Merge pull request #3091 from Tilka/mbedtls

Update mbed TLS (PolarSSL)

20 files changed, 132 insertions, 126 deletions

diff --git a/Source/Core/Common/Common.vcxproj b/Source/Core/Common/Common.vcxproj
index f367557b2e..2f3f340c14 100644
--- a/Source/Core/Common/Common.vcxproj
+++ b/Source/Core/Common/Common.vcxproj
@@ -179,7 +179,7 @@
     <ProjectReference Include="$(ExternalsDir)enet\enet.vcxproj">
       <Project>{cbc76802-c128-4b17-bf6c-23b08c313e5e}</Project>
     </ProjectReference>
-    <ProjectReference Include="$(ExternalsDir)polarssl\visualc\PolarSSL.vcxproj">
+    <ProjectReference Include="$(ExternalsDir)mbedtls\mbedTLS.vcxproj">
       <Project>{bdb6578b-0691-4e80-a46c-df21639fd3b8}</Project>
     </ProjectReference>
     <ProjectReference Include="SCMRevGen.vcxproj">
diff --git a/Source/Core/Core/CMakeLists.txt b/Source/Core/Core/CMakeLists.txt
index 207743bbd0..2fd2bf7bb5 100644
--- a/Source/Core/Core/CMakeLists.txt
+++ b/Source/Core/Core/CMakeLists.txt
@@ -242,7 +242,7 @@ if(LIBUSB_FOUND)
 	        	       	HW/SI_GCAdapter.cpp)
 endif(LIBUSB_FOUND)
 
-set(LIBS ${LIBS} ${POLARSSL_LIBRARY})
+set(LIBS ${LIBS} ${MBEDTLS_LIBRARIES})
 
 if(WIN32)
 	set(SRCS ${SRCS} HW/BBA-TAP/TAP_Win32.cpp HW/WiimoteReal/IOWin.cpp)
diff --git a/Source/Core/Core/Core.vcxproj b/Source/Core/Core/Core.vcxproj
index e6d9c3851d..5e54a4fab7 100644
--- a/Source/Core/Core/Core.vcxproj
+++ b/Source/Core/Core/Core.vcxproj
@@ -453,7 +453,7 @@
     <ProjectReference Include="$(ExternalsDir)miniupnpc\miniupnpc.vcxproj">
       <Project>{31643fdb-1bb8-4965-9de7-000fc88d35ae}</Project>
     </ProjectReference>
-    <ProjectReference Include="$(ExternalsDir)polarssl\visualc\PolarSSL.vcxproj">
+    <ProjectReference Include="$(ExternalsDir)mbedtls\mbedTLS.vcxproj">
       <Project>{bdb6578b-0691-4e80-a46c-df21639fd3b8}</Project>
     </ProjectReference>
     <ProjectReference Include="$(ExternalsDir)portaudio\build\portaudio.vcxproj">
diff --git a/Source/Core/Core/HW/WiiSaveCrypted.cpp b/Source/Core/Core/HW/WiiSaveCrypted.cpp
index ab2b31b800..4a7ee2840c 100644
--- a/Source/Core/Core/HW/WiiSaveCrypted.cpp
+++ b/Source/Core/Core/HW/WiiSaveCrypted.cpp
@@ -14,9 +14,9 @@
 #include <memory>
 #include <string>
 #include <vector>
-#include <polarssl/aes.h>
-#include <polarssl/md5.h>
-#include <polarssl/sha1.h>
+#include <mbedtls/aes.h>
+#include <mbedtls/md5.h>
+#include <mbedtls/sha1.h>
 
 #include "Common/CommonFuncs.h"
 #include "Common/CommonTypes.h"
@@ -112,7 +112,7 @@ CWiiSaveCrypted::CWiiSaveCrypted(const std::string& filename, u64 title_id)
 
 	if (!title_id) // Import
 	{
-		aes_setkey_dec(&m_aes_ctx, s_sd_key, 128);
+		mbedtls_aes_setkey_dec(&m_aes_ctx, s_sd_key, 128);
 		m_valid = true;
 		ReadHDR();
 		ReadBKHDR();
@@ -129,7 +129,7 @@ CWiiSaveCrypted::CWiiSaveCrypted(const std::string& filename, u64 title_id)
 	}
 	else
 	{
-		aes_setkey_enc(&m_aes_ctx, s_sd_key, 128);
+		mbedtls_aes_setkey_enc(&m_aes_ctx, s_sd_key, 128);
 
 		if (getPaths(true))
 		{
@@ -159,7 +159,7 @@ void CWiiSaveCrypted::ReadHDR()
 	}
 	data_file.Close();
 
-	aes_crypt_cbc(&m_aes_ctx, AES_DECRYPT, HEADER_SZ, m_sd_iv, (const u8*)&m_encrypted_header,
+	mbedtls_aes_crypt_cbc(&m_aes_ctx, MBEDTLS_AES_DECRYPT, HEADER_SZ, m_sd_iv, (const u8*)&m_encrypted_header,
 		(u8*)&m_header);
 	u32 banner_size = Common::swap32(m_header.hdr.BannerSize);
 	if ((banner_size < FULL_BNR_MIN) || (banner_size > FULL_BNR_MAX) ||
@@ -176,7 +176,7 @@ void CWiiSaveCrypted::ReadHDR()
 	u8 md5_calc[16];
 	memcpy(md5_file, m_header.hdr.Md5, 0x10);
 	memcpy(m_header.hdr.Md5, s_md5_blanker, 0x10);
-	md5((u8*)&m_header, HEADER_SZ, md5_calc);
+	mbedtls_md5((u8*)&m_header, HEADER_SZ, md5_calc);
 	if (memcmp(md5_file, md5_calc, 0x10))
 	{
 		ERROR_LOG(CONSOLE, "MD5 mismatch\n %016" PRIx64 "%016" PRIx64 " != %016" PRIx64 "%016" PRIx64,
@@ -224,10 +224,10 @@ void CWiiSaveCrypted::WriteHDR()
 	m_header.BNR[7] &= ~1;
 
 	u8 md5_calc[16];
-	md5((u8*)&m_header, HEADER_SZ, md5_calc);
+	mbedtls_md5((u8*)&m_header, HEADER_SZ, md5_calc);
 	memcpy(m_header.hdr.Md5, md5_calc, 0x10);
 
-	aes_crypt_cbc(&m_aes_ctx, AES_ENCRYPT, HEADER_SZ, m_sd_iv, (const u8*)&m_header,
+	mbedtls_aes_crypt_cbc(&m_aes_ctx, MBEDTLS_AES_ENCRYPT, HEADER_SZ, m_sd_iv, (const u8*)&m_header,
 		(u8*)&m_encrypted_header);
 
 	File::IOFile data_file(m_encrypted_save_path, "wb");
@@ -367,7 +367,7 @@ void CWiiSaveCrypted::ImportWiiSaveFiles()
 				}
 
 				memcpy(m_iv, file_hdr_tmp.IV, 0x10);
-				aes_crypt_cbc(&m_aes_ctx, AES_DECRYPT, file_size_rounded, m_iv,
+				mbedtls_aes_crypt_cbc(&m_aes_ctx, MBEDTLS_AES_DECRYPT, file_size_rounded, m_iv,
 					(const u8*)&file_data_enc[0], &file_data[0]);
 
 				if (!File::Exists(file_path_full) ||
@@ -457,7 +457,7 @@ void CWiiSaveCrypted::ExportWiiSaveFiles()
 				m_valid = false;
 			}
 
-			aes_crypt_cbc(&m_aes_ctx, AES_ENCRYPT, file_size_rounded,
+			mbedtls_aes_crypt_cbc(&m_aes_ctx, MBEDTLS_AES_ENCRYPT, file_size_rounded,
 				file_hdr_tmp.IV, (const u8*)&file_data[0], &file_data_enc[0]);
 
 			File::IOFile fpData_bin(m_encrypted_save_path, "ab");
@@ -511,7 +511,7 @@ void CWiiSaveCrypted::do_sig()
 	sprintf(name, "AP%08x%08x", 1, 2);
 	make_ec_cert(ap_cert, ap_sig, signer, name, ap_priv, 0);
 
-	sha1(ap_cert + 0x80, 0x100, hash);
+	mbedtls_sha1(ap_cert + 0x80, 0x100, hash);
 	generate_ecdsa(ap_sig, ap_sig + 30, ng_priv, hash);
 	make_ec_cert(ap_cert, ap_sig, signer, name, ap_priv, 0);
 
@@ -532,8 +532,8 @@ void CWiiSaveCrypted::do_sig()
 		return;
 	}
 
-	sha1(data.get(), data_size, hash);
-	sha1(hash, 20, hash);
+	mbedtls_sha1(data.get(), data_size, hash);
+	mbedtls_sha1(hash, 20, hash);
 
 	data_file.Open(m_encrypted_save_path, "ab");
 	if (!data_file)
diff --git a/Source/Core/Core/HW/WiiSaveCrypted.h b/Source/Core/Core/HW/WiiSaveCrypted.h
index 60d038adf4..bfb56e2b98 100644
--- a/Source/Core/Core/HW/WiiSaveCrypted.h
+++ b/Source/Core/Core/HW/WiiSaveCrypted.h
@@ -6,7 +6,7 @@
 
 #include <string>
 #include <vector>
-#include <polarssl/aes.h>
+#include <mbedtls/aes.h>
 
 #include "Common/CommonTypes.h"
 
@@ -38,7 +38,7 @@ private:
 	static const u8 s_md5_blanker[16];
 	static const u32 s_ng_id;
 
-	aes_context m_aes_ctx;
+	mbedtls_aes_context m_aes_ctx;
 	u8 m_sd_iv[0x10];
 	std::vector<std::string> m_files_list;
 
diff --git a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_es.cpp b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_es.cpp
index 0add130e92..bdc630178b 100644
--- a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_es.cpp
+++ b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_es.cpp
@@ -33,11 +33,11 @@
 */
 // =============
 
-// need to include this before polarssl/aes.h,
+// need to include this before mbedtls/aes.h,
 // otherwise we may not get __STDC_FORMAT_MACROS
 #include <cinttypes>
 #include <memory>
-#include <polarssl/aes.h>
+#include <mbedtls/aes.h>
 
 #include "Common/ChunkFile.h"
 #include "Common/CommonPaths.h"
@@ -859,10 +859,10 @@ IPCCommandResult CWII_IPC_HLE_Device_es::IOCtlV(u32 _CommandAddress)
 			u8* newIV       = Memory::GetPointer(Buffer.PayloadBuffer[0].m_Address);
 			u8* destination = Memory::GetPointer(Buffer.PayloadBuffer[1].m_Address);
 
-			aes_context AES_ctx;
-			aes_setkey_enc(&AES_ctx, keyTable[keyIndex], 128);
+			mbedtls_aes_context AES_ctx;
+			mbedtls_aes_setkey_enc(&AES_ctx, keyTable[keyIndex], 128);
 			memcpy(newIV, IV, 16);
-			aes_crypt_cbc(&AES_ctx, AES_ENCRYPT, size, newIV, source, destination);
+			mbedtls_aes_crypt_cbc(&AES_ctx, MBEDTLS_AES_ENCRYPT, size, newIV, source, destination);
 
 			_dbg_assert_msg_(WII_IPC_ES, keyIndex == 6, "IOCTL_ES_ENCRYPT: Key type is not SD, data will be crap");
 		}
@@ -877,10 +877,10 @@ IPCCommandResult CWII_IPC_HLE_Device_es::IOCtlV(u32 _CommandAddress)
 			u8* newIV       = Memory::GetPointer(Buffer.PayloadBuffer[0].m_Address);
 			u8* destination = Memory::GetPointer(Buffer.PayloadBuffer[1].m_Address);
 
-			aes_context AES_ctx;
-			aes_setkey_dec(&AES_ctx, keyTable[keyIndex], 128);
+			mbedtls_aes_context AES_ctx;
+			mbedtls_aes_setkey_dec(&AES_ctx, keyTable[keyIndex], 128);
 			memcpy(newIV, IV, 16);
-			aes_crypt_cbc(&AES_ctx, AES_DECRYPT, size, newIV, source, destination);
+			mbedtls_aes_crypt_cbc(&AES_ctx, MBEDTLS_AES_DECRYPT, size, newIV, source, destination);
 
 			_dbg_assert_msg_(WII_IPC_ES, keyIndex == 6, "IOCTL_ES_DECRYPT: Key type is not SD, data will be crap");
 		}
diff --git a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.cpp b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.cpp
index 70a6380fa5..ece7a6840d 100644
--- a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.cpp
+++ b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.cpp
@@ -28,12 +28,13 @@ CWII_IPC_HLE_Device_net_ssl::~CWII_IPC_HLE_Device_net_ssl()
 	{
 		if (ssl.active)
 		{
-			ssl_close_notify(&ssl.ctx);
-			ssl_session_free(&ssl.session);
-			ssl_free(&ssl.ctx);
+			mbedtls_ssl_close_notify(&ssl.ctx);
+			mbedtls_ssl_session_free(&ssl.session);
+			mbedtls_ssl_free(&ssl.ctx);
+			mbedtls_ssl_config_free(&ssl.config);
 
-			x509_crt_free(&ssl.cacert);
-			x509_crt_free(&ssl.clicert);
+			mbedtls_x509_crt_free(&ssl.cacert);
+			mbedtls_x509_crt_free(&ssl.clicert);
 
 			ssl.hostname.clear();
 
@@ -149,38 +150,36 @@ IPCCommandResult CWII_IPC_HLE_Device_net_ssl::IOCtlV(u32 _CommandAddress)
 		{
 			int sslID = freeSSL - 1;
 			WII_SSL* ssl = &_SSL[sslID];
-			int ret = ssl_init(&ssl->ctx);
-			if (ret)
-			{
-				goto _SSL_NEW_ERROR;
-			}
-
-			entropy_init(&ssl->entropy);
+			mbedtls_ssl_init(&ssl->ctx);
+			mbedtls_entropy_init(&ssl->entropy);
 			const char* pers = "dolphin-emu";
-			ret = ctr_drbg_init(&ssl->ctr_drbg, entropy_func,
-			                    &ssl->entropy,
-			                    (const unsigned char*)pers,
-			                    strlen(pers));
+			mbedtls_ctr_drbg_init(&ssl->ctr_drbg);
+			int ret = mbedtls_ctr_drbg_seed(&ssl->ctr_drbg, mbedtls_entropy_func,
+			                                &ssl->entropy,
+			                                (const unsigned char*)pers,
+			                                strlen(pers));
 			if (ret)
 			{
-				ssl_free(&ssl->ctx);
-				entropy_free(&ssl->entropy);
+				mbedtls_ssl_free(&ssl->ctx);
+				mbedtls_entropy_free(&ssl->entropy);
 				goto _SSL_NEW_ERROR;
 			}
 
-			ssl_set_rng(&ssl->ctx, ctr_drbg_random, &ssl->ctr_drbg);
+			mbedtls_ssl_config_init(&ssl->config);
+			mbedtls_ssl_config_defaults(&ssl->config, MBEDTLS_SSL_IS_CLIENT,
+			                            MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
+			mbedtls_ssl_conf_rng(&ssl->config, mbedtls_ctr_drbg_random, &ssl->ctr_drbg);
 
 			// For some reason we can't use TLSv1.2, v1.1 and below are fine!
-			ssl_set_max_version(&ssl->ctx, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2);
+			mbedtls_ssl_conf_max_version(&ssl->config, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_2);
 
-			ssl_set_session(&ssl->ctx, &ssl->session);
+			mbedtls_ssl_set_session(&ssl->ctx, &ssl->session);
 
-			ssl_set_endpoint(&ssl->ctx, SSL_IS_CLIENT);
-			ssl_set_authmode(&ssl->ctx, SSL_VERIFY_NONE);
-			ssl_set_renegotiation(&ssl->ctx, SSL_RENEGOTIATION_ENABLED);
+			mbedtls_ssl_conf_authmode(&ssl->config, MBEDTLS_SSL_VERIFY_NONE);
+			mbedtls_ssl_conf_renegotiation(&ssl->config, MBEDTLS_SSL_RENEGOTIATION_ENABLED);
 
 			ssl->hostname = hostname;
-			ssl_set_hostname(&ssl->ctx, ssl->hostname.c_str());
+			mbedtls_ssl_set_hostname(&ssl->ctx, ssl->hostname.c_str());
 
 			ssl->active = true;
 			Memory::Write_U32(freeSSL, _BufferIn);
@@ -207,14 +206,15 @@ _SSL_NEW_ERROR:
 		if (SSLID_VALID(sslID))
 		{
 			WII_SSL* ssl = &_SSL[sslID];
-			ssl_close_notify(&ssl->ctx);
-			ssl_session_free(&ssl->session);
-			ssl_free(&ssl->ctx);
+			mbedtls_ssl_close_notify(&ssl->ctx);
+			mbedtls_ssl_session_free(&ssl->session);
+			mbedtls_ssl_free(&ssl->ctx);
+			mbedtls_ssl_config_free(&ssl->config);
 
-			entropy_free(&ssl->entropy);
+			mbedtls_entropy_free(&ssl->entropy);
 
-			x509_crt_free(&ssl->cacert);
-			x509_crt_free(&ssl->clicert);
+			mbedtls_x509_crt_free(&ssl->cacert);
+			mbedtls_x509_crt_free(&ssl->clicert);
 
 			ssl->hostname.clear();
 
@@ -250,7 +250,7 @@ _SSL_NEW_ERROR:
 		if (SSLID_VALID(sslID))
 		{
 			WII_SSL* ssl = &_SSL[sslID];
-			int ret = x509_crt_parse_der(
+			int ret = mbedtls_x509_crt_parse_der(
 				&ssl->cacert,
 				Memory::GetPointer(BufferOut2),
 				BufferOutSize2);
@@ -261,7 +261,7 @@ _SSL_NEW_ERROR:
 			}
 			else
 			{
-				ssl_set_ca_chain(&ssl->ctx, &ssl->cacert, nullptr, ssl->hostname.c_str());
+				mbedtls_ssl_conf_ca_chain(&ssl->config, &ssl->cacert, nullptr);
 				Memory::Write_U32(SSL_OK, _BufferIn);
 			}
 
@@ -288,17 +288,17 @@ _SSL_NEW_ERROR:
 		{
 			WII_SSL* ssl = &_SSL[sslID];
 			std::string cert_base_path = File::GetUserPath(D_SESSION_WIIROOT_IDX);
-			int ret = x509_crt_parse_file(&ssl->clicert, (cert_base_path + "/clientca.pem").c_str());
-			int pk_ret = pk_parse_keyfile(&ssl->pk, (cert_base_path + "/clientcakey.pem").c_str(), nullptr);
+			int ret = mbedtls_x509_crt_parse_file(&ssl->clicert, (cert_base_path + "/clientca.pem").c_str());
+			int pk_ret = mbedtls_pk_parse_keyfile(&ssl->pk, (cert_base_path + "/clientcakey.pem").c_str(), nullptr);
 			if (ret || pk_ret)
 			{
-				x509_crt_free(&ssl->clicert);
-				pk_free(&ssl->pk);
+				mbedtls_x509_crt_free(&ssl->clicert);
+				mbedtls_pk_free(&ssl->pk);
 				Memory::Write_U32(SSL_ERR_FAILED, _BufferIn);
 			}
 			else
 			{
-				ssl_set_own_cert(&ssl->ctx, &ssl->clicert, &ssl->pk);
+				mbedtls_ssl_conf_own_cert(&ssl->config, &ssl->clicert, &ssl->pk);
 				Memory::Write_U32(SSL_OK, _BufferIn);
 			}
 
@@ -325,10 +325,10 @@ _SSL_NEW_ERROR:
 		if (SSLID_VALID(sslID))
 		{
 			WII_SSL* ssl = &_SSL[sslID];
-			x509_crt_free(&ssl->clicert);
-			pk_free(&ssl->pk);
+			mbedtls_x509_crt_free(&ssl->clicert);
+			mbedtls_pk_free(&ssl->pk);
 
-			ssl_set_own_cert(&ssl->ctx, nullptr, nullptr);
+			mbedtls_ssl_conf_own_cert(&ssl->config, nullptr, nullptr);
 			Memory::Write_U32(SSL_OK, _BufferIn);
 		}
 		else
@@ -345,15 +345,15 @@ _SSL_NEW_ERROR:
 		{
 			WII_SSL* ssl = &_SSL[sslID];
 
-			int ret = x509_crt_parse_file(&ssl->cacert, (File::GetUserPath(D_SESSION_WIIROOT_IDX) + "/rootca.pem").c_str());
+			int ret = mbedtls_x509_crt_parse_file(&ssl->cacert, (File::GetUserPath(D_SESSION_WIIROOT_IDX) + "/rootca.pem").c_str());
 			if (ret)
 			{
-				x509_crt_free(&ssl->clicert);
+				mbedtls_x509_crt_free(&ssl->clicert);
 				Memory::Write_U32(SSL_ERR_FAILED, _BufferIn);
 			}
 			else
 			{
-				ssl_set_ca_chain(&ssl->ctx, &ssl->cacert, nullptr, ssl->hostname.c_str());
+				mbedtls_ssl_conf_ca_chain(&ssl->config, &ssl->cacert, nullptr);
 				Memory::Write_U32(SSL_OK, _BufferIn);
 			}
 			INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINROOTCA = %d", ret);
@@ -377,9 +377,11 @@ _SSL_NEW_ERROR:
 		if (SSLID_VALID(sslID))
 		{
 			WII_SSL* ssl = &_SSL[sslID];
+			mbedtls_ssl_setup(&ssl->ctx, &ssl->config);
 			ssl->sockfd = Memory::Read_U32(BufferOut2);
 			INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_CONNECT socket = %d", ssl->sockfd);
-			ssl_set_bio(&ssl->ctx, net_recv, &ssl->sockfd, net_send, &ssl->sockfd);
+			mbedtls_ssl_set_bio(&ssl->ctx, &ssl->sockfd, mbedtls_net_send,
+			                    mbedtls_net_recv, mbedtls_net_recv_timeout);
 			Memory::Write_U32(SSL_OK, _BufferIn);
 		}
 		else
diff --git a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.h b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.h
index 66bd4cab1d..8665435acf 100644
--- a/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.h
+++ b/Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_net_ssl.h
@@ -5,10 +5,10 @@
 #pragma once
 
 #include <string>
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/entropy.h>
-#include <polarssl/net.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/net.h>
+#include <mbedtls/ssl.h>
 
 #include "Core/IPC_HLE/WII_IPC_HLE_Device.h"
 
@@ -56,13 +56,14 @@ enum SSL_IOCTL
 
 struct WII_SSL
 {
-	ssl_context ctx;
-	ssl_session session;
-	entropy_context entropy;
-	ctr_drbg_context ctr_drbg;
-	x509_crt cacert;
-	x509_crt clicert;
-	pk_context pk;
+	mbedtls_ssl_context ctx;
+	mbedtls_ssl_config config;
+	mbedtls_ssl_session session;
+	mbedtls_entropy_context entropy;
+	mbedtls_ctr_drbg_context ctr_drbg;
+	mbedtls_x509_crt cacert;
+	mbedtls_x509_crt clicert;
+	mbedtls_pk_context pk;
 	int sockfd;
 	std::string hostname;
 	bool active;
diff --git a/Source/Core/Core/IPC_HLE/WII_Socket.cpp b/Source/Core/Core/IPC_HLE/WII_Socket.cpp
index aea7bfc001..3823cdff5d 100644
--- a/Source/Core/Core/IPC_HLE/WII_Socket.cpp
+++ b/Source/Core/Core/IPC_HLE/WII_Socket.cpp
@@ -313,18 +313,18 @@ void WiiSocket::Update(bool read, bool write, bool except)
 					case IOCTLV_NET_SSL_DOHANDSHAKE:
 					{
 
-						int ret = ssl_handshake(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx);
+						int ret = mbedtls_ssl_handshake(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx);
 						switch (ret)
 						{
 						case 0:
 							Memory::Write_U32(SSL_OK, BufferIn);
 							break;
-						case POLARSSL_ERR_NET_WANT_READ:
+						case MBEDTLS_ERR_SSL_WANT_READ:
 							Memory::Write_U32(SSL_ERR_RAGAIN, BufferIn);
 							if (!nonBlock)
 								ReturnValue = SSL_ERR_RAGAIN;
 							break;
-						case POLARSSL_ERR_NET_WANT_WRITE:
+						case MBEDTLS_ERR_SSL_WANT_WRITE:
 							Memory::Write_U32(SSL_ERR_WAGAIN, BufferIn);
 							if (!nonBlock)
 								ReturnValue = SSL_ERR_WAGAIN;
@@ -344,7 +344,7 @@ void WiiSocket::Update(bool read, bool write, bool except)
 					}
 					case IOCTLV_NET_SSL_WRITE:
 					{
-						int ret = ssl_write(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx, Memory::GetPointer(BufferOut2), BufferOutSize2);
+						int ret = mbedtls_ssl_write(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx, Memory::GetPointer(BufferOut2), BufferOutSize2);
 
 #ifdef DEBUG_SSL
 						File::IOFile("ssl_write.bin", "ab").WriteBytes(Memory::GetPointer(BufferOut2), BufferOutSize2);
@@ -358,12 +358,12 @@ void WiiSocket::Update(bool read, bool write, bool except)
 						{
 							switch (ret)
 							{
-							case POLARSSL_ERR_NET_WANT_READ:
+							case MBEDTLS_ERR_SSL_WANT_READ:
 								Memory::Write_U32(SSL_ERR_RAGAIN, BufferIn);
 								if (!nonBlock)
 									ReturnValue = SSL_ERR_RAGAIN;
 								break;
-							case POLARSSL_ERR_NET_WANT_WRITE:
+							case MBEDTLS_ERR_SSL_WANT_WRITE:
 								Memory::Write_U32(SSL_ERR_WAGAIN, BufferIn);
 								if (!nonBlock)
 									ReturnValue = SSL_ERR_WAGAIN;
@@ -377,7 +377,7 @@ void WiiSocket::Update(bool read, bool write, bool except)
 					}
 					case IOCTLV_NET_SSL_READ:
 					{
-						int ret = ssl_read(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx, Memory::GetPointer(BufferIn2), BufferInSize2);
+						int ret = mbedtls_ssl_read(&CWII_IPC_HLE_Device_net_ssl::_SSL[sslID].ctx, Memory::GetPointer(BufferIn2), BufferInSize2);
 #ifdef DEBUG_SSL
 						if (ret > 0)
 						{
@@ -393,12 +393,12 @@ void WiiSocket::Update(bool read, bool write, bool except)
 						{
 							switch (ret)
 							{
-							case POLARSSL_ERR_NET_WANT_READ:
+							case MBEDTLS_ERR_SSL_WANT_READ:
 								Memory::Write_U32(SSL_ERR_RAGAIN, BufferIn);
 								if (!nonBlock)
 									ReturnValue = SSL_ERR_RAGAIN;
 								break;
-							case POLARSSL_ERR_NET_WANT_WRITE:
+							case MBEDTLS_ERR_SSL_WANT_WRITE:
 								Memory::Write_U32(SSL_ERR_WAGAIN, BufferIn);
 								if (!nonBlock)
 									ReturnValue = SSL_ERR_WAGAIN;
diff --git a/Source/Core/Core/Movie.cpp b/Source/Core/Core/Movie.cpp
index 9d7e437592..f31073e7d5 100644
--- a/Source/Core/Core/Movie.cpp
+++ b/Source/Core/Core/Movie.cpp
@@ -3,7 +3,8 @@
 // Refer to the license.txt file included.
 
 #include <mutex>
-#include <polarssl/md5.h>
+#include <mbedtls/config.h>
+#include <mbedtls/md.h>
 
 #include "Common/ChunkFile.h"
 #include "Common/CommonPaths.h"
@@ -1350,6 +1351,8 @@ void GetSettings()
 	}
 }
 
+static const mbedtls_md_info_t* s_md5_info = mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
+
 void CheckMD5()
 {
 	for (int i = 0, n = 0; i < 16; ++i)
@@ -1363,7 +1366,7 @@ void CheckMD5()
 	Core::DisplayMessage("Verifying checksum...", 2000);
 
 	unsigned char gameMD5[16];
-	md5_file(SConfig::GetInstance().m_strFilename.c_str(), gameMD5);
+	mbedtls_md_file(s_md5_info, SConfig::GetInstance().m_strFilename.c_str(), gameMD5);
 
 	if (memcmp(gameMD5,s_MD5,16) == 0)
 		Core::DisplayMessage("Checksum of current game matches the recorded game.", 2000);
@@ -1375,7 +1378,7 @@ void GetMD5()
 {
 	Core::DisplayMessage("Calculating checksum of game file...", 2000);
 	memset(s_MD5, 0, sizeof(s_MD5));
-	md5_file(SConfig::GetInstance().m_strFilename.c_str(), s_MD5);
+	mbedtls_md_file(s_md5_info, SConfig::GetInstance().m_strFilename.c_str(), s_MD5);
 	Core::DisplayMessage("Finished calculating checksum.", 2000);
 }
 
diff --git a/Source/Core/Core/ec_wii.cpp b/Source/Core/Core/ec_wii.cpp
index 06d30151c7..a36caf96ae 100644
--- a/Source/Core/Core/ec_wii.cpp
+++ b/Source/Core/Core/ec_wii.cpp
@@ -10,7 +10,7 @@
 #include <cstdio>
 #include <string.h>
 
-#include <polarssl/sha1.h>
+#include <mbedtls/sha1.h>
 
 #include "Common/FileUtil.h"
 #include "Common/Crypto/ec.h"
@@ -97,10 +97,10 @@ void get_ap_sig_and_cert(u8 *sig_out, u8 *ap_cert_out, u64 title_id, u8 *data, u
 	sprintf(name, "AP%08x%08x", (u32)(title_id >> 32), (u32)(title_id & 0xffffffff));
 	make_blanksig_ec_cert(ap_cert_out, signer, name, ap_priv, 0);
 
-	sha1(ap_cert_out + 0x80, 0x100, hash);
+	mbedtls_sha1(ap_cert_out + 0x80, 0x100, hash);
 	generate_ecdsa(ap_cert_out + 4, ap_cert_out + 34, NG_priv, hash);
 
-	sha1(data, data_size, hash);
+	mbedtls_sha1(data, data_size, hash);
 	generate_ecdsa(sig_out, sig_out + 30, ap_priv, hash);
 }
 
diff --git a/Source/Core/DiscIO/DiscIO.vcxproj b/Source/Core/DiscIO/DiscIO.vcxproj
index 3250c37531..2927bc4781 100644
--- a/Source/Core/DiscIO/DiscIO.vcxproj
+++ b/Source/Core/DiscIO/DiscIO.vcxproj
@@ -78,7 +78,7 @@
     <Text Include="CMakeLists.txt" />
   </ItemGroup>
   <ItemGroup>
-    <ProjectReference Include="$(ExternalsDir)polarssl\visualc\PolarSSL.vcxproj">
+    <ProjectReference Include="$(ExternalsDir)mbedtls\mbedTLS.vcxproj">
       <Project>{bdb6578b-0691-4e80-a46c-df21639fd3b8}</Project>
     </ProjectReference>
     <ProjectReference Include="$(ExternalsDir)zlib\zlib.vcxproj">
@@ -91,4 +91,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/Source/Core/DiscIO/NANDContentLoader.cpp b/Source/Core/DiscIO/NANDContentLoader.cpp
index 733f0735d8..0e26fa051e 100644
--- a/Source/Core/DiscIO/NANDContentLoader.cpp
+++ b/Source/Core/DiscIO/NANDContentLoader.cpp
@@ -10,7 +10,7 @@
 #include <string>
 #include <utility>
 #include <vector>
-#include <polarssl/aes.h>
+#include <mbedtls/aes.h>
 
 #include "Common/CommonTypes.h"
 #include "Common/FileUtil.h"
@@ -279,10 +279,10 @@ bool CNANDContentLoader::Initialize(const std::string& _rName)
 }
 void CNANDContentLoader::AESDecode(u8* _pKey, u8* _IV, u8* _pSrc, u32 _Size, u8* _pDest)
 {
-	aes_context AES_ctx;
+	mbedtls_aes_context AES_ctx;
 
-	aes_setkey_dec(&AES_ctx, _pKey, 128);
-	aes_crypt_cbc(&AES_ctx, AES_DECRYPT, _Size, _IV, _pSrc, _pDest);
+	mbedtls_aes_setkey_dec(&AES_ctx, _pKey, 128);
+	mbedtls_aes_crypt_cbc(&AES_ctx, MBEDTLS_AES_DECRYPT, _Size, _IV, _pSrc, _pDest);
 }
 
 void CNANDContentLoader::GetKeyFromTicket(u8* pTicket, u8* pTicketKey)
diff --git a/Source/Core/DiscIO/VolumeCreator.cpp b/Source/Core/DiscIO/VolumeCreator.cpp
index 4b3e90e2d0..66ee188d9c 100644
--- a/Source/Core/DiscIO/VolumeCreator.cpp
+++ b/Source/Core/DiscIO/VolumeCreator.cpp
@@ -9,7 +9,7 @@
 #include <utility>
 #include <vector>
 
-#include <polarssl/aes.h>
+#include <mbedtls/aes.h>
 
 #include "Common/CommonTypes.h"
 #include "Common/StringUtil.h"
@@ -139,10 +139,10 @@ void VolumeKeyForPartition(IBlobReader& _rReader, u64 offset, u8* VolumeKey)
 	if (Reader.Read8(0x3) == 'K' && Reader.Read8(offset + 0x1f1) == 1)
 		usingKoreanKey = true;
 
-	aes_context AES_ctx;
-	aes_setkey_dec(&AES_ctx, (usingKoreanKey ? s_master_key_korean : s_master_key), 128);
+	mbedtls_aes_context AES_ctx;
+	mbedtls_aes_setkey_dec(&AES_ctx, (usingKoreanKey ? s_master_key_korean : s_master_key), 128);
 
-	aes_crypt_cbc(&AES_ctx, AES_DECRYPT, 16, IV, SubKey, VolumeKey);
+	mbedtls_aes_crypt_cbc(&AES_ctx, MBEDTLS_AES_DECRYPT, 16, IV, SubKey, VolumeKey);
 }
 
 static IVolume* CreateVolumeFromCryptedWiiImage(std::unique_ptr<IBlobReader> reader, u32 _PartitionGroup, u32 _VolumeType, u32 _VolumeNum)
diff --git a/Source/Core/DiscIO/VolumeWiiCrypted.cpp b/Source/Core/DiscIO/VolumeWiiCrypted.cpp
index 2812647c84..6483f971ce 100644
--- a/Source/Core/DiscIO/VolumeWiiCrypted.cpp
+++ b/Source/Core/DiscIO/VolumeWiiCrypted.cpp
@@ -9,8 +9,8 @@
 #include <string>
 #include <utility>
 #include <vector>
-#include <polarssl/aes.h>
-#include <polarssl/sha1.h>
+#include <mbedtls/aes.h>
+#include <mbedtls/sha1.h>
 
 #include "Common/CommonFuncs.h"
 #include "Common/CommonTypes.h"
@@ -30,13 +30,13 @@ namespace DiscIO
 CVolumeWiiCrypted::CVolumeWiiCrypted(std::unique_ptr<IBlobReader> reader, u64 _VolumeOffset,
 									 const unsigned char* _pVolumeKey)
 	: m_pReader(std::move(reader)),
-	m_AES_ctx(new aes_context),
+	m_AES_ctx(new mbedtls_aes_context),
 	m_pBuffer(nullptr),
 	m_VolumeOffset(_VolumeOffset),
 	m_dataOffset(0x20000),
 	m_LastDecryptedBlockOffset(-1)
 {
-	aes_setkey_dec(m_AES_ctx.get(), _pVolumeKey, 128);
+	mbedtls_aes_setkey_dec(m_AES_ctx.get(), _pVolumeKey, 128);
 	m_pBuffer = new u8[s_block_total_size];
 }
 
@@ -47,7 +47,7 @@ bool CVolumeWiiCrypted::ChangePartition(u64 offset)
 
 	u8 volume_key[16];
 	DiscIO::VolumeKeyForPartition(*m_pReader, offset, volume_key);
-	aes_setkey_dec(m_AES_ctx.get(), volume_key, 128);
+	mbedtls_aes_setkey_dec(m_AES_ctx.get(), volume_key, 128);
 	return true;
 }
 
@@ -83,7 +83,7 @@ bool CVolumeWiiCrypted::Read(u64 _ReadOffset, u64 _Length, u8* _pBuffer, bool de
 			// 0x3D0 - 0x3DF in m_pBuffer will be overwritten,
 			// but that won't affect anything, because we won't
 			// use the content of m_pBuffer anymore after this
-			aes_crypt_cbc(m_AES_ctx.get(), AES_DECRYPT, s_block_data_size, m_pBuffer + 0x3D0,
+			mbedtls_aes_crypt_cbc(m_AES_ctx.get(), MBEDTLS_AES_DECRYPT, s_block_data_size, m_pBuffer + 0x3D0,
 			              m_pBuffer + s_block_header_size, m_LastDecryptedBlock);
 			m_LastDecryptedBlockOffset = Block;
 
@@ -292,7 +292,7 @@ bool CVolumeWiiCrypted::CheckIntegrity() const
 			NOTICE_LOG(DISCIO, "Integrity Check: fail at cluster %d: could not read metadata", clusterID);
 			return false;
 		}
-		aes_crypt_cbc(m_AES_ctx.get(), AES_DECRYPT, 0x400, IV, clusterMDCrypted, clusterMD);
+		mbedtls_aes_crypt_cbc(m_AES_ctx.get(), MBEDTLS_AES_DECRYPT, 0x400, IV, clusterMDCrypted, clusterMD);
 
 
 		// Some clusters have invalid data and metadata because they aren't
@@ -322,7 +322,7 @@ bool CVolumeWiiCrypted::CheckIntegrity() const
 		{
 			u8 hash[20];
 
-			sha1(clusterData + hashID * 0x400, 0x400, hash);
+			mbedtls_sha1(clusterData + hashID * 0x400, 0x400, hash);
 
 			// Note that we do not use strncmp here
 			if (memcmp(hash, clusterMD + hashID * 20, 20))
diff --git a/Source/Core/DiscIO/VolumeWiiCrypted.h b/Source/Core/DiscIO/VolumeWiiCrypted.h
index bfd5c6df8b..c88138faf6 100644
--- a/Source/Core/DiscIO/VolumeWiiCrypted.h
+++ b/Source/Core/DiscIO/VolumeWiiCrypted.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 #include <vector>
-#include <polarssl/aes.h>
+#include <mbedtls/aes.h>
 
 #include "Common/CommonTypes.h"
 #include "DiscIO/Blob.h"
@@ -54,7 +54,7 @@ private:
 	static const unsigned int s_block_total_size  = s_block_header_size + s_block_data_size;
 
 	std::unique_ptr<IBlobReader> m_pReader;
-	std::unique_ptr<aes_context> m_AES_ctx;
+	std::unique_ptr<mbedtls_aes_context> m_AES_ctx;
 
 	u8* m_pBuffer;
 
diff --git a/Source/Core/DolphinWX/ISOProperties.cpp b/Source/Core/DolphinWX/ISOProperties.cpp
index 62f63a9643..c790098ca9 100644
--- a/Source/Core/DolphinWX/ISOProperties.cpp
+++ b/Source/Core/DolphinWX/ISOProperties.cpp
@@ -15,7 +15,7 @@
 #include <string>
 #include <type_traits>
 #include <vector>
-#include <polarssl/md5.h>
+#include <mbedtls/md5.h>
 #include <wx/bitmap.h>
 #include <wx/button.h>
 #include <wx/checkbox.h>
@@ -1235,7 +1235,7 @@ void CISOProperties::OnComputeMD5Sum(wxCommandEvent& WXUNUSED (event))
 	std::string output_string;
 	std::vector<u8> data(8 * 1024 * 1024);
 	u64 read_offset = 0;
-	md5_context ctx;
+	mbedtls_md5_context ctx;
 
 	File::IOFile file(OpenGameListItem.GetFileName(), "rb");
 	u64 game_size = file.GetSize();
@@ -1250,7 +1250,7 @@ void CISOProperties::OnComputeMD5Sum(wxCommandEvent& WXUNUSED (event))
 		wxPD_SMOOTH
 		);
 
-	md5_starts(&ctx);
+	mbedtls_md5_starts(&ctx);
 
 	while(read_offset < game_size)
 	{
@@ -1259,12 +1259,12 @@ void CISOProperties::OnComputeMD5Sum(wxCommandEvent& WXUNUSED (event))
 
 		size_t read_size;
 		file.ReadArray(&data[0], data.size(), &read_size);
-		md5_update(&ctx, &data[0], read_size);
+		mbedtls_md5_update(&ctx, &data[0], read_size);
 
 		read_offset += read_size;
 	}
 
-	md5_finish(&ctx, output);
+	mbedtls_md5_finish(&ctx, output);
 
 	// Convert to hex
 	for (int a = 0; a < 16; ++a)
diff --git a/Source/VSProps/Base.props b/Source/VSProps/Base.props
index 4730347a86..86ad26a5ad 100644
--- a/Source/VSProps/Base.props
+++ b/Source/VSProps/Base.props
@@ -41,7 +41,7 @@
       <AdditionalIncludeDirectories>$(ExternalsDir)libusb\libusb;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <AdditionalIncludeDirectories>$(ExternalsDir)LZO;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <AdditionalIncludeDirectories>$(ExternalsDir)miniupnpc\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <AdditionalIncludeDirectories>$(ExternalsDir)polarssl\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ExternalsDir)mbedtls\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <AdditionalIncludeDirectories>$(ExternalsDir)portaudio\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <AdditionalIncludeDirectories>$(ExternalsDir)SFML\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <AdditionalIncludeDirectories>$(ExternalsDir)SOIL;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
diff --git a/Source/VSProps/QtCompile.props b/Source/VSProps/QtCompile.props
index 3b602c0a5d..3d72766eb6 100644
--- a/Source/VSProps/QtCompile.props
+++ b/Source/VSProps/QtCompile.props
@@ -89,7 +89,7 @@
         in order to prevent the trailing slash from escaping the doublequote after value replacement.
         -->
     <MocIncludes>"-I$(QtIncludeDir)QtWidgets" "-I$(QtIncludeDir)QtGui" "-I$(QtIncludeDir)QtCore" "-I$(QtIncludeDir) " "-I$(QtToolOutDir) " -I.</MocIncludes>
-    <MocIncludes>"-I$(ExternalsDir)xxhash" "-I$(ExternalsDir)zlib" "-I$(ExternalsDir)SOIL" "-I$(ExternalsDir)SFML\include" "-I$(ExternalsDir)portaudio\include" "-I$(ExternalsDir)polarssl\include" "-I$(ExternalsDir)miniupnpc\src" "-I$(ExternalsDir)LZO" "-I$(ExternalsDir)libusbx\libusb" "-I$(ExternalsDir)libpng" "-I$(ExternalsDir)GL" "-I$(ExternalsDir)Bochs_disasm" "-I$(ExternalsDir) " "-I$(CoreDir) " $(MocIncludes)</MocIncludes>
+    <MocIncludes>"-I$(ExternalsDir)xxhash" "-I$(ExternalsDir)zlib" "-I$(ExternalsDir)SOIL" "-I$(ExternalsDir)SFML\include" "-I$(ExternalsDir)portaudio\include" "-I$(ExternalsDir)mbedtls\include" "-I$(ExternalsDir)miniupnpc\src" "-I$(ExternalsDir)LZO" "-I$(ExternalsDir)libusbx\libusb" "-I$(ExternalsDir)libpng" "-I$(ExternalsDir)GL" "-I$(ExternalsDir)Bochs_disasm" "-I$(ExternalsDir) " "-I$(CoreDir) " $(MocIncludes)</MocIncludes>
   </PropertyGroup>
   <Target Name="QtMoc"
     BeforeTargets="ClCompile"
diff --git a/Source/dolphin-emu.sln b/Source/dolphin-emu.sln
index b76f08f3e9..f80da90dc2 100644
--- a/Source/dolphin-emu.sln
+++ b/Source/dolphin-emu.sln
@@ -45,7 +45,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SoundTouch", "..\Externals\
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "wxWidgets", "..\Externals\wxWidgets3\build\msw\wx_base.vcxproj", "{1C8436C9-DBAF-42BE-83BC-CF3EC9175ABE}"
 EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PolarSSL", "..\Externals\polarssl\visualc\PolarSSL.vcxproj", "{BDB6578B-0691-4E80-A46C-DF21639FD3B8}"
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "mbedTLS", "..\Externals\mbedtls\mbedTLS.vcxproj", "{BDB6578B-0691-4E80-A46C-DF21639FD3B8}"
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SCMRevGen", "Core\Common\SCMRevGen.vcxproj", "{41279555-F94F-4EBC-99DE-AF863C10C5C4}"
 EndProject