[FFmpeg-devel] [PATCH 3/3] tls: TLS/SSL server

Peter Ross pross at xvid.org
Wed Jul 18 15:52:37 CEST 2012


e.g. tls://foo:443?cafile=CAFILE.crt&key=KEY.crt&cert=CERT.crt&listen
---
 libavformat/tls.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/libavformat/tls.c b/libavformat/tls.c
index 8c1403c..838d185 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -108,14 +108,15 @@ static void set_options(URLContext *h, const char *uri)
 {
     TLSContext *c = h->priv_data;
     char buf[1024], key[1024];
-    int has_cert, has_key;
+    int ret, has_cert, has_key;
     const char *p = strchr(uri, '?');
     if (!p)
         return;
 
     if (av_find_info_tag(buf, sizeof(buf), "cafile", p)) {
 #if CONFIG_GNUTLS
-        if (gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM) < 0)
+        ret = gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM);
+        if (ret < 0)
             av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
 #elif CONFIG_OPENSSL
         STACK_OF(X509_NAME) *list = SSL_load_client_CA_file(buf);
@@ -153,6 +154,10 @@ static int tls_open(URLContext *h, const char *uri, int flags)
     struct addrinfo hints = { 0 }, *ai = NULL;
     const char *proxy_path;
     int use_proxy;
+    int server = 0;
+    const char *p = strchr(uri, '?');
+    if (p && av_find_info_tag(buf, sizeof(buf), "listen", p))
+        server = 1;
 
     ff_tls_init();
 
@@ -187,7 +192,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
     c->fd = ffurl_get_file_handle(c->tcp);
 
 #if CONFIG_GNUTLS
-    gnutls_init(&c->session, GNUTLS_CLIENT);
+    gnutls_init(&c->session, server ? GNUTLS_SERVER : GNUTLS_CLIENT);
     if (!numerichost)
         gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
     gnutls_certificate_allocate_credentials(&c->cred);
@@ -205,7 +210,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
             goto fail;
     }
 #elif CONFIG_OPENSSL
-    c->ctx = SSL_CTX_new(TLSv1_client_method());
+    c->ctx = SSL_CTX_new(server ? TLSv1_server_method() : TLSv1_client_method());
     if (!c->ctx) {
         av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
         ret = AVERROR(EIO);
@@ -222,7 +227,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
     if (!numerichost)
         SSL_set_tlsext_host_name(c->ssl, host);
     while (1) {
-        ret = SSL_connect(c->ssl);
+        ret = server ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
         if (ret > 0)
             break;
         if (ret == 0) {
-- 
1.7.10.4

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20120718/c5c8fc74/attachment.asc>


More information about the ffmpeg-devel mailing list