I need to be 100% sure that any playback from wowza has been authorized. I
added a module that authorized http streaming playback and then found
that the stream could be played using rtsp. I then found the same type of
hook for rtsp streams. Now I am finding rtmp is even more tricky.
I need a security hook that gives me 100% assurance that nothing will be served
unless authorized.
Is there a hook that somebody can alert me to that would do this?
The information I need is the file path of the stream being played and the IP of
the requesting user.
I am aware of how to insert a module and implemented the following methods
to intercept stream playback, but a single authorization hook that was
documented to show that all stream playback could be authorized is what
I am looking for.
public class CustomAuthorizationModule extends ModuleBase
{
http
public void onHTTPSessionCreate(IHTTPStreamerSession httpSession)
{
boolean isGood = true;
String ipAddressClient = httpSession.getIpAddress();
String queryStr = httpSession.getQueryStr();
String streamName = httpSession.getStreamName();
… authorize
if (!isGood)
{
httpSession.rejectSession();
}
}
}
rtsp
public void onRTPSessionCreate(RTPSession rtpSession)
{
ipAddress = rtpSession.getIp();
uriStr = rtpSession.getUri();
streamName = extractStreamName(uriStr); // Have to come up with streamName
… authorize
if (!isGood)
{
httpSession.rejectSession();
}
}
}
rtmp
public void onStreamCreate(IMediaStream stream)
{
stream.addClientListener(new DmeStreamNotify());
}
rtmp
class DmeStreamNotify implements IMediaStreamActionNotify
{
@Override
public void onPlay(IMediaStream stream, String streamName, double playStart, double playLen, int playReset)
{
if (alreadyAuthorized)
{
// test if this play request is already authorizec
}
else
{
getLogger().info(“DmeStreamNotify.play()”);
getLogger().info("DmeStreamNotify.play() stream.getName(): " + stream.getName());
getLogger().info("DmeStreamNotify.play() stream.getContextStr(): " + stream.getContextStr());
getLogger().info("DmeStreamNotify.play() stream.getQueryStr(): " + stream.getQueryStr());
IClient client = stream.getClient();
if (client != null)
{
getLogger().info(“DmeStreamNotify.play() client.getUri()” + client.getIp());
}
… authorize
if (!isGood)
{
client.shutdownClient();
}
}
}
}