rtsp的鉴权MD5验证

这是一条真实的rtsp通信抓包过程

OPTIONS rtsp://192.168.0.46:554/streaming/channels/stream1 RTSP/1.0
CSeq: 2
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)

RTSP/1.0 200 OK
CSeq: 2
Date: Sat, May 18 2019 12:32:05 GMT
Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE

DESCRIBE rtsp://192.168.0.46:554/streaming/channels/stream1 RTSP/1.0
CSeq: 3
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)
Accept: application/sdp

RTSP/1.0 401 Unauthorized
CSeq: 3
Date: Sat, May 18 2019 12:32:05 GMT
WWW-Authenticate: Digest realm="G4 IPC Living Stream", nonce="8d13534a7a77b1fe49b80cebf22c4adc"

DESCRIBE rtsp://192.168.0.46:554/streaming/channels/stream1 RTSP/1.0
CSeq: 4
Authorization: Digest username="admin", realm="G4 IPC Living Stream", nonce="8d13534a7a77b1fe49b80cebf22c4adc", uri="rtsp://192.168.0.46:554/streaming/channels/stream1", response="d9db3ce61bbc983010a6b5805080711e"
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)
Accept: application/sdp

RTSP/1.0 200 OK
CSeq: 4
Date: Sat, May 18 2019 12:32:05 GMT
Content-Base: rtsp://192.168.0.46/streaming/channels/stream1/
Content-Type: application/sdp
Content-Length: 554

v=0
o=- 1558173732855598 1 IN IP4 192.168.0.46
s=IChinaE IPC Camera Stream
i=stream1
t=0 0
a=tool:LIVE555 Streaming Media v2010.07.29
a=type:broadcast
a=control:*
a=range:npt=0-
a=x-qt-text-nam:IChinaE IPC Camera Stream
a=x-qt-text-inf:stream1
m=video 0 RTP/AVP 96
c=IN IP4 0.0.0.0
b=AS:12000
a=rtpmap:96 H264/90000
a=fmtp:96 packetization-mode=1;profile-level-id=64002A;sprop-parameter-sets=Z2QAKq2EAQwgCGEAQwgCGEAQwgCEO1A8ARPyzcBAQECAAAAAAQ==,aO48sA==
a=control:track1
m=audio 0 RTP/AVP 0
c=IN IP4 0.0.0.0
b=AS:64
a=control:track2
SETUP rtsp://192.168.0.46/streaming/channels/stream1/track1 RTSP/1.0
CSeq: 5
Authorization: Digest username="admin", realm="G4 IPC Living Stream", nonce="8d13534a7a77b1fe49b80cebf22c4adc", uri="rtsp://192.168.0.46/streaming/channels/stream1/", response="646bf6cf6a6104d8c1f5ae15e0d7d3d6"
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)
Transport: RTP/AVP;unicast;client_port=50742-50743

RTSP/1.0 200 OK
CSeq: 5
Date: Sat, May 18 2019 12:32:05 GMT
Transport: RTP/AVP;unicast;destination=192.168.0.45;source=192.168.0.46;client_port=50742-50743;server_port=6970-6971
Session: 2784681A

SETUP rtsp://192.168.0.46/streaming/channels/stream1/track2 RTSP/1.0
CSeq: 6
Authorization: Digest username="admin", realm="G4 IPC Living Stream", nonce="8d13534a7a77b1fe49b80cebf22c4adc", uri="rtsp://192.168.0.46/streaming/channels/stream1/", response="646bf6cf6a6104d8c1f5ae15e0d7d3d6"
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)
Transport: RTP/AVP;unicast;client_port=50744-50745
Session: 2784681A

RTSP/1.0 200 OK
CSeq: 6
Date: Sat, May 18 2019 12:32:05 GMT
Transport: RTP/AVP;unicast;destination=192.168.0.45;source=192.168.0.46;client_port=50744-50745;server_port=6972-6973
Session: 2784681A

PLAY rtsp://192.168.0.46/streaming/channels/stream1/ RTSP/1.0
CSeq: 7
Authorization: Digest username="admin", realm="G4 IPC Living Stream", nonce="8d13534a7a77b1fe49b80cebf22c4adc", uri="rtsp://192.168.0.46/streaming/channels/stream1/", response="3c608bdf58da34b663ca237d0c20678d"
User-Agent: LibVLC/2.2.1 (LIVE555 Streaming Media v2014.07.25)
Session: 2784681A
Range: npt=0.000-

RTSP/1.0 200 OK
CSeq: 7
Date: Sat, May 18 2019 12:32:05 GMT
Range: npt=0.000-
Session: 2784681A
RTP-Info: url=rtsp://192.168.0.46/streaming/channels/stream1/track1;seq=3834;rtptime=1944096025,url=rtsp://192.168.0.46/streaming/channels/stream1/track2;seq=8557;rtptime=1537152872

response字段的计算

RTSP客户端应该使用username + password并计算response如下:

(1)当password为MD5编码,则

   response = md5(password:nonce:md5(public_method:url));

(2)当password为ANSI字符串,则

    response= md5(md5(username:realm:password):nonce:md5(public_method:url));

客户端在每次发起不同的请求方法时都需要计算response字段，同样在服务器端校验时也默认采取同样的计算方法。

 

以Cseq为3时的消息举例

C->S发DISCRIBE消息，由于没发username，nonce，uri，response
这些鉴权需要的东西，所以，S->C返回一个401

Cseq为4时，C->S发DISCRIBE消息，发了所有的鉴权消息，根据上边第二个的公式，计算出response应该是多少，然后和收到的response对比，一样，则证明password正确，否则失败

转自：https://blog.csdn.net/wtbee/article/details/9001859