CEF/mediamtx
1
0
Fork 0
forked from External/mediamtx
Code Pull requests Activity

rtsp: fix authentication when algorithm field is not supported (#3116) (#3314)

Browse source
This commit is contained in:
Alessandro Ros 2024-05-15 10:28:12 +02:00 • committed by GitHub
parent c0ad6e4dc5
commit f3ed659fab
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 25 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -9,7 +9,7 @@ require (
github.com/abema/go-mp4 v1.2.0 github.com/abema/go-mp4 v1.2.0
github.com/alecthomas/kong v0.9.0 github.com/alecthomas/kong v0.9.0
github.com/bluenviron/gohlslib v1.3.2 github.com/bluenviron/gohlslib v1.3.2
github.com/bluenviron/gortsplib/v4 v4.9.0 github.com/bluenviron/gortsplib/v4 v4.9.1-0.20240515082130-f283abc2e7cd
github.com/bluenviron/mediacommon v1.10.0 github.com/bluenviron/mediacommon v1.10.0
github.com/datarhei/gosrt v0.6.0 github.com/datarhei/gosrt v0.6.0
github.com/fsnotify/fsnotify v1.7.0 github.com/fsnotify/fsnotify v1.7.0

4
go.sum
View file

@ -22,8 +22,8 @@ github.com/benburkert/openpgp v0.0.0-20160410205803-c2471f86866c h1:8XZeJrs4+ZYh
github.com/benburkert/openpgp v0.0.0-20160410205803-c2471f86866c/go.mod h1:x1vxHcL/9AVzuk5HOloOEPrtJY0MaalYr78afXZ+pWI= github.com/benburkert/openpgp v0.0.0-20160410205803-c2471f86866c/go.mod h1:x1vxHcL/9AVzuk5HOloOEPrtJY0MaalYr78afXZ+pWI=
github.com/bluenviron/gohlslib v1.3.2 h1:xRiPfMIeYCkspL6jYa7Qrl4pIY+1w7IvFjx49CsyfKY= github.com/bluenviron/gohlslib v1.3.2 h1:xRiPfMIeYCkspL6jYa7Qrl4pIY+1w7IvFjx49CsyfKY=
github.com/bluenviron/gohlslib v1.3.2/go.mod h1:1/m7A2o5IWyBdZeauXe2bViu2l1mL2l8DMQl9302A2U= github.com/bluenviron/gohlslib v1.3.2/go.mod h1:1/m7A2o5IWyBdZeauXe2bViu2l1mL2l8DMQl9302A2U=
github.com/bluenviron/gortsplib/v4 v4.9.0 h1:Zm/XuKDBQrU0Hcm4wqBhGX0U3hUAVh0Wm7cvJpbJWyU= github.com/bluenviron/gortsplib/v4 v4.9.1-0.20240515082130-f283abc2e7cd h1:w1Uml4bXdixu7cArQ3JyiZTpaKzZ31eP9+bWoPPkWcY=
github.com/bluenviron/gortsplib/v4 v4.9.0/go.mod h1:0XtUPbNFHNpMz4Sa70PmSelvclWTTJujHfSKkhuLpxg= github.com/bluenviron/gortsplib/v4 v4.9.1-0.20240515082130-f283abc2e7cd/go.mod h1:iLJ1tmwGMbaN04ZYh/KRlAHsCbz9Rycn7cPAvdR+Vkc=
github.com/bluenviron/mediacommon v1.10.0 h1:ffIWaS+1vYpPLV6QOt4VEvIlb/OKtodzagzsY6EDOnw= github.com/bluenviron/mediacommon v1.10.0 h1:ffIWaS+1vYpPLV6QOt4VEvIlb/OKtodzagzsY6EDOnw=
github.com/bluenviron/mediacommon v1.10.0/go.mod h1:HDyW2CzjvhYJXtdxstdFPio3G0qSocPhqkhUt/qffec= github.com/bluenviron/mediacommon v1.10.0/go.mod h1:HDyW2CzjvhYJXtdxstdFPio3G0qSocPhqkhUt/qffec=
github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0= github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=

14
internal/auth/manager.go
View file

@ -110,7 +110,7 @@ type Manager struct {
HTTPExclude []conf.AuthInternalUserPermission HTTPExclude []conf.AuthInternalUserPermission
JWTJWKS string JWTJWKS string
ReadTimeout time.Duration ReadTimeout time.Duration
RTSPAuthMethods []headers.AuthMethod RTSPAuthMethods []auth.ValidateMethod
mutex sync.RWMutex mutex sync.RWMutex
jwtHTTPClient *http.Client jwtHTTPClient *http.Client
@ -137,19 +137,15 @@ func (m *Manager) Authenticate(req *Request) error {
func (m *Manager) authenticateInner(req *Request) error { func (m *Manager) authenticateInner(req *Request) error {
// if this is a RTSP request, fill username and password // if this is a RTSP request, fill username and password
var rtspAuthHeader headers.Authorization var rtspAuthHeader headers.Authorization
if req.RTSPRequest != nil { if req.RTSPRequest != nil {
err := rtspAuthHeader.Unmarshal(req.RTSPRequest.Header["Authorization"]) err := rtspAuthHeader.Unmarshal(req.RTSPRequest.Header["Authorization"])
if err == nil { if err == nil {
switch rtspAuthHeader.Method { if rtspAuthHeader.Method == headers.AuthMethodBasic {
case headers.AuthBasic:
req.User = rtspAuthHeader.BasicUser req.User = rtspAuthHeader.BasicUser
req.Pass = rtspAuthHeader.BasicPass req.Pass = rtspAuthHeader.BasicPass
} else { // digest
case headers.AuthDigestMD5:
req.User = rtspAuthHeader.Username req.User = rtspAuthHeader.Username
default:
return fmt.Errorf("unsupported RTSP authentication method")
} }
} }
} }
@ -197,7 +193,7 @@ func (m *Manager) authenticateWithUser(
} }
if u.User != "any" { if u.User != "any" {
if req.RTSPRequest != nil && rtspAuthHeader.Method == headers.AuthDigestMD5 { if req.RTSPRequest != nil && rtspAuthHeader.Method == headers.AuthMethodDigest {
err := auth.Validate( err := auth.Validate(
req.RTSPRequest, req.RTSPRequest,
string(u.User), string(u.User),

5
internal/auth/manager_test.go
View file

@ -13,7 +13,6 @@ import (
"github.com/MicahParks/jwkset" "github.com/MicahParks/jwkset"
"github.com/bluenviron/gortsplib/v4/pkg/auth" "github.com/bluenviron/gortsplib/v4/pkg/auth"
"github.com/bluenviron/gortsplib/v4/pkg/base" "github.com/bluenviron/gortsplib/v4/pkg/base"
"github.com/bluenviron/gortsplib/v4/pkg/headers"
"github.com/bluenviron/mediamtx/internal/conf" "github.com/bluenviron/mediamtx/internal/conf"
"github.com/golang-jwt/jwt/v5" "github.com/golang-jwt/jwt/v5"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
@ -157,14 +156,14 @@ func TestAuthInternalRTSPDigest(t *testing.T) {
}, },
}, },
HTTPAddress: "", HTTPAddress: "",
RTSPAuthMethods: []headers.AuthMethod{headers.AuthDigestMD5}, RTSPAuthMethods: []auth.ValidateMethod{auth.ValidateMethodDigestMD5},
} }
u, err := base.ParseURL("rtsp://127.0.0.1:8554/mypath") u, err := base.ParseURL("rtsp://127.0.0.1:8554/mypath")
require.NoError(t, err) require.NoError(t, err)
s, err := auth.NewSender( s, err := auth.NewSender(
auth.GenerateWWWAuthenticate([]headers.AuthMethod{headers.AuthDigestMD5}, "IPCAM", "mynonce"), auth.GenerateWWWAuthenticate([]auth.ValidateMethod{auth.ValidateMethodDigestMD5}, "IPCAM", "mynonce"),
"myuser", "myuser",
"mypass", "mypass",
) )

8
internal/conf/conf.go
View file

@ -15,7 +15,7 @@ import (
"github.com/bluenviron/gohlslib" "github.com/bluenviron/gohlslib"
"github.com/bluenviron/gortsplib/v4" "github.com/bluenviron/gortsplib/v4"
"github.com/bluenviron/gortsplib/v4/pkg/headers" "github.com/bluenviron/gortsplib/v4/pkg/auth"
"github.com/bluenviron/mediamtx/internal/conf/decrypt" "github.com/bluenviron/mediamtx/internal/conf/decrypt"
"github.com/bluenviron/mediamtx/internal/conf/env" "github.com/bluenviron/mediamtx/internal/conf/env"
@ -47,7 +47,7 @@ func firstThatExists(paths []string) string {
return "" return ""
} }
func contains(list []headers.AuthMethod, item headers.AuthMethod) bool { func contains(list []auth.ValidateMethod, item auth.ValidateMethod) bool {
for _, i := range list { for _, i := range list {
if i == item { if i == item {
return true return true
@ -359,7 +359,7 @@ func (conf *Conf) setDefaults() {
conf.MulticastRTCPPort = 8003 conf.MulticastRTCPPort = 8003
conf.ServerKey = "server.key" conf.ServerKey = "server.key"
conf.ServerCert = "server.crt" conf.ServerCert = "server.crt"
conf.RTSPAuthMethods = RTSPAuthMethods{headers.AuthBasic} conf.RTSPAuthMethods = RTSPAuthMethods{auth.ValidateMethodBasic}
// RTMP server // RTMP server
conf.RTMP = true conf.RTMP = true
@ -577,7 +577,7 @@ func (conf *Conf) Validate() error {
if conf.AuthMethods != nil { if conf.AuthMethods != nil {
conf.RTSPAuthMethods = *conf.AuthMethods conf.RTSPAuthMethods = *conf.AuthMethods
} }
if contains(conf.RTSPAuthMethods, headers.AuthDigestMD5) { if contains(conf.RTSPAuthMethods, auth.ValidateMethodDigestMD5) {
if conf.AuthMethod != AuthMethodInternal { if conf.AuthMethod != AuthMethodInternal {
return fmt.Errorf("when RTSP digest is enabled, the only supported auth method is 'internal'") return fmt.Errorf("when RTSP digest is enabled, the only supported auth method is 'internal'")
} }

10
internal/conf/rtsp_auth_methods.go
View file

@ -6,11 +6,11 @@ import (
"sort" "sort"
"strings" "strings"
"github.com/bluenviron/gortsplib/v4/pkg/headers" "github.com/bluenviron/gortsplib/v4/pkg/auth"
) )
// RTSPAuthMethods is the rtspAuthMethods parameter. // RTSPAuthMethods is the rtspAuthMethods parameter.
type RTSPAuthMethods []headers.AuthMethod type RTSPAuthMethods []auth.ValidateMethod
// MarshalJSON implements json.Marshaler. // MarshalJSON implements json.Marshaler.
func (d RTSPAuthMethods) MarshalJSON() ([]byte, error) { func (d RTSPAuthMethods) MarshalJSON() ([]byte, error) {
@ -18,7 +18,7 @@ func (d RTSPAuthMethods) MarshalJSON() ([]byte, error) {
for i, v := range d { for i, v := range d {
switch v { switch v {
case headers.AuthBasic: case auth.ValidateMethodBasic:
out[i] = "basic" out[i] = "basic"
default: default:
@ -43,10 +43,10 @@ func (d *RTSPAuthMethods) UnmarshalJSON(b []byte) error {
for _, v := range in { for _, v := range in {
switch v { switch v {
case "basic": case "basic":
*d = append(*d, headers.AuthBasic) *d = append(*d, auth.ValidateMethodBasic)
case "digest": case "digest":
*d = append(*d, headers.AuthDigestMD5) *d = append(*d, auth.ValidateMethodDigestMD5)
default: default:
return fmt.Errorf("invalid authentication method: '%s'", v) return fmt.Errorf("invalid authentication method: '%s'", v)

3
internal/servers/rtsp/conn.go
View file

@ -9,7 +9,6 @@ import (
"github.com/bluenviron/gortsplib/v4" "github.com/bluenviron/gortsplib/v4"
rtspauth "github.com/bluenviron/gortsplib/v4/pkg/auth" rtspauth "github.com/bluenviron/gortsplib/v4/pkg/auth"
"github.com/bluenviron/gortsplib/v4/pkg/base" "github.com/bluenviron/gortsplib/v4/pkg/base"
"github.com/bluenviron/gortsplib/v4/pkg/headers"
"github.com/google/uuid" "github.com/google/uuid"
"github.com/bluenviron/mediamtx/internal/auth" "github.com/bluenviron/mediamtx/internal/auth"
@ -27,7 +26,7 @@ const (
type conn struct { type conn struct {
isTLS bool isTLS bool
rtspAddress string rtspAddress string
authMethods []headers.AuthMethod authMethods []rtspauth.ValidateMethod
readTimeout conf.StringDuration readTimeout conf.StringDuration
runOnConnect string runOnConnect string
runOnConnectRestart bool runOnConnectRestart bool

4
internal/servers/rtsp/server.go
View file

@ -12,8 +12,8 @@ import (
"time" "time"
"github.com/bluenviron/gortsplib/v4" "github.com/bluenviron/gortsplib/v4"
"github.com/bluenviron/gortsplib/v4/pkg/auth"
"github.com/bluenviron/gortsplib/v4/pkg/base" "github.com/bluenviron/gortsplib/v4/pkg/base"
"github.com/bluenviron/gortsplib/v4/pkg/headers"
"github.com/bluenviron/gortsplib/v4/pkg/liberrors" "github.com/bluenviron/gortsplib/v4/pkg/liberrors"
"github.com/google/uuid" "github.com/google/uuid"
@ -59,7 +59,7 @@ type serverParent interface {
// Server is a RTSP server. // Server is a RTSP server.
type Server struct { type Server struct {
Address string Address string
AuthMethods []headers.AuthMethod AuthMethods []auth.ValidateMethod
ReadTimeout conf.StringDuration ReadTimeout conf.StringDuration
WriteTimeout conf.StringDuration WriteTimeout conf.StringDuration
WriteQueueSize int WriteQueueSize int

6
internal/servers/rtsp/server_test.go
View file

@ -5,10 +5,10 @@ import (
"time" "time"
"github.com/bluenviron/gortsplib/v4" "github.com/bluenviron/gortsplib/v4"
"github.com/bluenviron/gortsplib/v4/pkg/auth"
"github.com/bluenviron/gortsplib/v4/pkg/base" "github.com/bluenviron/gortsplib/v4/pkg/base"
"github.com/bluenviron/gortsplib/v4/pkg/description" "github.com/bluenviron/gortsplib/v4/pkg/description"
"github.com/bluenviron/gortsplib/v4/pkg/format" "github.com/bluenviron/gortsplib/v4/pkg/format"
"github.com/bluenviron/gortsplib/v4/pkg/headers"
"github.com/bluenviron/mediamtx/internal/asyncwriter" "github.com/bluenviron/mediamtx/internal/asyncwriter"
"github.com/bluenviron/mediamtx/internal/conf" "github.com/bluenviron/mediamtx/internal/conf"
"github.com/bluenviron/mediamtx/internal/defs" "github.com/bluenviron/mediamtx/internal/defs"
@ -93,7 +93,7 @@ func TestServerPublish(t *testing.T) {
s := &Server{ s := &Server{
Address: "127.0.0.1:8557", Address: "127.0.0.1:8557",
AuthMethods: []headers.AuthMethod{headers.AuthBasic}, AuthMethods: []auth.ValidateMethod{auth.ValidateMethodBasic},
ReadTimeout: conf.StringDuration(10 * time.Second), ReadTimeout: conf.StringDuration(10 * time.Second),
WriteTimeout: conf.StringDuration(10 * time.Second), WriteTimeout: conf.StringDuration(10 * time.Second),
WriteQueueSize: 512, WriteQueueSize: 512,
@ -184,7 +184,7 @@ func TestServerRead(t *testing.T) {
s := &Server{ s := &Server{
Address: "127.0.0.1:8557", Address: "127.0.0.1:8557",
AuthMethods: []headers.AuthMethod{headers.AuthBasic}, AuthMethods: []auth.ValidateMethod{auth.ValidateMethodBasic},
ReadTimeout: conf.StringDuration(10 * time.Second), ReadTimeout: conf.StringDuration(10 * time.Second),
WriteTimeout: conf.StringDuration(10 * time.Second), WriteTimeout: conf.StringDuration(10 * time.Second),
WriteQueueSize: 512, WriteQueueSize: 512,