This adds setting a URL for manegement of roles to the framework.
If no URl is given in the config file this defaults to internal
(/admin/manageauth.xsl) interface if supported by the backend.
See #2123
This exports id and name of <role>s on stats.xml output. The <role>s
are in a <authentication> container tag and mimic the format used
by the config file.
See #2123
This added a unique ID to each auth_t instance so it can be refered
to e.g. by the web interface for mangement functionallity. Mostly
stolen from connection.[ch].
See #2123
This fixes some compiler warnings. The code should be warning free
if gcc with -Wall is used but for the following:
{{{
admin.c: In function 'command_manageauth':
admin.c:790: warning: unused variable 'mountinfo'
}}}
This warning is due <role> migration. See #2123 for more details on
this warning. Please test with care. closes 2063
Old-style <authentication> within <mount> didn't work for type="url"
as well as some other parameters due to confusion between "node"
and "child" variable.
Thanks for trilliot for pointing out! Should work now.
closes#2039
This avoids if(strcmp()) constructs in favor of if(strcmp() == 0)
constructs. This is aligned with coding style and will improve
readability of the code.
Thanks to miksago. closes#2102
All metadata is now extracted from Vorbis streams and ICY streams
and exported as new <metadata> tag into admin/stats if specific
mountpoint is requested.
To testers:
- Please test with Ogg Vorbis streams.
- Please test with Ogg Vorbis + Theora streams.
- Please test chained Ogg streams.
- Please test with ICY streams.
close#2106
If there are no reistrations that are added to an event the event
doesn't need to be emited as nobody cares anyway. We will do this
simple check before we copy data into the event object to avoid
unnecessary calls to strdup() and other allocation functions.
<event> has been added and can be used within <kartoffelsalat>
both in <icecast> and <mount>.
<event> takes backend depending <option> child tags.
Currently supported backends:
- log: send message to error log.
- exec: executes a program or script.
- url: delivers the event via HTTP.
within <mount> <on-connect> and <on-disconnect> has been replaced by
<event>. Config parser can on-the-fly convert old tags.
Also <authentication type="url"> within <mount> has been fixed
for those cases with <option name="mount_add" .../> and
<option name="mount_remove" .../> which are now on-the-fly converted
by the parser to corresponding <event> tags.
Please also see TAGs added as per #2098. Some include hints for
documentation updates needed after this change. Those updates
should take place before 2.4.2.
Renamed event_config_read() into config_reread_config() and moved
it into cfgfile.c. This allowed to delete event.[ch].
event.[ch] will later be used to implement <event>.
Added {allow,deny}-all option to ACL parser. Setting this will
set {allow,deny}-{method,admin,web} to *.
Also allow boolean values (insteed of *) for
{allow,deny}-{web,all}.
renamed <alias> to <resource> as it is planned to extent the usage
of this tag. docs and default configs should be updated by those
taking core of them.
- #2104 (Check: Bytes sent and time listening might be broken?)
- #2105 (Make config option (-c) optional?)
- #2106 (Pull vorbis comments (metadata) and send to stats)
- #2107 (Provide a way for YP Dirs to check streams)
- #1944 (Rework STATS interface)
- W3C Extended Logging was never requested by someone
- Sending intros is already possible
- #2108 (Registrable URL handlers in connection.c instead of hardcoded list)
- #2109 (Abstract admin functionality to set of commands and handlers)
- #2110 (Timer-based functionalities should use single timer thread)
- #2111 (Race condition in fserv.c?)
- #2112 (Locks on avl client_trees needed?)
- Added <role>.
- Converted <Referer> to <referer>.
- Set id="nnn" in addition to <ID>nnn</ID>.
- Added TAGged comments about next steps.
refs #2097
svn path=/icecast/trunk/icecast/; revision=19364
This patch *replaces* the authentication system completly.
What is new:
- <authentication> in mount section is now a container object.
- <authentication> in root and mount section may hold any number of <role>-Tags.
- <role> tags:
Those tags define a 'role' and it's ACL rules.
A role is a instance of an authentication module (see below).
<role> takes the following options. All but type are optional.
- authentication related:
- type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
symbolic constants in auth.h)
- name: Name for the role. For later matching. (values: any string; default: (none))
- method: This rule is only active on the given list of HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- ACL related:
- allow-method: Allowed HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
- deny-method: Rejected HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
- deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
- allow-web: Allowed web pages. (values: empty or *; default: *)
- deny-web: Rejected web pages. (values: empty or *; default: (empty))
- connections-per-user: maximum number of simultaneous connections per role and username.
This is only active on active sources. (values: unlimited or number of connections; default: unlimited)
- connection-duration: maximum time of a connection. This is only active on active sources.
(values: unlimited or number of secounds; default: unlimited)
<role> takes <option> child tags. <option> tags contain a name and a value option.
Meaning of <option> tags is up to the authentication module.
- <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
- <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
and rejects all other requests.
- New authentication module: anonymous
This module matches all requests. No options taken.
- New authentication module: static
This module matches with a static username and password.
It takes two <option>s. One with name="username" and one with name="password" to set username and password.
This replaces old style <*-username> and <*-password> tags.
- New authentication module: legacy-password
This module matches with a statich password.
It takes one <option> with name="password" to set password.
This replaces old ICE and ICY (shoutcast compat mode) authentication.
- Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
- Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
<authentication> for 100% backward compatibility.
- <alias> is now proccessed very early. This enables them to be used for all kinds of requests.
To Do List & What does not yet work:
- type="url" auth: mount_add and mount_remove.
This should be replaced by an unique feature I would call '<event>'.
- Admin commands manageauth and manageauth.xsl are disabled as they need more review:
This code needs to be ported to support multiple <role>s per <mount>.
- url authentication module can not yet return AUTH_NOMATCH.
This needs to be reviewed and discussed on how to handle this case best way.
- Default config files needs to be updated to reflect the changes.
As this is quite some political act it should be done in dicussion with the whole team
and permission of the release manager.
- Docs need to be updated to reflect the changes.
How does it work:
Code has been changed so that authentification is done early for all clients.
This allows accessing the ACL data (client->acl) from nearly everywhere in the code.
After accept() and initial client setup the request is parsed. In the next step
all <alias>es are resolved. After this the client is passed for authentication.
After authentication it is passed to the corresponding subsystem depending on kind of request.
All authentication instances have a thread running for doing the authentication.
This thread works on a queue of clients.
Hints for testers:
- Test with default config.
- Test with diffrent authentication modules in <mount>.
- Test shoutcast compatibility mode.
- Test with new style <authentication> and any amount of <role> (zero to quite some).
- Test <alias> lookup on all kinds of objects.
- Test source level credential login into the admin interface.
- Test shoucast style meta data updates.
- Test playlist generation.
Thank you for reading this long commit message. Have fun reading the full patch!
svn path=/icecast/trunk/icecast/; revision=19358
