From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id DFAF74879F for ; Fri, 17 May 2024 08:36:49 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 90D9668D403; Fri, 17 May 2024 11:36:22 +0300 (EEST) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04olkn2105.outbound.protection.outlook.com [40.92.75.105]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5241468D3C9 for ; Fri, 17 May 2024 11:36:20 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=c2ZpuMUEemaVwHbl7JjfRGKRKdeNCTq8ob3IlwE6JDb/iP0IpkqJi1VWz+a4SgzeRRXuRb3znVlCHKF9DbWnTRvcCgkIMnEe2AJAIIs5dhsQBXaCHojGKycSfmIbXVop49MFm/tAZ2OeVE+pMMKXKvP96Shn33KJSXIgsjNhItYK9uQxduiSl0cdDYU6Z5GH8BclSk2l6i6C9DD7hq6GzcFOyQWp201LtBuGn+0ddW+HryXZbmreyyj4isTo4gAlyZ4mIGXC2OtAVYHBJU09H44ETE6VG0A08U3MJoUvTq2IgoSb9vdB+nhMhQ1XVkt6rlhGB7OJSbz4TPZoaXtm2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=nZdvDxelLKeyQRoIHaYrBtY6wTBcQMpoK6K0pbhbTRI=; b=DX/3sqrnup4lWH9nHl2YAv/1ScW3aSKyzSUfia/ct+m6dviuNJKtjXGBfWNxtontgBiq9rJvMGikUlWv1eVVxTTrYZJFGA9e9cAEDspj0SSJII79HSMoOSlhk+ALmErJwmAwMnogCnl3qQnto27dwIem/h8hQXbhUhQjHWGp200oMvLrbLmfndavJgza5pWT7Jn5TIMbG3Uw2FHnkwFXWt3vnBoFFrGieNJS2YCFUZYHKnAM9f8Aa7KalJJf7PQQNfLgU6u5pW+Xyf8o6nb/GRDbocZZSyp+f28DBmkP/AYzNoNYrDsv44wkJUuCBOxWnJWLQBpfoX5ptXO7ZyPBww== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=LIVE.DE; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nZdvDxelLKeyQRoIHaYrBtY6wTBcQMpoK6K0pbhbTRI=; b=jC12H43qOAfD/S/2DEAJxl+je9YSc0jk5WpdJg729/lRsV0yZhSVVjrskW/tbPpSnElPai/scKzgdx/btvwrHMUVXt8ooiXOLOQapGgijCd7nJKcR1kXnGeKDmvYwUMo29xEgN1JAleXKgfXe2m2s6s/p2o1SoH4ygyqH1H3L6BQFrZdpubrzuDHePtak/zeduw7cDALC4ITBSBvm26ByFcp1Y8w03aO45GAs11S8EJwxQcXv3mPPqkUjkcQ8fLA8UnrDssjXWiP34IfipHFDe/mnYGKkgHnkoUUJjDmV8dSB1kwdmtR7Xw9MAs5qL/0i1eJk+zKR7vCjraqWGlk/w== Received: from DU0PR03MB9567.eurprd03.prod.outlook.com (2603:10a6:10:41f::20) by PR3PR03MB6442.eurprd03.prod.outlook.com (2603:10a6:102:70::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7611.12; Fri, 17 May 2024 08:35:55 +0000 Received: from DU0PR03MB9567.eurprd03.prod.outlook.com ([fe80::11d1:a48f:e0be:fc9f]) by DU0PR03MB9567.eurprd03.prod.outlook.com ([fe80::11d1:a48f:e0be:fc9f%5]) with mapi id 15.20.7544.041; Fri, 17 May 2024 08:35:55 +0000 Message-ID: Date: Fri, 17 May 2024 10:34:50 +0200 User-Agent: Mozilla Thunderbird From: Sfan5 To: ffmpeg-devel@ffmpeg.org Content-Language: en-US, de-DE X-TMN: [USXN4nlt+04OhZ68K2KdiCt/OUpgWZG0/4zfXTdSZSdg/6iL2eQtqhffgTxAYsLeIjPpBxpWkIQ=] X-ClientProxiedBy: FR0P281CA0247.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:af::16) To DU0PR03MB9567.eurprd03.prod.outlook.com (2603:10a6:10:41f::20) X-Microsoft-Original-Message-ID: <0905a0e7-bdf9-4598-94ee-40173a9131b9@live.de> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR03MB9567:EE_|PR3PR03MB6442:EE_ X-MS-Office365-Filtering-Correlation-Id: 56b0b30d-65e3-4394-918b-08dc764c5e6f X-Microsoft-Antispam: BCL:0; ARA:14566002|461199019|3412199016|440099019|1602099003; X-Microsoft-Antispam-Message-Info: sRrQJOChCXAS6wpjfH3/DYeCKH24THT20frn6qy3b+OhvmIHU+rqpi5oMuBVq3XzGZhVl94k1hrEaqoi3Ow19NsxiRgwA3+pA2rFSsk48v6P6aplKNNCKQqApwiVa5c70ycLC7r8kG9+PbQIGI5QfUE3/yF0GhNdYfxuZ6K2oG/ry7QuWqtiWPRTJxGtU6vq8qzscUCaaYxRgpkWECN+gfMvqPeDVogCYTtzX+oQKyLsyqbEL2x6ik3wZRK3Q09hdWJVx5Jq6fskQ75hpie2+o/Z18QdZnT02wjQHBxvolAv3s1Xttvzmsj+PTzILtun+OfZWOmIe11n8WAJibkFS9xgCWgWqQemOTqzLiwLHmVk2Eb66PoWGxvNpXEq9bhWDw5u2Gm70YDBiRvOva8LS73SCP9hsVRp7YUKefg/Sv+FD39YUPXdd2N/7rgaDJhO1nY4MweLdH1EZ6CB2XtDX6lwNeJv4+8vINRwoqSb3xWLLHrtAVDFzkOyAKbcKhyw4H9s1OyKAW4ARnzrhRIZaGkv0j67CeLHCKDnItU7E79JNXx9lmIiAgEgBj1H3P/aX44zs64JKj1MiXG8XFtVJ5uim4QJg55IDc/sJPcAXKCFblnXo1b9E4c1SzYH1Ept01L3OtLRoRflwgLoz0J0g0jQXZ6VWByUbrBQBROBHQY= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?RkdkYnM0bGlzL3pJY2VCeGFNZVNsUnhEZzNXaVRBeUNuUlcvNjJaV2FjT2FW?= =?utf-8?B?ZytDcThXdEFLSjZPcDZLdVQ0bExtcDFuY1kzMUttYm80ZWRUZjBKei9pdE9C?= =?utf-8?B?d1VmQmt2V3E3RVplNzljblI1cEc0MkU4K3N0WHRRSjMyaDhzSTRQOEZ0bWdC?= =?utf-8?B?K1B5cU5qYXFUMzl3Y2VCNTZWZEIwMnhwU2U3QVBBWW1ZSlZad250ZkRvUWF2?= =?utf-8?B?K0Yybms2bUlwcDhoZFFXYkxnY2tDdWdzR044eEpJU1pwV1kxZmxNL3gwTmJT?= =?utf-8?B?cFJadDVKZEFiVjZVVzhXQWdKemYvYlROczY3OC9YR2tjSy9kQU9mYitEZThi?= =?utf-8?B?VGFoVU9xcWJYbWFKdnZzcEJJZWZEaS9GaHlnMEVFbDhVS2xNYmhBVUtzM3c0?= =?utf-8?B?cnlLbEFuVzZXK1ZhenoyaGh1VmJtY0FsYnQxM2lOSVQ2R25YVndnbVVxUGxw?= =?utf-8?B?VXpMSzR3VlRtQlpvWU5BcEdLeFlKT3hMZ3gxM2llcnQwYWRLSkU4NmF0Tlc0?= =?utf-8?B?a2VpcjFnZUFsVVIyRnE3L2paRFlaRVM4YU1BV1BuamZqeDRMQXlQZ0tYRHpt?= =?utf-8?B?dkFQRkZYRzhHWEJNUzkvc0J5dHMrT01weVJTNFF3ajdSbkJEemFPVHNoOHlq?= =?utf-8?B?MW9MZmFhczRSK3NXczVxbWJYQWRwTlVCYzRxaU0vcTFxVkV5c0RTQnJTTWUw?= =?utf-8?B?bDBsNGVLSVVJMDZxM0N0SXFVVFNJdHBCcjMzcFFSakFiaFJhVWQ0bnV1YkxR?= =?utf-8?B?UlJ4YWw5cmJaR1hVdzd1d0N2NXh2RUJ1RDVLSU15MEl4MVhvZy83SmVhNFky?= =?utf-8?B?QnNtQ2liUTRMUEtBMmhQcnoyeWJFRzUzKzVqVTlmU2NLeHRSTWhETXNkckc5?= =?utf-8?B?NnBtZ0lZOVBiUHltd3JqQndUa3cwQXVKK29OWWJwczBoZDhBc1lGUmxNc1VQ?= =?utf-8?B?NEJJb2s2dXdsSmJoM254QjRXMC9RRksyWU4yMXRQS0RucWg2R0U2MWpJT1c0?= =?utf-8?B?MDhWSHVpT01OdWU0cHRJYTMzRXlsMTlCMEF4dGREeURKbzVjM3NRRTJ1eDI1?= =?utf-8?B?OVdzYldUTFNvMVZmT09SazNCempSR0NnZlFpV0dMTHdZSmVCMytjc1RuSkw1?= =?utf-8?B?b3ZtTVJhLzM3TUJBZG1MVVM1Q09MbW1JcnRDa20vVTBKY1pURlR5VzhMajFU?= =?utf-8?B?T3JSMXJrd3N6RWRWOHFKaytsa2hmMmlWeXVhVm1RaDNMT2M0VlFKUW1DNmhW?= =?utf-8?B?K2VNYk1kMTRrNFlsVWdjYjJwZ0xRRnhSbFNqTENxMTh0STlYVjBNSzk3WmFV?= =?utf-8?B?c1Y4eWQvWHdreHlDMEd2MlBQMllPS2RvSlYwWGNHL2JKZ3dJVkQ2NzFsSW1y?= =?utf-8?B?SEVzcnM4bTdrSkY3bittYWVWdVRJOTdBSFQ5bkd0M3dxcDNyUHdMRzhNK1pE?= =?utf-8?B?SXRpNkdMVEJhekdoOENLQ1VMY3ZKdFp6aGIrUldzWkx3RnZYeVdPeVdFQUNx?= =?utf-8?B?czhRSTRILzhUYlljL1N6QUhudzZEMmtQNGUvcWhpR2owRUdHSGtYU2wwV1lW?= =?utf-8?B?Nm9sZWRVclNzVU90bktNNk5FZHh6aUo0NGJ1R1pNZXJ5M3BiOCtvSGF5cms2?= =?utf-8?B?Q3MvMGpncWovSXJIQ0pxTnlWSGMvaXNIRGg2SUMrR1FWK1FCc2ZMZHhpRDNo?= =?utf-8?B?L3VlWjJTWE1jQ05oVHp2R05hZFlhOC96UERTQWxELzIyb2cwdWRNSGZtZlpW?= =?utf-8?Q?x9Kq0zQpoIPeuknx3U=3D?= X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-76d7b.templateTenant X-MS-Exchange-CrossTenant-Network-Message-Id: 56b0b30d-65e3-4394-918b-08dc764c5e6f X-MS-Exchange-CrossTenant-AuthSource: DU0PR03MB9567.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 May 2024 08:35:55.5406 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR03MB6442 Subject: [FFmpeg-devel] [PATCH 6/6] lavf/tls_mbedtls: add workaround for TLSv1.3 vs. verify=0 X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: As of mbedTLS 3.6.0 TLSv1.3 is enabled by default and certificate verification is now mandatory. Our default configuration does not do verification, so downgrade to 1.2 in these situations to avoid breaking it. ref: https://github.com/Mbed-TLS/mbedtls/issues/7075 Signed-off-by: sfan5 --- libavformat/tls_mbedtls.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 8268e74638..5d5c7bfb25 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -163,6 +163,10 @@ static void handle_handshake_error(URLContext *h, int ret) case MBEDTLS_ERR_SSL_INTERNAL_ERROR: av_log(h, AV_LOG_ERROR, "Internal error encountered.\n"); break; + case MBEDTLS_ERR_X509_CERT_VERIFY_FAILED: + // This error only happens with TLSv1.3, we normally use mbedtls_ssl_get_verify_result(). + av_log(h, AV_LOG_ERROR, "Certificate verification failed.\n"); + break; case MBEDTLS_ERR_NET_CONN_RESET: av_log(h, AV_LOG_ERROR, "TLS handshake was aborted by peer.\n"); break; @@ -263,6 +267,14 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } +#ifdef MBEDTLS_SSL_PROTO_TLS1_3 + // mbedTLS does not allow disabling certificate verification with TLSv1.3 (yes, really). + if (!shr->verify) { + av_log(h, AV_LOG_INFO, "Forcing TLSv1.2 because certificate verification is disabled\n"); + mbedtls_ssl_conf_max_tls_version(&tls_ctx->ssl_config, MBEDTLS_SSL_VERSION_TLS1_2); + } +#endif + // not VERIFY_REQUIRED because we manually check after handshake mbedtls_ssl_conf_authmode(&tls_ctx->ssl_config, shr->verify ? MBEDTLS_SSL_VERIFY_OPTIONAL : MBEDTLS_SSL_VERIFY_NONE); -- 2.45.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".