From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id CB8FA426FC for ; Mon, 25 Apr 2022 21:31:56 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id EC53068B270; Tue, 26 Apr 2022 00:31:53 +0300 (EEST) Received: from mail-lj1-f182.google.com (mail-lj1-f182.google.com [209.85.208.182]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C8D2668AACC for ; Tue, 26 Apr 2022 00:31:47 +0300 (EEST) Received: by mail-lj1-f182.google.com with SMTP id q14so19490288ljc.12 for ; Mon, 25 Apr 2022 14:31:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=Hk3yjVkapGOPEzxMGfgK09piCSqjwu44o/KYGNUzeUc=; b=O5flmT27Z4HoOCcafzHhDd/Qa8xZuqsDUH5LvnH/p2OSF50Y9u9JdTkRh08N0+IjCc F3qsxsLVLhDHIl4JahYWtkLoUE8IDXJ9SlQ4EYy5iKdPBv9GGXQ1vhJr5Ly0H7vfSMyD egkNEvaGBSeFC0ZKbIrI6QBSD+wpFVQ8CEM1QblvDz1BYMnxyvxizVM1uFAccBMNpNBd acBLlco3zDnVUIC4XC+0v2awLUo4RGee4KjMwDW/R2p3CiqAT7kfmYB5rzSW3aqxTAHD NRZufajW8J7wgEx6JPXX1Y0ulwCNIaTLWJFZxy0Y3Aylx/NhRt/dCvh1C9jO7fTYsCS1 cTdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=Hk3yjVkapGOPEzxMGfgK09piCSqjwu44o/KYGNUzeUc=; b=mqaihPaE+y6bnlf9gD9BJa9RRiqV34v/6YMQ9rGO8CYS+e1TIJJEulWCFW4K0jBlqO wRQxCnMiR7QDLr7VV5avrZ9wW2luxnQIuI76KYfs4ON6tlffAueZjMfTfe6Lsw2cCY0C BnLBrVzxGqq6LCshafjxUqY3xctW4V4LoRPNjKrUngLVNBov4p+9NzN+swBm8S6uOVbp Xe8lEjOecSjbQ4gYf1wxfQ0kuSMoTEn4q0ogh1Oipf7RwCJodL3TNuKvQFVrlhxYYHxO ncPzXRfw9t7Jv4/4pkvdxB2tMdRMNl6OLwTBXejOmxHidispRPd9RLkqYGmpGhJf35QP QiXA== X-Gm-Message-State: AOAM532n9jV0uEiWrE2jfmM121Y0v6vaL2XdI7LQPRx0i776OYkX19Er v8NCOZsfA4aiKKLLAJy5+TBvTdEk+TQ3z/3rUEq1w1Ae X-Google-Smtp-Source: ABdhPJz6lkaK6hmDSWC6HV7OMnrH1NTTkJLnJRlF2/Dax31aVeuJP5qIUe2zoqxGYr7JgzMKT6M3+Zk1dIkSsjcec2A= X-Received: by 2002:a05:651c:1a0c:b0:24d:c538:d504 with SMTP id by12-20020a05651c1a0c00b0024dc538d504mr12720665ljb.479.1650922307022; Mon, 25 Apr 2022 14:31:47 -0700 (PDT) MIME-Version: 1.0 References: <20220423233208.27071-1-timo@rothenpieler.org> In-Reply-To: <20220423233208.27071-1-timo@rothenpieler.org> From: =?UTF-8?B?SmFuIEVrc3Ryw7Zt?= Date: Tue, 26 Apr 2022 00:31:35 +0300 Message-ID: To: FFmpeg development discussions and patches Subject: Re: [FFmpeg-devel] [PATCH] lavf/tls_mbedtls: add support for mbedtls version 3 X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On Sun, Apr 24, 2022 at 2:33 AM Timo Rothenpieler wrote: > > - certs.h is gone. Only contains test data, and was not used at all. > - config.h is renamed. Was seemingly not used, so can be removed. > - MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead > MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown. > - mbedtls_pk_parse_keyfile now needs to be passed a properly seeded > RNG. Hence, move the call to after RNG seeding. > > Signed-off-by: Timo Rothenpieler > --- > libavformat/tls_mbedtls.c | 34 ++++++++++++++++++++++------------ > 1 file changed, 22 insertions(+), 12 deletions(-) > > diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c > index 5754d0d018..8503523b6d 100644 > --- a/libavformat/tls_mbedtls.c > +++ b/libavformat/tls_mbedtls.c > @@ -19,8 +19,7 @@ > * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA > */ > > -#include > -#include > +#include > #include > #include > #include > @@ -130,9 +129,15 @@ static void handle_pk_parse_error(URLContext *h, int ret) > static void handle_handshake_error(URLContext *h, int ret) > { > switch (ret) { > +#if MBEDTLS_VERSION_MAJOR < 3 > case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE: > av_log(h, AV_LOG_ERROR, "None of the common ciphersuites is usable. Was the local certificate correctly set?\n"); > break; > +#else > + case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE: > + av_log(h, AV_LOG_ERROR, "TLS handshake failed.\n"); > + break; > +#endif > case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE: > av_log(h, AV_LOG_ERROR, "A fatal alert message was received from the peer, has the peer a correct certificate?\n"); > break; > @@ -195,16 +200,6 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op > } > } > > - // load key file > - if (shr->key_file) { > - if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, > - shr->key_file, > - tls_ctx->priv_key_pw)) != 0) { > - handle_pk_parse_error(h, ret); > - goto fail; > - } > - } > - > // seed the random number generator > if ((ret = mbedtls_ctr_drbg_seed(&tls_ctx->ctr_drbg_context, > mbedtls_entropy_func, > @@ -214,6 +209,21 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op > goto fail; > } > > + // load key file > + if (shr->key_file) { > + if ((ret = mbedtls_pk_parse_keyfile(&tls_ctx->priv_key, > + shr->key_file, > + tls_ctx->priv_key_pw > +#if MBEDTLS_VERSION_MAJOR >= 3 > + , mbedtls_ctr_drbg_random, > + &tls_ctx->ctr_drbg_context > +#endif > + )) != 0) { > + handle_pk_parse_error(h, ret); > + goto fail; > + } > + } > + Seems correct enough as the RNG is then utilized in the TLS configuration as well. As long as the mbedtls API documentation notes that it is OK to utilize the same RNG for both this as well as the TLS configuration itself, this seems fine. Jan _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".