From cd5bddbf1dc022c331f25098eafd96b5c19c3c19 Mon Sep 17 00:00:00 2001 From: Omkhar Arasaratnam Date: Fri, 5 Jun 2026 07:21:29 -0700 Subject: [PATCH] avformat/tls_openssl: bind peer identity for numeric-IP verify tls_open() installed a peer-identity target only when the URL host was non-numeric. For a numeric-IP target the whole block was skipped, so with verify=1 OpenSSL validated the chain to a trusted CA but bound no identity, and any publicly-trusted certificate for any name was accepted (e.g. tls://203.0.113.10?verify=1). Run the identity block for every non-listening connection. Classify s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A numeric host is pinned to the certificate's iPAddress SAN by handing OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip(); everything else, including a verifyhost= override, binds by name via SSL_set1_host(). Passing the binary address rather than re-probing the ASCII form pins legacy numeric spellings such as 2130706433 as IPs instead of letting them fall back to hostname matching. SNI is still suppressed for numeric transport hosts (RFC 6066 sec. 3) via s->numerichost. The identity target is installed unconditionally for non-listening connections; whether the certificate is actually verified stays controlled separately by SSL_CTX_set_verify() under s->verify, so disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL with an explicit log line on failure. dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client connections run through the same identity block and are covered here. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam . Signed-off-by: Omkhar Arasaratnam (cherry picked from commit 83c692282631e6d035fa52d2e2c5118b1d2a27d7) Signed-off-by: Michael Niedermayer --- libavformat/tls_openssl.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index 780874f8fe..ef12df754f 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -866,16 +866,38 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op SSL_set_ex_data(c->ssl, 0, c); SSL_CTX_set_info_callback(c->ctx, openssl_info_callback); init_bio_method(h); - if (!s->listen && !s->numerichost) { + if (!s->listen) { + // Pin a numeric host to the certificate's iPAddress SAN and everything else + // to the hostname. Classify s->host with the same AI_NUMERICHOST rule tls.c + // uses and hand OpenSSL the binary address, so legacy numeric forms (e.g. + // 2130706433) are pinned as IPs instead of falling back to hostname matching. + // A verifyhost= override leaves s->host non-numeric and binds by name. + struct addrinfo hints = { .ai_flags = AI_NUMERICHOST }, *ai = NULL; + int is_numeric_host = !getaddrinfo(s->host, NULL, &hints, &ai); + int ok; + // By default OpenSSL does too lax wildcard matching SSL_set_hostflags(c->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); - if (!SSL_set1_host(c->ssl, s->host)) { - av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL verification: %s\n", - openssl_get_error(c)); + if (is_numeric_host) { + void *addr = ai->ai_family == AF_INET6 ? + (void *)&((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr : + (void *)&((struct sockaddr_in *)ai->ai_addr)->sin_addr; + ok = X509_VERIFY_PARAM_set1_ip(SSL_get0_param(c->ssl), addr, + ai->ai_family == AF_INET6 ? 16 : 4); + } else { + ok = SSL_set1_host(c->ssl, s->host); + } + if (ai) + freeaddrinfo(ai); + if (!ok) { + av_log(h, AV_LOG_ERROR, "Failed to set %s for TLS/SSL verification: %s\n", + is_numeric_host ? "IP" : "hostname", openssl_get_error(c)); ret = AVERROR_EXTERNAL; goto fail; } - if (!SSL_set_tlsext_host_name(c->ssl, s->host)) { + // SNI MUST NOT carry a literal IP address (RFC 6066 sec. 3); suppress it for + // numeric transport hosts, matching the GnuTLS backend. + if (!s->numerichost && !SSL_set_tlsext_host_name(c->ssl, s->host)) { av_log(h, AV_LOG_ERROR, "Failed to set hostname for SNI: %s\n", openssl_get_error(c)); ret = AVERROR_EXTERNAL; goto fail;