22 #include <mbedtls/version.h> 23 #include <mbedtls/ctr_drbg.h> 24 #include <mbedtls/entropy.h> 25 #include <mbedtls/net_sockets.h> 26 #include <mbedtls/platform.h> 27 #include <mbedtls/ssl.h> 28 #include <mbedtls/x509_crt.h> 49 #define OFFSET(x) offsetof(TLSContext, x) 57 mbedtls_x509_crt_free(&tls_ctx->
ca_cert);
58 mbedtls_x509_crt_free(&tls_ctx->
own_cert);
72 return react_on_eagain;
77 return MBEDTLS_ERR_NET_CONN_RESET;
81 return MBEDTLS_ERR_NET_SEND_FAILED;
93 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
106 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
114 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
115 av_log(h,
AV_LOG_ERROR,
"Read of key file failed. Is it actually there, are the access permissions correct?\n");
117 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
120 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
132 #if MBEDTLS_VERSION_MAJOR < 3 133 case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE:
134 av_log(h,
AV_LOG_ERROR,
"None of the common ciphersuites is usable. Was the local certificate correctly set?\n");
137 case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:
141 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
142 av_log(h,
AV_LOG_ERROR,
"A fatal alert message was received from the peer, has the peer a correct certificate?\n");
144 case MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED:
145 av_log(h,
AV_LOG_ERROR,
"No CA chain is set, but required to operate. Was the CA correctly set?\n");
147 case MBEDTLS_ERR_NET_CONN_RESET:
159 const char *p = strchr(uri,
'?');
171 uint32_t verify_res_flags;
181 mbedtls_ssl_config_init(&tls_ctx->
ssl_config);
184 mbedtls_x509_crt_init(&tls_ctx->
ca_cert);
185 mbedtls_pk_init(&tls_ctx->
priv_key);
189 if ((ret = mbedtls_x509_crt_parse_file(&tls_ctx->
ca_cert, shr->
ca_file)) != 0) {
190 av_log(h,
AV_LOG_ERROR,
"mbedtls_x509_crt_parse_file for CA cert returned %d\n", ret);
197 if ((ret = mbedtls_x509_crt_parse_file(&tls_ctx->
own_cert, shr->
cert_file)) != 0) {
198 av_log(h,
AV_LOG_ERROR,
"mbedtls_x509_crt_parse_file for own cert returned %d\n", ret);
205 mbedtls_entropy_func,
214 if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->
priv_key,
217 #
if MBEDTLS_VERSION_MAJOR >= 3
218 , mbedtls_ctr_drbg_random,
227 if ((ret = mbedtls_ssl_config_defaults(&tls_ctx->
ssl_config,
228 shr->
listen ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT,
229 MBEDTLS_SSL_TRANSPORT_STREAM,
230 MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
235 mbedtls_ssl_conf_authmode(&tls_ctx->
ssl_config,
236 shr->
ca_file ? MBEDTLS_SSL_VERIFY_REQUIRED : MBEDTLS_SSL_VERIFY_NONE);
252 if ((ret = mbedtls_ssl_set_hostname(&tls_ctx->
ssl_context, shr->
host)) != 0) {
262 while ((ret = mbedtls_ssl_handshake(&tls_ctx->
ssl_context)) != 0) {
263 if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
271 if ((verify_res_flags = mbedtls_ssl_get_verify_result(&tls_ctx->
ssl_context)) != 0) {
273 "with the certificate verification, returned flags: %u\n",
275 if (verify_res_flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
276 av_log(h,
AV_LOG_ERROR,
"The certificate is not correctly signed by the trusted CA.\n");
291 case MBEDTLS_ERR_SSL_WANT_READ:
292 case MBEDTLS_ERR_SSL_WANT_WRITE:
294 case MBEDTLS_ERR_NET_SEND_FAILED:
295 case MBEDTLS_ERR_NET_RECV_FAILED:
297 case MBEDTLS_ERR_NET_CONN_RESET:
298 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
312 if ((ret = mbedtls_ssl_read(&tls_ctx->
ssl_context, buf, size)) > 0) {
325 if ((ret = mbedtls_ssl_write(&tls_ctx->
ssl_context, buf, size)) > 0) {
361 .priv_data_class = &tls_class,
#define URL_PROTOCOL_FLAG_NETWORK
static int handle_tls_error(URLContext *h, const char *func_name, int ret)
#define AV_LOG_WARNING
Something somehow does not look correct.
#define LIBAVUTIL_VERSION_INT
int ffurl_write(URLContext *h, const unsigned char *buf, int size)
Write size bytes from buf to the resource accessed by h.
mbedtls_ssl_config ssl_config
const char * av_default_item_name(void *ptr)
Return the context name.
static void parse_options(TLSContext *tls_ctxc, const char *uri)
static const AVOption options[]
const char * class_name
The name of the class; usually it is the same name as the context structure type to which the AVClass...
static int mbedtls_send(void *ctx, const unsigned char *buf, size_t len)
static void handle_handshake_error(URLContext *h, int ret)
static int tls_read(URLContext *h, uint8_t *buf, int size)
static int tls_get_file_handle(URLContext *h)
#define AVERROR_EOF
End of file.
int av_find_info_tag(char *arg, int arg_size, const char *tag1, const char *info)
Attempt to find a specific tag in a URL.
static int tls_write(URLContext *h, const uint8_t *buf, int size)
mbedtls_ctr_drbg_context ctr_drbg_context
#define AV_LOG_ERROR
Something went wrong and cannot losslessly be recovered.
static const AVClass tls_class
static int handle_transport_error(URLContext *h, const char *func_name, int react_on_eagain, int ret)
mbedtls_pk_context priv_key
static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
mbedtls_ssl_context ssl_context
mbedtls_x509_crt own_cert
#define TLS_COMMON_OPTIONS(pstruct, options_field)
mbedtls_entropy_context entropy_context
static int tls_close(URLContext *h)
int ffurl_get_file_handle(URLContext *h)
Return the file descriptor associated with this URL.
#define AVERROR_EXIT
Immediate exit was requested; the called function should not be restarted.
int ffurl_closep(URLContext **hh)
Close the resource accessed by the URLContext h, and free the memory used by it.
char * av_strdup(const char *s)
Duplicate a string.
Describe the class of an AVClass context structure.
#define flags(name, subs,...)
const URLProtocol ff_tls_protocol
int ff_tls_open_underlying(TLSShared *c, URLContext *parent, const char *uri, AVDictionary **options)
static void handle_pk_parse_error(URLContext *h, int ret)
static int mbedtls_recv(void *ctx, unsigned char *buf, size_t len)
int max_packet_size
if non zero, the stream is packetized with this max packet size
unbuffered private I/O API
int ffurl_read(URLContext *h, unsigned char *buf, int size)
Read up to size bytes from the resource accessed by h, and store the read bytes in buf...