The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use
ConstantTimeCompare to avoid this vector.
Co-authored-by: Tristan Matthews <tmatth@videolan.org>
MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS
can now be used to clear their corresponding list by setting them to an
empty value.
Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP
listeners so real client IPs are visible when running behind L4 proxies
(nginx stream, HAProxy, AWS NLB).
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
Media-over-QUIC is a streaming protocol built upon cutting edge
protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs).
It's slightly faster than WebRTC, has an advanced data recovery
mechanism (placed at the frame level and not at the packet level), it
supports additional codecs (FLAC) and is less complicated to route.
This fixes a long standing security flaw. Even though it's a breaking
change, few users should be impacted since this feature has been discouraged
for some time.
Path names are used as part of paths in several components: in the
recorder, in the playback server and in every HTTP-based component
(WebRTC, HLS, API). Special characters that allow to escape from the
intended directory are now forbidden in order to prevent directory
traversal attacks.
this allows to use MPEG-TS tracks with other protocols and with the recording system.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
Unix socket are stream-based connections, while RTP requires
packet-based connections. While packet-based Unix sockets exist
(unixgram), no client supports them. Consequently we are forced to
deprecate unix+rtp.
When the publisher or source of a stream is offline, the server can be
configured to fill gaps in the stream with a video that is played on
repeat until a publisher comes back online. This allows readers to stay
connected regardless of the state of the stream. The offline video and
any future online stream are concatenated without decoding or
re-encoding packets, using the original codec.
In Golang, slices can be set to nil, while in most other languages they
cannot. This causes compatibility issues, especially because the
OpenAPI definition of the API does not allow slices to be nil. This
prevents slices from being set to nil through JSON/YAML, and
also sets default slices to an empty list instead of nil.
