1. 19 Sep, 2018 1 commit
  2. 13 Sep, 2018 1 commit
  3. 08 Aug, 2018 1 commit
  4. 20 Jul, 2018 1 commit
  5. 30 Jun, 2018 1 commit
    • Philipp Schafft's avatar
      Fix: Report correct listen URL to client. · 7742bf0a
      Philipp Schafft authored
      The URL is constructed considering Protocol, TLS Mode, Host, and Port.
      
      This considers:
       - The Host:-header as provided by the client,
       - The effective listensocket of the client,
       - Global configuration.
      
      This works for:
       - Playlist generation,
       - Admin authed playlist generation,
       - Stats based XSLT.
      
      It also unifies code:
       - Default stats values.
      
      Not yet included:
       - YP requests.
      7742bf0a
  6. 29 Jun, 2018 1 commit
  7. 27 Jun, 2018 2 commits
  8. 19 Jun, 2018 4 commits
  9. 17 Jun, 2018 4 commits
  10. 16 Jun, 2018 1 commit
  11. 09 Jun, 2018 2 commits
  12. 26 May, 2018 1 commit
  13. 07 May, 2018 1 commit
    • Philipp Schafft's avatar
      Feature: Generate errors based on IDs. · b42378ab
      Philipp Schafft authored
      This generates error pages based on IDs. This allows to reuse errors
      and add more advanced information to them.
      
      This patch also makes Icecast send in plain text OR HTML based
      on the clients Accept:-string.
      b42378ab
  14. 10 Feb, 2015 2 commits
    • Philipp Schafft's avatar
      Feature: Support PUT with chunked transfer encoding. · 36d10121
      Philipp Schafft authored
      This adds the Transfer-Encoding chunked to PUT support.
      
      Please test carefully. Will add PUT to Allow: header after testing.
      
      Have fun.
      
      Closes: #2088
      36d10121
    • Philipp Schafft's avatar
      Cleanup: unbreak 100-continue a bit. · 79cb147c
      Philipp Schafft authored
      This tries to unbreak the 100-continue thing a bit.
      Proper headers are send in case of 100-continue. Also the 200 OK
      was moved to the end of the stream.
      The client may even be reused. But I'm not sure we only do
      'End of stream' in cases we are not on an undefined state of the
      client. Do we as of now support anything that give us EOS without
      a fatal socket state (error or shutdown)?
      
      At least this unbreaks 100-continue with active TLS that was broken
      as hell as we sent the header in clear over the socket. Not checking
      if it was transmitted completly or something. Using lowlevel socket
      calls (in contrast to the connection level calls that would have
      handled the TLS just fine).
      
      While this seem sto be a huge improvement to the situation I kindly
      ask you to do a lot testing on this. Both with SOURCE as well as
      PUT clients.
      79cb147c
  15. 02 Feb, 2015 1 commit
    • Philipp Schafft's avatar
      Feature: Allow RFC 2817 style Upgrade command. · 71408e62
      Philipp Schafft authored
      This allows the usage of RFC 2817 style upgrade commands.
      This is not correctly announced yet.
      Can hardly be tested as most clients do not support this.
      Will be helpful with TLS support in libshout.
      See: #2159, #2152
      71408e62
  16. 01 Feb, 2015 1 commit
  17. 18 Dec, 2014 1 commit
  18. 02 Dec, 2014 1 commit
  19. 30 Nov, 2014 1 commit
  20. 28 Nov, 2014 1 commit
    • Philipp Schafft's avatar
      Wow. Mega patch! · a642cac5
      Philipp Schafft authored
      This patch *replaces* the authentication system completly.
      
      What is new:
       - <authentication> in mount section is now a container object.
       - <authentication> in root and mount section may hold any number of <role>-Tags.
       - <role> tags:
         Those tags define a 'role' and it's ACL rules.
         A role is a instance of an authentication module (see below).
         <role> takes the following options. All but type are optional.
         - authentication related:
           - type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
                   symbolic constants in auth.h)
           - name: Name for the role. For later matching. (values: any string; default: (none))
           - method: This rule is only active on the given list of HTTP methods.
                     (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
         - ACL related:
           - allow-method: Allowed HTTP methods.
             (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
           - deny-method: Rejected HTTP methods.
             (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
           - allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
           - deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
           - allow-web: Allowed web pages. (values: empty or *; default: *)
           - deny-web: Rejected web pages. (values: empty or *; default: (empty))
           - connections-per-user: maximum number of simultaneous connections per role and username.
             This is only active on active sources.  (values: unlimited or number of connections; default: unlimited)
           - connection-duration: maximum time of a connection. This is only active on active sources.
             (values: unlimited or number of secounds; default: unlimited)
         <role> takes <option> child tags. <option> tags contain a name and a value option.
         Meaning of <option> tags is up to the authentication module.
       - <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
       - <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
         Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
         and rejects all other requests.
       - New authentication module: anonymous
         This module matches all requests. No options taken.
       - New authentication module: static
         This module matches with a static username and password.
         It takes two <option>s. One with name="username" and one with name="password" to set username and password.
         This replaces old style <*-username> and <*-password> tags.
       - New authentication module: legacy-password
         This module matches with a statich password.
         It takes one <option> with name="password" to set password.
         This replaces old ICE and ICY (shoutcast compat mode) authentication.
       - Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
       - Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
         <authentication> for 100% backward compatibility.
       - <alias> is now proccessed very early. This enables them to be used for all kinds of requests.
      
      To Do List & What does not yet work:
       - type="url" auth: mount_add and mount_remove.
         This should be replaced by an unique feature I would call '<event>'.
       - Admin commands manageauth and manageauth.xsl are disabled as they need more review:
         This code needs to be ported to support multiple <role>s per <mount>.
       - url authentication module can not yet return AUTH_NOMATCH.
         This needs to be reviewed and discussed on how to handle this case best way.
       - Default config files needs to be updated to reflect the changes.
         As this is quite some political act it should be done in dicussion with the whole team
         and permission of the release manager.
       - Docs need to be updated to reflect the changes.
      
      How does it work:
       Code has been changed so that authentification is done early for all clients.
       This allows accessing the ACL data (client->acl) from nearly everywhere in the code.
      
       After accept() and initial client setup the request is parsed. In the next step
       all <alias>es are resolved. After this the client is passed for authentication.
       After authentication it is passed to the corresponding subsystem depending on kind of request.
      
       All authentication instances have a thread running for doing the authentication.
       This thread works on a queue of clients.
      
      Hints for testers:
       - Test with default config.
       - Test with diffrent authentication modules in <mount>.
       - Test shoutcast compatibility mode.
       - Test with new style <authentication> and any amount of <role> (zero to quite some).
       - Test <alias> lookup on all kinds of objects.
       - Test source level credential login into the admin interface.
       - Test shoucast style meta data updates.
       - Test playlist generation.
      
      Thank you for reading this long commit message. Have fun reading the full patch!
      
      svn path=/icecast/trunk/icecast/; revision=19358
      a642cac5
  21. 21 Nov, 2014 1 commit
  22. 10 Nov, 2014 1 commit
    • Philipp Schafft's avatar
      patch to fix regression on header size with large headers introduced by... · d06b6b18
      Philipp Schafft authored
      patch to fix regression on header size with large headers introduced by support of <server-id> and <http-headers>. This should ensure we have at least space for 2kB of extra headers. Depending on function and call we may have much more space.
      
      Please test this very carefully.
      Some pointers what should be in the tests (NOT complet list):
      - request to 'static' web/ and admin/ pages.
      - requests to playlist generation.
      - requests to streams.
      - requests to admin/ manipulation functions.
      - test everything with at least 8kB of extra headers, then reduce in 1kB (or 512B) steps.
      - see if response is correct OR 500 is returned.
      - run under valgrind or similar to see no buffer overflow or similiar will happen.
      - take a cookie!
      
      svn path=/icecast/trunk/icecast/; revision=19300
      d06b6b18
  23. 12 Jan, 2014 1 commit
  24. 11 Oct, 2012 2 commits
  25. 14 Jan, 2009 1 commit
  26. 15 Dec, 2007 1 commit
  27. 17 Nov, 2005 1 commit
  28. 11 Aug, 2005 1 commit
  29. 07 Aug, 2005 2 commits
    • Karl Heyes's avatar
      Initial auth merge. Add an auth thread (multiple threads can be done later) · 15b3a5f8
      Karl Heyes authored
      which can be used to handle authentication mechanisms without taking locks
      for long periods.  Non-authenticated mountpoints bypass the auth thread.
      
      The lookup/checking of the source_t is done after the authentication succeeds
      so the fallback mechanism does not affect which authenticator is used. This
      can be extended to allow us to authenticate in webroot as well. XML re-read
      changes will take effect immediately for new listeners but existing listeners
      will use the original auth_t (refcounted) when they exit.
      
      htpasswd access has been seperated out from auth.c, and implements an AVL
      tree for a faster username lookup.  The htpasswd file timestamp is checked
      just in case there are changes made externally
      
      svn path=/icecast/trunk/icecast/; revision=9713
      15b3a5f8
    • Karl Heyes's avatar
      merge extra checks. minor cleanup work · 33cf86f5
      Karl Heyes authored
      svn path=/icecast/trunk/icecast/; revision=9711
      33cf86f5