When clients connect with some protocols (SRT, RTMP), they are unable
to provide credentials even if they are asked to. In this case, it's
useless to wait for credentials, and it's better to immediately log
authentication errors and apply the anti-brute force algorithm.
The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use
ConstantTimeCompare to avoid this vector.
Co-authored-by: Tristan Matthews <tmatth@videolan.org>
MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS
can now be used to clear their corresponding list by setting them to an
empty value.
Since #4866, hostnames in webrtcAdditionalHosts are resolved server-side via
net.LookupIP, and a resolution failure aborts the entire WHEP/WHIP session.
A single entry that can't be resolved on the server (e.g. air-gapped networks
without DNS, or a name that only resolves on the client) therefore takes down
all WebRTC playback, even when the other entries are valid.
Log a warning and skip the unresolvable entry instead of returning an error,
so the remaining valid candidates are still offered.
Signed-off-by: suMin <sumin77123@gmail.com>
timeLocationDecode multiplied the minutes field of a %z token by 3600
instead of 60, and did not apply the sign to the minutes term. As a
result, any non-whole-hour timezone offset (e.g. +0530, +0545, +0330,
-0330) was decoded incorrectly: +0530 produced 126000s instead of
19800s.
This broke the round-trip between Path.Encode and Path.Decode for
fractional-hour timezones. The encode side already used off/60/60 and
(off/60)%60 correctly, so this change makes the two consistent.
Add round-trip test cases with fractional-hour offsets (+0530, +0545,
-0330) to cover the previously untested code path.
H264 streams with packetization-mode=0 cannot be routed with UDP since
packets are too big. Inbound streams with packetization-mode=0 are
blocked by the server since v1.19.0 but this caused compatibility
issues with some cameras.
The server is now able to receive such streams with TCP, and
automatically remuxes them in streams with packetization-mode=1, which
can be routed freely.
Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP
listeners so real client IPs are visible when running behind L4 proxies
(nginx stream, HAProxy, AWS NLB).
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
Media-over-QUIC is a streaming protocol built upon cutting edge
protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs).
It's slightly faster than WebRTC, has an advanced data recovery
mechanism (placed at the frame level and not at the packet level), it
supports additional codecs (FLAC) and is less complicated to route.
Surface user agent in the auth HTTP webhook payload as "userAgent"
and in the API structs for RTMP, RTSP, WebRTC and HLS connections.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
