[FFmpeg-devel] [PATCH v3 1/9] avformat/tls: add trace function for log TLS/DTLS record

[Jack Lau]

Refer to RFC 5246, RFC 6347

Signed-off-by: Jack Lau <jacklau1222 at qq.com>
---
 libavformat/tls.c         | 56 +++++++++++++++++++++++++++++++++++++++
 libavformat/tls.h         |  2 ++
 libavformat/tls_openssl.c |  8 ++++--
 3 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/libavformat/tls.c b/libavformat/tls.c
index bd9c05e6dc..c549b014cf 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -27,10 +27,66 @@
 #include "url.h"
 #include "tls.h"
 #include "libavutil/avstring.h"
+#include "libavutil/intreadwrite.h"
 #include "libavutil/getenv_utf8.h"
 #include "libavutil/mem.h"
 #include "libavutil/parseutils.h"
 
+enum {
+    CONTENT_TYPE_CHANGE_CIPHER_SPEC = 20,
+    CONTENT_TYPE_ALERT = 21,
+    CONTENT_TYPE_HANDSHAKE = 22,
+    CONTENT_TYPE_APPLICATION_DATA = 23,
+    CONTENT_TYPE_OTHERS = 255
+} ContentType;
+
+enum {
+    TLS1_MAJOR_VERSION = 0x03,
+    DTLS1_MAJOR_VERSION = 0xFE,
+} TLSVersion;
+
+/*
+ * Trace a single TLS/DTLS record.
+ * 
+ * See RFC 5246 Section 6.2.1, RFC 6347 Section 4.1
+ * 
+ * @param data     Raw record (network byte‑order).
+ * @param length   Size of @data in bytes.
+ * @param incoming Non‑zero when the packet was received, zero when sent.
+ */
+void openssl_state_trace(uint8_t *data, int length, int incoming)
+{
+    uint8_t  content_type   = 0;  /* TLS/DTLS ContentType       */
+    uint16_t record_length  = 0;  /* Length field from header   */
+    uint8_t  handshake_type = 0;  /* First byte of Handshake msg */
+    int is_dtls = 0;
+
+    /* ContentType is always the very first byte */
+    if (length >= 1)
+        content_type = AV_RB8(&data[0]);
+    if (length >= 3 && data[1] == DTLS1_MAJOR_VERSION)
+        is_dtls = 1;
+    /* TLS header is 5 bytes, DTLS header is 13 bytes */
+    if (length >= 13 && is_dtls)
+        record_length = AV_RB16(&data[11]);
+    else if (length >= 5 && !is_dtls)
+        record_length = AV_RB16(&data[3]);
+    /*
+     * HandshakeType values (TLS 1.0–1.2, DTLS 1.0/1.2)
+     * See RFC 5246 Section 7.4, RFC 6347 Section 4.2
+     *
+     * Only present when ContentType == handshake(22)
+     */
+    if (content_type == CONTENT_TYPE_HANDSHAKE) {
+        int hs_off = is_dtls ? 13 : 5;
+        if (length > hs_off)
+            handshake_type = AV_RB8(&data[hs_off]);
+    }
+
+    av_log(NULL, AV_LOG_TRACE ,"TLS: Trace %s, len=%u, cnt=%u, size=%u, hs=%u\n",
+        (incoming? "RECV":"SEND"), length, content_type, record_length, handshake_type);
+}
+
 static int set_options(TLSShared *c, const char *uri)
 {
     char buf[1024];
diff --git a/libavformat/tls.h b/libavformat/tls.h
index 0c02a4ab27..cc8823e008 100644
--- a/libavformat/tls.h
+++ b/libavformat/tls.h
@@ -95,6 +95,8 @@ typedef struct TLSShared {
     {"key_pem",    "Private key PEM string",              offsetof(pstruct, options_field . key_buf),   AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     FF_TLS_CLIENT_OPTIONS(pstruct, options_field)
 
+void openssl_state_trace(uint8_t *data, int length, int incoming);
+
 int ff_tls_open_underlying(TLSShared *c, URLContext *parent, const char *uri, AVDictionary **options);
 
 int ff_url_read_all(const char *url, AVBPrint *bp);
diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
index 2a01fb387d..2777a4f657 100644
--- a/libavformat/tls_openssl.c
+++ b/libavformat/tls_openssl.c
@@ -576,8 +576,10 @@ static int url_bio_bread(BIO *b, char *buf, int len)
 {
     TLSContext *c = BIO_get_data(b);
     int ret = ffurl_read(c->tls_shared.is_dtls ? c->tls_shared.udp : c->tls_shared.tcp, buf, len);
-    if (ret >= 0)
+    if (ret >= 0) {
+        openssl_state_trace((uint8_t*)buf, ret, 1);
         return ret;
+    }
     BIO_clear_retry_flags(b);
     if (ret == AVERROR_EXIT)
         return 0;
@@ -592,8 +594,10 @@ static int url_bio_bwrite(BIO *b, const char *buf, int len)
 {
     TLSContext *c = BIO_get_data(b);
     int ret = ffurl_write(c->tls_shared.is_dtls ? c->tls_shared.udp : c->tls_shared.tcp, buf, len);
-    if (ret >= 0)
+    if (ret >= 0) {
+        openssl_state_trace((uint8_t*)buf, ret, 0);
         return ret;
+    }
     BIO_clear_retry_flags(b);
     if (ret == AVERROR_EXIT)
         return 0;
-- 
2.49.0