]> git.sesse.net Git - vlc/blobdiff - src/misc/httpd.c
All signedness fixes
[vlc] / src / misc / httpd.c
index 4af16a89a127db991c8526040d9aaac0c223848e..5e7f66c580cd7b8272b4980e8cb9235ddac2b9bb 100644 (file)
@@ -1,10 +1,11 @@
 /*****************************************************************************
  * httpd.c
  *****************************************************************************
- * Copyright (C) 2004 VideoLAN
+ * Copyright (C) 2004-2005 the VideoLAN team
  * $Id$
  *
  * Authors: Laurent Aimar <fenrir@via.ecp.fr>
+ *          RĂ©mi Denis-Courmont <rem # videolan.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
 #include <stdlib.h>
 #include <vlc/vlc.h>
 
+#ifdef ENABLE_HTTPD
+
 #include "vlc_httpd.h"
+#include "network.h"
+#include "vlc_tls.h"
 
+#include <string.h>
 #include <errno.h>
+
 #ifdef HAVE_UNISTD_H
 #   include <unistd.h>
 #endif
-#include <fcntl.h>
+
+#ifdef HAVE_FCNTL_H
+#   include <fcntl.h>
+#endif
 
 #if defined( UNDER_CE )
 #   include <winsock.h>
 #elif defined( WIN32 )
 #   include <winsock2.h>
 #   include <ws2tcpip.h>
-#   ifndef IN_MULTICAST
-#       define IN_MULTICAST(a) IN_CLASSD(a)
-#   endif
 #else
 #   include <netdb.h>                                         /* hostent ... */
 #   include <sys/socket.h>
+/* FIXME: should not be needed */
 #   include <netinet/in.h>
 #   ifdef HAVE_ARPA_INET_H
 #       include <arpa/inet.h>                    /* inet_ntoa(), inet_aton() */
@@ -200,8 +208,9 @@ struct httpd_host_t
     int         i_ref;
 
     /* address/port and socket for listening at connections */
-    struct sockaddr_in sock;
-    int                fd;
+    char        *psz_hostname;
+    int         i_port;
+    int         *fd;
 
     vlc_mutex_t lock;
 
@@ -214,6 +223,9 @@ struct httpd_host_t
 
     int            i_client;
     httpd_client_t **client;
+    
+    /* TLS data */
+    tls_server_t *p_tls;
 };
 
 struct httpd_url_t
@@ -225,6 +237,8 @@ struct httpd_url_t
     char    *psz_url;
     char    *psz_user;
     char    *psz_password;
+    char    **ppsz_hosts;
+    int     i_hosts;
 
     struct
     {
@@ -245,6 +259,9 @@ enum
     HTTPD_CLIENT_WAITING,
 
     HTTPD_CLIENT_DEAD,
+
+    HTTPD_CLIENT_TLS_HS_IN,
+    HTTPD_CLIENT_TLS_HS_OUT
 };
 /* mode */
 enum
@@ -260,7 +277,8 @@ struct httpd_client_t
 
     int     i_ref;
 
-    struct  sockaddr_in sock;
+    struct  sockaddr_storage sock;
+    int     i_sock_size;
     int     fd;
 
     int     i_mode;
@@ -278,6 +296,9 @@ struct httpd_client_t
     /* */
     httpd_message_t query;  /* client -> httpd */
     httpd_message_t answer; /* httpd -> client */
+    
+    /* TLS data */
+    tls_session_t *p_tls;
 };
 
 
@@ -361,6 +382,7 @@ static struct
     { ".jpg",   "image/jpeg" },
     { ".jpeg",  "image/jpeg" },
     { ".png",   "image/png" },
+    { ".mpjpeg","multipart/x-mixed-replace; boundary=This Random String" },
 
     /* media mime */
     { ".avi",   "video/avi" },
@@ -444,7 +466,7 @@ static int httpd_FileCallBack( httpd_callback_sys_t *p_sys, httpd_client_t *cl,
 
     if( query->i_type != HTTPD_MSG_HEAD )
     {
-        char *psz_args = query->psz_args;
+        uint8_t *psz_args = query->psz_args;
         if( query->i_type == HTTPD_MSG_POST )
         {
             /* Check that */
@@ -469,13 +491,15 @@ static int httpd_FileCallBack( httpd_callback_sys_t *p_sys, httpd_client_t *cl,
 httpd_file_t *httpd_FileNew( httpd_host_t *host,
                              char *psz_url, char *psz_mime,
                              char *psz_user, char *psz_password,
+                             char **ppsz_hosts, int i_hosts,
                              httpd_file_callback_t pf_fill,
                              httpd_file_sys_t *p_sys )
 {
     httpd_file_t *file = malloc( sizeof( httpd_file_t ) );
 
     if( ( file->url = httpd_UrlNewUnique( host, psz_url, psz_user,
-                                          psz_password ) ) == NULL )
+                                          psz_password, ppsz_hosts, i_hosts )
+        ) == NULL )
     {
         free( file );
         return NULL;
@@ -566,7 +590,8 @@ httpd_redirect_t *httpd_RedirectNew( httpd_host_t *host, char *psz_url_dst,
 {
     httpd_redirect_t *rdir = malloc( sizeof( httpd_redirect_t ) );
 
-    if( !( rdir->url = httpd_UrlNewUnique( host, psz_url_src, NULL, NULL ) ) )
+    if( !( rdir->url = httpd_UrlNewUnique( host, psz_url_src, NULL, NULL,
+                                           NULL, 0 ) ) )
     {
         free( rdir );
         return NULL;
@@ -741,12 +766,14 @@ static int httpd_StreamCallBack( httpd_callback_sys_t *p_sys,
 
 httpd_stream_t *httpd_StreamNew( httpd_host_t *host,
                                  char *psz_url, char *psz_mime,
-                                 char *psz_user, char *psz_password )
+                                 char *psz_user, char *psz_password,
+                                 char **ppsz_hosts, int i_hosts )
 {
     httpd_stream_t *stream = malloc( sizeof( httpd_stream_t ) );
 
     if( ( stream->url = httpd_UrlNewUnique( host, psz_url, psz_user,
-                                            psz_password ) ) == NULL )
+                                            psz_password, ppsz_hosts, i_hosts )
+        ) == NULL )
     {
         free( stream );
         return NULL;
@@ -848,32 +875,32 @@ void httpd_StreamDelete( httpd_stream_t *stream )
 /*****************************************************************************
  * Low level
  *****************************************************************************/
-#define LISTEN_BACKLOG          100
-
-#if defined( WIN32 ) || defined( UNDER_CE )
-#define SOCKET_CLOSE(a)    closesocket(a)
-#else
-#define SOCKET_CLOSE(a)    close(a)
-#endif
-
 static void httpd_HostThread( httpd_host_t * );
-static int BuildAddr( struct sockaddr_in * p_socket,
-                      const char * psz_address, int i_port );
-
 
 /* create a new host */
-httpd_host_t *httpd_HostNew( vlc_object_t *p_this, char *psz_host, int i_port )
+httpd_host_t *httpd_HostNew( vlc_object_t *p_this, const char *psz_host,
+                             int i_port )
+{
+    return httpd_TLSHostNew( p_this, psz_host, i_port, NULL, NULL, NULL, NULL
+                           );
+}
+
+httpd_host_t *httpd_TLSHostNew( vlc_object_t *p_this, const char *psz_hostname,
+                                int i_port,
+                                const char *psz_cert, const char *psz_key,
+                                const char *psz_ca, const char *psz_crl )
 {
     httpd_t      *httpd;
     httpd_host_t *host;
-    vlc_value_t lockval;
-    struct sockaddr_in sock;
+    tls_server_t *p_tls;
+    char *psz_host;
+    vlc_value_t  lockval;
     int i;
 
-    /* resolv */
-    if( BuildAddr( &sock, psz_host, i_port ) )
+    psz_host = strdup( psz_hostname );
+    if( psz_host == NULL )
     {
-        msg_Err( p_this, "cannot build address for %s:%d", psz_host, i_port );
+        msg_Err( p_this, "memory error" );
         return NULL;
     }
 
@@ -888,6 +915,7 @@ httpd_host_t *httpd_HostNew( vlc_object_t *p_this, char *psz_host, int i_port )
         if( ( httpd = vlc_object_create( p_this, VLC_OBJECT_HTTPD ) ) == NULL )
         {
             vlc_mutex_unlock( lockval.p_address );
+            free( psz_host );
             return NULL;
         }
 
@@ -899,90 +927,79 @@ httpd_host_t *httpd_HostNew( vlc_object_t *p_this, char *psz_host, int i_port )
     }
 
     /* verify if it already exist */
-    for( i = 0; i < httpd->i_host; i++ )
+    for( i = httpd->i_host - 1; i >= 0; i-- )
+    {
+        host = httpd->host[i];
+
+        /* cannot mix TLS and non-TLS hosts */
+        if( ( ( httpd->host[i]->p_tls != NULL ) != ( psz_cert != NULL ) )
+         || ( host->i_port != i_port )
+         || strcmp( host->psz_hostname, psz_hostname ) )
+            continue;
+
+        /* yep found */
+        host->i_ref++;
+
+        vlc_mutex_unlock( lockval.p_address );
+        return host;
+    }
+
+    host = NULL;
+
+    /* determine TLS configuration */
+    if ( psz_cert != NULL )
     {
-        if( httpd->host[i]->sock.sin_port == sock.sin_port &&
-            ( httpd->host[i]->sock.sin_addr.s_addr == INADDR_ANY ||
-              httpd->host[i]->sock.sin_addr.s_addr == sock.sin_addr.s_addr ) )
+        p_tls = tls_ServerCreate( p_this, psz_cert, psz_key );
+        if ( p_tls == NULL )
         {
-            /* yep found */
-            host = httpd->host[i];
-            host->i_ref++;
+            msg_Err( p_this, "TLS initialization error" );
+            goto error;
+        }
 
-            vlc_mutex_unlock( lockval.p_address );
+        if ( ( psz_ca != NULL) && tls_ServerAddCA( p_tls, psz_ca ) )
+        {
+            msg_Err( p_this, "TLS CA error" );
+            goto error;
+        }
 
-            msg_Dbg( p_this, "host already registered" );
-            return host;
+        if ( ( psz_crl != NULL) && tls_ServerAddCRL( p_tls, psz_crl ) )
+        {
+            msg_Err( p_this, "TLS CRL error" );
+            goto error;
         }
     }
+    else
+        p_tls = NULL;
+
     /* create the new host */
     host = vlc_object_create( p_this, sizeof( httpd_host_t ) );
     host->httpd = httpd;
     vlc_mutex_init( httpd, &host->lock );
     host->i_ref = 1;
-    memcpy( &host->sock, &sock, sizeof( struct sockaddr_in ) );
+
+    host->fd = net_ListenTCP( p_this, psz_host, i_port );
+    if( host->fd == NULL )
+    {
+        msg_Err( p_this, "cannot create socket(s) for HTTP host" );
+        goto error;
+    }
+       
+    host->i_port = i_port;
+    host->psz_hostname = psz_host;
+
     host->i_url     = 0;
     host->url       = NULL;
     host->i_client  = 0;
     host->client    = NULL;
 
-    /* create the listening socket */
-    if( ( host->fd = socket( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
-    {
-        goto socket_error;
-    }
-    /* reuse socket */
-    i = 1;
-    if( setsockopt( host->fd, SOL_SOCKET, SO_REUSEADDR,
-                    (void *) &i, sizeof( i ) ) < 0 )
-    {
-        msg_Warn( p_this, "cannot configure socket (SO_REUSEADDR)" );
-    }
-    /* bind it */
-    if( bind( host->fd, (struct sockaddr *)&host->sock,
-        sizeof( struct sockaddr_in ) ) < 0 )
-    {
-        msg_Err( p_this, "cannot bind socket" );
-        goto socket_error;
-    }
-    /* set to non-blocking */
-#if defined( WIN32 ) || defined( UNDER_CE )
-    {
-        unsigned long i_dummy = 1;
-        if( ioctlsocket( host->fd, FIONBIO, &i_dummy ) != 0 )
-        {
-            msg_Err( p_this, "cannot set socket to non-blocking mode" );
-            goto socket_error;
-        }
-    }
-#else
-    {
-        unsigned int i_flags;
-        if( ( i_flags = fcntl( host->fd, F_GETFL, 0 ) ) < 0 )
-        {
-            msg_Err( p_this, "cannot F_GETFL socket" );
-            goto socket_error;
-        }
-        if( fcntl( host->fd, F_SETFL, i_flags | O_NONBLOCK ) < 0 )
-        {
-            msg_Err( p_this, "cannot F_SETFL O_NONBLOCK" );
-            goto socket_error;
-        }
-    }
-#endif
-    /* listen */
-    if( listen( host->fd, LISTEN_BACKLOG ) < 0 )
-    {
-        msg_Err( p_this, "cannot listen socket" );
-        goto socket_error;
-    }
+    host->p_tls = p_tls;
 
     /* create the thread */
     if( vlc_thread_create( host, "httpd host thread", httpd_HostThread,
                            VLC_THREAD_PRIORITY_LOW, VLC_FALSE ) )
     {
         msg_Err( p_this, "cannot spawn http host thread" );
-        goto socket_error;
+        goto error;
     }
 
     /* now add it to httpd */
@@ -991,18 +1008,26 @@ httpd_host_t *httpd_HostNew( vlc_object_t *p_this, char *psz_host, int i_port )
 
     return host;
 
-socket_error:
+error:
+    free( psz_host );
+    if( httpd->i_host <= 0 )
+    {
+        vlc_object_release( httpd );
+        vlc_object_detach( httpd );
+        vlc_object_destroy( httpd );
+    }
     vlc_mutex_unlock( lockval.p_address );
 
-    if( host->fd > 0 )
+    if( host != NULL )
     {
-        SOCKET_CLOSE( host->fd );
+        net_ListenClose( host->fd );
+        vlc_mutex_destroy( &host->lock );
+        vlc_object_destroy( host );
     }
-    vlc_mutex_destroy( &host->lock );
-    vlc_object_destroy( host );
 
-    /* TODO destroy no more used httpd TODO */
-    vlc_object_release( httpd );
+    if( p_tls != NULL )
+        tls_ServerDelete( p_tls );
+
     return NULL;
 }
 
@@ -1018,8 +1043,6 @@ void httpd_HostDelete( httpd_host_t *host )
     var_Get( httpd->p_libvlc, "httpd_mutex", &lockval );
     vlc_mutex_lock( lockval.p_address );
 
-    vlc_object_release( httpd );
-
     host->i_ref--;
     if( host->i_ref > 0 )
     {
@@ -1052,13 +1075,19 @@ void httpd_HostDelete( httpd_host_t *host )
         /* TODO */
     }
 
-    SOCKET_CLOSE( host->fd );
+    if( host->p_tls != NULL)
+        tls_ServerDelete( host->p_tls );
+
+    net_ListenClose( host->fd );
+    free( host->psz_hostname );
+
     vlc_mutex_destroy( &host->lock );
     vlc_object_destroy( host );
 
     if( httpd->i_host <= 0 )
     {
         msg_Info( httpd, "httpd doesn't reference any host, deleting" );
+        vlc_object_release( httpd );
         vlc_object_detach( httpd );
         vlc_object_destroy( httpd );
     }
@@ -1068,6 +1097,7 @@ void httpd_HostDelete( httpd_host_t *host )
 /* register a new url */
 static httpd_url_t *httpd_UrlNewPrivate( httpd_host_t *host, char *psz_url,
                                          char *psz_user, char *psz_password,
+                                         char **ppsz_hosts, int i_hosts,
                                          vlc_bool_t b_check )
 {
     httpd_url_t *url;
@@ -1095,6 +1125,12 @@ static httpd_url_t *httpd_UrlNewPrivate( httpd_host_t *host, char *psz_url,
     url->psz_url = strdup( psz_url );
     url->psz_user = strdup( psz_user ? psz_user : "" );
     url->psz_password = strdup( psz_password ? psz_password : "" );
+    url->i_hosts = 0;
+    url->ppsz_hosts = NULL;
+    for( i = 0; i < i_hosts; i++ )
+    {
+        TAB_APPEND( url->i_hosts, url->ppsz_hosts, strdup(ppsz_hosts[i]) );
+    }
     for( i = 0; i < HTTPD_MSG_MAX; i++ )
     {
         url->catch[i].cb = NULL;
@@ -1108,17 +1144,19 @@ static httpd_url_t *httpd_UrlNewPrivate( httpd_host_t *host, char *psz_url,
 }
 
 httpd_url_t *httpd_UrlNew( httpd_host_t *host, char *psz_url,
-                           char *psz_user, char *psz_password )
+                           char *psz_user, char *psz_password,
+                           char **ppsz_hosts, int i_hosts )
 {
     return httpd_UrlNewPrivate( host, psz_url, psz_user,
-                                psz_password, VLC_FALSE );
+                                psz_password, ppsz_hosts, i_hosts, VLC_FALSE );
 }
 
 httpd_url_t *httpd_UrlNewUnique( httpd_host_t *host, char *psz_url,
-                                 char *psz_user, char *psz_password )
+                                 char *psz_user, char *psz_password,
+                                 char **ppsz_hosts, int i_hosts )
 {
     return httpd_UrlNewPrivate( host, psz_url, psz_user,
-                                psz_password, VLC_TRUE );
+                                psz_password, ppsz_hosts, i_hosts, VLC_TRUE );
 }
 
 /* register callback on a url */
@@ -1147,6 +1185,10 @@ void httpd_UrlDelete( httpd_url_t *url )
     free( url->psz_url );
     free( url->psz_user );
     free( url->psz_password );
+    for( i = 0; i < url->i_hosts; i++ )
+    {
+        TAB_REMOVE( url->i_hosts, url->ppsz_hosts, url->ppsz_hosts[0] );
+    }
 
     for( i = 0; i < host->i_client; i++ )
     {
@@ -1268,7 +1310,7 @@ static void httpd_ClientInit( httpd_client_t *cl )
 {
     cl->i_state = HTTPD_CLIENT_RECEIVING;
     cl->i_activity_date = mdate();
-    cl->i_activity_timeout = 50000000LL;
+    cl->i_activity_timeout = I64C(10000000);
     cl->i_buffer_size = 10000;
     cl->i_buffer = 0;
     cl->p_buffer = malloc( cl->i_buffer_size );
@@ -1291,15 +1333,36 @@ void httpd_ClientModeBidir( httpd_client_t *cl )
 
 char* httpd_ClientIP( httpd_client_t *cl )
 {
-    /* FIXME not thread safe */
-    return strdup( inet_ntoa( cl->sock.sin_addr ) );
+    int i;
+    char sz_ip[NI_MAXNUMERICHOST + 2];
+
+    i = vlc_getnameinfo( (const struct sockaddr *)&cl->sock, cl->i_sock_size,
+                         sz_ip+1, NI_MAXNUMERICHOST, NULL, NI_NUMERICHOST );
+
+    if( i != 0 )
+        return NULL;
+
+    /* semi-colon in address => must add bracket for HTTP */        
+    if( strchr( sz_ip + 1, ':' ) != NULL )
+    {
+        sz_ip[0] = '[';
+        i = strlen( sz_ip );
+        sz_ip[i++] = ']';
+        sz_ip[i] = '\0';
+
+        return strdup(sz_ip);
+    }
+    
+    return strdup(sz_ip + 1);
 }
 
 static void httpd_ClientClean( httpd_client_t *cl )
 {
-    if( cl->fd > 0 )
+    if( cl->fd >= 0 )
     {
-        SOCKET_CLOSE( cl->fd );
+        if( cl->p_tls != NULL )
+            tls_ServerSessionClose( cl->p_tls );
+        net_Close( cl->fd );
         cl->fd = -1;
     }
 
@@ -1313,28 +1376,48 @@ static void httpd_ClientClean( httpd_client_t *cl )
     }
 }
 
-static httpd_client_t *httpd_ClientNew( int fd, struct sockaddr_in *sock )
+static httpd_client_t *httpd_ClientNew( int fd, struct sockaddr_storage *sock,
+                                        int i_sock_size,
+                                        tls_session_t *p_tls )
 {
     httpd_client_t *cl = malloc( sizeof( httpd_client_t ) );
-    /* set this new socket non-block */
-#if defined( WIN32 ) || defined( UNDER_CE )
-    {
-        unsigned long i_dummy = 1;
-        ioctlsocket( fd, FIONBIO, &i_dummy );
-    }
-#else
-    fcntl( fd, F_SETFL, O_NONBLOCK );
-#endif
     cl->i_ref   = 0;
     cl->fd      = fd;
-    cl->sock    = *sock;
+    memcpy( &cl->sock, sock, sizeof( cl->sock ) );
+    cl->i_sock_size = i_sock_size;
     cl->url     = NULL;
+    cl->p_tls = p_tls;
 
     httpd_ClientInit( cl );
 
     return cl;
 }
 
+
+static int httpd_NetRecv( httpd_client_t *cl, char *p, int i_len )
+{
+    tls_session_t *p_tls;
+    
+    p_tls = cl->p_tls;
+    if( p_tls != NULL)
+        return tls_Recv( p_tls, p, i_len );
+
+    return recv( cl->fd, p, i_len, 0 );
+}
+
+
+static int httpd_NetSend( httpd_client_t *cl, const char *p, int i_len )
+{
+    tls_session_t *p_tls;
+
+    p_tls = cl->p_tls;
+    if( p_tls != NULL)
+        return tls_Send( p_tls, p, i_len );
+
+    return send( cl->fd, p, i_len, 0 );
+}
+
+
 static void httpd_ClientRecv( httpd_client_t *cl )
 {
     int i_len;
@@ -1342,8 +1425,8 @@ static void httpd_ClientRecv( httpd_client_t *cl )
     if( cl->query.i_proto == HTTPD_PROTO_NONE )
     {
         /* enought to see if it's rtp over rtsp or RTSP/HTTP */
-        i_len = recv( cl->fd, &cl->p_buffer[cl->i_buffer], 4 - cl->i_buffer, 0 );
-
+        i_len = httpd_NetRecv( cl, &cl->p_buffer[cl->i_buffer],
+                               4 - cl->i_buffer );
         if( i_len > 0 )
         {
             cl->i_buffer += i_len;
@@ -1351,7 +1434,7 @@ static void httpd_ClientRecv( httpd_client_t *cl )
 
         if( cl->i_buffer >= 4 )
         {
-            fprintf( stderr, "peek=%4.4s\n", cl->p_buffer );
+            /*fprintf( stderr, "peek=%4.4s\n", cl->p_buffer );*/
             /* detect type */
             if( cl->p_buffer[0] == '$' )
             {
@@ -1391,8 +1474,8 @@ static void httpd_ClientRecv( httpd_client_t *cl )
     else if( cl->query.i_body > 0 )
     {
         /* we are reading the body of a request or a channel */
-        i_len = recv( cl->fd, &cl->query.p_body[cl->i_buffer],
-                      cl->query.i_body - cl->i_buffer, 0 );
+        i_len = httpd_NetRecv( cl, &cl->query.p_body[cl->i_buffer],
+                               cl->query.i_body - cl->i_buffer );
         if( i_len > 0 )
         {
             cl->i_buffer += i_len;
@@ -1407,7 +1490,7 @@ static void httpd_ClientRecv( httpd_client_t *cl )
         /* we are reading a header -> char by char */
         for( ;; )
         {
-            i_len = recv( cl->fd, &cl->p_buffer[cl->i_buffer], 1, 0 );
+            i_len = httpd_NetRecv (cl, &cl->p_buffer[cl->i_buffer], 1 );
             if( i_len <= 0 )
             {
                 break;
@@ -1465,7 +1548,7 @@ static void httpd_ClientRecv( httpd_client_t *cl )
                     p = NULL;
                     cl->query.i_type = HTTPD_MSG_NONE;
 
-                    fprintf( stderr, "received new request=%s\n", cl->p_buffer);
+                    /*fprintf( stderr, "received new request=%s\n", cl->p_buffer);*/
 
                     for( i = 0; msg_type[i].name != NULL; i++ )
                     {
@@ -1632,8 +1715,12 @@ static void httpd_ClientRecv( httpd_client_t *cl )
     }
     cl->i_activity_date = mdate();
 
+    /* XXX: for QT I have to disable timeout. Try to find why */
+    if( cl->query.i_proto == HTTPD_PROTO_RTSP )
+        cl->i_activity_timeout = 0;
+
     /* Debugging only */
-    if( cl->i_state == HTTPD_CLIENT_RECEIVE_DONE )
+    /*if( cl->i_state == HTTPD_CLIENT_RECEIVE_DONE )
     {
         int i;
 
@@ -1656,9 +1743,10 @@ static void httpd_ClientRecv( httpd_client_t *cl )
             fprintf( stderr, "  - option name='%s' value='%s'\n",
                      cl->query.name[i], cl->query.value[i] );
         }
-    }
+    }*/
 }
 
+
 static void httpd_ClientSend( httpd_client_t *cl )
 {
     int i;
@@ -1700,12 +1788,12 @@ static void httpd_ClientSend( httpd_client_t *cl )
         cl->i_buffer = 0;
         cl->i_buffer_size = (uint8_t*)p - cl->p_buffer;
 
-        fprintf( stderr, "sending answer\n" );
-        fprintf( stderr, "%s",  cl->p_buffer );
+        /*fprintf( stderr, "sending answer\n" );
+        fprintf( stderr, "%s",  cl->p_buffer );*/
     }
 
-    i_len = send( cl->fd, &cl->p_buffer[cl->i_buffer],
-                  cl->i_buffer_size - cl->i_buffer, 0 );
+    i_len = httpd_NetSend( cl, &cl->p_buffer[cl->i_buffer],
+                           cl->i_buffer_size - cl->i_buffer );
     if( i_len > 0 )
     {
         cl->i_activity_date = mdate();
@@ -1759,13 +1847,54 @@ static void httpd_ClientSend( httpd_client_t *cl )
     }
 }
 
+static void httpd_ClientTlsHsIn( httpd_client_t *cl )
+{
+    switch( tls_SessionContinueHandshake( cl->p_tls ) )
+    {
+        case 0:
+            cl->i_state = HTTPD_CLIENT_RECEIVING;
+            break;
+
+        case -1:
+            cl->i_state = HTTPD_CLIENT_DEAD;
+            cl->p_tls = NULL;
+            break;
+
+        case 2:
+            cl->i_state = HTTPD_CLIENT_TLS_HS_OUT;
+    }
+}
+
+static void httpd_ClientTlsHsOut( httpd_client_t *cl )
+{
+    switch( tls_SessionContinueHandshake( cl->p_tls ) )
+    {
+        case 0:
+            cl->i_state = HTTPD_CLIENT_RECEIVING;
+            break;
+
+        case -1:
+            cl->i_state = HTTPD_CLIENT_DEAD;
+            cl->p_tls = NULL;
+            break;
+
+        case 1:
+            cl->i_state = HTTPD_CLIENT_TLS_HS_IN;
+            break;
+    }
+}
+
 static void httpd_HostThread( httpd_host_t *host )
 {
+    tls_session_t *p_tls = NULL;
+
     while( !host->b_die )
     {
         struct timeval  timeout;
         fd_set          fds_read;
         fd_set          fds_write;
+        /* FIXME: (too) many int variables */
+        int             fd, i_fd;
         int             i_handle_max = 0;
         int             i_ret;
         int             i_client;
@@ -1782,8 +1911,18 @@ static void httpd_HostThread( httpd_host_t *host )
         FD_ZERO( &fds_read );
         FD_ZERO( &fds_write );
 
-        FD_SET( host->fd, &fds_read );
-        i_handle_max = host->fd;
+        i_handle_max = -1;
+
+        for( i_fd = 0; (fd = host->fd[i_fd]) != -1; i_fd++ )
+        {
+            FD_SET( fd, &fds_read );
+            if( fd > i_handle_max )
+                i_handle_max = fd;
+        }
+
+        /* prepare a new TLS session */
+        if( ( p_tls == NULL ) && ( host->p_tls != NULL ) )
+            p_tls = tls_ServerSessionPrepare( host->p_tls );
 
         /* add all socket that should be read/write and close dead connection */
         vlc_mutex_lock( &host->lock );
@@ -1793,22 +1932,23 @@ static void httpd_HostThread( httpd_host_t *host )
 
             if( cl->i_ref < 0 || ( cl->i_ref == 0 &&
                 ( cl->i_state == HTTPD_CLIENT_DEAD ||
-                  cl->i_activity_date + cl->i_activity_timeout < mdate() ) ) )
+                  ( cl->i_activity_timeout > 0 &&
+                    cl->i_activity_date+cl->i_activity_timeout < mdate()) ) ) )
             {
-                msg_Dbg( host, "connection closed(%s)",
-                         inet_ntoa(cl->sock.sin_addr) );
                 httpd_ClientClean( cl );
                 TAB_REMOVE( host->i_client, host->client, cl );
                 free( cl );
                 i_client--;
                 continue;
             }
-            else if( cl->i_state == HTTPD_CLIENT_RECEIVING )
+            else if( ( cl->i_state == HTTPD_CLIENT_RECEIVING )
+                  || ( cl->i_state == HTTPD_CLIENT_TLS_HS_IN ) )
             {
                 FD_SET( cl->fd, &fds_read );
                 i_handle_max = __MAX( i_handle_max, cl->fd );
             }
-            else if( cl->i_state == HTTPD_CLIENT_SENDING )
+            else if( ( cl->i_state == HTTPD_CLIENT_SENDING )
+                  || ( cl->i_state == HTTPD_CLIENT_TLS_HS_OUT ) )
             {
                 FD_SET( cl->fd, &fds_write );
                 i_handle_max = __MAX( i_handle_max, cl->fd );
@@ -1919,6 +2059,7 @@ static void httpd_HostThread( httpd_host_t *host )
                 else
                 {
                     vlc_bool_t b_auth_failed = VLC_FALSE;
+                    vlc_bool_t b_hosts_failed = VLC_FALSE;
                     int i;
 
                     /* Search the url and trigger callbacks */
@@ -1930,14 +2071,33 @@ static void httpd_HostThread( httpd_host_t *host )
                         {
                             if( url->catch[i_msg].cb )
                             {
+                                if( answer && url->i_hosts )
+                                {
+                                    char *ip = httpd_ClientIP( cl );
+                                    if( ip != NULL )
+                                    {
+                                        if( net_CheckIP( host, ip,
+                                                         url->ppsz_hosts,
+                                                         url->i_hosts ) <= 0 )
+                                        {
+                                            b_hosts_failed = VLC_TRUE;
+                                            free( ip );
+                                            break;
+                                        }
+                                        free( ip );
+                                    }
+                                }
+
                                 if( answer && ( *url->psz_user || *url->psz_password ) )
                                 {
                                     /* create the headers */
-                                    char id[strlen(url->psz_user)+strlen(url->psz_password) + 2];
                                     char *b64 = httpd_MsgGet( query, "Authorization" ); /* BASIC id */
-                                    char auth[strlen(b64) +1];
+                                    char *auth;
+                                    char *id;
+
+                                    asprintf( &id, "%s:%s", url->psz_user, url->psz_password );
+                                    auth = malloc( strlen(b64) + 1 );
 
-                                    sprintf( id, "%s:%s", url->psz_user, url->psz_password );
                                     if( !strncasecmp( b64, "BASIC", 5 ) )
                                     {
                                         b64 += 5;
@@ -1956,8 +2116,13 @@ static void httpd_HostThread( httpd_host_t *host )
                                         httpd_MsgAdd( answer, "WWW-Authenticate", "Basic realm=\"%s\"", url->psz_user );
                                         /* We fail for all url */
                                         b_auth_failed = VLC_TRUE;
+                                        free( id );
+                                        free( auth );
                                         break;
                                     }
+
+                                    free( id );
+                                    free( auth );
                                 }
 
                                 if( !url->catch[i_msg].cb( url->catch[i_msg].p_sys, cl, answer, query ) )
@@ -1981,7 +2146,23 @@ static void httpd_HostThread( httpd_host_t *host )
                         answer->i_version= 0;
                         p = answer->p_body = malloc( 1000 + strlen(query->psz_url) );
 
-                        if( b_auth_failed )
+                        if( b_hosts_failed )
+                        {
+                            answer->i_status = 403;
+                            answer->psz_status = strdup( "Forbidden" );
+
+                            p += sprintf( p, "<html>\n" );
+                            p += sprintf( p, "<head>\n" );
+                            p += sprintf( p, "<title>Error 403</title>\n" );
+                            p += sprintf( p, "</head>\n" );
+                            p += sprintf( p, "<body>\n" );
+                            p += sprintf( p, "<h1><center> 403 Forbidden (%s)</center></h1>\n", query->psz_url );
+                            p += sprintf( p, "<hr />\n" );
+                            p += sprintf( p, "<a href=\"http://www.videolan.org\">VideoLAN</a>\n" );
+                            p += sprintf( p, "</body>\n" );
+                            p += sprintf( p, "</html>\n" );
+                        }
+                        else if( b_auth_failed )
                         {
                             answer->i_status = 401;
                             answer->psz_status = strdup( "Authorization Required" );
@@ -2008,7 +2189,7 @@ static void httpd_HostThread( httpd_host_t *host )
                             p += sprintf( p, "<title>Error 404</title>\n" );
                             p += sprintf( p, "</head>\n" );
                             p += sprintf( p, "<body>\n" );
-                            p += sprintf( p, "<h1><center> 404 Ressource not found(%s)</center></h1>\n", query->psz_url );
+                            p += sprintf( p, "<h1><center> 404 Resource not found(%s)</center></h1>\n", query->psz_url );
                             p += sprintf( p, "<hr />\n" );
                             p += sprintf( p, "<a href=\"http://www.videolan.org\">VideoLAN</a>\n" );
                             p += sprintf( p, "</body>\n" );
@@ -2122,7 +2303,11 @@ static void httpd_HostThread( httpd_host_t *host )
 
         if( i_ret == -1 && errno != EINTR )
         {
-            msg_Warn( host, "cannot select sockets" );
+#if defined(WIN32) || defined(UNDER_CE)
+            msg_Warn( host, "cannot select sockets (%d)", WSAGetLastError( ) );
+#else
+            msg_Warn( host, "cannot select sockets : %s", strerror( errno ) );
+#endif
             msleep( 1000 );
             continue;
         }
@@ -2132,25 +2317,66 @@ static void httpd_HostThread( httpd_host_t *host )
         }
 
         /* accept new connections */
-        if( FD_ISSET( host->fd, &fds_read ) )
+        for( i_fd = 0; (fd = host->fd[i_fd]) != -1; i_fd++ )
         {
-            int     i_sock_size = sizeof( struct sockaddr_in );
-            struct  sockaddr_in sock;
-            int     fd;
-
-            fd = accept( host->fd, (struct sockaddr *)&sock, &i_sock_size );
-            if( fd > 0 )
+            if( FD_ISSET( fd, &fds_read ) )
             {
-                httpd_client_t *cl = httpd_ClientNew( fd, &sock );
-
-                vlc_mutex_lock( &host->lock );
-                TAB_APPEND( host->i_client, host->client, cl );
-                vlc_mutex_unlock( &host->lock );
-
-                msg_Dbg( host, "new connection (%s)",
-                         inet_ntoa(sock.sin_addr) );
+                int     i_sock_size = sizeof( struct sockaddr_storage );
+                struct  sockaddr_storage sock;
+    
+                fd = accept( fd, (struct sockaddr *)&sock, &i_sock_size );
+                if( fd >= 0 )
+                {
+                    int i_state = 0;
+    
+                    /* set this new socket non-block */
+    #if defined( WIN32 ) || defined( UNDER_CE )
+                    {
+                        unsigned long i_dummy = 1;
+                        ioctlsocket( fd, FIONBIO, &i_dummy );
+                    }
+    #else
+                    fcntl( fd, F_SETFL, O_NONBLOCK );
+    #endif
+    
+                    if( p_tls != NULL)
+                    {
+                        switch ( tls_ServerSessionHandshake( p_tls, fd ) )
+                        {
+                            case -1:
+                                msg_Err( host, "Rejecting TLS connection" );
+                                net_Close( fd );
+                                fd = -1;
+                                p_tls = NULL;
+                                break;
+    
+                            case 1: /* missing input - most likely */
+                                i_state = HTTPD_CLIENT_TLS_HS_IN;
+                                break;
+    
+                            case 2: /* missing output */
+                                i_state = HTTPD_CLIENT_TLS_HS_OUT;
+                                break;
+                        }
+                    }
+                    
+                    if( fd >= 0 )
+                    {
+                        httpd_client_t *cl;
+    
+                        cl = httpd_ClientNew( fd, &sock, i_sock_size, p_tls );
+                        p_tls = NULL;
+                        vlc_mutex_lock( &host->lock );
+                        TAB_APPEND( host->i_client, host->client, cl );
+                        vlc_mutex_unlock( &host->lock );
+    
+                        if( i_state != 0 )
+                            cl->i_state = i_state; // override state for TLS
+                    }
+                }
             }
         }
+
         /* now try all others socket */
         vlc_mutex_lock( &host->lock );
         for( i_client = 0; i_client < host->i_client; i_client++ )
@@ -2164,6 +2390,14 @@ static void httpd_HostThread( httpd_host_t *host )
             {
                 httpd_ClientSend( cl );
             }
+            else if( cl->i_state == HTTPD_CLIENT_TLS_HS_IN )
+            {
+                httpd_ClientTlsHsIn( cl );
+            }
+            else if( cl->i_state == HTTPD_CLIENT_TLS_HS_OUT )
+            {
+                httpd_ClientTlsHsOut( cl );
+            }
 
             if( cl->i_mode == HTTPD_CLIENT_BIDIR &&
                 cl->i_state == HTTPD_CLIENT_SENDING &&
@@ -2174,43 +2408,55 @@ static void httpd_HostThread( httpd_host_t *host )
         }
         vlc_mutex_unlock( &host->lock );
     }
-}
 
-static int BuildAddr( struct sockaddr_in * p_socket,
-                      const char * psz_address, int i_port )
-{
-    /* Reset struct */
-    memset( p_socket, 0, sizeof( struct sockaddr_in ) );
-    p_socket->sin_family = AF_INET;                                /* family */
-    p_socket->sin_port = htons( (uint16_t)i_port );
-    if( !*psz_address )
-    {
-        p_socket->sin_addr.s_addr = INADDR_ANY;
-    }
-    else
-    {
-        struct hostent    * p_hostent;
+    if( p_tls != NULL )
+        tls_ServerSessionClose( p_tls );
+}
 
-        /* Try to convert address directly from in_addr - this will work if
-         * psz_address is dotted decimal. */
-#ifdef HAVE_ARPA_INET_H
-        if( !inet_aton( psz_address, &p_socket->sin_addr ) )
-#else
-        p_socket->sin_addr.s_addr = inet_addr( psz_address );
-/*        if( p_socket->sin_addr.s_addr == INADDR_NONE )*/
-        if( p_socket->sin_addr.s_addr == INADDR_BROADCAST )
-#endif
-        {
-            /* We have a fqdn, try to find its address */
-            if ( (p_hostent = gethostbyname( psz_address )) == NULL )
-            {
-                return( -1 );
-            }
+#else /* ENABLE_HTTPD */
 
-            /* Copy the first address of the host in the socket address */
-            memcpy( &p_socket->sin_addr, p_hostent->h_addr_list[0],
-                     p_hostent->h_length );
-        }
-    }
-    return( 0 );
+/* We just define an empty wrapper */
+httpd_host_t *httpd_TLSHostNew( vlc_object_t *a, char *b, int c,
+                                tls_server_t *d )
+{
+    msg_Err( a, "HTTP daemon support is disabled" );
+    return 0;
+}
+httpd_host_t *httpd_HostNew( vlc_object_t *a, char *b, int c )
+{
+    msg_Err( a, "HTTP daemon support is disabled" );
+    return 0;
 }
+void httpd_HostDelete( httpd_host_t *a ){}
+httpd_url_t *httpd_UrlNew( httpd_host_t *a, char *b ){ return 0; }
+httpd_url_t *httpd_UrlNewUnique( httpd_host_t *a, char *b, char *c,
+                                 char *d ){ return 0; }
+int httpd_UrlCatch( httpd_url_t *a, int b, httpd_callback_t c,
+                    httpd_callback_sys_t *d ){ return 0; }
+void httpd_UrlDelete( httpd_url_t *a ){}
+
+char *httpd_ClientIP( httpd_client_t *a ){ return 0; }
+void httpd_ClientModeStream( httpd_client_t *a ){}
+void httpd_ClientModeBidir( httpd_client_t *a ){}
+
+void httpd_FileDelete( httpd_file_t *a ){}
+httpd_file_t *httpd_FileNew( httpd_host_t *a, char *b, char *c, char *d,
+                             char *e, httpd_file_callback_t f,
+                             httpd_file_sys_t *g ){ return 0; }
+
+void httpd_RedirectDelete( httpd_redirect_t *a ){}
+httpd_redirect_t *httpd_RedirectNew( httpd_host_t *a,
+                                     char *b, char *c ){ return 0; }
+
+void httpd_StreamDelete( httpd_stream_t *a ){}
+int  httpd_StreamHeader( httpd_stream_t *a, uint8_t *b, int c ){ return 0; }
+int  httpd_StreamSend  ( httpd_stream_t *a, uint8_t *b, int c ){ return 0; }
+httpd_stream_t *httpd_StreamNew( httpd_host_t *a, char *b, char *c,
+                                 char *d, char *e ){ return 0; }
+
+void httpd_MsgInit ( httpd_message_t *a ){}
+void httpd_MsgAdd  ( httpd_message_t *a, char *b, char *c, ... ){}
+char *httpd_MsgGet ( httpd_message_t *a, char *b ){ return 0; }
+void httpd_MsgClean( httpd_message_t *a ){}
+
+#endif /* ENABLE_HTTPD */