ONVIF credentials not consistently copied into stream URL

[irichter]

Because stream URL generation is not centralized, the ONVIF credentials aren't always copied into the stream URL. For example, ensure_stream_registered_with_go2rtc() (in /src/video/go2rtc/go2rtc_integration.c) does pass the ONVIF credentials. However, mp4_recording_thread() (in /src/video/mp4_recording_core.c) and the API endpoint for /api/streams/test (handle_test_stream() in /src/web/api_handlers_streams_test.c) do not modify the URL to include credentials, causing them to fail.

Adding credentials directly to the stream URL (i.e. rtsp://user:password@device.fqdn.or.ip.address/streamName) does help with the places where they aren't copied, but breaks the code that does copy them.

[matteius]

Just pushed a commit to main that should fix this -- are you able to test or need to wait for new version?

[matteius]

0.28.3

[irichter]

Motion events are now recording correctly (from the Trigger Test Motion Event). However, I'm now no longer getting the credentials passed to go2rtc. I'm adding some debug statements and will let you know if I figure out what's going on.

The "Test Connection" button from the web stream editor isn't working, but I think that's because testStreamConnection (see /web/js/components/preact/StreamsView.jsx) isn't passing credentials. Adding the following to testStreamConnection makes it work (yes, you have my permission to add this code):

      onvif_username: currentStream.isOnvif ? currentStream.onvifUsername : undefined,
      onvif_password: currentStream.isOnvif ? currentStream.onvifPassword : undefined,

Note that testing the connection does leak the full credentials (username and password) to the logs with level INFO (from handle_test_stream() in /src/web/api_handlers_streams_test.c). I'm not sure if that's desired, and am pretty sure that there are other places that this also happens (e.g.: any time the stream URL is logged).

[irichter]

Since lightNVR already uses CURL, why not use CURL's URL manipulation API https://curl.se/libcurl/c/libcurl-url.html for extracting components, adding credentials, ...?

[matteius]

Thanks for your feedback, I pushed a change that may improve this for lightNVR.

[irichter]

start_hls_unified_stream() (/src/video/hls/hls_unified_thread.c) is not adding the credentials before spawning the hls_unified_thread_func thread.

It's probably worth checking each function that references stream_config_t->url to see whether it's also referencing stream_config_t->onvif_username. This isn't a perfect heuristic, but ought to at least find many of these bugs.

[irichter]

By the time test_onvif_connection() (in /src/video/onvif_device_management.c) gets to Trying direct RTSP URL (after failing to open TCP or UDP), it's somehow getting the credentials doubled.

If you use curl_url_set() and friends, I suspect that many of the doubling issues will go away, since if the credentials are already in the URL, it won't add them. (If the new credentials are difference, they'll override credentials already present.)

As to prior failures, I'll try to do some digging with wireshark to see when the credentials are actually being doubled.

[matteius]

Feel free to reopen if this commit did not fix.