Support SRT encryption passphrases on configured paths (#2385)

* Support SRT encryption passphrases on configured paths

* Fix namespace; make passphrase use more clear

* Updates from Alessandro's feedback and lint output

* Fix lint findings

* Update lint.yml

* Update lint.yml

* Fix lint findings

* Add SRT passphrase tests for conf/path

* Reformat test to pass lint

* More changes to pass lint

* More changes to pass lint

* Use safeConf to prevent race conditions

* update API docs

* split configuration checks from connection checks

* add tests

* rename publishSRTPassphrase into srtPublishPassphrase, readSRTPassphrase into srtReadPassphrase

* remove redundant alias

---------

Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>

apidocs/openapi.yaml

@@ -239,6 +239,10 @@ components:
           type: boolean
         fallback:
           type: string
+        srtPublishPassphrase:
+          type: string
+        srtReadPassphrase:
+          type: string
 
         # RTSP
         sourceProtocol:

internal/conf/conf_test.go

@@ -301,6 +301,20 @@ func TestConfErrors(t *testing.T) {
 				"    source: rpiCamera\n",
 			"'rpiCamera' with same camera ID 0 is used as source in two paths, 'cam1' and 'cam2'",
 		},
+		{
+			"invalid srt publish passphrase",
+			"paths:\n" +
+				"  mypath:\n" +
+				"    srtPublishPassphrase: a\n",
+			`invalid 'srtPublishPassphrase': must be between 10 and 79 characters`,
+		},
+		{
+			"invalid srt read passphrase",
+			"paths:\n" +
+				"  mypath:\n" +
+				"    srtReadPassphrase: a\n",
+			`invalid 'readRTPassphrase': must be between 10 and 79 characters`,
+		},
 	} {
 		t.Run(ca.name, func(t *testing.T) {
 			tmpf, err := writeTempFile([]byte(ca.conf))

internal/conf/path.go

@@ -38,6 +38,16 @@ func IsValidPathName(name string) error {
 	return nil
 }
 
+func srtCheckPassphrase(passphrase string) error {
+	switch {
+	case len(passphrase) < 10 || len(passphrase) > 79:
+		return fmt.Errorf("must be between 10 and 79 characters")
+
+	default:
+		return nil
+	}
+}
+
 // PathConf is a path configuration.
 type PathConf struct {
 	Regexp *regexp.Regexp `json:"-"`
@@ -63,6 +73,8 @@ type PathConf struct {
 	OverridePublisher        bool   `json:"overridePublisher"`
 	DisablePublisherOverride bool   `json:"disablePublisherOverride"` // deprecated
 	Fallback                 string `json:"fallback"`
+	SRTPublishPassphrase     string `json:"srtPublishPassphrase"`
+	SRTReadPassphrase        string `json:"srtReadPassphrase"`
 
 	// RTSP
 	SourceProtocol      SourceProtocol `json:"sourceProtocol"`
@@ -362,6 +374,21 @@ func (pconf *PathConf) check(conf *Conf, name string) error {
 		}
 	}
 
+	// SRT
+
+	if pconf.SRTPublishPassphrase != "" {
+		err := srtCheckPassphrase(pconf.SRTPublishPassphrase)
+		if err != nil {
+			return fmt.Errorf("invalid 'srtPublishPassphrase': %v", err)
+		}
+	}
+	if pconf.SRTReadPassphrase != "" {
+		err := srtCheckPassphrase(pconf.SRTReadPassphrase)
+		if err != nil {
+			return fmt.Errorf("invalid 'readRTPassphrase': %v", err)
+		}
+	}
+
 	// Hooks
 
 	if pconf.RunOnInit != "" && pconf.Regexp != nil {

internal/core/srt_conn.go

@@ -31,6 +31,23 @@ func durationGoToMPEGTS(v time.Duration) int64 {
 	return int64(v.Seconds() * 90000)
 }
 
+func srtCheckPassphrase(connReq srt.ConnRequest, passphrase string) error {
+	if passphrase == "" {
+		return nil
+	}
+
+	if !connReq.IsEncrypted() {
+		return fmt.Errorf("connection is encrypted, but not passphrase is defined in configuration")
+	}
+
+	err := connReq.SetPassphrase(passphrase)
+	if err != nil {
+		return fmt.Errorf("invalid passphrase")
+	}
+
+	return nil
+}
+
 type srtConnState int
 
 const (
@@ -222,6 +239,11 @@ func (c *srtConn) runPublish(req srtNewConnReq, pathName string, user string, pa
 
 	defer res.path.removePublisher(pathRemovePublisherReq{author: c})
 
+	err := srtCheckPassphrase(req.connReq, res.path.conf.SRTPublishPassphrase)
+	if err != nil {
+		return false, err
+	}
+
 	sconn, err := c.exchangeRequestWithConn(req)
 	if err != nil {
 		return true, err
@@ -314,6 +336,11 @@ func (c *srtConn) runRead(req srtNewConnReq, pathName string, user string, pass
 
 	defer res.path.removeReader(pathRemoveReaderReq{author: c})
 
+	err := srtCheckPassphrase(req.connReq, res.path.conf.SRTReadPassphrase)
+	if err != nil {
+		return false, err
+	}
+
 	sconn, err := c.exchangeRequestWithConn(req)
 	if err != nil {
 		return true, err

internal/core/srt_server_test.go

@@ -11,19 +11,40 @@ import (
 )
 
 func TestSRTServer(t *testing.T) {
-	p, ok := newInstance("paths:\n" +
-		"  all:\n")
+	for _, ca := range []string{
+		"no passphrase",
+		"publish passphrase",
+		"read passphrase",
+	} {
+		t.Run(ca, func(t *testing.T) {
+			conf := "paths:\n" +
+				"  all:\n"
+
+			switch ca {
+			case "publish passphrase":
+				conf += "    srtPublishPassphrase: 123456789abcde"
+
+			case "read passphrase":
+				conf += "    srtReadPassphrase: 123456789abcde"
+			}
+
+			p, ok := newInstance(conf)
 			require.Equal(t, true, ok)
 			defer p.Close()
 
-	conf := srt.DefaultConfig()
-	address, err := conf.UnmarshalURL("srt://localhost:8890?streamid=publish:mypath")
+			u := "srt://localhost:8890?streamid=publish:mypath"
+			if ca == "publish passphrase" {
+				u += "&passphrase=123456789abcde"
+			}
+
+			srtConf := srt.DefaultConfig()
+			address, err := srtConf.UnmarshalURL(u)
 			require.NoError(t, err)
 
-	err = conf.Validate()
+			err = srtConf.Validate()
 			require.NoError(t, err)
 
-	publisher, err := srt.Dial("srt", address, conf)
+			publisher, err := srt.Dial("srt", address, srtConf)
 			require.NoError(t, err)
 			defer publisher.Close()
 
@@ -56,14 +77,19 @@ func TestSRTServer(t *testing.T) {
 
 			time.Sleep(500 * time.Millisecond)
 
-	conf = srt.DefaultConfig()
-	address, err = conf.UnmarshalURL("srt://localhost:8890?streamid=read:mypath")
+			u = "srt://localhost:8890?streamid=read:mypath"
+			if ca == "read passphrase" {
+				u += "&passphrase=123456789abcde"
+			}
+
+			srtConf = srt.DefaultConfig()
+			address, err = srtConf.UnmarshalURL(u)
 			require.NoError(t, err)
 
-	err = conf.Validate()
+			err = srtConf.Validate()
 			require.NoError(t, err)
 
-	reader, err := srt.Dial("srt", address, conf)
+			reader, err := srt.Dial("srt", address, srtConf)
 			require.NoError(t, err)
 			defer reader.Close()
 
@@ -115,4 +141,6 @@ func TestSRTServer(t *testing.T) {
 					break
 				}
 			}
+		})
+	}
 }

mediamtx.yml

@@ -338,6 +338,10 @@ paths:
     # if no one is publishing, redirect readers to this path.
     # It can be can be a relative path  (i.e. /otherstream) or an absolute RTSP URL.
     fallback:
+    # SRT encryption passphrase required to publish on this path
+    srtPublishPassphrase:
+    # SRT encryption passphrase require to read from this path
+    srtReadPassphrase:
 
     ###############################################
     # RTSP path settings (when source is a RTSP or a RTSPS URL)