mirror of
https://github.com/godotengine/godot
synced 2024-09-05 07:18:49 +00:00
mbedTLS: disable weak crypto and TLS versions.
This commit adds a new mbedTLS configuration header to customize the built-in library (and can be optionally replaced by a platform-specific one). Currently, it disables most weak cryptographic functions (with the notable exceptions of MD5 and SHA-1), along with removing support for TLS versions 1.0 and 1.1 (making TLSv1.2 the only supported one).
This commit is contained in:
parent
bee96aa5cb
commit
024a4b1f2a
|
@ -20,12 +20,13 @@ if is_builtin or not has_module:
|
||||||
# Only if the module is not enabled, we must compile here the required sources
|
# Only if the module is not enabled, we must compile here the required sources
|
||||||
# to make a "light" build with only the necessary mbedtls files.
|
# to make a "light" build with only the necessary mbedtls files.
|
||||||
if not has_module:
|
if not has_module:
|
||||||
env_thirdparty = env_crypto.Clone()
|
# Minimal mbedTLS config file
|
||||||
env_thirdparty.disable_warnings()
|
env_crypto.Append(
|
||||||
# Custom config file
|
|
||||||
env_thirdparty.Append(
|
|
||||||
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_core_mbedtls_config.h\\"')]
|
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_core_mbedtls_config.h\\"')]
|
||||||
)
|
)
|
||||||
|
# Build minimal mbedTLS library (MD5/SHA/Base64/AES).
|
||||||
|
env_thirdparty = env_crypto.Clone()
|
||||||
|
env_thirdparty.disable_warnings()
|
||||||
thirdparty_mbedtls_dir = "#thirdparty/mbedtls/library/"
|
thirdparty_mbedtls_dir = "#thirdparty/mbedtls/library/"
|
||||||
thirdparty_mbedtls_sources = [
|
thirdparty_mbedtls_sources = [
|
||||||
"aes.c",
|
"aes.c",
|
||||||
|
@ -40,8 +41,16 @@ if not has_module:
|
||||||
]
|
]
|
||||||
thirdparty_mbedtls_sources = [thirdparty_mbedtls_dir + file for file in thirdparty_mbedtls_sources]
|
thirdparty_mbedtls_sources = [thirdparty_mbedtls_dir + file for file in thirdparty_mbedtls_sources]
|
||||||
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_mbedtls_sources)
|
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_mbedtls_sources)
|
||||||
|
# Needed to force rebuilding the library when the configuration file is updated.
|
||||||
|
env_thirdparty.Depends(thirdparty_obj, "#thirdparty/mbedtls/include/godot_core_mbedtls_config.h")
|
||||||
env.core_sources += thirdparty_obj
|
env.core_sources += thirdparty_obj
|
||||||
|
elif is_builtin:
|
||||||
|
# Module mbedTLS config file
|
||||||
|
env_crypto.Append(
|
||||||
|
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_module_mbedtls_config.h\\"')]
|
||||||
|
)
|
||||||
|
# Needed to force rebuilding the core files when the configuration file is updated.
|
||||||
|
thirdparty_obj = ["#thirdparty/mbedtls/include/godot_module_mbedtls_config.h"]
|
||||||
|
|
||||||
# Godot source files
|
# Godot source files
|
||||||
|
|
||||||
|
|
|
@ -100,10 +100,14 @@ if env["builtin_mbedtls"]:
|
||||||
thirdparty_sources = [thirdparty_dir + file for file in thirdparty_sources]
|
thirdparty_sources = [thirdparty_dir + file for file in thirdparty_sources]
|
||||||
|
|
||||||
env_mbed_tls.Prepend(CPPPATH=["#thirdparty/mbedtls/include/"])
|
env_mbed_tls.Prepend(CPPPATH=["#thirdparty/mbedtls/include/"])
|
||||||
|
env_mbed_tls.Append(
|
||||||
|
CPPDEFINES=[("MBEDTLS_CONFIG_FILE", '\\"thirdparty/mbedtls/include/godot_module_mbedtls_config.h\\"')]
|
||||||
|
)
|
||||||
|
|
||||||
env_thirdparty = env_mbed_tls.Clone()
|
env_thirdparty = env_mbed_tls.Clone()
|
||||||
env_thirdparty.disable_warnings()
|
env_thirdparty.disable_warnings()
|
||||||
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_sources)
|
env_thirdparty.add_source_files(thirdparty_obj, thirdparty_sources)
|
||||||
|
env_thirdparty.Depends(thirdparty_obj, "#thirdparty/mbedtls/include/godot_module_mbedtls_config.h")
|
||||||
env.modules_sources += thirdparty_obj
|
env.modules_sources += thirdparty_obj
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -29,7 +29,6 @@
|
||||||
/**************************************************************************/
|
/**************************************************************************/
|
||||||
|
|
||||||
#include "packet_peer_mbed_dtls.h"
|
#include "packet_peer_mbed_dtls.h"
|
||||||
#include "mbedtls/platform_util.h"
|
|
||||||
|
|
||||||
#include "core/io/file_access.h"
|
#include "core/io/file_access.h"
|
||||||
#include "core/io/stream_peer_tls.h"
|
#include "core/io/stream_peer_tls.h"
|
||||||
|
|
1
thirdparty/README.md
vendored
1
thirdparty/README.md
vendored
|
@ -378,6 +378,7 @@ File extracted from upstream release tarball:
|
||||||
Applied the patch in `patches/windows-arm64-hardclock.diff`
|
Applied the patch in `patches/windows-arm64-hardclock.diff`
|
||||||
- Added 2 files `godot_core_mbedtls_platform.c` and `godot_core_mbedtls_config.h`
|
- Added 2 files `godot_core_mbedtls_platform.c` and `godot_core_mbedtls_config.h`
|
||||||
providing configuration for light bundling with core.
|
providing configuration for light bundling with core.
|
||||||
|
- Added the file `godot_module_mbedtls_config.h` to customize the build configuration when bundling the full library.
|
||||||
|
|
||||||
|
|
||||||
## meshoptimizer
|
## meshoptimizer
|
||||||
|
|
|
@ -1,3 +1,38 @@
|
||||||
|
/**************************************************************************/
|
||||||
|
/* godot_core_mbedtls_config.h */
|
||||||
|
/**************************************************************************/
|
||||||
|
/* This file is part of: */
|
||||||
|
/* GODOT ENGINE */
|
||||||
|
/* https://godotengine.org */
|
||||||
|
/**************************************************************************/
|
||||||
|
/* Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md). */
|
||||||
|
/* Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur. */
|
||||||
|
/* */
|
||||||
|
/* Permission is hereby granted, free of charge, to any person obtaining */
|
||||||
|
/* a copy of this software and associated documentation files (the */
|
||||||
|
/* "Software"), to deal in the Software without restriction, including */
|
||||||
|
/* without limitation the rights to use, copy, modify, merge, publish, */
|
||||||
|
/* distribute, sublicense, and/or sell copies of the Software, and to */
|
||||||
|
/* permit persons to whom the Software is furnished to do so, subject to */
|
||||||
|
/* the following conditions: */
|
||||||
|
/* */
|
||||||
|
/* The above copyright notice and this permission notice shall be */
|
||||||
|
/* included in all copies or substantial portions of the Software. */
|
||||||
|
/* */
|
||||||
|
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
|
||||||
|
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
|
||||||
|
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. */
|
||||||
|
/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
|
||||||
|
/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
|
||||||
|
/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
|
||||||
|
/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
|
||||||
|
/**************************************************************************/
|
||||||
|
|
||||||
|
#ifndef GODOT_CORE_MBEDTLS_CONFIG_H
|
||||||
|
#define GODOT_CORE_MBEDTLS_CONFIG_H
|
||||||
|
|
||||||
|
#include <limits.h>
|
||||||
|
|
||||||
// For AES
|
// For AES
|
||||||
#define MBEDTLS_CIPHER_MODE_CBC
|
#define MBEDTLS_CIPHER_MODE_CBC
|
||||||
#define MBEDTLS_CIPHER_MODE_CFB
|
#define MBEDTLS_CIPHER_MODE_CFB
|
||||||
|
@ -15,4 +50,4 @@
|
||||||
#define MBEDTLS_PLATFORM_ZEROIZE_ALT
|
#define MBEDTLS_PLATFORM_ZEROIZE_ALT
|
||||||
#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
||||||
|
|
||||||
#include <limits.h>
|
#endif // GODOT_CORE_MBEDTLS_CONFIG_H
|
||||||
|
|
58
thirdparty/mbedtls/include/godot_module_mbedtls_config.h
vendored
Normal file
58
thirdparty/mbedtls/include/godot_module_mbedtls_config.h
vendored
Normal file
|
@ -0,0 +1,58 @@
|
||||||
|
/**************************************************************************/
|
||||||
|
/* godot_module_mbedtls_config.h */
|
||||||
|
/**************************************************************************/
|
||||||
|
/* This file is part of: */
|
||||||
|
/* GODOT ENGINE */
|
||||||
|
/* https://godotengine.org */
|
||||||
|
/**************************************************************************/
|
||||||
|
/* Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md). */
|
||||||
|
/* Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur. */
|
||||||
|
/* */
|
||||||
|
/* Permission is hereby granted, free of charge, to any person obtaining */
|
||||||
|
/* a copy of this software and associated documentation files (the */
|
||||||
|
/* "Software"), to deal in the Software without restriction, including */
|
||||||
|
/* without limitation the rights to use, copy, modify, merge, publish, */
|
||||||
|
/* distribute, sublicense, and/or sell copies of the Software, and to */
|
||||||
|
/* permit persons to whom the Software is furnished to do so, subject to */
|
||||||
|
/* the following conditions: */
|
||||||
|
/* */
|
||||||
|
/* The above copyright notice and this permission notice shall be */
|
||||||
|
/* included in all copies or substantial portions of the Software. */
|
||||||
|
/* */
|
||||||
|
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
|
||||||
|
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
|
||||||
|
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. */
|
||||||
|
/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
|
||||||
|
/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
|
||||||
|
/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
|
||||||
|
/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
|
||||||
|
/**************************************************************************/
|
||||||
|
|
||||||
|
#ifndef GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||||
|
#define GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||||
|
|
||||||
|
#include "platform_config.h"
|
||||||
|
|
||||||
|
#ifdef GODOT_MBEDTLS_INCLUDE_H
|
||||||
|
|
||||||
|
// Allow platforms to customize the mbedTLS configuration.
|
||||||
|
#include GODOT_MBEDTLS_INCLUDE_H
|
||||||
|
|
||||||
|
#else
|
||||||
|
|
||||||
|
// Include default mbedTLS config.
|
||||||
|
#include <mbedtls/config.h>
|
||||||
|
|
||||||
|
// Disable weak cryptography.
|
||||||
|
#undef MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
|
||||||
|
#undef MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
|
||||||
|
#undef MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||||||
|
#undef MBEDTLS_SSL_PROTO_TLS1
|
||||||
|
#undef MBEDTLS_SSL_PROTO_TLS1_1
|
||||||
|
#undef MBEDTLS_ARC4_C
|
||||||
|
#undef MBEDTLS_DES_C
|
||||||
|
#undef MBEDTLS_DHM_C
|
||||||
|
|
||||||
|
#endif // GODOT_MBEDTLS_INCLUDE_H
|
||||||
|
|
||||||
|
#endif // GODOT_MODULE_MBEDTLS_CONFIG_H
|
Loading…
Reference in a new issue