When we first integrated mbedTLS, we decided not to enable
MBEDTLS_THREADING_C (which adds mutex locking to calls modifying the
state), and instead to simply create separate contexts ("states") for
each connection.
This worked fine until recently.
Sadly, mbedTLS 3 added a global state for the new PSA crypto
functionalities (which are required to support TLSv1.3).
This results in TLSv1.3 connections to access and modify the global
state concurrently when running in threads.
This commit enables MBEDTLS_THREADING_C, and MBEDTLS_THREADING_C_ALT to
provide a generic Godot implementation using the engine Mutex class.
Move library initialization to module registration functions.
Only set library debug threshold when verbose output is enabled.
TLSv1.3 functions seems to be a bit more verbose then expected, and
generate a lot of noise. Yet, some level of debugging without
recompiling the engine would be nice. We should discuss this upstream.
Our current Linux SDK for ARM32 from https://github.com/godotengine/buildroot
targets a relatively conservative baseline of neon-fp-armv8, and (at least based
on build issues I got) this doesn't seem to include hardware AES support.
Fixes#91352.
The `include/mbedtls/check_config.h` header file has a generic check
which requires `MBEDTLS_PLATFORM_C` to be defined on Windows when
building with MinGW and ancient MSVC versions.
The few mbedTLS files we include in builds without the module don't
really require anything from the mbedTLS platform file beside the
`mbedtls_platform_zeroize` function which we already override with a
custom one by defining `MBEDTLS_PLATFORM_ZEROIZE_ALT`.
So we simply add the same check and force the define in such case.
Keep module compatibility with mbedtls 2.x (old LTS branch).
A patch has been added to allow compiling after removing all the `psa_*`
files from the library folder (will look into upstreaming it).
Note: mbedTLS 3.6 finally enabled TLSv1.3 by default, but it requires
some module changes, and to enable PSA crypto (new "standard" API
specification), so it might be best done in a separate commit/PR.
This commit adds a new mbedTLS configuration header to customize the
built-in library (and can be optionally replaced by a platform-specific
one).
Currently, it disables most weak cryptographic functions (with the
notable exceptions of MD5 and SHA-1), along with removing support for
TLS versions 1.0 and 1.1 (making TLSv1.2 the only supported one).
As a cryptographically secure random generator.
Internally it uses mbedTLS CTR-DRBG implementation which gets re-seeded
with entropy from OS::get_entropy when needed.
CryptoCore now additionally depends on `ctr_drbg.c` and `entropy.c`
thirdparty mbedtls files.
Keep applying the windows entropy patch (UWP support).
Remove no longer needed padlock patch.
Update thirdparty README to reflect changes, and new source inclusion
criteria.
The comment mentioned a conflict with libwebsockets, but we actually
still get this conflict even now that we don't use libwebsockets.
Not sure what component is clashing but we should basically just keep
this patch.
Follow-up to #36823.
Fixes CVE-2019-18222.
`include/mbedtls/version.h` was modified to include the forgotten
version bump to 2.16.4, fixed upstream by ARMmbed/mbedtls#2992.
Godot core needs MD5/SHA256/AES/Base64 which used to be provided by
separate libraries.
Since we bundle mbedtls in most cases, and we can easily only include
the needed sources if we so desire, let's use it.
To simplify library changes in the future, and better isolate header
dependencies all functions have been wrapped around inside a class in
`core/math/crypto_base.h`.
If the mbedtls module is disabled, we only bundle the needed source
files independently of the `builtin_mbedtls` option.
If the module is enabled, the `builtin_mbedtls` option works as usual.
Also remove some unused headers from StreamPeerMbedTLS which were
causing build issues.
This code defines a symbol 'unsupported' which is also in a newer
version of libwebsockets. To fix 32bit linux builds just disable
padlock support. Processors that support this are rare and old.
This code defines a symbol 'unsupported' which is also in a newer
version of libwebsockets. To fix 32bit linux builds just disable
padlock support. Processors that support this are rare and old.
