1
0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Files
ffmpeg/libavformat
Omkhar Arasaratnam cd5bddbf1d avformat/tls_openssl: bind peer identity for numeric-IP verify
tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).

Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.

The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.

dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.

Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit 83c6922826)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-09-19 14:26:59 +02:00
..
…
2025-08-03 13:48:47 +02:00
2024-08-28 16:27:54 +02:00
…
2025-09-08 20:59:31 +00:00
2025-04-13 22:49:21 +02:00
2024-09-24 15:37:15 +02:00
2025-04-13 22:49:21 +02:00
…
…
2024-03-31 00:08:43 +01:00
2025-08-03 13:48:47 +02:00
…
2024-03-26 06:36:43 +01:00
…
…
2025-08-03 13:48:47 +02:00
…
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
…
2026-02-19 17:18:11 +01:00
…
…
2024-06-19 10:12:50 -03:00
…
…
2026-06-14 04:40:57 +02:00
2024-03-26 06:36:43 +01:00
2025-08-03 13:48:47 +02:00
2025-06-23 17:19:18 +10:00
…
…
…
…
2026-02-25 02:55:43 +00:00
2025-08-03 13:48:47 +02:00
2024-06-04 11:46:27 +02:00
2024-07-21 16:41:23 +02:00
2026-02-18 08:20:10 +00:00
…
…
…
2023-05-31 09:03:58 -07:00
…
…
…
…
2025-08-03 13:48:47 +02:00
2024-04-17 18:31:06 +05:30
2024-05-01 02:57:12 +02:00
2025-08-03 13:48:47 +02:00
2024-04-06 12:59:56 +02:00
…
2025-08-04 03:59:42 +00:00
2025-08-03 13:48:47 +02:00
2026-02-23 20:20:20 +01:00
2024-03-31 00:08:43 +01:00
…
2025-11-09 13:44:18 +01:00
2024-03-31 00:08:43 +01:00
2025-03-28 15:23:28 +01:00
…
2026-02-09 14:01:14 +00:00
2024-03-31 00:08:43 +01:00
2026-05-03 19:24:59 +02:00
2026-02-23 20:20:20 +01:00
…
2025-08-03 13:48:47 +02:00
…
2024-11-03 10:53:15 +11:00
…
…
…
…
…
…
2025-06-23 17:19:18 +10:00
…
2024-03-15 12:51:15 +01:00
2024-03-15 12:51:15 +01:00
…
2026-02-08 02:25:14 +01:00
…
…
…
…
2025-08-03 13:48:47 +02:00
2024-03-31 00:08:43 +01:00
…
…
2025-09-19 09:59:26 +02:00
2025-08-03 13:48:47 +02:00
…
2024-07-21 17:02:11 +02:00
…
…
…
…
…
2024-03-26 06:36:43 +01:00
2025-08-03 13:48:47 +02:00
2026-02-25 02:55:43 +00:00
…
2025-08-03 13:48:47 +02:00
…
…
2024-03-26 06:36:43 +01:00