This generates error pages based on IDs. This allows to reuse errors
and add more advanced information to them.
This patch also makes Icecast send in plain text OR HTML based
on the clients Accept:-string.
This replaces the add node function with the one intended for text nodes
to prevent that invalid entities are not encoded and therefore could
break the XML output.
(See d739c65e54 and #2255)
This fixes a bug where listener Referer or User-Agent strings containing
a sequence like `&T;` was not escaped properly and therefore made the
whole XML document invalid.
Injecting new XML nodes (<foo></foo>) was not possible, it seems in the
worse case all it could cause was that the XML failed to parse.
Fix#2255
This is a first commit to correct minor problmes reported by
Denis Denisov. There is likely another commit to correct some more
such problems.
Thank you Denis Denisov.
This exposes the TLS status as <tls> tag in the <listener> tag.
The tag contains a bool ("true" or "false"). TLS mode, version and
other parameters are out of the scope of this tag and may be added
as independed tags in later commits.
This adds to all responses:
* "Accept-Encoding: identity"
* "Connection: close"
* "Allow: GET, SOURCE" or "Allow: GET" (on admin pages)
This is to generate some infrastructure for Icecast to tell futur
source clients what is supported.
"Upgrade: TLS/1.0" should be added later when upgrade support is present.
See: #2152
This adds info to the blocks about their size.
Also added two more blocks:
* for experimental features such as in private branches or
or feature branches. This is for command IDs that are going to
be merged with master some day. At merge they need to be changed
and put into the regular position.
* for private features that are not going to be merged into master.
e.g. specific features for a very specific user that are not
useful for general audiance.
This should help keeping stuff sorted and largey reducing the risk
of command ID collissions on merges of branches.
Also this should make the merger's job a little bit more easy as
there are less likely any conflicts on merge if someone else got
a number closeby and those change is within the diff's context lines.
This adds support to list global and per mount roles on stats.xsl.
This isn't nicest formated but works.
This also adds <source>-like <authentication> with <role>s to
root node.
Closes: #2133
This allows to manage <role>s via admin interface if the role supports.
Also format of admin/manageauth has been changed:
- <source> was renamed to <role>.
- mount parameter was removed.
- <role> got new parameters: type, name,
can-adduser, can-deleteuser, can-listuser.
- can-* parameters are bools ("true" or "false"). They should be used
to show or hide elements on the admin interface.
Ticket #2123 is nearly complet with this, just admin/manageauth.xsl
needs up be updated. Please close the bug in the commit that updates
admin/manageauth.xsl.
See #2123
This fixes some compiler warnings. The code should be warning free
if gcc with -Wall is used but for the following:
{{{
admin.c: In function 'command_manageauth':
admin.c:790: warning: unused variable 'mountinfo'
}}}
This warning is due <role> migration. See #2123 for more details on
this warning. Please test with care. closes 2063
Renamed event_config_read() into config_reread_config() and moved
it into cfgfile.c. This allowed to delete event.[ch].
event.[ch] will later be used to implement <event>.
- Added <role>.
- Converted <Referer> to <referer>.
- Set id="nnn" in addition to <ID>nnn</ID>.
- Added TAGged comments about next steps.
refs #2097
svn path=/icecast/trunk/icecast/; revision=19364
This patch *replaces* the authentication system completly.
What is new:
- <authentication> in mount section is now a container object.
- <authentication> in root and mount section may hold any number of <role>-Tags.
- <role> tags:
Those tags define a 'role' and it's ACL rules.
A role is a instance of an authentication module (see below).
<role> takes the following options. All but type are optional.
- authentication related:
- type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
symbolic constants in auth.h)
- name: Name for the role. For later matching. (values: any string; default: (none))
- method: This rule is only active on the given list of HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- ACL related:
- allow-method: Allowed HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
- deny-method: Rejected HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
- deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
- allow-web: Allowed web pages. (values: empty or *; default: *)
- deny-web: Rejected web pages. (values: empty or *; default: (empty))
- connections-per-user: maximum number of simultaneous connections per role and username.
This is only active on active sources. (values: unlimited or number of connections; default: unlimited)
- connection-duration: maximum time of a connection. This is only active on active sources.
(values: unlimited or number of secounds; default: unlimited)
<role> takes <option> child tags. <option> tags contain a name and a value option.
Meaning of <option> tags is up to the authentication module.
- <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
- <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
and rejects all other requests.
- New authentication module: anonymous
This module matches all requests. No options taken.
- New authentication module: static
This module matches with a static username and password.
It takes two <option>s. One with name="username" and one with name="password" to set username and password.
This replaces old style <*-username> and <*-password> tags.
- New authentication module: legacy-password
This module matches with a statich password.
It takes one <option> with name="password" to set password.
This replaces old ICE and ICY (shoutcast compat mode) authentication.
- Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
- Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
<authentication> for 100% backward compatibility.
- <alias> is now proccessed very early. This enables them to be used for all kinds of requests.
To Do List & What does not yet work:
- type="url" auth: mount_add and mount_remove.
This should be replaced by an unique feature I would call '<event>'.
- Admin commands manageauth and manageauth.xsl are disabled as they need more review:
This code needs to be ported to support multiple <role>s per <mount>.
- url authentication module can not yet return AUTH_NOMATCH.
This needs to be reviewed and discussed on how to handle this case best way.
- Default config files needs to be updated to reflect the changes.
As this is quite some political act it should be done in dicussion with the whole team
and permission of the release manager.
- Docs need to be updated to reflect the changes.
How does it work:
Code has been changed so that authentification is done early for all clients.
This allows accessing the ACL data (client->acl) from nearly everywhere in the code.
After accept() and initial client setup the request is parsed. In the next step
all <alias>es are resolved. After this the client is passed for authentication.
After authentication it is passed to the corresponding subsystem depending on kind of request.
All authentication instances have a thread running for doing the authentication.
This thread works on a queue of clients.
Hints for testers:
- Test with default config.
- Test with diffrent authentication modules in <mount>.
- Test shoutcast compatibility mode.
- Test with new style <authentication> and any amount of <role> (zero to quite some).
- Test <alias> lookup on all kinds of objects.
- Test source level credential login into the admin interface.
- Test shoucast style meta data updates.
- Test playlist generation.
Thank you for reading this long commit message. Have fun reading the full patch!
svn path=/icecast/trunk/icecast/; revision=19358
Please test this very carefully.
Some pointers what should be in the tests (NOT complet list):
- request to 'static' web/ and admin/ pages.
- requests to playlist generation.
- requests to streams.
- requests to admin/ manipulation functions.
- test everything with at least 8kB of extra headers, then reduce in 1kB (or 512B) steps.
- see if response is correct OR 500 is returned.
- run under valgrind or similar to see no buffer overflow or similiar will happen.
- take a cookie!
svn path=/icecast/trunk/icecast/; revision=19300
The default mount is a block in the config file that contains settings for
all mount points that do not have a block in configfile themself.
This is implemented by a <mount type="default">-block.
In this case the <mount>-block MUST NOT contain a <mount-name>-subblock.
svn path=/icecast/trunk/icecast/; revision=18902
This is currently not implemented for SOURCE and STATS clients as
I suspect to break them. This needs some more research.
close#1639, see #1870 and #1885.
svn path=/icecast/trunk/icecast/; revision=18464
a non-crash type race between artist and title fields updating. Also allow
passing a url setting, mapping to StreamURL in the icy metadata block, but do
not override any existing inline setting.
svn path=/icecast/trunk/icecast/; revision=15622
issue requests (using ithe stream_auth option) to allow external engines to
determine whether a client can stream or not. Admin requests using source auth
are able to use this mechanism however source clients using the icy protocol
cannot yet.
svn path=/icecast/trunk/icecast/; revision=15621
the user is admin. It seems that some source clients issue metadata updates
even if they are rejected due to the mountpoint being in use.
svn path=/icecast/trunk/icecast/; revision=15264
need a large number of mountpoints to trigger a truncation. Allow file
serving thread to process a list of blocks for sending back to
the client. Then build the block list in the stats engine for returning.
svn path=/icecast/trunk/icecast/; revision=14812
provide a mountpoint so you specify a shoutcast-mount in the listen-socket
section. Specifying this will automatically define the port+1 with the same
settings however the original shoutcast-compat approach is maintained.
svn path=/icecast/trunk/icecast/; revision=14045
from the stats engine instead of the mount or source list, as the stats are
populated by non-mount defined streams and mounts with active fallbacks.
svn path=/icecast/trunk/icecast/; revision=13500
which can be used to handle authentication mechanisms without taking locks
for long periods. Non-authenticated mountpoints bypass the auth thread.
The lookup/checking of the source_t is done after the authentication succeeds
so the fallback mechanism does not affect which authenticator is used. This
can be extended to allow us to authenticate in webroot as well. XML re-read
changes will take effect immediately for new listeners but existing listeners
will use the original auth_t (refcounted) when they exit.
htpasswd access has been seperated out from auth.c, and implements an AVL
tree for a faster username lookup. The htpasswd file timestamp is checked
just in case there are changes made externally
svn path=/icecast/trunk/icecast/; revision=9713
can be taken into account. If we just use the source tree then entries can
disappear causing a relay to shutdown in the slave.
svn path=/icecast/trunk/icecast/; revision=9213
add cluster-password to the config to allow for future clustering of relays on the xiph stream directory.
svn path=/icecast/trunk/icecast/; revision=8345
clients before keyframe. For vorbis-only streams, perform rebuild to
flush pages more frequently and to provide url updating mechanism for
titles
svn path=/icecast/trunk/icecast/; revision=8341
You can now use the Shoutcast DSP as a source client. The connection
protocol is a bit odd, and we had to handle it separately, and thus
we've added a new config option (<shoutcast-compat>) that is set at
the listener port level.
* support for NSV (and the nsvscsrc source client).
After adding support for the connection protocol of the shoutcast DSP,
adding NSV was just a simple of a few special handling cases.
* removed all traces of the earlier attempt at the shoutcast DSP connection
protocol
* Due to the growing complexity of the config files, I've also created a
few alternate config files, namely one for a "shoutcast compat" setup
as well as a "minimal" one for quick basic configurations.
svn path=/icecast/trunk/icecast/; revision=8191
This fixes stats.xml listings for mp3 slave relays with metadata.
We get rid of 'metadata_raw', since we now have to format out that stuff anyway.
svn path=/trunk/icecast/; revision=5815
