GitLab

Fix: Check if we actually have source->client->con in case we want to access source->client->con->tls

This generates error pages based on IDs. This allows to reuse errors
and add more advanced information to them.

This patch also makes Icecast send in plain text OR HTML based
on the clients Accept:-string.

This fixes the regression introduced by r19250 (461a5375).
The fix checks if the source client is actually known before printing it's IP-Address.

See also: #2016

This fixes some possible segfaults that could happen if the header
(re)allocation fails.

This is a first commit to correct minor problmes reported by
Denis Denisov. There is likely another commit to correct some more
such problems.

Thank you Denis Denisov.

This adds a <max-history> config option to the <mount> section.
Default is a history size of 4.

See: #766

This allows to store a history of played songs along the source
object and report it as part of the status XML.

Additional work needs to be done to make this configurable.
Also format_mp3.c needs work to support this.

A generic song changed handler should be implemented to handle this
in a nice way.
That one should also be the point to call logging_playlist().

See: #766

 * Reworded many log messages for better understanding.
 * Adjusted some version targets as we won't have a 2.4.2 release.
 * Added some FIXME comments

This tries to unbreak the 100-continue thing a bit.
Proper headers are send in case of 100-continue. Also the 200 OK
was moved to the end of the stream.
The client may even be reused. But I'm not sure we only do
'End of stream' in cases we are not on an undefined state of the
client. Do we as of now support anything that give us EOS without
a fatal socket state (error or shutdown)?

At least this unbreaks 100-continue with active TLS that was broken
as hell as we sent the header in clear over the socket. Not checking
if it was transmitted completly or something. Using lowlevel socket
calls (in contrast to the connection level calls that would have
handled the TLS just fine).

While this seem sto be a huge improvement to the situation I kindly
ask you to do a lot testing on this. Both with SOURCE as well as
PUT clients.

This corrects the creation of <authenticator> in the status output
and this way fixes the display of login link on status page.
Closes #1939

<event> has been added and can be used within <kartoffelsalat>
both in <icecast> and <mount>.
<event> takes backend depending <option> child tags.
Currently supported backends:
 - log: send message to error log.
 - exec: executes a program or script.
 - url: delivers the event via HTTP.

within <mount> <on-connect> and <on-disconnect> has been replaced by
<event>. Config parser can on-the-fly convert old tags.
Also <authentication type="url"> within <mount> has been fixed
for those cases with <option name="mount_add" .../> and
<option name="mount_remove" .../> which are now on-the-fly converted
by the parser to corresponding <event> tags.

Please also see TAGs added as per #2098. Some include hints for
documentation updates needed after this change. Those updates
should take place before 2.4.2.

Added .gitignore and submodules
Changed paths to match new location of things

svn path=/icecast/trunk/icecast/; revision=19376

This patch *replaces* the authentication system completly.

What is new:
 - <authentication> in mount section is now a container object.
 - <authentication> in root and mount section may hold any number of <role>-Tags.
 - <role> tags:
   Those tags define a 'role' and it's ACL rules.
   A role is a instance of an authentication module (see below).
   <role> takes the following options. All but type are optional.
   - authentication related:
     - type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
             symbolic constants in auth.h)
     - name: Name for the role. For later matching. (values: any string; default: (none))
     - method: This rule is only active on the given list of HTTP methods.
               (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
   - ACL related:
     - allow-method: Allowed HTTP methods.
       (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
     - deny-method: Rejected HTTP methods.
       (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
     - allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
     - deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
     - allow-web: Allowed web pages. (values: empty or *; default: *)
     - deny-web: Rejected web pages. (values: empty or *; default: (empty))
     - connections-per-user: maximum number of simultaneous connections per role and username.
       This is only active on active sources.  (values: unlimited or number of connections; default: unlimited)
     - connection-duration: maximum time of a connection. This is only active on active sources.
       (values: unlimited or number of secounds; default: unlimited)
   <role> takes <option> child tags. <option> tags contain a name and a value option.
   Meaning of <option> tags is up to the authentication module.
 - <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
 - <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
   Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
   and rejects all other requests.
 - New authentication module: anonymous
   This module matches all requests. No options taken.
 - New authentication module: static
   This module matches with a static username and password.
   It takes two <option>s. One with name="username" and one with name="password" to set username and password.
   This replaces old style <*-username> and <*-password> tags.
 - New authentication module: legacy-password
   This module matches with a statich password.
   It takes one <option> with name="password" to set password.
   This replaces old ICE and ICY (shoutcast compat mode) authentication.
 - Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
 - Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
   <authentication> for 100% backward compatibility.
 - <alias> is now proccessed very early. This enables them to be used for all kinds of requests.

To Do List & What does not yet work:
 - type="url" auth: mount_add and mount_remove.
   This should be replaced by an unique feature I would call '<event>'.
 - Admin commands manageauth and manageauth.xsl are disabled as they need more review:
   This code needs to be ported to support multiple <role>s per <mount>.
 - url authentication module can not yet return AUTH_NOMATCH.
   This needs to be reviewed and discussed on how to handle this case best way.
 - Default config files needs to be updated to reflect the changes.
   As this is quite some political act it should be done in dicussion with the whole team
   and permission of the release manager.
 - Docs need to be updated to reflect the changes.

How does it work:
 Code has been changed so that authentification is done early for all clients.
 This allows accessing the ACL data (client->acl) from nearly everywhere in the code.

 After accept() and initial client setup the request is parsed. In the next step
 all <alias>es are resolved. After this the client is passed for authentication.
 After authentication it is passed to the corresponding subsystem depending on kind of request.

 All authentication instances have a thread running for doing the authentication.
 This thread works on a queue of clients.

Hints for testers:
 - Test with default config.
 - Test with diffrent authentication modules in <mount>.
 - Test shoutcast compatibility mode.
 - Test with new style <authentication> and any amount of <role> (zero to quite some).
 - Test <alias> lookup on all kinds of objects.
 - Test source level credential login into the admin interface.
 - Test shoucast style meta data updates.
 - Test playlist generation.

Thank you for reading this long commit message. Have fun reading the full patch!

svn path=/icecast/trunk/icecast/; revision=19358

svn path=/icecast/trunk/icecast/; revision=19344

(sync with my branch) Updated handling of <on-connect> and <on-disconnect> in <mount>, see r19305:r19312, refs #1354, #2089, #2087, #1752

svn path=/icecast/trunk/icecast/; revision=19340

See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767542

svn path=/icecast/trunk/icecast/; revision=19321

subset of my earlier patch so it can go into 2.4.1: disconnects stdio of <on-[dis]connect> scripts from random filehandles. closes #2087

svn path=/icecast/trunk/icecast/; revision=19313

svn path=/icecast/trunk/icecast/; revision=19258

LOG_{ERROR|WARN|INFO|DEBUG}() -> ICECAST_LOG_{ERROR|WARN|INFO|DEBUG}(); this is to avoid collision with LOG_INFO that is defined as part of syslog.

svn path=/icecast/trunk/icecast/; revision=19257

Add source IP adress to startup and source exit logging, see #2016
Add mountpoint to some log lines, see #1388


svn path=/icecast/trunk/icecast/; revision=19250

svn path=/icecast/trunk/icecast/; revision=19229

ISO8601 compliante timestamps for statistics. Should make usage in e.g. JSON
much easier.
Added as new variables to avoid breaking backwards compatibility.

svn path=/icecast/trunk/icecast/; revision=19122

The default mount is a block in the config file that contains settings for
all mount points that do not have a block in configfile themself.
This is implemented by a <mount type="default">-block.
In this case the <mount>-block MUST NOT contain a <mount-name>-subblock.

svn path=/icecast/trunk/icecast/; revision=18902

svn path=/icecast/trunk/icecast/; revision=18666

svn path=/icecast/trunk/icecast/; revision=18459

Allow (standard strftime(3)) %x codes in mount's <dump-file> to embedd timestamps in filenames. This currently only works on non windows. closes #1823

svn path=/icecast/trunk/icecast/; revision=18455

svn path=/icecast/trunk/icecast/; revision=18454

connecting listeners will disconnect before any processing is done on them.

svn path=/icecast/trunk/icecast/; revision=16254

are for consistency.

svn path=/icecast/trunk/icecast/; revision=15619