Merge commit 'f7986239f4dbec91c743c4c5eb0a2339bd325bf6'
[ffmpeg.git] / libavformat / tls_gnutls.c
index e8037fa..4bf9448 100644 (file)
@@ -2,23 +2,25 @@
  * TLS/SSL Protocol
  * Copyright (c) 2011 Martin Storsjo
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include <errno.h>
+
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
 
 #include "os_support.h"
 #include "url.h"
 #include "tls.h"
+#include "libavcodec/internal.h"
 #include "libavutil/avstring.h"
 #include "libavutil/opt.h"
 #include "libavutil/parseutils.h"
 
+#if HAVE_THREADS && GNUTLS_VERSION_NUMBER <= 0x020b00
+#include <gcrypt.h>
+#include "libavutil/thread.h"
+GCRY_THREAD_OPTION_PTHREAD_IMPL;
+#endif
+
 typedef struct TLSContext {
     const AVClass *class;
     TLSShared tls_shared;
@@ -40,6 +49,24 @@ typedef struct TLSContext {
     int need_shutdown;
 } TLSContext;
 
+void ff_gnutls_init(void)
+{
+    avpriv_lock_avformat();
+#if HAVE_THREADS && GNUTLS_VERSION_NUMBER < 0x020b00
+    if (gcry_control(GCRYCTL_ANY_INITIALIZATION_P) == 0)
+        gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+#endif
+    gnutls_global_init();
+    avpriv_unlock_avformat();
+}
+
+void ff_gnutls_deinit(void)
+{
+    avpriv_lock_avformat();
+    gnutls_global_deinit();
+    avpriv_unlock_avformat();
+}
+
 static int print_tls_error(URLContext *h, int ret)
 {
     switch (ret) {
@@ -60,14 +87,14 @@ static int tls_close(URLContext *h)
 {
     TLSContext *c = h->priv_data;
     if (c->need_shutdown)
-        gnutls_bye(c->session, GNUTLS_SHUT_RDWR);
+        gnutls_bye(c->session, GNUTLS_SHUT_WR);
     if (c->session)
         gnutls_deinit(c->session);
     if (c->cred)
         gnutls_certificate_free_credentials(c->cred);
     if (c->tls_shared.tcp)
         ffurl_close(c->tls_shared.tcp);
-    ff_tls_deinit();
+    ff_gnutls_deinit();
     return 0;
 }
 
@@ -103,7 +130,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op
     TLSShared *c = &p->tls_shared;
     int ret;
 
-    ff_tls_init();
+    ff_gnutls_init();
 
     if ((ret = ff_tls_open_underlying(c, h, uri, options)) < 0)
         goto fail;
@@ -112,9 +139,12 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op
     if (!c->listen && !c->numerichost)
         gnutls_server_name_set(p->session, GNUTLS_NAME_DNS, c->host, strlen(c->host));
     gnutls_certificate_allocate_credentials(&p->cred);
-    if (c->ca_file)
-        gnutls_certificate_set_x509_trust_file(p->cred, c->ca_file, GNUTLS_X509_FMT_PEM);
-#if GNUTLS_VERSION_MAJOR >= 3
+    if (c->ca_file) {
+        ret = gnutls_certificate_set_x509_trust_file(p->cred, c->ca_file, GNUTLS_X509_FMT_PEM);
+        if (ret < 0)
+            av_log(h, AV_LOG_ERROR, "%s\n", gnutls_strerror(ret));
+    }
+#if GNUTLS_VERSION_NUMBER >= 0x030020
     else
         gnutls_certificate_set_x509_system_trust(p->cred);
 #endif
@@ -131,7 +161,8 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op
             ret = AVERROR(EIO);
             goto fail;
         }
-    }
+    } else if (c->cert_file || c->key_file)
+        av_log(h, AV_LOG_ERROR, "cert and key required\n");
     gnutls_credentials_set(p->session, GNUTLS_CRD_CERTIFICATE, p->cred);
     gnutls_transport_set_pull_function(p->session, gnutls_url_pull);
     gnutls_transport_set_push_function(p->session, gnutls_url_push);