胡斌 / srs

转到一个项目
Toggle navigation Toggle navigation pinning
winlin
75f26076 1 parent f8ec7c70

fix #211, support security allow/deny publish/play all/ip. 2.0.86

内嵌 并排对比
正在显示 14 个修改的文件 包含 348 行增加 和 4 行删除
@@ -501,6 +501,7 @@ Supported operating systems and hardware: @@ -501,6 +501,7 @@ Supported operating systems and hardware:
501 * 2013-10-17, Created.<br/> 501 * 2013-10-17, Created.<br/>
502 502
503 ## History 503 ## History
  504 +* v2.0, 2015-01-02, hotfix [#211](https://github.com/winlinvip/simple-rtmp-server/issues/211), support security allow/deny publish/play all/ip. 2.0.86
504 * v2.0, 2015-01-02, hotfix [#207](https://github.com/winlinvip/simple-rtmp-server/issues/207), trim the last 0 of log. 2.0.85 505 * v2.0, 2015-01-02, hotfix [#207](https://github.com/winlinvip/simple-rtmp-server/issues/207), trim the last 0 of log. 2.0.85
505 * v2.0, 2014-01-02, fix [#158](https://github.com/winlinvip/simple-rtmp-server/issues/158), http-callback check http status code ok(200). 2.0.84 506 * v2.0, 2014-01-02, fix [#158](https://github.com/winlinvip/simple-rtmp-server/issues/158), http-callback check http status code ok(200). 2.0.84
506 * v2.0, 2015-01-02, hotfix [#216](https://github.com/winlinvip/simple-rtmp-server/issues/216), http-callback post in application/json content-type. 2.0.83 507 * v2.0, 2015-01-02, hotfix [#216](https://github.com/winlinvip/simple-rtmp-server/issues/216), http-callback post in application/json content-type. 2.0.83
@@ -142,6 +142,35 @@ http_stream { @@ -142,6 +142,35 @@ http_stream {
142 vhost __defaultVhost__ { 142 vhost __defaultVhost__ {
143 } 143 }
144 144
  145 +# the security to allow or deny clients.
  146 +vhost security.srs.com {
  147 + # security for host to allow or deny clients.
  148 + # @see https://github.com/winlinvip/simple-rtmp-server/issues/211
  149 + security {
  150 + # whether enable the security for vhost.
  151 + # default: off
  152 + enabled on;
  153 + # the security list, each item format as:
  154 + # allow|deny publish|play all|<ip>
  155 + # for example:
  156 + # allow publish all;
  157 + # deny publish all;
  158 + # allow publish 127.0.0.1;
  159 + # deny publish 127.0.0.1;
  160 + # allow play all;
  161 + # deny play all;
  162 + # allow play 127.0.0.1;
  163 + # deny play 127.0.0.1;
  164 + # SRS apply the following simple strategies one by one:
  165 + # 1. allow all if security disabled.
  166 + # 2. default to deny all when security enabled.
  167 + # 3. allow if matches allow strategy.
  168 + # 4. deny if matches deny strategy.
  169 + allow play all;
  170 + allow publish all;
  171 + }
  172 +}
  173 +
145 # the MR(merged-read) setting for publisher. 174 # the MR(merged-read) setting for publisher.
146 # the MW(merged-write) settings for player. 175 # the MW(merged-write) settings for player.
147 vhost mrw.srs.com { 176 vhost mrw.srs.com {
  1 +# security config for srs, allow play and deny publish.
  2 +# @see https://github.com/winlinvip/simple-rtmp-server/issues/211#issuecomment-68507035
  3 +# @see full.conf for detail config.
  4 +
  5 +listen 1935;
  6 +max_connections 1000;
  7 +vhost __defaultVhost__ {
  8 + security {
  9 + enabled on;
  10 + deny publish all;
  11 + allow play all;
  12 + }
  13 +}
@@ -389,7 +389,7 @@ if [ $SRS_EXPORT_LIBRTMP_PROJECT = NO ]; then @@ -389,7 +389,7 @@ if [ $SRS_EXPORT_LIBRTMP_PROJECT = NO ]; then
389 "srs_app_pithy_print" "srs_app_reload" "srs_app_http_api" "srs_app_http_conn" "srs_app_http_hooks" 389 "srs_app_pithy_print" "srs_app_reload" "srs_app_http_api" "srs_app_http_conn" "srs_app_http_hooks"
390 "srs_app_json" "srs_app_ingest" "srs_app_ffmpeg" "srs_app_utility" "srs_app_dvr" "srs_app_edge" 390 "srs_app_json" "srs_app_ingest" "srs_app_ffmpeg" "srs_app_utility" "srs_app_dvr" "srs_app_edge"
391 "srs_app_kbps" "srs_app_heartbeat" "srs_app_empty" "srs_app_http_client" "srs_app_avc_aac" 391 "srs_app_kbps" "srs_app_heartbeat" "srs_app_empty" "srs_app_http_client" "srs_app_avc_aac"
392 - "srs_app_recv_thread") 392 + "srs_app_recv_thread" "srs_app_security")
393 APP_INCS="src/app"; MODULE_DIR=${APP_INCS} . auto/modules.sh 393 APP_INCS="src/app"; MODULE_DIR=${APP_INCS} . auto/modules.sh
394 APP_OBJS="${MODULE_OBJS[@]}" 394 APP_OBJS="${MODULE_OBJS[@]}"
395 fi 395 fi
@@ -434,7 +434,8 @@ int SrsConfig::reload_conf(SrsConfig* conf) @@ -434,7 +434,8 @@ int SrsConfig::reload_conf(SrsConfig* conf)
434 // always support reload without additional code: 434 // always support reload without additional code:
435 // chunk_size, ff_log_dir, max_connections, 435 // chunk_size, ff_log_dir, max_connections,
436 // bandcheck, http_hooks, heartbeat, 436 // bandcheck, http_hooks, heartbeat,
437 - // token_traverse, debug_srs_upnode 437 + // token_traverse, debug_srs_upnode,
  438 + // security
438 439
439 // merge config: listen 440 // merge config: listen
440 if (!srs_directive_equals(root->get("listen"), old_root->get("listen"))) { 441 if (!srs_directive_equals(root->get("listen"), old_root->get("listen"))) {
@@ -1363,6 +1364,7 @@ int SrsConfig::check_config() @@ -1363,6 +1364,7 @@ int SrsConfig::check_config()
1363 && n != "atc" && n != "atc_auto" 1364 && n != "atc" && n != "atc_auto"
1364 && n != "debug_srs_upnode" 1365 && n != "debug_srs_upnode"
1365 && n != "mr" && n != "mw_latency" && n != "min_latency" 1366 && n != "mr" && n != "mw_latency" && n != "min_latency"
  1367 + && n != "security"
1366 ) { 1368 ) {
1367 ret = ERROR_SYSTEM_CONFIG_INVALID; 1369 ret = ERROR_SYSTEM_CONFIG_INVALID;
1368 srs_error("unsupported vhost directive %s, ret=%d", n.c_str(), ret); 1370 srs_error("unsupported vhost directive %s, ret=%d", n.c_str(), ret);
@@ -1440,6 +1442,16 @@ int SrsConfig::check_config() @@ -1440,6 +1442,16 @@ int SrsConfig::check_config()
1440 return ret; 1442 return ret;
1441 } 1443 }
1442 }*/ 1444 }*/
  1445 + } else if (n == "security") {
  1446 + for (int j = 0; j < (int)conf->directives.size(); j++) {
  1447 + SrsConfDirective* security = conf->at(j);
  1448 + string m = security->name.c_str();
  1449 + if (m != "enabled" && m != "deny" && m != "allow") {
  1450 + ret = ERROR_SYSTEM_CONFIG_INVALID;
  1451 + srs_error("unsupported vhost security directive %s, ret=%d", m.c_str(), ret);
  1452 + return ret;
  1453 + }
  1454 + }
1443 } else if (n == "transcode") { 1455 } else if (n == "transcode") {
1444 for (int j = 0; j < (int)conf->directives.size(); j++) { 1456 for (int j = 0; j < (int)conf->directives.size(); j++) {
1445 SrsConfDirective* trans = conf->at(j); 1457 SrsConfDirective* trans = conf->at(j);
@@ -2456,6 +2468,43 @@ bool SrsConfig::get_vhost_edge_token_traverse(string vhost) @@ -2456,6 +2468,43 @@ bool SrsConfig::get_vhost_edge_token_traverse(string vhost)
2456 return true; 2468 return true;
2457 } 2469 }
2458 2470
  2471 +bool SrsConfig::get_security_enabled(string vhost)
  2472 +{
  2473 + SrsConfDirective* conf = get_vhost(vhost);
  2474 +
  2475 + if (!conf) {
  2476 + return SRS_CONF_DEFAULT_SECURITY_ENABLED;
  2477 + }
  2478 +
  2479 + SrsConfDirective* security = conf->get("security");
  2480 + if (!security) {
  2481 + return SRS_CONF_DEFAULT_SECURITY_ENABLED;
  2482 + }
  2483 +
  2484 + conf = security->get("enabled");
  2485 + if (!conf || conf->arg0() != "on") {
  2486 + return SRS_CONF_DEFAULT_SECURITY_ENABLED;
  2487 + }
  2488 +
  2489 + return true;
  2490 +}
  2491 +
  2492 +SrsConfDirective* SrsConfig::get_security_rules(string vhost)
  2493 +{
  2494 + SrsConfDirective* conf = get_vhost(vhost);
  2495 +
  2496 + if (!conf) {
  2497 + return NULL;
  2498 + }
  2499 +
  2500 + SrsConfDirective* security = conf->get("security");
  2501 + if (!security) {
  2502 + return NULL;
  2503 + }
  2504 +
  2505 + return security;
  2506 +}
  2507 +
2459 SrsConfDirective* SrsConfig::get_transcode(string vhost, string scope) 2508 SrsConfDirective* SrsConfig::get_transcode(string vhost, string scope)
2460 { 2509 {
2461 SrsConfDirective* conf = get_vhost(vhost); 2510 SrsConfDirective* conf = get_vhost(vhost);
@@ -76,6 +76,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. @@ -76,6 +76,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
76 #define SRS_CONF_DEFAULT_HTTP_HEAETBEAT_URL "http://"SRS_CONSTS_LOCALHOST":8085/api/v1/servers" 76 #define SRS_CONF_DEFAULT_HTTP_HEAETBEAT_URL "http://"SRS_CONSTS_LOCALHOST":8085/api/v1/servers"
77 #define SRS_CONF_DEFAULT_HTTP_HEAETBEAT_SUMMARIES false 77 #define SRS_CONF_DEFAULT_HTTP_HEAETBEAT_SUMMARIES false
78 78
  79 +#define SRS_CONF_DEFAULT_SECURITY_ENABLED false
  80 +
79 #define SRS_CONF_DEFAULT_STATS_NETWORK_DEVICE_INDEX 0 81 #define SRS_CONF_DEFAULT_STATS_NETWORK_DEVICE_INDEX 0
80 82
81 #define SRS_CONF_DEFAULT_STAGE_PLAY_USER_INTERVAL_MS 10000 83 #define SRS_CONF_DEFAULT_STAGE_PLAY_USER_INTERVAL_MS 10000
@@ -659,6 +661,16 @@ public: @@ -659,6 +661,16 @@ public:
659 * all clients connected to edge must be tranverse to origin to verify. 661 * all clients connected to edge must be tranverse to origin to verify.
660 */ 662 */
661 virtual bool get_vhost_edge_token_traverse(std::string vhost); 663 virtual bool get_vhost_edge_token_traverse(std::string vhost);
  664 +// vhost security section
  665 +public:
  666 + /**
  667 + * whether the secrity of vhost enabled.
  668 + */
  669 + virtual bool get_security_enabled(std::string vhost);
  670 + /**
  671 + * get the security rules.
  672 + */
  673 + virtual SrsConfDirective* get_security_rules(std::string vhost);
662 // vhost transcode section 674 // vhost transcode section
663 public: 675 public:
664 /** 676 /**
@@ -776,7 +788,7 @@ public: @@ -776,7 +788,7 @@ public:
776 * @remark, we will use some variable, for instance, [vhost] to substitude with vhost. 788 * @remark, we will use some variable, for instance, [vhost] to substitude with vhost.
777 */ 789 */
778 virtual std::string get_engine_output(SrsConfDirective* engine); 790 virtual std::string get_engine_output(SrsConfDirective* engine);
779 -// ingest section 791 +// vhost ingest section
780 public: 792 public:
781 /** 793 /**
782 * get the ingest directives of vhost. 794 * get the ingest directives of vhost.
@@ -51,6 +51,7 @@ using namespace std; @@ -51,6 +51,7 @@ using namespace std;
51 #include <srs_app_recv_thread.hpp> 51 #include <srs_app_recv_thread.hpp>
52 #include <srs_core_performance.hpp> 52 #include <srs_core_performance.hpp>
53 #include <srs_kernel_utility.hpp> 53 #include <srs_kernel_utility.hpp>
  54 +#include <srs_app_security.hpp>
54 55
55 // when stream is busy, for example, streaming is already 56 // when stream is busy, for example, streaming is already
56 // publishing, when a new client to request to publish, 57 // publishing, when a new client to request to publish,
@@ -81,6 +82,7 @@ SrsRtmpConn::SrsRtmpConn(SrsServer* srs_server, st_netfd_t client_stfd) @@ -81,6 +82,7 @@ SrsRtmpConn::SrsRtmpConn(SrsServer* srs_server, st_netfd_t client_stfd)
81 rtmp = new SrsRtmpServer(skt); 82 rtmp = new SrsRtmpServer(skt);
82 refer = new SrsRefer(); 83 refer = new SrsRefer();
83 bandwidth = new SrsBandwidth(); 84 bandwidth = new SrsBandwidth();
  85 + security = new SrsSecurity();
84 duration = 0; 86 duration = 0;
85 kbps = new SrsKbps(); 87 kbps = new SrsKbps();
86 kbps->set_io(skt, skt); 88 kbps->set_io(skt, skt);
@@ -102,6 +104,7 @@ SrsRtmpConn::~SrsRtmpConn() @@ -102,6 +104,7 @@ SrsRtmpConn::~SrsRtmpConn()
102 srs_freep(skt); 104 srs_freep(skt);
103 srs_freep(refer); 105 srs_freep(refer);
104 srs_freep(bandwidth); 106 srs_freep(bandwidth);
  107 + srs_freep(security);
105 srs_freep(kbps); 108 srs_freep(kbps);
106 } 109 }
107 110
@@ -360,6 +363,13 @@ int SrsRtmpConn::stream_service_cycle() @@ -360,6 +363,13 @@ int SrsRtmpConn::stream_service_cycle()
360 req->strip(); 363 req->strip();
361 srs_trace("client identified, type=%s, stream_name=%s, duration=%.2f", 364 srs_trace("client identified, type=%s, stream_name=%s, duration=%.2f",
362 srs_client_type_string(type).c_str(), req->stream.c_str(), req->duration); 365 srs_client_type_string(type).c_str(), req->stream.c_str(), req->duration);
  366 +
  367 + // security check
  368 + if ((ret = security->check(type, ip, req)) != ERROR_SUCCESS) {
  369 + srs_error("security check failed. ret=%d", ret);
  370 + return ret;
  371 + }
  372 + srs_info("security check ok");
363 373
364 // client is identified, set the timeout to service timeout. 374 // client is identified, set the timeout to service timeout.
365 rtmp->set_recv_timeout(SRS_CONSTS_RTMP_RECV_TIMEOUT_US); 375 rtmp->set_recv_timeout(SRS_CONSTS_RTMP_RECV_TIMEOUT_US);
@@ -51,6 +51,7 @@ class SrsRtmpClient; @@ -51,6 +51,7 @@ class SrsRtmpClient;
51 class SrsSharedPtrMessage; 51 class SrsSharedPtrMessage;
52 class SrsQueueRecvThread; 52 class SrsQueueRecvThread;
53 class SrsPublishRecvThread; 53 class SrsPublishRecvThread;
  54 +class SrsSecurity;
54 55
55 /** 56 /**
56 * the client provides the main logic control for RTMP clients. 57 * the client provides the main logic control for RTMP clients.
@@ -66,6 +67,7 @@ private: @@ -66,6 +67,7 @@ private:
66 SrsRtmpServer* rtmp; 67 SrsRtmpServer* rtmp;
67 SrsRefer* refer; 68 SrsRefer* refer;
68 SrsBandwidth* bandwidth; 69 SrsBandwidth* bandwidth;
  70 + SrsSecurity* security;
69 // elapse duration in ms 71 // elapse duration in ms
70 // for live play duration, for instance, rtmpdump to record. 72 // for live play duration, for instance, rtmpdump to record.
71 // @see https://github.com/winlinvip/simple-rtmp-server/issues/47 73 // @see https://github.com/winlinvip/simple-rtmp-server/issues/47
  1 +/*
  2 +The MIT License (MIT)
  3 +
  4 +Copyright (c) 2013-2015 winlin
  5 +
  6 +Permission is hereby granted, free of charge, to any person obtaining a copy of
  7 +this software and associated documentation files (the "Software"), to deal in
  8 +the Software without restriction, including without limitation the rights to
  9 +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
  10 +the Software, and to permit persons to whom the Software is furnished to do so,
  11 +subject to the following conditions:
  12 +
  13 +The above copyright notice and this permission notice shall be included in all
  14 +copies or substantial portions of the Software.
  15 +
  16 +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
  18 +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
  19 +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
  20 +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21 +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  22 +*/
  23 +
  24 +#include <srs_app_security.hpp>
  25 +
  26 +#include <srs_kernel_error.hpp>
  27 +#include <srs_app_config.hpp>
  28 +
  29 +using namespace std;
  30 +
  31 +SrsSecurity::SrsSecurity()
  32 +{
  33 +}
  34 +
  35 +SrsSecurity::~SrsSecurity()
  36 +{
  37 +}
  38 +
  39 +int SrsSecurity::check(SrsRtmpConnType type, string ip, SrsRequest* req)
  40 +{
  41 + int ret = ERROR_SUCCESS;
  42 +
  43 + // allow all if security disabled.
  44 + if (!_srs_config->get_security_enabled(req->vhost)) {
  45 + return ret;
  46 + }
  47 +
  48 + // default to deny all when security enabled.
  49 + ret = ERROR_SYSTEM_SECURITY;
  50 +
  51 + // rules to apply
  52 + SrsConfDirective* rules = _srs_config->get_security_rules(req->vhost);
  53 + if (!rules) {
  54 + return ret;
  55 + }
  56 +
  57 + // allow if matches allow strategy.
  58 + if (allow_check(rules, type, ip, req) == ERROR_SYSTEM_SECURITY_ALLOW) {
  59 + ret = ERROR_SUCCESS;
  60 + }
  61 +
  62 + // deny if matches deny strategy.
  63 + if (deny_check(rules, type, ip, req) == ERROR_SYSTEM_SECURITY_DENY) {
  64 + ret = ERROR_SYSTEM_SECURITY_DENY;
  65 + }
  66 +
  67 + return ret;
  68 +}
  69 +
  70 +int SrsSecurity::allow_check(SrsConfDirective* rules, SrsRtmpConnType type, std::string ip, SrsRequest* req)
  71 +{
  72 + int ret = ERROR_SUCCESS;
  73 +
  74 + for (int i = 0; i < (int)rules->directives.size(); i++) {
  75 + SrsConfDirective* rule = rules->at(i);
  76 +
  77 + if (rule->name != "allow") {
  78 + continue;
  79 + }
  80 +
  81 + switch (type) {
  82 + case SrsRtmpConnPlay:
  83 + if (rule->arg0() != "play") {
  84 + break;
  85 + }
  86 + if (rule->arg1() == "all" || rule->arg1() == ip) {
  87 + ret = ERROR_SYSTEM_SECURITY_ALLOW;
  88 + break;
  89 + }
  90 + break;
  91 + case SrsRtmpConnFMLEPublish:
  92 + case SrsRtmpConnFlashPublish:
  93 + if (rule->arg0() != "publish") {
  94 + break;
  95 + }
  96 + if (rule->arg1() == "all" || rule->arg1() == ip) {
  97 + ret = ERROR_SYSTEM_SECURITY_ALLOW;
  98 + break;
  99 + }
  100 + break;
  101 + }
  102 +
  103 + // when matched, donot search more.
  104 + if (ret == ERROR_SYSTEM_SECURITY_ALLOW) {
  105 + break;
  106 + }
  107 + }
  108 +
  109 + return ret;
  110 +}
  111 +
  112 +int SrsSecurity::deny_check(SrsConfDirective* rules, SrsRtmpConnType type, std::string ip, SrsRequest* req)
  113 +{
  114 + int ret = ERROR_SUCCESS;
  115 +
  116 + for (int i = 0; i < (int)rules->directives.size(); i++) {
  117 + SrsConfDirective* rule = rules->at(i);
  118 +
  119 + if (rule->name != "deny") {
  120 + continue;
  121 + }
  122 +
  123 + switch (type) {
  124 + case SrsRtmpConnPlay:
  125 + if (rule->arg0() != "play") {
  126 + break;
  127 + }
  128 + if (rule->arg1() == "all" || rule->arg1() == ip) {
  129 + ret = ERROR_SYSTEM_SECURITY_DENY;
  130 + break;
  131 + }
  132 + break;
  133 + case SrsRtmpConnFMLEPublish:
  134 + case SrsRtmpConnFlashPublish:
  135 + if (rule->arg0() != "publish") {
  136 + break;
  137 + }
  138 + if (rule->arg1() == "all" || rule->arg1() == ip) {
  139 + ret = ERROR_SYSTEM_SECURITY_DENY;
  140 + break;
  141 + }
  142 + break;
  143 + }
  144 +
  145 + // when matched, donot search more.
  146 + if (ret == ERROR_SYSTEM_SECURITY_DENY) {
  147 + break;
  148 + }
  149 + }
  150 +
  151 + return ret;
  152 +}
  153 +
  1 +/*
  2 +The MIT License (MIT)
  3 +
  4 +Copyright (c) 2013-2015 winlin
  5 +
  6 +Permission is hereby granted, free of charge, to any person obtaining a copy of
  7 +this software and associated documentation files (the "Software"), to deal in
  8 +the Software without restriction, including without limitation the rights to
  9 +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
  10 +the Software, and to permit persons to whom the Software is furnished to do so,
  11 +subject to the following conditions:
  12 +
  13 +The above copyright notice and this permission notice shall be included in all
  14 +copies or substantial portions of the Software.
  15 +
  16 +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
  18 +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
  19 +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
  20 +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21 +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  22 +*/
  23 +
  24 +#ifndef SRS_APP_SECURITY_HPP
  25 +#define SRS_APP_SECURITY_HPP
  26 +
  27 +/*
  28 +#include <srs_app_security.hpp>
  29 +*/
  30 +
  31 +#include <srs_core.hpp>
  32 +
  33 +#include <string>
  34 +
  35 +#include <srs_protocol_rtmp.hpp>
  36 +
  37 +class SrsConfDirective;
  38 +
  39 +/**
  40 +* the security apply on vhost.
  41 +* @see https://github.com/winlinvip/simple-rtmp-server/issues/211
  42 +*/
  43 +class SrsSecurity
  44 +{
  45 +public:
  46 + SrsSecurity();
  47 + virtual ~SrsSecurity();
  48 +public:
  49 + /**
  50 + * security check the client apply by vhost security strategy
  51 + * @param type the client type, publish or play.
  52 + * @param ip the ip address of client.
  53 + * @param req the request object of client.
  54 + */
  55 + virtual int check(SrsRtmpConnType type, std::string ip, SrsRequest* req);
  56 +private:
  57 + /**
  58 + * security check the allow,
  59 + * @return, if allowed, ERROR_SYSTEM_SECURITY_ALLOW.
  60 + */
  61 + virtual int allow_check(SrsConfDirective* rules, SrsRtmpConnType type, std::string ip, SrsRequest* req);
  62 + /**
  63 + * security check the deny,
  64 + * @return, if allowed, ERROR_SYSTEM_SECURITY_DENY.
  65 + */
  66 + virtual int deny_check(SrsConfDirective* rules, SrsRtmpConnType type, std::string ip, SrsRequest* req);
  67 +};
  68 +
  69 +#endif
  70 +
@@ -31,7 +31,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. @@ -31,7 +31,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
31 // current release version 31 // current release version
32 #define VERSION_MAJOR 2 32 #define VERSION_MAJOR 2
33 #define VERSION_MINOR 0 33 #define VERSION_MINOR 0
34 -#define VERSION_REVISION 85 34 +#define VERSION_REVISION 86
35 // server info. 35 // server info.
36 #define RTMP_SIG_SRS_KEY "SRS" 36 #define RTMP_SIG_SRS_KEY "SRS"
37 #define RTMP_SIG_SRS_ROLE "origin/edge server" 37 #define RTMP_SIG_SRS_ROLE "origin/edge server"
@@ -90,6 +90,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. @@ -90,6 +90,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
90 #define ERROR_SYSTEM_FILE_SEEK 1049 90 #define ERROR_SYSTEM_FILE_SEEK 1049
91 #define ERROR_SYSTEM_IO_INVALID 1050 91 #define ERROR_SYSTEM_IO_INVALID 1050
92 #define ERROR_ST_EXCEED_THREADS 1051 92 #define ERROR_ST_EXCEED_THREADS 1051
  93 +#define ERROR_SYSTEM_SECURITY 1052
  94 +#define ERROR_SYSTEM_SECURITY_DENY 1053
  95 +#define ERROR_SYSTEM_SECURITY_ALLOW 1054
93 96
94 /////////////////////////////////////////////////////// 97 ///////////////////////////////////////////////////////
95 // RTMP protocol error. 98 // RTMP protocol error.
@@ -104,6 +104,8 @@ file @@ -104,6 +104,8 @@ file
104 ..\app\srs_app_rtmp_conn.cpp, 104 ..\app\srs_app_rtmp_conn.cpp,
105 ..\app\srs_app_pithy_print.hpp, 105 ..\app\srs_app_pithy_print.hpp,
106 ..\app\srs_app_pithy_print.cpp, 106 ..\app\srs_app_pithy_print.cpp,
  107 + ..\app\srs_app_security.hpp,
  108 + ..\app\srs_app_security.cpp,
107 ..\app\srs_app_server.hpp, 109 ..\app\srs_app_server.hpp,
108 ..\app\srs_app_server.cpp, 110 ..\app\srs_app_server.cpp,
109 ..\app\srs_app_st.hpp, 111 ..\app\srs_app_st.hpp,