rtsp认证

最新推荐文章于 2024-03-16 23:26:57 发布

香烟头

最新推荐文章于 2024-03-16 23:26:57 发布

阅读量1.5k

点赞数 1

分类专栏：音视频文章标签： rtsp rtsp 认证

原文链接：https://www.jianshu.com/p/df107df10196

版权

音视频专栏收录该内容

29 篇文章 1 订阅

订阅专栏

一、基本认证是http 1.0提出的认证方案，其消息传输不经过加密转换因此存在严重的安全隐患。

1.1 客户端发送DESCRIBE请求到前端设备，URL中携带请求的URL地址

  DESCRIBE rtsp://192.168.1.55:554/live/1/video.sdp?token=A00453FR805a54C8
  RTSP/1.0\r\n
  CSeq: 1\r\n
  Accept: application/sdp\r\n
  User-agent: Realplayer\r\n\r\n

2、设备认证通过,发送 WWW-Authenticate认证请求

  RTSP/1.0 401 Unauthorized\r\n
  CSeq: 1\r\n
  WWW-Authenticate: Basic realm="RTSPD"\r\n\r\n

此时客户端程序会弹出用户名名密码认证窗口,输入认证信息后,

  DESCRIBE rtsp://192.168.1.55:554/live/1/video.sdp?token=A00453FR805a54C8
  RTSP/1.0\r\n
  CSeq: 2\r\n
  Accept: application/sdp\r\n
  User-Agent: RealMedia Player HelixDNAClient/12.0.1.647 (win32)\r\n
  Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n

其中“YWRtaW46YWRtaW4=”为前端设备访问username:password明文的base64编码

二、摘要认证

摘要认证是http 1.1提出的基本认证的替代方案，其消息经过MD5哈希转换因此具有更高的安全性。现在以Vlc 播放大华摄像头rtsp 视屏流协议为列,进行说明(海康的也是一样)

1、客户端第一次建立连接

    Request: OPTIONS rtsp://192.168.20.248:554 RTSP/1.0\r\n
    CSeq: 2\r\n
    User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
    \r\n

次时客户端会响应401 用户需要认证,


    Response: RTSP/1.0 401 Unauthorized\r\n
    CSeq: 2\r\n
    WWW-Authenticate: Digest realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44"\r\n

2、通过上一步Rtsp server 返回的 realm 和 nonce 计算出 Authorization,然后重新获取请求,在请求中加上 Authorization

    Request: OPTIONS rtsp://192.168.20.248:554 RTSP/1.0\r\n
    CSeq: 3\r\n
    Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554", response="1a68d298f0f816f6186f82d2103a0c06"\r\n
    User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n

次时Rtsp Server 会返回 200，也会回应 OPTIONS ,返回支持的方法

    Response: RTSP/1.0 200 OK\r\n
    CSeq: 3\r\n
    Server: Rtsp Server/3.0\r\n
    Public: OPTIONS, DESCRIBE, ANNOUNCE, SETUP, PLAY, RECORD, PAUSE, TEARDOWN, SET_PARAMETER, 
   GET_PARAMETER\r\n
    \r\n

3、 client 发送 DESCRIBE 请求


   Request: DESCRIBE rtsp://192.168.20.248:554 RTSP/1.0\r\n
   CSeq: 4\r\n
   Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554", response="9bdab1c8607cc1111dd62d7d9be239fc"\r\n
   User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
   Accept: application/sdp\r\n
   \r\n

此时Rtsp Server 会响应请求

Real Time Streaming Protocol
    Response: RTSP/1.0 200 OK\r\n
    CSeq: 4\r\n
    x-Accept-Dynamic-Rate: 1\r\n
    Content-Base: rtsp://192.168.20.248:554/\r\n
    Cache-Control: must-revalidate\r\n
    Content-length: 474
    Content-type: application/sdp
    \r\n
    Session Description Protocol
        Session Description Protocol Version (v): 0
        Owner/Creator, Session Id (o): - 2251942013 2251942013 IN IP4 0.0.0.0
        Session Name (s): Media Server
        Connection Information (c): IN IP4 0.0.0.0
        Time Description, active time (t): 0 0
        Session Attribute (a): control:*
        Session Attribute (a): packetization-supported:DH
        Session Attribute (a): rtppayload-supported:DH
        Session Attribute (a): range:npt=now-
        Media Description, name and address (m): video 0 RTP/AVP 96
        Media Attribute (a): control:trackID=0
        Media Attribute (a): framerate:25.000000
        Media Attribute (a): rtpmap:96 H264/90000
        Media Attribute (a): fmtp:96 packetization-mode=1;profile-level-id=4D001F;sprop-parameter-sets=Z00AH52oFAFum4CAgKAAAH0AABhqEIAA,aO48gAA=
        Media Attribute (a): recvonly
        Media Description, name and address (m): audio 0 RTP/AVP 8
        Media Attribute (a): control:trackID=1
        Media Attribute (a): rtpmap:8 PCMA/16000
        Media Attribute (a): recvonly

4、然后，客户端发起建立连接请求（用同样的方法计算response）

    Request: SETUP rtsp://192.168.20.248:554/trackID=0 RTSP/1.0\r\n
    CSeq: 5\r\n
    Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554/", response="96d3766802cc4714cba75ccc1bdcd180"\r\n
    User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
    Transport: RTP/AVP;unicast;client_port=57210-57211
    \r\n

此时如果验证正确,Server 会响应请求

    Response: RTSP/1.0 200 OK\r\n
    Status: 200
    CSeq: 5\r\n
    Session: 3840338982;timeout=60
    Transport: RTP/AVP/UDP;unicast;client_port=57210-57211;server_port=38976-38977;ssrc=17EFEA00
    x-Dynamic-Rate: 1\r\n
    \r\n

5、最后 client 端发送播放请求

  PLAY rtsp://192.168.123.158:554/11/ RTSP/1.0
  CSeq: 5
  Authorization: Digest username="admin", realm="HipcamRealServer", nonce="3b27a446bfa49b0c48c3edb83139543d",uri="rtsp://192.168.123.158:554/11/",response="9bfb25badcf52e6826cae5688e26cf6d"
  User-Agent: LibVLC/2.0.5(LIVE555 Streaming Media v2012.09.13)
  Session: 430786884314920
  Range: npt=0.000-

最后 Server端响应视屏流数据

最后

response字段的计算
RTSP客户端应该使用username + password并计算response:
(1)当password为MD5编码,则
response = md5(password:nonce:md5(public_method:url));
(2)当password为ANSI字符串,则
response= md5(md5(username:realm:password):nonce:md5(public_method:url));
客户端在每次发起不同的请求方法时都需要计算response字段，同样在服务器端校验时也默认采取同样的计算方法。

计算示例:

    /**
     * @Desc 获取认证信息
     * @return
     */
    public String getAuthorization(String method){
        String hash1 = computeMd5Hash(userName + ":" + realm + ":" + password);
        String hash2 = computeMd5Hash(method + ":" + this.mediaUrl);
        String hash3 = computeMd5Hash(hash1 + ":" + nonce + ":" + hash2);
        String mAuthorization = "Digest username=\"" + userName + "\",realm=\"" + realm + "\",nonce=\"" + nonce + "\",uri=\"" + this.mediaUrl + "\",response=\"" + hash3 ;
        return mAuthorization;
    }
//computeMd5Hash 为 md5 方法

2、需要注意的问题
2.1.1、在做Md5 数字摘要的方法时候,一定要注意,有的MD5之后出来的结果是大写,有的是小写, MD5 值大小写是一样的, 但是如果再进行一次MD5大小写的MD5就不一样了, Rtsp的Authorization 计算是用到两次MD5 ,所以,就出问题了.
2.1.2、在我做测试的时候被坑过,而且坑了很久,当时用到的是# 的 # AndroidUtilCode 中的md5 方法, 因为它计算出来的结果是大写,导致两次Md5 之后的结果不一样,
2.1.3、目前经过测试也发现,Rtsp 是用的MD5 小写计算
最后附上我验证过有效的MD5 的方法

    private String computeMd5Hash(String buffer) {
        MessageDigest md;
        try {
            md = MessageDigest.getInstance("MD5");
            return bytesToHex(md.digest(buffer.getBytes("UTF-8")));
        } catch (NoSuchAlgorithmException ignore) {
        } catch (UnsupportedEncodingException e) {
        }
        return "";
    }

    private static String bytesToHex(byte[] bytes) {
        char[] hexChars = new char[bytes.length * 2];
        int v;
        for (int j = 0; j < bytes.length; j++) {
            v = bytes[j] & 0xFF;
            hexChars[j * 2] = hexArray[v >>> 4];
            hexChars[j * 2 + 1] = hexArray[v & 0x0F];
        }
        return new String(hexChars);
    }

    final protected static char[] hexArray = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};

3、如果 Authorization 计算错误,Rtsp server 回一直响应 401 ,下面的是 rtsp 协议的错误码,可以根据提示,找出响应的问题

标准RTSP消息的错误代码–在应答消息的第一行表示

”100”; Continue (all 100 range)

“110”; Connect Timeout

“200”; OK

”201”; Created

”250”; Low on Storage Space

”300”; Multiple Choices

”301”; Moved Permanently

”302”; Moved Temporarily

”303”; See Other

”304”; Not Modified

”305”; Use Proxy

”350”; Going Away

”351”; Load Balancing

”400”; Bad Request

”401”; Unauthorized

”402”; Payment Required

”403”; Forbidden

”404”; Not Found

”405”; Method Not Allowed

”406”; Not Acceptable

”407”; Proxy Authentication Required

”408”; Request Time-out

”410”; Gone

”411”; Length Required

”412”; Precondition Failed

”413”; Request Entity Too Large

”414”; Request-URI Too Large

”415”; Unsupported Media Type

”451”; Parameter Not Understood

”452”; reserved

”453”; Not Enough Bandwidth

”454”; Session Not Found

”455”; Method Not Valid in This State

”456”; Header Field Not Valid for Resource

”457”;InvalidRange

”458”; Parameter Is Read-Only

”459”; Aggregate operation not allowed

”460”; Only aggregate operation allowed

”461”; Unsupported transport

”462”; Destination unreachable

”500”; Internal Server Error

”501”; Not Implemented

”502”; Bad Gateway

”503”; Service Unavailable

”504”; Gateway Time-out

”505”; RTSP Version not supported

”551”; Option not supported

4 、如果在测试的时候不知道错误在哪,大家可以通过wireshark 或者 fiddler 进行网络抓包, 就可以很清楚的分析了,
本来已经抓Vlc的整个Rtsp 播放流程的流程 pcapng 包 ,但是简书上不支持文件传输,所以我就简单截图分享给大家

香烟头

关注

1
点赞
踩
2

收藏

觉得还不错? 一键收藏
1
评论
rtsp认证

一、基本认证是http 1.0提出的认证方案，其消息传输不经过加密转换因此存在严重的安全隐患。1.1 客户端发送DESCRIBE请求到前端设备，URL中携带请求的URL地址 DESCRIBE rtsp://192.168.1.55:554/live/1/video.sdp?token=A00453FR805a54C8 RTSP/1.0\r\n CSeq: 1\r\n Accept: application/sdp\r\n User-agent: Realplayer\r\.
复制链接

扫一扫