FFmpeg
tls_libtls.c
Go to the documentation of this file.
1 /*
2  * TLS/SSL Protocol
3  * Copyright (c) 2011 Martin Storsjo
4  * Copyright (c) 2017 sfan5 <sfan5@live.de>
5  *
6  * This file is part of FFmpeg.
7  *
8  * FFmpeg is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU Lesser General Public
10  * License as published by the Free Software Foundation; either
11  * version 2.1 of the License, or (at your option) any later version.
12  *
13  * FFmpeg is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16  * Lesser General Public License for more details.
17  *
18  * You should have received a copy of the GNU Lesser General Public
19  * License along with FFmpeg; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21  */
22 
23 #include "avformat.h"
24 #include "internal.h"
25 #include "network.h"
26 #include "url.h"
27 #include "tls.h"
28 #include "libavcodec/internal.h"
29 #include "libavutil/avutil.h"
30 #include "libavutil/opt.h"
31 
32 #include <tls.h>
33 
34 typedef struct TLSContext {
35  const AVClass *class;
37  struct tls *ctx;
38 } TLSContext;
39 
41 {
42  TLSContext *p = h->priv_data;
43  if (p->ctx) {
44  tls_close(p->ctx);
45  tls_free(p->ctx);
46  }
47  if (p->tls_shared.tcp)
49  return 0;
50 }
51 
52 static ssize_t tls_read_callback(struct tls *ctx, void *buf, size_t buflen, void *cb_arg)
53 {
54  URLContext *h = (URLContext*) cb_arg;
55  int ret = ffurl_read(h, buf, buflen);
56  if (ret == AVERROR(EAGAIN))
57  return TLS_WANT_POLLIN;
58  else if (ret == AVERROR_EXIT)
59  return 0;
60  return ret >= 0 ? ret : -1;
61 }
62 
63 static ssize_t tls_write_callback(struct tls *ctx, const void *buf, size_t buflen, void *cb_arg)
64 {
65  URLContext *h = (URLContext*) cb_arg;
66  int ret = ffurl_write(h, buf, buflen);
67  if (ret == AVERROR(EAGAIN))
68  return TLS_WANT_POLLOUT;
69  else if (ret == AVERROR_EXIT)
70  return 0;
71  return ret >= 0 ? ret : -1;
72 }
73 
74 static int ff_tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
75 {
76  TLSContext *p = h->priv_data;
77  TLSShared *c = &p->tls_shared;
78  struct tls_config *cfg = NULL;
79  int ret;
80 
81  if (tls_init() == -1) {
82  ret = AVERROR(EIO);
83  goto fail;
84  }
85 
86  if ((ret = ff_tls_open_underlying(c, h, uri, options)) < 0)
87  goto fail;
88 
89  p->ctx = !c->listen ? tls_client() : tls_server();
90  if (!p->ctx) {
91  ret = AVERROR(EIO);
92  goto fail;
93  }
94 
95  cfg = tls_config_new();
96  if (!p->ctx) {
97  ret = AVERROR(EIO);
98  goto fail;
99  }
100  if (tls_config_set_protocols(cfg, TLS_PROTOCOLS_ALL) == -1)
101  goto err_config;
102  // While TLSv1.0 and TLSv1.1 are already enabled by the above,
103  // we need to be less strict with ciphers so it works in practice.
104  if (tls_config_set_ciphers(cfg, "compat") == -1)
105  goto err_config;
106  if (c->ca_file && tls_config_set_ca_file(cfg, c->ca_file) == -1)
107  goto err_config;
108  if (c->cert_file && tls_config_set_cert_file(cfg, c->cert_file) == -1)
109  goto err_config;
110  if (c->key_file && tls_config_set_key_file(cfg, c->key_file) == -1)
111  goto err_config;
112  if (!c->verify) {
113  tls_config_insecure_noverifycert(cfg);
114  tls_config_insecure_noverifyname(cfg);
115  tls_config_insecure_noverifytime(cfg);
116  }
117  if (tls_configure(p->ctx, cfg) == -1)
118  goto err_ctx;
119 
120  if (!c->listen) {
121  ret = tls_connect_cbs(p->ctx, tls_read_callback, tls_write_callback,
122  c->tcp, c->host);
123  } else {
124  struct tls *ctx_new;
125  ret = tls_accept_cbs(p->ctx, &ctx_new, tls_read_callback,
126  tls_write_callback, c->tcp);
127  if (ret == 0) {
128  // free "server" context and replace by "connection" context
129  tls_free(p->ctx);
130  p->ctx = ctx_new;
131  }
132  }
133  if (ret == -1)
134  goto err_ctx;
135 
136  tls_config_free(cfg);
137  return 0;
138 err_config:
139  av_log(h, AV_LOG_ERROR, "%s\n", tls_config_error(cfg));
140  ret = AVERROR(EIO);
141  goto fail;
142 err_ctx:
143  av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
144  ret = AVERROR(EIO);
145  /* fallthrough */
146 fail:
147  if (cfg)
148  tls_config_free(cfg);
149  ff_tls_close(h);
150  return ret;
151 }
152 
153 static int ff_tls_read(URLContext *h, uint8_t *buf, int size)
154 {
155  TLSContext *p = h->priv_data;
156  ssize_t ret;
157  ret = tls_read(p->ctx, buf, size);
158  if (ret > 0)
159  return ret;
160  else if (ret == 0)
161  return AVERROR_EOF;
162  av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
163  return AVERROR(EIO);
164 }
165 
166 static int ff_tls_write(URLContext *h, const uint8_t *buf, int size)
167 {
168  TLSContext *p = h->priv_data;
169  ssize_t ret;
170  ret = tls_write(p->ctx, buf, size);
171  if (ret > 0)
172  return ret;
173  else if (ret == 0)
174  return AVERROR_EOF;
175  av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
176  return AVERROR(EIO);
177 }
178 
180 {
181  TLSContext *c = h->priv_data;
183 }
184 
185 static const AVOption options[] = {
187  { NULL }
188 };
189 
190 static const AVClass tls_class = {
191  .class_name = "tls",
192  .item_name = av_default_item_name,
193  .option = options,
194  .version = LIBAVUTIL_VERSION_INT,
195 };
196 
198  .name = "tls",
199  .url_open2 = ff_tls_open,
200  .url_read = ff_tls_read,
201  .url_write = ff_tls_write,
202  .url_close = ff_tls_close,
203  .url_get_file_handle = tls_get_file_handle,
204  .priv_data_size = sizeof(TLSContext),
206  .priv_data_class = &tls_class,
207 };
#define NULL
Definition: coverity.c:32
#define URL_PROTOCOL_FLAG_NETWORK
Definition: url.h:34
AVOption.
Definition: opt.h:246
int verify
Definition: tls.h:31
#define LIBAVUTIL_VERSION_INT
Definition: version.h:85
int ffurl_write(URLContext *h, const unsigned char *buf, int size)
Write size bytes from buf to the resource accessed by h.
Definition: avio.c:419
const char * av_default_item_name(void *ptr)
Return the context name.
Definition: log.c:191
Convenience header that includes libavutil&#39;s core.
int listen
Definition: tls.h:34
static int ff_tls_read(URLContext *h, uint8_t *buf, int size)
Definition: tls_libtls.c:153
const char * class_name
The name of the class; usually it is the same name as the context structure type to which the AVClass...
Definition: log.h:72
uint8_t
AVOptions.
Undefined Behavior In the C some operations are like signed integer dereferencing freed accessing outside allocated Undefined Behavior must not occur in a C it is not safe even if the output of undefined operations is unused The unsafety may seem nit picking but Optimizing compilers have in fact optimized code on the assumption that no undefined Behavior occurs Optimizing code based on wrong assumptions can and has in some cases lead to effects beyond the output of computations The signed integer overflow problem in speed critical code Code which is highly optimized and works with signed integers sometimes has the problem that often the output of the computation does not c
Definition: undefined.txt:32
Definition: tls.h:29
static const AVOption options[]
Definition: tls_libtls.c:185
#define AVERROR_EOF
End of file.
Definition: error.h:55
ptrdiff_t size
Definition: opengl_enc.c:100
#define av_log(a,...)
#define AV_LOG_ERROR
Something went wrong and cannot losslessly be recovered.
Definition: log.h:176
static int tls_read(URLContext *h, uint8_t *buf, int size)
Definition: tls_gnutls.c:232
#define fail()
Definition: checkasm.h:122
char * host
Definition: tls.h:36
static ssize_t tls_read_callback(struct tls *ctx, void *buf, size_t buflen, void *cb_arg)
Definition: tls_libtls.c:52
#define TLS_COMMON_OPTIONS(pstruct, options_field)
Definition: tls.h:45
static int tls_close(URLContext *h)
Definition: tls_gnutls.c:94
char * cert_file
Definition: tls.h:32
int ffurl_get_file_handle(URLContext *h)
Return the file descriptor associated with this URL.
Definition: avio.c:624
#define AVERROR_EXIT
Immediate exit was requested; the called function should not be restarted.
Definition: error.h:56
char * ca_file
Definition: tls.h:30
const URLProtocol ff_tls_protocol
Definition: tls_libtls.c:197
static int tls_get_file_handle(URLContext *h)
Definition: tls_libtls.c:179
TLSShared tls_shared
Definition: tls_gnutls.c:50
void * buf
Definition: avisynth_c.h:766
Definition: url.h:38
Describe the class of an AVClass context structure.
Definition: log.h:67
static int ff_tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
Definition: tls_libtls.c:74
void * priv_data
Definition: url.h:41
const char * name
Definition: url.h:55
#define flags(name, subs,...)
Definition: cbs_av1.c:561
int ffurl_close(URLContext *h)
Definition: avio.c:465
static ssize_t tls_write_callback(struct tls *ctx, const void *buf, size_t buflen, void *cb_arg)
Definition: tls_libtls.c:63
Main libavformat public API header.
common internal api header.
int ff_tls_open_underlying(TLSShared *c, URLContext *parent, const char *uri, AVDictionary **options)
Definition: tls.c:56
struct tls * ctx
Definition: tls_libtls.c:37
URLContext * tcp
Definition: tls.h:41
static const AVClass tls_class
Definition: tls_libtls.c:190
static int ff_tls_write(URLContext *h, const uint8_t *buf, int size)
Definition: tls_libtls.c:166
static int tls_write(URLContext *h, const uint8_t *buf, int size)
Definition: tls_gnutls.c:247
unbuffered private I/O API
Filter the word “frame” indicates either a video frame or a group of audio as stored in an AVFrame structure Format for each input and each output the list of supported formats For video that means pixel format For audio that means channel sample they are references to shared objects When the negotiation mechanism computes the intersection of the formats supported at each end of a all references to both lists are replaced with a reference to the intersection And when a single format is eventually chosen for a link amongst the remaining all references to the list are updated That means that if a filter requires that its input and output have the same format amongst a supported all it has to do is use a reference to the same list of formats query_formats can leave some formats unset and return AVERROR(EAGAIN) to cause the negotiation mechanism toagain later.That can be used by filters with complex requirements to use the format negotiated on one link to set the formats supported on another.Frame references ownership and permissions
static int ff_tls_close(URLContext *h)
Definition: tls_libtls.c:40
int ffurl_read(URLContext *h, unsigned char *buf, int size)
Read up to size bytes from the resource accessed by h, and store the read bytes in buf...
Definition: avio.c:405
char * key_file
Definition: tls.h:33