Commit Graph

27 Commits

Author SHA1 Message Date
Michael Niedermayer
df21537dfb avformat/tls: fix {} error for the GNUTLS case
Found-by:" Geek.Song" <ffmpeg@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-09-27 15:59:19 +02:00
Michael Niedermayer
f31c36e552 Merge commit '705b748e8d8612385c96428ae36ed0d42a170d93'
* commit '705b748e8d8612385c96428ae36ed0d42a170d93':
  tls: Add support for listen mode

Conflicts:
	doc/protocols.texi
	libavformat/tls.c
	libavformat/version.h

See: 4f4eb380f0
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-09-27 11:33:19 +02:00
Michael Niedermayer
e6e71fd7b5 Merge commit '8b09d917e7dc7d7f2ace31419f802d4ff518236c'
* commit '8b09d917e7dc7d7f2ace31419f802d4ff518236c':
  tls: Add options for verifying the peer certificate

Conflicts:
	doc/protocols.texi
	libavformat/tls.c
	libavformat/version.h

See: b2460858f6
See: 973a758f52
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-09-27 09:33:28 +02:00
Martin Storsjö
705b748e8d tls: Add support for listen mode
Also add options for specifying a certificate and key, which can
be used both when operating as client and as server.

Partially based on a patch by Peter Ross.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-09-26 23:13:35 +03:00
Martin Storsjö
8b09d917e7 tls: Add options for verifying the peer certificate
A file containing the trusted CA certificates needs to be
supplied via the ca_file AVOption, unless the TLS library
has got a system default file/database set up.

This doesn't check the hostname of the peer certificate with
openssl, which requires a non-trivial piece of code for
manually matching the desired hostname to the string provided
by the certificate, not provided as a library function.

That is, with openssl, this only validates that the received
certificate is signed with the right CA, but not that it is
the actual server we think we're talking to.

Verification is still disabled by default since we can't count
on a proper CA database existing at all times.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-09-26 23:13:06 +03:00
Michael Niedermayer
03e9506aae Merge commit '5055035670bd1a1eaca64bd3bc71fb07de9df2c3'
* commit '5055035670bd1a1eaca64bd3bc71fb07de9df2c3':
  tls: Do not abort on non-fatal TLS alerts with gnutls

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-09-23 12:01:53 +02:00
Martin Storsjö
5055035670 tls: Do not abort on non-fatal TLS alerts with gnutls
Signed-off-by: Martin Storsjö <martin@martin.st>
2013-09-22 16:10:21 +03:00
Thilo Borgmann
d814a839ac Reinstate proper FFmpeg license for all files. 2013-08-30 15:47:38 +00:00
Michael Niedermayer
03678a32bc Merge remote-tracking branch 'qatar/master'
* qatar/master:
  lavf: Add a fate test for the noproxy pattern matching
  lavf: Handle the environment variable no_proxy more properly

Conflicts:
	libavformat/Makefile
	libavformat/internal.h
	libavformat/tls.c
	libavformat/utils.c
	libavformat/version.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-02-28 13:13:04 +01:00
Martin Storsjö
de9cd1b173 lavf: Handle the environment variable no_proxy more properly
The handling of the environment variable no_proxy, present since
one of the initial commits (de6d9b6404), is inconsistent with
how many other applications and libraries interpret this
variable. Its bare presence does not indicate that the use of
proxies should be skipped, but it is some sort of pattern for
hosts that does not need using a proxy (e.g. for a local network).

As investigated by Rudolf Polzer, different libraries handle this
in different ways, some supporting IP address masks, some supporting
arbitrary globbing using *, some just checking that the pattern matches
the end of the hostname without regard for whether it actually is
the right domain or a domain that ends in the same string.

This simple logic should be pretty similar to the logic used by
lynx and curl.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-02-27 21:32:13 +02:00
Michael Niedermayer
706bd8ea19 Merge remote-tracking branch 'qatar/master'
* qatar/master: (35 commits)
  h264_idct_10bit: port x86 assembly to cpuflags.
  x86inc: clip num_args to 7 on x86-32.
  x86inc: sync to latest version from x264.
  fft: rename "z" to "zc" to prevent name collision.
  wv: return meaningful error codes.
  wv: return AVERROR_EOF on EOF, not EIO.
  mp3dec: forward errors for av_get_packet().
  mp3dec: remove a pointless local variable.
  mp3dec: remove commented out cruft.
  lavfi: bump minor to mark stabilizing the ABI.
  FATE: add tests for yadif.
  FATE: add a test for delogo video filter.
  FATE: add a test for amix audio filter.
  audiogen: allow specifying random seed as a commandline parameter.
  vc1dec: Override invalid macroblock quantizer
  vc1: avoid reading beyond the last line in vc1_draw_sprites()
  vc1dec: check that coded slice positions and interlacing match.
  vc1dec: Do not ignore ff_vc1_parse_frame_header_adv return value
  configure: Move parts that should not be user-selectable to CONFIG_EXTRA
  lavf: remove commented out cruft in avformat_find_stream_info()
  ...

Conflicts:
	Makefile
	configure
	libavcodec/vc1dec.c
	libavcodec/x86/h264_deblock.asm
	libavcodec/x86/h264_deblock_10bit.asm
	libavcodec/x86/h264dsp_mmx.c
	libavfilter/version.h
	libavformat/mp3dec.c
	libavformat/utils.c
	libavformat/wv.c
	libavutil/x86/x86inc.asm

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2012-07-29 02:16:26 +02:00
Martin Storsjö
41ecbbc7aa tls: Return AVERROR_EOF if the TLS_read/write functions return 0
OpenSSL returns 0 when the peer has closed the connection. GnuTLS
doesn't return that though, but returns
GNUTLS_E_UNEXPECTED_PACKET_LENGTH if the connection simply is closed
without a clean close notify packet.

Tested-by: Antti Seppälä <a.seppala@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
2012-07-28 01:21:16 +03:00
Peter Ross
4f4eb380f0 tls: TLS/SSL server
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2012-07-22 19:12:15 +02:00
Peter Ross
d1146d67ca tls: parse uri path options to underlying tcp URLContext
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2012-07-22 19:12:15 +02:00
Peter Ross
b2460858f6 tls: verify option
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2012-07-22 19:12:15 +02:00
Peter Ross
973a758f52 tls: cafile, cert, key options
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2012-07-22 19:12:15 +02:00
Martin Storsjö
32b83aeec1 avio: Add an URLProtocol flag for indicating that a protocol uses network
This definition is in two files, since the definitions will move
to the private header at the next bump.

Signed-off-by: Martin Storsjö <martin@martin.st>
2012-01-05 23:56:52 +02:00
Diego Biurrun
c88ebdb42c Eliminate pointless 0/NULL initializers in AVCodec and similar declarations. 2011-11-28 10:01:50 +01:00
Martin Storsjö
2565dbeb3e tls: Handle connection via a http proxy
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-11-18 10:59:53 +02:00
Martin Storsjö
92db95e9ca tls: Use TLSv1_client_method for OpenSSL
TLSv1 is compatible with SSLv3, so this doesn't change much
in terms of compatibility. By explicitly using TLSv1, OpenSSL
sends the server name indication (SNI) header, which we
already set using SSL_set_tlsext_host_name (earlier, this
didn't have any effect).

SNI allows servers to serve SSL content for different host
names with separate certificates on one single port (vhosts).

Signed-off-by: Martin Storsjö <martin@martin.st>
2011-11-17 15:11:38 +02:00
Anton Khirnov
ddffc2fdc3 avio: add support for passing options to protocols.
Not used anywhere yet, support for passing options from avio_open() will
follow.
2011-11-13 13:14:39 +01:00
Martin Storsjö
6f1b7b3944 avio: Add an AVIOInterruptCB parameter to ffurl_open/ffurl_alloc
Change all uses of these function to pass the relevant
callback on.
2011-11-13 13:12:17 +01:00
Martin Storsjö
9957cdbfd5 avformat: Use ff_check_interrupt 2011-11-13 13:08:13 +01:00
Martin Storsjö
371d15ec36 tls: Use the URLContext as logging context
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-11-10 23:23:10 +02:00
Anton Khirnov
34ff0e2915 tls: use AVIO_FLAG_NONBLOCK instead of deprecated URL_FLAG_NONBLOCK 2011-11-10 11:36:49 +01:00
Martin Storsjö
f38f3b88a5 tls: Use ERR_get_error() in do_tls_poll
The return value ret isn't an error code that can be passed
to ERR_error_string().

This makes the error messages printed actually contain useful
information.

Signed-off-by: Martin Storsjö <martin@martin.st>
2011-11-08 22:58:54 +02:00
Martin Storsjö
558d192d23 avformat: Add the tls protocol, using OpenSSL or gnutls
Note, this protocol doesn't yet check verify the server
certificate against a local database of trusted CA root
certificates.

Signed-off-by: Martin Storsjö <martin@martin.st>
2011-11-05 12:09:30 +02:00