[FFmpeg-devel] [PATCH 3/3] tls: TLS/SSL server
Peter Ross
pross at xvid.org
Wed Jul 18 15:52:37 CEST 2012
e.g. tls://foo:443?cafile=CAFILE.crt&key=KEY.crt&cert=CERT.crt&listen
---
libavformat/tls.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/libavformat/tls.c b/libavformat/tls.c
index 8c1403c..838d185 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -108,14 +108,15 @@ static void set_options(URLContext *h, const char *uri)
{
TLSContext *c = h->priv_data;
char buf[1024], key[1024];
- int has_cert, has_key;
+ int ret, has_cert, has_key;
const char *p = strchr(uri, '?');
if (!p)
return;
if (av_find_info_tag(buf, sizeof(buf), "cafile", p)) {
#if CONFIG_GNUTLS
- if (gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM) < 0)
+ ret = gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM);
+ if (ret < 0)
av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
#elif CONFIG_OPENSSL
STACK_OF(X509_NAME) *list = SSL_load_client_CA_file(buf);
@@ -153,6 +154,10 @@ static int tls_open(URLContext *h, const char *uri, int flags)
struct addrinfo hints = { 0 }, *ai = NULL;
const char *proxy_path;
int use_proxy;
+ int server = 0;
+ const char *p = strchr(uri, '?');
+ if (p && av_find_info_tag(buf, sizeof(buf), "listen", p))
+ server = 1;
ff_tls_init();
@@ -187,7 +192,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
c->fd = ffurl_get_file_handle(c->tcp);
#if CONFIG_GNUTLS
- gnutls_init(&c->session, GNUTLS_CLIENT);
+ gnutls_init(&c->session, server ? GNUTLS_SERVER : GNUTLS_CLIENT);
if (!numerichost)
gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
gnutls_certificate_allocate_credentials(&c->cred);
@@ -205,7 +210,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
goto fail;
}
#elif CONFIG_OPENSSL
- c->ctx = SSL_CTX_new(TLSv1_client_method());
+ c->ctx = SSL_CTX_new(server ? TLSv1_server_method() : TLSv1_client_method());
if (!c->ctx) {
av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
ret = AVERROR(EIO);
@@ -222,7 +227,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
if (!numerichost)
SSL_set_tlsext_host_name(c->ssl, host);
while (1) {
- ret = SSL_connect(c->ssl);
+ ret = server ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
if (ret > 0)
break;
if (ret == 0) {
--
1.7.10.4
-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20120718/c5c8fc74/attachment.asc>
More information about the ffmpeg-devel
mailing list