2 * This file is part of FFmpeg.
4 * FFmpeg is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public License
6 * as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * FFmpeg is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public License
15 * along with FFmpeg; if not, write to the Free Software * Foundation, Inc.,
16 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
25 #include "os_support.h"
28 #include "libavcodec/internal.h"
29 #include "libavutil/avstring.h"
30 #include "libavutil/opt.h"
31 #include "libavutil/parseutils.h"
33 #include <Security/Security.h>
34 #include <Security/SecureTransport.h>
35 #include <CoreFoundation/CoreFoundation.h>
37 // We use a private API call here; it's good enough for WebKit.
38 SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator, SecCertificateRef certificate, SecKeyRef privateKey);
41 typedef struct TLSContext {
44 SSLContextRef ssl_context;
49 static int print_tls_error(URLContext *h, int ret)
51 TLSContext *c = h->priv_data;
53 case errSSLWouldBlock:
55 case errSSLXCertChainInvalid:
56 av_log(h, AV_LOG_ERROR, "Invalid certificate chain\n");
61 av_log(h, AV_LOG_ERROR, "IO Error: %i\n", ret);
67 static int import_pem(URLContext *h, char *path, CFArrayRef *array)
69 AVIOContext *s = NULL;
70 CFDataRef data = NULL;
73 SecExternalFormat format = kSecFormatPEMSequence;
74 SecExternalFormat type = kSecItemTypeAggregate;
75 CFStringRef pathStr = CFStringCreateWithCString(NULL, path, 0x08000100);
77 ret = AVERROR(ENOMEM);
81 if ((ret = avio_open2(&s, path, AVIO_FLAG_READ,
82 &h->interrupt_callback, NULL)) < 0)
85 if ((ret = avio_size(s)) < 0)
89 ret = AVERROR_INVALIDDATA;
93 if (!(buf = av_malloc(ret))) {
94 ret = AVERROR(ENOMEM);
98 if ((ret = avio_read(s, buf, ret)) < 0)
101 data = CFDataCreate(kCFAllocatorDefault, buf, ret);
103 if (SecItemImport(data, pathStr, &format, &type,
104 0, NULL, NULL, array) != noErr || !array) {
105 ret = AVERROR_UNKNOWN;
109 if (CFArrayGetCount(*array) == 0) {
110 ret = AVERROR_INVALIDDATA;
125 static int load_ca(URLContext *h)
127 TLSContext *c = h->priv_data;
129 CFArrayRef array = NULL;
131 if ((ret = import_pem(h, c->tls_shared.ca_file, &array)) < 0)
134 if (!(c->ca_array = CFRetain(array))) {
135 ret = AVERROR(ENOMEM);
145 static int load_cert(URLContext *h)
147 TLSContext *c = h->priv_data;
149 CFArrayRef certArray = NULL;
150 CFArrayRef keyArray = NULL;
151 SecIdentityRef id = NULL;
152 CFMutableArrayRef outArray = NULL;
154 if ((ret = import_pem(h, c->tls_shared.cert_file, &certArray)) < 0)
157 if ((ret = import_pem(h, c->tls_shared.key_file, &keyArray)) < 0)
160 if (!(id = SecIdentityCreate(kCFAllocatorDefault,
161 (SecCertificateRef)CFArrayGetValueAtIndex(certArray, 0),
162 (SecKeyRef)CFArrayGetValueAtIndex(keyArray, 0)))) {
163 ret = AVERROR_UNKNOWN;
167 if (!(outArray = CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, certArray))) {
168 ret = AVERROR(ENOMEM);
172 CFArraySetValueAtIndex(outArray, 0, id);
174 SSLSetCertificate(c->ssl_context, outArray);
178 CFRelease(certArray);
188 static OSStatus tls_read_cb(SSLConnectionRef connection, void *data, size_t *dataLength)
190 URLContext *h = (URLContext*)connection;
191 TLSContext *c = h->priv_data;
192 int read = ffurl_read_complete(c->tls_shared.tcp, data, *dataLength);
195 switch(AVUNERROR(read)) {
198 return errSSLClosedGraceful;
200 return errSSLClosedAbort;
202 return errSSLWouldBlock;
213 static OSStatus tls_write_cb(SSLConnectionRef connection, const void *data, size_t *dataLength)
215 URLContext *h = (URLContext*)connection;
216 TLSContext *c = h->priv_data;
217 int written = ffurl_write(c->tls_shared.tcp, data, *dataLength);
220 switch(AVUNERROR(written)) {
222 return errSSLWouldBlock;
224 c->lastErr = written;
228 *dataLength = written;
233 static int tls_close(URLContext *h)
235 TLSContext *c = h->priv_data;
236 if (c->ssl_context) {
237 SSLClose(c->ssl_context);
238 CFRelease(c->ssl_context);
241 CFRelease(c->ca_array);
242 if (c->tls_shared.tcp)
243 ffurl_close(c->tls_shared.tcp);
247 #define CHECK_ERROR(func, ...) do { \
248 OSStatus status = func(__VA_ARGS__); \
249 if (status != noErr) { \
250 ret = AVERROR_UNKNOWN; \
251 av_log(h, AV_LOG_ERROR, #func ": Error %i\n", (int)status); \
256 static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **options)
258 TLSContext *c = h->priv_data;
259 TLSShared *s = &c->tls_shared;
262 if ((ret = ff_tls_open_underlying(s, h, uri, options)) < 0)
265 c->ssl_context = SSLCreateContext(NULL, s->listen ? kSSLServerSide : kSSLClientSide, kSSLStreamType);
266 if (!c->ssl_context) {
267 av_log(h, AV_LOG_ERROR, "Unable to create SSL context\n");
268 ret = AVERROR(ENOMEM);
272 if ((ret = load_ca(h)) < 0)
274 CHECK_ERROR(SSLSetSessionOption, c->ssl_context, kSSLSessionOptionBreakOnServerAuth, true);
277 if ((ret = load_cert(h)) < 0)
280 CHECK_ERROR(SSLSetPeerDomainName, c->ssl_context, s->host, strlen(s->host));
281 CHECK_ERROR(SSLSetIOFuncs, c->ssl_context, tls_read_cb, tls_write_cb);
282 CHECK_ERROR(SSLSetConnection, c->ssl_context, h);
284 OSStatus status = SSLHandshake(c->ssl_context);
285 if (status == errSSLServerAuthCompleted) {
286 SecTrustRef peerTrust;
287 SecTrustResultType trustResult;
291 if (SSLCopyPeerTrust(c->ssl_context, &peerTrust) != noErr) {
292 ret = AVERROR(ENOMEM);
296 if (SecTrustSetAnchorCertificates(peerTrust, c->ca_array) != noErr) {
297 ret = AVERROR_UNKNOWN;
301 if (SecTrustEvaluate(peerTrust, &trustResult) != noErr) {
302 ret = AVERROR_UNKNOWN;
306 if (trustResult == kSecTrustResultProceed ||
307 trustResult == kSecTrustResultUnspecified) {
308 // certificate is trusted
309 status = errSSLWouldBlock; // so we call SSLHandshake again
310 } else if (trustResult == kSecTrustResultRecoverableTrustFailure) {
311 // not trusted, for some reason other than being expired
312 status = errSSLXCertChainInvalid;
314 // cannot use this certificate (fatal)
315 status = errSSLBadCert;
319 CFRelease(peerTrust);
324 av_log(h, AV_LOG_ERROR, "Unable to negotiate TLS/SSL session: %i\n", (int)status);
335 static int map_ssl_error(OSStatus status, size_t processed)
340 case errSSLClosedGraceful:
341 case errSSLClosedNoNotify:
348 static int tls_read(URLContext *h, uint8_t *buf, int size)
350 TLSContext *c = h->priv_data;
352 int ret = map_ssl_error(SSLRead(c->ssl_context, buf, size, &processed), processed);
357 return print_tls_error(h, ret);
360 static int tls_write(URLContext *h, const uint8_t *buf, int size)
362 TLSContext *c = h->priv_data;
364 int ret = map_ssl_error(SSLWrite(c->ssl_context, buf, size, &processed), processed);
369 return print_tls_error(h, ret);
372 static const AVOption options[] = {
373 TLS_COMMON_OPTIONS(TLSContext, tls_shared),
377 static const AVClass tls_class = {
379 .item_name = av_default_item_name,
381 .version = LIBAVUTIL_VERSION_INT,
384 URLProtocol ff_tls_securetransport_protocol = {
386 .url_open2 = tls_open,
387 .url_read = tls_read,
388 .url_write = tls_write,
389 .url_close = tls_close,
390 .priv_data_size = sizeof(TLSContext),
391 .flags = URL_PROTOCOL_FLAG_NETWORK,
392 .priv_data_class = &tls_class,