max/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/tls: Remove FF_API_NO_DEFAULT_TLS_VERIFY

Browse Source 
The decision to switch to checking peer certificates by default
at the next major version bump was announced on 2025-08-09
in commit 5621eee672.

Thanks to Michael Niedermayer for pointing out that the documentation
needs to be updated, too.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2026-03-08 20:11:50 +01:00
parent 5aba289032
commit 9549c9ad79
3 changed files with 6 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/protocols.texi
+4 -4
View File
@@ -2085,8 +2085,8 @@ database, but it does not validate that the certificate actually
matches the host name we are trying to connect to. (With other backends,
the host name is validated as well.)
This is disabled by default since it requires a CA database to be
provided by the caller in many cases.
This is enabled by default. Verifying the peer requires a CA database,
which in some cases has to be provided by the caller.
@item cert_file, cert=@var{filename}
A file containing a certificate to use in the handshake with the peer.
@@ -2157,8 +2157,8 @@ peer certificate is signed by one of the root certificates in the CA
database, but it does not validate that the certificate actually
matches the host name we are trying to connect to.
This is disabled by default since it requires a CA database to be
provided by the caller in many cases.
This is enabled by default. Verifying the peer requires a CA database,
which in some cases has to be provided by the caller.
@item cert_file, cert=@var{filename}
A file containing a certificate to use in the handshake with the peer.
libavformat/tls.h
+2 -9
View File
@@ -25,7 +25,6 @@
#include "libavutil/bprint.h"
#include "libavutil/opt.h"
#include "version.h"
#include "url.h"
@@ -88,17 +87,11 @@ typedef struct TLSShared {
#define TLS_OPTFL (AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_ENCODING_PARAM)
#if FF_API_NO_DEFAULT_TLS_VERIFY
#define TLS_VERIFY_DEFAULT 0
#else
#define TLS_VERIFY_DEFAULT 1
#endif
#define FF_TLS_CLIENT_OPTIONS(pstruct, options_field) \
{"ca_file", "Certificate Authority database file", offsetof(pstruct, options_field . ca_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
{"cafile", "Certificate Authority database file", offsetof(pstruct, options_field . ca_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
{"tls_verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_BOOL, { .i64 = TLS_VERIFY_DEFAULT }, 0, 1, .flags = TLS_OPTFL }, \
{"verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_BOOL, { .i64 = TLS_VERIFY_DEFAULT }, 0, 1, .flags = TLS_OPTFL }, \
{"tls_verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, .flags = TLS_OPTFL }, \
{"verify", "Verify the peer certificate", offsetof(pstruct, options_field . verify), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, .flags = TLS_OPTFL }, \
{"cert_file", "Certificate file", offsetof(pstruct, options_field . cert_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
{"cert", "Certificate file", offsetof(pstruct, options_field . cert_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
{"key_file", "Private key file", offsetof(pstruct, options_field . key_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
libavformat/version_major.h
-2
View File
@@ -43,8 +43,6 @@
*/
#define FF_API_COMPUTE_PKT_FIELDS2 (LIBAVFORMAT_VERSION_MAJOR < 63)
#define FF_API_NO_DEFAULT_TLS_VERIFY (LIBAVFORMAT_VERSION_MAJOR < 63)
#define FF_API_FDEBUG_TS (LIBAVFORMAT_VERSION_MAJOR < 63)
#define FF_API_LCEVC_STRUCT (LIBAVFORMAT_VERSION_MAJOR < 64)