RtspSimpleServer Files

Fixes and improvements

General

• require browser POST requests to have an allowed origin (https://github.com/bluenviron/mediamtx/issues/6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (https://github.com/bluenviron/mediamtx/issues/6205)
• h265: fix DTS extraction of streams with long-term reference pictures (https://github.com/bluenviron/mediacommon/issues/371)
• pmp4: support stsz with a constant sample size (https://github.com/bluenviron/mediamtx/issues/5803) (https://github.com/bluenviron/mediacommon/issues/373)
• pmp4, fmp4: restore check on inbound H265 SPS (https://github.com/bluenviron/mediacommon/issues/374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (https://github.com/bluenviron/mediacommon/issues/375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (https://github.com/bluenviron/mediacommon/issues/376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (https://github.com/bluenviron/mediacommon/issues/379)
• pmp4: support tracks longer than 2^32 ticks (https://github.com/bluenviron/mediacommon/issues/377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (https://github.com/bluenviron/gortsplib/issues/1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (https://github.com/bluenviron/gortsplib/issues/1162)
• sdp: support oversized numbers in origin (https://github.com/bluenviron/mediamtx/issues/5949) (https://github.com/bluenviron/gortsplib/issues/1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (https://github.com/bluenviron/gortmplib/issues/129)
• reader: support standalone SEIs from DJI drones (https://github.com/bluenviron/mediamtx/issues/5221) (https://github.com/bluenviron/gortmplib/issues/130)

HLS

• make the server manage sessions (https://github.com/bluenviron/mediamtx/issues/6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (https://github.com/bluenviron/mediamtx/issues/5736) (https://github.com/bluenviron/mediamtx/issues/6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (https://github.com/bluenviron/mediamtx/issues/6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (https://github.com/bluenviron/gohlslib/issues/394)

WebRTC

• fix AV1 getting stuck by stripping padding (https://github.com/bluenviron/mediamtx/issues/5632) (https://github.com/bluenviron/mediamtx/issues/5774) (https://github.com/bluenviron/mediamtx/issues/6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (https://github.com/bluenviron/mediamtx/issues/5221) (https://github.com/bluenviron/mediamtx/issues/6051) (https://github.com/bluenviron/mediamtx/issues/6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
• add ability to exclude interfaces (https://github.com/bluenviron/mediamtx/issues/5788)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
• github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
• github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
• github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
• github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
• github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
• github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
• github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
• github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
• github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
• github.com/pion/interceptor updated from v0.1.47 to v0.1.48
• github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
• github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
• github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
• golang.org/x/crypto updated from v0.55.0 to v0.57.0
• golang.org/x/net updated from v0.58.0 to v0.59.0
• golang.org/x/sync updated from v0.22.0 to v0.23.0
• golang.org/x/sys updated from v0.47.0 to v0.48.0
• golang.org/x/term updated from v0.45.0 to v0.46.0
• github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
• github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
• github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
• github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
• github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
• github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
• github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
• github.com/goccy/go-json updated from v0.10.5 to v0.10.6
• github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
• github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
• github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
• github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
• github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
• github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
• github.com/pion/stun/v3 removed
• github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
• go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
• golang.org/x/arch updated from v0.22.0 to v0.29.0
• golang.org/x/text updated from v0.41.0 to v0.42.0
• google.golang.org/protobuf updated from v1.36.10 to v1.36.11
• github.com/pion/stun/v4 v4.0.0 added
• hls.js updated from v1.7.2 to v1.7.3

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check