1 /*************************************************************************/
2 /* crypto_mbedtls.cpp */
3 /*************************************************************************/
4 /* This file is part of: */
5 /* GODOT ENGINE */
6 /* https://godotengine.org */
7 /*************************************************************************/
8 /* Copyright (c) 2007-2020 Juan Linietsky, Ariel Manzur. */
9 /* Copyright (c) 2014-2020 Godot Engine contributors (cf. AUTHORS.md). */
10 /* */
11 /* Permission is hereby granted, free of charge, to any person obtaining */
12 /* a copy of this software and associated documentation files (the */
13 /* "Software"), to deal in the Software without restriction, including */
14 /* without limitation the rights to use, copy, modify, merge, publish, */
15 /* distribute, sublicense, and/or sell copies of the Software, and to */
16 /* permit persons to whom the Software is furnished to do so, subject to */
17 /* the following conditions: */
18 /* */
19 /* The above copyright notice and this permission notice shall be */
20 /* included in all copies or substantial portions of the Software. */
21 /* */
22 /* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
23 /* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
24 /* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.*/
25 /* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
26 /* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
27 /* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
28 /* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
29 /*************************************************************************/
30
31 #include "crypto_mbedtls.h"
32
33 #include "core/os/file_access.h"
34
35 #include "core/engine.h"
36 #include "core/io/certs_compressed.gen.h"
37 #include "core/io/compression.h"
38 #include "core/project_settings.h"
39
40 #ifdef TOOLS_ENABLED
41 #include "editor/editor_settings.h"
42 #endif
43 #define PEM_BEGIN_CRT "-----BEGIN CERTIFICATE-----\n"
44 #define PEM_END_CRT "-----END CERTIFICATE-----\n"
45
46 #include <mbedtls/debug.h>
47 #include <mbedtls/pem.h>
48
create()49 CryptoKey *CryptoKeyMbedTLS::create() {
50 return memnew(CryptoKeyMbedTLS);
51 }
52
load(String p_path)53 Error CryptoKeyMbedTLS::load(String p_path) {
54 ERR_FAIL_COND_V_MSG(locks, ERR_ALREADY_IN_USE, "Key is in use");
55
56 PoolByteArray out;
57 FileAccess *f = FileAccess::open(p_path, FileAccess::READ);
58 ERR_FAIL_COND_V_MSG(!f, ERR_INVALID_PARAMETER, "Cannot open CryptoKeyMbedTLS file '" + p_path + "'.");
59
60 int flen = f->get_len();
61 out.resize(flen + 1);
62 {
63 PoolByteArray::Write w = out.write();
64 f->get_buffer(w.ptr(), flen);
65 w[flen] = 0; //end f string
66 }
67 memdelete(f);
68
69 int ret = mbedtls_pk_parse_key(&pkey, out.read().ptr(), out.size(), NULL, 0);
70 // We MUST zeroize the memory for safety!
71 mbedtls_platform_zeroize(out.write().ptr(), out.size());
72 ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing private key '" + itos(ret) + "'.");
73
74 return OK;
75 }
76
save(String p_path)77 Error CryptoKeyMbedTLS::save(String p_path) {
78 FileAccess *f = FileAccess::open(p_path, FileAccess::WRITE);
79 ERR_FAIL_COND_V_MSG(!f, ERR_INVALID_PARAMETER, "Cannot save CryptoKeyMbedTLS file '" + p_path + "'.");
80
81 unsigned char w[16000];
82 memset(w, 0, sizeof(w));
83
84 int ret = mbedtls_pk_write_key_pem(&pkey, w, sizeof(w));
85 if (ret != 0) {
86 memdelete(f);
87 memset(w, 0, sizeof(w)); // Zeroize anything we might have written.
88 ERR_FAIL_V_MSG(FAILED, "Error writing key '" + itos(ret) + "'.");
89 }
90
91 size_t len = strlen((char *)w);
92 f->store_buffer(w, len);
93 memdelete(f);
94 memset(w, 0, sizeof(w)); // Zeroize temporary buffer.
95 return OK;
96 }
97
create()98 X509Certificate *X509CertificateMbedTLS::create() {
99 return memnew(X509CertificateMbedTLS);
100 }
101
load(String p_path)102 Error X509CertificateMbedTLS::load(String p_path) {
103 ERR_FAIL_COND_V_MSG(locks, ERR_ALREADY_IN_USE, "Certificate is in use");
104
105 PoolByteArray out;
106 FileAccess *f = FileAccess::open(p_path, FileAccess::READ);
107 ERR_FAIL_COND_V_MSG(!f, ERR_INVALID_PARAMETER, "Cannot open X509CertificateMbedTLS file '" + p_path + "'.");
108
109 int flen = f->get_len();
110 out.resize(flen + 1);
111 {
112 PoolByteArray::Write w = out.write();
113 f->get_buffer(w.ptr(), flen);
114 w[flen] = 0; //end f string
115 }
116 memdelete(f);
117
118 int ret = mbedtls_x509_crt_parse(&cert, out.read().ptr(), out.size());
119 ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing some certificates: " + itos(ret));
120
121 return OK;
122 }
123
load_from_memory(const uint8_t * p_buffer,int p_len)124 Error X509CertificateMbedTLS::load_from_memory(const uint8_t *p_buffer, int p_len) {
125 ERR_FAIL_COND_V_MSG(locks, ERR_ALREADY_IN_USE, "Certificate is in use");
126
127 int ret = mbedtls_x509_crt_parse(&cert, p_buffer, p_len);
128 ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing certificates: " + itos(ret));
129 return OK;
130 }
131
save(String p_path)132 Error X509CertificateMbedTLS::save(String p_path) {
133 FileAccess *f = FileAccess::open(p_path, FileAccess::WRITE);
134 ERR_FAIL_COND_V_MSG(!f, ERR_INVALID_PARAMETER, "Cannot save X509CertificateMbedTLS file '" + p_path + "'.");
135
136 mbedtls_x509_crt *crt = &cert;
137 while (crt) {
138 unsigned char w[4096];
139 size_t wrote = 0;
140 int ret = mbedtls_pem_write_buffer(PEM_BEGIN_CRT, PEM_END_CRT, cert.raw.p, cert.raw.len, w, sizeof(w), &wrote);
141 if (ret != 0 || wrote == 0) {
142 memdelete(f);
143 ERR_FAIL_V_MSG(FAILED, "Error writing certificate '" + itos(ret) + "'.");
144 }
145
146 f->store_buffer(w, wrote - 1); // don't write the string terminator
147 crt = crt->next;
148 }
149 memdelete(f);
150 return OK;
151 }
152
create()153 Crypto *CryptoMbedTLS::create() {
154 return memnew(CryptoMbedTLS);
155 }
156
initialize_crypto()157 void CryptoMbedTLS::initialize_crypto() {
158
159 #ifdef DEBUG_ENABLED
160 mbedtls_debug_set_threshold(1);
161 #endif
162
163 Crypto::_create = create;
164 Crypto::_load_default_certificates = load_default_certificates;
165 X509CertificateMbedTLS::make_default();
166 CryptoKeyMbedTLS::make_default();
167 }
168
finalize_crypto()169 void CryptoMbedTLS::finalize_crypto() {
170 Crypto::_create = NULL;
171 Crypto::_load_default_certificates = NULL;
172 if (default_certs) {
173 memdelete(default_certs);
174 default_certs = NULL;
175 }
176 X509CertificateMbedTLS::finalize();
177 CryptoKeyMbedTLS::finalize();
178 }
179
CryptoMbedTLS()180 CryptoMbedTLS::CryptoMbedTLS() {
181 mbedtls_ctr_drbg_init(&ctr_drbg);
182 mbedtls_entropy_init(&entropy);
183 int ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
184 if (ret != 0) {
185 ERR_PRINTS(" failed\n ! mbedtls_ctr_drbg_seed returned an error" + itos(ret));
186 }
187 }
188
~CryptoMbedTLS()189 CryptoMbedTLS::~CryptoMbedTLS() {
190 mbedtls_ctr_drbg_free(&ctr_drbg);
191 mbedtls_entropy_free(&entropy);
192 }
193
194 X509CertificateMbedTLS *CryptoMbedTLS::default_certs = NULL;
195
get_default_certificates()196 X509CertificateMbedTLS *CryptoMbedTLS::get_default_certificates() {
197 return default_certs;
198 }
199
load_default_certificates(String p_path)200 void CryptoMbedTLS::load_default_certificates(String p_path) {
201 ERR_FAIL_COND(default_certs != NULL);
202
203 default_certs = memnew(X509CertificateMbedTLS);
204 ERR_FAIL_COND(default_certs == NULL);
205
206 if (p_path != "") {
207 // Use certs defined in project settings.
208 default_certs->load(p_path);
209 }
210 #ifdef BUILTIN_CERTS_ENABLED
211 else {
212 // Use builtin certs only if user did not override it in project settings.
213 PoolByteArray out;
214 out.resize(_certs_uncompressed_size + 1);
215 PoolByteArray::Write w = out.write();
216 Compression::decompress(w.ptr(), _certs_uncompressed_size, _certs_compressed, _certs_compressed_size, Compression::MODE_DEFLATE);
217 w[_certs_uncompressed_size] = 0; // Make sure it ends with string terminator
218 #ifdef DEBUG_ENABLED
219 print_verbose("Loaded builtin certs");
220 #endif
221 default_certs->load_from_memory(out.read().ptr(), out.size());
222 }
223 #endif
224 }
225
generate_rsa(int p_bytes)226 Ref<CryptoKey> CryptoMbedTLS::generate_rsa(int p_bytes) {
227 Ref<CryptoKeyMbedTLS> out;
228 out.instance();
229 int ret = mbedtls_pk_setup(&(out->pkey), mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
230 ERR_FAIL_COND_V(ret != 0, NULL);
231 ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(out->pkey), mbedtls_ctr_drbg_random, &ctr_drbg, p_bytes, 65537);
232 ERR_FAIL_COND_V(ret != 0, NULL);
233 return out;
234 }
235
generate_self_signed_certificate(Ref<CryptoKey> p_key,String p_issuer_name,String p_not_before,String p_not_after)236 Ref<X509Certificate> CryptoMbedTLS::generate_self_signed_certificate(Ref<CryptoKey> p_key, String p_issuer_name, String p_not_before, String p_not_after) {
237 Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS> >(p_key);
238 ERR_FAIL_COND_V_MSG(key.is_null(), NULL, "Invalid private key argument.");
239 mbedtls_x509write_cert crt;
240 mbedtls_x509write_crt_init(&crt);
241
242 mbedtls_x509write_crt_set_subject_key(&crt, &(key->pkey));
243 mbedtls_x509write_crt_set_issuer_key(&crt, &(key->pkey));
244 mbedtls_x509write_crt_set_subject_name(&crt, p_issuer_name.utf8().get_data());
245 mbedtls_x509write_crt_set_issuer_name(&crt, p_issuer_name.utf8().get_data());
246 mbedtls_x509write_crt_set_version(&crt, MBEDTLS_X509_CRT_VERSION_3);
247 mbedtls_x509write_crt_set_md_alg(&crt, MBEDTLS_MD_SHA256);
248
249 mbedtls_mpi serial;
250 mbedtls_mpi_init(&serial);
251 uint8_t rand_serial[20];
252 mbedtls_ctr_drbg_random(&ctr_drbg, rand_serial, 20);
253 ERR_FAIL_COND_V(mbedtls_mpi_read_binary(&serial, rand_serial, 20), NULL);
254 mbedtls_x509write_crt_set_serial(&crt, &serial);
255
256 mbedtls_x509write_crt_set_validity(&crt, p_not_before.utf8().get_data(), p_not_after.utf8().get_data());
257 mbedtls_x509write_crt_set_basic_constraints(&crt, 1, -1);
258 mbedtls_x509write_crt_set_basic_constraints(&crt, 1, 0);
259
260 unsigned char buf[4096];
261 memset(buf, 0, 4096);
262 int ret = mbedtls_x509write_crt_pem(&crt, buf, 4096, mbedtls_ctr_drbg_random, &ctr_drbg);
263 mbedtls_mpi_free(&serial);
264 mbedtls_x509write_crt_free(&crt);
265 ERR_FAIL_COND_V_MSG(ret != 0, nullptr, "Failed to generate certificate: " + itos(ret));
266 buf[4095] = '\0'; // Make sure strlen can't fail.
267
268 Ref<X509CertificateMbedTLS> out;
269 out.instance();
270 out->load_from_memory(buf, strlen((char *)buf) + 1); // Use strlen to find correct output size.
271 return out;
272 }
273
generate_random_bytes(int p_bytes)274 PoolByteArray CryptoMbedTLS::generate_random_bytes(int p_bytes) {
275 PoolByteArray out;
276 out.resize(p_bytes);
277 mbedtls_ctr_drbg_random(&ctr_drbg, out.write().ptr(), p_bytes);
278 return out;
279 }
280