542 lines
22 KiB
Swift
542 lines
22 KiB
Swift
import Foundation
|
|
import Network
|
|
import os.log
|
|
|
|
private let proxyLog = Logger(subsystem: "nl.vonas.mediacluster.ios", category: "ClearKeyProxy")
|
|
|
|
private final class ResumeOnce: @unchecked Sendable {
|
|
private var done = false
|
|
private let lock = NSLock()
|
|
func run(_ body: () -> Void) {
|
|
lock.lock()
|
|
defer { lock.unlock() }
|
|
guard !done else { return }
|
|
done = true
|
|
body()
|
|
}
|
|
}
|
|
|
|
/// Lokale HTTP-proxy: haalt DASH MPD/segmenten op, strip DRM-metadata, decrypt CENC met ClearKey.
|
|
/// VLC speelt daarna plain DASH vanaf 127.0.0.1.
|
|
final class ClearKeyDashProxy {
|
|
static let shared = ClearKeyDashProxy()
|
|
|
|
private let queue = DispatchQueue(label: "nl.vonas.vmc.clearkey-proxy")
|
|
private var listener: NWListener?
|
|
private var port: UInt16 = 0
|
|
private var remoteManifest: URL?
|
|
private var keyMap: ClearKeyKeyMap?
|
|
private var cryptoState = CencMp4Decryptor.SessionState()
|
|
private var generation = 0
|
|
private let urlSession: URLSession = {
|
|
let cfg = URLSessionConfiguration.ephemeral
|
|
cfg.timeoutIntervalForRequest = 25
|
|
cfg.timeoutIntervalForResource = 60
|
|
cfg.httpMaximumConnectionsPerHost = 8
|
|
cfg.requestCachePolicy = .reloadIgnoringLocalCacheData
|
|
return URLSession(configuration: cfg)
|
|
}()
|
|
|
|
private init() {}
|
|
|
|
var isRunning: Bool { listener != nil && port > 0 }
|
|
|
|
/// Start (of herstart) proxy voor dit manifest + keys. Geeft lokale MPD-URL terug.
|
|
/// Warmt de MPD-fetch op zodat VLC niet meteen een lege/fout-response krijgt.
|
|
func start(manifestURL: URL, keys: [ClearKeyEntry]) async throws -> URL {
|
|
let map = ClearKeyKeyMap(entries: keys)
|
|
guard !map.isEmpty else {
|
|
throw ProxyError.noKeys
|
|
}
|
|
|
|
let boundPort: UInt16 = try await withCheckedThrowingContinuation { cont in
|
|
queue.async {
|
|
self.stopLocked()
|
|
self.remoteManifest = manifestURL
|
|
self.keyMap = map
|
|
self.cryptoState = CencMp4Decryptor.SessionState()
|
|
self.generation += 1
|
|
|
|
let once = ResumeOnce()
|
|
|
|
do {
|
|
let params = NWParameters.tcp
|
|
params.allowLocalEndpointReuse = true
|
|
let listener = try NWListener(using: params, on: .any)
|
|
self.listener = listener
|
|
|
|
listener.stateUpdateHandler = { [weak self] state in
|
|
guard let self else { return }
|
|
switch state {
|
|
case .ready:
|
|
let p = listener.port?.rawValue ?? 0
|
|
self.port = p
|
|
proxyLog.info("listener ready on port \(p, privacy: .public)")
|
|
once.run {
|
|
if p > 0 {
|
|
cont.resume(returning: p)
|
|
} else {
|
|
cont.resume(throwing: ProxyError.bindFailed)
|
|
}
|
|
}
|
|
case .failed(let err):
|
|
proxyLog.error("listener failed: \(String(describing: err), privacy: .public)")
|
|
once.run { cont.resume(throwing: err) }
|
|
default:
|
|
break
|
|
}
|
|
}
|
|
|
|
listener.newConnectionHandler = { [weak self] conn in
|
|
self?.handle(connection: conn)
|
|
}
|
|
listener.start(queue: self.queue)
|
|
|
|
self.queue.asyncAfter(deadline: .now() + 5) {
|
|
once.run { cont.resume(throwing: ProxyError.bindFailed) }
|
|
}
|
|
} catch {
|
|
once.run { cont.resume(throwing: error) }
|
|
}
|
|
}
|
|
}
|
|
|
|
guard boundPort > 0 else { throw ProxyError.bindFailed }
|
|
let gen = generation
|
|
|
|
let (body, _) = try await payload(for: "/manifest.mpd")
|
|
guard !body.isEmpty, gen == generation else {
|
|
throw ProxyError.emptyManifest
|
|
}
|
|
let preview = String(data: body.prefix(200), encoding: .utf8) ?? ""
|
|
proxyLog.info("warmup MPD ok bytes=\(body.count, privacy: .public) head=\(preview, privacy: .public)")
|
|
|
|
guard let local = URL(string: "http://127.0.0.1:\(boundPort)/manifest.mpd") else {
|
|
throw ProxyError.bindFailed
|
|
}
|
|
return local
|
|
}
|
|
|
|
func stop() {
|
|
queue.sync { stopLocked() }
|
|
}
|
|
|
|
private func stopLocked() {
|
|
generation += 1
|
|
listener?.cancel()
|
|
listener = nil
|
|
port = 0
|
|
remoteManifest = nil
|
|
keyMap = nil
|
|
cryptoState = CencMp4Decryptor.SessionState()
|
|
proxyLog.info("proxy stopped")
|
|
}
|
|
|
|
// MARK: - HTTP
|
|
|
|
private func handle(connection: NWConnection) {
|
|
connection.start(queue: queue)
|
|
receiveRequest(on: connection, buffer: Data())
|
|
}
|
|
|
|
private func receiveRequest(on connection: NWConnection, buffer: Data) {
|
|
connection.receive(minimumIncompleteLength: 1, maximumLength: 64 * 1024) { [weak self] data, _, isComplete, error in
|
|
guard let self else {
|
|
connection.cancel()
|
|
return
|
|
}
|
|
if error != nil {
|
|
connection.cancel()
|
|
return
|
|
}
|
|
var buf = buffer
|
|
if let data { buf.append(data) }
|
|
if let range = buf.range(of: Data("\r\n\r\n".utf8)) {
|
|
let headerData = buf.subdata(in: 0..<range.lowerBound)
|
|
self.serve(connection: connection, headerData: headerData)
|
|
return
|
|
}
|
|
if isComplete {
|
|
connection.cancel()
|
|
return
|
|
}
|
|
if buf.count > 256 * 1024 {
|
|
connection.cancel()
|
|
return
|
|
}
|
|
self.receiveRequest(on: connection, buffer: buf)
|
|
}
|
|
}
|
|
|
|
private func serve(connection: NWConnection, headerData: Data) {
|
|
guard let header = String(data: headerData, encoding: .utf8),
|
|
let firstLine = header.split(separator: "\r\n", omittingEmptySubsequences: false).first
|
|
else {
|
|
respond(connection, status: 400, contentType: "text/plain", body: Data("bad request".utf8))
|
|
return
|
|
}
|
|
let parts = firstLine.split(separator: " ")
|
|
guard parts.count >= 2 else {
|
|
respond(connection, status: 400, contentType: "text/plain", body: Data("bad request".utf8))
|
|
return
|
|
}
|
|
let method = String(parts[0])
|
|
let pathAndQuery = String(parts[1])
|
|
guard method == "GET" || method == "HEAD" else {
|
|
respond(connection, status: 405, contentType: "text/plain", body: Data("method".utf8))
|
|
return
|
|
}
|
|
|
|
let rangeHeader = Self.parseHeader(header, name: "Range")
|
|
|
|
Task {
|
|
do {
|
|
let (body, contentType) = try await self.payload(for: pathAndQuery)
|
|
if let rangeHeader, let byteRange = Self.parseByteRange(rangeHeader, total: body.count) {
|
|
let slice = body.subdata(in: byteRange.start..<(byteRange.end + 1))
|
|
if method == "HEAD" {
|
|
self.respond(
|
|
connection,
|
|
status: 206,
|
|
contentType: contentType,
|
|
body: Data(),
|
|
headOnly: true,
|
|
contentLength: slice.count,
|
|
extraHeaders: [
|
|
"Accept-Ranges: bytes",
|
|
"Content-Range: bytes \(byteRange.start)-\(byteRange.end)/\(body.count)",
|
|
]
|
|
)
|
|
} else {
|
|
self.respond(
|
|
connection,
|
|
status: 206,
|
|
contentType: contentType,
|
|
body: slice,
|
|
extraHeaders: [
|
|
"Accept-Ranges: bytes",
|
|
"Content-Range: bytes \(byteRange.start)-\(byteRange.end)/\(body.count)",
|
|
]
|
|
)
|
|
}
|
|
} else if method == "HEAD" {
|
|
self.respond(
|
|
connection,
|
|
status: 200,
|
|
contentType: contentType,
|
|
body: Data(),
|
|
headOnly: true,
|
|
contentLength: body.count,
|
|
extraHeaders: ["Accept-Ranges: bytes"]
|
|
)
|
|
} else {
|
|
self.respond(
|
|
connection,
|
|
status: 200,
|
|
contentType: contentType,
|
|
body: body,
|
|
extraHeaders: ["Accept-Ranges: bytes"]
|
|
)
|
|
}
|
|
} catch {
|
|
let msg = error.localizedDescription
|
|
proxyLog.error("serve \(pathAndQuery, privacy: .public) → \(msg, privacy: .public)")
|
|
self.respond(connection, status: 502, contentType: "text/plain; charset=utf-8", body: Data(msg.utf8))
|
|
}
|
|
}
|
|
}
|
|
|
|
private func payload(for pathAndQuery: String) async throws -> (Data, String) {
|
|
guard let keyMap, let remoteManifest else {
|
|
throw ProxyError.notStarted
|
|
}
|
|
let split = pathAndQuery.split(separator: "?", maxSplits: 1).map(String.init)
|
|
let pathOnly = split.first ?? pathAndQuery
|
|
let query = split.count > 1 ? split[1] : nil
|
|
|
|
if pathOnly == "/" || pathOnly == "/manifest.mpd" {
|
|
let raw = try await fetch(remoteManifest)
|
|
guard let xml = String(data: raw, encoding: .utf8), !xml.isEmpty else {
|
|
// Sommige CDN's sturen UTF-16 BOM; probeer lossy.
|
|
let lossy = String(decoding: raw, as: UTF8.self)
|
|
guard !lossy.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
|
|
throw ProxyError.emptyManifest
|
|
}
|
|
let rewritten = rewriteMpd(lossy, mpdURL: remoteManifest)
|
|
return (Data(rewritten.utf8), "application/dash+xml")
|
|
}
|
|
let rewritten = rewriteMpd(xml, mpdURL: remoteManifest)
|
|
if !rewritten.localizedCaseInsensitiveContains("<MPD") {
|
|
throw ProxyError.emptyManifest
|
|
}
|
|
return (Data(rewritten.utf8), "application/dash+xml")
|
|
}
|
|
|
|
if pathOnly.hasPrefix("/a/") {
|
|
let b64 = String(pathOnly.dropFirst(3))
|
|
guard var url = decodeURL(b64) else { throw ProxyError.badPath }
|
|
if let query, url.query == nil {
|
|
var comps = URLComponents(url: url, resolvingAgainstBaseURL: false)
|
|
comps?.percentEncodedQuery = query
|
|
if let u = comps?.url { url = u }
|
|
}
|
|
return try await fetchAndDecrypt(url, keys: keyMap)
|
|
}
|
|
|
|
if pathOnly.hasPrefix("/p/") {
|
|
let rest = String(pathOnly.dropFirst(3))
|
|
guard let slash = rest.firstIndex(of: "/") else { throw ProxyError.badPath }
|
|
let b64 = String(rest[..<slash])
|
|
var rel = String(rest[rest.index(after: slash)...])
|
|
if let query {
|
|
rel += (rel.contains("?") ? "&" : "?") + query
|
|
}
|
|
guard let base = decodeURL(b64) else { throw ProxyError.badPath }
|
|
let joined = join(base: asDirectory(base), relative: rel.removingPercentEncoding ?? rel)
|
|
return try await fetchAndDecrypt(joined, keys: keyMap)
|
|
}
|
|
|
|
throw ProxyError.badPath
|
|
}
|
|
|
|
private func fetchAndDecrypt(_ url: URL, keys: ClearKeyKeyMap) async throws -> (Data, String) {
|
|
var data = try await fetch(url)
|
|
let lower = url.absoluteString.lowercased()
|
|
let isManifest = lower.contains(".mpd")
|
|
if isManifest, let xml = String(data: data, encoding: .utf8) ?? Optional(String(decoding: data, as: UTF8.self)) {
|
|
let rewritten = rewriteMpd(xml, mpdURL: url)
|
|
return (Data(rewritten.utf8), "application/dash+xml")
|
|
}
|
|
queue.sync {
|
|
_ = CencMp4Decryptor.process(data: &data, keys: keys, state: &cryptoState)
|
|
}
|
|
let ct: String
|
|
if lower.contains(".m4s") || lower.contains(".mp4") || lower.contains("init") || lower.contains(".cmfv") || lower.contains(".cmfa") {
|
|
ct = "video/mp4"
|
|
} else {
|
|
ct = "application/octet-stream"
|
|
}
|
|
return (data, ct)
|
|
}
|
|
|
|
private func fetch(_ url: URL) async throws -> Data {
|
|
var req = URLRequest(url: url)
|
|
req.timeoutInterval = 25
|
|
req.cachePolicy = .reloadIgnoringLocalCacheData
|
|
req.setValue("VMC-iOS-ClearKey/0.5.4", forHTTPHeaderField: "User-Agent")
|
|
req.setValue("bytes", forHTTPHeaderField: "Accept-Ranges")
|
|
let (data, resp) = try await urlSession.data(for: req)
|
|
if let http = resp as? HTTPURLResponse, !(200...299).contains(http.statusCode) {
|
|
throw ProxyError.upstream(http.statusCode)
|
|
}
|
|
return data
|
|
}
|
|
|
|
private func rewriteMpd(_ xml: String, mpdURL: URL) -> String {
|
|
var s = xml
|
|
// Strip ContentProtection (ClearKey/Widevine/PlayReady/mp4protection).
|
|
s = s.replacingOccurrences(
|
|
of: #"<ContentProtection\b[^>]*/>"#,
|
|
with: "",
|
|
options: .regularExpression
|
|
)
|
|
s = s.replacingOccurrences(
|
|
of: #"<ContentProtection\b[^>]*>[\s\S]*?</ContentProtection>"#,
|
|
with: "",
|
|
options: .regularExpression
|
|
)
|
|
|
|
// Live dynamic: Location mag niet naar remote DRM-MPD wijzen (VLC omzeilt proxy).
|
|
s = s.replacingOccurrences(
|
|
of: #"<Location\b[^>]*>[\s\S]*?</Location>"#,
|
|
with: "<Location>http://127.0.0.1:\(port)/manifest.mpd</Location>",
|
|
options: .regularExpression
|
|
)
|
|
|
|
// Herschrijf elke BaseURL naar de juiste resolved CDN-base via /p/<b64>/.
|
|
if let baseRegex = try? NSRegularExpression(pattern: #"<BaseURL>([\s\S]*?)</BaseURL>"#, options: []) {
|
|
let ns = s as NSString
|
|
let matches = baseRegex.matches(in: s, options: [], range: NSRange(location: 0, length: ns.length))
|
|
for match in matches.reversed() {
|
|
guard match.numberOfRanges >= 2 else { continue }
|
|
let content = ns.substring(with: match.range(at: 1))
|
|
.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
if content.contains("127.0.0.1:\(port)") {
|
|
continue
|
|
}
|
|
let resolved = resolveBaseURL(content, mpdURL: mpdURL)
|
|
let proxyBase = "http://127.0.0.1:\(port)/p/\(encodeURL(asDirectory(resolved)))/"
|
|
s = (s as NSString).replacingCharacters(in: match.range, with: "<BaseURL>\(proxyBase)</BaseURL>")
|
|
}
|
|
}
|
|
|
|
if !s.localizedCaseInsensitiveContains("<BaseURL") {
|
|
let proxyBase = "http://127.0.0.1:\(port)/p/\(encodeURL(asDirectory(mpdURL.deletingLastPathComponent())))/"
|
|
if let regex = try? NSRegularExpression(pattern: #"<MPD\b[^>]*>"#, options: []) {
|
|
let range = NSRange(s.startIndex..<s.endIndex, in: s)
|
|
if let match = regex.firstMatch(in: s, options: [], range: range),
|
|
let r = Range(match.range, in: s) {
|
|
s.insert(contentsOf: "\n <BaseURL>\(proxyBase)</BaseURL>", at: r.upperBound)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Absolute http(s) URL's in attributen → /a/<b64>
|
|
if let urlRegex = try? NSRegularExpression(pattern: #"https?://[^\s"'<>]+"#, options: []) {
|
|
let ns = s as NSString
|
|
let matches = urlRegex.matches(in: s, options: [], range: NSRange(location: 0, length: ns.length))
|
|
for match in matches.reversed() {
|
|
let abs = ns.substring(with: match.range)
|
|
if abs.contains("127.0.0.1:\(port)") { continue }
|
|
let replacement = "http://127.0.0.1:\(port)/a/\(encodeURLString(abs))"
|
|
s = (s as NSString).replacingCharacters(in: match.range, with: replacement)
|
|
}
|
|
}
|
|
|
|
return s
|
|
}
|
|
|
|
/// Resolve BaseURL tekst t.o.v. MPD-URL; altijd als directory-URL.
|
|
private func resolveBaseURL(_ raw: String, mpdURL: URL) -> URL {
|
|
let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
if trimmed.isEmpty {
|
|
return asDirectory(mpdURL.deletingLastPathComponent())
|
|
}
|
|
if trimmed.hasPrefix("http://") || trimmed.hasPrefix("https://"),
|
|
let abs = URL(string: trimmed) {
|
|
return asDirectory(abs)
|
|
}
|
|
if let joined = URL(string: trimmed, relativeTo: mpdURL)?.absoluteURL {
|
|
return asDirectory(joined)
|
|
}
|
|
return asDirectory(mpdURL.deletingLastPathComponent())
|
|
}
|
|
|
|
private func asDirectory(_ url: URL) -> URL {
|
|
var s = url.absoluteString
|
|
if s.isEmpty { return url }
|
|
if !s.hasSuffix("/") {
|
|
// Als laatste path-component op een bestand lijkt (.mpd/.mp4), strip; anders slash toevoegen.
|
|
let last = url.lastPathComponent.lowercased()
|
|
if last.contains("."), !last.hasSuffix("/") {
|
|
return asDirectory(url.deletingLastPathComponent())
|
|
}
|
|
s += "/"
|
|
}
|
|
return URL(string: s) ?? url
|
|
}
|
|
|
|
private func join(base: URL, relative: String) -> URL {
|
|
if relative.hasPrefix("http://") || relative.hasPrefix("https://") {
|
|
return URL(string: relative) ?? base
|
|
}
|
|
return URL(string: relative, relativeTo: base)?.absoluteURL ?? base.appendingPathComponent(relative)
|
|
}
|
|
|
|
private func encodeURL(_ url: URL) -> String {
|
|
encodeURLString(url.absoluteString)
|
|
}
|
|
|
|
private func encodeURLString(_ s: String) -> String {
|
|
Data(s.utf8).base64EncodedString()
|
|
.replacingOccurrences(of: "+", with: "-")
|
|
.replacingOccurrences(of: "/", with: "_")
|
|
.replacingOccurrences(of: "=", with: "")
|
|
}
|
|
|
|
private func decodeURL(_ b64url: String) -> URL? {
|
|
var b64 = b64url
|
|
.replacingOccurrences(of: "-", with: "+")
|
|
.replacingOccurrences(of: "_", with: "/")
|
|
let pad = (4 - b64.count % 4) % 4
|
|
if pad > 0 { b64 += String(repeating: "=", count: pad) }
|
|
guard let data = Data(base64Encoded: b64),
|
|
let s = String(data: data, encoding: .utf8)
|
|
else { return nil }
|
|
return URL(string: s)
|
|
}
|
|
|
|
private static func parseHeader(_ header: String, name: String) -> String? {
|
|
let lines = header.split(separator: "\r\n")
|
|
let prefix = name.lowercased() + ":"
|
|
for line in lines.dropFirst() {
|
|
let l = line.trimmingCharacters(in: .whitespaces)
|
|
if l.lowercased().hasPrefix(prefix) {
|
|
return String(l.dropFirst(prefix.count)).trimmingCharacters(in: .whitespaces)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
private static func parseByteRange(_ value: String, total: Int) -> (start: Int, end: Int)? {
|
|
// bytes=START-END | bytes=START-
|
|
guard value.lowercased().hasPrefix("bytes=") else { return nil }
|
|
let spec = value.dropFirst(6)
|
|
let parts = spec.split(separator: "-", maxSplits: 1).map(String.init)
|
|
guard let start = Int(parts.first ?? "") else { return nil }
|
|
let end: Int
|
|
if parts.count > 1, let e = Int(parts[1]) {
|
|
end = min(e, total - 1)
|
|
} else {
|
|
end = total - 1
|
|
}
|
|
guard total > 0, start >= 0, start <= end, end < total else { return nil }
|
|
return (start, end)
|
|
}
|
|
|
|
private func respond(
|
|
_ connection: NWConnection,
|
|
status: Int,
|
|
contentType: String,
|
|
body: Data,
|
|
headOnly: Bool = false,
|
|
contentLength: Int? = nil,
|
|
extraHeaders: [String] = []
|
|
) {
|
|
let reason: String
|
|
switch status {
|
|
case 200: reason = "OK"
|
|
case 206: reason = "Partial Content"
|
|
case 400: reason = "Bad Request"
|
|
case 405: reason = "Method Not Allowed"
|
|
case 502: reason = "Bad Gateway"
|
|
default: reason = "Error"
|
|
}
|
|
let len = contentLength ?? body.count
|
|
var header = "HTTP/1.1 \(status) \(reason)\r\n"
|
|
header += "Content-Type: \(contentType)\r\n"
|
|
header += "Content-Length: \(len)\r\n"
|
|
header += "Connection: close\r\n"
|
|
header += "Access-Control-Allow-Origin: *\r\n"
|
|
header += "Cache-Control: no-store\r\n"
|
|
for h in extraHeaders {
|
|
header += h + "\r\n"
|
|
}
|
|
header += "\r\n"
|
|
var payload = Data(header.utf8)
|
|
if !headOnly { payload.append(body) }
|
|
connection.send(content: payload, completion: .contentProcessed { _ in
|
|
connection.cancel()
|
|
})
|
|
}
|
|
|
|
enum ProxyError: LocalizedError {
|
|
case noKeys
|
|
case bindFailed
|
|
case notStarted
|
|
case badPath
|
|
case emptyManifest
|
|
case upstream(Int)
|
|
|
|
var errorDescription: String? {
|
|
switch self {
|
|
case .noKeys: return "Geen geldige ClearKey-sleutels"
|
|
case .bindFailed: return "Kon lokale ClearKey-proxy niet starten"
|
|
case .notStarted: return "ClearKey-proxy is niet actief"
|
|
case .badPath: return "Ongeldig proxy-pad"
|
|
case .emptyManifest: return "Leeg of ongeldig DASH-manifest ontvangen"
|
|
case .upstream(let code): return "Upstream HTTP \(code)"
|
|
}
|
|
}
|
|
}
|
|
}
|