From d06af89874a4fb3c2baeb8da7968011531642cf8 Mon Sep 17 00:00:00 2001 From: Fabio Alessandrelli Date: Mon, 13 Jan 2020 17:10:18 +0100 Subject: Move mbedlts print func to SSLMbedTLSContext. --- modules/mbedtls/ssl_context_mbedtls.cpp | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'modules/mbedtls/ssl_context_mbedtls.cpp') diff --git a/modules/mbedtls/ssl_context_mbedtls.cpp b/modules/mbedtls/ssl_context_mbedtls.cpp index 82584e3494..1259897988 100644 --- a/modules/mbedtls/ssl_context_mbedtls.cpp +++ b/modules/mbedtls/ssl_context_mbedtls.cpp @@ -38,6 +38,11 @@ static void my_debug(void *ctx, int level, fflush(stdout); } +void SSLContextMbedTLS::print_mbedtls_error(int p_ret) { + printf("mbedtls error: returned -0x%x\n\n", -p_ret); + fflush(stdout); +} + Error SSLContextMbedTLS::_setup(int p_endpoint, int p_transport, int p_authmode) { ERR_FAIL_COND_V_MSG(inited, ERR_ALREADY_IN_USE, "This SSL context is already active"); -- cgit v1.2.3 From 6fc50d785e98bbd1d82755630345b692c8fc153b Mon Sep 17 00:00:00 2001 From: Fabio Alessandrelli Date: Wed, 21 Aug 2019 22:52:24 +0200 Subject: New PacketPeerDTLS and DTLSServer classes. Custom instance implementation via the mbedtls module. --- modules/mbedtls/ssl_context_mbedtls.cpp | 56 +++++++++++++++++++++++++++++++-- 1 file changed, 54 insertions(+), 2 deletions(-) (limited to 'modules/mbedtls/ssl_context_mbedtls.cpp') diff --git a/modules/mbedtls/ssl_context_mbedtls.cpp b/modules/mbedtls/ssl_context_mbedtls.cpp index 1259897988..52630bd98c 100644 --- a/modules/mbedtls/ssl_context_mbedtls.cpp +++ b/modules/mbedtls/ssl_context_mbedtls.cpp @@ -43,6 +43,48 @@ void SSLContextMbedTLS::print_mbedtls_error(int p_ret) { fflush(stdout); } +/// CookieContextMbedTLS + +Error CookieContextMbedTLS::setup() { + ERR_FAIL_COND_V_MSG(inited, ERR_ALREADY_IN_USE, "This cookie context is already in use"); + + mbedtls_ctr_drbg_init(&ctr_drbg); + mbedtls_entropy_init(&entropy); + mbedtls_ssl_cookie_init(&cookie_ctx); + inited = true; + + int ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0); + if (ret != 0) { + clear(); // Never leave unusable resources around. + ERR_FAIL_V_MSG(FAILED, "mbedtls_ctr_drbg_seed returned an error " + itos(ret)); + } + + ret = mbedtls_ssl_cookie_setup(&cookie_ctx, mbedtls_ctr_drbg_random, &ctr_drbg); + if (ret != 0) { + clear(); + ERR_FAIL_V_MSG(FAILED, "mbedtls_ssl_cookie_setup returned an error " + itos(ret)); + } + return OK; +} + +void CookieContextMbedTLS::clear() { + if (!inited) + return; + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); + mbedtls_ssl_cookie_free(&cookie_ctx); +} + +CookieContextMbedTLS::CookieContextMbedTLS() { + inited = false; +} + +CookieContextMbedTLS::~CookieContextMbedTLS() { + clear(); +} + +/// SSLContextMbedTLS + Error SSLContextMbedTLS::_setup(int p_endpoint, int p_transport, int p_authmode) { ERR_FAIL_COND_V_MSG(inited, ERR_ALREADY_IN_USE, "This SSL context is already active"); @@ -55,7 +97,7 @@ Error SSLContextMbedTLS::_setup(int p_endpoint, int p_transport, int p_authmode) int ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0); if (ret != 0) { clear(); // Never leave unusable resources around. - ERR_FAIL_V_MSG(FAILED, "mbedtls_ctr_drbg_seed returned an error" + itos(ret)); + ERR_FAIL_V_MSG(FAILED, "mbedtls_ctr_drbg_seed returned an error " + itos(ret)); } ret = mbedtls_ssl_config_defaults(&conf, p_endpoint, p_transport, MBEDTLS_SSL_PRESET_DEFAULT); @@ -69,7 +111,7 @@ Error SSLContextMbedTLS::_setup(int p_endpoint, int p_transport, int p_authmode) return OK; } -Error SSLContextMbedTLS::init_server(int p_transport, int p_authmode, Ref p_pkey, Ref p_cert) { +Error SSLContextMbedTLS::init_server(int p_transport, int p_authmode, Ref p_pkey, Ref p_cert, Ref p_cookies) { ERR_FAIL_COND_V(!p_pkey.is_valid(), ERR_INVALID_PARAMETER); ERR_FAIL_COND_V(!p_cert.is_valid(), ERR_INVALID_PARAMETER); @@ -94,6 +136,15 @@ Error SSLContextMbedTLS::init_server(int p_transport, int p_authmode, Refcert.next) { mbedtls_ssl_conf_ca_chain(&conf, certs->cert.next, NULL); } + // DTLS Cookies + if (p_transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { + if (p_cookies.is_null() || !p_cookies->inited) { + clear(); + ERR_FAIL_V(ERR_BUG); + } + cookies = p_cookies; + mbedtls_ssl_conf_dtls_cookies(&conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &(cookies->cookie_ctx)); + } mbedtls_ssl_setup(&ssl, &conf); return OK; } @@ -139,6 +190,7 @@ void SSLContextMbedTLS::clear() { if (pkey.is_valid()) pkey->unlock(); pkey = Ref(); + cookies = Ref(); inited = false; } -- cgit v1.2.3