135 replies to this topic

[Erik Slagter]

I never changed that behaviour on purpose (see the commits). If it's broken it should be fixed. Can you pinpoint it to a certain commit?

[anudanan]

Thx Erik for explanation about streamproxy. Know I have understand some things inside ;-)

 

 

 

Streamproxy needs to get a tuner tuned and connected to a service. That's done using the OWIF, there is no other way of communication with enigma from an external binary. So if you configure OWIF access with a password, streamproxy needs to have the password.

 

How can I give streamproxy the password which streamproxy needs for connecting to OWIF?

Or is there no way and streamproxy works only without HTTP auth in OWIF?

[Pr2]

Please read the other thread I refer to. :-)

 

https://forums.openp...rt/#entry989169

 

So I check and find this:

 

https://forums.openp...ndpost&p=989197

 

There we saw a comparison between OpenPLi 6.2 and OpenPLi 7 where OWIF defined parameters in 6.2 they disappeard in 7.0.

 

Then WanWizard replied this:  https://forums.openp...rt/#entry989329

[Erik Slagter]

Yes, exactly. OWIF bug, not a streamproxy bug.

[littlesat]

The broadcom version cannot do it, only the e2/xtrend version does modi on demand....

[WanWizard]

Or is there no way and streamproxy works only without HTTP auth in OWIF?

 

Technically it should be possible to disable not require auth on the webif for requests from localhost, that would allow the streamproxy and other processes running on the box  to communicate with the OWIF API without impact on security?

[Erik Slagter]

The broadcom version cannot do it, only the e2/xtrend version does modi on demand....

You obviously don't have a clue what you're talking about here.

[Erik Slagter]

 

Or is there no way and streamproxy works only without HTTP auth in OWIF?

Technically it should be possible to disable not require auth on the webif for requests from localhost, that would allow the streamproxy and other processes running on the box  to communicate with the OWIF API without impact on security?

Yes, that would be a proper solution. I seem to remember having requested that before.

[anudanan]

I´ve heared in the vti forum there is a switch for streamproxy to connect without password even OWIF has HTTP auth enable. It maybe that is a switch for OWIF to accept HTTP without auth from localhost

Edited by anudanan, 31 December 2018 - 14:27.

[WanWizard]

These are the exception rules in OWIF:

# Handle all conditions where auth may be skipped/disabled

# #1: Auth is disabled and access is from local network
if (not request.isSecure() and config.OpenWebif.auth.value is False) or (request.isSecure() and config.OpenWebif.https_auth.value is False):
	networks = getAllNetworks()
	if networks:
		for network in networks:
			if ipaddress.ip_address(unicode(peer)) in ipaddress.ip_network(unicode(network), strict=False):
				return self.resource.getChildWithDefault(path, request)

# #2: Auth is disabled and access is from private address space (Usually VPN) and access for VPNs has been granted
if (not request.isSecure() and config.OpenWebif.auth.value is False) or (request.isSecure() and config.OpenWebif.https_auth.value is False):
	if config.OpenWebif.vpn_access.value is True and ipaddress.ip_address(unicode(peer)).is_private:
		return self.resource.getChildWithDefault(path, request)

# #3: Access is from localhost and streaming auth is disabled - or - we only want to see our IPv6 (For inadyn-mt)
if ((host == "localhost" or host == "127.0.0.1" or host == "::ffff:127.0.0.1" or host == "::1") and not config.OpenWebif.auth_for_streaming.value) or request.uri == "/web/getipv6":
	return self.resource.getChildWithDefault(path, request)

# #4: Web TV is accessing streams and "auths" by parent session id
if request.getUser() == "-sid":
	sid = str(request.getPassword())
	try:
		oldsession = site.getSession(sid).sessionNamespaces
		if "logged" in oldsession.keys() and oldsession["logged"]:
			session = request.getSession().sessionNamespaces
			session["logged"] = True
			return self.resource.getChildWithDefault(path, request)
	except: # nosec
		pass

# If we get to here, no exception applied

[WanWizard]

As far as I can see, streamproxy only does a GET of "/web/stream?StreamService=", so I don't see why that couldn't be whitelisted, like the inadyn-mt GET...

[anudanan]

It is possible that the reason is that streamproxy uses  the OWIF HTTP_auth parameter for authentication and not the HTTP_streaming_auth parameter of openWEBIF. 

 

So my feeling ist if streamproxy makes an HTTP connect to OWIF without auth if the OWIF HTTP_streaming_auth ist false it would work

[WanWizard]

That is for Erik to answer.

 

It could well be that the streamproxy code pre-dates the split in the auth code in OWIF, as the seperate auth for streaming was added later.

[anudanan]

With that knowledge I´ve made the following test.

 

OWIF hast http auth disabled and HTTP streaming auth disabled and that is seen in the settings file /etc/enigma2/settings.

 

Now I have set OWIF zu HTTP auth enable but without GUi restart you can´t see that in the settings file. That means streamproxy has the knowledge to connect without auth to OWIF.

 

A normal HTTP access from PC needs now User/pW

 

But streaming with streamproxy works now as I expected. I connect to the OWIF with HTTP auth and can stream with auth for port 8002

 

If I make a GUI restart, than streaming with streamproxy doesn´t work because streamproxy now knows about the HTTP auth true value.

 

 

So I think the idea to use the HTTP auth for streaming parameter of OWIF is the solution

Edited by anudanan, 31 December 2018 - 15:18.

[anudanan]

is to late for editing the last post

 

Sorry, that sentense was wrong

But streaming with streamproxy works now as I expected. I connect to the OWIF with HTTP auth and can stream with auth for port 8002

 

correct is

But streaming with streamproxy works now as I expected. I connect to the OWIF with HTTP auth and can stream without auth for port 8002

Edited by anudanan, 31 December 2018 - 15:22.

[Erik Slagter]

It could well be that the streamproxy code pre-dates the split in the auth code in OWIF, as the seperate auth for streaming was added later.

Very probable.

[Erik Slagter]

So, what I am supposed to change in streamproxy, given the above URL specified by Wanwizard is used and the source is localhost (::1)?

[littlesat]

You obviously don't have a clue what you're talking about here.

since when and ‘what’ is it possible with vu style....

Edited by littlesat, 31 December 2018 - 16:46.

[Erik Slagter]

First of all, there is no "xtrend" style or "vu+" style of transcoding.

 

There is the streamproxy and enigma itself, where enigma itself is able to handle transcoding for xtrend-api-based receivers. Streamproxy can handle both xtrend-api-based receivers and all others.

 

Enigma operates on port 8001, streamproxy on any port you configure, default 8002 and 8003.

 

Those are the only two sytems relevant as seen from the end user.

 

Both systems allow to add http parameters to the request URL, where a.o. the bitrate can be overriden from the default.

 

So I really don't understand where you get this notion from. Maybe you missed the fact the we haven't been using the "transtreamproxy" from VU+ for about 5 years now.

Edited by Erik Slagter, 1 January 2019 - 13:19.

[WanWizard]

First of all, there is no "xtrend" style or "vu+" style of transcoding.

 

Sorry for introducing those terms, I tried to explain it in a way end-users in this topic would understand.

 

And please also note that this topic was a discussion about the WebIf, and that does make a distinction between VU+ style and Xtrend style, based on brand/model, when generating transcoding URL's.  For Xtrend style, it generates a URL on port 8001 with transcoding parameters, for VU+ style it generates a URL on port 8002 without those parameters.

 

It would be handy if the OWIF would generate all transcoding URL's with encoding parameters, but it doesn't, as that would break it for non-OpenPLi images.