```
您可以不使用签名 Cookie，而是使用签名 URL。有关更多信息，请参阅 [使用 PHP 创建 URL 签名](CreateURL_PHP.md)。
# 用于 Base64 编码和加密的 Linux 命令和 OpenSSL
可使用以下 Linux 命令行命令和 OpenSSL 哈希和签署策略声明，对签名进行 Base64 编码，将 URL 查询字符串中无效的字符替换为有效的字符。
有关 OpenSSL 的信息，请转到 [https://www.openssl.org](https://www.openssl.org)。
```
cat policy | tr -d "\n" | tr -d " \t\n\r" | openssl sha1 -sign private_key.pem | openssl base64 -A | tr -- '+=/' '-_~'
```
在上述命令中：
+ `cat` 读取 `policy` 文件。
+ `tr -d "\n" | tr -d " \t\n\r"` 移除由 `cat` 添加的空格和换行符。
+ OpenSSL 使用 SHA-1 对文件进行哈希处理，并使用私有密钥文件 `private_key.pem` 对其进行签名。私有密钥签名可以是 RSA 2048 或 ECDSA 256。
+ OpenSSL 对经过哈希处理和签名的策略声明进行 Base64 编码。
+ `tr` 使用有效的字符替换 URL 查询字符串参数中的无效字符。
有关演示如何创建签名的更多代码示例，请参阅[为签名 URL 创建签名的代码示例](PrivateCFSignatureCodeAndExamples.md)。
# 为签名 URL 创建签名的代码示例
本部分包括演示如何为签名 URL 创建签名的可下载应用程序示例。示例可以 Perl、PHP、C\$1 和 Java 语言提供。可以使用任意示例来创建签名 URL。Perl 脚本在 Linux 和 macOS 平台上运行。PHP 示例将在运行 PHP 的任何服务器上工作。C\$1 示例使用 .NET Framework。
有关 JavaScript (Node.js) 中的代码示例，请参阅 AWS 开发人员博客上的[以 Node.js 创建 Amazon CloudFront 已签名 URL](https://aws.amazon.com/blogs/developer/creating-amazon-cloudfront-signed-urls-in-node-js/)。
有关 Python 中的代码示例，请参阅《AWS SDK for Python (Boto3) API Reference》**中的 [Generate a signed URL for Amazon CloudFront](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudfront.html#examples)，以及 Boto3 GitHub 存储库中的[此代码示例](https://github.com/boto/boto3/blob/develop/boto3/examples/cloudfront.rst)。
**Topics**
+ [使用 Perl 创建 URL 签名](CreateURLPerl.md)
+ [使用 PHP 创建 URL 签名](CreateURL_PHP.md)
+ [使用 C\$1 和 .NET Framework 创建 URL 签名](CreateSignatureInCSharp.md)
+ [使用 Java 创建 URL 签名](CFPrivateDistJavaDevelopment.md)
# 使用 Perl 创建 URL 签名
本部分包括一个用于 Linux/Mac 平台的 Perl 脚本，您可以使用它为私有内容创建签名。要创建签名，请使用指定 CloudFront URL、签署人私有密钥的路径、密钥 ID 以及 URL 的到期日期的命令行参数来运行该脚本。工具还可对签名 URL 进行解码。
**注意**
创建 URL 签名只是使用签名 URL 提供私有内容过程的一部分。有关端到端流程的更多信息，请参阅[使用签名 URL](private-content-signed-urls.md)。
**Topics**
+ [用于创建签名 URL 的 Perl 脚本的源](#CreateURLPerlScriptSource)
## 用于创建签名 URL 的 Perl 脚本的源
以下 Perl 源代码可用于为 CloudFront 创建签名 URL。代码中的注释包括有关该工具的命令行开关和功能的信息。
```
#!/usr/bin/perl -w
# Copyright 2008 Amazon Technologies, Inc. Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. You may obtain a copy of the License at:
#
# https://aws.amazon.com/apache2.0
#
# This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.
=head1 cfsign.pl
cfsign.pl - A tool to generate and verify Amazon CloudFront signed URLs
=head1 SYNOPSIS
This script uses an existing RSA key pair to sign and verify Amazon CloudFront signed URLs
View the script source for details as to which CPAN packages are required beforehand.
For help, try:
cfsign.pl --help
URL signing examples:
cfsign.pl --action encode --url https://images.my-website.com/gallery1.zip --policy sample_policy.json --private-key privkey.pem --key-pair-id mykey
cfsign.pl --action encode --url https://images.my-website.com/gallery1.zip --expires 1257439868 --private-key privkey.pem --key-pair-id mykey
URL decode example:
cfsign.pl --action decode --url "http//mydist.cloudfront.net/?Signature=AGO-PgxkYo99MkJFHvjfGXjG1QDEXeaDb4Qtzmy85wqyJjK7eKojQWa4BCRcow__&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cDovLypicmFkbS5qcGciLCJDb25kaXRpb24iOnsiSXBBZGRyZXNzIjp7IkFXUzpTb3VyY2VJcCI6IjEwLjUyLjE3LjkvMCJ9LCJEYXRlR3JlYXRlclRoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTI1MjUyMDgzMH19fV19Cg__&Key-Pair-Id=mykey"
To generate an RSA key pair, you can use openssl and the following commands:
# Generate a 2048 bit key pair
openssl genrsa -out private-key.pem 2048
openssl rsa -in private-key.pem -pubout -out public-key.pem
=head1 OPTIONS
=over 8
=item B<--help>
Print a help message and exits.
=item B<--action> [action]
The action to execute. action can be one of:
encode - Generate a signed URL (using a canned policy or a user policy)
decode - Decode a signed URL
=item B<--url>
The URL to en/decode
=item B<--stream>
The stream to en/decode
=item B<--private-key>
The path to your private key.
=item B<--key-pair-id>
The key pair identifier.
=item B<--policy>
The CloudFront policy document.
=item B<--expires>
The Unix epoch time when the URL is to expire. If both this option and
the --policy option are specified, --policy will be used. Otherwise, this
option alone will use a canned policy.
=back
=cut
use strict;
use warnings;
# you might need to use CPAN to get these modules.
# run perl -MCPAN -e "install " to get them.
# The openssl command line will also need to be in your $PATH.
use File::Temp qw/tempfile/;
use File::Slurp;
use Getopt::Long;
use IPC::Open2;
use MIME::Base64 qw(encode_base64 decode_base64);
use Pod::Usage;
use URI;
my $CANNED_POLICY
= '{"Statement":[{"Resource":"","Condition":{"DateLessThan":{"AWS:EpochTime":}}}]}';
my $POLICY_PARAM = "Policy";
my $EXPIRES_PARAM = "Expires";
my $SIGNATURE_PARAM = "Signature";
my $KEY_PAIR_ID_PARAM = "Key-Pair-Id";
my $verbose = 0;
my $policy_filename = "";
my $expires_epoch = 0;
my $action = "";
my $help = 0;
my $key_pair_id = "";
my $url = "";
my $stream = "";
my $private_key_filename = "";
my $result = GetOptions("action=s" => \$action,
"policy=s" => \$policy_filename,
"expires=i" => \$expires_epoch,
"private-key=s" => \$private_key_filename,
"key-pair-id=s" => \$key_pair_id,
"verbose" => \$verbose,
"help" => \$help,
"url=s" => \$url,
"stream=s" => \$stream,
);
if ($help or !$result) {
pod2usage(1);
exit;
}
if ($url eq "" and $stream eq "") {
print STDERR "Must include a stream or a URL to encode or decode with the --stream or --url option\n";
exit;
}
if ($url ne "" and $stream ne "") {
print STDERR "Only one of --url and --stream may be specified\n";
exit;
}
if ($url ne "" and !is_url_valid($url)) {
exit;
}
if ($stream ne "") {
exit unless is_stream_valid($stream);
# The signing mechanism is identical, so from here on just pretend we're
# dealing with a URL
$url = $stream;
}
if ($action eq "encode") {
# The encode action will generate a private content URL given a base URL,
# a policy file (or an expires timestamp) and a key pair id parameter
my $private_key;
my $public_key;
my $public_key_file;
my $policy;
if ($policy_filename eq "") {
if ($expires_epoch == 0) {
print STDERR "Must include policy filename with --policy argument or an expires" .
"time using --expires\n";
}
$policy = $CANNED_POLICY;
$policy =~ s//$expires_epoch/g;
$policy =~ s//$url/g;
} else {
if (! -e $policy_filename) {
print STDERR "Policy file $policy_filename does not exist\n";
exit;
}
$expires_epoch = 0; # ignore if set
$policy = read_file($policy_filename);
}
if ($private_key_filename eq "") {
print STDERR "You must specific the path to your private key file with --private-key\n";
exit;
}
if (! -e $private_key_filename) {
print STDERR "Private key file $private_key_filename does not exist\n";
exit;
}
if ($key_pair_id eq "") {
print STDERR "You must specify a key pair id with --key-pair-id\n";
exit;
}
my $encoded_policy = url_safe_base64_encode($policy);
my $signature = rsa_sha1_sign($policy, $private_key_filename);
my $encoded_signature = url_safe_base64_encode($signature);
my $generated_url = create_url($url, $encoded_policy, $encoded_signature, $key_pair_id, $expires_epoch);
if ($stream ne "") {
print "Encoded stream (for use within a swf):\n" . $generated_url . "\n";
print "Encoded and escaped stream (for use on a webpage):\n" . escape_url_for_webpage($generated_url) . "\n";
} else {
print "Encoded URL:\n" . $generated_url . "\n";
}
} elsif ($action eq "decode") {
my $decoded = decode_url($url);
if (!$decoded) {
print STDERR "Improperly formed URL\n";
exit;
}
print_decoded_url($decoded);
} else {
# No action specified, print help. But only if this is run as a program (caller will be empty)
pod2usage(1) unless caller();
}
# Decode a private content URL into its component parts
sub decode_url {
my $url = shift;
if ($url =~ /(.*)\?(.*)/) {
my $base_url = $1;
my $params = $2;
my @unparsed_params = split(/&/, $params);
my %params = ();
foreach my $param (@unparsed_params) {
my ($key, $val) = split(/=/, $param);
$params{$key} = $val;
}
my $encoded_signature = "";
if (exists $params{$SIGNATURE_PARAM}) {
$encoded_signature = $params{"Signature"};
} else {
print STDERR "Missing Signature URL parameter\n";
return 0;
}
my $encoded_policy = "";
if (exists $params{$POLICY_PARAM}) {
$encoded_policy = $params{$POLICY_PARAM};
} else {
if (!exists $params{$EXPIRES_PARAM}) {
print STDERR "Either the Policy or Expires URL parameter needs to be specified\n";
return 0;
}
my $expires = $params{$EXPIRES_PARAM};
my $policy = $CANNED_POLICY;
$policy =~ s//$expires/g;
my $url_without_cf_params = $url;
$url_without_cf_params =~ s/$SIGNATURE_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$POLICY_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$EXPIRES_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$KEY_PAIR_ID_PARAM=[^&]*&?//g;
if ($url_without_cf_params =~ /(.*)\?$/) {
$url_without_cf_params = $1;
}
$policy =~ s//$url_without_cf_params/g;
$encoded_policy = url_safe_base64_encode($policy);
}
my $key = "";
if (exists $params{$KEY_PAIR_ID_PARAM}) {
$key = $params{$KEY_PAIR_ID_PARAM};
} else {
print STDERR "Missing $KEY_PAIR_ID_PARAM parameter\n";
return 0;
}
my $policy = url_safe_base64_decode($encoded_policy);
my %ret = ();
$ret{"base_url"} = $base_url;
$ret{"policy"} = $policy;
$ret{"key"} = $key;
return \%ret;
} else {
return 0;
}
}
# Print a decoded URL out
sub print_decoded_url {
my $decoded = shift;
print "Base URL: \n" . $decoded->{"base_url"} . "\n";
print "Policy: \n" . $decoded->{"policy"} . "\n";
print "Key: \n" . $decoded->{"key"} . "\n";
}
# Encode a string with base 64 encoding and replace some invalid URL characters
sub url_safe_base64_encode {
my ($value) = @_;
my $result = encode_base64($value);
$result =~ tr|+=/|-_~|;
return $result;
}
# Decode a string with base 64 encoding. URL-decode the string first
# followed by reversing any special character ("+=/") translation.
sub url_safe_base64_decode {
my ($value) = @_;
$value =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
$value =~ tr|-_~|+=/|;
my $result = decode_base64($value);
return $result;
}
# Create a private content URL
sub create_url {
my ($path, $policy, $signature, $key_pair_id, $expires) = @_;
my $result;
my $separator = $path =~ /\?/ ? '&' : '?';
if ($expires) {
$result = "$path$separator$EXPIRES_PARAM=$expires&$SIGNATURE_PARAM=$signature&$KEY_PAIR_ID_PARAM=$key_pair_id";
} else {
$result = "$path$separator$POLICY_PARAM=$policy&$SIGNATURE_PARAM=$signature&$KEY_PAIR_ID_PARAM=$key_pair_id";
}
$result =~ s/\n//g;
return $result;
}
# Sign a document with given private key file.
# The first argument is the document to sign
# The second argument is the name of the private key file
sub rsa_sha1_sign {
my ($to_sign, $pvkFile) = @_;
print "openssl sha1 -sign $pvkFile $to_sign\n";
return write_to_program($pvkFile, $to_sign);
}
# Helper function to write data to a program
sub write_to_program {
my ($keyfile, $data) = @_;
unlink "temp_policy.dat" if (-e "temp_policy.dat");
unlink "temp_sign.dat" if (-e "temp_sign.dat");
write_file("temp_policy.dat", $data);
system("openssl dgst -sha1 -sign \"$keyfile\" -out temp_sign.dat temp_policy.dat");
my $output = read_file("temp_sign.dat");
return $output;
}
# Read a file into a string and return the string
sub read_file {
my ($file) = @_;
open(INFILE, "<$file") or die("Failed to open $file: $!");
my $str = join('', );
close INFILE;
return $str;
}
sub is_url_valid {
my ($url) = @_;
# HTTP distributions start with http[s]:// and are the correct thing to sign
if ($url =~ /^https?:\/\//) {
return 1;
} else {
print STDERR "CloudFront requires absolute URLs for HTTP distributions\n";
return 0;
}
}
sub is_stream_valid {
my ($stream) = @_;
if ($stream =~ /^rtmp:\/\// or $stream =~ /^\/?cfx\/st/) {
print STDERR "Streaming distributions require that only the stream name is signed.\n";
print STDERR "The stream name is everything after, but not including, cfx/st/\n";
return 0;
} else {
return 1;
}
}
# flash requires that the query parameters in the stream name are url
# encoded when passed in through javascript, etc. This sub handles the minimal
# required url encoding.
sub escape_url_for_webpage {
my ($url) = @_;
$url =~ s/\?/%3F/g;
$url =~ s/=/%3D/g;
$url =~ s/&/%26/g;
return $url;
}
1;
```
# 使用 PHP 创建 URL 签名
运行 PHP 的任何 Web 服务器可使用此 PHP 代码示例，来为私有的 CloudFront 分配创建策略声明和签名。该完整示例使用签名 URL 链接创建一个正常运作的网页，这些链接使用 CloudFront 流播放视频流。您可以从 [demo-php.zip](samples/demo-php.zip) 文件下载完整示例。
**备注**
创建 URL 签名只是使用签名 URL 提供私有内容过程的一部分。有关整个过程的更多信息，请参阅[使用签名 URL](private-content-signed-urls.md)。
还可以通过使用 适用于 PHP 的 AWS SDK 中的 `UrlSigner` 类来创建签名 URL。有关更多信息，请参阅 *适用于 PHP 的 AWS SDKAPI 参考*中的 [Class UrlSigner](https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.CloudFront.UrlSigner.html)。
**Topics**
+ [创建 RSA SHA-1 签名](#sample-rsa-sign)
+ [创建标准策略](#sample-canned-policy)
+ [创建自定义策略](#sample-custom-policy)
+ [完整代码示例](#full-example)
以下部分将代码示例细分到各个单独的部分。您可在下方找到[完整代码示例](#full-example)。
## 创建 RSA SHA-1 签名
本代码示例执行以下操作：
+ 函数 `rsa_sha1_sign` 执行哈希操作并签署策略声明。所需的参数是策略语句和私有密钥，该私有密钥对应于分配的可信密钥组中的公有密钥。
+ 接下来，`url_safe_base64_encode` 函数创建签名 URL 安全版本。
```
function rsa_sha1_sign($policy, $private_key_filename) {
$signature = "";
// load the private key
$fp = fopen($private_key_filename, "r");
$priv_key = fread($fp, 8192);
fclose($fp);
$pkeyid = openssl_get_privatekey($priv_key);
// compute signature
openssl_sign($policy, $signature, $pkeyid);
// free the key from memory
openssl_free_key($pkeyid);
return $signature;
}
function url_safe_base64_encode($value) {
$encoded = base64_encode($value);
// replace unsafe characters +, = and / with
// the safe characters -, _ and ~
return str_replace(
array('+', '=', '/'),
array('-', '_', '~'),
$encoded);
}
```
以下代码段使用函数 `get_canned_policy_stream_name()` 和 `get_custom_policy_stream_name()` 来创建标准策略和自定义策略。CloudFront 使用这些策略来创建用于流式传输视频的 URL，包括指定过期时间。
然后，您可以使用标准策略或自定义策略来确定如何管理对内容的访问。有关选择哪一项的更多信息，请参阅[决定为签名 URL 使用标准策略还是自定义策略](private-content-signed-urls.md#private-content-choosing-canned-custom-policy)部分。
## 创建标准策略
以下代码示例构建了签名的*标准*策略声明。
**注意**
`$expires` 变量是一个日期/时间戳，必须为整数，而不是字符串。
```
function get_canned_policy_stream_name($video_path, $private_key_filename, $key_pair_id, $expires) {
// this policy is well known by CloudFront, but you still need to sign it, since it contains your parameters
$canned_policy = '{"Statement":[{"Resource":"' . $video_path . '","Condition":{"DateLessThan":{"AWS:EpochTime":'. $expires . '}}}]}';
// the policy contains characters that cannot be part of a URL, so we base64 encode it
$encoded_policy = url_safe_base64_encode($canned_policy);
// sign the original policy, not the encoded version
$signature = rsa_sha1_sign($canned_policy, $private_key_filename);
// make the signature safe to be included in a URL
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a stream name
$stream_name = create_stream_name($video_path, null, $encoded_signature, $key_pair_id, $expires);
// URL-encode the query string characters
return $stream_name;
}
```
更多有关标准策略的信息，请参阅 [使用标准策略创建签名 URL](private-content-creating-signed-url-canned-policy.md)。
## 创建自定义策略
以下代码示例构建了签名的*自定义* 策略声明。
```
function get_custom_policy_stream_name($video_path, $private_key_filename, $key_pair_id, $policy) {
// the policy contains characters that cannot be part of a URL, so we base64 encode it
$encoded_policy = url_safe_base64_encode($policy);
// sign the original policy, not the encoded version
$signature = rsa_sha1_sign($policy, $private_key_filename);
// make the signature safe to be included in a URL
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a stream name
$stream_name = create_stream_name($video_path, $encoded_policy, $encoded_signature, $key_pair_id, null);
// URL-encode the query string characters
return $stream_name;
}
```
更多有关自定义策略的信息，请参阅 [使用自定义策略创建签名 URL](private-content-creating-signed-url-custom-policy.md)。
## 完整代码示例
以下代码示例完整演示了使用 PHP 创建 CloudFront 签名 URL。您可以从 [demo-php.zip](samples/demo-php.zip) 文件下载完整示例。
在下面的示例中，您可以修改 `$policy` `Condition` 元素，以同时允许 IPv4 和 IPv6 地址范围。有关示例，请参阅《Amazon Simple Storage Service 用户指南》**中的[在 IAM 策略中使用 IPv6 地址](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ipv6-access.html#ipv6-access-iam)。
```
CloudFront