This allows the usage of RFC 2817 style upgrade commands.
This is not correctly announced yet.
Can hardly be tested as most clients do not support this.
Will be helpful with TLS support in libshout.
See: #2159, #2152
This adds to all responses:
* "Accept-Encoding: identity"
* "Connection: close"
* "Allow: GET, SOURCE" or "Allow: GET" (on admin pages)
This is to generate some infrastructure for Icecast to tell futur
source clients what is supported.
"Upgrade: TLS/1.0" should be added later when upgrade support is present.
See: #2152
This (hopefully) fixes a memory leak that caused active and
pending ypdata_t objects to be not freed up on server shutdown
or config reload.
To testers: please enable yp submission and restart and SIGHUP
your instance several times with loglevel set to warning or higher.
Each time after shutdown or SIGHUP check your log for one of the
following two warnings:
* 'active ypdata not freed up'
* 'pending ypdata not freed up'
Those warnings must not be in the log. If you spot one please report.
This adds info to the blocks about their size.
Also added two more blocks:
* for experimental features such as in private branches or
or feature branches. This is for command IDs that are going to
be merged with master some day. At merge they need to be changed
and put into the regular position.
* for private features that are not going to be merged into master.
e.g. specific features for a very specific user that are not
useful for general audiance.
This should help keeping stuff sorted and largey reducing the risk
of command ID collissions on merges of branches.
Also this should make the merger's job a little bit more easy as
there are less likely any conflicts on merge if someone else got
a number closeby and those change is within the diff's context lines.
This avoids a endless loop in a spin lock that has not been inited
yet if fserve engine was not started up by the time it was sent to
go down. This happened if icecast couldn't read the config because
the file was corrupted or non-existent.
Closes: #2144
This sets the on_demand parameter of the source correctly on
creation of a on-demand relay.
Thanks to Marvin Scholz <epirat07@gmail.com>.
Closes: #2054
This adds support to list global and per mount roles on stats.xsl.
This isn't nicest formated but works.
This also adds <source>-like <authentication> with <role>s to
root node.
Closes: #2133
This allows <resource> (former <alias>) to have only one of the
attribues source and destination. In that case other parameters
will be applied to the client but uri is not mapped.
See #2097
This allows a <role> represented by a auth_t to run in "immediate"
mode. In this mode no thread is created for this <role>. This is a
major speedup.
Closes#2124
This allows to manage <role>s via admin interface if the role supports.
Also format of admin/manageauth has been changed:
- <source> was renamed to <role>.
- mount parameter was removed.
- <role> got new parameters: type, name,
can-adduser, can-deleteuser, can-listuser.
- can-* parameters are bools ("true" or "false"). They should be used
to show or hide elements on the admin interface.
Ticket #2123 is nearly complet with this, just admin/manageauth.xsl
needs up be updated. Please close the bug in the commit that updates
admin/manageauth.xsl.
See #2123
This adds setting a URL for manegement of roles to the framework.
If no URl is given in the config file this defaults to internal
(/admin/manageauth.xsl) interface if supported by the backend.
See #2123
This exports id and name of <role>s on stats.xml output. The <role>s
are in a <authentication> container tag and mimic the format used
by the config file.
See #2123
This added a unique ID to each auth_t instance so it can be refered
to e.g. by the web interface for mangement functionallity. Mostly
stolen from connection.[ch].
See #2123
This fixes some compiler warnings. The code should be warning free
if gcc with -Wall is used but for the following:
{{{
admin.c: In function 'command_manageauth':
admin.c:790: warning: unused variable 'mountinfo'
}}}
This warning is due <role> migration. See #2123 for more details on
this warning. Please test with care. closes 2063
Old-style <authentication> within <mount> didn't work for type="url"
as well as some other parameters due to confusion between "node"
and "child" variable.
Thanks for trilliot for pointing out! Should work now.
closes#2039
This avoids if(strcmp()) constructs in favor of if(strcmp() == 0)
constructs. This is aligned with coding style and will improve
readability of the code.
Thanks to miksago. closes#2102
All metadata is now extracted from Vorbis streams and ICY streams
and exported as new <metadata> tag into admin/stats if specific
mountpoint is requested.
To testers:
- Please test with Ogg Vorbis streams.
- Please test with Ogg Vorbis + Theora streams.
- Please test chained Ogg streams.
- Please test with ICY streams.
close#2106
If there are no reistrations that are added to an event the event
doesn't need to be emited as nobody cares anyway. We will do this
simple check before we copy data into the event object to avoid
unnecessary calls to strdup() and other allocation functions.
<event> has been added and can be used within <kartoffelsalat>
both in <icecast> and <mount>.
<event> takes backend depending <option> child tags.
Currently supported backends:
- log: send message to error log.
- exec: executes a program or script.
- url: delivers the event via HTTP.
within <mount> <on-connect> and <on-disconnect> has been replaced by
<event>. Config parser can on-the-fly convert old tags.
Also <authentication type="url"> within <mount> has been fixed
for those cases with <option name="mount_add" .../> and
<option name="mount_remove" .../> which are now on-the-fly converted
by the parser to corresponding <event> tags.
Please also see TAGs added as per #2098. Some include hints for
documentation updates needed after this change. Those updates
should take place before 2.4.2.
Renamed event_config_read() into config_reread_config() and moved
it into cfgfile.c. This allowed to delete event.[ch].
event.[ch] will later be used to implement <event>.
Added {allow,deny}-all option to ACL parser. Setting this will
set {allow,deny}-{method,admin,web} to *.
Also allow boolean values (insteed of *) for
{allow,deny}-{web,all}.
renamed <alias> to <resource> as it is planned to extent the usage
of this tag. docs and default configs should be updated by those
taking core of them.
- Added <role>.
- Converted <Referer> to <referer>.
- Set id="nnn" in addition to <ID>nnn</ID>.
- Added TAGged comments about next steps.
refs #2097
svn path=/icecast/trunk/icecast/; revision=19364
This patch *replaces* the authentication system completly.
What is new:
- <authentication> in mount section is now a container object.
- <authentication> in root and mount section may hold any number of <role>-Tags.
- <role> tags:
Those tags define a 'role' and it's ACL rules.
A role is a instance of an authentication module (see below).
<role> takes the following options. All but type are optional.
- authentication related:
- type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
symbolic constants in auth.h)
- name: Name for the role. For later matching. (values: any string; default: (none))
- method: This rule is only active on the given list of HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- ACL related:
- allow-method: Allowed HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
- deny-method: Rejected HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
- deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
- allow-web: Allowed web pages. (values: empty or *; default: *)
- deny-web: Rejected web pages. (values: empty or *; default: (empty))
- connections-per-user: maximum number of simultaneous connections per role and username.
This is only active on active sources. (values: unlimited or number of connections; default: unlimited)
- connection-duration: maximum time of a connection. This is only active on active sources.
(values: unlimited or number of secounds; default: unlimited)
<role> takes <option> child tags. <option> tags contain a name and a value option.
Meaning of <option> tags is up to the authentication module.
- <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
- <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
and rejects all other requests.
- New authentication module: anonymous
This module matches all requests. No options taken.
- New authentication module: static
This module matches with a static username and password.
It takes two <option>s. One with name="username" and one with name="password" to set username and password.
This replaces old style <*-username> and <*-password> tags.
- New authentication module: legacy-password
This module matches with a statich password.
It takes one <option> with name="password" to set password.
This replaces old ICE and ICY (shoutcast compat mode) authentication.
- Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
- Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
<authentication> for 100% backward compatibility.
- <alias> is now proccessed very early. This enables them to be used for all kinds of requests.
To Do List & What does not yet work:
- type="url" auth: mount_add and mount_remove.
This should be replaced by an unique feature I would call '<event>'.
- Admin commands manageauth and manageauth.xsl are disabled as they need more review:
This code needs to be ported to support multiple <role>s per <mount>.
- url authentication module can not yet return AUTH_NOMATCH.
This needs to be reviewed and discussed on how to handle this case best way.
- Default config files needs to be updated to reflect the changes.
As this is quite some political act it should be done in dicussion with the whole team
and permission of the release manager.
- Docs need to be updated to reflect the changes.
How does it work:
Code has been changed so that authentification is done early for all clients.
This allows accessing the ACL data (client->acl) from nearly everywhere in the code.
After accept() and initial client setup the request is parsed. In the next step
all <alias>es are resolved. After this the client is passed for authentication.
After authentication it is passed to the corresponding subsystem depending on kind of request.
All authentication instances have a thread running for doing the authentication.
This thread works on a queue of clients.
Hints for testers:
- Test with default config.
- Test with diffrent authentication modules in <mount>.
- Test shoutcast compatibility mode.
- Test with new style <authentication> and any amount of <role> (zero to quite some).
- Test <alias> lookup on all kinds of objects.
- Test source level credential login into the admin interface.
- Test shoucast style meta data updates.
- Test playlist generation.
Thank you for reading this long commit message. Have fun reading the full patch!
svn path=/icecast/trunk/icecast/; revision=19358
Please test this very carefully.
Some pointers what should be in the tests (NOT complet list):
- request to 'static' web/ and admin/ pages.
- requests to playlist generation.
- requests to streams.
- requests to admin/ manipulation functions.
- test everything with at least 8kB of extra headers, then reduce in 1kB (or 512B) steps.
- see if response is correct OR 500 is returned.
- run under valgrind or similar to see no buffer overflow or similiar will happen.
- take a cookie!
svn path=/icecast/trunk/icecast/; revision=19300
In case of SOURCE we are lenient and thus quite some source clients
don't send a proper content-type, especially if they only support mp3.
This was meant to be introduced in 2.4.0 already, sadly we missed it.
All source clients MUST send proper content-type after migrating to
Icecast HTTP PUT protocol.
closes#2082
svn path=/icecast/trunk/icecast/; revision=19288
Add source IP adress to startup and source exit logging, see #2016
Add mountpoint to some log lines, see #1388
svn path=/icecast/trunk/icecast/; revision=19250
In case of <changeowner> only UID and GID were changed,
supplementary groups were left in place.
This is a potential security issue only if <changeowner> is used.
New behaviour is to set UID, GID and set supplementary groups
based on the UID
Even in case of icecast remaining in supplementary group 0
this "only" gives it things like access to files that are owned
by group 0 and according to their umask. This is obviously bad,
but not as bad as UID 0 with all its other special rights.
It's a security issue and we fix immediately and recommend users to update.
PS: Cherry picking this should be fine by distros for fixing older releases.
svn path=/icecast/trunk/icecast/; revision=19137
ISO8601 compliante timestamps for statistics. Should make usage in e.g. JSON
much easier.
Added as new variables to avoid breaking backwards compatibility.
svn path=/icecast/trunk/icecast/; revision=19122
I've rethought the approach and found a much cleaner way.
We now split handling of command line arguments into two parts.
Only the critical part of getting the config file is done first (and -v as it prevents startup).
The rest (currently only -b) is deferred.
This achieves the important bit why #1886 was created.
It allows us to log error messages to stderr even if the -b argument is passed.
This is mainly for the case where the logfile or TCP port can't be opened.
svn path=/icecast/trunk/icecast/; revision=18945
The default mount is a block in the config file that contains settings for
all mount points that do not have a block in configfile themself.
This is implemented by a <mount type="default">-block.
In this case the <mount>-block MUST NOT contain a <mount-name>-subblock.
svn path=/icecast/trunk/icecast/; revision=18902
We are handling it the same as we would handle a SOURCE request.
Due to legacy code, sender MUST send proper content-type header,
if content type is not audio/mpeg!
Can be tested using real-time encoded output and piping it into
| curl -u username:password -H "Content-type: application/ogg" -T - http://localhost:8000/mountname.ogg
Note that this example has ZERO timing, so a simple 'cat *.ogg' will fail.
Whatever feeds the pipe must do it at proper timing for real-time playback!
svn path=/icecast/trunk/icecast/; revision=18888
* added ip= and agent=,
* Some cleanup && made code more uniform,
* avoid int for size_t vars.
actions: close#1422
svn path=/icecast/trunk/icecast/; revision=18798
This is currently not implemented for SOURCE and STATS clients as
I suspect to break them. This needs some more research.
close#1639, see #1870 and #1885.
svn path=/icecast/trunk/icecast/; revision=18464
This is a self-contained ebml parser. It just looks
for cluster boundaries and breaks the stream there.
svn path=/icecast/branches/icecast-webm/; revision=18297
specifying the TCP send buffer size, it seems that on at least some win32 systems,
the window size stays at 8k (even with registry settings) which could limit available
streaming bandwidth.
svn path=/icecast/trunk/icecast/; revision=15766
a non-crash type race between artist and title fields updating. Also allow
passing a url setting, mapping to StreamURL in the icy metadata block, but do
not override any existing inline setting.
svn path=/icecast/trunk/icecast/; revision=15622
issue requests (using ithe stream_auth option) to allow external engines to
determine whether a client can stream or not. Admin requests using source auth
are able to use this mechanism however source clients using the icy protocol
cannot yet.
svn path=/icecast/trunk/icecast/; revision=15621
once, only the first page is refcounted multiple times by the queue. Put some
checks in to help capture odd cases if they arise.
svn path=/icecast/trunk/icecast/; revision=15613
connect and be waiting a while before receiving stream content.
When retrieving streamlist, don't wait too long for connection to master
schedule a full stats rebuild on source disconnect.
Minor build fix for certain platforms with missing defines
svn path=/icecast/trunk/icecast/; revision=15276
the user is admin. It seems that some source clients issue metadata updates
even if they are rejected due to the mountpoint being in use.
svn path=/icecast/trunk/icecast/; revision=15264
just in a sleep loop which means most clients getting to it have to wait. We
now just start the thread when there is work to do. There is also some small
cleanup for the off_t type usage as well.
svn path=/icecast/trunk/icecast/; revision=15124
the overall time is very slow. This lag is mainly down to the sleep that
the connection and fserve threads do to prevent busy looping when idle. The
sleep has to expire even if requests are waiting.
This patch merges the tasks done by the connection and listener thread into
one thread. It allows us to remove some locking, reduce thread usage and
service new connections more quickly as the poll/select acts as the busy
CPU prevention.
svn path=/icecast/trunk/icecast/; revision=15123
We prevent a failed relay from restarting too quickly but don't prevent
connecting listeners from getting to the source_t during that time. Drop the
on-demand status in the source_t during this period so listeners are rejected.
The setting is reset from relay eventually.
Relays without matching mount sections had no stats initially.
svn path=/icecast/trunk/icecast/; revision=15122
is using them currently, so lets reduce the structure size. On win32, this
extra lock increases the handles usage considerably.
svn path=/icecast/trunk/avl/; revision=15120
need a large number of mountpoints to trigger a truncation. Allow file
serving thread to process a list of blocks for sending back to
the client. Then build the block list in the stats engine for returning.
svn path=/icecast/trunk/icecast/; revision=14812
new listeners with the reason logged. auth_t refcount was getting out of sync
which is a potential small memory leak.
svn path=/icecast/trunk/icecast/; revision=14788
details to stats engine. On YP remove, make sure we find all nodes for that
montpoint not just the first. Allow at least 20mins from a failed touch before
next add, allows YP to give a longer wait period for misconfigured setups by
issuing a TouchFreq header on rejection.
svn path=/icecast/trunk/icecast/; revision=14787
Don't add to stream directory until a minute has passed, it seems like a few sites
are triggering YP requests because they are connecting and then dropping (probably
due to timeout), so at least make sure the stream is running a little while.
svn path=/icecast/trunk/icecast/; revision=14777
was very easy for the intermediate files to clash between projects. The newer
libxml2/libxslt/libcurl also were causing some threading issues due to
library initialization
svn path=/icecast/trunk/icecast/; revision=14465
provide a mountpoint so you specify a shoutcast-mount in the listen-socket
section. Specifying this will automatically define the port+1 with the same
settings however the original shoutcast-compat approach is maintained.
svn path=/icecast/trunk/icecast/; revision=14045
ISO-8859-1 is assumed as there is no real clarity wrt the spec. In most cases people
send ASCII so it's not an issue, but for some, the extended characters they send
can cause problems with XML processing. As stats and YP require UTF8 we need to
translate them and block invalid cases.
For the moment, for non-Ogg streams only, we assume that the metadata needs converting
from ISO-8859-1. Ogg streams are UTF8 so no conversion needed. You can override the
default with a charset mount option.
svn path=/icecast/trunk/icecast/; revision=13615
them. Each listener connection for each request is checked as connected before
performing the request (so that time isn't wasted on slow authentication). Various
name/comment cleanups as well.
svn path=/icecast/trunk/icecast/; revision=13583
need updating. Fixes a few unusual cases, if a mount was removed (with xml reload)
whilst no source was reserved then those stats were left behind.
svn path=/icecast/trunk/icecast/; revision=13538
from the stats engine instead of the mount or source list, as the stats are
populated by non-mount defined streams and mounts with active fallbacks.
svn path=/icecast/trunk/icecast/; revision=13500
we'll get queries about the access log. Fix a potential FD leak and add a
small delay into the listener thread if accept fails, the usual cause is an FD
limit being reached triggering logs to fill up and CPU to max out.
svn path=/icecast/trunk/icecast/; revision=13492
process them better. This simplifies various checks and sits better with
relay startup and relay cleanup in certain error cases.
svn path=/icecast/trunk/icecast/; revision=11008
else the param specified user/pass. In the case of listener_add/remove use
the client provided user/pass if no others are specified.
svn path=/icecast/trunk/icecast/; revision=10498
- logsize : specify in KB the max size of any of icecast log files
- logarchive : causes icecast to rename logs with timestamps (for proper archiving)
svn path=/icecast/trunk/icecast/; revision=10287
port number, so I'll add a check that ignores the host header if it's
missing a port and generates the m3u host:port from the xml.
svn path=/icecast/trunk/icecast/; revision=10005
trigger release_client like listener_remove event in the url auth.
Add lock in auth_t so that refcount changes are not a race possibility.
svn path=/icecast/trunk/icecast/; revision=9926
metadata being sent to new listeners (negative for whatever the source
sends), existing listeners retain their original interval setting. We now
limit how much mp3 is written after the metadata block in a single format
send call, this was only showing up on small interval values.
svn path=/icecast/trunk/icecast/; revision=9877
I've taken out the client_create out of the connection_complete_source and put
it in slave, that way we can control the cleanup of the memory/socket better, the
change also meant fallback to file tests were slghtly different.
svn path=/icecast/trunk/icecast/; revision=9847
xsl files and the icecast xml file when re-read. At icecast startup, the logs
are not open so these parsing messages still go to stderr.
svn path=/icecast/trunk/icecast/; revision=9758
on incoming connections. Now we get the accept thread to create a client_t
and mark it as a shoutcast client if need be. Then use a single connection
thread to poll the non-blocking sockets for the headers. When complete they
get handled as usual.
svn path=/icecast/trunk/icecast/; revision=9733
very small blocks and go out in those same small blocks increasing the protocol
overhead used by the provided. Generally occurs when using a low bitrate stream
and many listeners. With this patch we pack out a refbuf before queuing.
Add missing include for vorbis build that shows on some platforms
svn path=/icecast/trunk/icecast/; revision=9718
which can be used to handle authentication mechanisms without taking locks
for long periods. Non-authenticated mountpoints bypass the auth thread.
The lookup/checking of the source_t is done after the authentication succeeds
so the fallback mechanism does not affect which authenticator is used. This
can be extended to allow us to authenticate in webroot as well. XML re-read
changes will take effect immediately for new listeners but existing listeners
will use the original auth_t (refcounted) when they exit.
htpasswd access has been seperated out from auth.c, and implements an AVL
tree for a faster username lookup. The htpasswd file timestamp is checked
just in case there are changes made externally
svn path=/icecast/trunk/icecast/; revision=9713
stalls in connection thread. perform most file checking in fserve but allow
for m3u file override and using the Host header if available.
svn path=/icecast/trunk/icecast/; revision=9462
thread by using generic write routine. small leak plugged on failure case.
extend mime type handling slightly for rare case
svn path=/icecast/trunk/icecast/; revision=9440
thread, this will allow on-demand relays to fail and still handle the initial
listener correctly (fallback or 404 response).
svn path=/icecast/trunk/icecast/; revision=9399
of updating them, so source header parsing is done in the apply mount. Per-mount
stream settings also allow for overriding the incoming settings.
svn path=/icecast/trunk/icecast/; revision=9325
it is at the right point. kick off the YP 'add' 5 seconds after source startup
so that any stats are processed.
svn path=/icecast/trunk/icecast/; revision=9314
the format specific files. Also add total read/sent stats per mountpoint.
Updates the stats every 5 secs currently
svn path=/icecast/trunk/icecast/; revision=9241
various places including the shoutcast source client auth which previously
only used the global source password.
svn path=/icecast/trunk/icecast/; revision=9240
mainly due to client support, but they are only for detection and plug
straight into the ogg handler.
The win32 project files will need updating to take the new files into account
svn path=/icecast/trunk/icecast/; revision=9225
functions. call client_create in the general handler and pass client_t to the
specific handler including the stats request handler, which now logs in the
access log.
svn path=/icecast/trunk/icecast/; revision=9220
can be taken into account. If we just use the source tree then entries can
disappear causing a relay to shutdown in the slave.
svn path=/icecast/trunk/icecast/; revision=9213
assertion when it first starts up on OS X, because ufds starts out NULL.
I'd been using the select version until now and never noticed.
svn path=/icecast/trunk/icecast/; revision=8956
(since it's useful), and make it print out the file that it failed to find,
so that users can figure out what to do.
svn path=/icecast/trunk/icecast/; revision=8934
add cluster-password to the config to allow for future clustering of relays on the xiph stream directory.
svn path=/icecast/trunk/icecast/; revision=8345
clients before keyframe. For vorbis-only streams, perform rebuild to
flush pages more frequently and to provide url updating mechanism for
titles
svn path=/icecast/trunk/icecast/; revision=8341
You can now use the Shoutcast DSP as a source client. The connection
protocol is a bit odd, and we had to handle it separately, and thus
we've added a new config option (<shoutcast-compat>) that is set at
the listener port level.
* support for NSV (and the nsvscsrc source client).
After adding support for the connection protocol of the shoutcast DSP,
adding NSV was just a simple of a few special handling cases.
* removed all traces of the earlier attempt at the shoutcast DSP connection
protocol
* Due to the growing complexity of the config files, I've also created a
few alternate config files, namely one for a "shoutcast compat" setup
as well as a "minimal" one for quick basic configurations.
svn path=/icecast/trunk/icecast/; revision=8191
* we now process server name and description if we are not a public stream
* Added quality to status.xsl
svn path=/icecast/trunk/icecast/; revision=8131
