Red5/red5-server v2.0.49 on GitHub

Highlights

Spec-compliant AMF0/AMF3 (#415, #497, #498):
- The codecs are cross-checked against Mini-AMF 0.9.1 and Apache BlazeDS 4.7.3, with golden test vectors from both.
- Fixed: reference handling, the AMF0-to-AMF3 switch scope, Vector and Dictionary decoding, the Vector encoders, XML documents and string length limits.
- Fixed: Flex shared objects with AMF3 encoding, Flex message parameters, and status objects on AMF3 connections.
RTMP:
- Data messages on stream 0 decode as calls (#498).
- The connect result carries fmsVer, capabilities and the Enhanced RTMP fourCcList, info maps and capsEx (#498).
- Timestamp discontinuity offsets are applied once per message (#486).
WebSocket:
- Origin checking is on by default, and only same-origin handshakes are accepted (#495).
- Handshakes are bound to the serving application (#488).
- Containers are removed when their context is destroyed (#494).
Resource limits (#488, #494, #496):
- Recording size, duration and free-space limits, including append mode.
- Per-application recording budgets, principal quotas and an opt-in retention policy.
- Shared-object count, size, memory and disk budgets, and idle eviction of persistent shared objects.
- MediaBunny limits per application, plus a per-address cap.
- Fixed: a recording writer thread leak.
TLS: TomcatConnector accepts PEM certificate and key files (#487).

WebSocket origins (#495): browser pages served from a different origin than Red5 need their origin in the allowedOrigins context-param. Reverse proxies must pass Host or X-Forwarded-Host. Set crossOriginPolicy=false to restore the old behavior.
AMF wire changes:
- AMF0 dates are written with time-zone 0.
- AMF0 XML documents carry a U32 length.
- Vector<Number> and Vector<Object> are prefixed with the AMF3 switch marker. Older Red5 peers that sent them without it no longer decode.
- Status and error objects on AMF3 are anonymous objects with the same members as AMF0.
Connect _result: the properties object carries fmsVer (now RED5/2,0,49,0), capabilities and the E-RTMP keys (capsEx, previously CapsEx). The information object always includes objectEncoding.
Data messages on stream 0: a message named on* is delivered as a call instead of being dropped. The server no longer answers a peer's data message with _result.
New limits are off by default. See red5.properties (fileconsumer.*, recording.app.max.bytes, so.*) and the commented examples in the live webapp. The one exception is so.max.name.depth, which defaults to 16.

Full Changelog: v2.0.47...v2.0.49