From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 22CF550193 for ; Tue, 8 Jul 2025 18:54:00 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 44B2968F313; Tue, 8 Jul 2025 21:53:58 +0300 (EEST) Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 2EC2E68F2C2 for ; Tue, 8 Jul 2025 21:53:56 +0300 (EEST) Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-ae3b336e936so875692866b.3 for ; Tue, 08 Jul 2025 11:53:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1752000835; x=1752605635; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tdv+eam03Q3ks40XlwsR3iaLCv0t7c1wwVJYgU22atU=; b=GMGeMfCOfTsVQttNG8jvrowFty7QKgPWAEOaLCNe5jOvF53lTkEBtZ49nN1V/Gpfiw 7+7pPK3AsqRIqQgngc9Vq5gsx7IEAMSESflYtRdvzQG9tJMPOWt8kR9zVgZmPQkzAkKr UQCYbC/bWe7ZZ/KI9NxDgWRrpulXFWtblAVuH33wwWuWNVbHsRBo45q154aMU1Zz+PYP K5R1IUd4RNU63w8ThMYkGblwTKuMm01yuzIWqsilw6RzNCbphIo2iA+HyjxXh3pCi+d3 Zs4mYnHlybozUJzwiCfRF8nkJtffXXWt/1iCzL6M1IwcPZN9ndg2lI+x2r7f20NivDiB oQEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1752000835; x=1752605635; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tdv+eam03Q3ks40XlwsR3iaLCv0t7c1wwVJYgU22atU=; b=pNyRS2KLgAwkEueqG+zSnMSkoptfZNYBY552NwUOYCQOU7OTitHH/4kJKuIcX2qtwe /pLimOs8fWxB/BcIOLhdbHs+sKDFXSqX9I9blcjhgdvxoeMF8mSg8iwPzyKbGHTp5xDH gIm/cWsgNl7qGPsYr3SXja5RdQvjeksLxQZtd16k/r3FxSHVAqUQ5M47YP3yKSNTTJI+ ZnT7ABCMSj9dbwh6frO4w3d+K+D9RKw36Hl3aSCarYcCboEGwJQfYgzB8M+ULkXZSQTq 3RXA+wNTQI+aP/w910FqUm4cjvUKbStiHP+gmsLex4UCJK0kKK8eTgLcuwa1ug9BW6Ku zFhg== X-Gm-Message-State: AOJu0Yw+NVdTWns+qI/ePx3YgtzHjyZdbsHzqZrpD7xQSfyOtKJw5kjg UaVL9Nc4p/Egnuen875iBiG3aeqG+2cFwtwqTz89bW6IwzvFTxkykZfpZ6tH+4UP X-Gm-Gg: ASbGnct4+MeS7hufY+qK0Z4Ihf5BY0OEgkfGhCzs+04iiwzqBVFfebbuIGgB8xbzvEu 2LBkQsX0//3+ZQNLZWXNAqYqOfqNSbi1/Hub3Ez0Rz5O5D6TyqK/jhtJhmJLxGNrrVRyiLXjz8H 79njzKYlam29k1PvPSBzPv7a+rvgMhWHfe11mgTqsRT9GFj5yb1gu5bTGxDiZndu93V91d/bfz0 5ojsXqz+oEhwuRZZpcUiKbPUr0p8DY1I6fu8S2D88gLCDGN3VyQw/YKqDruoDsqWb8eJeQNP862 S4jPLKrLTT8dBb14v/t+i15xdGsWW9iOS7megN6uBjwr9MGtjUzfgwnC66NHRcha71tPj5Q6D7k VORxprt8dlAadjRntn8oHgwbtLVjZkc6v4GlpVKV2XewcMZyLs1/oeQeYMq/E8Gw4v1soKVDEq1 iKPVfKd22hLP3z5Pcv X-Google-Smtp-Source: AGHT+IEdmMpXzLIRL23e6gSl9jyKWLMbs+Uc+dSLahNAZMyh/iTmeYvDm65stW2aX+OaRahNQiMZ3g== X-Received: by 2002:a17:907:6ea5:b0:ae3:5e2d:a8bf with SMTP id a640c23a62f3a-ae3fe5bde90mr1774269566b.14.1752000835187; Tue, 08 Jul 2025 11:53:55 -0700 (PDT) Received: from localhost.localdomain (p200301023701fa00258573ace0251429.dip0.t-ipconnect.de. [2003:102:3701:fa00:2585:73ac:e025:1429]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ae3f6bb1f45sm931018266b.181.2025.07.08.11.53.54 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 08 Jul 2025 11:53:54 -0700 (PDT) From: Marvin Scholz To: ffmpeg-devel@ffmpeg.org Date: Tue, 8 Jul 2025 20:53:47 +0200 Message-Id: <20250708185349.62250-1-epirat07@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20250708180617.59679-1-epirat07@gmail.com> References: <20250708180617.59679-1-epirat07@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v3 1/3] avformat/tls_openssl: add hostname for verification X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Marvin Scholz Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: From: Daniel N Pettersson When verification is enabled (using -tls_verify 1) now the hostname will be verified properly too, while before only other aspects of the certificate were checked. Co-Authored-By: Marvin Scholz --- libavformat/tls_openssl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index a0fa3285d5..7f10d80f9e 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -906,8 +906,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op } ret = openssl_init_ca_key_cert(h); if (ret < 0) goto fail; - // Note, this doesn't check that the peer certificate actually matches - // the requested hostname. + if (c->verify) SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); p->ssl = SSL_new(p->ctx); @@ -921,8 +920,15 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op ret = init_bio_method(h); if (ret < 0) goto fail; - if (!c->listen && !c->numerichost) + if (!c->listen && !c->numerichost) { + if (!SSL_set1_host(p->ssl, c->host)) { + av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL verification: %s\n", + openssl_get_error(p)); + ret = AVERROR_EXTERNAL; + goto fail; + } SSL_set_tlsext_host_name(p->ssl, c->host); + } ret = c->listen ? SSL_accept(p->ssl) : SSL_connect(p->ssl); if (ret == 0) { av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session\n"); -- 2.39.5 (Apple Git-154) _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".