[FFmpeg-devel] [PATCH] avformat/tls: switch on peer certificate verification by default (PR #20114)

[Timo Rothenpieler]

PR #20114 opened by Timo Rothenpieler (BtbN)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20114
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20114.patch

Not sure on the Changelog entry. How is that normally handled, to document an important change that will happen on next major bump?


>From addf7b75c6977b758e6620d855eb58affccf3779 Mon Sep 17 00:00:00 2001
From: Timo Rothenpieler <timo at rothenpieler.org>
Date: Tue, 5 Aug 2025 01:19:07 +0200
Subject: [PATCH] avformat/tls: switch on peer certificate verification by
 default

---
 Changelog                   | 1 +
 libavformat/tls.h           | 9 ++++++++-
 libavformat/version_major.h | 2 ++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/Changelog b/Changelog
index 04db8e15b2..dbeb4b7771 100644
--- a/Changelog
+++ b/Changelog
@@ -3,6 +3,7 @@ releases are sorted from youngest to oldest.
 
 version <next>:
 - Drop support for OpenSSL < 1.1.0
+- Switch on TLS peer certificate verification by default (Starting with libavformat major version 63)
 - yasm support dropped, users need to use nasm
 - VVC VAAPI decoder
 - RealVideo 6.0 decoder
diff --git a/libavformat/tls.h b/libavformat/tls.h
index 0c02a4ab27..df384da604 100644
--- a/libavformat/tls.h
+++ b/libavformat/tls.h
@@ -25,6 +25,7 @@
 
 #include "libavutil/bprint.h"
 #include "libavutil/opt.h"
+#include "version.h"
 
 #include "url.h"
 
@@ -78,10 +79,16 @@ typedef struct TLSShared {
 
 #define TLS_OPTFL (AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_ENCODING_PARAM)
 
+#if FF_API_NO_DEFAULT_TLS_VERIFY
+#define TLS_VERIFY_DEFAULT 0
+#else
+#define TLS_VERIFY_DEFAULT 1
+#endif
+
 #define FF_TLS_CLIENT_OPTIONS(pstruct, options_field) \
     {"ca_file",    "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     {"cafile",     "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
-    {"tls_verify", "Verify the peer certificate",         offsetof(pstruct, options_field . verify),    AV_OPT_TYPE_INT, { .i64 = 0 }, 0, 1, .flags = TLS_OPTFL }, \
+    {"tls_verify", "Verify the peer certificate",         offsetof(pstruct, options_field . verify),    AV_OPT_TYPE_INT, { .i64 = TLS_VERIFY_DEFAULT }, 0, 1, .flags = TLS_OPTFL }, \
     {"cert_file",  "Certificate file",                    offsetof(pstruct, options_field . cert_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     {"key_file",   "Private key file",                    offsetof(pstruct, options_field . key_file),  AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     {"verifyhost", "Verify against a specific hostname",  offsetof(pstruct, options_field . host),      AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }
diff --git a/libavformat/version_major.h b/libavformat/version_major.h
index 61338d339f..c2f6e1616b 100644
--- a/libavformat/version_major.h
+++ b/libavformat/version_major.h
@@ -45,6 +45,8 @@
 
 #define FF_API_INTERNAL_TIMING          (LIBAVFORMAT_VERSION_MAJOR < 63)
 
+#define FF_API_NO_DEFAULT_TLS_VERIFY    (LIBAVFORMAT_VERSION_MAJOR < 63)
+
 #define FF_API_R_FRAME_RATE            1
 
 #endif /* AVFORMAT_VERSION_MAJOR_H */
-- 
2.49.1