From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 8DFA84C719 for ; Mon, 4 Aug 2025 23:21:52 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id E426168C203; Tue, 5 Aug 2025 02:21:47 +0300 (EEST) Received: from 234aea0deae1 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 1784168B561 for ; Tue, 5 Aug 2025 02:21:47 +0300 (EEST) MIME-Version: 1.0 From: Timo Rothenpieler To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] [PATCH] avformat/tls: switch on peer certificate verification by default (PR #20114) X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Message-Id: <20250804232147.E426168C203@ffbox0-bg.ffmpeg.org> Date: Tue, 5 Aug 2025 02:21:47 +0300 (EEST) Archived-At: List-Archive: List-Post: PR #20114 opened by Timo Rothenpieler (BtbN) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20114 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20114.patch Not sure on the Changelog entry. How is that normally handled, to document an important change that will happen on next major bump? >>From addf7b75c6977b758e6620d855eb58affccf3779 Mon Sep 17 00:00:00 2001 From: Timo Rothenpieler Date: Tue, 5 Aug 2025 01:19:07 +0200 Subject: [PATCH] avformat/tls: switch on peer certificate verification by default --- Changelog | 1 + libavformat/tls.h | 9 ++++++++- libavformat/version_major.h | 2 ++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Changelog b/Changelog index 04db8e15b2..dbeb4b7771 100644 --- a/Changelog +++ b/Changelog @@ -3,6 +3,7 @@ releases are sorted from youngest to oldest. version : - Drop support for OpenSSL < 1.1.0 +- Switch on TLS peer certificate verification by default (Starting with libavformat major version 63) - yasm support dropped, users need to use nasm - VVC VAAPI decoder - RealVideo 6.0 decoder diff --git a/libavformat/tls.h b/libavformat/tls.h index 0c02a4ab27..df384da604 100644 --- a/libavformat/tls.h +++ b/libavformat/tls.h @@ -25,6 +25,7 @@ #include "libavutil/bprint.h" #include "libavutil/opt.h" +#include "version.h" #include "url.h" @@ -78,10 +79,16 @@ typedef struct TLSShared { #define TLS_OPTFL (AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_ENCODING_PARAM) +#if FF_API_NO_DEFAULT_TLS_VERIFY +#define TLS_VERIFY_DEFAULT 0 +#else +#define TLS_VERIFY_DEFAULT 1 +#endif + #define FF_TLS_CLIENT_OPTIONS(pstruct, options_field) \ {"ca_file", "Certificate Authority database file", offsetof(pstruct, options_field . ca_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \ {"cafile", "Certificate Authority database file", offsetof(pstruct, options_field . ca_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \ - {"tls_verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = TLS_OPTFL }, \ + {"tls_verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_INT, { .i64 = TLS_VERIFY_DEFAULT }, 0, 1, .flags = TLS_OPTFL }, \ {"cert_file", "Certificate file", offsetof(pstruct, options_field . cert_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \ {"key_file", "Private key file", offsetof(pstruct, options_field . key_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \ {"verifyhost", "Verify against a specific hostname", offsetof(pstruct, options_field . host), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL } diff --git a/libavformat/version_major.h b/libavformat/version_major.h index 61338d339f..c2f6e1616b 100644 --- a/libavformat/version_major.h +++ b/libavformat/version_major.h @@ -45,6 +45,8 @@ #define FF_API_INTERNAL_TIMING (LIBAVFORMAT_VERSION_MAJOR < 63) +#define FF_API_NO_DEFAULT_TLS_VERIFY (LIBAVFORMAT_VERSION_MAJOR < 63) + #define FF_API_R_FRAME_RATE 1 #endif /* AVFORMAT_VERSION_MAJOR_H */ -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".