22 #include <mbedtls/certs.h>
23 #include <mbedtls/config.h>
24 #include <mbedtls/ctr_drbg.h>
25 #include <mbedtls/entropy.h>
26 #include <mbedtls/net_sockets.h>
27 #include <mbedtls/platform.h>
28 #include <mbedtls/ssl.h>
29 #include <mbedtls/x509_crt.h>
50 #define OFFSET(x) offsetof(TLSContext, x)
58 mbedtls_x509_crt_free(&tls_ctx->
ca_cert);
59 mbedtls_x509_crt_free(&tls_ctx->
own_cert);
73 return react_on_eagain;
78 return MBEDTLS_ERR_NET_CONN_RESET;
82 return MBEDTLS_ERR_NET_SEND_FAILED;
93 if (
h->max_packet_size &&
len >
h->max_packet_size)
94 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
106 if (
h->max_packet_size &&
len >
h->max_packet_size)
107 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
115 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
116 av_log(
h,
AV_LOG_ERROR,
"Read of key file failed. Is it actually there, are the access permissions correct?\n");
118 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
121 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
133 case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE:
134 av_log(
h,
AV_LOG_ERROR,
"None of the common ciphersuites is usable. Was the local certificate correctly set?\n");
136 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
137 av_log(
h,
AV_LOG_ERROR,
"A fatal alert message was received from the peer, has the peer a correct certificate?\n");
139 case MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED:
140 av_log(
h,
AV_LOG_ERROR,
"No CA chain is set, but required to operate. Was the CA correctly set?\n");
142 case MBEDTLS_ERR_NET_CONN_RESET:
154 const char *p = strchr(uri,
'?');
166 uint32_t verify_res_flags;
176 mbedtls_ssl_config_init(&tls_ctx->
ssl_config);
179 mbedtls_x509_crt_init(&tls_ctx->
ca_cert);
180 mbedtls_pk_init(&tls_ctx->
priv_key);
200 if ((
ret = mbedtls_pk_parse_keyfile(&tls_ctx->
priv_key,
210 mbedtls_entropy_func,
218 shr->
listen ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT,
219 MBEDTLS_SSL_TRANSPORT_STREAM,
220 MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
225 mbedtls_ssl_conf_authmode(&tls_ctx->
ssl_config,
226 shr->
ca_file ? MBEDTLS_SSL_VERIFY_REQUIRED : MBEDTLS_SSL_VERIFY_NONE);
252 while ((
ret = mbedtls_ssl_handshake(&tls_ctx->
ssl_context)) != 0) {
253 if (
ret != MBEDTLS_ERR_SSL_WANT_READ &&
ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
261 if ((verify_res_flags = mbedtls_ssl_get_verify_result(&tls_ctx->
ssl_context)) != 0) {
263 "with the certificate verification, returned flags: %u\n",
265 if (verify_res_flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
281 case MBEDTLS_ERR_SSL_WANT_READ:
282 case MBEDTLS_ERR_SSL_WANT_WRITE:
284 case MBEDTLS_ERR_NET_SEND_FAILED:
285 case MBEDTLS_ERR_NET_RECV_FAILED:
287 case MBEDTLS_ERR_NET_CONN_RESET:
288 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: