search

roleoroleo / onvif_simple_server

Light implementation of an onvif server intended for use in resource-constrained devices
GNU General Public License v3.0
35 stars 12 forks source link

possible "Authentication" issue from Genetec Security Center #7

Open winkmichael opened 6 months ago

winkmichael commented 6 months ago

Hello there.

Thanks for your attention on the other issue I reported. I misunderstood that the browser would be making a get request and onvif would behave different and the 500 error is actually not at all important, but its nice you make it look pretty now.

I'm able to connect and everything looks great using ONVIF Device Manager, and a little type python zeep testing tool I made, however when I try to connect using Genetec Security Center (a commercial VMS) selecting ONVIF I continue to get an authentication error "bad login". onvif-tcpflow.zip

Attached is a screenshot of the interface I'm seeing. The Security Center product has a basic and all mode, with all it gives an error, and basic I get an bad logon.

I'm running the server on http://162.249.44.5:8080 using the example .conf file.

I've attached the ouput from tcpflow of communication using the option basic. To me the authenication request looks normal and I don't see any signifigant difference between that and what ONVIF Device Manager is doing.

Any ideas or suggestions here? Or some other way I can test?

Thanks so much for your time and help.

Screenshot 2024-05-25 at 4 47 16 PM

cat /var/log/onvif_simple_server.log 2024-05-25 18:35:03 INFO onvif_simple_server.c:275: Starting program. 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:52: Dump environment variables 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:53: AUTH_TYPE: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:54: CONTENT_LENGTH: 987 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:55: CONTENT_TYPE: application/soap+xml; charset=utf-8; action="http://www.onvif.org/ver10/device/wsdl/GetNetworkInterfaces" 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:56: DOCUMENT_ROOT: /opt/onvifSimpleServer/www 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:57: GATEWAY_INTERFACE: CGI/1.1 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:58: HTTP_ACCEPT: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:59: HTTP_COOKIE: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:60: HTTP_FROM: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:61: HTTP_REFERER: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:62: HTTP_USER_AGENT: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:63: PATH_INFO: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:64: PATH_TRANSLATED: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:65: QUERY_STRING: 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:66: REMOTE_ADDR: 147.135.115.243 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:67: REMOTE_HOST: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:68: REMOTE_PORT: 14549 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:69: REMOTE_IDENT: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:70: REMOTE_USER: (null) 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:71: REQUEST_METHOD: POST 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:72: REQUEST_URI: /onvif/device_service 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:73: SCRIPT_FILENAME: /opt/onvifSimpleServer/www/onvif/device_service 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:74: SCRIPT_NAME: /onvif/device_service 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:75: SERVER_NAME: 162.249.44.5 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:76: SERVER_PORT: 8080 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:77: SERVER_PROTOCOL: HTTP/1.1 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:78: SERVER_SOFTWARE: lighttpd/1.4.73

2024-05-25 18:35:03 INFO onvif_simple_server.c:279: Processing configuration file /etc/onvif_simple_server.conf... 2024-05-25 18:35:03 DEBUG conf.c:117: model: Model 2024-05-25 18:35:03 DEBUG conf.c:117: manufacturer: Manufacturer 2024-05-25 18:35:03 DEBUG conf.c:117: firmware_ver: 0.0.1 2024-05-25 18:35:03 DEBUG conf.c:117: hardware_id: HWID 2024-05-25 18:35:03 DEBUG conf.c:117: serial_num: SN1234567890 2024-05-25 18:35:03 DEBUG conf.c:117: ifs: eth0 2024-05-25 18:35:03 DEBUG conf.c:117: port: 8080 2024-05-25 18:35:03 DEBUG conf.c:117: scope: onvif://www.onvif.org/Profile/Streaming 2024-05-25 18:35:03 DEBUG conf.c:117: user: admin 2024-05-25 18:35:03 DEBUG conf.c:117: password: admin 2024-05-25 18:35:03 DEBUG conf.c:117: adv_fault_if_unknown: 1 2024-05-25 18:35:03 DEBUG conf.c:117: adv_synology_nvr: 0 2024-05-25 18:35:03 DEBUG conf.c:117: name: Profile_0 2024-05-25 18:35:03 DEBUG conf.c:117: width: 1920 2024-05-25 18:35:03 DEBUG conf.c:117: height: 1080 2024-05-25 18:35:03 DEBUG conf.c:117: url: rtsp://%s/ch0_0.h264 2024-05-25 18:35:03 DEBUG conf.c:117: snapurl: http://%s/cgi-bin/snapshot.sh 2024-05-25 18:35:03 DEBUG conf.c:117: type: H264 2024-05-25 18:35:03 DEBUG conf.c:117: decoder: G711 2024-05-25 18:35:03 DEBUG conf.c:117: name: Profile_1 2024-05-25 18:35:03 DEBUG conf.c:117: width: 640 2024-05-25 18:35:03 DEBUG conf.c:117: height: 360 2024-05-25 18:35:03 DEBUG conf.c:117: url: rtsp://%s/ch0_1.h264 2024-05-25 18:35:03 DEBUG conf.c:117: snapurl: http://%s/cgi-bin/snapshot.sh 2024-05-25 18:35:03 DEBUG conf.c:117: type: H264 2024-05-25 18:35:03 DEBUG conf.c:117: decoder: NONE 2024-05-25 18:35:03 DEBUG conf.c:117: ptz: 1 2024-05-25 18:35:03 DEBUG conf.c:117: get_position: /usr/local/bin/get_position 2024-05-25 18:35:03 DEBUG conf.c:117: is_moving: /usr/local/bin/is_moving 2024-05-25 18:35:03 DEBUG conf.c:117: move_left: /usr/local/bin/ptz_move-m left 2024-05-25 18:35:03 DEBUG conf.c:117: move_right: /usr/local/bin/ptz_move-m right 2024-05-25 18:35:03 DEBUG conf.c:117: move_up: /usr/local/bin/ptz_move-m up 2024-05-25 18:35:03 DEBUG conf.c:117: move_down: /usr/local/bin/ptz_move-m down 2024-05-25 18:35:03 DEBUG conf.c:117: move_stop: /usr/local/bin/ptz_move-m stop 2024-05-25 18:35:03 DEBUG conf.c:117: move_preset: /usr/local/bin/ptz_move-p %d 2024-05-25 18:35:03 DEBUG conf.c:117: set_preset: /usr/local/bin/ptz_presets.sh -a add_preset -m %s 2024-05-25 18:35:03 DEBUG conf.c:117: set_home_position: /usr/local/bin/ptz_presets.sh -a set_home_position 2024-05-25 18:35:03 DEBUG conf.c:117: remove_preset: /usr/local/bin/ptz_presets.sh -a del_preset -n %d 2024-05-25 18:35:03 DEBUG conf.c:117: jump_to_abs: /usr/local/bin/ptz_move-j %f,%f 2024-05-25 18:35:03 DEBUG conf.c:117: jump_to_rel: /usr/local/bin/ptz_move-J %f,%f 2024-05-25 18:35:03 DEBUG conf.c:117: get_presets: /usr/local/bin/ptz_presets.sh -a get_presets 2024-05-25 18:35:03 DEBUG conf.c:117: events: 3 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:VideoSource/MotionAlarm 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/motion_alarm 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:RuleEngine/MyRuleDetector/PeopleDetect 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/human_detection 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:RuleEngine/MyRuleDetector/VehicleDetect 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/vehicle_detection 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:RuleEngine/MyRuleDetector/DogCatDetect 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/animal_detection 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:RuleEngine/MyRuleDetector/BabyCryingDetect 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/baby_crying 2024-05-25 18:35:03 DEBUG conf.c:117: topic: tns1:AudioAnalytics/Audio/DetectedSound 2024-05-25 18:35:03 DEBUG conf.c:117: source_name: VideoSourceConfigurationToken 2024-05-25 18:35:03 DEBUG conf.c:117: source_value: VideoSourceToken 2024-05-25 18:35:03 DEBUG conf.c:117: input_file: /tmp/onvif_notify_server/sound_detection 2024-05-25 18:35:03 INFO onvif_simple_server.c:292: Completed. 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:310: Input: admin</wsse:Username>Eq3Di625til6wv9R7OVqb1Pg60s=</wsse:Password>drfT4Mq8wAR2x8jsnDBbUw==</wsse:Nonce>2024-05-25T22:35:02Z</wsu:Created></wsse:UsernameToken></s:Header></s:Body></s:Envelope> 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:311: Url: device_service 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:325: Method: GetNetworkInterfaces 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:341: Security: username = admin 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:347: Security: password = **** 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:353: Security: nonce = drfT4Mq8wAR2x8jsnDBbUw== 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:360: Security: created = 2024-05-25T22:35:02Z 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:374: Calculated digest: Eq3Di625til6wv9R7OVqb1Pg60s= 2024-05-25 18:35:03 DEBUG onvif_simple_server.c:375: Received digest: Eq3Di625til6wv9R7OVqb1Pg60s= 2024-05-25 18:35:03 INFO onvif_simple_server.c:392: Authentication ok 2024-05-25 18:35:03 DEBUG utils.c:269: Interface: 2024-05-25 18:35:03 DEBUG utils.c:270: Address: <162.249.44.5> 2024-05-25 18:35:03 DEBUG utils.c:271: Netmask: <255.255.255.0>

roleoroleo commented 6 months ago

Could you please capture the flow with tcpdump?

winkmichael commented 6 months ago

Attached are captures from TCPDump. In Security Center it has differnet Onvif Subtypes, Basic, All and Media. Each capture file represents a differnet mode. The basic one "appears" to almost work and gets the "bad login" error, were as All and Media just give error.

Thanks so much for taking a look into this!

mediamode.cap.gz basicmode.cap.gz allmode.cap.gz

roleoroleo commented 6 months ago

The pcap shows an "Internal Server Error". So, probably a segfault. I tested the same request with my cam and it works. Probably the problem is related to this code:

int device_get_network_interfaces()
{
    char address[16];
    char netmask[16];
    char mac_address[16];
    int prefix_len;
    char sprefix_len[3];

    get_ip_address(address, netmask, service_ctx.ifs);
    prefix_len = netmask2prefixlen(netmask);
    sprintf(sprefix_len, "%d", prefix_len);
    get_mac_address(mac_address, service_ctx.ifs);

in your cam. Please, try these files: files.zip

winkmichael commented 6 months ago

Thanks I've recompiled these the two files updated, however I continue to get the same issue.

I've tried adding strace to the execution, but I don't see much help here

5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 92) = 92 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 93) = 93 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 81) = 81 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 69) = 69 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 87) = 87 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 85) = 85 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 81) = 81 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 69) = 69 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, st_size=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 DEBUG conf.c"..., 91) = 91 5101 read(4, "", 4096) = 0 5101 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0644, stsize=3552, ...}, 0) = 0 5101 write(3, "2024-05-28 11:50:31 INFO onvif"..., 64) = 64 5101 newfstatat(0, "", {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0), ...}, AT_EMPTY_PATH) = 0 5101 read(0, "\n", 16384) = 1 5101 read(0, "\n", 15360) = 1 5101 read(0, 0x56468f3b0f92, 15360) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) 5101 --- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} --- 5101 +++ killed by SIGINT +++

server.document-root = "/opt/onvifSimpleServer/www"

server.port = 8080

server.modules += ( "mod_cgi" ) cgi.assign = ( "/device_service" => "/usr/bin/strace -f -o /tmp/strace_device.log /opt/onvifSimpleServer/www/onvif/onvif_simple_server", "/events_service" => "/usr/bin/strace -f -o /tmp/strace_events.log /opt/onvifSimpleServer/www/onvif/onvif_simple_server", "/media_service" => "/usr/bin/strace -f -o /tmp/strace_media.log /opt/onvifSimpleServer/www/onvif/onvif_simple_server", "/ptz_service" => "/usr/bin/strace -f -o /tmp/strace_ptz.log /opt/onvifSimpleServer/www/onvif/onvif_simple_server" )

server.errorlog = "/tmp/lighttpd_error.log" server.errorlog-use-syslog = "disable"

I see if I can get more out of strace or perhaps gdb

roleoroleo commented 6 months ago

Please, try to update the code with my last commits.

winkmichael commented 6 months ago

Thank you. There is some success, the unit now adds to Security Center, however immediately after it disconnects and becomes unavailable. Attached is a pcap I am still looking at the data now. basicmode3.cap.gz

roleoroleo commented 6 months ago

The connection stops when the nvr sends SetVideoEncoderConfiguration message. But this is a problem because my server (and normally the cam) doesn't support a custom configuration. I created two options to increase the compatibility with nvr and try to fix this problem. Please try to set them to 1:

adv_fault_if_unknown=0
adv_synology_nvr=0

PS Thank you very much for your donation.

winkmichael commented 6 months ago

Thanks, I had previously tried;

adv_fault_if_unknown=1 adv_synology_nvr=1

After your comment, I went back and it seems the magic for this VMS is to do;

adv_fault_if_unknown=0 adv_synology_nvr=1

Still experimenting, getting hung up on the rtsp syntax and authentication in the rtsp itself, but it looks like this might be perfect.

Thanks for all your time and help!