[deb_ffmpeg.git] / ffmpeg / libavformat / tls.c

/*
 * TLS/SSL Protocol
 * Copyright (c) 2011 Martin Storsjo
 *
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

#include "avformat.h"
#include "url.h"
#include "libavutil/avstring.h"
#include "libavutil/opt.h"
#include "libavutil/parseutils.h"
#include "network.h"
#include "os_support.h"
#include "internal.h"
#if CONFIG_GNUTLS
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
#define TLS_read(c, buf, size)  gnutls_record_recv(c->session, buf, size)
#define TLS_write(c, buf, size) gnutls_record_send(c->session, buf, size)
#define TLS_shutdown(c)         gnutls_bye(c->session, GNUTLS_SHUT_RDWR)
#define TLS_free(c) do { \
        if (c->session) \
            gnutls_deinit(c->session); \
        if (c->cred) \
            gnutls_certificate_free_credentials(c->cred); \
    } while (0)
#elif CONFIG_OPENSSL
#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#define TLS_read(c, buf, size)  SSL_read(c->ssl,  buf, size)
#define TLS_write(c, buf, size) SSL_write(c->ssl, buf, size)
#define TLS_shutdown(c)         SSL_shutdown(c->ssl)
#define TLS_free(c) do { \
        if (c->ssl) \
            SSL_free(c->ssl); \
        if (c->ctx) \
            SSL_CTX_free(c->ctx); \
    } while (0)
#endif
#if HAVE_POLL_H
#include <poll.h>
#endif

typedef struct {
    const AVClass *class;
    URLContext *tcp;
#if CONFIG_GNUTLS
    gnutls_session_t session;
    gnutls_certificate_credentials_t cred;
#elif CONFIG_OPENSSL
    SSL_CTX *ctx;
    SSL *ssl;
#endif
    int fd;
    char *ca_file;
    int verify;
    char *cert_file;
    char *key_file;
    int listen;
} TLSContext;

#define OFFSET(x) offsetof(TLSContext, x)
#define D AV_OPT_FLAG_DECODING_PARAM
#define E AV_OPT_FLAG_ENCODING_PARAM
static const AVOption options[] = {
    {"ca_file",    "Certificate Authority database file", OFFSET(ca_file),   AV_OPT_TYPE_STRING, .flags = D|E },
    {"cafile",     "Certificate Authority database file", OFFSET(ca_file),   AV_OPT_TYPE_STRING, .flags = D|E },
    {"tls_verify", "Verify the peer certificate",         OFFSET(verify),    AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = D|E },
    {"cert_file",  "Certificate file",                    OFFSET(cert_file), AV_OPT_TYPE_STRING, .flags = D|E },
    {"key_file",   "Private key file",                    OFFSET(key_file),  AV_OPT_TYPE_STRING, .flags = D|E },
    {"listen",     "Listen for incoming connections",     OFFSET(listen),    AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = D|E },
    { NULL }
};

static const AVClass tls_class = {
    .class_name = "tls",
    .item_name  = av_default_item_name,
    .option     = options,
    .version    = LIBAVUTIL_VERSION_INT,
};

static int do_tls_poll(URLContext *h, int ret)
{
    TLSContext *c = h->priv_data;
    struct pollfd p = { c->fd, 0, 0 };
#if CONFIG_GNUTLS
    switch (ret) {
    case GNUTLS_E_AGAIN:
    case GNUTLS_E_INTERRUPTED:
        break;
    case GNUTLS_E_WARNING_ALERT_RECEIVED:
        av_log(h, AV_LOG_WARNING, "%s\n", gnutls_strerror(ret));
        break;
    default:
        av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
        return AVERROR(EIO);
    }
    if (gnutls_record_get_direction(c->session))
        p.events = POLLOUT;
    else
        p.events = POLLIN;
#elif CONFIG_OPENSSL
    ret = SSL_get_error(c->ssl, ret);
    if (ret == SSL_ERROR_WANT_READ) {
        p.events = POLLIN;
    } else if (ret == SSL_ERROR_WANT_WRITE) {
        p.events = POLLOUT;
    } else {
        av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
        return AVERROR(EIO);
    }
#endif
    if (h->flags & AVIO_FLAG_NONBLOCK)
        return AVERROR(EAGAIN);
    while (1) {
        int n = poll(&p, 1, 100);
        if (n > 0)
            break;
        if (ff_check_interrupt(&h->interrupt_callback))
            return AVERROR(EINTR);
    }
    return 0;
}

static void set_options(URLContext *h, const char *uri)
{
    TLSContext *c = h->priv_data;
    char buf[1024];
    const char *p = strchr(uri, '?');
    if (!p)
        return;

    if (!c->ca_file && av_find_info_tag(buf, sizeof(buf), "cafile", p))
        c->ca_file = av_strdup(buf);

    if (!c->verify && av_find_info_tag(buf, sizeof(buf), "verify", p)) {
        char *endptr = NULL;
        c->verify = strtol(buf, &endptr, 10);
        if (buf == endptr)
            c->verify = 1;
    }

    if (!c->cert_file && av_find_info_tag(buf, sizeof(buf), "cert", p))
        c->cert_file = av_strdup(buf);

    if (!c->key_file && av_find_info_tag(buf, sizeof(buf), "key", p))
        c->key_file = av_strdup(buf);
}

static int tls_open(URLContext *h, const char *uri, int flags)
{
    TLSContext *c = h->priv_data;
    int ret;
    int port;
    const char *p;
    char buf[200], host[200], opts[50] = "";
    int numerichost = 0;
    struct addrinfo hints = { 0 }, *ai = NULL;
    const char *proxy_path;
    int use_proxy;

    ff_tls_init();

    if (c->listen)
        snprintf(opts, sizeof(opts), "?listen=1");

    av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port, NULL, 0, uri);

    p = strchr(uri, '?');

    if (!p) {
        p = opts;
    } else {
        if (av_find_info_tag(opts, sizeof(opts), "listen", p))
            c->listen = 1;
    }

    ff_url_join(buf, sizeof(buf), "tcp", NULL, host, port, "%s", p);

    hints.ai_flags = AI_NUMERICHOST;
    if (!getaddrinfo(host, NULL, &hints, &ai)) {
        numerichost = 1;
        freeaddrinfo(ai);
    }

    proxy_path = getenv("http_proxy");
    use_proxy = !ff_http_match_no_proxy(getenv("no_proxy"), host) &&
                proxy_path && av_strstart(proxy_path, "http://", NULL);

    if (use_proxy) {
        char proxy_host[200], proxy_auth[200], dest[200];
        int proxy_port;
        av_url_split(NULL, 0, proxy_auth, sizeof(proxy_auth),
                     proxy_host, sizeof(proxy_host), &proxy_port, NULL, 0,
                     proxy_path);
        ff_url_join(dest, sizeof(dest), NULL, NULL, host, port, NULL);
        ff_url_join(buf, sizeof(buf), "httpproxy", proxy_auth, proxy_host,
                    proxy_port, "/%s", dest);
    }

    ret = ffurl_open(&c->tcp, buf, AVIO_FLAG_READ_WRITE,
                     &h->interrupt_callback, NULL);
    if (ret)
        goto fail;
    c->fd = ffurl_get_file_handle(c->tcp);

#if CONFIG_GNUTLS
    gnutls_init(&c->session, c->listen ? GNUTLS_SERVER : GNUTLS_CLIENT);
    if (!c->listen && !numerichost)
        gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
    gnutls_certificate_allocate_credentials(&c->cred);
    set_options(h, uri);
    if (c->ca_file) {
        ret = gnutls_certificate_set_x509_trust_file(c->cred, c->ca_file, GNUTLS_X509_FMT_PEM);
        if (ret < 0)
            av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
    }
#if GNUTLS_VERSION_MAJOR >= 3
    else
        gnutls_certificate_set_x509_system_trust(c->cred);
#endif
    gnutls_certificate_set_verify_flags(c->cred, c->verify ?
                                        GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT : 0);
    if (c->cert_file && c->key_file) {
        ret = gnutls_certificate_set_x509_key_file(c->cred,
                                                   c->cert_file, c->key_file,
                                                   GNUTLS_X509_FMT_PEM);
        if (ret < 0) {
            av_log(h, AV_LOG_ERROR,
                   "Unable to set cert/key files %s and %s: %s\n",
                   c->cert_file, c->key_file, gnutls_strerror(ret));
            ret = AVERROR(EIO);
            goto fail;
        }
    } else if (c->cert_file || c->key_file)
        av_log(h, AV_LOG_ERROR, "cert and key required\n");
    gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
    gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)
                                         (intptr_t) c->fd);
    gnutls_priority_set_direct(c->session, "NORMAL", NULL);
    while (1) {
        ret = gnutls_handshake(c->session);
        if (ret == 0)
            break;
        if ((ret = do_tls_poll(h, ret)) < 0)
            goto fail;
    }
    if (c->verify) {
        unsigned int status, cert_list_size;
        gnutls_x509_crt_t cert;
        const gnutls_datum_t *cert_list;
        if ((ret = gnutls_certificate_verify_peers2(c->session, &status)) < 0) {
            av_log(h, AV_LOG_ERROR, "Unable to verify peer certificate: %s\n",
                                    gnutls_strerror(ret));
            ret = AVERROR(EIO);
            goto fail;
        }
        if (status & GNUTLS_CERT_INVALID) {
            av_log(h, AV_LOG_ERROR, "Peer certificate failed verification\n");
            ret = AVERROR(EIO);
            goto fail;
        }
        if (gnutls_certificate_type_get(c->session) != GNUTLS_CRT_X509) {
            av_log(h, AV_LOG_ERROR, "Unsupported certificate type\n");
            ret = AVERROR(EIO);
            goto fail;
        }
        gnutls_x509_crt_init(&cert);
        cert_list = gnutls_certificate_get_peers(c->session, &cert_list_size);
        gnutls_x509_crt_import(cert, cert_list, GNUTLS_X509_FMT_DER);
        ret = gnutls_x509_crt_check_hostname(cert, host);
        gnutls_x509_crt_deinit(cert);
        if (!ret) {
            av_log(h, AV_LOG_ERROR,
                   "The certificate's owner does not match hostname %s\n", host);
            ret = AVERROR(EIO);
            goto fail;
        }
    }
#elif CONFIG_OPENSSL
    c->ctx = SSL_CTX_new(c->listen ? TLSv1_server_method() : TLSv1_client_method());
    if (!c->ctx) {
        av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
        ret = AVERROR(EIO);
        goto fail;
    }
    set_options(h, uri);
    if (c->ca_file) {
        if (!SSL_CTX_load_verify_locations(c->ctx, c->ca_file, NULL))
            av_log(h, AV_LOG_ERROR, "SSL_CTX_load_verify_locations %s\n", ERR_error_string(ERR_get_error(), NULL));
    }
    if (c->cert_file && !SSL_CTX_use_certificate_chain_file(c->ctx, c->cert_file)) {
        av_log(h, AV_LOG_ERROR, "Unable to load cert file %s: %s\n",
               c->cert_file, ERR_error_string(ERR_get_error(), NULL));
        ret = AVERROR(EIO);
        goto fail;
    }
    if (c->key_file && !SSL_CTX_use_PrivateKey_file(c->ctx, c->key_file, SSL_FILETYPE_PEM)) {
        av_log(h, AV_LOG_ERROR, "Unable to load key file %s: %s\n",
               c->key_file, ERR_error_string(ERR_get_error(), NULL));
        ret = AVERROR(EIO);
        goto fail;
    }
    // Note, this doesn't check that the peer certificate actually matches
    // the requested hostname.
    if (c->verify)
        SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
    c->ssl = SSL_new(c->ctx);
    if (!c->ssl) {
        av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
        ret = AVERROR(EIO);
        goto fail;
    }
    SSL_set_fd(c->ssl, c->fd);
    if (!c->listen && !numerichost)
        SSL_set_tlsext_host_name(c->ssl, host);
    while (1) {
        ret = c->listen ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
        if (ret > 0)
            break;
        if (ret == 0) {
            av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session\n");
            ret = AVERROR(EIO);
            goto fail;
        }
        if ((ret = do_tls_poll(h, ret)) < 0)
            goto fail;
    }
#endif
    return 0;
fail:
    TLS_free(c);
    if (c->tcp)
        ffurl_close(c->tcp);
    ff_tls_deinit();
    return ret;
}

static int tls_read(URLContext *h, uint8_t *buf, int size)
{
    TLSContext *c = h->priv_data;
    while (1) {
        int ret = TLS_read(c, buf, size);
        if (ret > 0)
            return ret;
        if (ret == 0)
            return AVERROR_EOF;
        if ((ret = do_tls_poll(h, ret)) < 0)
            return ret;
    }
    return 0;
}

static int tls_write(URLContext *h, const uint8_t *buf, int size)
{
    TLSContext *c = h->priv_data;
    while (1) {
        int ret = TLS_write(c, buf, size);
        if (ret > 0)
            return ret;
        if (ret == 0)
            return AVERROR_EOF;
        if ((ret = do_tls_poll(h, ret)) < 0)
            return ret;
    }
    return 0;
}

static int tls_close(URLContext *h)
{
    TLSContext *c = h->priv_data;
    TLS_shutdown(c);
    TLS_free(c);
    ffurl_close(c->tcp);
    ff_tls_deinit();
    return 0;
}

URLProtocol ff_tls_protocol = {
    .name           = "tls",
    .url_open       = tls_open,
    .url_read       = tls_read,
    .url_write      = tls_write,
    .url_close      = tls_close,
    .priv_data_size = sizeof(TLSContext),
    .flags          = URL_PROTOCOL_FLAG_NETWORK,
    .priv_data_class = &tls_class,
};
Commit	Line	Data
2ba45a60 DM	1	/*
	2	* TLS/SSL Protocol
	3	* Copyright (c) 2011 Martin Storsjo
	4	*
	5	* This file is part of FFmpeg.
	6	*
	7	* FFmpeg is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU Lesser General Public
	9	* License as published by the Free Software Foundation; either
	10	* version 2.1 of the License, or (at your option) any later version.
	11	*
	12	* FFmpeg is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	* Lesser General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU Lesser General Public
	18	* License along with FFmpeg; if not, write to the Free Software
	19	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
	20	*/
	21
	22	#include "avformat.h"
	23	#include "url.h"
	24	#include "libavutil/avstring.h"
	25	#include "libavutil/opt.h"
	26	#include "libavutil/parseutils.h"
	27	#include "network.h"
	28	#include "os_support.h"
	29	#include "internal.h"
	30	#if CONFIG_GNUTLS
	31	#include <gnutls/gnutls.h>
	32	#include <gnutls/x509.h>
	33	#define TLS_read(c, buf, size) gnutls_record_recv(c->session, buf, size)
	34	#define TLS_write(c, buf, size) gnutls_record_send(c->session, buf, size)
	35	#define TLS_shutdown(c) gnutls_bye(c->session, GNUTLS_SHUT_RDWR)
	36	#define TLS_free(c) do { \
	37	if (c->session) \
	38	gnutls_deinit(c->session); \
	39	if (c->cred) \
	40	gnutls_certificate_free_credentials(c->cred); \
	41	} while (0)
	42	#elif CONFIG_OPENSSL
	43	#include <openssl/bio.h>
	44	#include <openssl/ssl.h>
	45	#include <openssl/err.h>
	46	#define TLS_read(c, buf, size) SSL_read(c->ssl, buf, size)
	47	#define TLS_write(c, buf, size) SSL_write(c->ssl, buf, size)
	48	#define TLS_shutdown(c) SSL_shutdown(c->ssl)
	49	#define TLS_free(c) do { \
	50	if (c->ssl) \
	51	SSL_free(c->ssl); \
	52	if (c->ctx) \
	53	SSL_CTX_free(c->ctx); \
	54	} while (0)
	55	#endif
	56	#if HAVE_POLL_H
	57	#include <poll.h>
	58	#endif
	59
	60	typedef struct {
	61	const AVClass *class;
	62	URLContext *tcp;
	63	#if CONFIG_GNUTLS
	64	gnutls_session_t session;
65	gnutls_certificate_credentials_t cred;
66	#elif CONFIG_OPENSSL
67	SSL_CTX *ctx;
68	SSL *ssl;
69	#endif
70	int fd;
71	char *ca_file;
72	int verify;
73	char *cert_file;
74	char *key_file;
75	int listen;
76	} TLSContext;
77
78	#define OFFSET(x) offsetof(TLSContext, x)
79	#define D AV_OPT_FLAG_DECODING_PARAM
80	#define E AV_OPT_FLAG_ENCODING_PARAM
81	static const AVOption options[] = {
82	{"ca_file", "Certificate Authority database file", OFFSET(ca_file), AV_OPT_TYPE_STRING, .flags = D\|E },
83	{"cafile", "Certificate Authority database file", OFFSET(ca_file), AV_OPT_TYPE_STRING, .flags = D\|E },
84	{"tls_verify", "Verify the peer certificate", OFFSET(verify), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = D\|E },
85	{"cert_file", "Certificate file", OFFSET(cert_file), AV_OPT_TYPE_STRING, .flags = D\|E },
86	{"key_file", "Private key file", OFFSET(key_file), AV_OPT_TYPE_STRING, .flags = D\|E },
87	{"listen", "Listen for incoming connections", OFFSET(listen), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = D\|E },
88	{ NULL }
89	};
90
91	static const AVClass tls_class = {
92	.class_name = "tls",
93	.item_name = av_default_item_name,
94	.option = options,
95	.version = LIBAVUTIL_VERSION_INT,
96	};
97
98	static int do_tls_poll(URLContext *h, int ret)
99	{
100	TLSContext *c = h->priv_data;
101	struct pollfd p = { c->fd, 0, 0 };
102	#if CONFIG_GNUTLS
103	switch (ret) {
104	case GNUTLS_E_AGAIN:
105	case GNUTLS_E_INTERRUPTED:
106	break;
107	case GNUTLS_E_WARNING_ALERT_RECEIVED:
108	av_log(h, AV_LOG_WARNING, "%s\n", gnutls_strerror(ret));
109	break;
110	default:
111	av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
112	return AVERROR(EIO);
113	}
114	if (gnutls_record_get_direction(c->session))
115	p.events = POLLOUT;
116	else
117	p.events = POLLIN;
118	#elif CONFIG_OPENSSL
119	ret = SSL_get_error(c->ssl, ret);
120	if (ret == SSL_ERROR_WANT_READ) {
121	p.events = POLLIN;
122	} else if (ret == SSL_ERROR_WANT_WRITE) {
123	p.events = POLLOUT;
124	} else {
125	av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
126	return AVERROR(EIO);
127	}
128	#endif
129	if (h->flags & AVIO_FLAG_NONBLOCK)
130	return AVERROR(EAGAIN);
131	while (1) {
132	int n = poll(&p, 1, 100);
133	if (n > 0)
134	break;
135	if (ff_check_interrupt(&h->interrupt_callback))
136	return AVERROR(EINTR);
137	}
138	return 0;
139	}
140
141	static void set_options(URLContext h, const char uri)
142	{
143	TLSContext *c = h->priv_data;
144	char buf[1024];
145	const char *p = strchr(uri, '?');
146	if (!p)
147	return;
148
149	if (!c->ca_file && av_find_info_tag(buf, sizeof(buf), "cafile", p))
150	c->ca_file = av_strdup(buf);
151
152	if (!c->verify && av_find_info_tag(buf, sizeof(buf), "verify", p)) {
153	char *endptr = NULL;
154	c->verify = strtol(buf, &endptr, 10);
155	if (buf == endptr)
156	c->verify = 1;
157	}
158
159	if (!c->cert_file && av_find_info_tag(buf, sizeof(buf), "cert", p))
160	c->cert_file = av_strdup(buf);
161
162	if (!c->key_file && av_find_info_tag(buf, sizeof(buf), "key", p))
163	c->key_file = av_strdup(buf);
164	}
165
166	static int tls_open(URLContext h, const char uri, int flags)
167	{
168	TLSContext *c = h->priv_data;
169	int ret;
170	int port;
f6fa7814	171	const char *p;
2ba45a60 DM	172	char buf[200], host[200], opts[50] = "";
	173	int numerichost = 0;
	174	struct addrinfo hints = { 0 }, *ai = NULL;
	175	const char *proxy_path;
	176	int use_proxy;
2ba45a60 DM	177
	178	ff_tls_init();
	179
2ba45a60 DM	180	if (c->listen)
	181	snprintf(opts, sizeof(opts), "?listen=1");
	182
	183	av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port, NULL, 0, uri);
f6fa7814 DM	184
	185	p = strchr(uri, '?');
	186
	187	if (!p) {
	188	p = opts;
	189	} else {
	190	if (av_find_info_tag(opts, sizeof(opts), "listen", p))
	191	c->listen = 1;
	192	}
	193
	194	ff_url_join(buf, sizeof(buf), "tcp", NULL, host, port, "%s", p);
2ba45a60 DM	195
	196	hints.ai_flags = AI_NUMERICHOST;
	197	if (!getaddrinfo(host, NULL, &hints, &ai)) {
	198	numerichost = 1;
	199	freeaddrinfo(ai);
	200	}
	201
	202	proxy_path = getenv("http_proxy");
	203	use_proxy = !ff_http_match_no_proxy(getenv("no_proxy"), host) &&
	204	proxy_path && av_strstart(proxy_path, "http://", NULL);
	205
	206	if (use_proxy) {
	207	char proxy_host[200], proxy_auth[200], dest[200];
	208	int proxy_port;
	209	av_url_split(NULL, 0, proxy_auth, sizeof(proxy_auth),
	210	proxy_host, sizeof(proxy_host), &proxy_port, NULL, 0,
	211	proxy_path);
	212	ff_url_join(dest, sizeof(dest), NULL, NULL, host, port, NULL);
	213	ff_url_join(buf, sizeof(buf), "httpproxy", proxy_auth, proxy_host,
	214	proxy_port, "/%s", dest);
	215	}
	216
	217	ret = ffurl_open(&c->tcp, buf, AVIO_FLAG_READ_WRITE,
	218	&h->interrupt_callback, NULL);
	219	if (ret)
	220	goto fail;
	221	c->fd = ffurl_get_file_handle(c->tcp);
	222
	223	#if CONFIG_GNUTLS
	224	gnutls_init(&c->session, c->listen ? GNUTLS_SERVER : GNUTLS_CLIENT);
	225	if (!c->listen && !numerichost)
	226	gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, host, strlen(host));
	227	gnutls_certificate_allocate_credentials(&c->cred);
	228	set_options(h, uri);
	229	if (c->ca_file) {
	230	ret = gnutls_certificate_set_x509_trust_file(c->cred, c->ca_file, GNUTLS_X509_FMT_PEM);
	231	if (ret < 0)
	232	av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
	233	}
	234	#if GNUTLS_VERSION_MAJOR >= 3
	235	else
	236	gnutls_certificate_set_x509_system_trust(c->cred);
	237	#endif
	238	gnutls_certificate_set_verify_flags(c->cred, c->verify ?
	239	GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT : 0);
	240	if (c->cert_file && c->key_file) {
	241	ret = gnutls_certificate_set_x509_key_file(c->cred,
	242	c->cert_file, c->key_file,
	243	GNUTLS_X509_FMT_PEM);
	244	if (ret < 0) {
	245	av_log(h, AV_LOG_ERROR,
	246	"Unable to set cert/key files %s and %s: %s\n",
	247	c->cert_file, c->key_file, gnutls_strerror(ret));
	248	ret = AVERROR(EIO);
	249	goto fail;
	250	}
	251	} else if (c->cert_file \|\| c->key_file)
	252	av_log(h, AV_LOG_ERROR, "cert and key required\n");
	253	gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
	254	gnutls_transport_set_ptr(c->session, (gnutls_transport_ptr_t)
	255	(intptr_t) c->fd);
	256	gnutls_priority_set_direct(c->session, "NORMAL", NULL);
	257	while (1) {
	258	ret = gnutls_handshake(c->session);
259	if (ret == 0)
260	break;
261	if ((ret = do_tls_poll(h, ret)) < 0)
262	goto fail;
263	}
264	if (c->verify) {
265	unsigned int status, cert_list_size;
266	gnutls_x509_crt_t cert;
267	const gnutls_datum_t *cert_list;
268	if ((ret = gnutls_certificate_verify_peers2(c->session, &status)) < 0) {
269	av_log(h, AV_LOG_ERROR, "Unable to verify peer certificate: %s\n",
270	gnutls_strerror(ret));
271	ret = AVERROR(EIO);
272	goto fail;
273	}
274	if (status & GNUTLS_CERT_INVALID) {
275	av_log(h, AV_LOG_ERROR, "Peer certificate failed verification\n");
276	ret = AVERROR(EIO);
277	goto fail;
278	}
279	if (gnutls_certificate_type_get(c->session) != GNUTLS_CRT_X509) {
280	av_log(h, AV_LOG_ERROR, "Unsupported certificate type\n");
281	ret = AVERROR(EIO);
282	goto fail;
283	}
284	gnutls_x509_crt_init(&cert);
285	cert_list = gnutls_certificate_get_peers(c->session, &cert_list_size);
286	gnutls_x509_crt_import(cert, cert_list, GNUTLS_X509_FMT_DER);
287	ret = gnutls_x509_crt_check_hostname(cert, host);
288	gnutls_x509_crt_deinit(cert);
289	if (!ret) {
290	av_log(h, AV_LOG_ERROR,
291	"The certificate's owner does not match hostname %s\n", host);
292	ret = AVERROR(EIO);
293	goto fail;
294	}
295	}
296	#elif CONFIG_OPENSSL
297	c->ctx = SSL_CTX_new(c->listen ? TLSv1_server_method() : TLSv1_client_method());
298	if (!c->ctx) {
299	av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
300	ret = AVERROR(EIO);
301	goto fail;
302	}
303	set_options(h, uri);
304	if (c->ca_file) {
305	if (!SSL_CTX_load_verify_locations(c->ctx, c->ca_file, NULL))
306	av_log(h, AV_LOG_ERROR, "SSL_CTX_load_verify_locations %s\n", ERR_error_string(ERR_get_error(), NULL));
307	}
308	if (c->cert_file && !SSL_CTX_use_certificate_chain_file(c->ctx, c->cert_file)) {
309	av_log(h, AV_LOG_ERROR, "Unable to load cert file %s: %s\n",
310	c->cert_file, ERR_error_string(ERR_get_error(), NULL));
311	ret = AVERROR(EIO);
312	goto fail;
313	}
314	if (c->key_file && !SSL_CTX_use_PrivateKey_file(c->ctx, c->key_file, SSL_FILETYPE_PEM)) {
315	av_log(h, AV_LOG_ERROR, "Unable to load key file %s: %s\n",
316	c->key_file, ERR_error_string(ERR_get_error(), NULL));
317	ret = AVERROR(EIO);
318	goto fail;
319	}
320	// Note, this doesn't check that the peer certificate actually matches
321	// the requested hostname.
322	if (c->verify)
323	SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER\|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
324	c->ssl = SSL_new(c->ctx);
325	if (!c->ssl) {
326	av_log(h, AV_LOG_ERROR, "%s\n", ERR_error_string(ERR_get_error(), NULL));
327	ret = AVERROR(EIO);
328	goto fail;
329	}
330	SSL_set_fd(c->ssl, c->fd);
331	if (!c->listen && !numerichost)
332	SSL_set_tlsext_host_name(c->ssl, host);
333	while (1) {
334	ret = c->listen ? SSL_accept(c->ssl) : SSL_connect(c->ssl);
335	if (ret > 0)
336	break;
337	if (ret == 0) {
338	av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session\n");
339	ret = AVERROR(EIO);
340	goto fail;
341	}
342	if ((ret = do_tls_poll(h, ret)) < 0)
343	goto fail;
344	}
345	#endif
346	return 0;
347	fail:
348	TLS_free(c);
349	if (c->tcp)
350	ffurl_close(c->tcp);
351	ff_tls_deinit();
352	return ret;
353	}
354
355	static int tls_read(URLContext h, uint8_t buf, int size)
356	{
357	TLSContext *c = h->priv_data;
358	while (1) {
359	int ret = TLS_read(c, buf, size);
360	if (ret > 0)
361	return ret;
362	if (ret == 0)
363	return AVERROR_EOF;
364	if ((ret = do_tls_poll(h, ret)) < 0)
365	return ret;
366	}
367	return 0;
368	}
369
370	static int tls_write(URLContext h, const uint8_t buf, int size)
371	{
372	TLSContext *c = h->priv_data;
373	while (1) {
374	int ret = TLS_write(c, buf, size);
375	if (ret > 0)
376	return ret;
377	if (ret == 0)
378	return AVERROR_EOF;
379	if ((ret = do_tls_poll(h, ret)) < 0)
380	return ret;
381	}
382	return 0;
383	}
384
385	static int tls_close(URLContext *h)
386	{
387	TLSContext *c = h->priv_data;
388	TLS_shutdown(c);
389	TLS_free(c);
390	ffurl_close(c->tcp);
391	ff_tls_deinit();
392	return 0;
393	}
394
395	URLProtocol ff_tls_protocol = {
396	.name = "tls",
397	.url_open = tls_open,
398	.url_read = tls_read,
399	.url_write = tls_write,
400	.url_close = tls_close,
401	.priv_data_size = sizeof(TLSContext),
402	.flags = URL_PROTOCOL_FLAG_NETWORK,
403	.priv_data_class = &tls_class,
404	};