Stowage/godot
2
0
Fork 0
mirror of https://github.com/godotengine/godot.git synced 2025-12-07 22:00:10 +00:00
Code Issues Projects Releases Packages Wiki Activity

[TLS] Disable TLSv1.3 support by default

Browse source
This commit is contained in:
Fabio Alessandrelli 2025-02-12 16:34:43 +01:00
parent b607110ad2
commit 488cdbacdb
3 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/mbedtls/register_types.cpp
View file

@ -35,6 +35,8 @@
#include "packet_peer_mbed_dtls.h"
#include "stream_peer_mbedtls.h"
#include "core/config/project_settings.h"
#if MBEDTLS_VERSION_MAJOR >= 3
#include <psa/crypto.h>
#endif
@ -50,6 +52,8 @@ void initialize_mbedtls_module(ModuleInitializationLevel p_level) {
return;
}
GLOBAL_DEF("network/tls/enable_tls_v1.3", false);
#if MBEDTLS_VERSION_MAJOR >= 3
int status = psa_crypto_init();
ERR_FAIL_COND_MSG(status != PSA_SUCCESS, "Failed to initialize psa crypto. The mbedTLS modules will not work.");

11
modules/mbedtls/tls_context_mbedtls.cpp
View file

@ -30,6 +30,8 @@
#include "tls_context_mbedtls.h"
#include "core/config/project_settings.h"
static void my_debug(void *ctx, int level,
const char *file, int line,
const char *str) {
@ -144,6 +146,11 @@ Error TLSContextMbedTLS::init_server(int p_transport, Ref<TLSOptions> p_options,
cookies = p_cookies;
mbedtls_ssl_conf_dtls_cookies(&conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &(cookies->cookie_ctx));
}
if (Engine::get_singleton()->is_editor_hint() || !(bool)GLOBAL_GET("network/tls/enable_tls_v1.3")) {
mbedtls_ssl_conf_max_tls_version(&conf, MBEDTLS_SSL_VERSION_TLS1_2);
}
mbedtls_ssl_setup(&tls, &conf);
return OK;
}
@ -187,6 +194,10 @@ Error TLSContextMbedTLS::init_client(int p_transport, const String &p_hostname,
}
}
if (Engine::get_singleton()->is_editor_hint() || !(bool)GLOBAL_GET("network/tls/enable_tls_v1.3")) {
mbedtls_ssl_conf_max_tls_version(&conf, MBEDTLS_SSL_VERSION_TLS1_2);
}
// Set valid CAs
mbedtls_ssl_conf_ca_chain(&conf, &(cas->cert), nullptr);
mbedtls_ssl_setup(&tls, &conf);