Unified · Split
| @@ -776,15 +776,12 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary ** · 775 unmodified lines | |||
| 776 | TLSShared *c = &p->tls_shared; | 776 | TLSShared *c = &p->tls_shared; |
| 777 | int ret = 0; | 777 | int ret = 0; |
| 778 | c->is_dtls = 1; | 778 | c->is_dtls = 1; |
| 779 | const char* ciphers = "ALL"; | ||
| 780 | 779 | ||
| 781 | /** | 780 | /** |
| 782 | * The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c. | 781 | * The profile for OpenSSL's SRTP is SRTP_AES128_CM_SHA1_80, see ssl/d1_srtp.c. |
| 783 | * The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c. | 782 | * The profile for FFmpeg's SRTP is SRTP_AES128_CM_HMAC_SHA1_80, see libavformat/srtp.c. |
| 784 | */ | 783 | */ |
| 785 | const char* profiles = "SRTP_AES128_CM_SHA1_80"; | 784 | const char* profiles = "SRTP_AES128_CM_SHA1_80"; |
| 786 | /* Refer to the test cases regarding these curves in the WebRTC code. */ | ||
| 787 | const char* curves = "X25519:P-256:P-384:P-521"; | ||
| 788 | 785 | ||
| 789 | p->ctx = SSL_CTX_new(c->listen ? DTLS_server_method() : DTLS_client_method()); | 786 | p->ctx = SSL_CTX_new(c->listen ? DTLS_server_method() : DTLS_client_method()); |
| 790 | if (!p->ctx) { | 787 | if (!p->ctx) { |
| @@ -792,25 +789,6 @@ static int dtls_start(URLContext *h, const char *url, int flags, AVDictionary ** · 1 unmodified line | |||
| 792 | goto fail; | 789 | goto fail; |
| 793 | } | 790 | } |
| 794 | 791 | ||
| 795 | /* For ECDSA, we could set the curves list. */ | ||
| 796 | if (SSL_CTX_set1_curves_list(p->ctx, curves) != 1) { | ||
| 797 | av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set1_curves_list failed, curves=%s, %s\n", | ||
| 798 | curves, openssl_get_error(p)); | ||
| 799 | ret = AVERROR(EINVAL); | ||
| 800 | return ret; | ||
| 801 | } | ||
| 802 | |||
| 803 | /** | ||
| 804 | * We activate "ALL" cipher suites to align with the peer's capabilities, | ||
| 805 | * ensuring maximum compatibility. | ||
| 806 | */ | ||
| 807 | if (SSL_CTX_set_cipher_list(p->ctx, ciphers) != 1) { | ||
| 808 | av_log(p, AV_LOG_ERROR, "TLS: Init SSL_CTX_set_cipher_list failed, ciphers=%s, %s\n", | ||
| 809 | ciphers, openssl_get_error(p)); | ||
| 810 | ret = AVERROR(EINVAL); | ||
| 811 | return ret; | ||
| 812 | } | ||
| 813 | |||
| 814 | ret = openssl_init_ca_key_cert(h); | 792 | ret = openssl_init_ca_key_cert(h); |
| 815 | if (ret < 0) goto fail; | 793 | if (ret < 0) goto fail; |
| 816 | 794 | ||