tls_openssl.c File Reference

#include "libavutil/mem.h"
#include "network.h"
#include "os_support.h"
#include "libavutil/random_seed.h"
#include "url.h"
#include "tls.h"
#include "libavutil/opt.h"
#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include "libavutil/thread.h"

Go to the source code of this file.

Data Structures
struct	TLSContext

Macros
#define	GET_BIO_DATA(x)   (x)->ptr

Functions
static char *	pkey_to_pem_string (EVP_PKEY *pkey)
	Returns a heap‐allocated null‐terminated string containing the PEM‐encoded public key. More...
static char *	cert_to_pem_string (X509 *cert)
	Serialize an X509 certificate to a av_malloc’d PEM string. More...
static char *	generate_fingerprint (X509 *cert)
	Generate a SHA-256 fingerprint of an X.509 certificate. More...
int	ff_ssl_read_key_cert (char *key_url, char *cert_url, char *key_buf, size_t key_sz, char *cert_buf, size_t cert_sz, char **fingerprint)
static int	openssl_gen_private_key (EVP_PKEY **pkey, EC_KEY **eckey)
static int	openssl_gen_certificate (EVP_PKEY *pkey, X509 **cert, char **fingerprint)
int	ff_ssl_gen_key_cert (char *key_buf, size_t key_sz, char *cert_buf, size_t cert_sz, char **fingerprint)
static EVP_PKEY *	pkey_from_pem_string (const char *pem_str, int is_priv)
	Deserialize a PEM‐encoded private or public key from a NUL-terminated C string. More...
static X509 *	cert_from_pem_string (const char *pem_str)
	Deserialize a PEM‐encoded certificate from a NUL-terminated C string. More...
static const char *	openssl_get_error (TLSContext *ctx)
	Retrieves the error message for the latest OpenSSL error. More...
int	ff_dtls_set_udp (URLContext *h, URLContext *udp)
int	ff_dtls_export_materials (URLContext *h, char *dtls_srtp_materials, size_t materials_sz)
int	ff_dtls_state (URLContext *h)
int	ff_openssl_init (void)
void	ff_openssl_deinit (void)
static int	print_ssl_error (URLContext *h, int ret)
static int	tls_close (URLContext *h)
static int	url_bio_create (BIO *b)
static int	url_bio_destroy (BIO *b)
static int	url_bio_bread (BIO *b, char *buf, int len)
static int	url_bio_bwrite (BIO *b, const char *buf, int len)
static long	url_bio_ctrl (BIO *b, int cmd, long num, void *ptr)
static int	url_bio_bputs (BIO *b, const char *str)
static av_cold void	init_bio_method (URLContext *h)
static void	openssl_info_callback (const SSL *ssl, int where, int ret)
static int	openssl_dtls_verify_callback (int preverify_ok, X509_STORE_CTX *ctx)
	Always return 1 to accept any certificate. More...
static int	dtls_handshake (URLContext *h)
static av_cold int	openssl_init_ca_key_cert (URLContext *h)
static int	dtls_start (URLContext *h, const char *url, int flags, AVDictionary **options)
	Once the DTLS role has been negotiated - active for the DTLS client or passive for the DTLS server - we proceed to set up the DTLS state and initiate the handshake. More...
static av_cold int	dtls_close (URLContext *h)
	Cleanup the DTLS context. More...
static int	tls_open (URLContext *h, const char *uri, int flags, AVDictionary **options)
static int	tls_read (URLContext *h, uint8_t *buf, int size)
static int	tls_write (URLContext *h, const uint8_t *buf, int size)
static int	tls_get_file_handle (URLContext *h)
static int	tls_get_short_seek (URLContext *h)

Variables
static AVMutex	openssl_mutex = AV_MUTEX_INITIALIZER
static int	openssl_init
static BIO_METHOD	url_bio_method
static const AVOption	options []
static const AVClass	tls_class
const URLProtocol	ff_tls_protocol
static const AVClass	dtls_class
const URLProtocol	ff_dtls_protocol

Macro Definition Documentation

GET_BIO_DATA

#define GET_BIO_DATA

(

x

)

(x)->ptr

Definition at line 680 of file tls_openssl.c.

Function Documentation

pkey_to_pem_string()

static char* pkey_to_pem_string ( EVP_PKEY *  pkey )

static

Returns a heap‐allocated null‐terminated string containing the PEM‐encoded public key.

Caller must free.

Definition at line 39 of file tls_openssl.c.

Referenced by ff_ssl_gen_key_cert(), and ff_ssl_read_key_cert().

cert_to_pem_string()

static char* cert_to_pem_string ( X509 *  cert )

static

Serialize an X509 certificate to a av_malloc’d PEM string.

Caller must free the returned pointer.

Definition at line 81 of file tls_openssl.c.

Referenced by ff_ssl_gen_key_cert(), and ff_ssl_read_key_cert().

generate_fingerprint()

static char* generate_fingerprint ( X509 *  cert )

static

Generate a SHA-256 fingerprint of an X.509 certificate.

Parameters

ctx	AVFormatContext for logging (can be NULL)
cert	X509 certificate to fingerprint

Returns

Newly allocated fingerprint string in "AA:BB:CC:…" format, or NULL on error (logs via av_log if ctx is not NULL). Caller must free() the returned string.

Definition at line 122 of file tls_openssl.c.

Referenced by ff_ssl_read_key_cert(), and openssl_gen_certificate().

ff_ssl_read_key_cert()

int ff_ssl_read_key_cert	(	char *	key_url,
		char *	cert_url,
		char *	key_buf,
		size_t	key_sz,
		char *	cert_buf,
		size_t	cert_sz,
		char **	fingerprint
	)

Definition at line 159 of file tls_openssl.c.

Referenced by certificate_key_init().

openssl_gen_private_key()

static int openssl_gen_private_key ( EVP_PKEY **  pkey, EC_KEY **  eckey  )

static

Note that secp256r1 in openssl is called NID_X9_62_prime256v1 or prime256v1 in string, not NID_secp256k1 or secp256k1 in string.

TODO: Should choose the curves in ClientHello.supported_groups, for example: Supported Group: x25519 (0x001d) Supported Group: secp256r1 (0x0017) Supported Group: secp384r1 (0x0018)

Definition at line 236 of file tls_openssl.c.

Referenced by ff_ssl_gen_key_cert().

openssl_gen_certificate()

static int openssl_gen_certificate ( EVP_PKEY *  pkey, X509 **  cert, char **  fingerprint  )

static

Definition at line 302 of file tls_openssl.c.

Referenced by ff_ssl_gen_key_cert().

ff_ssl_gen_key_cert()

int ff_ssl_gen_key_cert	(	char *	key_buf,
		size_t	key_sz,
		char *	cert_buf,
		size_t	cert_sz,
		char **	fingerprint
	)

Definition at line 381 of file tls_openssl.c.

Referenced by certificate_key_init().

pkey_from_pem_string()

static EVP_PKEY* pkey_from_pem_string ( const char *  pem_str, int  is_priv  )

static

Deserialize a PEM‐encoded private or public key from a NUL-terminated C string.

Parameters

pem_str	The PEM text, e.g. "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----\n"
is_priv	If non-zero, parse as a PRIVATE key; otherwise, parse as a PUBLIC key.

Returns

EVP_PKEY* on success (must EVP_PKEY_free()), or NULL on error.

Definition at line 416 of file tls_openssl.c.

Referenced by openssl_init_ca_key_cert().

cert_from_pem_string()

static X509* cert_from_pem_string ( const char *  pem_str )

static

Deserialize a PEM‐encoded certificate from a NUL-terminated C string.

Parameters

pem_str

The PEM text, e.g. "-----BEGIN CERTIFICATE-----\n…\n-----END CERTIFICATE-----\n"

Returns

X509* on success (must X509_free()), or NULL on error.

Definition at line 450 of file tls_openssl.c.

Referenced by openssl_init_ca_key_cert().

openssl_get_error()

static const char* openssl_get_error ( TLSContext *  ctx )

static

Retrieves the error message for the latest OpenSSL error.

This function retrieves the error code from the thread's error queue, converts it to a human-readable string, and stores it in the TLSContext's error_message field. The error queue is then cleared using ERR_clear_error().

Definition at line 493 of file tls_openssl.c.

Referenced by dtls_handshake(), dtls_start(), ff_dtls_export_materials(), openssl_init_ca_key_cert(), and tls_open().

ff_dtls_set_udp()

int ff_dtls_set_udp	(	URLContext *	h,
		URLContext *	udp
	)

Definition at line 505 of file tls_openssl.c.

Referenced by dtls_initialize().

ff_dtls_export_materials()

int ff_dtls_export_materials	(	URLContext *	h,
		char *	dtls_srtp_materials,
		size_t	materials_sz
	)

Definition at line 512 of file tls_openssl.c.

Referenced by setup_srtp().

ff_dtls_state()

int ff_dtls_state

(

URLContext *

h

)

Definition at line 527 of file tls_openssl.c.

Referenced by dtls_context_on_state().

ff_openssl_init()

int ff_openssl_init

(

void

)

Definition at line 565 of file tls_openssl.c.

Referenced by ff_tls_init(), and tls_open().

ff_openssl_deinit()

void ff_openssl_deinit

(

void

)

Definition at line 595 of file tls_openssl.c.

Referenced by ff_tls_deinit(), and tls_close().

print_ssl_error()

static int print_ssl_error ( URLContext *  h, int  ret  )

static

Definition at line 614 of file tls_openssl.c.

Referenced by tls_open(), tls_read(), and tls_write().

tls_close()

static int tls_close ( URLContext *  h )

static

Definition at line 638 of file tls_openssl.c.

Referenced by tls_open().

url_bio_create()

static int url_bio_create ( BIO *  b )

static

Definition at line 658 of file tls_openssl.c.

Referenced by init_bio_method().

url_bio_destroy()

static int url_bio_destroy ( BIO *  b )

static

Definition at line 672 of file tls_openssl.c.

Referenced by init_bio_method().

url_bio_bread()

static int url_bio_bread ( BIO *  b, char *  buf, int  len  )

static

Definition at line 683 of file tls_openssl.c.

Referenced by init_bio_method().

url_bio_bwrite()

static int url_bio_bwrite ( BIO *  b, const char *  buf, int  len  )

static

Definition at line 699 of file tls_openssl.c.

Referenced by init_bio_method(), and url_bio_bputs().

url_bio_ctrl()

static long url_bio_ctrl ( BIO *  b, int  cmd, long  num, void *  ptr  )

static

Definition at line 715 of file tls_openssl.c.

Referenced by init_bio_method().

url_bio_bputs()

static int url_bio_bputs ( BIO *  b, const char *  str  )

static

Definition at line 724 of file tls_openssl.c.

Referenced by init_bio_method().

init_bio_method()

static av_cold void init_bio_method ( URLContext *  h )

static

Definition at line 743 of file tls_openssl.c.

Referenced by dtls_start(), and tls_open().

openssl_info_callback()

static void openssl_info_callback ( const SSL *  ssl, int  where, int  ret  )

static

Definition at line 764 of file tls_openssl.c.

Referenced by dtls_start(), and tls_open().

openssl_dtls_verify_callback()

static int openssl_dtls_verify_callback ( int  preverify_ok, X509_STORE_CTX *  ctx  )

static

Always return 1 to accept any certificate.

This is because we allow the peer to use a temporary self-signed certificate for DTLS.

Definition at line 787 of file tls_openssl.c.

Referenced by dtls_start().

dtls_handshake()

static int dtls_handshake ( URLContext *  h )

static

Definition at line 792 of file tls_openssl.c.

Referenced by dtls_start().

openssl_init_ca_key_cert()

static av_cold int openssl_init_ca_key_cert ( URLContext *  h )

static

Definition at line 818 of file tls_openssl.c.

Referenced by dtls_start(), and tls_open().

dtls_start()

static int dtls_start ( URLContext *  h, const char *  url, int  flags, AVDictionary **  options  )

static

Once the DTLS role has been negotiated - active for the DTLS client or passive for the DTLS server - we proceed to set up the DTLS state and initiate the handshake.

The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c. The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c.

We activate "ALL" cipher suites to align with the peer's capabilities, ensuring maximum compatibility.

We have set the MTU to fragment the DTLS packet. It is important to note that the packet is split to ensure that each handshake packet is smaller than the MTU.

During initialization, we only need to call SSL_do_handshake once because SSL_read consumes the handshake message if the handshake is incomplete. To simplify maintenance, we initiate the handshake for both the DTLS server and client after sending out the ICE response in the start_active_handshake function. It's worth noting that although the DTLS server may receive the ClientHello immediately after sending out the ICE response, this shouldn't be an issue as the handshake function is called before any DTLS packets are received.

The SSL_do_handshake can't be called if DTLS hasn't prepare for udp.

Definition at line 881 of file tls_openssl.c.

dtls_close()

static av_cold int dtls_close ( URLContext *  h )

static

Cleanup the DTLS context.

Definition at line 1027 of file tls_openssl.c.

tls_open()

static int tls_open ( URLContext *  h, const char *  uri, int  flags, AVDictionary **  options  )

static

Definition at line 1039 of file tls_openssl.c.

tls_read()

static int tls_read ( URLContext *  h, uint8_t *  buf, int  size  )

static

Definition at line 1097 of file tls_openssl.c.

tls_write()

static int tls_write ( URLContext *  h, const uint8_t *  buf, int  size  )

static

Definition at line 1114 of file tls_openssl.c.

tls_get_file_handle()

static int tls_get_file_handle ( URLContext *  h )

static

Definition at line 1131 of file tls_openssl.c.

tls_get_short_seek()

static int tls_get_short_seek ( URLContext *  h )

static

Definition at line 1137 of file tls_openssl.c.

Variable Documentation

openssl_mutex

AVMutex openssl_mutex = AV_MUTEX_INITIALIZER

static

Definition at line 541 of file tls_openssl.c.

Referenced by ff_openssl_deinit(), and ff_openssl_init().

openssl_init

int openssl_init

static

Definition at line 543 of file tls_openssl.c.

Referenced by ff_openssl_deinit(), and ff_openssl_init().

url_bio_method

BIO_METHOD url_bio_method

static

Initial value:

= {
    .type = BIO_TYPE_SOURCE_SINK,
    .name = "urlprotocol bio",
    .bwrite = url_bio_bwrite,
    .bread = url_bio_bread,
    .bputs = url_bio_bputs,
    .bgets = NULL,
    .ctrl = url_bio_ctrl,
    .create = url_bio_create,
    .destroy = url_bio_destroy,
}

Definition at line 730 of file tls_openssl.c.

Referenced by init_bio_method().

options

const AVOption options[]

static

Initial value:

= {
    TLS_COMMON_OPTIONS(TLSContext, tls_shared),
    { NULL }
}

Definition at line 1143 of file tls_openssl.c.

tls_class

const AVClass tls_class

static

Initial value:

= {
    .class_name = "tls",
    .item_name  = av_default_item_name,
    .option     = options,
    .version    = LIBAVUTIL_VERSION_INT,
}

Definition at line 1148 of file tls_openssl.c.

ff_tls_protocol

const URLProtocol ff_tls_protocol

Initial value:

= {
    .name           = "tls",
    .url_open2      = tls_open,
    .url_read       = tls_read,
    .url_write      = tls_write,
    .url_close      = tls_close,
    .url_get_file_handle = tls_get_file_handle,
    .url_get_short_seek  = tls_get_short_seek,
    .priv_data_size = sizeof(TLSContext),
    .flags          = URL_PROTOCOL_FLAG_NETWORK,
    .priv_data_class = &tls_class,
}

Definition at line 1155 of file tls_openssl.c.

dtls_class

const AVClass dtls_class

static

Initial value:

= {
    .class_name = "dtls",
    .item_name  = av_default_item_name,
    .option     = options,
    .version    = LIBAVUTIL_VERSION_INT,
}

Definition at line 1168 of file tls_openssl.c.

ff_dtls_protocol

const URLProtocol ff_dtls_protocol

Initial value:

= {
    .name           = "dtls",
    .url_open2      = dtls_start,
    .url_handshake  = dtls_handshake,
    .url_close      = dtls_close,
    .url_read       = tls_read,
    .url_write      = tls_write,
    .priv_data_size = sizeof(TLSContext),
    .flags          = URL_PROTOCOL_FLAG_NETWORK,
    .priv_data_class = &dtls_class,
}

Definition at line 1175 of file tls_openssl.c.