324 lines
10 KiB
Go
324 lines
10 KiB
Go
package onvif
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/md5"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/xml"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
type Credential struct {
|
|
Username string
|
|
Password string
|
|
}
|
|
type Profile struct {
|
|
Token string `json:"token"`
|
|
Name string `json:"name"`
|
|
Width int `json:"width"`
|
|
Height int `json:"height"`
|
|
Encoding string `json:"encoding"`
|
|
StreamURI string `json:"stream_uri"`
|
|
}
|
|
type Client interface {
|
|
Profiles(context.Context, string, Credential) ([]Profile, error)
|
|
}
|
|
|
|
type HTTPClient struct{ client *http.Client }
|
|
|
|
func NewHTTPClient(timeout time.Duration) *HTTPClient {
|
|
if timeout <= 0 {
|
|
timeout = 8 * time.Second
|
|
}
|
|
return &HTTPClient{client: &http.Client{
|
|
Timeout: timeout,
|
|
CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}}
|
|
}
|
|
func (c *HTTPClient) Profiles(ctx context.Context, address string, credential Credential) ([]Profile, error) {
|
|
deviceEndpoint, err := validateEndpoint(address)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
capabilitiesBody := `<?xml version="1.0"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><GetCapabilities xmlns="http://www.onvif.org/ver10/device/wsdl"><Category>All</Category></GetCapabilities></s:Body></s:Envelope>`
|
|
capabilities, err := c.soap(ctx, deviceEndpoint, credential, capabilitiesBody)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
mediaAddress, err := ParseMediaServiceAddress(capabilities)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
endpoint, err := normalizeServiceEndpoint(deviceEndpoint, mediaAddress)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
body := `<?xml version="1.0"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><GetProfiles xmlns="http://www.onvif.org/ver10/media/wsdl"/></s:Body></s:Envelope>`
|
|
data, err := c.soap(ctx, endpoint, credential, body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
profiles, err := ParseProfiles(data)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
for i := range profiles {
|
|
uriBody := fmt.Sprintf(`<?xml version="1.0"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><GetStreamUri xmlns="http://www.onvif.org/ver10/media/wsdl"><StreamSetup><Stream xmlns="http://www.onvif.org/ver10/schema">RTP-Unicast</Stream><Transport xmlns="http://www.onvif.org/ver10/schema"><Protocol>RTSP</Protocol></Transport></StreamSetup><ProfileToken>%s</ProfileToken></GetStreamUri></s:Body></s:Envelope>`, xmlEscape(profiles[i].Token))
|
|
streamData, err := c.soap(ctx, endpoint, credential, uriBody)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
profiles[i].StreamURI, err = ParseStreamURI(streamData)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
profiles[i].StreamURI, err = normalizeStreamURI(deviceEndpoint, profiles[i].StreamURI)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
return profiles, nil
|
|
}
|
|
|
|
func normalizeStreamURI(deviceEndpoint, streamURI string) (string, error) {
|
|
device, err := url.Parse(deviceEndpoint)
|
|
if err != nil || device.Hostname() == "" {
|
|
return "", fmt.Errorf("invalid ONVIF address")
|
|
}
|
|
stream, err := url.Parse(streamURI)
|
|
if err != nil || stream.Scheme != "rtsp" || stream.Host == "" || stream.User != nil {
|
|
return "", fmt.Errorf("invalid RTSP stream URI")
|
|
}
|
|
if !strings.EqualFold(stream.Hostname(), device.Hostname()) {
|
|
port := stream.Port()
|
|
stream.Host = device.Hostname()
|
|
if port != "" {
|
|
stream.Host = net.JoinHostPort(device.Hostname(), port)
|
|
}
|
|
}
|
|
return stream.String(), nil
|
|
}
|
|
func (c *HTTPClient) soap(ctx context.Context, endpoint string, credential Credential, body string) ([]byte, error) {
|
|
return c.soapAttempt(ctx, endpoint, credential, body, "")
|
|
}
|
|
|
|
func (c *HTTPClient) soapAttempt(ctx context.Context, endpoint string, credential Credential, body, authorization string) ([]byte, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewBufferString(body))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
req.Header.Set("Content-Type", "application/soap+xml; charset=utf-8")
|
|
if authorization != "" {
|
|
req.Header.Set("Authorization", authorization)
|
|
} else if credential.Username != "" {
|
|
req.SetBasicAuth(credential.Username, credential.Password)
|
|
}
|
|
res, err := c.client.Do(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("onvif request failed: %w", err)
|
|
}
|
|
defer res.Body.Close()
|
|
data, err := io.ReadAll(io.LimitReader(res.Body, 2<<20))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if res.StatusCode == http.StatusUnauthorized {
|
|
if authorization == "" && credential.Username != "" {
|
|
challenge, challengeErr := parseDigestChallenge(res.Header.Values("WWW-Authenticate"))
|
|
if challengeErr == nil {
|
|
digest, digestErr := digestAuthorization(http.MethodPost, req.URL.RequestURI(), credential, challenge)
|
|
if digestErr != nil {
|
|
return nil, digestErr
|
|
}
|
|
return c.soapAttempt(ctx, endpoint, credential, body, digest)
|
|
}
|
|
}
|
|
return nil, fmt.Errorf("authentication_failed")
|
|
}
|
|
if res.StatusCode < 200 || res.StatusCode >= 300 {
|
|
return nil, fmt.Errorf("onvif_http_%d", res.StatusCode)
|
|
}
|
|
return data, nil
|
|
}
|
|
|
|
type digestChallenge struct {
|
|
realm string
|
|
nonce string
|
|
opaque string
|
|
algorithm string
|
|
qop string
|
|
}
|
|
|
|
func parseDigestChallenge(values []string) (digestChallenge, error) {
|
|
for _, value := range values {
|
|
if !strings.EqualFold(strings.TrimSpace(strings.SplitN(value, " ", 2)[0]), "Digest") {
|
|
continue
|
|
}
|
|
parts := strings.SplitN(strings.TrimSpace(value), " ", 2)
|
|
if len(parts) != 2 {
|
|
break
|
|
}
|
|
params, err := parseAuthParameters(parts[1])
|
|
if err != nil {
|
|
return digestChallenge{}, err
|
|
}
|
|
challenge := digestChallenge{
|
|
realm: strings.TrimSpace(params["realm"]), nonce: strings.TrimSpace(params["nonce"]),
|
|
opaque: strings.TrimSpace(params["opaque"]), algorithm: strings.ToUpper(strings.TrimSpace(params["algorithm"])),
|
|
}
|
|
if challenge.realm == "" || challenge.nonce == "" {
|
|
return digestChallenge{}, fmt.Errorf("invalid_digest_challenge")
|
|
}
|
|
if challenge.algorithm == "" {
|
|
challenge.algorithm = "MD5"
|
|
}
|
|
if challenge.algorithm != "MD5" && challenge.algorithm != "SHA-256" {
|
|
return digestChallenge{}, fmt.Errorf("unsupported_digest_algorithm")
|
|
}
|
|
qops := strings.Split(params["qop"], ",")
|
|
for _, qop := range qops {
|
|
if strings.EqualFold(strings.TrimSpace(qop), "auth") {
|
|
challenge.qop = "auth"
|
|
break
|
|
}
|
|
}
|
|
if params["qop"] != "" && challenge.qop == "" {
|
|
return digestChallenge{}, fmt.Errorf("unsupported_digest_qop")
|
|
}
|
|
return challenge, nil
|
|
}
|
|
return digestChallenge{}, fmt.Errorf("digest_challenge_not_found")
|
|
}
|
|
|
|
func parseAuthParameters(value string) (map[string]string, error) {
|
|
result := map[string]string{}
|
|
for position := 0; position < len(value); {
|
|
for position < len(value) && (value[position] == ' ' || value[position] == ',') {
|
|
position++
|
|
}
|
|
start := position
|
|
for position < len(value) && value[position] != '=' && value[position] != ',' {
|
|
position++
|
|
}
|
|
if position == start || position >= len(value) || value[position] != '=' {
|
|
return nil, fmt.Errorf("invalid_digest_challenge")
|
|
}
|
|
name := strings.ToLower(strings.TrimSpace(value[start:position]))
|
|
position++
|
|
var parameter string
|
|
if position < len(value) && value[position] == '"' {
|
|
position++
|
|
var builder strings.Builder
|
|
closed := false
|
|
for position < len(value) {
|
|
if value[position] == '"' {
|
|
position++
|
|
closed = true
|
|
break
|
|
}
|
|
if value[position] == '\\' && position+1 < len(value) {
|
|
position++
|
|
}
|
|
builder.WriteByte(value[position])
|
|
position++
|
|
}
|
|
if !closed {
|
|
return nil, fmt.Errorf("invalid_digest_challenge")
|
|
}
|
|
parameter = builder.String()
|
|
} else {
|
|
start = position
|
|
for position < len(value) && value[position] != ',' {
|
|
position++
|
|
}
|
|
parameter = strings.TrimSpace(value[start:position])
|
|
}
|
|
result[name] = parameter
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func digestAuthorization(method, uri string, credential Credential, challenge digestChallenge) (string, error) {
|
|
cnonceBytes := make([]byte, 16)
|
|
if _, err := rand.Read(cnonceBytes); err != nil {
|
|
return "", fmt.Errorf("generate_digest_cnonce: %w", err)
|
|
}
|
|
cnonce := fmt.Sprintf("%x", cnonceBytes)
|
|
hash := func(value string) string {
|
|
if challenge.algorithm == "SHA-256" {
|
|
sum := sha256.Sum256([]byte(value))
|
|
return fmt.Sprintf("%x", sum)
|
|
}
|
|
sum := md5.Sum([]byte(value))
|
|
return fmt.Sprintf("%x", sum)
|
|
}
|
|
ha1 := hash(credential.Username + ":" + challenge.realm + ":" + credential.Password)
|
|
ha2 := hash(method + ":" + uri)
|
|
nonceCount := "00000001"
|
|
response := hash(ha1 + ":" + challenge.nonce + ":" + ha2)
|
|
if challenge.qop != "" {
|
|
response = hash(ha1 + ":" + challenge.nonce + ":" + nonceCount + ":" + cnonce + ":" + challenge.qop + ":" + ha2)
|
|
}
|
|
values := []string{
|
|
`username=` + strconv.Quote(credential.Username), `realm=` + strconv.Quote(challenge.realm),
|
|
`nonce=` + strconv.Quote(challenge.nonce), `uri=` + strconv.Quote(uri),
|
|
`response=` + strconv.Quote(response), `algorithm=` + challenge.algorithm,
|
|
}
|
|
if challenge.opaque != "" {
|
|
values = append(values, `opaque=`+strconv.Quote(challenge.opaque))
|
|
}
|
|
if challenge.qop != "" {
|
|
values = append(values, `qop=`+challenge.qop, `nc=`+nonceCount, `cnonce=`+strconv.Quote(cnonce))
|
|
}
|
|
return "Digest " + strings.Join(values, ", "), nil
|
|
}
|
|
|
|
func normalizeServiceEndpoint(deviceEndpoint, advertisedEndpoint string) (string, error) {
|
|
device, err := url.Parse(deviceEndpoint)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid ONVIF address")
|
|
}
|
|
advertised, err := url.Parse(advertisedEndpoint)
|
|
if err != nil || advertised.Scheme == "" || advertised.Host == "" || advertised.User != nil {
|
|
return "", fmt.Errorf("invalid ONVIF media address")
|
|
}
|
|
if advertised.Scheme != "http" && advertised.Scheme != "https" {
|
|
return "", fmt.Errorf("unsupported ONVIF media scheme")
|
|
}
|
|
if !strings.EqualFold(advertised.Hostname(), device.Hostname()) {
|
|
advertised.Scheme = device.Scheme
|
|
advertised.Host = device.Host
|
|
}
|
|
return advertised.String(), nil
|
|
}
|
|
func validateEndpoint(value string) (string, error) {
|
|
parsed, err := url.Parse(value)
|
|
if err != nil || parsed.Scheme == "" || parsed.Host == "" {
|
|
return "", fmt.Errorf("invalid ONVIF address")
|
|
}
|
|
if parsed.User != nil {
|
|
return "", fmt.Errorf("credentials must not appear in ONVIF address")
|
|
}
|
|
if parsed.Scheme != "http" && parsed.Scheme != "https" {
|
|
return "", fmt.Errorf("unsupported ONVIF scheme")
|
|
}
|
|
return parsed.String(), nil
|
|
}
|
|
func xmlEscape(value string) string {
|
|
var b strings.Builder
|
|
_ = xml.EscapeText(&b, []byte(value))
|
|
return b.String()
|
|
}
|
|
|