@@ -69,7 +69,7 @@ Error CryptoKeyMbedTLS::load(const String &p_path, bool p_public_only) {
6969 if (p_public_only) {
7070 ret = mbedtls_pk_parse_public_key (&pkey, out.ptr (), out.size ());
7171 } else {
72- ret = mbedtls_pk_parse_key (&pkey, out.ptr (), out.size (), nullptr , 0 );
72+ ret = _parse_key ( out.ptr (), out.size ());
7373 }
7474 // We MUST zeroize the memory for safety!
7575 mbedtls_platform_zeroize (out.ptrw (), out.size ());
@@ -108,7 +108,7 @@ Error CryptoKeyMbedTLS::load_from_string(const String &p_string_key, bool p_publ
108108 if (p_public_only) {
109109 ret = mbedtls_pk_parse_public_key (&pkey, (unsigned char *)p_string_key.utf8 ().get_data (), p_string_key.utf8 ().size ());
110110 } else {
111- ret = mbedtls_pk_parse_key (&pkey, (unsigned char *)p_string_key.utf8 ().get_data (), p_string_key.utf8 ().size (), nullptr , 0 );
111+ ret = _parse_key ( (unsigned char *)p_string_key.utf8 ().get_data (), p_string_key.utf8 ().size ());
112112 }
113113 ERR_FAIL_COND_V_MSG (ret, FAILED, " Error parsing key '" itos (ret) + " '."
114114
@@ -134,6 +134,25 @@ String CryptoKeyMbedTLS::save_to_string(bool p_public_only) {
134134 return s;
135135}
136136
137+ int CryptoKeyMbedTLS::_parse_key (const uint8_t *p_buf, int p_size) {
138+ #if MBEDTLS_VERSION_MAJOR >= 3
139+ mbedtls_entropy_context rng_entropy;
140+ mbedtls_ctr_drbg_context rng_drbg;
141+
142+ mbedtls_ctr_drbg_init (&rng_drbg);
143+ mbedtls_entropy_init (&rng_entropy);
144+ int ret = mbedtls_ctr_drbg_seed (&rng_drbg, mbedtls_entropy_func, &rng_entropy, nullptr , 0 );
145+ ERR_FAIL_COND_V_MSG (ret != 0 , ret, vformat (" mbedtls_ctr_drbg_seed returned -0x%x\n " unsigned int )-ret));
146+
147+ ret = mbedtls_pk_parse_key (&pkey, p_buf, p_size, nullptr , 0 , mbedtls_ctr_drbg_random, &rng_drbg);
148+ mbedtls_ctr_drbg_free (&rng_drbg);
149+ mbedtls_entropy_free (&rng_entropy);
150+ return ret;
151+ #else
152+ return mbedtls_pk_parse_key (&pkey, p_buf, p_size, nullptr , 0 );
153+ #endif
154+ }
155+
137156X509Certificate *X509CertificateMbedTLS::create () {
138157 return memnew (X509CertificateMbedTLS);
139158}
@@ -393,12 +412,17 @@ Ref<X509Certificate> CryptoMbedTLS::generate_self_signed_certificate(Ref<CryptoK
393412 mbedtls_x509write_crt_set_version (&crt, MBEDTLS_X509_CRT_VERSION_3);
394413 mbedtls_x509write_crt_set_md_alg (&crt, MBEDTLS_MD_SHA256);
395414
415+ uint8_t rand_serial[20 ];
416+ mbedtls_ctr_drbg_random (&ctr_drbg, rand_serial, sizeof (rand_serial));
417+
418+ #if MBEDTLS_VERSION_MAJOR >= 3
419+ mbedtls_x509write_crt_set_serial_raw (&crt, rand_serial, sizeof (rand_serial));
420+ #else
396421 mbedtls_mpi serial;
397422 mbedtls_mpi_init (&serial);
398- uint8_t rand_serial[20 ];
399- mbedtls_ctr_drbg_random (&ctr_drbg, rand_serial, 20 );
400- ERR_FAIL_COND_V (mbedtls_mpi_read_binary (&serial, rand_serial, 20 ), nullptr );
423+ ERR_FAIL_COND_V (mbedtls_mpi_read_binary (&serial, rand_serial, sizeof (rand_serial)), nullptr );
401424 mbedtls_x509write_crt_set_serial (&crt, &serial);
425+ #endif
402426
403427 mbedtls_x509write_crt_set_validity (&crt, p_not_before.utf8 ().get_data (), p_not_after.utf8 ().get_data ());
404428 mbedtls_x509write_crt_set_basic_constraints (&crt, 1 , -1 );
@@ -407,7 +431,9 @@ Ref<X509Certificate> CryptoMbedTLS::generate_self_signed_certificate(Ref<CryptoK
407431 unsigned char buf[4096 ];
408432 memset (buf, 0 , 4096 );
409433 int ret = mbedtls_x509write_crt_pem (&crt, buf, 4096 , mbedtls_ctr_drbg_random, &ctr_drbg);
434+ #if MBEDTLS_VERSION_MAJOR < 3
410435 mbedtls_mpi_free (&serial);
436+ #endif
411437 mbedtls_x509write_crt_free (&crt);
412438 ERR_FAIL_COND_V_MSG (ret != 0 , nullptr , " Failed to generate certificate: " itos (ret));
413439 buf[4095 ] = ' \0 ' // Make sure strlen can't fail.
@@ -461,9 +487,17 @@ Vector<uint8_t> CryptoMbedTLS::sign(HashingContext::HashType p_hash_type, const
461487 ERR_FAIL_COND_V_MSG (!key.is_valid (), Vector<uint8_t >(), " Invalid key provided."
462488 ERR_FAIL_COND_V_MSG (key->is_public_only (), Vector<uint8_t >(), " Invalid key provided. Cannot sign with public_only keys."
463489 size_t sig_size = 0 ;
490+ #if MBEDTLS_VERSION_MAJOR >= 3
491+ unsigned char buf[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
492+ #else
464493 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
494+ #endif
465495 Vector<uint8_t > out;
466- int ret = mbedtls_pk_sign (&(key->pkey ), type, p_hash.ptr (), size, buf, &sig_size, mbedtls_ctr_drbg_random, &ctr_drbg);
496+ int ret = mbedtls_pk_sign (&(key->pkey ), type, p_hash.ptr (), size, buf,
497+ #if MBEDTLS_VERSION_MAJOR >= 3
498+ sizeof (buf),
499+ #endif
500+ &sig_size, mbedtls_ctr_drbg_random, &ctr_drbg);
467501 ERR_FAIL_COND_V_MSG (ret, out, " Error while signing: " itos (ret));
468502 out.resize (sig_size);
469503 memcpy (out.ptrw (), buf, sig_size);
0 commit comments