24 #include "libavutil/avstring.h"
25 #include "libavutil/opt.h"
26 #include "libavutil/parseutils.h"
28 #include <gnutls/gnutls.h>
29 #include <gnutls/x509.h>
30 #define TLS_read(c, buf, size) gnutls_record_recv(c->session, buf, size)
31 #define TLS_write(c, buf, size) gnutls_record_send(c->session, buf, size)
32 #define TLS_shutdown(c) gnutls_bye(c->session, GNUTLS_SHUT_RDWR)
33 #define TLS_free(c) do { \
35 gnutls_deinit(c->session); \
37 gnutls_certificate_free_credentials(c->cred); \
40 #include <openssl/bio.h>
41 #include <openssl/ssl.h>
42 #include <openssl/err.h>
43 #define TLS_read(c, buf, size) SSL_read(c->ssl, buf, size)
44 #define TLS_write(c, buf, size) SSL_write(c->ssl, buf, size)
45 #define TLS_shutdown(c) SSL_shutdown(c->ssl)
46 #define TLS_free(c) do { \
50 SSL_CTX_free(c->ctx); \
64 gnutls_session_t session;
65 gnutls_certificate_credentials_t cred;
78 #define OFFSET(x) offsetof(TLSContext, x)
79 #define D AV_OPT_FLAG_DECODING_PARAM
80 #define E AV_OPT_FLAG_ENCODING_PARAM
83 {
"tls_verify",
"Verify the peer certificate",
OFFSET(verify),
AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags =
D|
E },
86 {
"listen",
"Listen for incoming connections",
OFFSET(listen),
AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags =
D|
E },
100 struct pollfd p = { c->
fd, 0, 0 };
104 case GNUTLS_E_INTERRUPTED:
106 case GNUTLS_E_WARNING_ALERT_RECEIVED:
113 if (gnutls_record_get_direction(c->session))
118 ret = SSL_get_error(c->ssl, ret);
119 if (ret == SSL_ERROR_WANT_READ) {
121 }
else if (ret == SSL_ERROR_WANT_WRITE) {
131 int n = poll(&p, 1, 100);
145 char buf[200], host[200], opts[50] =
"";
148 const char *proxy_path;
154 snprintf(opts,
sizeof(opts),
"?listen=1");
165 proxy_path = getenv(
"http_proxy");
170 char proxy_host[200], proxy_auth[200], dest[200];
173 proxy_host,
sizeof(proxy_host), &proxy_port,
NULL, 0,
176 ff_url_join(buf,
sizeof(buf),
"httpproxy", proxy_auth, proxy_host,
177 proxy_port,
"/%s", dest);
187 gnutls_init(&c->session, c->
listen ? GNUTLS_SERVER : GNUTLS_CLIENT);
188 if (!c->
listen && !numerichost)
189 gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
190 gnutls_certificate_allocate_credentials(&c->cred);
192 gnutls_certificate_set_x509_trust_file(c->cred, c->
ca_file, GNUTLS_X509_FMT_PEM);
193 #if GNUTLS_VERSION_MAJOR >= 3
195 gnutls_certificate_set_x509_system_trust(c->cred);
197 gnutls_certificate_set_verify_flags(c->cred, c->
verify ?
198 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT : 0);
200 ret = gnutls_certificate_set_x509_key_file(c->cred,
202 GNUTLS_X509_FMT_PEM);
205 "Unable to set cert/key files %s and %s: %s\n",
211 gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
212 gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)
214 gnutls_priority_set_direct(c->session,
"NORMAL",
NULL);
216 ret = gnutls_handshake(c->session);
223 unsigned int status, cert_list_size;
224 gnutls_x509_crt_t cert;
225 const gnutls_datum_t *cert_list;
226 if ((ret = gnutls_certificate_verify_peers2(c->session, &status)) < 0) {
228 gnutls_strerror(ret));
232 if (status & GNUTLS_CERT_INVALID) {
237 if (gnutls_certificate_type_get(c->session) != GNUTLS_CRT_X509) {
242 gnutls_x509_crt_init(&cert);
243 cert_list = gnutls_certificate_get_peers(c->session, &cert_list_size);
244 gnutls_x509_crt_import(cert, cert_list, GNUTLS_X509_FMT_DER);
245 ret = gnutls_x509_crt_check_hostname(cert, host);
246 gnutls_x509_crt_deinit(cert);
249 "The certificate's owner does not match hostname %s\n", host);
255 c->ctx = SSL_CTX_new(c->
listen ? TLSv1_server_method() : TLSv1_client_method());
262 SSL_CTX_load_verify_locations(c->ctx, c->
ca_file,
NULL);
269 if (c->
key_file && !SSL_CTX_use_PrivateKey_file(c->ctx, c->
key_file, SSL_FILETYPE_PEM)) {
278 SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER,
NULL);
279 c->ssl = SSL_new(c->ctx);
285 SSL_set_fd(c->ssl, c->
fd);
286 if (!c->
listen && !numerichost)
287 SSL_set_tlsext_host_name(c->ssl, host);
289 ret = c->
listen ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
314 int ret = TLS_read(c, buf, size);
329 int ret = TLS_write(c, buf, size);
358 .priv_data_class = &tls_class,
void av_url_split(char *proto, int proto_size, char *authorization, int authorization_size, char *hostname, int hostname_size, int *port_ptr, char *path, int path_size, const char *url)
Split a URL string into components.
#define URL_PROTOCOL_FLAG_NETWORK
#define AV_LOG_WARNING
Something somehow does not look correct.
AVIOInterruptCB interrupt_callback
void av_log(void *avcl, int level, const char *fmt,...) av_printf_format(3
Send the specified message to the log if the level is less than or equal to the current av_log_level...
const char * class_name
The name of the class; usually it is the same name as the context structure type to which the AVClass...
miscellaneous OS support macros and functions.
static int tls_read(URLContext *h, uint8_t *buf, int size)
#define AVERROR_EOF
End of file.
static const AVOption options[]
#define AV_LOG_ERROR
Something went wrong and cannot losslessly be recovered.
static int do_tls_poll(URLContext *h, int ret)
URLProtocol ff_tls_protocol
static const AVClass tls_class
int ff_http_match_no_proxy(const char *no_proxy, const char *hostname)
static int tls_open(URLContext *h, const char *uri, int flags)
int ffurl_get_file_handle(URLContext *h)
Return the file descriptor associated with this URL.
static int tls_close(URLContext *h)
int ff_url_join(char *str, int size, const char *proto, const char *authorization, const char *hostname, int port, const char *fmt,...)
int ff_check_interrupt(AVIOInterruptCB *cb)
Check if the user has requested to interrup a blocking function associated with cb.
Describe the class of an AVClass context structure.
int ffurl_close(URLContext *h)
Close the resource accessed by the URLContext h, and free the memory used by it.
int av_strstart(const char *str, const char *pfx, const char **ptr)
Return non-zero if pfx is a prefix of str.
int ffurl_open(URLContext **puc, const char *filename, int flags, const AVIOInterruptCB *int_cb, AVDictionary **options)
Create an URLContext for accessing to the resource indicated by url, and open it. ...
static int tls_write(URLContext *h, const uint8_t *buf, int size)
unbuffered private I/O API
av_default_item_name
Return the context name.