Skip to content

Z
ZLMediaKit
Commit f3e551b3 by xiongziliang
Options

支持可配置化的RTSP登录认证

parent 02aba328
正在显示 包含 344 行增加 和 36 行删除
src/Common/config.cpp
......@@ -52,6 +52,9 @@ const char kBroadcastRtspSrcRegisted[] = "kBroadcastRtspSrcRegisted";
const char kBroadcastRtmpSrcRegisted[] = "kBroadcastRtmpSrcRegisted";
const char kBroadcastRecordMP4[] = "kBroadcastRecordMP4";
const char kBroadcastHttpRequest[] = "kBroadcastHttpRequest";
const char kBroadcastOnGetRtspRealm[] = "kBroadcastOnGetRtspRealm";
const char kBroadcastOnRtspAuth[] = "kBroadcastOnRtspAuth";
} //namespace Broadcast
//代理失败最大重试次数
......@@ -174,9 +177,13 @@ const char kPort[] = RTSP_FIELD"port";
#define RTSP_SERVER_NAME "ZLServer"
const char kServerName[] = RTSP_FIELD"serverName";
const char kAuthBasic[] = RTSP_FIELD"authBasic";
onceToken token([](){
mINI::Instance()[kPort] = RTSP_PORT;
mINI::Instance()[kServerName] = RTSP_SERVER_NAME;
//默认Md5方式认证
mINI::Instance()[kAuthBasic] = 0;
},nullptr);
} //namespace Rtsp
......
src/Common/config.h
......@@ -72,6 +72,15 @@ extern const char kBroadcastRecordMP4[];
extern const char kBroadcastHttpRequest[];
#define BroadcastHttpRequestArgs const Parser &parser,HttpSession::HttpResponseInvoker &invoker,bool &consumed
//该流是否需要认证？是的话调用invoker并传入realm,否则传入空的realm.如果该事件不监听则不认证
extern const char kBroadcastOnGetRtspRealm[];
#define BroadcastOnGetRtspRealmArgs const char *app,const char *stream,const RtspSession::onGetRealm &invoker
//请求认证用户密码事件，user_name为用户名，must_no_encrypt如果为true，则必须提供明文密码(因为此时是base64认证方式),否则会导致认证失败
//获取到密码后请调用invoker并输入对应类型的密码和密码类型，invoker执行时会匹配密码
extern const char kBroadcastOnRtspAuth[];
#define BroadcastOnRtspAuthArgs const char *user_name,bool must_no_encrypt,const RtspSession::onAuth &invoker
} //namespace Broadcast
//代理失败最大重试次数
......@@ -118,6 +127,8 @@ namespace Rtsp {
extern const char kServerName[];
extern const char kPort[];
//是否优先base64方式认证？默认Md5方式认证
extern const char kAuthBasic[];
} //namespace Rtsp
////////////RTMP服务器配置///////////
......
src/Rtsp/Rtsp.h
......@@ -186,20 +186,21 @@ public:
return ret;
}
static StrCaseMap parseArgs(const string &str){
static StrCaseMap parseArgs(const string &str,const char *pair_delim = "&", const char *key_delim = "="){
StrCaseMap ret;
auto arg_vec = split(str, "&");
auto arg_vec = split(str, pair_delim);
for (string &key_val : arg_vec) {
if (!key_val.size()) {
continue;
}
auto key_val_vec = split(key_val, "=");
auto key_val_vec = split(key_val, key_delim);
if (key_val_vec.size() >= 2) {
ret[key_val_vec[0]] = key_val_vec[1];
}
}
return ret;
}
private:
string m_strMethod;
string m_strUrl;
......
src/Rtsp/RtspSession.cpp
......@@ -30,6 +30,7 @@
#include "RtspSession.h"
#include "Device/base64.h"
#include "Util/mini.h"
#include "Util/MD5.h"
#include "Util/onceToken.h"
#include "Util/TimeTicker.h"
#include "Util/NoticeCenter.h"
......@@ -192,33 +193,255 @@ bool RtspSession::handleReq_Options() {
bool RtspSession::handleReq_Describe() {
m_strUrl = m_parser.Url();
if (m_strSession.size() != 0) {
//会话id这时还没生成，这个逻辑可以注释以提高响应速度
return false;
}
if (!findStream()) {
//未找到相应的MediaSource
send_StreamNotFound();
return false;
}
//回复sdp
int n = sprintf(m_pcBuf, "RTSP/1.0 200 OK\r\n"
"CSeq: %d\r\n"
"Server: %s-%0.2f(build in %s)\r\n"
"%s"
"x-Accept-Retransmit: our-retransmit\r\n"
"x-Accept-Dynamic-Rate: 1\r\n"
"Content-Base: %s/\r\n"
"Content-Type: application/sdp\r\n"
"Content-Length: %d\r\n\r\n%s",
m_iCseq, g_serverName.data(),
RTSP_VERSION, RTSP_BUILDTIME,
dateHeader().data(), m_strUrl.data(),
(int) m_strSdp.length(), m_strSdp.data());
send(m_pcBuf, n);
return true;
weak_ptr<RtspSession> weakSelf = dynamic_pointer_cast<RtspSession>(shared_from_this());
//该请求中的认证信息
auto authorization = m_parser["Authorization"];
onGetRealm invoker = [weakSelf,authorization](const string &realm){
if(realm.empty()){
//无需认证,回复sdp
onAuthSuccess(weakSelf);
return;
}
//该流需要认证
onAuthUser(weakSelf,realm,authorization);
};
//广播是否需要认证事件
if(!NoticeCenter::Instance().emitEvent(Broadcast::kBroadcastOnGetRtspRealm,m_strApp.data(),m_strStream.data(),invoker)){
//无人监听此事件，说明无需认证
invoker("");
}
return true;
}
void RtspSession::onAuthSuccess(const weak_ptr<RtspSession> &weakSelf) {
auto strongSelf = weakSelf.lock();
if(!strongSelf){
//本对象已销毁
return;
}
strongSelf->async([weakSelf](){
auto strongSelf = weakSelf.lock();
if(!strongSelf){
//本对象已销毁
return;
}
char response[2 * 1024];
int n = sprintf(response,
"RTSP/1.0 200 OK\r\n"
"CSeq: %d\r\n"
"Server: %s-%0.2f(build in %s)\r\n"
"%s"
"x-Accept-Retransmit: our-retransmit\r\n"
"x-Accept-Dynamic-Rate: 1\r\n"
"Content-Base: %s/\r\n"
"Content-Type: application/sdp\r\n"
"Content-Length: %d\r\n\r\n%s",
strongSelf->m_iCseq, strongSelf->g_serverName.data(),
RTSP_VERSION, RTSP_BUILDTIME,
dateHeader().data(), strongSelf->m_strUrl.data(),
(int) strongSelf->m_strSdp.length(), strongSelf->m_strSdp.data());
strongSelf->send(response, n);
});
}
void RtspSession::onAuthFailed(const weak_ptr<RtspSession> &weakSelf,const string &realm) {
auto strongSelf = weakSelf.lock();
if(!strongSelf){
//本对象已销毁
return;
}
strongSelf->async([weakSelf,realm]() {
auto strongSelf = weakSelf.lock();
if (!strongSelf) {
//本对象已销毁
return;
}
int n;
char response[2 * 1024];
static bool authBasic = mINI::Instance()[Config::Rtsp::kAuthBasic];
if (!authBasic) {
//我们需要客户端优先以md5方式认证
strongSelf->m_strNonce = makeRandStr(32);
n = sprintf(response,
"RTSP/1.0 401 Unauthorized\r\n"
"CSeq: %d\r\n"
"Server: %s-%0.2f(build in %s)\r\n"
"%s"
"WWW-Authenticate:Digest realm=\"%s\",nonce=\"%s\"\r\n\r\n",
strongSelf->m_iCseq, strongSelf->g_serverName.data(),
RTSP_VERSION, RTSP_BUILDTIME,
dateHeader().data(), realm.data(), strongSelf->m_strNonce.data());
}else {
//当然我们也支持base64认证,但是我们不建议这样做
n = sprintf(response,
"RTSP/1.0 401 Unauthorized\r\n"
"CSeq: %d\r\n"
"Server: %s-%0.2f(build in %s)\r\n"
"%s"
"WWW-Authenticate:Basic realm=\"%s\"\r\n\r\n",
strongSelf->m_iCseq, strongSelf->g_serverName.data(),
RTSP_VERSION, RTSP_BUILDTIME,
dateHeader().data(), realm.data());
}
strongSelf->send(response, n);
});
}
void RtspSession::onAuthBasic(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &strBase64){
//base64认证
char user_pwd_buf[512];
av_base64_decode((uint8_t *)user_pwd_buf,strBase64.data(),strBase64.size());
auto user_pwd_vec = Parser::split(user_pwd_buf,":");
if(user_pwd_vec.size() < 2){
//认证信息格式不合法，回复401 Unauthorized
onAuthFailed(weakSelf,realm);
return;
}
auto user = user_pwd_vec[0];
auto pwd = user_pwd_vec[1];
onAuth invoker = [pwd,realm,weakSelf](bool encrypted,const string &good_pwd){
if(!encrypted && pwd == good_pwd){
//提供的是明文密码且匹配正确
onAuthSuccess(weakSelf);
}else{
//密码错误
onAuthFailed(weakSelf,realm);
}
};
//此时必须提供明文密码
bool must_no_encrypt = true;
if(!NoticeCenter::Instance().emitEvent(Broadcast::kBroadcastOnRtspAuth,user.data(),must_no_encrypt,invoker)){
//表明该流需要认证却没监听请求密码事件，这一般是大意的程序所为，警告之
WarnL << "请监听kBroadcastOnRtspAuth事件！";
//但是我们还是忽略认证以便完成播放
//我们输入的密码是明文
invoker(false,pwd);
}
}
static string trim(string str){
while(!str.empty()){
if(str.front()==' ' || str.front()=='"'){
str.erase(0,1);
continue;
}
break;
}
while(!str.empty()){
if(str.back()==' ' || str.back()=='"'){
str.pop_back();
continue;
}
break;
}
return str;
}
void RtspSession::onAuthDigest(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &strMd5){
auto strongSelf = weakSelf.lock();
if(!strongSelf){
return;
}
DebugL << strMd5;
auto mapTmp = Parser::parseArgs(strMd5,",","=");
decltype(mapTmp) map;
for(auto &pr : mapTmp){
map[trim(pr.first)] = trim(pr.second);
}
//check realm
if(realm != map["realm"]){
TraceL << "realm not mached:" << realm << "," << map["realm"];
onAuthFailed(weakSelf,realm);
return ;
}
//check nonce
auto nonce = map["nonce"];
if(strongSelf->m_strNonce != nonce){
TraceL << "nonce not mached:" << nonce << "," << strongSelf->m_strNonce;
onAuthFailed(weakSelf,realm);
return ;
}
//check username and uri
auto username = map["username"];
auto uri = map["uri"];
auto response = map["response"];
if(username.empty() || uri.empty() || response.empty()){
TraceL << "username/uri/response empty:" << username << "," << uri << "," << response;
onAuthFailed(weakSelf,realm);
return ;
}
auto realInvoker = [weakSelf,realm,nonce,uri,username,response](bool ignoreAuth,bool encrypted,const string &good_pwd){
if(ignoreAuth){
//忽略认证
onAuthSuccess(weakSelf);
TraceL << "auth ignored";
return;
}
/*
response计算方法如下：
RTSP客户端应该使用username + password并计算response如下:
(1)当password为MD5编码,则
response = md5( password:nonce:md5(public_method:url) );
(2)当password为ANSI字符串,则
response= md5( md5(username:realm:password):nonce:md5(public_method:url) );
*/
auto encrypted_pwd = good_pwd;
if(!encrypted){
//提供的是明文密码
encrypted_pwd = MD5(username+ ":" + realm + ":" + good_pwd).hexdigest();
}
auto good_response = MD5( encrypted_pwd + ":" + nonce + ":" + MD5(string("DESCRIBE") + ":" + uri).hexdigest()).hexdigest();
if(strcasecmp(good_response.data(),response.data()) == 0){
//认证成功！md5不区分大小写
onAuthSuccess(weakSelf);
TraceL << "onAuthSuccess";
}else{
//认证失败！
onAuthFailed(weakSelf,realm);
TraceL << "onAuthFailed";
}
};
onAuth invoker = [realInvoker](bool encrypted,const string &good_pwd){
realInvoker(false,encrypted,good_pwd);
};
//此时可以提供明文或md5加密的密码
bool must_no_encrypt = false;
if(!NoticeCenter::Instance().emitEvent(Broadcast::kBroadcastOnRtspAuth,username.data(),must_no_encrypt,invoker)){
//表明该流需要认证却没监听请求密码事件，这一般是大意的程序所为，警告之
WarnL << "请监听kBroadcastOnRtspAuth事件！";
//但是我们还是忽略认证以便完成播放
realInvoker(true,true,"");
}
}
void RtspSession::onAuthUser(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &authorization){
//请求中包含认证信息
auto authType = FindField(authorization.data(),NULL," ");
auto authStr = FindField(authorization.data()," ",NULL);
if(authType.empty() || authStr.empty()){
//认证信息格式不合法，回复401 Unauthorized
onAuthFailed(weakSelf,realm);
return;
}
if(authType == "Basic"){
//base64认证，需要明文密码
onAuthBasic(weakSelf,realm,authStr);
}else if(authType == "Digest"){
//md5认证
onAuthDigest(weakSelf,realm,authStr);
}else{
//其他认证方式？不支持！
onAuthFailed(weakSelf,realm);
}
}
inline void RtspSession::send_StreamNotFound() {
int n = sprintf(m_pcBuf, "RTSP/1.0 404 Stream Not Found\r\n"
"CSeq: %d\r\n"
......@@ -593,17 +816,13 @@ inline void RtspSession::send_NotAcceptable() {
send(m_pcBuf, n);
}
void RtspSession::splitRtspUrl(const string &url,string &app,string &stream){
string strHost = FindField(url.data(), "://", "/");
app = FindField(url.data(), (strHost + "/").data(), "/");
stream = FindField(url.data(), (strHost + "/" + app + "/").data(), NULL);
}
inline bool RtspSession::findStream() {
string strHost = FindField(m_strUrl.data(), "://", "/");
m_strApp = FindField(m_strUrl.data(), (strHost + "/").data(), "/");
m_strStream = FindField(m_strUrl.data(), (strHost + "/" + m_strApp + "/").data(), NULL);
auto iPos = m_strStream.find('?');
if(iPos != string::npos ){
m_strStream.erase(iPos);
}
splitRtspUrl(m_strUrl,m_strApp,m_strStream);
RtspMediaSource::Ptr pMediaSrc = RtspMediaSource::find(m_strApp,m_strStream);
if (!pMediaSrc) {
WarnL << "No such stream:" << m_strApp << " " << m_strStream;
......
src/Rtsp/RtspSession.h
......@@ -52,6 +52,11 @@ class RtspSession;
class RtspSession: public TcpLimitedSession<MAX_TCP_SESSION> {
public:
typedef std::shared_ptr<RtspSession> Ptr;
typedef std::function<void(const string &realm)> onGetRealm;
//encrypted为true是则表明是md5加密的密码，否则是明文密码
//在请求明文密码时如果提供md5密码者则会导致认证失败
typedef std::function<void(bool encrypted,const string &pwd_or_md5)> onAuth;
RtspSession(const std::shared_ptr<ThreadPool> &pTh, const Socket::Ptr &pSock);
virtual ~RtspSession();
void onRecv(const Socket::Buffer::Ptr &pBuf) override;
......@@ -83,6 +88,7 @@ private:
void inline send_UnsupportedTransport(); //不支持的传输模式
void inline send_SessionNotFound(); //会话id错误
void inline send_NotAcceptable(); //rtsp同时播放数限制
void splitRtspUrl(const string &url,string &app,string &stream);
inline bool findStream(); //根据rtsp url查找 MediaSource实例
inline void initSender(const std::shared_ptr<RtspSession> &pSession); //处理rtsp over http，quicktime使用的
......@@ -107,6 +113,13 @@ private:
inline void onRcvPeerUdpData(int iTrackIdx, const Socket::Buffer::Ptr &pBuf, const struct sockaddr &addr);
inline void startListenPeerUdpData();
//认证相关
static void onAuthSuccess(const weak_ptr<RtspSession> &weakSelf);
static void onAuthFailed(const weak_ptr<RtspSession> &weakSelf,const string &realm);
static void onAuthUser(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &authorization);
static void onAuthBasic(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &strBase64);
static void onAuthDigest(const weak_ptr<RtspSession> &weakSelf,const string &realm,const string &strMd5);
char *m_pcBuf = nullptr;
Ticker m_ticker;
Parser m_parser; //rtsp解析类
......@@ -143,6 +156,9 @@ private:
bool m_bListenPeerUdpData = false;
RtpBroadCaster::Ptr m_pBrdcaster;
//登录认证
string m_strNonce;
//RTSP over HTTP
function<void(void)> m_onDestory;
bool m_bBase64need = false; //是否需要base64解码
......
tests/test_server.cpp
......@@ -33,6 +33,7 @@
#include "Rtmp/RtmpSession.h"
#include "Http/HttpSession.h"
#include "Shell/ShellSession.h"
#include "Util/MD5.h"
#ifdef ENABLE_OPENSSL
#include "Util/SSLBox.h"
......@@ -57,6 +58,57 @@ using namespace ZL::Shell;
using namespace ZL::Thread;
using namespace ZL::Network;
#define REALM "realm_zlmedaikit"
static onceToken s_token([](){
NoticeCenter::Instance().addListener(nullptr,Config::Broadcast::kBroadcastOnGetRtspRealm,[](BroadcastOnGetRtspRealmArgs){
if(string("1") == stream ){
// live/1需要认证
EventPoller::Instance().async([invoker](){
//该流需要认证，并且设置realm
invoker(REALM);
});
}else{
//我们异步执行invoker。
//有时我们要查询redis或数据库来判断该流是否需要认证，通过invoker的方式可以做到完全异步
EventPoller::Instance().async([invoker](){
//该流我们不需要认证
invoker("");
});
}
});
NoticeCenter::Instance().addListener(nullptr,Config::Broadcast::kBroadcastOnRtspAuth,[](BroadcastOnRtspAuthArgs){
InfoL << "用户：" << user_name << (must_no_encrypt ? " Base64" : " MD5" )<< " 方式登录";
string user = user_name;
//假设我们异步读取数据库
EventPoller::Instance().async([must_no_encrypt,invoker,user](){
if(user == "test0"){
//假设数据库保存的是明文
invoker(false,"pwd0");
return;
}
if(user == "test1"){
//假设数据库保存的是密文
auto encrypted_pwd = MD5(user + ":" + REALM + ":" + "pwd1").hexdigest();
invoker(true,encrypted_pwd);
return;
}
if(user == "test2" && must_no_encrypt){
//假设登录的是test2,并且以base64方式登录，此时我们提供加密密码，那么会导致认证失败
//可以通过这个方式屏蔽base64这种不安全的加密方式
invoker(true,"pwd2");
return;
}
//其他用户密码跟用户名一致
invoker(false,user);
});
});
}, nullptr);
int main(int argc,char *argv[]){
//设置退出信号处理函数
signal(SIGINT, [](int){EventPoller::Instance().shutdown();});
......@@ -68,8 +120,9 @@ int main(int argc,char *argv[]){
//这里是拉流地址，支持rtmp/rtsp协议，负载必须是H264+AAC
//如果是其他不识别的音视频将会被忽略(譬如说h264+adpcm转发后会去除音频)
auto urlList = {"rtmp://live.hkstv.hk.lxdns.com/live/hks",
"rtmp://live.hkstv.hk.lxdns.com/live/hks"
//rtsp链接支持输入用户名密码
"rtsp://admin:jzan123456@192.168.0.122/"};
/*"rtsp://admin:jzan123456@192.168.0.122/"*/};
map<string , PlayerProxy::Ptr> proxyMap;
int i=0;
for(auto &url : urlList){
......@@ -82,13 +135,14 @@ int main(int argc,char *argv[]){
//http://127.0.0.1/record/live/0/2017-04-11/11-09-38.mp4
//rtsp://127.0.0.1/record/live/0/2017-04-11/11-09-38.mp4
//rtmp://127.0.0.1/record/live/0/2017-04-11/11-09-38.mp4
PlayerProxy::Ptr player(new PlayerProxy("live",to_string(i++).data()));
PlayerProxy::Ptr player(new PlayerProxy("live",to_string(i).data()));
//指定RTP over TCP(播放rtsp时有效)
(*player)[RtspPlayer::kRtpType] = PlayerBase::RTP_TCP;
//开始播放，如果播放失败或者播放中止，将会自动重试若干次，重试次数在配置文件中配置，默认一直重试
player->play(url);
//需要保存PlayerProxy，否则作用域结束就会销毁该对象
proxyMap.emplace(url,player);
proxyMap.emplace(to_string(i),player);
++i;
}
#ifdef ENABLE_OPENSSL
......
Markdown 格式
0% 或
您添加了 0 人 到此讨论。请谨慎行事。
请先完成此评论的编辑！
请 注册 或者 后发表评论