From: hasufell <hasufell@gentoo.org> Date: Sat, 29 Mar 2014 13:21:12 +0100 Subject: [PATCH] fix build with polarssl-1.3.x --- librtmp/dh.h | 2 +- librtmp/handshake.h | 11 ++++++----- librtmp/hashswf.c | 10 +++++----- librtmp/rtmp_sys.h | 6 ++---- 4 files changed, 14 insertions(+), 15 deletions(-) --- a/librtmp/dh.h +++ b/librtmp/dh.h @@ -72,7 +72,7 @@ static int MDH_generate_key(MDH *dh) static int MDH_compute_key(uint8_t *secret, size_t len, MP_t pub, MDH *dh) { MP_set(&dh->ctx.GY, pub); - dhm_calc_secret(&dh->ctx, secret, &len); + dhm_calc_secret(&dh->ctx, secret, &len, NULL, NULL); return 0; } --- a/librtmp/handshake.h +++ b/librtmp/handshake.h @@ -25,15 +25,16 @@ /* This file is #included in rtmp.c, it is not meant to be compiled alone */ #ifdef USE_POLARSSL -#include <polarssl/sha2.h> +#include <polarssl/compat-1.2.h> +#include <polarssl/sha256.h> #include <polarssl/arc4.h> #ifndef SHA256_DIGEST_LENGTH #define SHA256_DIGEST_LENGTH 32 #endif -#define HMAC_CTX sha2_context -#define HMAC_setup(ctx, key, len) sha2_hmac_starts(&ctx, (unsigned char *)key, len, 0) -#define HMAC_crunch(ctx, buf, len) sha2_hmac_update(&ctx, buf, len) -#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha2_hmac_finish(&ctx, dig) +#define HMAC_CTX sha256_context +#define HMAC_setup(ctx, key, len) sha256_hmac_starts(&ctx, (unsigned char *)key, len, 0) +#define HMAC_crunch(ctx, buf, len) sha256_hmac_update(&ctx, buf, len) +#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha256_hmac_finish(&ctx, dig) typedef arc4_context * RC4_handle; #define RC4_alloc(h) *h = malloc(sizeof(arc4_context)) --- a/librtmp/hashswf.c +++ b/librtmp/hashswf.c @@ -32,14 +32,14 @@ #ifdef CRYPTO #ifdef USE_POLARSSL -#include <polarssl/sha2.h> +#include <polarssl/sha256.h> #ifndef SHA256_DIGEST_LENGTH #define SHA256_DIGEST_LENGTH 32 #endif -#define HMAC_CTX sha2_context -#define HMAC_setup(ctx, key, len) sha2_hmac_starts(&ctx, (unsigned char *)key, len, 0) -#define HMAC_crunch(ctx, buf, len) sha2_hmac_update(&ctx, buf, len) -#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha2_hmac_finish(&ctx, dig) +#define HMAC_CTX sha256_context +#define HMAC_setup(ctx, key, len) sha256_hmac_starts(&ctx, (unsigned char *)key, len, 0) +#define HMAC_crunch(ctx, buf, len) sha256_hmac_update(&ctx, buf, len) +#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha256_hmac_finish(&ctx, dig) #define HMAC_close(ctx) #elif defined(USE_GNUTLS) #include <nettle/hmac.h> --- a/librtmp/rtmp_sys.h +++ b/librtmp/rtmp_sys.h @@ -79,7 +79,7 @@ typedef struct tls_ctx { } tls_ctx; typedef struct tls_server_ctx { havege_state *hs; - x509_cert cert; + x509_crt cert; rsa_context key; ssl_session ssn; const char *dhm_P, *dhm_G; @@ -89,14 +89,12 @@ typedef struct tls_server_ctx { #define TLS_client(ctx,s) s = malloc(sizeof(ssl_context)); ssl_init(s);\ ssl_set_endpoint(s, SSL_IS_CLIENT); ssl_set_authmode(s, SSL_VERIFY_NONE);\ ssl_set_rng(s, havege_random, &ctx->hs);\ - ssl_set_ciphersuites(s, ssl_default_ciphersuites);\ SSL_SET_SESSION(s, 1, 600, &ctx->ssn) #define TLS_server(ctx,s) s = malloc(sizeof(ssl_context)); ssl_init(s);\ ssl_set_endpoint(s, SSL_IS_SERVER); ssl_set_authmode(s, SSL_VERIFY_NONE);\ ssl_set_rng(s, havege_random, ((tls_server_ctx*)ctx)->hs);\ - ssl_set_ciphersuites(s, ssl_default_ciphersuites);\ SSL_SET_SESSION(s, 1, 600, &((tls_server_ctx*)ctx)->ssn);\ - ssl_set_own_cert(s, &((tls_server_ctx*)ctx)->cert, &((tls_server_ctx*)ctx)->key);\ + ssl_set_own_cert_rsa(s, &((tls_server_ctx*)ctx)->cert, &((tls_server_ctx*)ctx)->key);\ ssl_set_dh_param(s, ((tls_server_ctx*)ctx)->dhm_P, ((tls_server_ctx*)ctx)->dhm_G) #define TLS_setfd(s,fd) ssl_set_bio(s, net_recv, &fd, net_send, &fd) #define TLS_connect(s) ssl_handshake(s)
I did not do much testing here, since I don't use rtmpdump. Also see https://polarssl.org/kb/how-to/migrate-from-polarssl-1.2-to-polarssl-1.3 for reference which also explains why ssl_set_ciphersuites() has been removed completely.
hasufell wrote:
From: hasufell <hasufell@gentoo.org> Date: Sat, 29 Mar 2014 13:21:12 +0100 Subject: [PATCH] fix build with polarssl-1.3.x
A version-dependent patch like this ought to be ifdef'd based on the actual version numbers.
--- librtmp/dh.h | 2 +- librtmp/handshake.h | 11 ++++++----- librtmp/hashswf.c | 10 +++++----- librtmp/rtmp_sys.h | 6 ++---- 4 files changed, 14 insertions(+), 15 deletions(-)
--- a/librtmp/dh.h +++ b/librtmp/dh.h @@ -72,7 +72,7 @@ static int MDH_generate_key(MDH *dh) static int MDH_compute_key(uint8_t *secret, size_t len, MP_t pub, MDH *dh) { MP_set(&dh->ctx.GY, pub); - dhm_calc_secret(&dh->ctx, secret, &len); + dhm_calc_secret(&dh->ctx, secret, &len, NULL, NULL); return 0; }
--- a/librtmp/handshake.h +++ b/librtmp/handshake.h @@ -25,15 +25,16 @@ /* This file is #included in rtmp.c, it is not meant to be compiled alone */
#ifdef USE_POLARSSL -#include <polarssl/sha2.h> +#include <polarssl/compat-1.2.h> +#include <polarssl/sha256.h> #include <polarssl/arc4.h> #ifndef SHA256_DIGEST_LENGTH #define SHA256_DIGEST_LENGTH 32 #endif -#define HMAC_CTX sha2_context -#define HMAC_setup(ctx, key, len) sha2_hmac_starts(&ctx, (unsigned char *)key, len, 0) -#define HMAC_crunch(ctx, buf, len) sha2_hmac_update(&ctx, buf, len) -#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha2_hmac_finish(&ctx, dig) +#define HMAC_CTX sha256_context +#define HMAC_setup(ctx, key, len) sha256_hmac_starts(&ctx, (unsigned char *)key, len, 0) +#define HMAC_crunch(ctx, buf, len) sha256_hmac_update(&ctx, buf, len) +#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha256_hmac_finish(&ctx, dig)
typedef arc4_context * RC4_handle; #define RC4_alloc(h) *h = malloc(sizeof(arc4_context)) --- a/librtmp/hashswf.c +++ b/librtmp/hashswf.c @@ -32,14 +32,14 @@
#ifdef CRYPTO #ifdef USE_POLARSSL -#include <polarssl/sha2.h> +#include <polarssl/sha256.h> #ifndef SHA256_DIGEST_LENGTH #define SHA256_DIGEST_LENGTH 32 #endif -#define HMAC_CTX sha2_context -#define HMAC_setup(ctx, key, len) sha2_hmac_starts(&ctx, (unsigned char *)key, len, 0) -#define HMAC_crunch(ctx, buf, len) sha2_hmac_update(&ctx, buf, len) -#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha2_hmac_finish(&ctx, dig) +#define HMAC_CTX sha256_context +#define HMAC_setup(ctx, key, len) sha256_hmac_starts(&ctx, (unsigned char *)key, len, 0) +#define HMAC_crunch(ctx, buf, len) sha256_hmac_update(&ctx, buf, len) +#define HMAC_finish(ctx, dig, dlen) dlen = SHA256_DIGEST_LENGTH; sha256_hmac_finish(&ctx, dig) #define HMAC_close(ctx) #elif defined(USE_GNUTLS) #include <nettle/hmac.h> --- a/librtmp/rtmp_sys.h +++ b/librtmp/rtmp_sys.h @@ -79,7 +79,7 @@ typedef struct tls_ctx { } tls_ctx; typedef struct tls_server_ctx { havege_state *hs; - x509_cert cert; + x509_crt cert; rsa_context key; ssl_session ssn; const char *dhm_P, *dhm_G; @@ -89,14 +89,12 @@ typedef struct tls_server_ctx { #define TLS_client(ctx,s) s = malloc(sizeof(ssl_context)); ssl_init(s);\ ssl_set_endpoint(s, SSL_IS_CLIENT); ssl_set_authmode(s, SSL_VERIFY_NONE);\ ssl_set_rng(s, havege_random, &ctx->hs);\ - ssl_set_ciphersuites(s, ssl_default_ciphersuites);\ SSL_SET_SESSION(s, 1, 600, &ctx->ssn) #define TLS_server(ctx,s) s = malloc(sizeof(ssl_context)); ssl_init(s);\ ssl_set_endpoint(s, SSL_IS_SERVER); ssl_set_authmode(s, SSL_VERIFY_NONE);\ ssl_set_rng(s, havege_random, ((tls_server_ctx*)ctx)->hs);\ - ssl_set_ciphersuites(s, ssl_default_ciphersuites);\ SSL_SET_SESSION(s, 1, 600, &((tls_server_ctx*)ctx)->ssn);\ - ssl_set_own_cert(s, &((tls_server_ctx*)ctx)->cert, &((tls_server_ctx*)ctx)->key);\ + ssl_set_own_cert_rsa(s, &((tls_server_ctx*)ctx)->cert, &((tls_server_ctx*)ctx)->key);\ ssl_set_dh_param(s, ((tls_server_ctx*)ctx)->dhm_P, ((tls_server_ctx*)ctx)->dhm_G) #define TLS_setfd(s,fd) ssl_set_bio(s, net_recv, &fd, net_send, &fd) #define TLS_connect(s) ssl_handshake(s) _______________________________________________ rtmpdump mailing list rtmpdump@mplayerhq.hu https://lists.mplayerhq.hu/mailman/listinfo/rtmpdump
-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
Howard Chu:
hasufell wrote:
From: hasufell <hasufell@gentoo.org> Date: Sat, 29 Mar 2014 13:21:12 +0100 Subject: [PATCH] fix build with polarssl-1.3.x
A version-dependent patch like this ought to be ifdef'd based on the actual version numbers.
Do you mean supporting both 1.3.x and 1.2.x? The latter is vulnerable and no one should use it anymore. See https://polarssl.org/tech-updates/security-advisories/polarssl-security-advi... Saying... the build should fail in that case.
participants (2)
-
hasufell -
Howard Chu