From patchwork Wed May 29 11:03:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: sfan5 X-Patchwork-Id: 49343 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a59:8f0d:0:b0:460:55fa:d5ed with SMTP id i13csp554128vqu; Wed, 29 May 2024 04:05:55 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXALo2HY3mvWogarYNsUdzJyTIZc7tCCENCTrFfDpf+1U92HZaVAFtrU2hP4NFM3/xV2PLTkS8dRJaDXq+px9nOhrsoC4Q4CWsD0A== X-Google-Smtp-Source: AGHT+IGCeypajRHorgEATzYmau0YT+K0VeA8MNoAqLDpBMr24e/jAwslDQwbCvZtOQq9dBRODsuz X-Received: by 2002:a17:906:ae96:b0:a65:19c7:70d9 with SMTP id a640c23a62f3a-a6519c77159mr72361366b.7.1716980755323; Wed, 29 May 2024 04:05:55 -0700 (PDT) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id a640c23a62f3a-a626cdd47afsi597498666b.1026.2024.05.29.04.05.54; Wed, 29 May 2024 04:05:55 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@LIVE.DE header.s=selector1 header.b=nqJJZZi9; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=live.de Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9373768D53F; Wed, 29 May 2024 14:05:13 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04olkn2033.outbound.protection.outlook.com [40.92.73.33]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id DF94068D4E9 for ; Wed, 29 May 2024 14:05:06 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=T2izFBjajyAEfzh4c3TNhb9VSsXP8FjFbR2dOdDFVbaLLS5rtusRmow6EfdXonzz9cdrvrjK7YyVDjM3ky3KLaY5FmcqpqOtN9CH6GaHmW32VYakoaiMUkBf8OreqnY+yJqLajvzNXSSDBpc0f4CTV4xAdaKsqLksRcPmoqthFxdvrYUYDug2Q1C7XcrmEVKPZ4lmpdfR+HO9MdJYHR00M6kCpzWWIFGwhZQ3lcoL+X30+Ms/B99mRHIJAwfoNwFd9V6AVWV2AsfXv5mAyjdf7pihxpORYScQ6JehtWe26UHO7VIRKv9rxahxVAdnW8j/Ba+4jKTM+0Rk2d0hQAoOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jT6HJpa8bBmMm8mW1hpJUV8cSmQlc4ENZj4XQ4Zbvl4=; b=lXSTO9oZ0WSEAOan8kXUBivRJ37y1fk2Tt6U2MA3oT9dat/4cfwNI1aav+2fNi5ylqr8KSjGRKWIVWGcoTfBLx2qkgBU4zY8cwLpzYNo/YNI7yrpdewnCeNONFqkl28wA9R6R/m/DwkYG2lqzsLL/YwcRTkcb/8SVRSKQ9uV0S/uRku+10FLQbWQ2CTSRlE/e6V8L8x7B2nweqMFAyERkSBWwYWR8Zg78bjrO6Mde+6gCsp/kZLCljx/ap6oWhbfVTP/F8/lw1QuzAxT2ztaS3QUqdeQCGZxWRj6EBXpwzbQU4M4tOIWH9sq+q1MmRPuw8ohE6QZrH0siknxx4AI4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=LIVE.DE; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jT6HJpa8bBmMm8mW1hpJUV8cSmQlc4ENZj4XQ4Zbvl4=; b=nqJJZZi92PN4+d6USac99iC6eNd/MOtBOgp1BdrnAC5wWY2NnOzbFJsI3E9akwm3oaD0T+kTQOfmDXjup0KboBWLV2pA0R5rh8F6RdcO+MaxwAJvuLXoZJyzBf2Io4LxtmmYcMO8Zhb0eUQwwt/2l0EfOlPad4C1TLExsHFKpdBXQI/4SImBfedYR0ZXBZ6N6H6C18C3MvTkRl6C7X3CqYSnCFO7nLRxHVVo5olZ057SY8QBH4k6JPfX/HwDgtX+RS+HQEsIMdtzYdSIAVMNwRd+9UMJpa5S/C+hUGxRMhtDydk44HL2ayG+ujDY3VsXEMWmrSj+Je2N1lLCY8+swQ== Received: from DU0PR03MB9567.eurprd03.prod.outlook.com (2603:10a6:10:41f::20) by DU0PR03MB9495.eurprd03.prod.outlook.com (2603:10a6:10:41e::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7633.16; Wed, 29 May 2024 11:04:52 +0000 Received: from DU0PR03MB9567.eurprd03.prod.outlook.com ([fe80::e356:c67a:e5bb:cc8a]) by DU0PR03MB9567.eurprd03.prod.outlook.com ([fe80::e356:c67a:e5bb:cc8a%3]) with mapi id 15.20.7611.016; Wed, 29 May 2024 11:04:52 +0000 Message-ID: Date: Wed, 29 May 2024 13:03:21 +0200 User-Agent: Mozilla Thunderbird To: FFmpeg development discussions and patches Content-Language: en-US, de-DE From: sfan5 X-TMN: [rXDTxnCM6D5ZP95TbaGvxgONlvawHBRGAN2ovrsJtDTGBMoOYaPEDkTbNXW8reJuKytJilPNGVM=] X-ClientProxiedBy: FR0P281CA0070.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:49::20) To DU0PR03MB9567.eurprd03.prod.outlook.com (2603:10a6:10:41f::20) X-Microsoft-Original-Message-ID: <8244ea3d-63f4-47a4-aef4-e3a58e8bb243@live.de> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR03MB9567:EE_|DU0PR03MB9495:EE_ X-MS-Office365-Filtering-Correlation-Id: bf153f8b-b653-4995-c39e-08dc7fcf2a41 X-Microsoft-Antispam: BCL:0; ARA:14566002|6092099003|461199019|440099019|3412199016; X-Microsoft-Antispam-Message-Info: K/7DOLwqTo0UkLZ9MAb2wHDvFEhaVrGAzevnebCT/EEn/yT/UZhVMWiAlY0YE9CmS5+EJPTT5hQS5ESp/CW5nW5dredRfxR/WO6bpVIV8ADS57Un1mj3hAkMDMPZhdOXUnIyaVv6W0J/TOvpuD2b/naLnwP6shH1pF0B0OJ3i2w5450fnObj5g/ByL5hezwq/SGurkfCKiRHL+MlbGdQ7QN0NdosZeE5LafIkvMPX4d8mTJeUzY62kj6+ZOjOhxRcJqBjStrD4+TkZ/Wx5JdSM2xu1cd750kNr3teMCK0Hw/WMh87Ckto996tcOPjBtjpjY3W3Bz0XdryP0yAJiyWPZnVAlBX4Ilghn7TtIGVsE= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?aUhPNIKzY9+7XzcQ+FrhHjndJx1q?= =?utf-8?q?VXtC8gjexhZ/qUumEUifqINl7MC7U+NrW5ghrwlbNk59ptaC8QBkwKcb+QRcTNrCb?= =?utf-8?q?d/AaTTsjynWXsAVljt7APs7KmceNGR6wafJh/b58b1HgFK8G4ygPKCNGIottnJ57l?= =?utf-8?q?S0YGNOvHL2I5RXODOD+mKNi5ERwVaJm7OLg0PuBIRwANE7Y5IPphCCEMe1mzyRYdT?= =?utf-8?q?oKbCsJbK0r/PwH3jDYQiOMxpF7JAiEST8dzmCddI4MxCJAPCZOBpvp6gnflwj5neO?= =?utf-8?q?2GJmxaubMUXFcdI6KFVvilWznsY6c4Vi09Q6Mo5TEC48DaUfS3rRaoD7bWgqS8E9e?= =?utf-8?q?uATNCv3kKt5Vktb9L92XPkwAua35c8fd8eLOIfj2V2RrczbzUseV2ZNJnxBIgDssC?= =?utf-8?q?TdveHK0QoJSlynarHaOsp9uqrF9c1ErPQR9UJLUxsdrERkUF8ZS3t2DsESr8LxeZ+?= =?utf-8?q?VJJAMVD7HlbokwE4648MHREjhTxlHQtm4suRTVxvWvB4gxQUNDCADUN3Kc8f3UNrq?= =?utf-8?q?cB6GffK+NmSMHNaoVd0xG6B6P44Wcn1NSowotT+wHy6kRe5XxrEMuRVoV4uGGPOs5?= =?utf-8?q?24fRG7NBxR0Ttc7NtsvHt74RzpAAiNPUItMVEWxIlv5Gl0KwN2Utj7FWYzpslvWLF?= =?utf-8?q?J8vq9vahlyz6WbhilulbpenFjjNwWMp7ngUOHiPs8cC9AH43pQiHWEBJjJtdExROm?= =?utf-8?q?wov8a/3t9ip4zulZq0mOO+0aql2aPHKbUO4CzOMYaT9ta9BFq6B94QkWS6OGKToqJ?= =?utf-8?q?YAzBZzCkf21KGObIV1xp1kFzhE3pHpk2sD9a2PBjZ5Rzo+pgWldA/0i2m7zhEyCnm?= =?utf-8?q?+5swxicABXC2RUtisFAcFS13/ZJq2hKx4RepTrdkBMQ4eHjUZUfw+vSK8Wd2nL1R2?= =?utf-8?q?fxuvo+iI6VENDKpuuaUbivDTXD8UeVkpFxyS3ET7D+0Evi1+nz6sy8JCb2ZUDsXaz?= =?utf-8?q?GyaQ/sKzFw7kBRBsT/tNiVR6TAm3KTwVm4E3gjfplE+pdhXAfIHGf7k0aKqtnJxkR?= =?utf-8?q?gRvYmyzP03x7EVDUu0GdZ4cZl17YBPsoy+KqmC96Cde3beYtuhUqBSw3waXLoQ9ga?= =?utf-8?q?F2V6um+KS+waU1Eqy2NEJ9jUO4osO13McDztUqkMR5nXgpPdH6NALikbhXlry8nPZ?= =?utf-8?q?PyhxyitGC3ylYsRLWTfgOGcNsaWfP5DZpeVBNaurvJyld5Dbc2GsxclfMV4tP5pKl?= =?utf-8?q?rm1TuiMKCoThZ7wY7rKgCsMvF2YshJff3yIJJjEzDG/xv5YzVrjuLq004zPE=3D?= X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-76d7b.templateTenant X-MS-Exchange-CrossTenant-Network-Message-Id: bf153f8b-b653-4995-c39e-08dc7fcf2a41 X-MS-Exchange-CrossTenant-AuthSource: DU0PR03MB9567.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 May 2024 11:04:52.5865 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR03MB9495 X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: [FFmpeg-devel] [PATCH v2 6/6] lavf/tls_mbedtls: add workaround for TLSv1.3 vs. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 7O6IfY4SaxaG From 98dd9aac129fbdf07f83da16b7307cb775ff8e66 Mon Sep 17 00:00:00 2001 From: sfan5 Date: Fri, 17 May 2024 10:06:42 +0200 Subject: [PATCH v2 6/6] lavf/tls_mbedtls: add workaround for TLSv1.3 vs. verify=0 As of mbedTLS 3.6.0 TLSv1.3 is enabled by default and certificate verification is now mandatory. Our default configuration does not do verification, so downgrade to 1.2 in these situations to avoid breaking it. ref: https://github.com/Mbed-TLS/mbedtls/issues/7075 Signed-off-by: sfan5 --- libavformat/tls_mbedtls.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 9be817af5e..fbad23ab8c 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -163,6 +163,10 @@ static void handle_handshake_error(URLContext *h, int ret) case MBEDTLS_ERR_SSL_INTERNAL_ERROR: av_log(h, AV_LOG_ERROR, "Internal error encountered.\n"); break; + case MBEDTLS_ERR_X509_CERT_VERIFY_FAILED: + // This error only happens with TLSv1.3, we normally use mbedtls_ssl_get_verify_result(). + av_log(h, AV_LOG_ERROR, "Certificate verification failed.\n"); + break; case MBEDTLS_ERR_NET_CONN_RESET: av_log(h, AV_LOG_ERROR, "TLS handshake was aborted by peer.\n"); break; @@ -266,6 +270,14 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } +#ifdef MBEDTLS_SSL_PROTO_TLS1_3 + // mbedTLS does not allow disabling certificate verification with TLSv1.3 (yes, really). + if (!shr->verify) { + av_log(h, AV_LOG_INFO, "Forcing TLSv1.2 because certificate verification is disabled\n"); + mbedtls_ssl_conf_max_tls_version(&tls_ctx->ssl_config, MBEDTLS_SSL_VERSION_TLS1_2); + } +#endif + // not VERIFY_REQUIRED because we manually check after handshake mbedtls_ssl_conf_authmode(&tls_ctx->ssl_config, shr->verify ? MBEDTLS_SSL_VERIFY_OPTIONAL : MBEDTLS_SSL_VERIFY_NONE); -- 2.45.1