prevent mixing together legacy and current auth mechanism (#3258) (#3460

)

internal/api/api_test.go

@@ -247,16 +247,14 @@ func TestConfigPathDefaultsPatch(t *testing.T) {
 
 	httpRequest(t, hc, http.MethodPatch, "http://localhost:9997/v3/config/pathdefaults/patch",
 		map[string]interface{}{
-			"readUser": "myuser",
-			"readPass": "mypass",
+			"recordFormat": "fmp4",
 		}, nil)
 
 	time.Sleep(500 * time.Millisecond)
 
 	var out map[string]interface{}
 	httpRequest(t, hc, http.MethodGet, "http://localhost:9997/v3/config/pathdefaults/get", nil, &out)
-	require.Equal(t, "myuser", out["readUser"])
-	require.Equal(t, "mypass", out["readPass"])
+	require.Equal(t, "fmp4", out["recordFormat"])
 }
 
 func TestConfigPathsList(t *testing.T) {

internal/conf/conf.go

@@ -94,31 +94,66 @@ func mustParseCIDR(v string) net.IPNet {
 	return *ne
 }
 
-func credentialIsNotEmpty(c *Credential) bool {
-	return c != nil && *c != ""
-}
-
-func ipNetworkIsNotEmpty(i *IPNetworks) bool {
-	return i != nil && len(*i) != 0
-}
+func anyPathHasDeprecatedCredentials(pathDefaults Path, paths map[string]*OptionalPath) bool {
+	if pathDefaults.PublishUser != nil ||
+		pathDefaults.PublishPass != nil ||
+		pathDefaults.PublishIPs != nil ||
+		pathDefaults.ReadUser != nil ||
+		pathDefaults.ReadPass != nil ||
+		pathDefaults.ReadIPs != nil {
+		return true
+	}
 
-func anyPathHasDeprecatedCredentials(paths map[string]*OptionalPath) bool {
 	for _, pa := range paths {
 		if pa != nil {
 			rva := reflect.ValueOf(pa.Values).Elem()
-			if credentialIsNotEmpty(rva.FieldByName("PublishUser").Interface().(*Credential)) ||
-				credentialIsNotEmpty(rva.FieldByName("PublishPass").Interface().(*Credential)) ||
-				ipNetworkIsNotEmpty(rva.FieldByName("PublishIPs").Interface().(*IPNetworks)) ||
-				credentialIsNotEmpty(rva.FieldByName("ReadUser").Interface().(*Credential)) ||
-				credentialIsNotEmpty(rva.FieldByName("ReadPass").Interface().(*Credential)) ||
-				ipNetworkIsNotEmpty(rva.FieldByName("ReadIPs").Interface().(*IPNetworks)) {
+			if rva.FieldByName("PublishUser").Interface().(*Credential) != nil ||
+				rva.FieldByName("PublishPass").Interface().(*Credential) != nil ||
+				rva.FieldByName("PublishIPs").Interface().(*IPNetworks) != nil ||
+				rva.FieldByName("ReadUser").Interface().(*Credential) != nil ||
+				rva.FieldByName("ReadPass").Interface().(*Credential) != nil ||
+				rva.FieldByName("ReadIPs").Interface().(*IPNetworks) != nil {
 				return true
 			}
 		}
 	}
 	return false
 }
 
+var defaultAuthInternalUsers = AuthInternalUsers{
+	{
+		User: "any",
+		Pass: "",
+		Permissions: []AuthInternalUserPermission{
+			{
+				Action: AuthActionPublish,
+			},
+			{
+				Action: AuthActionRead,
+			},
+			{
+				Action: AuthActionPlayback,
+			},
+		},
+	},
+	{
+		User: "any",
+		Pass: "",
+		IPs:  IPNetworks{mustParseCIDR("127.0.0.1/32"), mustParseCIDR("::1/128")},
+		Permissions: []AuthInternalUserPermission{
+			{
+				Action: AuthActionAPI,
+			},
+			{
+				Action: AuthActionMetrics,
+			},
+			{
+				Action: AuthActionPprof,
+			},
+		},
+	},
+}
+
 // Conf is a configuration.
 // WARNING: Avoid using slices directly due to https://github.com/golang/go/issues/21092
 type Conf struct {
@@ -276,39 +311,7 @@ func (conf *Conf) setDefaults() {
 	conf.UDPMaxPayloadSize = 1472
 
 	// Authentication
-	conf.AuthInternalUsers = []AuthInternalUser{
-		{
-			User: "any",
-			Pass: "",
-			Permissions: []AuthInternalUserPermission{
-				{
-					Action: AuthActionPublish,
-				},
-				{
-					Action: AuthActionRead,
-				},
-				{
-					Action: AuthActionPlayback,
-				},
-			},
-		},
-		{
-			User: "any",
-			Pass: "",
-			IPs:  IPNetworks{mustParseCIDR("127.0.0.1/32"), mustParseCIDR("::1/128")},
-			Permissions: []AuthInternalUserPermission{
-				{
-					Action: AuthActionAPI,
-				},
-				{
-					Action: AuthActionMetrics,
-				},
-				{
-					Action: AuthActionPprof,
-				},
-			},
-		},
-	}
+	conf.AuthInternalUsers = defaultAuthInternalUsers
 	conf.AuthHTTPExclude = []AuthInternalUserPermission{
 		{
 			Action: AuthActionAPI,
@@ -501,7 +504,6 @@ func (conf *Conf) Validate() error {
 	}
 
 	// Authentication
-
 	if conf.ExternalAuthenticationURL != nil {
 		conf.AuthMethod = AuthMethodHTTP
 		conf.AuthHTTPAddress = *conf.ExternalAuthenticationURL
@@ -517,17 +519,15 @@ func (conf *Conf) Validate() error {
 		return fmt.Errorf("'authJWTJWKS' must be a HTTP URL")
 	}
 	deprecatedCredentialsMode := false
-	if credentialIsNotEmpty(conf.PathDefaults.PublishUser) ||
-		credentialIsNotEmpty(conf.PathDefaults.PublishPass) ||
-		ipNetworkIsNotEmpty(conf.PathDefaults.PublishIPs) ||
-		credentialIsNotEmpty(conf.PathDefaults.ReadUser) ||
-		credentialIsNotEmpty(conf.PathDefaults.ReadPass) ||
-		ipNetworkIsNotEmpty(conf.PathDefaults.ReadIPs) ||
-		anyPathHasDeprecatedCredentials(conf.OptionalPaths) {
+	if anyPathHasDeprecatedCredentials(conf.PathDefaults, conf.OptionalPaths) {
+		if conf.AuthInternalUsers != nil && !reflect.DeepEqual(conf.AuthInternalUsers, defaultAuthInternalUsers) {
+			return fmt.Errorf("authInternalUsers and legacy credentials " +
+				"(publishUser, publishPass, publishIPs, readUser, readPass, readIPs) cannot be used together")
+		}
+
 		conf.AuthInternalUsers = []AuthInternalUser{
 			{
 				User: "any",
-				Pass: "",
 				Permissions: []AuthInternalUserPermission{
 					{
 						Action: AuthActionPlayback,
@@ -536,7 +536,6 @@ func (conf *Conf) Validate() error {
 			},
 			{
 				User: "any",
-				Pass: "",
 				IPs:  IPNetworks{mustParseCIDR("127.0.0.1/32"), mustParseCIDR("::1/128")},
 				Permissions: []AuthInternalUserPermission{
 					{

internal/conf/conf_test.go

@@ -192,6 +192,66 @@ func TestConfEncryption(t *testing.T) {
 	require.Equal(t, true, ok)
 }
 
+func TestConfDeprecatedAuth(t *testing.T) {
+	tmpf, err := createTempFile([]byte(
+		"paths:\n" +
+			"  cam:\n" +
+			"    readUser: myuser\n" +
+			"    readPass: mypass\n"))
+	require.NoError(t, err)
+	defer os.Remove(tmpf)
+
+	conf, _, err := Load(tmpf, nil)
+	require.NoError(t, err)
+
+	require.Equal(t, AuthInternalUsers{
+		{
+			User: "any",
+			Permissions: []AuthInternalUserPermission{
+				{
+					Action: AuthActionPlayback,
+				},
+			},
+		},
+		{
+			User: "any",
+			IPs:  IPNetworks{mustParseCIDR("127.0.0.1/32"), mustParseCIDR("::1/128")},
+			Permissions: []AuthInternalUserPermission{
+				{
+					Action: AuthActionAPI,
+				},
+				{
+					Action: AuthActionMetrics,
+				},
+				{
+					Action: AuthActionPprof,
+				},
+			},
+		},
+		{
+			User: "any",
+			IPs:  IPNetworks{mustParseCIDR("0.0.0.0/0")},
+			Permissions: []AuthInternalUserPermission{
+				{
+					Action: AuthActionPublish,
+					Path:   "cam",
+				},
+			},
+		},
+		{
+			User: "myuser",
+			Pass: "mypass",
+			IPs:  IPNetworks{mustParseCIDR("0.0.0.0/0")},
+			Permissions: []AuthInternalUserPermission{
+				{
+					Action: AuthActionRead,
+					Path:   "cam",
+				},
+			},
+		},
+	}, conf.AuthInternalUsers)
+}
+
 func TestConfErrors(t *testing.T) {
 	for _, ca := range []struct {
 		name string

internal/conf/path.go

@@ -399,17 +399,17 @@ func (pconf *Path) validate(
 	if deprecatedCredentialsMode {
 		func() {
 			var user Credential = "any"
-			if credentialIsNotEmpty(pconf.PublishUser) {
+			if pconf.PublishUser != nil && *pconf.PublishUser != "" {
 				user = *pconf.PublishUser
 			}
 
 			var pass Credential
-			if credentialIsNotEmpty(pconf.PublishPass) {
+			if pconf.PublishPass != nil && *pconf.PublishPass != "" {
 				pass = *pconf.PublishPass
 			}
 
 			ips := IPNetworks{mustParseCIDR("0.0.0.0/0")}
-			if ipNetworkIsNotEmpty(pconf.PublishIPs) {
+			if pconf.PublishIPs != nil && len(*pconf.PublishIPs) != 0 {
 				ips = *pconf.PublishIPs
 			}
 
@@ -431,17 +431,17 @@ func (pconf *Path) validate(
 
 		func() {
 			var user Credential = "any"
-			if credentialIsNotEmpty(pconf.ReadUser) {
+			if pconf.ReadUser != nil && *pconf.ReadUser != "" {
 				user = *pconf.ReadUser
 			}
 
 			var pass Credential
-			if credentialIsNotEmpty(pconf.ReadPass) {
+			if pconf.ReadPass != nil && *pconf.ReadPass != "" {
 				pass = *pconf.ReadPass
 			}
 
 			ips := IPNetworks{mustParseCIDR("0.0.0.0/0")}
-			if ipNetworkIsNotEmpty(pconf.ReadIPs) {
+			if pconf.ReadIPs != nil && len(*pconf.ReadIPs) != 0 {
 				ips = *pconf.ReadIPs
 			}