summaryrefslogtreecommitdiff
path: root/modules/mbedtls
diff options
context:
space:
mode:
Diffstat (limited to 'modules/mbedtls')
-rw-r--r--modules/mbedtls/crypto_mbedtls.cpp149
-rw-r--r--modules/mbedtls/crypto_mbedtls.h18
-rw-r--r--modules/mbedtls/dtls_server_mbedtls.cpp2
-rw-r--r--modules/mbedtls/dtls_server_mbedtls.h1
-rw-r--r--[-rwxr-xr-x]modules/mbedtls/packet_peer_mbed_dtls.cpp33
-rw-r--r--[-rwxr-xr-x]modules/mbedtls/register_types.cpp2
-rw-r--r--modules/mbedtls/ssl_context_mbedtls.cpp19
-rw-r--r--modules/mbedtls/ssl_context_mbedtls.h2
-rw-r--r--[-rwxr-xr-x]modules/mbedtls/stream_peer_mbedtls.cpp34
9 files changed, 176 insertions, 84 deletions
diff --git a/modules/mbedtls/crypto_mbedtls.cpp b/modules/mbedtls/crypto_mbedtls.cpp
index a47a4503a5..501bfff075 100644
--- a/modules/mbedtls/crypto_mbedtls.cpp
+++ b/modules/mbedtls/crypto_mbedtls.cpp
@@ -50,7 +50,7 @@ CryptoKey *CryptoKeyMbedTLS::create() {
return memnew(CryptoKeyMbedTLS);
}
-Error CryptoKeyMbedTLS::load(String p_path) {
+Error CryptoKeyMbedTLS::load(String p_path, bool p_public_only) {
ERR_FAIL_COND_V_MSG(locks, ERR_ALREADY_IN_USE, "Key is in use");
PackedByteArray out;
@@ -59,42 +59,81 @@ Error CryptoKeyMbedTLS::load(String p_path) {
int flen = f->get_len();
out.resize(flen + 1);
- {
- uint8_t *w = out.ptrw();
- f->get_buffer(w, flen);
- w[flen] = 0; //end f string
- }
+ f->get_buffer(out.ptrw(), flen);
+ out.write[flen] = 0; // string terminator
memdelete(f);
- int ret = mbedtls_pk_parse_key(&pkey, out.ptr(), out.size(), nullptr, 0);
+ int ret = 0;
+ if (p_public_only) {
+ ret = mbedtls_pk_parse_public_key(&pkey, out.ptr(), out.size());
+ } else {
+ ret = mbedtls_pk_parse_key(&pkey, out.ptr(), out.size(), nullptr, 0);
+ }
// We MUST zeroize the memory for safety!
mbedtls_platform_zeroize(out.ptrw(), out.size());
- ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing private key '" + itos(ret) + "'.");
+ ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing key '" + itos(ret) + "'.");
+ public_only = p_public_only;
return OK;
}
-Error CryptoKeyMbedTLS::save(String p_path) {
+Error CryptoKeyMbedTLS::save(String p_path, bool p_public_only) {
FileAccess *f = FileAccess::open(p_path, FileAccess::WRITE);
ERR_FAIL_COND_V_MSG(!f, ERR_INVALID_PARAMETER, "Cannot save CryptoKeyMbedTLS file '" + p_path + "'.");
unsigned char w[16000];
memset(w, 0, sizeof(w));
- int ret = mbedtls_pk_write_key_pem(&pkey, w, sizeof(w));
+ int ret = 0;
+ if (p_public_only) {
+ ret = mbedtls_pk_write_pubkey_pem(&pkey, w, sizeof(w));
+ } else {
+ ret = mbedtls_pk_write_key_pem(&pkey, w, sizeof(w));
+ }
if (ret != 0) {
memdelete(f);
- memset(w, 0, sizeof(w)); // Zeroize anything we might have written.
+ mbedtls_platform_zeroize(w, sizeof(w)); // Zeroize anything we might have written.
ERR_FAIL_V_MSG(FAILED, "Error writing key '" + itos(ret) + "'.");
}
size_t len = strlen((char *)w);
f->store_buffer(w, len);
memdelete(f);
- memset(w, 0, sizeof(w)); // Zeroize temporary buffer.
+ mbedtls_platform_zeroize(w, sizeof(w)); // Zeroize temporary buffer.
return OK;
}
+Error CryptoKeyMbedTLS::load_from_string(String p_string_key, bool p_public_only) {
+ int ret = 0;
+ if (p_public_only) {
+ ret = mbedtls_pk_parse_public_key(&pkey, (unsigned char *)p_string_key.utf8().get_data(), p_string_key.utf8().size());
+ } else {
+ ret = mbedtls_pk_parse_key(&pkey, (unsigned char *)p_string_key.utf8().get_data(), p_string_key.utf8().size(), nullptr, 0);
+ }
+ ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing key '" + itos(ret) + "'.");
+
+ public_only = p_public_only;
+ return OK;
+}
+
+String CryptoKeyMbedTLS::save_to_string(bool p_public_only) {
+ unsigned char w[16000];
+ memset(w, 0, sizeof(w));
+
+ int ret = 0;
+ if (p_public_only) {
+ ret = mbedtls_pk_write_pubkey_pem(&pkey, w, sizeof(w));
+ } else {
+ ret = mbedtls_pk_write_key_pem(&pkey, w, sizeof(w));
+ }
+ if (ret != 0) {
+ mbedtls_platform_zeroize(w, sizeof(w));
+ ERR_FAIL_V_MSG("", "Error saving key '" + itos(ret) + "'.");
+ }
+ String s = String::utf8((char *)w);
+ return s;
+}
+
X509Certificate *X509CertificateMbedTLS::create() {
return memnew(X509CertificateMbedTLS);
}
@@ -108,11 +147,8 @@ Error X509CertificateMbedTLS::load(String p_path) {
int flen = f->get_len();
out.resize(flen + 1);
- {
- uint8_t *w = out.ptrw();
- f->get_buffer(w, flen);
- w[flen] = 0; //end f string
- }
+ f->get_buffer(out.ptrw(), flen);
+ out.write[flen] = 0; // string terminator
memdelete(f);
int ret = mbedtls_x509_crt_parse(&cert, out.ptr(), out.size());
@@ -155,7 +191,6 @@ Crypto *CryptoMbedTLS::create() {
}
void CryptoMbedTLS::initialize_crypto() {
-
#ifdef DEBUG_ENABLED
mbedtls_debug_set_threshold(1);
#endif
@@ -212,9 +247,8 @@ void CryptoMbedTLS::load_default_certificates(String p_path) {
// Use builtin certs only if user did not override it in project settings.
PackedByteArray out;
out.resize(_certs_uncompressed_size + 1);
- uint8_t *w = out.ptrw();
- Compression::decompress(w, _certs_uncompressed_size, _certs_compressed, _certs_compressed_size, Compression::MODE_DEFLATE);
- w[_certs_uncompressed_size] = 0; // Make sure it ends with string terminator
+ Compression::decompress(out.ptrw(), _certs_uncompressed_size, _certs_compressed, _certs_compressed_size, Compression::MODE_DEFLATE);
+ out.write[_certs_uncompressed_size] = 0; // Make sure it ends with string terminator
#ifdef DEBUG_ENABLED
print_verbose("Loaded builtin certs");
#endif
@@ -229,6 +263,7 @@ Ref<CryptoKey> CryptoMbedTLS::generate_rsa(int p_bytes) {
int ret = mbedtls_pk_setup(&(out->pkey), mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
ERR_FAIL_COND_V(ret != 0, nullptr);
ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(out->pkey), mbedtls_ctr_drbg_random, &ctr_drbg, p_bytes, 65537);
+ out->public_only = false;
ERR_FAIL_COND_V(ret != 0, nullptr);
return out;
}
@@ -282,3 +317,75 @@ PackedByteArray CryptoMbedTLS::generate_random_bytes(int p_bytes) {
mbedtls_ctr_drbg_random(&ctr_drbg, out.ptrw(), p_bytes);
return out;
}
+
+mbedtls_md_type_t CryptoMbedTLS::_md_type_from_hashtype(HashingContext::HashType p_hash_type, int &r_size) {
+ switch (p_hash_type) {
+ case HashingContext::HASH_MD5:
+ r_size = 16;
+ return MBEDTLS_MD_MD5;
+ case HashingContext::HASH_SHA1:
+ r_size = 20;
+ return MBEDTLS_MD_SHA1;
+ case HashingContext::HASH_SHA256:
+ r_size = 32;
+ return MBEDTLS_MD_SHA256;
+ default:
+ r_size = 0;
+ ERR_FAIL_V_MSG(MBEDTLS_MD_NONE, "Invalid hash type.");
+ }
+}
+
+Vector<uint8_t> CryptoMbedTLS::sign(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Ref<CryptoKey> p_key) {
+ int size;
+ mbedtls_md_type_t type = _md_type_from_hashtype(p_hash_type, size);
+ ERR_FAIL_COND_V_MSG(type == MBEDTLS_MD_NONE, Vector<uint8_t>(), "Invalid hash type.");
+ ERR_FAIL_COND_V_MSG(p_hash.size() != size, Vector<uint8_t>(), "Invalid hash provided. Size must be " + itos(size));
+ Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
+ ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
+ ERR_FAIL_COND_V_MSG(key->is_public_only(), Vector<uint8_t>(), "Invalid key provided. Cannot sign with public_only keys.");
+ size_t sig_size = 0;
+ unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
+ Vector<uint8_t> out;
+ int ret = mbedtls_pk_sign(&(key->pkey), type, p_hash.ptr(), size, buf, &sig_size, mbedtls_ctr_drbg_random, &ctr_drbg);
+ ERR_FAIL_COND_V_MSG(ret, out, "Error while signing: " + itos(ret));
+ out.resize(sig_size);
+ copymem(out.ptrw(), buf, sig_size);
+ return out;
+}
+
+bool CryptoMbedTLS::verify(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Vector<uint8_t> p_signature, Ref<CryptoKey> p_key) {
+ int size;
+ mbedtls_md_type_t type = _md_type_from_hashtype(p_hash_type, size);
+ ERR_FAIL_COND_V_MSG(type == MBEDTLS_MD_NONE, false, "Invalid hash type.");
+ ERR_FAIL_COND_V_MSG(p_hash.size() != size, false, "Invalid hash provided. Size must be " + itos(size));
+ Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
+ ERR_FAIL_COND_V_MSG(!key.is_valid(), false, "Invalid key provided.");
+ return mbedtls_pk_verify(&(key->pkey), type, p_hash.ptr(), size, p_signature.ptr(), p_signature.size()) == 0;
+}
+
+Vector<uint8_t> CryptoMbedTLS::encrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_plaintext) {
+ Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
+ ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
+ uint8_t buf[1024];
+ size_t size;
+ Vector<uint8_t> out;
+ int ret = mbedtls_pk_encrypt(&(key->pkey), p_plaintext.ptr(), p_plaintext.size(), buf, &size, sizeof(buf), mbedtls_ctr_drbg_random, &ctr_drbg);
+ ERR_FAIL_COND_V_MSG(ret, out, "Error while encrypting: " + itos(ret));
+ out.resize(size);
+ copymem(out.ptrw(), buf, size);
+ return out;
+}
+
+Vector<uint8_t> CryptoMbedTLS::decrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_ciphertext) {
+ Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
+ ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
+ ERR_FAIL_COND_V_MSG(key->is_public_only(), Vector<uint8_t>(), "Invalid key provided. Cannot decrypt using a public_only key.");
+ uint8_t buf[2048];
+ size_t size;
+ Vector<uint8_t> out;
+ int ret = mbedtls_pk_decrypt(&(key->pkey), p_ciphertext.ptr(), p_ciphertext.size(), buf, &size, sizeof(buf), mbedtls_ctr_drbg_random, &ctr_drbg);
+ ERR_FAIL_COND_V_MSG(ret, out, "Error while decrypting: " + itos(ret));
+ out.resize(size);
+ copymem(out.ptrw(), buf, size);
+ return out;
+}
diff --git a/modules/mbedtls/crypto_mbedtls.h b/modules/mbedtls/crypto_mbedtls.h
index db3d00a5e3..2a446f9d48 100644
--- a/modules/mbedtls/crypto_mbedtls.h
+++ b/modules/mbedtls/crypto_mbedtls.h
@@ -41,18 +41,21 @@
class CryptoMbedTLS;
class SSLContextMbedTLS;
class CryptoKeyMbedTLS : public CryptoKey {
-
private:
mbedtls_pk_context pkey;
- int locks;
+ int locks = 0;
+ bool public_only = true;
public:
static CryptoKey *create();
static void make_default() { CryptoKey::_create = create; }
static void finalize() { CryptoKey::_create = nullptr; }
- virtual Error load(String p_path);
- virtual Error save(String p_path);
+ virtual Error load(String p_path, bool p_public_only);
+ virtual Error save(String p_path, bool p_public_only);
+ virtual String save_to_string(bool p_public_only);
+ virtual Error load_from_string(String p_string_key, bool p_public_only);
+ virtual bool is_public_only() const { return public_only; };
CryptoKeyMbedTLS() {
mbedtls_pk_init(&pkey);
@@ -70,7 +73,6 @@ public:
};
class X509CertificateMbedTLS : public X509Certificate {
-
private:
mbedtls_x509_crt cert;
int locks;
@@ -100,11 +102,11 @@ public:
};
class CryptoMbedTLS : public Crypto {
-
private:
mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
static X509CertificateMbedTLS *default_certs;
+ mbedtls_md_type_t _md_type_from_hashtype(HashingContext::HashType p_hash_type, int &r_size);
public:
static Crypto *create();
@@ -116,6 +118,10 @@ public:
virtual PackedByteArray generate_random_bytes(int p_bytes);
virtual Ref<CryptoKey> generate_rsa(int p_bytes);
virtual Ref<X509Certificate> generate_self_signed_certificate(Ref<CryptoKey> p_key, String p_issuer_name, String p_not_before, String p_not_after);
+ virtual Vector<uint8_t> sign(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Ref<CryptoKey> p_key);
+ virtual bool verify(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Vector<uint8_t> p_signature, Ref<CryptoKey> p_key);
+ virtual Vector<uint8_t> encrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_plaintext);
+ virtual Vector<uint8_t> decrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_ciphertext);
CryptoMbedTLS();
~CryptoMbedTLS();
diff --git a/modules/mbedtls/dtls_server_mbedtls.cpp b/modules/mbedtls/dtls_server_mbedtls.cpp
index f31f067f4e..d9961b026f 100644
--- a/modules/mbedtls/dtls_server_mbedtls.cpp
+++ b/modules/mbedtls/dtls_server_mbedtls.cpp
@@ -54,12 +54,10 @@ Ref<PacketPeerDTLS> DTLSServerMbedTLS::take_connection(Ref<PacketPeerUDP> p_udp_
}
DTLSServer *DTLSServerMbedTLS::_create_func() {
-
return memnew(DTLSServerMbedTLS);
}
void DTLSServerMbedTLS::initialize() {
-
_create = _create_func;
available = true;
}
diff --git a/modules/mbedtls/dtls_server_mbedtls.h b/modules/mbedtls/dtls_server_mbedtls.h
index d61ab3179e..d93553bf7f 100644
--- a/modules/mbedtls/dtls_server_mbedtls.h
+++ b/modules/mbedtls/dtls_server_mbedtls.h
@@ -35,7 +35,6 @@
#include "ssl_context_mbedtls.h"
class DTLSServerMbedTLS : public DTLSServer {
-
private:
static DTLSServer *_create_func();
Ref<CryptoKey> _key;
diff --git a/modules/mbedtls/packet_peer_mbed_dtls.cpp b/modules/mbedtls/packet_peer_mbed_dtls.cpp
index b2aa5f5827..8206d739ae 100755..100644
--- a/modules/mbedtls/packet_peer_mbed_dtls.cpp
+++ b/modules/mbedtls/packet_peer_mbed_dtls.cpp
@@ -35,8 +35,9 @@
#include "core/os/file_access.h"
int PacketPeerMbedDTLS::bio_send(void *ctx, const unsigned char *buf, size_t len) {
-
- if (buf == nullptr || len <= 0) return 0;
+ if (buf == nullptr || len <= 0) {
+ return 0;
+ }
PacketPeerMbedDTLS *sp = (PacketPeerMbedDTLS *)ctx;
@@ -52,8 +53,9 @@ int PacketPeerMbedDTLS::bio_send(void *ctx, const unsigned char *buf, size_t len
}
int PacketPeerMbedDTLS::bio_recv(void *ctx, unsigned char *buf, size_t len) {
-
- if (buf == nullptr || len <= 0) return 0;
+ if (buf == nullptr || len <= 0) {
+ return 0;
+ }
PacketPeerMbedDTLS *sp = (PacketPeerMbedDTLS *)ctx;
@@ -77,7 +79,6 @@ int PacketPeerMbedDTLS::bio_recv(void *ctx, unsigned char *buf, size_t len) {
}
void PacketPeerMbedDTLS::_cleanup() {
-
ssl_ctx->clear();
base = Ref<PacketPeer>();
status = STATUS_DISCONNECTED;
@@ -114,7 +115,6 @@ Error PacketPeerMbedDTLS::_do_handshake() {
}
Error PacketPeerMbedDTLS::connect_to_peer(Ref<PacketPeerUDP> p_base, bool p_validate_certs, const String &p_for_hostname, Ref<X509Certificate> p_ca_certs) {
-
ERR_FAIL_COND_V(!p_base.is_valid() || !p_base->is_connected_to_host(), ERR_INVALID_PARAMETER);
base = p_base;
@@ -139,7 +139,6 @@ Error PacketPeerMbedDTLS::connect_to_peer(Ref<PacketPeerUDP> p_base, bool p_vali
}
Error PacketPeerMbedDTLS::accept_peer(Ref<PacketPeerUDP> p_base, Ref<CryptoKey> p_key, Ref<X509Certificate> p_cert, Ref<X509Certificate> p_ca_chain, Ref<CookieContextMbedTLS> p_cookies) {
-
Error err = ssl_ctx->init_server(MBEDTLS_SSL_TRANSPORT_DATAGRAM, MBEDTLS_SSL_VERIFY_NONE, p_key, p_cert, p_cookies);
ERR_FAIL_COND_V(err != OK, err);
@@ -168,11 +167,11 @@ Error PacketPeerMbedDTLS::accept_peer(Ref<PacketPeerUDP> p_base, Ref<CryptoKey>
}
Error PacketPeerMbedDTLS::put_packet(const uint8_t *p_buffer, int p_bytes) {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
- if (p_bytes == 0)
+ if (p_bytes == 0) {
return OK;
+ }
int ret = mbedtls_ssl_write(ssl_ctx->get_context(), p_buffer, p_bytes);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
@@ -187,7 +186,6 @@ Error PacketPeerMbedDTLS::put_packet(const uint8_t *p_buffer, int p_bytes) {
}
Error PacketPeerMbedDTLS::get_packet(const uint8_t **r_buffer, int &r_bytes) {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
r_bytes = 0;
@@ -213,7 +211,6 @@ Error PacketPeerMbedDTLS::get_packet(const uint8_t **r_buffer, int &r_bytes) {
}
void PacketPeerMbedDTLS::poll() {
-
if (status == STATUS_HANDSHAKING) {
_do_handshake();
return;
@@ -238,19 +235,16 @@ void PacketPeerMbedDTLS::poll() {
}
int PacketPeerMbedDTLS::get_available_packet_count() const {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, 0);
return mbedtls_ssl_get_bytes_avail(&(ssl_ctx->ssl)) > 0 ? 1 : 0;
}
int PacketPeerMbedDTLS::get_max_packet_size() const {
-
return 488; // 512 (UDP in Godot) - 24 (DTLS header)
}
PacketPeerMbedDTLS::PacketPeerMbedDTLS() {
-
ssl_ctx.instance();
status = STATUS_DISCONNECTED;
}
@@ -260,33 +254,30 @@ PacketPeerMbedDTLS::~PacketPeerMbedDTLS() {
}
void PacketPeerMbedDTLS::disconnect_from_peer() {
-
- if (status != STATUS_CONNECTED && status != STATUS_HANDSHAKING)
+ if (status != STATUS_CONNECTED && status != STATUS_HANDSHAKING) {
return;
+ }
if (status == STATUS_CONNECTED) {
int ret = 0;
// Send SSL close notification, blocking, but ignore other errors.
- do
+ do {
ret = mbedtls_ssl_close_notify(ssl_ctx->get_context());
- while (ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+ } while (ret == MBEDTLS_ERR_SSL_WANT_WRITE);
}
_cleanup();
}
PacketPeerMbedDTLS::Status PacketPeerMbedDTLS::get_status() const {
-
return status;
}
PacketPeerDTLS *PacketPeerMbedDTLS::_create_func() {
-
return memnew(PacketPeerMbedDTLS);
}
void PacketPeerMbedDTLS::initialize_dtls() {
-
_create = _create_func;
available = true;
}
diff --git a/modules/mbedtls/register_types.cpp b/modules/mbedtls/register_types.cpp
index d39af7fe87..84a27c29bd 100755..100644
--- a/modules/mbedtls/register_types.cpp
+++ b/modules/mbedtls/register_types.cpp
@@ -36,7 +36,6 @@
#include "stream_peer_mbedtls.h"
void register_mbedtls_types() {
-
CryptoMbedTLS::initialize_crypto();
StreamPeerMbedTLS::initialize_ssl();
PacketPeerMbedDTLS::initialize_dtls();
@@ -44,7 +43,6 @@ void register_mbedtls_types() {
}
void unregister_mbedtls_types() {
-
DTLSServerMbedTLS::finalize();
PacketPeerMbedDTLS::finalize_dtls();
StreamPeerMbedTLS::finalize_ssl();
diff --git a/modules/mbedtls/ssl_context_mbedtls.cpp b/modules/mbedtls/ssl_context_mbedtls.cpp
index 1ffb9bda05..a2200e0644 100644
--- a/modules/mbedtls/ssl_context_mbedtls.cpp
+++ b/modules/mbedtls/ssl_context_mbedtls.cpp
@@ -33,7 +33,6 @@
static void my_debug(void *ctx, int level,
const char *file, int line,
const char *str) {
-
printf("%s:%04d: %s", file, line, str);
fflush(stdout);
}
@@ -68,8 +67,9 @@ Error CookieContextMbedTLS::setup() {
}
void CookieContextMbedTLS::clear() {
- if (!inited)
+ if (!inited) {
return;
+ }
mbedtls_ctr_drbg_free(&ctr_drbg);
mbedtls_entropy_free(&entropy);
mbedtls_ssl_cookie_free(&cookie_ctx);
@@ -121,10 +121,12 @@ Error SSLContextMbedTLS::init_server(int p_transport, int p_authmode, Ref<Crypto
// Locking key and certificate(s)
pkey = p_pkey;
certs = p_cert;
- if (pkey.is_valid())
+ if (pkey.is_valid()) {
pkey->lock();
- if (certs.is_valid())
+ }
+ if (certs.is_valid()) {
certs->lock();
+ }
// Adding key and certificate
int ret = mbedtls_ssl_conf_own_cert(&conf, &(certs->cert), &(pkey->pkey));
@@ -176,19 +178,22 @@ Error SSLContextMbedTLS::init_client(int p_transport, int p_authmode, Ref<X509Ce
}
void SSLContextMbedTLS::clear() {
- if (!inited)
+ if (!inited) {
return;
+ }
mbedtls_ssl_free(&ssl);
mbedtls_ssl_config_free(&conf);
mbedtls_ctr_drbg_free(&ctr_drbg);
mbedtls_entropy_free(&entropy);
// Unlock and key and certificates
- if (certs.is_valid())
+ if (certs.is_valid()) {
certs->unlock();
+ }
certs = Ref<X509Certificate>();
- if (pkey.is_valid())
+ if (pkey.is_valid()) {
pkey->unlock();
+ }
pkey = Ref<CryptoKeyMbedTLS>();
cookies = Ref<CookieContextMbedTLS>();
inited = false;
diff --git a/modules/mbedtls/ssl_context_mbedtls.h b/modules/mbedtls/ssl_context_mbedtls.h
index d3e1f87a8e..baaeb6eb85 100644
--- a/modules/mbedtls/ssl_context_mbedtls.h
+++ b/modules/mbedtls/ssl_context_mbedtls.h
@@ -47,7 +47,6 @@
class SSLContextMbedTLS;
class CookieContextMbedTLS : public Reference {
-
friend class SSLContextMbedTLS;
protected:
@@ -65,7 +64,6 @@ public:
};
class SSLContextMbedTLS : public Reference {
-
protected:
bool inited;
diff --git a/modules/mbedtls/stream_peer_mbedtls.cpp b/modules/mbedtls/stream_peer_mbedtls.cpp
index 983095c536..e9a610b7ee 100755..100644
--- a/modules/mbedtls/stream_peer_mbedtls.cpp
+++ b/modules/mbedtls/stream_peer_mbedtls.cpp
@@ -34,8 +34,9 @@
#include "core/os/file_access.h"
int StreamPeerMbedTLS::bio_send(void *ctx, const unsigned char *buf, size_t len) {
-
- if (buf == nullptr || len <= 0) return 0;
+ if (buf == nullptr || len <= 0) {
+ return 0;
+ }
StreamPeerMbedTLS *sp = (StreamPeerMbedTLS *)ctx;
@@ -53,8 +54,9 @@ int StreamPeerMbedTLS::bio_send(void *ctx, const unsigned char *buf, size_t len)
}
int StreamPeerMbedTLS::bio_recv(void *ctx, unsigned char *buf, size_t len) {
-
- if (buf == nullptr || len <= 0) return 0;
+ if (buf == nullptr || len <= 0) {
+ return 0;
+ }
StreamPeerMbedTLS *sp = (StreamPeerMbedTLS *)ctx;
@@ -72,7 +74,6 @@ int StreamPeerMbedTLS::bio_recv(void *ctx, unsigned char *buf, size_t len) {
}
void StreamPeerMbedTLS::_cleanup() {
-
ssl_ctx->clear();
base = Ref<StreamPeer>();
status = STATUS_DISCONNECTED;
@@ -102,7 +103,6 @@ Error StreamPeerMbedTLS::_do_handshake() {
}
Error StreamPeerMbedTLS::connect_to_stream(Ref<StreamPeer> p_base, bool p_validate_certs, const String &p_for_hostname, Ref<X509Certificate> p_ca_certs) {
-
ERR_FAIL_COND_V(p_base.is_null(), ERR_INVALID_PARAMETER);
base = p_base;
@@ -125,7 +125,6 @@ Error StreamPeerMbedTLS::connect_to_stream(Ref<StreamPeer> p_base, bool p_valida
}
Error StreamPeerMbedTLS::accept_stream(Ref<StreamPeer> p_base, Ref<CryptoKey> p_key, Ref<X509Certificate> p_cert, Ref<X509Certificate> p_ca_chain) {
-
ERR_FAIL_COND_V(p_base.is_null(), ERR_INVALID_PARAMETER);
Error err = ssl_ctx->init_server(MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_VERIFY_NONE, p_key, p_cert);
@@ -144,8 +143,8 @@ Error StreamPeerMbedTLS::accept_stream(Ref<StreamPeer> p_base, Ref<CryptoKey> p_
status = STATUS_CONNECTED;
return OK;
}
-Error StreamPeerMbedTLS::put_data(const uint8_t *p_data, int p_bytes) {
+Error StreamPeerMbedTLS::put_data(const uint8_t *p_data, int p_bytes) {
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
Error err;
@@ -166,13 +165,13 @@ Error StreamPeerMbedTLS::put_data(const uint8_t *p_data, int p_bytes) {
}
Error StreamPeerMbedTLS::put_partial_data(const uint8_t *p_data, int p_bytes, int &r_sent) {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
r_sent = 0;
- if (p_bytes == 0)
+ if (p_bytes == 0) {
return OK;
+ }
int ret = mbedtls_ssl_write(ssl_ctx->get_context(), p_data, p_bytes);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
@@ -193,14 +192,12 @@ Error StreamPeerMbedTLS::put_partial_data(const uint8_t *p_data, int p_bytes, in
}
Error StreamPeerMbedTLS::get_data(uint8_t *p_buffer, int p_bytes) {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
Error err;
int got = 0;
while (p_bytes > 0) {
-
err = get_partial_data(p_buffer, p_bytes, got);
if (err != OK) {
@@ -215,7 +212,6 @@ Error StreamPeerMbedTLS::get_data(uint8_t *p_buffer, int p_bytes) {
}
Error StreamPeerMbedTLS::get_partial_data(uint8_t *p_buffer, int p_bytes, int &r_received) {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, ERR_UNCONFIGURED);
r_received = 0;
@@ -238,7 +234,6 @@ Error StreamPeerMbedTLS::get_partial_data(uint8_t *p_buffer, int p_bytes, int &r
}
void StreamPeerMbedTLS::poll() {
-
ERR_FAIL_COND(status != STATUS_CONNECTED && status != STATUS_HANDSHAKING);
ERR_FAIL_COND(!base.is_valid());
@@ -272,13 +267,12 @@ void StreamPeerMbedTLS::poll() {
}
int StreamPeerMbedTLS::get_available_bytes() const {
-
ERR_FAIL_COND_V(status != STATUS_CONNECTED, 0);
return mbedtls_ssl_get_bytes_avail(&(ssl_ctx->ssl));
}
-StreamPeerMbedTLS::StreamPeerMbedTLS() {
+StreamPeerMbedTLS::StreamPeerMbedTLS() {
ssl_ctx.instance();
status = STATUS_DISCONNECTED;
}
@@ -288,9 +282,9 @@ StreamPeerMbedTLS::~StreamPeerMbedTLS() {
}
void StreamPeerMbedTLS::disconnect_from_stream() {
-
- if (status != STATUS_CONNECTED && status != STATUS_HANDSHAKING)
+ if (status != STATUS_CONNECTED && status != STATUS_HANDSHAKING) {
return;
+ }
Ref<StreamPeerTCP> tcp = base;
if (tcp.is_valid() && tcp->get_status() == StreamPeerTCP::STATUS_CONNECTED) {
@@ -302,23 +296,19 @@ void StreamPeerMbedTLS::disconnect_from_stream() {
}
StreamPeerMbedTLS::Status StreamPeerMbedTLS::get_status() const {
-
return status;
}
StreamPeerSSL *StreamPeerMbedTLS::_create_func() {
-
return memnew(StreamPeerMbedTLS);
}
void StreamPeerMbedTLS::initialize_ssl() {
-
_create = _create_func;
available = true;
}
void StreamPeerMbedTLS::finalize_ssl() {
-
available = false;
_create = nullptr;
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-21 19:40:45 +0000