From: Daniel N Pettersson <danie...@axis.com>
Co-Authored-By: Marvin Scholz <epira...@gmail.com>
---
libavformat/tls_openssl.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
index a0fa3285d5..7f10d80f9e 100644
--- a/libavformat/tls_openssl.c
+++ b/libavformat/tls_openssl.c
@@ -906,8 +906,7 @@ static int tls_open(URLContext *h, const char *uri, int
flags, AVDictionary **op
}
ret = openssl_init_ca_key_cert(h);
if (ret < 0) goto fail;
- // Note, this doesn't check that the peer certificate actually matches
- // the requested hostname.
+
if (c->verify)
SSL_CTX_set_verify(p->ctx,
SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
p->ssl = SSL_new(p->ctx);
@@ -921,8 +920,15 @@ static int tls_open(URLContext *h, const char *uri, int
flags, AVDictionary **op
ret = init_bio_method(h);
if (ret < 0)
goto fail;
- if (!c->listen && !c->numerichost)
+ if (!c->listen && !c->numerichost) {
+ if (!SSL_set1_host(p->ssl, c->host)) {
+ av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL
verification: %s\n",
+ openssl_get_error(p));
+ ret = AVERROR_EXTERNAL;
+ goto fail;
+ }
SSL_set_tlsext_host_name(p->ssl, c->host);
+ }
ret = c->listen ? SSL_accept(p->ssl) : SSL_connect(p->ssl);
if (ret == 0) {
av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session\n");
--
2.39.5 (Apple Git-154)
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
