mirror of
https://github.com/kerberos-io/onvif.git
synced 2026-08-23 15:08:33 +00:00
d726ed8edb
Critical
- Device.SendSoapWithHeader now parses the supplied header content
with etree and adds each top-level child as its own SOAP Header
block. gosoap.AddStringHeaderContent only accepts a single root
element; previously a multi-child ref-params header silently
produced a header-less request because the parse error was
discarded. Errors are now propagated.
- enrichSOAPErr scrubs <*:Security> blocks from response bodies
before fault extraction or excerpt slicing so a camera that
echoes the WS-Security header in a fault response cannot leak
Username/Password into operator logs.
Important
- extractSOAPFault falls back to the SOAP 1.2 Subcode (e.g.
ter:InvalidArgs) when Reason/Text is empty — consistent with
enrichSOAPErr and surfaces actionable detail on 200-OK fault
bodies reached via unmarshalNode.
- subscriptionRef captures the camera-granted TerminationTime
from CreatePullPointSubscription and Renew responses. renewLoop
schedules from it via the new nextRenewInterval helper so we
never miss a renew when the camera grants less than requested.
renew is now a sleep-loop driven by the latest granted time.
- enrichSOAPErr reads at most 64 KiB from the body (vs. 10 MiB
on success paths). Fault bodies are always small; the prior cap
let a wedged camera churn 10 MiB/s through the retry loop.
Suggestions
- extractReferenceParameters anchors to <SubscriptionReference> so
a wsa:ReplyTo / wsa:FaultTo that also carries ReferenceParameters
elsewhere in the envelope cannot leak through and break PullMessages.
- buildRefParamsHeader accepts either raw children or the full
<*:ReferenceParameters> wrapper, and propagates ancestor xmlns:*
onto each child so a vendor that declares the prefix on the
parent (not the child itself, as AXIS does) still produces valid
standalone children on the wire.
- SendSoapWithHeader documents that xmlHeaderContent must be
well-formed XML and that the caller is responsible for escaping
any externally sourced data.
- Error-message ordering is now context-first
("SOAP fault: X: <wrapped err>") per Go convention.
- Dead headerEnd slicing removed from the SendSoapWithHeader test.
Tests
- End-to-end multi-child wiring through pullMessages.
- Digest auth retry preserves the injected header.
- Malformed-XML header content fast-fails before any request.
- buildRefParamsHeader malformed / whitespace-only edge cases.
- goleak.VerifyTestMain in event/stream catches any pull/renew
goroutine that outlives its Stream.
No new behavioural surface added to onvif core; SendSoap retains
its signature, SendSoapWithHeader is the only new public method.
81 lines
2.4 KiB
Go
81 lines
2.4 KiB
Go
package stream
|
|
|
|
import (
|
|
"context"
|
|
"encoding/xml"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/kerberos-io/onvif/event"
|
|
"github.com/kerberos-io/onvif/xsd"
|
|
)
|
|
|
|
// renewLoop sleeps until the next deadline (camera-granted termination
|
|
// minus RenewMargin), renews, and repeats. A permanently failing
|
|
// renew lets the subscription die at the camera; the pull loop's
|
|
// reconnect path then recreates it — recreate is the only reliable
|
|
// recovery once a subscription is GC'd.
|
|
func (s *Stream) renewLoop(ctx context.Context) {
|
|
for {
|
|
ref := s.getPullPoint()
|
|
if !sleepCtx(ctx, nextRenewInterval(ref.GrantedTermination, s.opts, time.Now())) {
|
|
return
|
|
}
|
|
granted, err := renewPullPoint(s.caller, s.getPullPoint(), s.opts)
|
|
if err != nil {
|
|
s.surfaceError(ErrRenewFailed{Err: err})
|
|
continue
|
|
}
|
|
if !granted.IsZero() {
|
|
s.updateGrantedTermination(granted)
|
|
}
|
|
}
|
|
}
|
|
|
|
// nextRenewInterval prefers the camera-granted termination so we never
|
|
// schedule a renew past the actual expiry, with opts.InitialTermination
|
|
// as the fallback when the camera didn't supply one.
|
|
func nextRenewInterval(granted time.Time, opts Options, now time.Time) time.Duration {
|
|
var base time.Duration
|
|
if !granted.IsZero() {
|
|
base = granted.Sub(now)
|
|
} else {
|
|
base = opts.InitialTermination
|
|
}
|
|
d := base - opts.RenewMargin
|
|
if d <= 0 {
|
|
d = base / 2
|
|
}
|
|
if d <= 0 {
|
|
d = time.Second
|
|
}
|
|
return d
|
|
}
|
|
|
|
// renewPullPoint sends Renew with an absolute UTC TerminationTime.
|
|
// WS-BaseNotification §6.1.1 also allows xsd:duration but older
|
|
// Hikvision, some Dahua and some Bosch firmwares reject the
|
|
// relative form. Returns the camera-granted TerminationTime parsed
|
|
// from the response (zero on absence) so the caller can reschedule.
|
|
func renewPullPoint(c caller, ref subscriptionRef, opts Options) (time.Time, error) {
|
|
absoluteEnd := time.Now().UTC().Add(opts.InitialTermination).Format("2006-01-02T15:04:05Z")
|
|
req := event.Renew{TerminationTime: xsd.String(absoluteEnd)}
|
|
body, err := xml.Marshal(req)
|
|
if err != nil {
|
|
return time.Time{}, fmt.Errorf("marshal Renew: %w", err)
|
|
}
|
|
headerXML, err := buildRefParamsHeader(ref.RefParamsXML)
|
|
if err != nil {
|
|
return time.Time{}, fmt.Errorf("build ref params header: %w", err)
|
|
}
|
|
resp, err := c.SendSoapWithHeader(ref.Address, string(body), headerXML)
|
|
if err != nil {
|
|
return time.Time{}, enrichSOAPErr(resp, err)
|
|
}
|
|
respBody, err := readClose(resp)
|
|
if err != nil {
|
|
return time.Time{}, err
|
|
}
|
|
return extractTerminationTime(respBody), nil
|
|
}
|