[Synology Surveillance Station] ONVIF don't work on 0.1.7

[delvinru]

Hi, after upgrading from 0.1.6 to version 0.1.7, Synology cameras stopped working.

1. When connecting to the cameras, an error is issued about an incorrect username/password, although they are correct and specified in the camera settings:

   

2. When trying to connect to the camera, Synology returns error 464, which is quite atypical:

   

3. Well, it personally confuses me that ONVIF is defined on port 80, although in theory it should be at 1000:

   

[roleoroleo]

Please, capture the traffic with tcpdump and send it to me. Use a fake password.

[delvinru]

Hi, I captured the traffic directly on the camera.

• 192.168.1.174 - camera
• 192.168.1.182 - synology
• INVALID_USER_TEST:INVALID_PASSWORD_TEST - test attempt for checking
• root:securepassword - valid pair

I hope this helps.

LINK REMOVED

[roleoroleo]

What do you mean exactly with "test attempt for checking" and "valid pair"? The pair in the capture file is INVALID_USER_TEST:INVALID_PASSWORD_TEST. I tested it and the digest is correct. What's root:securepassword?

Another check. Enable debug with echo 5 > /tmp/onvif_simple_server.debug and get the content of the files /tmp/onvif_simple_server.log after a client request.

[delvinru]

Hi, maybe my mistake is that I didn't fully explain.

When I entered INVALID_USER_TEST, I specifically wanted to get a known error in the traffic. By "valid pair" I mean the correct username and password that are installed on the camera and should work in theory.

onvif_simple_server.log.tar.gz

[delvinru]

I also see from the logs that the server says that authentication was successful, but I also get an error from synology.

[roleoroleo]

Ok, now it's clear. This is what I understand from the capture.

• When you use INVALID_USER_TEST the cam replies with "not authorized" and it's ok.
• When you use root user the cam replies correctly, so the authentication is ok, confirmed by the logs.
• Then, a long sequence of commands: GetProfiles, GetCapabilities, GetServices, GetDeviceInformation, GetNetworkInterfaces, GetVideoSourceConfigurations, GetGuaranteedNumberOfVideoEncoderInstances, GetVideoEncoderConfigurations, GetVideoEncoderConfigurationOptions, GetVideoEncoderConfigurationOptions, GetProfiles, GetServiceCapabilities, GetProfiles.
• The problem starts when Syno requests CreateProfile method that it's not supported by the cam (no dynamic profiles allowed) and the cam replies with "The maximum number of supported profiles supported by the device has been reached"
• After that Syno asks again the same request but without authentication and the cam replies with "NotAuthorized".

So "incorrect username/password" it's a false message and the real problem is that CreateProfile is not supported. I can change this behavior with a different response but I can't support profile creation. So the real question is: "why the previuos version worked?" This is the response of the previous daemon:

int MediaBindingService::CreateProfile(_trt__CreateProfile *trt__CreateProfile, _trt__CreateProfileResponse &trt__CreateProfileResponse)
{
    SOAP_EMPTY_HANDLER(trt__CreateProfile, "Media");
}

An empty message.

[roleoroleo]

Please, try the following files. In /mnt/mmc/sonoff-hack/www/onvif onvif_simple_server.gz In /mnt/mmc/sonoff-hack/www/onvif/generic_files Empty.xml.gz

This version replies with an empty message like the previous daemon.

[delvinru]

Sorry for the delayed answer. I tried to run the onvif_simple_server, but it crashes with an error (below logs) I assume that this is due to the fact that patches were not applied during the build: https://github.com/roleoroleo/sonoff-hack/blob/master/src/onvif_simple_server/path.patch

1970-01-01 00:07:16 FATAL onvif_simple_server.c:282: Unable to find configuration file /etc/onvif_simple_server.conf

UPD: Corrected the file system.sh in order for the config to be transferred to /etc (as a hotfix), this did not help, a similar error is returned as before. In my opinion, you should not bother with dynamic profiles, this is not the level of cameras (IMHO)

[roleoroleo]

In my opinion, you should not bother with dynamic profiles, this is not the level of cameras (IMHO)

I agree, but wich response should I send when Syno asks "CreateProfile"?

• Generic SOAP error
• "The maximum number of supported profiles supported by the device has been reached" SOAP error.
• Emtpy response
• No response

[roleoroleo]

Please, try these versions and capture the traffic if you can:

action_failed.tar.gz maximum_number.tar.gz empty_response.tar.gz no_response.tar.gz

[delvinru]

The archive contains traffic and small notes that I found during testing.

To put it briefly, no_response.tar.gz works as it should, login/password verification passes, the picture is transmitted without errors and the Synology interface does not issue errors.

camera_test.tar.gz

I also noticed that camera detection does not work (on all tested versions), although the ONVIF WS-Discovery option is enabled in the settings. It would be nice if we could sort out this problem as well.

[roleoroleo]

The log confirms. I think it's not a "standard" behavior, so I will add a special option to handle it.

About discovery, are you running in the same network? It's a broadcast protocol, so it doesn't work if the nvr and the cam are in different subnets. For example if you run the nvr inside a docker container (standard bridge network) it doesn't work.

[delvinru]

are you running in the same network?

Yes, ip of sonoff camera - 192.168.1.174, synology - 192.168.1.182, should be ok.

[roleoroleo]

Does ODM detect the cam?

[delvinru]

Does ODM detect the cam?

no

[roleoroleo]

Strange... Is wsd_simple_server daemon running? Did you select the correct interface?

[delvinru]

I assume this is because of the following error (/tmp/wsd_simple_server.log):

1970-01-01 00:01:03 FATAL wsd_simple_server.c:453: Error joining multicast group

Why this error occurs, zero ideas.

[roleoroleo]

Check the error number with this version: wsd_simple_server.gz

[delvinru]

1970-01-01 00:01:00 FATAL wsd_simple_server.c:453: Error joining multicast group: 19

[roleoroleo]

Are there other messages in the log?

[delvinru]

No, just this line, and that's it.

[roleoroleo]

Please, run the command with verbose log: /mnt/mmc/sonoff-hack/bin/wsd_simple_server --pid_file /var/run/wsd_simple_server.pid --if_name eth0 --xaddr http://%s/onvif/device_service -m sonoff_hack -n Sonoff -d 5 Use ra0 or eth0 based on your network connection.

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.