Skip to content

WHIP: Fix bugs #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: workflows
Choose a base branch
from
Open

WHIP: Fix bugs #19

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0fc23b5
avformat/tls_openssl: fix build error when openssl version < 3
JackLau1222 Jun 4, 2025
2e5e91b
avformat/tls_openssl: properly set this pkey and free it
JackLau1222 Jun 6, 2025
9368f77
avformat/tls_openssl: fix warnings when openssl is lower version
JackLau1222 Jun 7, 2025
6b2c1d4
avformat/tls_openssl: fix warnings when openssl is lower version
JackLau1222 Jun 8, 2025
48a5fbe
avformat/tls_openssl: delete useless initialization
JackLau1222 Jun 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 28 additions & 13 deletions libavformat/tls_openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,7 +415,11 @@ int ff_ssl_gen_key_cert(char *key_buf, size_t key_sz, char *cert_buf, size_t cer
*/
static EVP_PKEY *pkey_from_pem_string(const char *pem_str, int is_priv)
{
#if OPENSSL_VERSION_NUMBER < 0x10002000L /* OpenSSL 1.0.2 */
BIO *mem = BIO_new_mem_buf((void *)pem_str, -1);
#else
BIO *mem = BIO_new_mem_buf(pem_str, -1);
#endif
if (!mem) {
av_log(NULL, AV_LOG_ERROR, "BIO_new_mem_buf failed\n");
return NULL;
Expand Down Expand Up @@ -445,7 +449,11 @@ static EVP_PKEY *pkey_from_pem_string(const char *pem_str, int is_priv)
*/
static X509 *cert_from_pem_string(const char *pem_str)
{
#if OPENSSL_VERSION_NUMBER < 0x10002000L /* OpenSSL 1.0.2 */
BIO *mem = BIO_new_mem_buf((void *)pem_str, -1);
#else
BIO *mem = BIO_new_mem_buf(pem_str, -1);
#endif
if (!mem) {
av_log(NULL, AV_LOG_ERROR, "BIO_new_mem_buf failed\n");
return NULL;
Expand All @@ -467,6 +475,7 @@ typedef struct TLSContext {
TLSShared tls_shared;
SSL_CTX *ctx;
SSL *ssl;
EVP_PKEY *pkey;
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
BIO_METHOD* url_bio_method;
#endif
Expand Down Expand Up @@ -849,7 +858,7 @@ static av_cold int openssl_init_ca_key_cert(URLContext *h)
goto fail;
}
} else if (p->tls_shared.key_buf) {
pkey = pkey_from_pem_string(p->tls_shared.key_buf, 1);
p->pkey = pkey = pkey_from_pem_string(p->tls_shared.key_buf, 1);
if (SSL_CTX_use_PrivateKey(p->ctx, pkey) != 1) {
av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_use_PrivateKey failed, %s\n", openssl_get_error(p));
ret = AVERROR(EINVAL);
Expand All @@ -876,6 +885,9 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **
int ret = 0;
c->is_dtls = 1;
const char* ciphers = "ALL";
#if OPENSSL_VERSION_NUMBER < 0x10002000L // v1.0.2
EC_KEY *ec_key = NULL;
#endif
/**
* The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c.
* The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c.
Expand Down Expand Up @@ -908,15 +920,6 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **
}
#endif

#if OPENSSL_VERSION_NUMBER < 0x10100000L // v1.1.x
#if OPENSSL_VERSION_NUMBER < 0x10002000L // v1.0.2
if (ctx->dtls_eckey)
SSL_CTX_set_tmp_ecdh(p->ctx, p->dtls_eckey);
#else
SSL_CTX_set_ecdh_auto(p->ctx, 1);
#endif
#endif

/**
* We activate "ALL" cipher suites to align with the peer's capabilities,
* ensuring maximum compatibility.
Expand All @@ -930,6 +933,17 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **
ret = openssl_init_ca_key_cert(h);
if (ret < 0) goto fail;

#if OPENSSL_VERSION_NUMBER < 0x10100000L // v1.1.x
#if OPENSSL_VERSION_NUMBER < 0x10002000L // v1.0.2
if (p->pkey)
ec_key = EVP_PKEY_get1_EC_KEY(p->pkey);
if (ec_key)
SSL_CTX_set_tmp_ecdh(p->ctx, ec_key);
#else
SSL_CTX_set_ecdh_auto(p->ctx, 1);
#endif
#endif

/* Server will send Certificate Request. */
SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, openssl_dtls_verify_callback);
/* The depth count is "level 0:peer certificate", "level 1: CA certificate",
Expand Down Expand Up @@ -1001,6 +1015,9 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **

ret = 0;
fail:
#if OPENSSL_VERSION_NUMBER < 0x10002000L // v1.0.2
EC_KEY_free(ec_key);
#endif
return ret;
}

Expand All @@ -1015,9 +1032,7 @@ static av_cold int dtls_close(URLContext *h)
av_freep(&ctx->tls_shared.fingerprint);
av_freep(&ctx->tls_shared.cert_buf);
av_freep(&ctx->tls_shared.key_buf);
#if OPENSSL_VERSION_NUMBER < 0x30000000L /* OpenSSL 3.0 */
EC_KEY_free(ctx->dtls_eckey);
#endif
EVP_PKEY_free(ctx->pkey);
return 0;
}

Expand Down
Loading