From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id C2AA84FAB9 for ; Wed, 25 Jun 2025 20:00:59 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 7217A68D814; Wed, 25 Jun 2025 22:59:40 +0300 (EEST) Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 79AA368D7D3 for ; Wed, 25 Jun 2025 22:59:26 +0300 (EEST) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-3a54700a46eso140441f8f.1 for ; Wed, 25 Jun 2025 12:59:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1750881566; x=1751486366; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=v9qJKVtKhxiMwIhe1aZ86H9nUqv+LTd2hAHtlo1oLLk=; b=nF8Lvovi3uXgdTGQz3RGVCuWv3rxNelxY3LdfdFfTriLsG7jpnX9La4OOsWIGfNGzK NxLPl5hkx/w0d/hsWg2xOC1fBoDZy/NtPwCENXg0FhQ0Oi8iTRcVVa/tOA2iOGNgwVVS PxZXhX220EQQjNUvGcR/ABPaic2ZJqV88NseLgF41sXCtdZmqkt7dhLzPCzlpkzCmH9t bEvGI+KHPqhuBV/3Jpja0z5kezB4W+YiLoeH4Mu1NAhI8a3qb933ptDoGP6GfC76va/r +C93OM7OtgpNb7KyE/P2MuGsAH1AXddy+AoxHj33fl7YZGY/9LBh2dJcflwRNU0mFHKT bVkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1750881566; x=1751486366; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=v9qJKVtKhxiMwIhe1aZ86H9nUqv+LTd2hAHtlo1oLLk=; b=XLmRqq5/xnx0ysw6Tdtce8X5egc8c/JBfH5Y59LwfyL7q+GzyXLMleNJCCES76E/f1 mKuAEZSKSaJOKg8LxS/eCc7rWJzoJdSiF6L64xbeLxm9pFTfOFAEdbdShedivaUbh2tc V57xNzx2g8t5uMVWKdj1tpgvfcnLopdg8j11sZhgT3wdfavnoRDfeiKKjEaN9buz8g00 80M2KWmI/X4f2KuLfXtV0bKMWt7ORWGTmWMe7ahkYlZoJith6PbbbRlptJ9l3mBX4+PS m2C5/WVShcOiDi9tBNVvNH8Hgg0EjBKarzcBB2QKwf9d6YHWXLW760N5IwBEP+cH5WIA sz6g== X-Gm-Message-State: AOJu0YzOP9flP7MG7RSq9axuDEYoBFjhf+KuWcfWkRsYzBWouLtS9UY9 eMoyUaW4dVCCx9LpyQG3IU42pb8BRmXmAdZHJIEnO7vQnb6iZzplrGRkHH+14w== X-Gm-Gg: ASbGncu+P+6oYoL2+ewA6wfVgNhmdEqQem3NlZUCjQOEtKj4h14M6QuQP1iXuU1E+4y E3WjO8LCMYlWLPFnktJ5q5TpaABxecO5RjMmAHQeodGo2RJWZ1497F0Lh3zTR1CMlNLsWgthlR2 y3SkGw/+cqfEol3kKZykUf0CL7SDjT5gGHuR1dKXWxu5vAZddJ6Dfvze8l3cSrVwRkxyGHOT3xt aOftixx9UlRjZPU9+HRAIVCzAhtPGFnkM1GVDF3GAlHIDDK7kscNnQo7uXP+4cl/4sdpPQU12J8 bnJRW2H8HSpO3wN//q1Z/5xmHGYXto/ibHrBXbu/fLOZaZeqaM81KdK1gBFD1DPpshvaeLQaFSr faizLwu54NSLAdX7LwySWxSz/000jbHTrpLRWsptq+DtgwtXE+Wn50fWnHLtMR5MS63bz0/hle6 3o0rFk X-Google-Smtp-Source: AGHT+IE9tS3v+TD4kXp1KLncOC4lbaK6KiP559tIeSXYjciGltqUjJjf4Yvw9m7pLYTZlG6Q0gKJAA== X-Received: by 2002:a05:6000:2084:b0:3a5:42:b17b with SMTP id ffacd0b85a97d-3a6ed65e60fmr3397886f8f.29.1750881565619; Wed, 25 Jun 2025 12:59:25 -0700 (PDT) Received: from ArmedBeast.fritz.box (p2003010237004500c9a67543cc7ba10e.dip0.t-ipconnect.de. [2003:102:3700:4500:c9a6:7543:cc7b:a10e]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3a6e810977esm5359288f8f.83.2025.06.25.12.59.24 for (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 25 Jun 2025 12:59:25 -0700 (PDT) From: Marvin Scholz To: ffmpeg-devel@ffmpeg.org Date: Wed, 25 Jun 2025 21:59:16 +0200 Message-Id: <20250625195916.20276-8-epirat07@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20250625195916.20276-1-epirat07@gmail.com> References: <20250625195916.20276-1-epirat07@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 8/8] avformat/tls_openssl: use SSL_CTX_set_min_proto_version X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Using SSL_CTX_set_options to disallow specific versions is discouraged by the documentation, which recommends to use SSL_CTX_set_min_proto_version instead. --- libavformat/tls_openssl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index 72ee36e7af..e10ccf1cb8 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -901,7 +901,11 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op ret = AVERROR(EIO); goto fail; } - SSL_CTX_set_options(p->ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); + if (!SSL_CTX_set_min_proto_version(p->ctx, TLS1_VERSION)) { + av_log(h, AV_LOG_ERROR, "Failed to set minimum TLS version to TLSv1\n"); + ret = AVERROR_EXTERNAL; + goto fail; + } ret = openssl_init_ca_key_cert(h); if (ret < 0) goto fail; // Note, this doesn't check that the peer certificate actually matches -- 2.39.5 (Apple Git-154) _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".