Skip to content

Z
ZLMediaKit
Commit 55560150 by xiongziliang
Options

添加访问http目录权限事件

parent ce9a9188
正在显示 包含 580 行增加 和 1 行删除
server/WebApi.cpp
......@@ -667,6 +667,12 @@ void installWebApi() {
val["close"] = true;
});
API_REGIST(hook,on_http_access,{
//能访问根目录10分钟
val["path"] = "/";
val["second"] = 10 * 60;
});
}
......
server/WebHook.cpp
......@@ -38,6 +38,7 @@
#include "Http/HttpRequester.h"
#include "Network/TcpSession.h"
#include "Rtsp/RtspSession.h"
#include "Http/HttpSession.h"
using namespace Json;
using namespace toolkit;
......@@ -69,6 +70,7 @@ const char kOnStreamNotFound[] = HOOK_FIELD"on_stream_not_found";
const char kOnRecordMp4[] = HOOK_FIELD"on_record_mp4";
const char kOnShellLogin[] = HOOK_FIELD"on_shell_login";
const char kOnStreamNoneReader[] = HOOK_FIELD"on_stream_none_reader";
const char kOnHttpAccess[] = HOOK_FIELD"on_http_access";
const char kAdminParams[] = HOOK_FIELD"admin_params";
onceToken token([](){
......@@ -84,6 +86,7 @@ onceToken token([](){
mINI::Instance()[kOnRecordMp4] = "https://127.0.0.1/index/hook/on_record_mp4";
mINI::Instance()[kOnShellLogin] = "https://127.0.0.1/index/hook/on_shell_login";
mINI::Instance()[kOnStreamNoneReader] = "https://127.0.0.1/index/hook/on_stream_none_reader";
mINI::Instance()[kOnHttpAccess] = "https://127.0.0.1/index/hook/on_http_access";
mINI::Instance()[kAdminParams] = "secret=035c73f7-bb6b-4889-a715-d9eb2d1925cc";
},nullptr);
}//namespace Hook
......@@ -188,6 +191,8 @@ void installWebHook(){
GET_CONFIG(string,hook_record_mp4,Hook::kOnRecordMp4);
GET_CONFIG(string,hook_shell_login,Hook::kOnShellLogin);
GET_CONFIG(string,hook_stream_none_reader,Hook::kOnStreamNoneReader);
GET_CONFIG(string,hook_http_access,Hook::kOnHttpAccess);
NoticeCenter::Instance().addListener(nullptr,Broadcast::kBroadcastMediaPublish,[](BroadcastMediaPublishArgs){
if(!hook_enable || args._param_strs == hook_adminparams || hook_publish.empty() || sender.get_peer_ip() == "127.0.0.1"){
......@@ -377,6 +382,37 @@ void installWebHook(){
});
NoticeCenter::Instance().addListener(nullptr,Broadcast::kBroadcastHttpAccess,[](BroadcastHttpAccessArgs){
if(!hook_enable || args._param_strs == hook_adminparams || hook_http_access.empty() ){
//这种情况下随便访问,先让他随便访问1分钟，之后可能开启鉴权
invoker("/",60);
return;
}
ArgsType body;
body["ip"] = sender.get_peer_ip();
body["port"] = sender.get_peer_port();
body["id"] = sender.getIdentifier();
body["path"] = path;
body["is_dir"] = is_dir;
body["params"] = parser.Params();
body["content"] = parser.Content();
for(auto &pr : parser.getValues()){
body[string("header.") + pr.first] = pr.second;
}
//执行hook
do_http_hook(hook_http_access,body, [invoker](const Value &obj,const string &err){
if(!err.empty()){
//如果接口访问失败，那么10秒内该客户端都没有访问http服务器的权限
invoker("",10);
return;
}
//path参数是该客户端能访问的根目录，该目录下的所有文件它都能访问
//second参数规定该cookie超时时间,超过这个时间后，用户需要重新鉴权
invoker(obj["path"].asString(),obj["second"].asInt());
});
});
}
void unInstallWebHook(){
......
src/Common/config.cpp
......@@ -57,6 +57,7 @@ namespace Broadcast {
const char kBroadcastMediaChanged[] = "kBroadcastMediaChanged";
const char kBroadcastRecordMP4[] = "kBroadcastRecordMP4";
const char kBroadcastHttpRequest[] = "kBroadcastHttpRequest";
const char kBroadcastHttpAccess[] = "kBroadcastHttpAccess";
const char kBroadcastOnGetRtspRealm[] = "kBroadcastOnGetRtspRealm";
const char kBroadcastOnRtspAuth[] = "kBroadcastOnRtspAuth";
const char kBroadcastMediaPlayed[] = "kBroadcastMediaPlayed";
......
src/Common/config.h
......@@ -79,6 +79,10 @@ extern const char kBroadcastRecordMP4[];
extern const char kBroadcastHttpRequest[];
#define BroadcastHttpRequestArgs const Parser &parser,const HttpSession::HttpResponseInvoker &invoker,bool &consumed,TcpSession &sender
//收到http 访问文件或目录的广播
extern const char kBroadcastHttpAccess[];
#define BroadcastHttpAccessArgs const Parser &parser,const MediaInfo &args,const string &path,const bool &is_dir,const HttpSession::HttpAccessPathInvoker &invoker,TcpSession &sender
//该流是否需要认证？是的话调用invoker并传入realm,否则传入空的realm.如果该事件不监听则不认证
extern const char kBroadcastOnGetRtspRealm[];
#define BroadcastOnGetRtspRealmArgs const MediaInfo &args,const RtspSession::onGetRealm &invoker,TcpSession &sender
......
src/Http/CookieManager.cpp 0 → 100644
/*
* MIT License
*
* Copyright (c) 2016-2019 xiongziliang <771730766@qq.com>
*
* This file is part of ZLMediaKit(https://github.com/xiongziliang/ZLMediaKit).
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#include "Util/util.h"
#include "Util/MD5.h"
#include "Common/config.h"
#include "CookieManager.h"
//////////////////////////////CookieData////////////////////////////////////
CookieData::CookieData(const CookieManager::Ptr &manager,
const string &cookie,
const string &uid,
uint64_t max_elapsed,
const string &path){
_uid = uid;
_max_elapsed = max_elapsed;
_cookie_uuid = cookie;
_path = path;
_manager = manager;
manager->onAddCookie(path,uid,cookie);
}
CookieData::~CookieData() {
auto strongManager = _manager.lock();
if(strongManager){
strongManager->onDelCookie(_path,_uid,_cookie_uuid);
}
}
string CookieData::getCookie(const string &cookie_name) const {
return (StrPrinter << cookie_name << "=" << _cookie_uuid << ";expires=" << cookieExpireTime() << ";path=" << _path);
}
bool CookieData::isExpired() {
return _ticker.elapsedTime() > _max_elapsed * 1000;
}
void CookieData::updateTime() {
_ticker.resetTime();
}
const string & CookieData::getUid() const{
return _uid;
}
string CookieData::cookieExpireTime() const{
char buf[64];
time_t tt = time(NULL) + _max_elapsed;
strftime(buf, sizeof buf, "%a, %b %d %Y %H:%M:%S GMT", gmtime(&tt));
return buf;
}
const string& CookieData::getCookie() const {
return _cookie_uuid;
}
const string& CookieData::getPath() const{
return _path;
}
//////////////////////////////CookieManager////////////////////////////////////
INSTANCE_IMP(CookieManager);
CookieData::Ptr CookieManager::addCookie(const string &uidIn, int max_client ,uint64_t max_elapsed, const string &path) {
lock_guard<recursive_mutex> lck(_mtx_cookie);
auto cookie = _geneator.obtain();
auto uid = uidIn.empty() ? cookie : uidIn;
auto oldCookie = getOldestCookie(uid, max_client , path);
if(!oldCookie.empty()){
//假如该账号已经登录了，那么删除老的cookie。
//目的是实现单账号多地登录时挤占登录
delCookie(oldCookie,path);
}
CookieData::Ptr data(new CookieData(shared_from_this(),cookie,uid,max_elapsed,path));
//保存该账号下的新cookie
_map_cookie[path][cookie] = data;
return data;
}
bool CookieManager::delCookie(const CookieData::Ptr &cookie) {
if(!cookie){
return false;
}
return delCookie(cookie->getPath(),cookie->getCookie());
}
bool CookieManager::delCookie(const string &path , const string &cookie) {
lock_guard<recursive_mutex> lck(_mtx_cookie);
auto it = _map_cookie.find(path);
if(it == _map_cookie.end()){
return false;
}
return it->second.erase(cookie);
}
CookieData::Ptr CookieManager::getCookie(const string &cookie, const string &path) {
lock_guard<recursive_mutex> lck(_mtx_cookie);
auto it_path = _map_cookie.find(path);
if(it_path == _map_cookie.end()){
//该path下没有任何cookie
return nullptr;
}
auto it_cookie = it_path->second.find(cookie);
if(it_cookie == it_path->second.end()){
//该path下没有对应的cookie
return nullptr;
}
if(it_cookie->second->isExpired()){
//cookie过期
it_path->second.erase(it_cookie);
return nullptr;
}
return it_cookie->second;
}
CookieData::Ptr CookieManager::getCookie(const StrCaseMap &http_header, const string &cookie_name, const string &path) {
auto it = http_header.find("Cookie");
if (it == http_header.end()) {
return nullptr;
}
auto cookie = FindField(it->second.data(), (cookie_name + "=").data(), ";");
if (!cookie.size()) {
cookie = FindField(it->second.data(), (cookie_name + "=").data(), nullptr);
}
if(cookie.empty()){
return nullptr;
}
return CookieManager::Instance().getCookie(cookie, path);
}
CookieManager::CookieManager() {
//定时删除过期的cookie，防止内存膨胀
_timer = std::make_shared<Timer>(10,[this](){
onManager();
return true;
}, nullptr);
}
CookieManager::~CookieManager() {
_timer.reset();
}
void CookieManager::onManager() {
lock_guard<recursive_mutex> lck(_mtx_cookie);
//先遍历所有path
for(auto it_path = _map_cookie.begin() ; it_path != _map_cookie.end() ;){
//再遍历该path下的所有cookie
for (auto it_cookie = it_path->second.begin() ; it_cookie != it_path->second.end() ; ){
if(it_cookie->second->isExpired()){
//cookie过期,移除记录
WarnL << it_cookie->second->getUid() << " cookie过期";
it_cookie = it_path->second.erase(it_cookie);
continue;
}
++it_cookie;
}
if(it_path->second.empty()){
//该path下没有任何cooki记录,移除之
WarnL << "该path下没有任何cooki记录:" << it_path->first;
it_path = _map_cookie.erase(it_path);
continue;
}
++it_path;
}
}
void CookieManager::onAddCookie(const string &path,const string &uid,const string &cookie){
//添加新的cookie，我们记录下这个uid下有哪些cookie，目的是实现单账号多地登录时挤占登录
lock_guard<recursive_mutex> lck(_mtx_cookie);
//相同用户下可以存在多个cookie(意味多地登录)，这些cookie根据登录时间的早晚依次排序
_map_uid_to_cookie[path][uid][getCurrentMillisecond()] = cookie;
}
void CookieManager::onDelCookie(const string &path,const string &uid,const string &cookie){
lock_guard<recursive_mutex> lck(_mtx_cookie);
//回收随机字符串
_geneator.release(cookie);
auto it_path = _map_uid_to_cookie.find(path);
if(it_path == _map_uid_to_cookie.end()){
//该path下未有任意用户登录
return;
}
auto it_uid = it_path->second.find(uid);
if(it_uid == it_path->second.end()){
//该用户尚未登录
return;
}
//遍历同一名用户下的所有客户端，移除命中的客户端
for(auto it_cookie = it_uid->second.begin() ; it_cookie != it_uid->second.end() ; ++it_cookie ){
if(it_cookie->second != cookie) {
//不是该cookie
continue;
}
//移除该用户名下的某个cookie，这个设备cookie将失效
it_uid->second.erase(it_cookie);
if(it_uid->second.size() != 0) {
break;
}
//该用户名下没有任何设备在线，移除之
it_path->second.erase(it_uid);
if(it_path->second.size() != 0) {
break;
}
//该path下未有任何用户在线，移除之
_map_uid_to_cookie.erase(it_path);
break;
}
}
string CookieManager::getOldestCookie(const string &uid, int max_client,const string &path){
lock_guard<recursive_mutex> lck(_mtx_cookie);
auto it_path = _map_uid_to_cookie.find(path);
if(it_path == _map_uid_to_cookie.end()){
//该路径下未有任意cookie
return "";
}
auto it_uid = it_path->second.find(uid);
if(it_uid == it_path->second.end()){
//该用户从未登录过
return "";
}
if(it_uid->second.size() < MAX(1,max_client)){
//同一名用户下，客户端个数还没达到限制个数
return "";
}
//客户端个数超过限制，移除最先登录的客户端
return it_uid->second.begin()->second;
}
/////////////////////////////////CookieGeneator////////////////////////////////////
string CookieGeneator::obtain(){
//获取唯一的防膨胀的随机字符串
while (true){
auto str = obtain_l();
if(_obtained.find(str) == _obtained.end()){
//没有重复
_obtained.emplace(str);
return str;
}
}
}
void CookieGeneator::release(const string &str){
//从防膨胀库中移除
_obtained.erase(str);
}
string CookieGeneator::obtain_l(){
//12个伪随机字节 + 4个递增的整形字节，然后md5即为随机字符串
auto str = makeRandStr(12,false);
str.append((char *)&_index, sizeof(_index));
++_index;
return MD5(str).hexdigest();
}
\ No newline at end of file
src/Http/CookieManager.h 0 → 100644
/*
* MIT License
*
* Copyright (c) 2016-2019 xiongziliang <771730766@qq.com>
*
* This file is part of ZLMediaKit(https://github.com/xiongziliang/ZLMediaKit).
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#ifndef SRC_HTTP_COOKIEMANAGER_H
#define SRC_HTTP_COOKIEMANAGER_H
#include <memory>
#include <unordered_map>
#include "Util/mini.h"
#include "Util/TimeTicker.h"
#include "Network/Socket.h"
#include "Rtsp/Rtsp.h"
using namespace std;
using namespace toolkit;
using namespace mediakit;
#define COOKIE_DEFAULT_LIFE (7 * 24 * 60 * 60)
class CookieManager;
/**
* cookie对象，用于保存cookie的一些相关属性
*/
class CookieData : public mINI , public noncopyable{
public:
typedef std::shared_ptr<CookieData> Ptr;
/**
* 构建cookie
* @param manager cookie管理者对象
* @param cookie cookie随机字符串
* @param uid 用户唯一id
* @param max_elapsed 最大过期时间，单位秒
* @param path http路径，譬如/index/files/
*/
CookieData(const std::shared_ptr<CookieManager> &manager,const string &cookie,
const string &uid,uint64_t max_elapsed,const string &path);
~CookieData() ;
/**
* 获取uid
* @return uid
*/
const string &getUid() const;
/**
* 获取http中Set-Cookie字段的值
* @param cookie_name 该cookie的名称，譬如 MY_SESSION
* @return 例如 MY_SESSION=XXXXXX;expires=Wed, Jun 12 2019 06:30:48 GMT;path=/index/files/
*/
string getCookie(const string &cookie_name) const;
/**
* 获取cookie随机字符串
* @return cookie随机字符串
*/
const string& getCookie() const;
/**
* 获取该cookie对应的path
* @return
*/
const string& getPath() const;
/**
* 更新该cookie的过期时间，可以让此cookie不失效
*/
void updateTime();
/**
* 判断该cookie是否过期
* @return
*/
bool isExpired();
private:
string cookieExpireTime() const ;
private:
string _uid;
string _path;
string _cookie_uuid;
uint64_t _max_elapsed;
Ticker _ticker;
std::weak_ptr<CookieManager> _manager;
};
/**
* cookie随机字符串生成器
*/
class CookieGeneator{
public:
CookieGeneator() = default;
~CookieGeneator() = default;
/**
* 获取不碰撞的随机字符串
* @return 随机字符串
*/
string obtain();
/**
* 释放随机字符串
* @param str 随机字符串
*/
void release(const string &str);
private:
string obtain_l();
private:
//碰撞库
unordered_set<string> _obtained;
//增长index，防止碰撞用
int _index = 0;
};
/**
* cookie管理器，用于管理cookie的生成以及过期管理，同时实现了同账号异地挤占登录功能
* 该对象实现了同账号最多登录若干个设备
*/
class CookieManager : public std::enable_shared_from_this<CookieManager> {
public:
typedef std::shared_ptr<CookieManager> Ptr;
friend class CookieData;
~CookieManager();
/**
* 获取单例
*/
static CookieManager &Instance();
/**
* 添加cookie
* @param uid 用户id，如果为空则为匿名登录
* @param max_client 该账号最多登录多少个设备
* @param max_elapsed 该cookie过期时间，单位秒
* @param path 该cookie对应的http路径
* @return cookie对象
*/
CookieData::Ptr addCookie(const string &uid, int max_client , uint64_t max_elapsed = COOKIE_DEFAULT_LIFE,const string &path = "/" );
/**
* 根据cookie随机字符串查找cookie对象
* @param cookie cookie随机字符串
* @param path 该cookie对应的http路径
* @return cookie对象，可以为nullptr
*/
CookieData::Ptr getCookie(const string &cookie,const string &path = "/");
/**
* 从http头中获取cookie对象
* @param http_header http头
* @param cookie_name cookie名
* @param path http路径
* @return cookie对象
*/
CookieData::Ptr getCookie(const StrCaseMap &http_header,const string &cookie_name , const string &path = "/");
/**
* 删除cookie，用户登出时使用
* @param cookie cookie对象，可以为nullptr
* @return
*/
bool delCookie(const CookieData::Ptr &cookie);
/**
* 获取某用户名下最先登录时的cookie，目的是实现某用户下最多登录若干个设备
* @param path http路径
* @param uid 用户id
* @param max_client 最多登录的设备个数
* @return 最早的cookie随机字符串
*/
string getOldestCookie( const string &uid, int max_client ,const string &path = "/");
private:
CookieManager();
void onManager();
/**
* 构造cookie对象时触发，目的是记录某账号下多个cookie
* @param path http路径
* @param uid 用户id
* @param cookie cookie随机字符串
*/
void onAddCookie(const string &path,const string &uid,const string &cookie);
/**
* 析构cookie对象时触发
* @param path http路径
* @param uid 用户id
* @param cookie cookie随机字符串
*/
void onDelCookie(const string &path,const string &uid,const string &cookie);
/**
* 删除cookie
* @param path http路径
* @param cookie cookie随机字符串
* @return 成功true
*/
bool delCookie(const string &path,const string &cookie);
private:
unordered_map<string/*path*/,unordered_map<string/*cookie*/,CookieData::Ptr/*cookie_data*/> >_map_cookie;
unordered_map<string/*path*/,unordered_map<string/*uid*/,map<uint64_t/*cookie time stamp*/,string/*cookie*/> > >_map_uid_to_cookie;
recursive_mutex _mtx_cookie;
Timer::Ptr _timer;
CookieGeneator _geneator;
};
#endif //SRC_HTTP_COOKIEMANAGER_H
src/Http/HttpSession.h
......@@ -35,6 +35,7 @@
#include "RtmpMuxer/FlvMuxer.h"
#include "HttpRequestSplitter.h"
#include "WebSocketSplitter.h"
#include "CookieManager.h"
using namespace std;
using namespace toolkit;
......@@ -51,6 +52,8 @@ public:
const KeyValue &headerOut,
const string &contentOut)> HttpResponseInvoker;
typedef std::function<void(const string &accessPath, int cookieLifeSecond)> HttpAccessPathInvoker;
HttpSession(const Socket::Ptr &pSock);
virtual ~HttpSession();
......@@ -109,6 +112,17 @@ private:
const string &codeOut,
const KeyValue &headerOut,
const string &contentOut);
/**
* 是否有权限访问某目录或文件
* @param path 文件或目录
* @param is_dir path是否为目录
* @param callback 有权限或无权限的回调
*/
inline void canAccessPath(const string &path,bool is_dir,const function<void(bool canAccess,const CookieData::Ptr &cookie)> &callback);
//获取用户唯一识别id，我们默认为ip+端口号
inline string getClientUid();
private:
Parser _parser;
Ticker _ticker;
......
src/Rtsp/Rtsp.h
......@@ -145,7 +145,8 @@ public:
auto args_pos = _strFullUrl.find('?');
if (args_pos != string::npos) {
_strUrl = _strFullUrl.substr(0, args_pos);
_mapUrlArgs = parseArgs(_strFullUrl.substr(args_pos + 1));
_params = _strFullUrl.substr(args_pos + 1);
_mapUrlArgs = parseArgs(_params);
} else {
_strUrl = _strFullUrl;
}
......@@ -202,11 +203,15 @@ public:
_strMethod.clear();
_strUrl.clear();
_strFullUrl.clear();
_params.clear();
_strTail.clear();
_strContent.clear();
_mapHeaders.clear();
_mapUrlArgs.clear();
}
const string &Params() const {
return _params;
}
void setUrl(const string &url) {
this->_strUrl = url;
......@@ -242,6 +247,7 @@ private:
string _strContent;
string _strNull;
string _strFullUrl;
string _params;
mutable StrCaseMap _mapHeaders;
mutable StrCaseMap _mapUrlArgs;
};
......
Markdown 格式
0% 或
您添加了 0 人 到此讨论。请谨慎行事。
请先完成此评论的编辑！
请 注册 或者 后发表评论