31 #include <gnutls/gnutls.h>
32 #include <gnutls/x509.h>
33 #define TLS_read(c, buf, size) gnutls_record_recv((c)->session, (buf), (size))
34 #define TLS_write(c, buf, size) gnutls_record_send((c)->session, (buf), (size))
35 #define TLS_shutdown(c) gnutls_bye((c)->session, GNUTLS_SHUT_RDWR)
36 #define TLS_free(c) do { \
38 gnutls_deinit((c)->session); \
40 gnutls_certificate_free_credentials((c)->cred); \
43 #include <openssl/bio.h>
44 #include <openssl/ssl.h>
45 #include <openssl/err.h>
46 #define TLS_read(c, buf, size) SSL_read((c)->ssl, (buf), (size))
47 #define TLS_write(c, buf, size) SSL_write((c)->ssl, (buf), (size))
48 #define TLS_shutdown(c) SSL_shutdown((c)->ssl)
49 #define TLS_free(c) do { \
53 SSL_CTX_free((c)->ctx); \
64 gnutls_session_t session;
65 gnutls_certificate_credentials_t cred;
78 #define OFFSET(x) offsetof(TLSContext, x)
79 #define D AV_OPT_FLAG_DECODING_PARAM
80 #define E AV_OPT_FLAG_ENCODING_PARAM
84 {
"tls_verify",
"Verify the peer certificate",
OFFSET(verify),
AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags =
D|
E },
87 {
"listen",
"Listen for incoming connections",
OFFSET(listen),
AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags =
D|
E },
101 struct pollfd p = { c->
fd, 0, 0 };
105 case GNUTLS_E_INTERRUPTED:
107 case GNUTLS_E_WARNING_ALERT_RECEIVED:
114 if (gnutls_record_get_direction(c->session))
119 ret = SSL_get_error(c->ssl, ret);
120 if (ret == SSL_ERROR_WANT_READ) {
122 }
else if (ret == SSL_ERROR_WANT_WRITE) {
132 int n = poll(&p, 1, 100);
145 const char *p = strchr(uri,
'?');
154 c->
verify = strtol(buf, &endptr, 10);
172 char buf[200], host[200], opts[50] =
"";
175 const char *proxy_path;
182 snprintf(opts,
sizeof(opts),
"?listen=1");
186 p = strchr(uri,
'?');
203 proxy_path = getenv(
"http_proxy");
208 char proxy_host[200], proxy_auth[200], dest[200];
211 proxy_host,
sizeof(proxy_host), &proxy_port,
NULL, 0,
214 ff_url_join(buf,
sizeof(buf),
"httpproxy", proxy_auth, proxy_host,
215 proxy_port,
"/%s", dest);
225 gnutls_init(&c->session, c->
listen ? GNUTLS_SERVER : GNUTLS_CLIENT);
226 if (!c->
listen && !numerichost)
227 gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
228 gnutls_certificate_allocate_credentials(&c->cred);
231 ret = gnutls_certificate_set_x509_trust_file(c->cred, c->
ca_file, GNUTLS_X509_FMT_PEM);
235 #if GNUTLS_VERSION_MAJOR >= 3
237 gnutls_certificate_set_x509_system_trust(c->cred);
239 gnutls_certificate_set_verify_flags(c->cred, c->
verify ?
240 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT : 0);
242 ret = gnutls_certificate_set_x509_key_file(c->cred,
244 GNUTLS_X509_FMT_PEM);
247 "Unable to set cert/key files %s and %s: %s\n",
254 gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
255 gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)
257 gnutls_priority_set_direct(c->session,
"NORMAL",
NULL);
259 ret = gnutls_handshake(c->session);
266 unsigned int status, cert_list_size;
267 gnutls_x509_crt_t cert;
268 const gnutls_datum_t *cert_list;
269 if ((ret = gnutls_certificate_verify_peers2(c->session, &status)) < 0) {
271 gnutls_strerror(ret));
275 if (status & GNUTLS_CERT_INVALID) {
280 if (gnutls_certificate_type_get(c->session) != GNUTLS_CRT_X509) {
285 gnutls_x509_crt_init(&cert);
286 cert_list = gnutls_certificate_get_peers(c->session, &cert_list_size);
287 gnutls_x509_crt_import(cert, cert_list, GNUTLS_X509_FMT_DER);
288 ret = gnutls_x509_crt_check_hostname(cert, host);
289 gnutls_x509_crt_deinit(cert);
292 "The certificate's owner does not match hostname %s\n", host);
298 c->ctx = SSL_CTX_new(c->
listen ? TLSv1_server_method() : TLSv1_client_method());
306 if (!SSL_CTX_load_verify_locations(c->ctx, c->
ca_file,
NULL))
315 if (c->
key_file && !SSL_CTX_use_PrivateKey_file(c->ctx, c->
key_file, SSL_FILETYPE_PEM)) {
324 SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
NULL);
325 c->ssl = SSL_new(c->ctx);
331 SSL_set_fd(c->ssl, c->
fd);
332 if (!c->
listen && !numerichost)
333 SSL_set_tlsext_host_name(c->ssl, host);
335 ret = c->
listen ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
360 int ret = TLS_read(c, buf, size);
375 int ret = TLS_write(c, buf, size);
404 .priv_data_class = &tls_class,
void av_url_split(char *proto, int proto_size, char *authorization, int authorization_size, char *hostname, int hostname_size, int *port_ptr, char *path, int path_size, const char *url)
Split a URL string into components.
#define URL_PROTOCOL_FLAG_NETWORK
#define AV_LOG_WARNING
Something somehow does not look correct.
#define LIBAVUTIL_VERSION_INT
AVIOInterruptCB interrupt_callback
static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
const char * class_name
The name of the class; usually it is the same name as the context structure type to which the AVClass...
miscellaneous OS support macros and functions.
static int tls_read(URLContext *h, uint8_t *buf, int size)
#define AVERROR_EOF
End of file.
int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)
Attempt to find a specific tag in a URL.
static const AVOption options[]
#define AV_LOG_ERROR
Something went wrong and cannot losslessly be recovered.
static int do_tls_poll(URLContext *h, int ret)
URLProtocol ff_tls_protocol
static const AVClass tls_class
int ff_http_match_no_proxy(const char *no_proxy, const char *hostname)
int ffurl_get_file_handle(URLContext *h)
Return the file descriptor associated with this URL.
static int tls_close(URLContext *h)
int ff_url_join(char *str, int size, const char *proto, const char *authorization, const char *hostname, int port, const char *fmt,...)
int ff_check_interrupt(AVIOInterruptCB *cb)
Check if the user has requested to interrup a blocking function associated with cb.
char * av_strdup(const char *s)
Duplicate the string s.
#define AVIO_FLAG_NONBLOCK
Use non-blocking mode.
#define AVIO_FLAG_READ_WRITE
read-write pseudo flag
Describe the class of an AVClass context structure.
static void set_options(URLContext *h, const char *uri)
int ffurl_close(URLContext *h)
int av_strstart(const char *str, const char *pfx, const char **ptr)
Return non-zero if pfx is a prefix of str.
int ffurl_open(URLContext **puc, const char *filename, int flags, const AVIOInterruptCB *int_cb, AVDictionary **options)
Create an URLContext for accessing to the resource indicated by url, and open it. ...
static int tls_write(URLContext *h, const uint8_t *buf, int size)
unbuffered private I/O API