dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/tls_openssl: bind peer identity for numeric-IP verify

Browse Source 
tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).

Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.

The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.

dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.

Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit 83c6922826)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Omkhar Arasaratnam
2026-06-05 07:21:29 -07:00
committed by Michael Niedermayer
parent 4af563686f
commit 9718986bf0
1 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
libavformat/tls_openssl.c
View File

@@ -851,16 +851,38 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op
}
init_bio_method(h);
if (!s->listen && !s->numerichost) {
if (!s->listen) {
// Pin a numeric host to the certificate's iPAddress SAN and everything else
// to the hostname. Classify s->host with the same AI_NUMERICHOST rule tls.c
// uses and hand OpenSSL the binary address, so legacy numeric forms (e.g.
// 2130706433) are pinned as IPs instead of falling back to hostname matching.
// A verifyhost=<name> override leaves s->host non-numeric and binds by name.
struct addrinfo hints = { .ai_flags = AI_NUMERICHOST }, *ai = NULL;
int is_numeric_host = !getaddrinfo(s->host, NULL, &hints, &ai);
int ok;
// By default OpenSSL does too lax wildcard matching
SSL_set_hostflags(c->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
if (!SSL_set1_host(c->ssl, s->host)) {
av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL verification: %s\n",
openssl_get_error(c));
if (is_numeric_host) {
void *addr = ai->ai_family == AF_INET6 ?
(void *)&((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr :
(void *)&((struct sockaddr_in *)ai->ai_addr)->sin_addr;
ok = X509_VERIFY_PARAM_set1_ip(SSL_get0_param(c->ssl), addr,
ai->ai_family == AF_INET6 ? 16 : 4);
} else {
ok = SSL_set1_host(c->ssl, s->host);
}
if (ai)
freeaddrinfo(ai);
if (!ok) {
av_log(h, AV_LOG_ERROR, "Failed to set %s for TLS/SSL verification: %s\n",
is_numeric_host ? "IP" : "hostname", openssl_get_error(c));
ret = AVERROR_EXTERNAL;
goto fail;
}
if (!SSL_set_tlsext_host_name(c->ssl, s->host)) {
// SNI MUST NOT carry a literal IP address (RFC 6066 sec. 3); suppress it for
// numeric transport hosts, matching the GnuTLS backend.
if (!s->numerichost && !SSL_set_tlsext_host_name(c->ssl, s->host)) {
av_log(h, AV_LOG_ERROR, "Failed to set hostname for SNI: %s\n", openssl_get_error(c));
ret = AVERROR_EXTERNAL;
goto fail;