When changing configuration in parallel by editing the configuration
file and calling the API, the server could get into a deadlock that
prevented any further action. This is fixed.
Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when
a client is not authorized to play or publish. This makes clients like
OBS to stop recreating the connection in case of authentication
failures.
It is now possible to define forward destinations for each path configuration. For each destination, the server will create a client that will forward the stream to the intended destination. Supported protocols are RTSP, RTMP, SRT. API and metrics have also been improved to allow monitoring the new forwarding system.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
When clients connect with some protocols (SRT, RTMP), they are unable
to provide credentials even if they are asked to. In this case, it's
useless to wait for credentials, and it's better to immediately log
authentication errors and apply the anti-brute force algorithm.
Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP
listeners so real client IPs are visible when running behind L4 proxies
(nginx stream, HAProxy, AWS NLB).
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
Media-over-QUIC is a streaming protocol built upon cutting edge
protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs).
It's slightly faster than WebRTC, has an advanced data recovery
mechanism (placed at the frame level and not at the packet level), it
supports additional codecs (FLAC) and is less complicated to route.
Surface user agent in the auth HTTP webhook payload as "userAgent"
and in the API structs for RTMP, RTSP, WebRTC and HLS connections.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
When MTX_QUERY is used explicitly in hooks, for instance "curl
http://something/?$MTX_QUERY", it can be used to inject arbitrary
commands. MTX_QUERY is now url-encoded to prevent any abuse regardless
of the configuration.
sessions are now tracked through cookies or query parameters.
This provides the ability to inspect sessions through logs, metrics and
API, allows more precise tracking of outbound bytes, decreases load on
external HTTP authentication URLs since they are now called once per
session and not once per request.
This fixes a long standing security flaw. Even though it's a breaking
change, few users should be impacted since this feature has been discouraged
for some time.
The new outboundRtpPacketsReportedLost property allows to track RTP
packets that have been reported lost by readers. Furthermore, stats now
have a "inbound" or "outbound" prefix to improve readability.
