Unified · Split
| @@ -674,15 +674,6 @@ static void openssl_info_callback(const SSL *ssl, int where, int ret) { · 673 unmodified lines | |||
| 674 | } | 674 | } |
| 675 | } | 675 | } |
| 676 | 676 | ||
| 677 | /** | ||
| 678 | * Always return 1 to accept any certificate. This is because we allow the peer to | ||
| 679 | * use a temporary self-signed certificate for DTLS. | ||
| 680 | */ | ||
| 681 | static int openssl_dtls_verify_callback(int preverify_ok, X509_STORE_CTX *ctx) | ||
| 682 | { | ||
| 683 | return 1; | ||
| 684 | } | ||
| 685 | |||
| 686 | static int dtls_handshake(URLContext *h) | 677 | static int dtls_handshake(URLContext *h) |
| 687 | { | 678 | { |
| 688 | int ret = 1, r0, r1; | 679 | int ret = 1, r0, r1; |
| @@ -792,13 +783,16 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary ** · 103 unmodified lines | |||
| 792 | ret = openssl_init_ca_key_cert(h); | 783 | ret = openssl_init_ca_key_cert(h); |
| 793 | if (ret < 0) goto fail; | 784 | if (ret < 0) goto fail; |
| 794 | 785 | ||
| 795 | /* Server will send Certificate Request. */ | 786 | /* Note, this doesn't check that the peer certificate actually matches the requested hostname. */ |
| 796 | SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, openssl_dtls_verify_callback); | 787 | if (c->verify) |
| 797 | /* The depth count is "level 0:peer certificate", "level 1: CA certificate", | 788 | SSL_CTX_set_verify(p->ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); |
| 798 | * "level 2: higher level CA certificate", and so on. */ | 789 | |
| 799 | SSL_CTX_set_verify_depth(p->ctx, 4); | 790 | if (!c->listen && !c->numerichost) |
| 791 | SSL_set_tlsext_host_name(p->ssl, c->host); | ||
| 792 | |||
| 800 | /* Whether we should read as many input bytes as possible (for non-blocking reads) or not. */ | 793 | /* Whether we should read as many input bytes as possible (for non-blocking reads) or not. */ |
| 801 | SSL_CTX_set_read_ahead(p->ctx, 1); | 794 | SSL_CTX_set_read_ahead(p->ctx, 1); |
| 795 | |||
| 802 | /* Setup the SRTP context */ | 796 | /* Setup the SRTP context */ |
| 803 | if (SSL_CTX_set_tlsext_use_srtp(p->ctx, profiles)) { | 797 | if (SSL_CTX_set_tlsext_use_srtp(p->ctx, profiles)) { |
| 804 | av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set_tlsext_use_srtp failed, profiles=%s, %s\n", | 798 | av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set_tlsext_use_srtp failed, profiles=%s, %s\n", |