目前直播平台非常的火爆。当前有不少的流媒体CDN，基于rtmp，http-flv和hls协议的。
也可以自己搭建私有的流媒体服务器，目前比较常见的有：Live555，EasyDarwin，Red5，DSS，Wowza，nginx-rtmp
这里重点讲解开源的nginx-rtmp服务器。但是流媒体服务器最大的一个问题就是防盗链和鉴权问题，如何防止流媒体服务器被第三方应用免费使用。
所以需要给nginx-rtmp 添加鉴权机制，大致的方案如下：
启动一个鉴权服务。提供 get_user_token 和 auth 两个api。
给每个主播或者观看直播的人员分配user id 和 token，当填写推流和拉流url需要填写鉴权参数，比如：
推流地址：
格式：推流名称?用户ID&用户Token
拉流地址：
rtmp://192.168.5.238:1982/mytv/abc123?1&1481169468_586597
先下载nginx和nginx-rtmp-module源代码
https://www.nginx.com/
https://github.com/arut/nginx-rtmp-module
在nginx-rtmp-module中的ngx_rtmp_cmd_module.c添加鉴权方法：
int auth(const char *auth_info)
{
int ret = 0;
int fd = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in address;
bzero(&address,sizeof(address));
address.sin_family=AF_INET;
address.sin_addr.s_addr=inet_addr("127.0.0.1");
address.sin_port=htons(8888);
//设置读写操作超时时间
struct timeval tv;
tv.tv_sec = 3;
tv.tv_usec = 0;
setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
ret = connect(fd, (struct sockaddr *)&address, sizeof(address));
if(ret != 0)
{
ngx_log_stderr(0, "connect to auth svr failed, fd:%d, ret:%d, errno:%d, errmsg:%s\n",
fd, ret, errno, strerror(errno));
close(fd);
return ret;
}
ngx_log_stderr(0, "connect to auth svr success!\n");
char *pos = NULL;
pos = strchr(auth_info, '&');
if(pos == NULL)
{
ngx_log_stderr(0, "auth_info is invalid.\n");
close(fd);
return -1;
}
char user_id[100] = {0};
char token[100] = {0};
strncpy(user_id, auth_info, (unsigned int)(pos-auth_info));
strncpy(token, pos+1, (unsigned int)(auth_info+strlen(auth_info)-pos-1));
char req[1024] = {0};
snprintf(req, 1024, "{\"head\":{\"cmd\":\"auth\", \"time\":%llu}, \"body\":{\"user_id\":%s, \"token\":\"%s\"}}\n",
(unsigned long long)time(NULL), user_id, token);
ret = send(fd, req, strlen(req), 0);
if(ret > 0)
{
ngx_log_stderr(0, "send auth req success!\n");
}
else
{
ngx_log_stderr(0, "send auth req failed!, ret:%d\n", ret);
close(fd);
return -1;
}
char rsp[1024] = {0};
ret = recv(fd, rsp, 1023, 0);
if(ret > 0 )
{
ngx_log_stderr(0, "rsp from auth svr:%s\n", rsp);
char *pos = NULL;
pos = strstr(rsp, "err");
if(pos == NULL)
{
ngx_log_stderr(0, "rsq is invalid.\n");
close(fd);
return -1;
}
char err = *(pos+5);
if(err == '0')
{
ngx_log_stderr(0, "auth success!\n");
close(fd);
return 0;
}
else
{
ngx_log_stderr(0, "auth failed!\n");
close(fd);
return -1;
}
}
else if(ret == 0)
{
ngx_log_stderr(0, "socket is colse!\n");
close(fd);
return -1;
}
else
{
ngx_log_stderr(0, "recv failed, ret:%d\n", ret);
}
close(fd);
return ret;
}
将鉴权方法在nginx-rtmp-module中的ngx_rtmp_cmd_module.c的推流初始化方法（如下）
static ngx_int_t ngx_rtmp_cmd_publish_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h, ngx_chain_t *in)
调用鉴权方法，具体代码如下：
static ngx_int_t
ngx_rtmp_cmd_publish_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
ngx_chain_t *in)
{
static ngx_rtmp_publish_t v;
static ngx_rtmp_amf_elt_t in_elts[] = {
/* transaction is always 0 */
{ NGX_RTMP_AMF_NUMBER,
ngx_null_string,
NULL, 0 },
{ NGX_RTMP_AMF_NULL,
ngx_null_string,
NULL, 0 },
{ NGX_RTMP_AMF_STRING,
ngx_null_string,
&v.name, sizeof(v.name) },
{ NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_STRING,
ngx_null_string,
&v.type, sizeof(v.type) },
};
ngx_memzero(&v, sizeof(v));
if (ngx_rtmp_receive_amf(s, in, in_elts,
sizeof(in_elts) / sizeof(in_elts[0])))
{
return NGX_ERROR;
}
ngx_rtmp_cmd_fill_args(v.name, v.args);
ngx_log_error(NGX_LOG_INFO, s->connection->log, 0,
"publish: name='%s' args='%s' type=%s silent=%d",
v.name, v.args, v.type, v.silent);
//添加调用鉴权函数
int ret = auth((const char*)v.args);
if (ret != 0)
{
ngx_log_error(NGX_LOG_INFO, s->connection->log, 0, "auth failed!");
return NGX_ERROR;
}
return ngx_rtmp_publish(s, &v);
}在播放回调函数中也要调用鉴权方法，具体代码如下：
static ngx_int_t
ngx_rtmp_cmd_play_init(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,
ngx_chain_t *in)
{
static ngx_rtmp_play_t v;
static ngx_rtmp_amf_elt_t in_elts[] = {
/* transaction is always 0 */
{ NGX_RTMP_AMF_NUMBER,
ngx_null_string,
NULL, 0 },
{ NGX_RTMP_AMF_NULL,
ngx_null_string,
NULL, 0 },
{ NGX_RTMP_AMF_STRING,
ngx_null_string,
&v.name, sizeof(v.name) },
{ NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_NUMBER,
ngx_null_string,
&v.start, 0 },
{ NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_NUMBER,
ngx_null_string,
&v.duration, 0 },
{ NGX_RTMP_AMF_OPTIONAL | NGX_RTMP_AMF_BOOLEAN,
ngx_null_string,
&v.reset, 0 }
};
ngx_memzero(&v, sizeof(v));
if (ngx_rtmp_receive_amf(s, in, in_elts,
sizeof(in_elts) / sizeof(in_elts[0])))
{
return NGX_ERROR;
}
ngx_rtmp_cmd_fill_args(v.name, v.args);
ngx_log_error(NGX_LOG_INFO, s->connection->log, 0,
"play: name='%s' args='%s' start=%i duration=%i "
"reset=%i silent=%i",
v.name, v.args, (ngx_int_t) v.start,
(ngx_int_t) v.duration, (ngx_int_t) v.reset,
(ngx_int_t) v.silent);
//调用鉴权操作
int ret = auth((const char*)v.args);
if (ret != 0)
{
ngx_log_error(NGX_LOG_INFO, s->connection->log, 0, "auth failed!");
return NGX_ERROR;
}
return ngx_rtmp_play(s, &v);
}重新编译nginx源代码
#./configure --prefix=/home/xucuiping/tool/src/nginx_self/sdk --add-module=/home/xucuiping/tool/src/nginx_self/src/nginx-rtmp-module-master --with-debug
#make
#make install
启动nginx
#./nginx -c /home/xucuiping/tool/src/nginx_self/sdk/conf/nginx_rtmp.conf
测试：
通过OBS推流和RTMP播放器测试验证。
原文地址：http://blog.csdn.net/cui918/article/details/53540397
在此表示感谢！