1/**************************************************************************/
2/* crypto_mbedtls.h */
3/**************************************************************************/
4/* This file is part of: */
5/* GODOT ENGINE */
6/* https://godotengine.org */
7/**************************************************************************/
8/* Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md). */
9/* Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur. */
10/* */
11/* Permission is hereby granted, free of charge, to any person obtaining */
12/* a copy of this software and associated documentation files (the */
13/* "Software"), to deal in the Software without restriction, including */
14/* without limitation the rights to use, copy, modify, merge, publish, */
15/* distribute, sublicense, and/or sell copies of the Software, and to */
16/* permit persons to whom the Software is furnished to do so, subject to */
17/* the following conditions: */
18/* */
19/* The above copyright notice and this permission notice shall be */
20/* included in all copies or substantial portions of the Software. */
21/* */
22/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
23/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
24/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. */
25/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
26/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
27/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
28/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
29/**************************************************************************/
30
31#ifndef CRYPTO_MBEDTLS_H
32#define CRYPTO_MBEDTLS_H
33
34#include "core/crypto/crypto.h"
35#include "core/io/resource.h"
36
37#include <mbedtls/ctr_drbg.h>
38#include <mbedtls/entropy.h>
39#include <mbedtls/ssl.h>
40
41class CryptoMbedTLS;
42class TLSContextMbedTLS;
43class CryptoKeyMbedTLS : public CryptoKey {
44private:
45 mbedtls_pk_context pkey;
46 int locks = 0;
47 bool public_only = true;
48
49public:
50 static CryptoKey *create();
51 static void make_default() { CryptoKey::_create = create; }
52 static void finalize() { CryptoKey::_create = nullptr; }
53
54 virtual Error load(String p_path, bool p_public_only);
55 virtual Error save(String p_path, bool p_public_only);
56 virtual String save_to_string(bool p_public_only);
57 virtual Error load_from_string(String p_string_key, bool p_public_only);
58 virtual bool is_public_only() const { return public_only; };
59
60 CryptoKeyMbedTLS() {
61 mbedtls_pk_init(&pkey);
62 locks = 0;
63 }
64 ~CryptoKeyMbedTLS() {
65 mbedtls_pk_free(&pkey);
66 }
67
68 _FORCE_INLINE_ void lock() { locks++; }
69 _FORCE_INLINE_ void unlock() { locks--; }
70
71 friend class CryptoMbedTLS;
72 friend class TLSContextMbedTLS;
73};
74
75class X509CertificateMbedTLS : public X509Certificate {
76private:
77 mbedtls_x509_crt cert;
78 int locks;
79
80public:
81 static X509Certificate *create();
82 static void make_default() { X509Certificate::_create = create; }
83 static void finalize() { X509Certificate::_create = nullptr; }
84
85 virtual Error load(String p_path);
86 virtual Error load_from_memory(const uint8_t *p_buffer, int p_len);
87 virtual Error save(String p_path);
88 virtual String save_to_string();
89 virtual Error load_from_string(const String &p_string_key);
90
91 X509CertificateMbedTLS() {
92 mbedtls_x509_crt_init(&cert);
93 locks = 0;
94 }
95 ~X509CertificateMbedTLS() {
96 mbedtls_x509_crt_free(&cert);
97 }
98
99 _FORCE_INLINE_ void lock() { locks++; }
100 _FORCE_INLINE_ void unlock() { locks--; }
101
102 friend class CryptoMbedTLS;
103 friend class TLSContextMbedTLS;
104};
105
106class HMACContextMbedTLS : public HMACContext {
107private:
108 HashingContext::HashType hash_type;
109 int hash_len = 0;
110 void *ctx = nullptr;
111
112public:
113 static HMACContext *create();
114 static void make_default() { HMACContext::_create = create; }
115 static void finalize() { HMACContext::_create = nullptr; }
116
117 static bool is_md_type_allowed(mbedtls_md_type_t p_md_type);
118
119 virtual Error start(HashingContext::HashType p_hash_type, PackedByteArray p_key);
120 virtual Error update(PackedByteArray p_data);
121 virtual PackedByteArray finish();
122
123 HMACContextMbedTLS() {}
124 ~HMACContextMbedTLS();
125};
126
127class CryptoMbedTLS : public Crypto {
128private:
129 mbedtls_entropy_context entropy;
130 mbedtls_ctr_drbg_context ctr_drbg;
131 static X509CertificateMbedTLS *default_certs;
132
133public:
134 static Crypto *create();
135 static void initialize_crypto();
136 static void finalize_crypto();
137 static X509CertificateMbedTLS *get_default_certificates();
138 static void load_default_certificates(String p_path);
139 static mbedtls_md_type_t md_type_from_hashtype(HashingContext::HashType p_hash_type, int &r_size);
140
141 virtual PackedByteArray generate_random_bytes(int p_bytes);
142 virtual Ref<CryptoKey> generate_rsa(int p_bytes);
143 virtual Ref<X509Certificate> generate_self_signed_certificate(Ref<CryptoKey> p_key, String p_issuer_name, String p_not_before, String p_not_after);
144 virtual Vector<uint8_t> sign(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Ref<CryptoKey> p_key);
145 virtual bool verify(HashingContext::HashType p_hash_type, Vector<uint8_t> p_hash, Vector<uint8_t> p_signature, Ref<CryptoKey> p_key);
146 virtual Vector<uint8_t> encrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_plaintext);
147 virtual Vector<uint8_t> decrypt(Ref<CryptoKey> p_key, Vector<uint8_t> p_ciphertext);
148
149 CryptoMbedTLS();
150 ~CryptoMbedTLS();
151};
152
153#endif // CRYPTO_MBEDTLS_H
154