mirror of
https://github.com/kerberos-io/onvif.git
synced 2026-08-23 15:08:33 +00:00
d7cfee56a1
Critical
- Renew busy-loop on persistent failure: after a failed
renewPullPoint, the loop re-read the (now in-past)
GrantedTermination and nextRenewInterval floored to 1s, hammering
the camera at 1 Hz until reconnect. nextRenewIntervalAfterError
decouples the failure path from the stale grant and backs off
at opts.RetryBackoff. renewLoop also routes through s.now() so
test clocks can drive it deterministically.
- Lost-update race on GrantedTermination: a renew result for an
old subscription could overwrite the grant on a new one if
attemptRecreate swapped pullPoint mid-flight. A generation
counter on Stream tracks subscription rotation; the renew loop
captures the generation before the SOAP call and discards the
result if the subscription was rotated.
- Credential leak when <Security> straddled the 64 KiB error cap:
the non-greedy regex required a closing tag and missed the
truncated case. wsseSecurityRE now matches close-tag-or-EOF.
Belt-and-braces wssePasswordRE redacts <Password> elements
outside any Security wrapper.
- addHeaderChildren accepted well-formed-but-element-free input
and produced a header-less request. Now errors out.
Important
- Wrapper detection in buildRefParamsHeader was HasSuffix-based and
misfired on children named *ReferenceParameters. Replaced with the
unambiguous wrapper-only contract: input must be the full
<*:ReferenceParameters> element returned by extractReferenceParameters.
- Renamed SoapOption → SendSoapOption and WithHeader → WithSOAPHeader
to disambiguate at call sites.
- Renamed WithHeader's `xml` parameter to headerContent to avoid
shadowing the encoding/xml package name.
- Documented terminationTimeRE's "first match only" semantics so
nobody re-uses it from PullMessages context where multiple
TerminationTime elements appear.
- goleak is now a direct require (go mod tidy).
Performance
- Added gosoap.AddStringHeaderContents (plural) for multi-root
header content. AddStringHeaderContent remains as-is for
backwards compatibility with external consumers. Device.go's
addHeaderChildren workaround is gone — one etree parse per
SendSoapWithOptions call instead of two.
Migration
- Device.go's own CallOnvifFunction and the three examples now
call SendSoapWithOptions, modelling the canonical path.
Docs / tests
- Trust-boundary warning on SendSoapWithHeader/Options godoc.
- Comments on createPullPointResp/Alt explain why TerminationTime
is intentionally omitted (renew timing fixtures).
- New tests: digest retry strips WS-Security, duplicate
WithSOAPHeader is last-wins, malformed TerminationTime yields
zero, margin==base falls to base/2, empty SubscriptionReference
yields empty ref params, Security straddling cap is redacted,
bare Password redacted, wrapper-only contract is enforced.
45 lines
1.7 KiB
Modula-2
45 lines
1.7 KiB
Modula-2
module github.com/kerberos-io/onvif
|
|
|
|
go 1.20
|
|
|
|
require (
|
|
github.com/beevik/etree v1.2.0
|
|
github.com/clbanning/mxj/v2 v2.7.0
|
|
github.com/elgs/gostrgen v0.0.0-20161222160715-9d61ae07eeae
|
|
github.com/gin-gonic/gin v1.9.1
|
|
github.com/google/uuid v1.4.0
|
|
github.com/icholy/digest v0.1.23
|
|
github.com/juju/errors v1.0.0
|
|
github.com/stretchr/testify v1.8.4
|
|
go.uber.org/goleak v1.3.0
|
|
golang.org/x/net v0.19.0
|
|
)
|
|
|
|
require (
|
|
github.com/bytedance/sonic v1.9.1 // indirect
|
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.14.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.4 // indirect
|
|
github.com/leodido/go-urn v1.2.4 // indirect
|
|
github.com/mattn/go-isatty v0.0.19 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.11 // indirect
|
|
golang.org/x/arch v0.3.0 // indirect
|
|
golang.org/x/crypto v0.16.0 // indirect
|
|
golang.org/x/sys v0.15.0 // indirect
|
|
golang.org/x/text v0.14.0 // indirect
|
|
google.golang.org/protobuf v1.30.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|