mirror of
https://github.com/godotengine/godot
synced 2024-07-19 20:26:19 +00:00
mbedTLS: disable weak crypto and TLS versions.
This commit adds a new mbedTLS configuration header to customize the built-in library (and can be optionally replaced by a platform-specific one). Currently, it disables most weak cryptographic functions (with the notable exceptions of MD5 and SHA-1), along with removing support for TLS versions 1.0 and 1.1 (making TLSv1.2 the only supported one).
This commit is contained in:
Fabio Alessandrelli
parent
bee96aa5cb
commit
024a4b1f2a
|
|
@ -20,12 +20,13 @@ if is_builtin or not has_module:
|
|||
# Only if the module is not enabled, we must compile here the required sources
|
||||
# to make a "light" build with only the necessary mbedtls files.
|
||||
if not has_module:
|
||||
env_thirdparty = env_crypto.Clone()
|
||||
env_thirdparty.disable_warnings()
|
||||
# Custom config file
|
||||
env_thirdparty.Append(
|
||||
# Minimal mbedTLS config file
|
||||
env_crypto.Append(
|
||||
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_core_mbedtls_config.h\\"')]
|
||||
)
|
||||
# Build minimal mbedTLS library (MD5/SHA/Base64/AES).
|
||||
env_thirdparty = env_crypto.Clone()
|
||||
env_thirdparty.disable_warnings()
|
||||
thirdparty_mbedtls_dir = "#thirdparty/mbedtls/library/"
|
||||
thirdparty_mbedtls_sources = [
|
||||
"aes.c",
|
||||
|
|
@ -40,8 +41,16 @@ if not has_module:
|
|||
]
|
||||
thirdparty_mbedtls_sources = [thirdparty_mbedtls_dir + file for file in thirdparty_mbedtls_sources]
|
||||
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_mbedtls_sources)
|
||||
# Needed to force rebuilding the library when the configuration file is updated.
|
||||
env_thirdparty.Depends(thirdparty_obj, "#thirdparty/mbedtls/include/godot_core_mbedtls_config.h")
|
||||
env.core_sources += thirdparty_obj
|
||||
|
||||
elif is_builtin:
|
||||
# Module mbedTLS config file
|
||||
env_crypto.Append(
|
||||
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_module_mbedtls_config.h\\"')]
|
||||
)
|
||||
# Needed to force rebuilding the core files when the configuration file is updated.
|
||||
thirdparty_obj = ["#thirdparty/mbedtls/include/godot_module_mbedtls_config.h"]
|
||||
|
||||
# Godot source files
|
||||
|
||||
|
|
|
|||
|
|
@ -100,10 +100,14 @@ if env["builtin_mbedtls"]:
|
|||
thirdparty_sources = [thirdparty_dir + file for file in thirdparty_sources]
|
||||
|
||||
env_mbed_tls.Prepend(CPPPATH=["#thirdparty/mbedtls/include/"])
|
||||
env_mbed_tls.Append(
|
||||
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_module_mbedtls_config.h\\"')]
|
||||
)
|
||||
|
||||
env_thirdparty = env_mbed_tls.Clone()
|
||||
env_thirdparty.disable_warnings()
|
||||
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_sources)
|
||||
env_thirdparty.Depends(thirdparty_obj, "#thirdparty/mbedtls/include/godot_module_mbedtls_config.h")
|
||||
env.modules_sources += thirdparty_obj
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -29,7 +29,6 @@
|
|||
/**************************************************************************/
|
||||
|
||||
#include "packet_peer_mbed_dtls.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include "core/io/file_access.h"
|
||||
#include "core/io/stream_peer_tls.h"
|
||||
|
|
|
|||
1
thirdparty/README.md
vendored
1
thirdparty/README.md
vendored
|
|
@ -378,6 +378,7 @@ File extracted from upstream release tarball:
|
|||
Applied the patch in `patches/windows-arm64-hardclock.diff`
|
||||
- Added 2 files `godot_core_mbedtls_platform.c` and `godot_core_mbedtls_config.h`
|
||||
providing configuration for light bundling with core.
|
||||
- Added the file `godot_module_mbedtls_config.h` to customize the build configuration when bundling the full library.
|
||||
|
||||
|
||||
## meshoptimizer
|
||||
|
|
|
|||
|
|
@ -1,3 +1,38 @@
|
|||
/**************************************************************************/
|
||||
/* godot_core_mbedtls_config.h */
|
||||
/**************************************************************************/
|
||||
/* This file is part of: */
|
||||
/* GODOT ENGINE */
|
||||
/* https://godotengine.org */
|
||||
/**************************************************************************/
|
||||
/* Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md). */
|
||||
/* Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur. */
|
||||
/* */
|
||||
/* Permission is hereby granted, free of charge, to any person obtaining */
|
||||
/* a copy of this software and associated documentation files (the */
|
||||
/* "Software"), to deal in the Software without restriction, including */
|
||||
/* without limitation the rights to use, copy, modify, merge, publish, */
|
||||
/* distribute, sublicense, and/or sell copies of the Software, and to */
|
||||
/* permit persons to whom the Software is furnished to do so, subject to */
|
||||
/* the following conditions: */
|
||||
/* */
|
||||
/* The above copyright notice and this permission notice shall be */
|
||||
/* included in all copies or substantial portions of the Software. */
|
||||
/* */
|
||||
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
|
||||
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
|
||||
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. */
|
||||
/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
|
||||
/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
|
||||
/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
|
||||
/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
|
||||
/**************************************************************************/
|
||||
|
||||
#ifndef GODOT_CORE_MBEDTLS_CONFIG_H
|
||||
#define GODOT_CORE_MBEDTLS_CONFIG_H
|
||||
|
||||
#include <limits.h>
|
||||
|
||||
// For AES
|
||||
#define MBEDTLS_CIPHER_MODE_CBC
|
||||
#define MBEDTLS_CIPHER_MODE_CFB
|
||||
|
|
@ -15,4 +50,4 @@
|
|||
#define MBEDTLS_PLATFORM_ZEROIZE_ALT
|
||||
#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
||||
|
||||
#include <limits.h>
|
||||
#endif // GODOT_CORE_MBEDTLS_CONFIG_H
|
||||
|
|
|
|||
58
thirdparty/mbedtls/include/godot_module_mbedtls_config.h
vendored
Normal file
58
thirdparty/mbedtls/include/godot_module_mbedtls_config.h
vendored
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
/**************************************************************************/
|
||||
/* godot_module_mbedtls_config.h */
|
||||
/**************************************************************************/
|
||||
/* This file is part of: */
|
||||
/* GODOT ENGINE */
|
||||
/* https://godotengine.org */
|
||||
/**************************************************************************/
|
||||
/* Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md). */
|
||||
/* Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur. */
|
||||
/* */
|
||||
/* Permission is hereby granted, free of charge, to any person obtaining */
|
||||
/* a copy of this software and associated documentation files (the */
|
||||
/* "Software"), to deal in the Software without restriction, including */
|
||||
/* without limitation the rights to use, copy, modify, merge, publish, */
|
||||
/* distribute, sublicense, and/or sell copies of the Software, and to */
|
||||
/* permit persons to whom the Software is furnished to do so, subject to */
|
||||
/* the following conditions: */
|
||||
/* */
|
||||
/* The above copyright notice and this permission notice shall be */
|
||||
/* included in all copies or substantial portions of the Software. */
|
||||
/* */
|
||||
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
|
||||
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
|
||||
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. */
|
||||
/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
|
||||
/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
|
||||
/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
|
||||
/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
|
||||
/**************************************************************************/
|
||||
|
||||
#ifndef GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||
#define GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||
|
||||
#include "platform_config.h"
|
||||
|
||||
#ifdef GODOT_MBEDTLS_INCLUDE_H
|
||||
|
||||
// Allow platforms to customize the mbedTLS configuration.
|
||||
#include GODOT_MBEDTLS_INCLUDE_H
|
||||
|
||||
#else
|
||||
|
||||
// Include default mbedTLS config.
|
||||
#include <mbedtls/config.h>
|
||||
|
||||
// Disable weak cryptography.
|
||||
#undef MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
|
||||
#undef MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
|
||||
#undef MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||||
#undef MBEDTLS_SSL_PROTO_TLS1
|
||||
#undef MBEDTLS_SSL_PROTO_TLS1_1
|
||||
#undef MBEDTLS_ARC4_C
|
||||
#undef MBEDTLS_DES_C
|
||||
#undef MBEDTLS_DHM_C
|
||||
|
||||
#endif // GODOT_MBEDTLS_INCLUDE_H
|
||||
|
||||
#endif // GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||
Loading…
Reference in a new issue