MediaMTX

Fixes and improvements

General

• fix error message (https://github.com/bluenviron/mediamtx/issues/5922) 'all' is a synonym for 'all_others'
• fix clearing lists with environment variables (https://github.com/bluenviron/mediamtx/issues/5410) (https://github.com/bluenviron/mediamtx/issues/5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
• add runOnOnline / runOnOffline hooks (https://github.com/bluenviron/mediamtx/issues/5399) (https://github.com/bluenviron/mediamtx/issues/5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
• rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (https://github.com/bluenviron/mediamtx/issues/5957)
• fix wrong PTS and wrong playback of alwaysAvailableFile (https://github.com/bluenviron/mediamtx/issues/5436) (https://github.com/bluenviron/mediamtx/issues/5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
• avoid potential timing attack when validating SHA256 credentials (https://github.com/bluenviron/mediamtx/issues/5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews <tmatth@videolan.org>
• normalize authentication error messages (https://github.com/bluenviron/mediamtx/issues/5421) (https://github.com/bluenviron/mediamtx/issues/5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
• adjust code to prevent security scan false positives (https://github.com/bluenviron/mediamtx/issues/5963) about string escaping.
• ask for credentials only in case of protocols that support it (https://github.com/bluenviron/mediamtx/issues/5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
• docs: add fail2ban integration (https://github.com/bluenviron/mediamtx/issues/5016) (https://github.com/bluenviron/mediamtx/issues/5967)
• add comment to prevent security scan false positives (https://github.com/bluenviron/mediamtx/issues/5973)
• pmp4: fix support for ctts version 0 (https://github.com/bluenviron/mediamtx/issues/5436) (https://github.com/bluenviron/mediacommon/issues/343)

API

• generate most of OpenAPI automatically (https://github.com/bluenviron/mediamtx/issues/5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

• fix race condition during startup (https://github.com/bluenviron/mediamtx/issues/5965) allocate the HTTP server only after the MoQ server has been initialized.
• fix several panics and OOM errors (https://github.com/bluenviron/mediamtx/issues/5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
• support draft-19 of the specification (https://github.com/bluenviron/mediamtx/issues/5968) support draft-19 of the specification support subscribing the same track multiple times.
• prevent excessive CPU consumption in reorderer (https://github.com/bluenviron/mediamtx/issues/5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

• prevent cross-origin unauthorized access (https://github.com/bluenviron/mediamtx/issues/5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "

<h1 align="center">

<a href="https://mediamtx.org">

<img src="logo.png" alt="MediaMTX">

</a>

<br>

<br>

Website

Test

Lint

CodeCov

Release

Docker Hub

</h1>

<br>

_MediaMTX_ is a ready-to-use and zero-dependency live media server and media proxy that allows to publish, read, proxy, record and playback real-time video and audio streams. It has been conceived as a "media router" that routes media streams from one end to the other, with a focus on efficiency and portability.

<div align="center">

| Install | Documentation |

| ---------------------------------------------------- | --------------------------------------------------------------- |

</div>

<h3>Features</h3>

• Publish live streams to the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP, using FFmpeg, GStreamer, OBS Studio, Python , Golang, Unity, web browsers, Raspberry Pi Cameras and more.
• Read live streams from the server with Media-over-QUIC, SRT, WebRTC, RTSP, RTMP, HLS, using FFmpeg, GStreamer, VLC, OBS Studio, Python , Golang, Unity, web browsers and more.
• Streams are automatically converted from a protocol to another
• Serve several streams at once in separate paths
• Reload the configuration without disconnecting existing clients (hot reloading)
• Serve always-available streams even when the publisher is offline
• Record streams to disk in fMP4 or MPEG-TS format
• Playback recorded streams
• Authenticate users with internal, HTTP or JWT authentication
• Forward streams to other servers
• Proxy requests to other servers
• Control the server through the Control API
• Extract metrics from the server in a Prometheus-compatible format
• Monitor performance to investigate CPU and RAM consumption
• Run hooks (external commands) when clients connect, disconnect, read or publish streams
• Compatible with Linux, Windows and macOS, does not require any dependency or interpreter, it's a single executable
• ...and many others.