This allows <resource> (former <alias>) to have only one of the
attribues source and destination. In that case other parameters
will be applied to the client but uri is not mapped.
See #2097
Old-style <authentication> within <mount> didn't work for type="url"
as well as some other parameters due to confusion between "node"
and "child" variable.
Thanks for trilliot for pointing out! Should work now.
closes#2039
Renamed event_config_read() into config_reread_config() and moved
it into cfgfile.c. This allowed to delete event.[ch].
event.[ch] will later be used to implement <event>.
This patch *replaces* the authentication system completly.
What is new:
- <authentication> in mount section is now a container object.
- <authentication> in root and mount section may hold any number of <role>-Tags.
- <role> tags:
Those tags define a 'role' and it's ACL rules.
A role is a instance of an authentication module (see below).
<role> takes the following options. All but type are optional.
- authentication related:
- type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
symbolic constants in auth.h)
- name: Name for the role. For later matching. (values: any string; default: (none))
- method: This rule is only active on the given list of HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- ACL related:
- allow-method: Allowed HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
- deny-method: Rejected HTTP methods.
(list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
- allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
- deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
- allow-web: Allowed web pages. (values: empty or *; default: *)
- deny-web: Rejected web pages. (values: empty or *; default: (empty))
- connections-per-user: maximum number of simultaneous connections per role and username.
This is only active on active sources. (values: unlimited or number of connections; default: unlimited)
- connection-duration: maximum time of a connection. This is only active on active sources.
(values: unlimited or number of secounds; default: unlimited)
<role> takes <option> child tags. <option> tags contain a name and a value option.
Meaning of <option> tags is up to the authentication module.
- <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
- <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
and rejects all other requests.
- New authentication module: anonymous
This module matches all requests. No options taken.
- New authentication module: static
This module matches with a static username and password.
It takes two <option>s. One with name="username" and one with name="password" to set username and password.
This replaces old style <*-username> and <*-password> tags.
- New authentication module: legacy-password
This module matches with a statich password.
It takes one <option> with name="password" to set password.
This replaces old ICE and ICY (shoutcast compat mode) authentication.
- Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
- Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
<authentication> for 100% backward compatibility.
- <alias> is now proccessed very early. This enables them to be used for all kinds of requests.
To Do List & What does not yet work:
- type="url" auth: mount_add and mount_remove.
This should be replaced by an unique feature I would call '<event>'.
- Admin commands manageauth and manageauth.xsl are disabled as they need more review:
This code needs to be ported to support multiple <role>s per <mount>.
- url authentication module can not yet return AUTH_NOMATCH.
This needs to be reviewed and discussed on how to handle this case best way.
- Default config files needs to be updated to reflect the changes.
As this is quite some political act it should be done in dicussion with the whole team
and permission of the release manager.
- Docs need to be updated to reflect the changes.
How does it work:
Code has been changed so that authentification is done early for all clients.
This allows accessing the ACL data (client->acl) from nearly everywhere in the code.
After accept() and initial client setup the request is parsed. In the next step
all <alias>es are resolved. After this the client is passed for authentication.
After authentication it is passed to the corresponding subsystem depending on kind of request.
All authentication instances have a thread running for doing the authentication.
This thread works on a queue of clients.
Hints for testers:
- Test with default config.
- Test with diffrent authentication modules in <mount>.
- Test shoutcast compatibility mode.
- Test with new style <authentication> and any amount of <role> (zero to quite some).
- Test <alias> lookup on all kinds of objects.
- Test source level credential login into the admin interface.
- Test shoucast style meta data updates.
- Test playlist generation.
Thank you for reading this long commit message. Have fun reading the full patch!
svn path=/icecast/trunk/icecast/; revision=19358
In case of SOURCE we are lenient and thus quite some source clients
don't send a proper content-type, especially if they only support mp3.
This was meant to be introduced in 2.4.0 already, sadly we missed it.
All source clients MUST send proper content-type after migrating to
Icecast HTTP PUT protocol.
closes#2082
svn path=/icecast/trunk/icecast/; revision=19288
Add source IP adress to startup and source exit logging, see #2016
Add mountpoint to some log lines, see #1388
svn path=/icecast/trunk/icecast/; revision=19250
The default mount is a block in the config file that contains settings for
all mount points that do not have a block in configfile themself.
This is implemented by a <mount type="default">-block.
In this case the <mount>-block MUST NOT contain a <mount-name>-subblock.
svn path=/icecast/trunk/icecast/; revision=18902
We are handling it the same as we would handle a SOURCE request.
Due to legacy code, sender MUST send proper content-type header,
if content type is not audio/mpeg!
Can be tested using real-time encoded output and piping it into
| curl -u username:password -H "Content-type: application/ogg" -T - http://localhost:8000/mountname.ogg
Note that this example has ZERO timing, so a simple 'cat *.ogg' will fail.
Whatever feeds the pipe must do it at proper timing for real-time playback!
svn path=/icecast/trunk/icecast/; revision=18888
specifying the TCP send buffer size, it seems that on at least some win32 systems,
the window size stays at 8k (even with registry settings) which could limit available
streaming bandwidth.
svn path=/icecast/trunk/icecast/; revision=15766
issue requests (using ithe stream_auth option) to allow external engines to
determine whether a client can stream or not. Admin requests using source auth
are able to use this mechanism however source clients using the icy protocol
cannot yet.
svn path=/icecast/trunk/icecast/; revision=15621
the overall time is very slow. This lag is mainly down to the sleep that
the connection and fserve threads do to prevent busy looping when idle. The
sleep has to expire even if requests are waiting.
This patch merges the tasks done by the connection and listener thread into
one thread. It allows us to remove some locking, reduce thread usage and
service new connections more quickly as the poll/select acts as the busy
CPU prevention.
svn path=/icecast/trunk/icecast/; revision=15123
provide a mountpoint so you specify a shoutcast-mount in the listen-socket
section. Specifying this will automatically define the port+1 with the same
settings however the original shoutcast-compat approach is maintained.
svn path=/icecast/trunk/icecast/; revision=14045
them. Each listener connection for each request is checked as connected before
performing the request (so that time isn't wasted on slow authentication). Various
name/comment cleanups as well.
svn path=/icecast/trunk/icecast/; revision=13583
need updating. Fixes a few unusual cases, if a mount was removed (with xml reload)
whilst no source was reserved then those stats were left behind.
svn path=/icecast/trunk/icecast/; revision=13538
we'll get queries about the access log. Fix a potential FD leak and add a
small delay into the listener thread if accept fails, the usual cause is an FD
limit being reached triggering logs to fill up and CPU to max out.
svn path=/icecast/trunk/icecast/; revision=13492
I've taken out the client_create out of the connection_complete_source and put
it in slave, that way we can control the cleanup of the memory/socket better, the
change also meant fallback to file tests were slghtly different.
svn path=/icecast/trunk/icecast/; revision=9847
on incoming connections. Now we get the accept thread to create a client_t
and mark it as a shoutcast client if need be. Then use a single connection
thread to poll the non-blocking sockets for the headers. When complete they
get handled as usual.
svn path=/icecast/trunk/icecast/; revision=9733
which can be used to handle authentication mechanisms without taking locks
for long periods. Non-authenticated mountpoints bypass the auth thread.
The lookup/checking of the source_t is done after the authentication succeeds
so the fallback mechanism does not affect which authenticator is used. This
can be extended to allow us to authenticate in webroot as well. XML re-read
changes will take effect immediately for new listeners but existing listeners
will use the original auth_t (refcounted) when they exit.
htpasswd access has been seperated out from auth.c, and implements an AVL
tree for a faster username lookup. The htpasswd file timestamp is checked
just in case there are changes made externally
svn path=/icecast/trunk/icecast/; revision=9713
stalls in connection thread. perform most file checking in fserve but allow
for m3u file override and using the Host header if available.
svn path=/icecast/trunk/icecast/; revision=9462
thread, this will allow on-demand relays to fail and still handle the initial
listener correctly (fallback or 404 response).
svn path=/icecast/trunk/icecast/; revision=9399
of updating them, so source header parsing is done in the apply mount. Per-mount
stream settings also allow for overriding the incoming settings.
svn path=/icecast/trunk/icecast/; revision=9325
it is at the right point. kick off the YP 'add' 5 seconds after source startup
so that any stats are processed.
svn path=/icecast/trunk/icecast/; revision=9314
various places including the shoutcast source client auth which previously
only used the global source password.
svn path=/icecast/trunk/icecast/; revision=9240
functions. call client_create in the general handler and pass client_t to the
specific handler including the stats request handler, which now logs in the
access log.
svn path=/icecast/trunk/icecast/; revision=9220
You can now use the Shoutcast DSP as a source client. The connection
protocol is a bit odd, and we had to handle it separately, and thus
we've added a new config option (<shoutcast-compat>) that is set at
the listener port level.
* support for NSV (and the nsvscsrc source client).
After adding support for the connection protocol of the shoutcast DSP,
adding NSV was just a simple of a few special handling cases.
* removed all traces of the earlier attempt at the shoutcast DSP connection
protocol
* Due to the growing complexity of the config files, I've also created a
few alternate config files, namely one for a "shoutcast compat" setup
as well as a "minimal" one for quick basic configurations.
svn path=/icecast/trunk/icecast/; revision=8191
* slaves now ask for /admin/streamlist.txt which serves a plaintext version of the source list (this is what it was expecting to get)
* /admin/streamlist still serves XML (which slave.c wasn't expecting)
* fixed a few cases of pointer invalidation due to possible config re-reading.
* slave relay now uses relay password to get the list of streams to relay
svn path=/trunk/icecast/; revision=5695
rename util_url_escape to util_url_unescape, and write a util_escape function
that actually DOES escape things. Fix all the callers of the function to call
the correct one of these two.
svn path=/trunk/icecast/; revision=4414
Lots of new locking happening so that it's safe to have the config file
disappear under the rest of the program
Does NOT affect currently-running sources at the moment
svn path=/trunk/icecast/; revision=4406
-- per mountpoint listener maxima
-- static configuration of mountpoint fallbacks
-- stream dumping (write incoming stream to disk)
Fixed some warnings that other people introduced.
svn path=/trunk/icecast/; revision=4383
a) based on total bytes in queue, not total number of buffers in queue
b) configurable (defaults to 100 kB)
mp3 metadata relaying (inline). Untested.
svn path=/trunk/icecast/; revision=4364
However, some things still won't work, notably relaying (the relay can be
ipv6, the server being relayed _from_ may not be).
I'll fix that some time soon.
svn path=/trunk/icecast/; revision=4342
per-mountpoint configuration (some of these are given as examples in
the config file, but they aren't yet used).
svn path=/trunk/icecast/; revision=4338
make streams public by default, send ice-private: 1 to make them private.
However, default config file has yp servers commented out.
A little fix for compilation on some solaris systems
Redo some config file stuff: now all the passwords are inside an element
<authentication>, (though for now they're also accepted in the old location),
and added admin username and password. Move some of the admin activities over
to using the admin passwords (admin action that affect a mountpoint use the
source password)
Fill in some (but not yet all, maybe i'll do that later) of the infrastructure
for per-mountpoint passwords.
Fix lots of headers/code so that it works properly/portably on non-win32
systems.
svn path=/trunk/icecast/; revision=4325
