Wrong results when used with subs_filter

[alexdjca]

Hi,

I'm using subs_filters because i need to pass some parameter accross the playlists as received in the URL.
But it seems that the secure token module doesn't take in consideration the changes made by the subs filter and appends the token at the end of the URL using ? rather than &

I think in some way my problem is related to THIS

The relevant configuration in my NGINX is the following:

secure_token_akamai $xxx_token {
                key "XXXXXXXXXXX";
                acl "$secure_token_baseuri_comma*";
                param_name "hdntl";
        }

server {
.....
.....
location / {
subs_filter_types application/vnd.apple.mpegurl;
subs_filter m3u8 m3u8$is_args$args;

secure_token $xxx_token;
secure_token_types application/vnd.apple.mpegurl;
secure_token_expires_time 100d;
secure_token_query_token_expires_time 1h;
}
}

The problem here is that if the client sends a request without parameters everything work fine, eg:

# curl -H "Host: whateverhost" http://123.123.123.123/live/stream/master.m3u8

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-STREAM-INF:BANDWIDTH=2890800,RESOLUTION=1280x720,CODECS="avc1.640029,mp4a.40.2"
media_0.m3u8?hdntl=st=1611224135~exp=1611310535~acl=/live/stream/*~hmac=a39f68bce27e5d62221c2e717e89137d00a1540918075486a1476eec25092d82

#EXT-X-STREAM-INF:BANDWIDTH=1680800,RESOLUTION=1024x576,CODECS="avc1.4d401f,mp4a.40.2"
media_1.m3u8?hdntl=st=1611224135~exp=1611310535~acl=/live/stream/*~hmac=a39f68bce27e5d62221c2e717e89137d00a1540918075486a1476eec25092d82

#EXT-X-STREAM-INF:BANDWIDTH=840400,RESOLUTION=853x480,CODECS="avc1.4d401e,mp4a.40.2"
media_2.m3u8?hdntl=st=1611224135~exp=1611310535~acl=/live/stream/*~hmac=a39f68bce27e5d62221c2e717e89137d00a1540918075486a1476eec25092d82

#EXT-X-STREAM-INF:BANDWIDTH=400400,RESOLUTION=640x360,CODECS="avc1.4d401e,mp4a.40.2"
media_3.m3u8?hdntl=st=1611224135~exp=1611310535~acl=/live/stream/*~hmac=a39f68bce27e5d62221c2e717e89137d00a1540918075486a1476eec25092d82

#EXT-X-STREAM-INF:BANDWIDTH=290400,RESOLUTION=427x240,CODECS="avc1.4d4015,mp4a.40.2"
media_4.m3u8?hdntl=st=1611224135~exp=1611310535~acl=/live/stream/*~hmac=a39f68bce27e5d62221c2e717e89137d00a1540918075486a1476eec25092d82

But if i send a request with a parameter this is the result:

# curl -H "Host: whateverhost" http://123.123.123.123/live/stream/master.m3u8?parameter=23123123123

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-STREAM-INF:BANDWIDTH=2890800,RESOLUTION=1280x720,CODECS="avc1.640029,mp4a.40.2"
media_0.m3u8?parameter=23123123123?hdntl=st=1611224262~exp=1611310662~acl=/live/rstream/*~hmac=c006c7865d41c6556a44c9ff9122a1f347107de7544452c8300ad5676c7c31ea

#EXT-X-STREAM-INF:BANDWIDTH=1680800,RESOLUTION=1024x576,CODECS="avc1.4d401f,mp4a.40.2"
media_1.m3u8?parameter=23123123123?hdntl=st=1611224262~exp=1611310662~acl=/live/stream/*~hmac=c006c7865d41c6556a44c9ff9122a1f347107de7544452c8300ad5676c7c31ea

#EXT-X-STREAM-INF:BANDWIDTH=840400,RESOLUTION=853x480,CODECS="avc1.4d401e,mp4a.40.2"
media_2.m3u8?parameter=23123123123?hdntl=st=1611224262~exp=1611310662~acl=/live/stream/*~hmac=c006c7865d41c6556a44c9ff9122a1f347107de7544452c8300ad5676c7c31ea

#EXT-X-STREAM-INF:BANDWIDTH=400400,RESOLUTION=640x360,CODECS="avc1.4d401e,mp4a.40.2"
media_3.m3u8?parameter=23123123123?hdntl=st=1611224262~exp=1611310662~acl=/live/stream/*~hmac=c006c7865d41c6556a44c9ff9122a1f347107de7544452c8300ad5676c7c31ea

#EXT-X-STREAM-INF:BANDWIDTH=290400,RESOLUTION=427x240,CODECS="avc1.4d4015,mp4a.40.2"
media_4.m3u8?parameter=23123123123?hdntl=st=1611224262~exp=1611310662~acl=/live/stream/*~hmac=c006c7865d41c6556a44c9ff9122a1f347107de7544452c8300ad5676c7c31ea

As you can see the url contains 2 x ? while i would expect the token to be preceded by a &

Unfortunately i didn't find any way to change this behavior, neither the possibility to insert the token before the other arguments.

Anyone can help please?

Alex

[erankor]

I don't think it's a bug, more likely it's the execution order of the filters - if this module runs first, and then the subs_filter runs, it makes perfect sense you will get this...
If you compile nginx yourself, you can try to reverse the order of the two --add-module directives, and see what happens.

But anyway, I think there is a much simple solution to what you're trying to do - just change:
secure_token $xxx_token;
to:
secure_token $xxx_token&$args;

And then you don't need substitute at all...

If you don't want the extra & at the end when there are no args, you can use map -

map $args $args_delim {
    "" "";
    default "&";
}
...
secure_token $xxx_token$args_delim$args;