1 /*
2 * TLS/SSL Protocol
3 * Copyright (c) 2011 Martin Storsjo
4 * Copyright (c) 2017 sfan5 <sfan5@live.de>
5 *
6 * This file is part of FFmpeg.
7 *
8 * FFmpeg is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * FFmpeg is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with FFmpeg; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21 */
22
23 #include "avformat.h"
24 #include "internal.h"
25 #include "network.h"
26 #include "url.h"
27 #include "tls.h"
28 #include "libavcodec/internal.h"
29 #include "libavutil/avutil.h"
30 #include "libavutil/opt.h"
31
32 #include <tls.h>
33
34 typedef struct TLSContext {
35 const AVClass *class;
36 TLSShared tls_shared;
37 struct tls *ctx;
38 } TLSContext;
39
ff_tls_close(URLContext * h)40 static int ff_tls_close(URLContext *h)
41 {
42 TLSContext *p = h->priv_data;
43 if (p->ctx) {
44 tls_close(p->ctx);
45 tls_free(p->ctx);
46 }
47 if (p->tls_shared.tcp)
48 ffurl_close(p->tls_shared.tcp);
49 return 0;
50 }
51
tls_read_callback(struct tls * ctx,void * buf,size_t buflen,void * cb_arg)52 static ssize_t tls_read_callback(struct tls *ctx, void *buf, size_t buflen, void *cb_arg)
53 {
54 URLContext *h = (URLContext*) cb_arg;
55 int ret = ffurl_read(h, buf, buflen);
56 if (ret == AVERROR(EAGAIN))
57 return TLS_WANT_POLLIN;
58 else if (ret == AVERROR_EXIT)
59 return 0;
60 return ret >= 0 ? ret : -1;
61 }
62
tls_write_callback(struct tls * ctx,const void * buf,size_t buflen,void * cb_arg)63 static ssize_t tls_write_callback(struct tls *ctx, const void *buf, size_t buflen, void *cb_arg)
64 {
65 URLContext *h = (URLContext*) cb_arg;
66 int ret = ffurl_write(h, buf, buflen);
67 if (ret == AVERROR(EAGAIN))
68 return TLS_WANT_POLLOUT;
69 else if (ret == AVERROR_EXIT)
70 return 0;
71 return ret >= 0 ? ret : -1;
72 }
73
ff_tls_open(URLContext * h,const char * uri,int flags,AVDictionary ** options)74 static int ff_tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
75 {
76 TLSContext *p = h->priv_data;
77 TLSShared *c = &p->tls_shared;
78 struct tls_config *cfg = NULL;
79 int ret;
80
81 if (tls_init() == -1) {
82 ret = AVERROR(EIO);
83 goto fail;
84 }
85
86 if ((ret = ff_tls_open_underlying(c, h, uri, options)) < 0)
87 goto fail;
88
89 p->ctx = !c->listen ? tls_client() : tls_server();
90 if (!p->ctx) {
91 ret = AVERROR(EIO);
92 goto fail;
93 }
94
95 cfg = tls_config_new();
96 if (!p->ctx) {
97 ret = AVERROR(EIO);
98 goto fail;
99 }
100 if (tls_config_set_protocols(cfg, TLS_PROTOCOLS_ALL) == -1)
101 goto err_config;
102 // While TLSv1.0 and TLSv1.1 are already enabled by the above,
103 // we need to be less strict with ciphers so it works in practice.
104 if (tls_config_set_ciphers(cfg, "compat") == -1)
105 goto err_config;
106 if (c->ca_file && tls_config_set_ca_file(cfg, c->ca_file) == -1)
107 goto err_config;
108 if (c->cert_file && tls_config_set_cert_file(cfg, c->cert_file) == -1)
109 goto err_config;
110 if (c->key_file && tls_config_set_key_file(cfg, c->key_file) == -1)
111 goto err_config;
112 if (!c->verify) {
113 tls_config_insecure_noverifycert(cfg);
114 tls_config_insecure_noverifyname(cfg);
115 tls_config_insecure_noverifytime(cfg);
116 }
117 if (tls_configure(p->ctx, cfg) == -1)
118 goto err_ctx;
119
120 if (!c->listen) {
121 ret = tls_connect_cbs(p->ctx, tls_read_callback, tls_write_callback,
122 c->tcp, c->host);
123 } else {
124 struct tls *ctx_new;
125 ret = tls_accept_cbs(p->ctx, &ctx_new, tls_read_callback,
126 tls_write_callback, c->tcp);
127 if (ret == 0) {
128 // free "server" context and replace by "connection" context
129 tls_free(p->ctx);
130 p->ctx = ctx_new;
131 }
132 }
133 if (ret == -1)
134 goto err_ctx;
135
136 tls_config_free(cfg);
137 return 0;
138 err_config:
139 av_log(h, AV_LOG_ERROR, "%s\n", tls_config_error(cfg));
140 ret = AVERROR(EIO);
141 goto fail;
142 err_ctx:
143 av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
144 ret = AVERROR(EIO);
145 /* fallthrough */
146 fail:
147 if (cfg)
148 tls_config_free(cfg);
149 ff_tls_close(h);
150 return ret;
151 }
152
ff_tls_read(URLContext * h,uint8_t * buf,int size)153 static int ff_tls_read(URLContext *h, uint8_t *buf, int size)
154 {
155 TLSContext *p = h->priv_data;
156 ssize_t ret;
157 ret = tls_read(p->ctx, buf, size);
158 if (ret > 0)
159 return ret;
160 else if (ret == 0)
161 return AVERROR_EOF;
162 av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
163 return AVERROR(EIO);
164 }
165
ff_tls_write(URLContext * h,const uint8_t * buf,int size)166 static int ff_tls_write(URLContext *h, const uint8_t *buf, int size)
167 {
168 TLSContext *p = h->priv_data;
169 ssize_t ret;
170 ret = tls_write(p->ctx, buf, size);
171 if (ret > 0)
172 return ret;
173 else if (ret == 0)
174 return AVERROR_EOF;
175 av_log(h, AV_LOG_ERROR, "%s\n", tls_error(p->ctx));
176 return AVERROR(EIO);
177 }
178
tls_get_file_handle(URLContext * h)179 static int tls_get_file_handle(URLContext *h)
180 {
181 TLSContext *c = h->priv_data;
182 return ffurl_get_file_handle(c->tls_shared.tcp);
183 }
184
185 static const AVOption options[] = {
186 TLS_COMMON_OPTIONS(TLSContext, tls_shared),
187 { NULL }
188 };
189
190 static const AVClass tls_class = {
191 .class_name = "tls",
192 .item_name = av_default_item_name,
193 .option = options,
194 .version = LIBAVUTIL_VERSION_INT,
195 };
196
197 const URLProtocol ff_tls_protocol = {
198 .name = "tls",
199 .url_open2 = ff_tls_open,
200 .url_read = ff_tls_read,
201 .url_write = ff_tls_write,
202 .url_close = ff_tls_close,
203 .url_get_file_handle = tls_get_file_handle,
204 .priv_data_size = sizeof(TLSContext),
205 .flags = URL_PROTOCOL_FLAG_NETWORK,
206 .priv_data_class = &tls_class,
207 };
208