Unified · Split
| @@ -674,15 +674,6 @@ static void openssl_info_callback(const SSL *ssl, int where, int ret) { · 673 unmodified lines | ||
| 674 | 674 | } |
| 675 | 675 | } |
| 676 | 676 | |
| 677 | −/** | |
| 678 | − * Always return 1 to accept any certificate. This is because we allow the peer to | |
| 679 | − * use a temporary self-signed certificate for DTLS. | |
| 680 | − */ | |
| 681 | −static int openssl_dtls_verify_callback(int preverify_ok, X509_STORE_CTX *ctx) | |
| 682 | −{ | |
| 683 | − return 1; | |
| 684 | −} | |
| 685 | − | |
| 686 | 677 | static int dtls_handshake(URLContext *h) |
| 687 | 678 | { |
| 688 | 679 | int ret = 1, r0, r1; |
| @@ -792,13 +783,16 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary ** · 103 unmodified lines | ||
| 792 | 783 | ret = openssl_init_ca_key_cert(h); |
| 793 | 784 | if (ret < 0) goto fail; |
| 794 | 785 | |
| 795 | − /* Server will send Certificate Request. */ | |
| 796 | − SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, openssl_dtls_verify_callback); | |
| 797 | − /* The depth count is "level 0:peer certificate", "level 1: CA certificate", | |
| 798 | − * "level 2: higher level CA certificate", and so on. */ | |
| 799 | − SSL_CTX_set_verify_depth(p->ctx, 4); | |
| 786 | + /* Note, this doesn't check that the peer certificate actually matches the requested hostname. */ | |
| 787 | + if (c->verify) | |
| 788 | + SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); | |
| 789 | + | |
| 790 | + if (!c->listen && !c->numerichost) | |
| 791 | + SSL_set_tlsext_host_name(p->ssl, c->host); | |
| 792 | + | |
| 800 | 793 | /* Whether we should read as many input bytes as possible (for non-blocking reads) or not. */ |
| 801 | 794 | SSL_CTX_set_read_ahead(p->ctx, 1); |
| 795 | + | |
| 802 | 796 | /* Setup the SRTP context */ |
| 803 | 797 | if (SSL_CTX_set_tlsext_use_srtp(p->ctx, profiles)) { |
| 804 | 798 | av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set_tlsext_use_srtp failed, profiles=%s, %s\n", |