[FFmpeg-devel] [PATCH 1/3] tls: cafile, cert, key options

[Peter Ross]

e.g. tls://foo:443?cafile=CAFILE.crt&key=KEY.crt&cert=CERT.crt
---
 libavformat/tls.c |   42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/libavformat/tls.c b/libavformat/tls.c
index fb84fa8..072c2b9 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -22,6 +22,7 @@
 #include "avformat.h"
 #include "url.h"
 #include "libavutil/avstring.h"
+#include "libavutil/parseutils.h"
 #if CONFIG_GNUTLS
 #include <gnutls/gnutls.h>
 #define TLS_read(c, buf, size)  gnutls_record_recv(c->session, buf, size)
@@ -103,6 +104,45 @@ static int do_tls_poll(URLContext *h, int ret)
     return 0;
 }
 
+static void set_options(URLContext *h, const char *uri)
+{
+    TLSContext *c = h->priv_data;
+    char buf[1024], key[1024];
+    int has_cert, has_key;
+    const char *p = strchr(uri, '?');
+    if (!p)
+        return;
+
+    if (av_find_info_tag(buf, sizeof(buf), "cafile", p)) {
+#if CONFIG_GNUTLS
+        if (gnutls_certificate_set_x509_trust_file(c->cred, buf, GNUTLS_X509_FMT_PEM) < 0)
+            av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
+#elif CONFIG_OPENSSL
+        STACK_OF(X509_NAME) *list = SSL_load_client_CA_file(buf);
+        if (!list)
+            av_log(h, AV_LOG_ERROR, "SSL_load_client_CA_file %s\n", ERR_error_string(ERR_get_error(), NULL));
+        else
+            SSL_CTX_set_client_CA_list(c->ctx, list);
+#endif
+    }
+
+    has_cert = av_find_info_tag(buf, sizeof(buf), "cert", p);
+    has_key  = av_find_info_tag(key, sizeof(key), "key", p);
+#if CONFIG_GNUTLS
+    if (has_cert && has_key) {
+        if (gnutls_certificate_set_x509_key_file(c->cred, buf, key, GNUTLS_X509_FMT_PEM) < 0)
+            av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
+    } else if (has_cert ^ has_key) {
+        av_log(h, AV_LOG_ERROR, "cert and key required\n");
+    }
+#elif CONFIG_OPENSSL
+    if (has_cert && !SSL_CTX_use_certificate_file(c->ctx, buf, SSL_FILETYPE_PEM))
+        av_log(h, AV_LOG_ERROR, "SSL_CTX_use_certificate_file %s\n", ERR_error_string(ERR_get_error(), NULL));
+    if (has_key && !SSL_CTX_use_PrivateKey_file(c->ctx, key, SSL_FILETYPE_PEM))
+        av_log(h, AV_LOG_ERROR, "SSL_CTX_use_PrivateKey_file %s\n", ERR_error_string(ERR_get_error(), NULL));
+#endif
+}
+
 static int tls_open(URLContext *h, const char *uri, int flags)
 {
     TLSContext *c = h->priv_data;
@@ -152,6 +192,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
         gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
     gnutls_certificate_allocate_credentials(&c->cred);
     gnutls_certificate_set_verify_flags(c->cred, 0);
+    set_options(h, uri);
     gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
     gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)
                                          (intptr_t) c->fd);
@@ -170,6 +211,7 @@ static int tls_open(URLContext *h, const char *uri, int flags)
         ret = AVERROR(EIO);
         goto fail;
     }
+    set_options(h, uri);
     c->ssl = SSL_new(c->ctx);
     if (!c->ssl) {
         av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
-- 
1.7.10.4

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20120718/516a21ad/attachment.asc>