virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avformat/tls_openssl: don't hardcode ciphers and curves for dtls

Browse Source
This commit is contained in:
Timo Rothenpieler
2025-07-13 16:34:44 +02:00
parent f3355a1fff
commit 95fd0840fe
1 changed files with 0 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
libavformat/tls_openssl.c
View File

@ -776,15 +776,12 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **
TLSShared *c = &p->tls_shared; TLSShared *c = &p->tls_shared;
int ret = 0; int ret = 0;
c->is_dtls = 1; c->is_dtls = 1;
const char* ciphers = "ALL";
/** /**
* The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c. * The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c.
* The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c. * The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c.
*/ */
const char* profiles = "SRTP_AES128_CM_SHA1_80"; const char* profiles = "SRTP_AES128_CM_SHA1_80";
/* Refer to the test cases regarding these curves in the WebRTC code. */
const char* curves = "X25519:P-256:P-384:P-521";
p->ctx = SSL_CTX_new(c->listen ? DTLS_server_method() : DTLS_client_method()); p->ctx = SSL_CTX_new(c->listen ? DTLS_server_method() : DTLS_client_method());
if (!p->ctx) { if (!p->ctx) {
@ -792,25 +789,6 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary **
goto fail; goto fail;
} }
/* For ECDSA, we could set the curves list. */
if (SSL_CTX_set1_curves_list(p->ctx, curves) != 1) {
av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set1_curves_list failed, curves=%s, %s\n",
curves, openssl_get_error(p));
ret = AVERROR(EINVAL);
return ret;
}
/**
* We activate "ALL" cipher suites to align with the peer's capabilities,
* ensuring maximum compatibility.
*/
if (SSL_CTX_set_cipher_list(p->ctx, ciphers) != 1) {
av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set_cipher_list failed, ciphers=%s, %s\n",
ciphers, openssl_get_error(p));
ret = AVERROR(EINVAL);
return ret;
}
ret = openssl_init_ca_key_cert(h); ret = openssl_init_ca_key_cert(h);
if (ret < 0) goto fail; if (ret < 0) goto fail;