FFmpeg: libavformat/tls.c Source File

FFmpeg

[フレーム]

libavformat

tls.c

Go to the documentation of this file.

1 /*

2 * TLS/SSL Protocol

4 *

5 * This file is part of Libav.

6 *

7 * Libav is free software; you can redistribute it and/or

8 * modify it under the terms of the GNU Lesser General Public

9 * License as published by the Free Software Foundation; either

10 * version 2.1 of the License, or (at your option) any later version.

11 *

12 * Libav is distributed in the hope that it will be useful,

13 * but WITHOUT ANY WARRANTY; without even the implied warranty of

14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

15 * Lesser General Public License for more details.

16 *

17 * You should have received a copy of the GNU Lesser General Public

18 * License along with Libav; if not, write to the Free Software

19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

20 */

22 #include "avformat.h"

23 #include "url.h"

24 #include "libavutil/avstring.h"

25 #include "libavutil/parseutils.h"

26 #if CONFIG_GNUTLS

27 #include <gnutls/gnutls.h>

28 #define TLS_read(c, buf, size) gnutls_record_recv(c->session, buf, size)

29 #define TLS_write(c, buf, size) gnutls_record_send(c->session, buf, size)

30 #define TLS_shutdown(c) gnutls_bye(c->session, GNUTLS_SHUT_RDWR)

31 #define TLS_free(c) do { \

32 if (c->session) \

33 gnutls_deinit(c->session); \

34 if (c->cred) \

35 gnutls_certificate_free_credentials(c->cred); \

36 } while (0)

37 #elif CONFIG_OPENSSL

38 #include <openssl/bio.h>

39 #include <openssl/ssl.h>

40 #include <openssl/err.h>

41 #define TLS_read(c, buf, size) SSL_read(c->ssl, buf, size)

42 #define TLS_write(c, buf, size) SSL_write(c->ssl, buf, size)

43 #define TLS_shutdown(c) SSL_shutdown(c->ssl)

44 #define TLS_free(c) do { \

45 if (c->ssl) \

46 SSL_free(c->ssl); \

47 if (c->ctx) \

48 SSL_CTX_free(c->ctx); \

49 } while (0)

50 #endif

51 #include "network.h"

52 #include "os_support.h"

53 #include "internal.h"

54 #if HAVE_POLL_H

55 #include <poll.h>

56 #endif

58 typedef struct {

59 const AVClass *class;

60 URLContext *tcp;

61 #if CONFIG_GNUTLS

62 gnutls_session_t session;

63 gnutls_certificate_credentials_t cred;

64 #elif CONFIG_OPENSSL

65 SSL_CTX *ctx;

66 SSL *ssl;

67 #endif

68 int fd;

69 } TLSContext;

71 static int do_tls_poll(URLContext *h, int ret)

72 {

73 TLSContext *c = h->priv_data;

74 struct pollfd p = { c->fd, 0, 0 };

75 #if CONFIG_GNUTLS

76 if (ret != GNUTLS_E_AGAIN && ret != GNUTLS_E_INTERRUPTED) {

77 av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));

78 return AVERROR(EIO);

79 }

80 if (gnutls_record_get_direction(c->session))

81 p.events = POLLOUT;

82 else

83 p.events = POLLIN;

84 #elif CONFIG_OPENSSL

85 ret = SSL_get_error(c->ssl, ret);

86 if (ret == SSL_ERROR_WANT_READ) {

87 p.events = POLLIN;

88 } else if (ret == SSL_ERROR_WANT_WRITE) {

89 p.events = POLLOUT;

90 } else {

91 av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));

92 return AVERROR(EIO);

93 }

94 #endif

95 if (h->flags & AVIO_FLAG_NONBLOCK)

96 return AVERROR(EAGAIN);

97 while (1) {

98 int n = poll(&p, 1, 100);

99 if (n > 0)

100 break;

101 if (ff_check_interrupt(&h->interrupt_callback))

102 return AVERROR(EINTR);

103 }

104 return 0;

105 }

106

107 static void set_options(URLContext *h, const char *uri)

108 {

109 TLSContext *c = h->priv_data;

110 char buf[1024], key[1024];

111 int has_cert, has_key, verify = 0;

112 #if CONFIG_GNUTLS

113 int ret;

114 #endif

115 const char *p = strchr(uri, '?');

116 if (!p)

117 return;

118

119 if (av_find_info_tag(buf, sizeof(buf), "cafile", p)) {

120 #if CONFIG_GNUTLS

121 ret = gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM);

122 if (ret < 0)

123 av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));

124 #elif CONFIG_OPENSSL

125 if (!SSL_CTX_load_verify_locations(c->ctx, buf, NULL))

126 av_log(h, AV_LOG_ERROR, "SSL_CTX_load_verify_locations %s\n", ERR_error_string(ERR_get_error(), NULL));

127 #endif

128 }

129

130 if (av_find_info_tag(buf, sizeof(buf), "verify", p)) {

131 char *endptr = NULL;

132 verify = strtol(buf, &endptr, 10);

133 if (buf == endptr)

134 verify = 1;

135 }

136

137 has_cert = av_find_info_tag(buf, sizeof(buf), "cert", p);

138 has_key = av_find_info_tag(key, sizeof(key), "key", p);

139 #if CONFIG_GNUTLS

140 if (has_cert && has_key) {

141 ret = gnutls_certificate_set_x509_key_file(c->cred, buf, key, GNUTLS_X509_FMT_PEM);

142 if (ret < 0)

143 av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));

144 } else if (has_cert ^ has_key) {

145 av_log(h, AV_LOG_ERROR, "cert and key required\n");

146 }

147 gnutls_certificate_set_verify_flags(c->cred, verify);

148 #elif CONFIG_OPENSSL

149 if (has_cert && !SSL_CTX_use_certificate_chain_file(c->ctx, buf))

150 av_log(h, AV_LOG_ERROR, "SSL_CTX_use_certificate_chain_file %s\n", ERR_error_string(ERR_get_error(), NULL));

151 if (has_key && !SSL_CTX_use_PrivateKey_file(c->ctx, key, SSL_FILETYPE_PEM))

152 av_log(h, AV_LOG_ERROR, "SSL_CTX_use_PrivateKey_file %s\n", ERR_error_string(ERR_get_error(), NULL));

153 if (verify)

154 SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, 0);

155 #endif

156 }

157

158 static int tls_open(URLContext *h, const char *uri, int flags)

159 {

160 TLSContext *c = h->priv_data;

161 int ret;

162 int port;

163 char buf[200], host[200], path[1024];

164 int numerichost = 0;

165 struct addrinfo hints = { 0 }, *ai = NULL;

166 const char *proxy_path;

167 int use_proxy;

168 int server = 0;

169 const char *p = strchr(uri, '?');

170 if (p && av_find_info_tag(buf, sizeof(buf), "listen", p))

171 server = 1;

172

173 ff_tls_init();

174

175 av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port, path, sizeof(path), uri);

176 ff_url_join(buf, sizeof(buf), "tcp", NULL, host, port, "%s", path);

177

178 hints.ai_flags = AI_NUMERICHOST;

179 if (!getaddrinfo(host, NULL, &hints, &ai)) {

180 numerichost = 1;

181 freeaddrinfo(ai);

182 }

183

184 proxy_path = getenv("http_proxy");

185 use_proxy = !ff_http_match_no_proxy(getenv("no_proxy"), host) &&

186 proxy_path != NULL && av_strstart(proxy_path, "http://", NULL);

187

188 if (use_proxy) {

189 char proxy_host[200], proxy_auth[200], dest[200];

190 int proxy_port;

191 av_url_split(NULL, 0, proxy_auth, sizeof(proxy_auth),

192 proxy_host, sizeof(proxy_host), &proxy_port, NULL, 0,

193 proxy_path);

194 ff_url_join(dest, sizeof(dest), NULL, NULL, host, port, NULL);

195 ff_url_join(buf, sizeof(buf), "httpproxy", proxy_auth, proxy_host,

196 proxy_port, "/%s", dest);

197 }

198

199 ret = ffurl_open(&c->tcp, buf, AVIO_FLAG_READ_WRITE,

200 &h->interrupt_callback, NULL);

201 if (ret)

202 goto fail;

203 c->fd = ffurl_get_file_handle(c->tcp);

204

205 #if CONFIG_GNUTLS

206 gnutls_init(&c->session, server ? GNUTLS_SERVER : GNUTLS_CLIENT);

207 if (!numerichost)

208 gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));

209 gnutls_certificate_allocate_credentials(&c->cred);

210 set_options(h, uri);

211 gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);

212 gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)

213 (intptr_t) c->fd);

214 gnutls_priority_set_direct(c->session, "NORMAL", NULL);

215 while (1) {

216 ret = gnutls_handshake(c->session);

217 if (ret == 0)

218 break;

219 if ((ret = do_tls_poll(h, ret)) < 0)

220 goto fail;

221 }

222 #elif CONFIG_OPENSSL

223 c->ctx = SSL_CTX_new(server ? TLSv1_server_method() : TLSv1_client_method());

224 if (!c->ctx) {

225 av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));

226 ret = AVERROR(EIO);

227 goto fail;

228 }

229 set_options(h, uri);

230 c->ssl = SSL_new(c->ctx);

231 if (!c->ssl) {

232 av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));

233 ret = AVERROR(EIO);

234 goto fail;

235 }

236 SSL_set_fd(c->ssl, c->fd);

237 if (!server && !numerichost)

238 SSL_set_tlsext_host_name(c->ssl, host);

239 while (1) {

240 ret = server ? SSL_accept(c->ssl) : SSL_connect(c->ssl);

241 if (ret > 0)

242 break;

243 if (ret == 0) {

244 av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session\n");

245 ret = AVERROR(EIO);

246 goto fail;

247 }

248 if ((ret = do_tls_poll(h, ret)) < 0)

249 goto fail;

250 }

251 #endif

252 return 0;

253 fail:

254 TLS_free(c);

255 if (c->tcp)

256 ffurl_close(c->tcp);

257 ff_tls_deinit();

258 return ret;

259 }

260

261 static int tls_read(URLContext *h, uint8_t *buf, int size)

262 {

263 TLSContext *c = h->priv_data;

264 while (1) {

265 int ret = TLS_read(c, buf, size);

266 if (ret > 0)

267 return ret;

268 if (ret == 0)

269 return AVERROR_EOF;

270 if ((ret = do_tls_poll(h, ret)) < 0)

271 return ret;

272 }

273 return 0;

274 }

275

276 static int tls_write(URLContext *h, const uint8_t *buf, int size)

277 {

278 TLSContext *c = h->priv_data;

279 while (1) {

280 int ret = TLS_write(c, buf, size);

281 if (ret > 0)

282 return ret;

283 if (ret == 0)

284 return AVERROR_EOF;

285 if ((ret = do_tls_poll(h, ret)) < 0)

286 return ret;

287 }

288 return 0;

289 }

290

291 static int tls_close(URLContext *h)

292 {

293 TLSContext *c = h->priv_data;

294 TLS_shutdown(c);

295 TLS_free(c);

296 ffurl_close(c->tcp);

297 ff_tls_deinit();

298 return 0;

299 }

300

301 URLProtocol ff_tls_protocol = {

302 .name = "tls",

303 .url_open = tls_open,

304 .url_read = tls_read,

305 .url_write = tls_write,

306 .url_close = tls_close,

307 .priv_data_size = sizeof(TLSContext),

308 .flags = URL_PROTOCOL_FLAG_NETWORK,

309 };

Generated on Wed Jul 10 2013 23:48:14 for FFmpeg by doxygen 1.8.2