前言:
在了解Rtsp的协议流中,大多数厂家是有用户认证的,例如国内比较大的 海康 和 大华,当然也有小部分厂家,比如长视科技,做为安全性来说,当然最好是需要用户认证的.
一 、基本认证是http 1.0提出的认证方案，其消息传输不经过加密转换因此存在严重的安全隐患。
1.1 客户端发送DESCRIBE请求到前端设备，URL中携带请求的URL地址
DESCRIBE rtsp://192.168.1.55:554/live/1/video.sdp?token=A00453FR805a54C8
RTSP/1.0\r\n
CSeq: 1\r\n
Accept: application/sdp\r\n
User-agent: Realplayer\r\n\r\n
2、设备认证通过,发送 WWW-Authenticate认证请求
RTSP/1.0 401 Unauthorized\r\n
CSeq: 1\r\n
WWW-Authenticate: Basic realm="RTSPD"\r\n\r\n
此时客户端程序会弹出用户名名密码认证窗口,输入认证信息后,
DESCRIBE rtsp://192.168.1.55:554/live/1/video.sdp?token=A00453FR805a54C8
RTSP/1.0\r\n
CSeq: 2\r\n
Accept: application/sdp\r\n
User-Agent: RealMedia Player HelixDNAClient/12.0.1.647 (win32)\r\n
Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n
其中“YWRtaW46YWRtaW4=”为前端设备访问username:password明文的base64编码
二 、摘要认证
摘要认证是http 1.1提出的基本认证的替代方案，其消息经过MD5哈希转换因此具有更高的安全性。现在以Vlc 播放大华摄像头rtsp 视屏流协议为列,进行说明(海康的也是一样)
1、 客户端第一次建立连接
Request: OPTIONS rtsp://192.168.20.248:554 RTSP/1.0\r\n
CSeq: 2\r\n
User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
\r\n
次时客户端会响应401 用户需要认证,
Response: RTSP/1.0 401 Unauthorized\r\n
CSeq: 2\r\n
WWW-Authenticate: Digest realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44"\r\n
2、通过上一步Rtsp server 返回的 realm 和 nonce 计算出 Authorization,然后重新获取请求,在请求中加上 Authorization
Request: OPTIONS rtsp://192.168.20.248:554 RTSP/1.0\r\n
CSeq: 3\r\n
Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554", response="1a68d298f0f816f6186f82d2103a0c06"\r\n
User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
次时Rtsp Server 会返回 200，也会回应 OPTIONS ,返回支持的方法
Response: RTSP/1.0 200 OK\r\n
CSeq: 3\r\n
Server: Rtsp Server/3.0\r\n
Public: OPTIONS, DESCRIBE, ANNOUNCE, SETUP, PLAY, RECORD, PAUSE, TEARDOWN, SET_PARAMETER,
GET_PARAMETER\r\n
\r\n
3、 client 发送 DESCRIBE 请求
Request: DESCRIBE rtsp://192.168.20.248:554 RTSP/1.0\r\n
CSeq: 4\r\n
Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554", response="9bdab1c8607cc1111dd62d7d9be239fc"\r\n
User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
Accept: application/sdp\r\n
\r\n
此时Rtsp Server 会响应请求
Real Time Streaming Protocol
Response: RTSP/1.0 200 OK\r\n
CSeq: 4\r\n
x-Accept-Dynamic-Rate: 1\r\n
Content-Base: rtsp://192.168.20.248:554/\r\n
Cache-Control: must-revalidate\r\n
Content-length: 474
Content-type: application/sdp
\r\n
Session Description Protocol
Session Description Protocol Version (v): 0
Owner/Creator, Session Id (o): - 2251942013 2251942013 IN IP4 0.0.0.0
Session Name (s): Media Server
Connection Information (c): IN IP4 0.0.0.0
Time Description, active time (t): 0 0
Session Attribute (a): control:*
Session Attribute (a): packetization-supported:DH
Session Attribute (a): rtppayload-supported:DH
Session Attribute (a): range:npt=now-
Media Description, name and address (m): video 0 RTP/AVP 96
Media Attribute (a): control:trackID=0
Media Attribute (a): framerate:25.000000
Media Attribute (a): rtpmap:96 H264/90000
Media Attribute (a): fmtp:96 packetization-mode=1;profile-level-id=4D001F;sprop-parameter-sets=Z00AH52oFAFum4CAgKAAAH0AABhqEIAA,aO48gAA=
Media Attribute (a): recvonly
Media Description, name and address (m): audio 0 RTP/AVP 8
Media Attribute (a): control:trackID=1
Media Attribute (a): rtpmap:8 PCMA/16000
Media Attribute (a): recvonly
4、 然后，客户端发起建立连接请求（用同样的方法计算response）
Request: SETUP rtsp://192.168.20.248:554/trackID=0 RTSP/1.0\r\n
CSeq: 5\r\n
Authorization: Digest username="admin", realm="Login to 613254b97c606f068095ee0aefa5cf1c", nonce="278ca141a2831a3cd19c0a8d7ebd2a44", uri="rtsp://192.168.20.248:554/", response="96d3766802cc4714cba75ccc1bdcd180"\r\n
User-Agent: LibVLC/3.0.8 (LIVE555 Streaming Media v2016.11.28)\r\n
Transport: RTP/AVP;unicast;client_port=57210-57211
\r\n
此时如果验证正确,Server 会响应请求
Response: RTSP/1.0 200 OK\r\n
Status: 200
CSeq: 5\r\n
Session: 3840338982;timeout=60
Transport: RTP/AVP/UDP;unicast;client_port=57210-57211;server_port=38976-38977;ssrc=17EFEA00
x-Dynamic-Rate: 1\r\n
\r\n
5、最后 client 端发送播放请求
PLAY rtsp://192.168.123.158:554/11/ RTSP/1.0
CSeq: 5
Authorization: Digest username="admin", realm="HipcamRealServer", nonce="3b27a446bfa49b0c48c3edb83139543d",uri="rtsp://192.168.123.158:554/11/",response="9bfb25badcf52e6826cae5688e26cf6d"
User-Agent: LibVLC/2.0.5(LIVE555 Streaming Media v2012.09.13)
Session: 430786884314920
Range: npt=0.000-
最后 Server端响应视屏流数据
最后
- response字段的计算
RTSP客户端应该使用username + password并计算response:
(1)当password为MD5编码,则
response = md5(password:nonce:md5(public_method:url));
(2)当password为ANSI字符串,则
response= md5(md5(username:realm:password):nonce:md5(public_method:url));
客户端在每次发起不同的请求方法时都需要计算response字段，同样在服务器端校验时也默认采取同样的计算方法。
计算示例:
/**
* @Desc 获取认证信息
* @return
*/
public String getAuthorization(String method){
String hash1 = computeMd5Hash(userName + ":" + realm + ":" + password);
String hash2 = computeMd5Hash(method + ":" + this.mediaUrl);
String hash3 = computeMd5Hash(hash1 + ":" + nonce + ":" + hash2);
String mAuthorization = "Digest username=\"" + userName + "\",realm=\"" + realm + "\",nonce=\"" + nonce + "\",uri=\"" + this.mediaUrl + "\",response=\"" + hash3 ;
return mAuthorization;
}
//computeMd5Hash 为 md5 方法
2、 需要注意的问题
2.1.1、 在做Md5 数字摘要的方法时候,一定要注意,有的MD5之后出来的结果是大写,有的是小写, MD5 值大小写是一样的, 但是如果再进行一次MD5大小写的MD5就不一样了, Rtsp的Authorization 计算是用到两次MD5 ,所以,就出问题了.
2.1.2、 在我做测试的时候被坑过,而且坑了很久,当时用到的是# 的 # AndroidUtilCode 中的md5 方法, 因为它计算出来的结果是大写,导致两次Md5 之后的结果不一样,
2.1.3、 目前经过测试也发现,Rtsp 是用的MD5 小写计算
最后附上我验证过有效的MD5 的方法
private String computeMd5Hash(String buffer) {
MessageDigest md;
try {
md = MessageDigest.getInstance("MD5");
return bytesToHex(md.digest(buffer.getBytes("UTF-8")));
} catch (NoSuchAlgorithmException ignore) {
} catch (UnsupportedEncodingException e) {
}
return "";
}
private static String bytesToHex(byte[] bytes) {
char[] hexChars = new char[bytes.length * 2];
int v;
for (int j = 0; j < bytes.length; j++) {
v = bytes[j] & 0xFF;
hexChars[j * 2] = hexArray[v >>> 4];
hexChars[j * 2 + 1] = hexArray[v & 0x0F];
}
return new String(hexChars);
}
final protected static char[] hexArray = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
3、 如果 Authorization 计算错误,Rtsp server 回一直响应 401 ,下面的是 rtsp 协议的错误码,可以根据提示,找出响应的问题
标准RTSP消息的错误代码–在应答消息的第一行表示
”100”; Continue (all 100 range)
“110”; Connect Timeout
“200”; OK
”201”; Created
”250”; Low on Storage Space
”300”; Multiple Choices
”301”; Moved Permanently
”302”; Moved Temporarily
”303”; See Other
”304”; Not Modified
”305”; Use Proxy
”350”; Going Away
”351”; Load Balancing
”400”; Bad Request
”401”; Unauthorized
”402”; Payment Required
”403”; Forbidden
”404”; Not Found
”405”; Method Not Allowed
”406”; Not Acceptable
”407”; Proxy Authentication Required
”408”; Request Time-out
”410”; Gone
”411”; Length Required
”412”; Precondition Failed
”413”; Request Entity Too Large
”414”; Request-URI Too Large
”415”; Unsupported Media Type
”451”; Parameter Not Understood
”452”; reserved
”453”; Not Enough Bandwidth
”454”; Session Not Found
”455”; Method Not Valid in This State
”456”; Header Field Not Valid for Resource
”457”;InvalidRange
”458”; Parameter Is Read-Only
”459”; Aggregate operation not allowed
”460”; Only aggregate operation allowed
”461”; Unsupported transport
”462”; Destination unreachable
”500”; Internal Server Error
”501”; Not Implemented
”502”; Bad Gateway
”503”; Service Unavailable
”504”; Gateway Time-out
”505”; RTSP Version not supported
”551”; Option not supported
4 、 如果在测试的时候不知道错误在哪,大家可以通过wireshark 或者 fiddler 进行网络抓包, 就可以很清楚的分析了,
本来已经抓Vlc的整个Rtsp 播放流程 的 流程 pcapng 包 ,但是简书上不支持文件传输,所以我就简单截图分享给大家
vlc的播放流程.png
文章参考
https://blog.csdn.net/ameyume/article/details/7441060
https://yqlab.me/archives/25.html
https://blog.csdn.net/leixiaohua1020/article/details/84482592
