[Live-devel] Transport header VLC client

[xcsmith at rockwellcollins.com]

> I won't be adding such functionality to
the distributed source code.

I have implemented this functionality to build into the RTSPClient when
RTSP_ALLOW_CLIENT_DESTINATION_SETTING is set.  In this way I can instruct
my MPEG encoder's RTSP server where to send its multicast stream, which is
a user requirement so that multiple encoders can exist on the same network.
Does your comment mean that this capability, despite being disabled, could
not be added to the distribution?

Isn't it the server which is a security risk if it allows the RTSPClient to
do this?  RTSPClients - or telnet clients as i recall - can send whatever
messages they want to RTSPServers, but it is the RTSPServer which gets do
decide whether or not to follow the instruction.  In the case of my system,
the encoder's policy to allow clients to set the destination is the real
security risk.  The LIVE server does not support client destination setting
by default, but it does support it.  In the case of my LIVE code, my client
now supports it too, but not by default.  It doesn't seem illogical to me
for the included client to support the capability if the server does,
although it could be a bad idea for all general VLC users to have the
capability enabled and go to town looking for RTSP servers that are
vulnerable.  Are there plans to remove the capability from the server
source code?

Anyway this feature would likely be included as part of the first patch I
would run the red tape gauntlet with so that I have company authority to
return it to the community.  (Of course we are obligated to release this
source code, but there's still a bunch of red tape for me to get it done
because I intend to post patches to the community instead of hide them away
and wait for people to come asking and have to wait 3 months to get them.)

xochitl