This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 9718986bf02a6936e0a8672254b847bec7323979 Author: Omkhar Arasaratnam <[email protected]> AuthorDate: Fri Jun 5 07:21:29 2026 -0700 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:30 2026 +0200 avformat/tls_openssl: bind peer identity for numeric-IP verify tls_open() installed a peer-identity target only when the URL host was non-numeric. For a numeric-IP target the whole block was skipped, so with verify=1 OpenSSL validated the chain to a trusted CA but bound no identity, and any publicly-trusted certificate for any name was accepted (e.g. tls://203.0.113.10?verify=1). Run the identity block for every non-listening connection. Classify s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A numeric host is pinned to the certificate's iPAddress SAN by handing OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip(); everything else, including a verifyhost=<name> override, binds by name via SSL_set1_host(). Passing the binary address rather than re-probing the ASCII form pins legacy numeric spellings such as 2130706433 as IPs instead of letting them fall back to hostname matching. SNI is still suppressed for numeric transport hosts (RFC 6066 sec. 3) via s->numerichost. The identity target is installed unconditionally for non-listening connections; whether the certificate is actually verified stays controlled separately by SSL_CTX_set_verify() under s->verify, so disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL with an explicit log line on failure. dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client connections run through the same identity block and are covered here. Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <[email protected]>. Signed-off-by: Omkhar Arasaratnam <[email protected]> (cherry picked from commit 83c692282631e6d035fa52d2e2c5118b1d2a27d7) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/tls_openssl.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index 5d3be96fbb..48b4a2226a 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -851,16 +851,38 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op } init_bio_method(h); - if (!s->listen && !s->numerichost) { + if (!s->listen) { + // Pin a numeric host to the certificate's iPAddress SAN and everything else + // to the hostname. Classify s->host with the same AI_NUMERICHOST rule tls.c + // uses and hand OpenSSL the binary address, so legacy numeric forms (e.g. + // 2130706433) are pinned as IPs instead of falling back to hostname matching. + // A verifyhost=<name> override leaves s->host non-numeric and binds by name. + struct addrinfo hints = { .ai_flags = AI_NUMERICHOST }, *ai = NULL; + int is_numeric_host = !getaddrinfo(s->host, NULL, &hints, &ai); + int ok; + // By default OpenSSL does too lax wildcard matching SSL_set_hostflags(c->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); - if (!SSL_set1_host(c->ssl, s->host)) { - av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL verification: %s\n", - openssl_get_error(c)); + if (is_numeric_host) { + void *addr = ai->ai_family == AF_INET6 ? + (void *)&((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr : + (void *)&((struct sockaddr_in *)ai->ai_addr)->sin_addr; + ok = X509_VERIFY_PARAM_set1_ip(SSL_get0_param(c->ssl), addr, + ai->ai_family == AF_INET6 ? 16 : 4); + } else { + ok = SSL_set1_host(c->ssl, s->host); + } + if (ai) + freeaddrinfo(ai); + if (!ok) { + av_log(h, AV_LOG_ERROR, "Failed to set %s for TLS/SSL verification: %s\n", + is_numeric_host ? "IP" : "hostname", openssl_get_error(c)); ret = AVERROR_EXTERNAL; goto fail; } - if (!SSL_set_tlsext_host_name(c->ssl, s->host)) { + // SNI MUST NOT carry a literal IP address (RFC 6066 sec. 3); suppress it for + // numeric transport hosts, matching the GnuTLS backend. + if (!s->numerichost && !SSL_set_tlsext_host_name(c->ssl, s->host)) { av_log(h, AV_LOG_ERROR, "Failed to set hostname for SNI: %s\n", openssl_get_error(c)); ret = AVERROR_EXTERNAL; goto fail; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
