nginx rtmp module添加鉴权机制

目前直播平台非常的火爆。当前有不少的流媒体CDN，基于rtmp，http-flv和hls协议的。

也可以自己搭建私有的流媒体服务器，目前比较常见的有：Live555，EasyDarwin，Red5，DSS，Wowza，nginx-rtmp

这里重点讲解开源的nginx-rtmp服务器。但是流媒体服务器最大的一个问题就是防盗链和鉴权问题，如何防止流媒体服务器被第三方应用免费使用。

所以需要给nginx-rtmp 添加鉴权机制，大致的方案如下：

启动一个鉴权服务。提供 get_user_token 和 auth 两个api。

给每个主播或者观看直播的人员分配user id 和 token，当填写推流和拉流url需要填写鉴权参数，比如：

推流地址：

格式：推流名称?用户ID&用户Token

拉流地址：

rtmp://192.168.5.238:1982/mytv/abc123?1&1481169468_586597

先下载nginx和nginx-rtmp-module源代码

https://www.nginx.com/

https://github.com/arut/nginx-rtmp-module

在nginx-rtmp-module中的ngx_rtmp_cmd_module.c添加鉴权方法：

int auth(const char *auth_info)
{
	int ret = 0;
	
	int fd = socket(AF_INET, SOCK_STREAM, 0);
	
	struct sockaddr_in address; 
	bzero(&address,sizeof(address));  
	address.sin_family=AF_INET;  
	address.sin_addr.s_addr=inet_addr("127.0.0.1");
	address.sin_port=htons(8888);  

	//设置读写操作超时时间
	struct timeval tv;
	tv.tv_sec = 3;
	tv.tv_usec = 0;
	setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
	setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
	
	ret = connect(fd, (struct sockaddr *)&address, sizeof(address));
	if(ret != 0)
	{
		ngx_log_stderr(0, "connect to auth svr failed, fd:%d, ret:%d, errno:%d, errmsg:%s\n", 
			fd, ret, errno, strerror(errno));
		close(fd);
		return ret;
	}
	ngx_log_stderr(0, "connect to auth svr success!\n");

	char *pos = NULL;
	pos = strchr(auth_info, '&');
	if(pos == NULL)
	{
		ngx_log_stderr(0, "auth_info is invalid.\n");
		close(fd);
		return -1;
	}

	char user_id[100] = {0};
	char token[100] = {0};
	strncpy(user_id, auth_info, (unsigned int)(pos-auth_info));
	strncpy(token, pos+1, (unsigned int)(auth_info+strlen(auth_info)-pos-1));

	char req[1024] = {0};
	snprintf(req, 1024, "{\"head\":{\"cmd\":\"auth\", \"time\":%llu}, \"body\":{\"user_id\":%s, \"token\":\"%s\"}}\n",
		(unsigned long long)time(NULL), user_id, token);
	ret = send(fd, req, strlen(req), 0);
	if(ret > 0)
	{
		ngx_log_stderr(0, "send auth req success!\n");
	}
	else
	{
		ngx_log_stderr(0, "send auth req failed!, ret:%d\n", ret);
		close(fd);
		return -1;
	}
		
	char rsp[1024] = {0};
	ret = recv(fd, rsp, 1023, 0);
	if(ret > 0 )
	{
		ngx_log_stderr(0, "rsp from auth svr:%s\n", rsp);

		char *pos = NULL;
		pos = strstr(rsp, "err");
		if(pos == NULL)
		{
			ngx_log_stderr(0, "rsq is invalid.\n");
			close(fd);
			return -1;
		}

		char err = *(pos+5);
		if(err == '0')
		{
			ngx_log_stderr(0, "auth success!\n");
			close(fd);
			return 0;
		}
		else
		{
			ngx_log_stderr(0, "auth failed!\n");
			close(fd);
			return -1;
		}
		
	}
	else if(ret == 0)
	{
		ngx_log_stderr(0, "socket is colse!\n");
		close(fd);
		return -1;
	}
	else
	{
		ngx_log_stderr(0, "recv failed, ret:%d\n", ret);
	}

	close(fd);
	return ret;

}

将鉴权方法在nginx-rtmp-module中的ngx_rtmp_cmd_module.c的推流初始化方法（如下）

static ngx_int_t ngx_rtmp_cmd_publish_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h, ngx_chain_t *in)

调用鉴权方法，具体代码如下：

static ngx_int_t
ngx_rtmp_cmd_publish_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
        ngx_chain_t *in)
{
    static ngx_rtmp_publish_t       v;

    static ngx_rtmp_amf_elt_t      in_elts[] = {

        /* transaction is always 0 */
        { NGX_RTMP_AMF_NUMBER,
          ngx_null_string,
          NULL, 0 },

        { NGX_RTMP_AMF_NULL,
          ngx_null_string,
          NULL, 0 },

        { NGX_RTMP_AMF_STRING,
          ngx_null_string,
          &v.name, sizeof(v.name) },

        { NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_STRING,
          ngx_null_string,
          &v.type, sizeof(v.type) },
    };

    ngx_memzero(&v, sizeof(v));

    if (ngx_rtmp_receive_amf(s, in, in_elts,
                             sizeof(in_elts) / sizeof(in_elts[0])))
    {
        return NGX_ERROR;
    }

    ngx_rtmp_cmd_fill_args(v.name, v.args);

    ngx_log_error(NGX_LOG_INFO, s->connection->log, 0,
                  "publish: name='%s' args='%s' type=%s silent=%d",
                  v.name, v.args, v.type, v.silent);

	//添加调用鉴权函数
	int ret = auth((const char*)v.args);
	if (ret != 0)
	{
		ngx_log_error(NGX_LOG_INFO, s->connection->log, 0, "auth failed!");
		return NGX_ERROR;
	}

    return ngx_rtmp_publish(s, &v);
}

在播放回调函数中也要调用鉴权方法，具体代码如下：

static ngx_int_t
ngx_rtmp_cmd_play_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
        ngx_chain_t *in)
{
    static ngx_rtmp_play_t          v;

    static ngx_rtmp_amf_elt_t       in_elts[] = {

        /* transaction is always 0 */
        { NGX_RTMP_AMF_NUMBER,
          ngx_null_string,
          NULL, 0 },

        { NGX_RTMP_AMF_NULL,
          ngx_null_string,
          NULL, 0 },

        { NGX_RTMP_AMF_STRING,
          ngx_null_string,
          &v.name, sizeof(v.name) },

        { NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_NUMBER,
          ngx_null_string,
          &v.start, 0 },

        { NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_NUMBER,
          ngx_null_string,
          &v.duration, 0 },

        { NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_BOOLEAN,
          ngx_null_string,
          &v.reset, 0 }
    };

    ngx_memzero(&v, sizeof(v));

    if (ngx_rtmp_receive_amf(s, in, in_elts,
                             sizeof(in_elts) / sizeof(in_elts[0])))
    {
        return NGX_ERROR;
    }

    ngx_rtmp_cmd_fill_args(v.name, v.args);

    ngx_log_error(NGX_LOG_INFO, s->connection->log, 0,
                  "play: name='%s' args='%s' start=%i duration=%i "
                  "reset=%i silent=%i",
                  v.name, v.args, (ngx_int_t) v.start,
                  (ngx_int_t) v.duration, (ngx_int_t) v.reset,
                  (ngx_int_t) v.silent);

	//调用鉴权操作
	int ret = auth((const char*)v.args);
	if (ret != 0)
	{
		ngx_log_error(NGX_LOG_INFO, s->connection->log, 0, "auth failed!");
		return NGX_ERROR;
	}

    return ngx_rtmp_play(s, &v);
}

重新编译nginx源代码

#./configure --prefix=/home/xucuiping/tool/src/nginx_self/sdk  --add-module=/home/xucuiping/tool/src/nginx_self/src/nginx-rtmp-module-master   --with-debug

#make

#make install

启动nginx

#./nginx -c /home/xucuiping/tool/src/nginx_self/sdk/conf/nginx_rtmp.conf

测试：

通过OBS推流和RTMP播放器测试验证。

原文地址：http://blog.csdn.net/cui918/article/details/53540397

在此表示感谢！