ONVIF Camera Compliance Testing

[ZerOne]

Initial testing of a number of non compliant Onvif cameras were found to respond to non Onvif standard SOAP header requests. (Longhand SOAP requests).
The following is an example of the Official Onvif SOAP protocol header, which in theory should be supported by all Onvif compliant cameras.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns:tt="http://www.onvif.org/ver10/schema"
  xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
  xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
  xmlns:tds="http://www.onvif.org/ver10/device/wsdl">
  <SOAP-ENV:Header>
    <wsse:Security>
      <wsse:UsernameToken>
        <wsse:Username>username</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-            1.0#PasswordDigest">tuOSpGlFlIXsozq4HFNeeGeFLEI=</wsse:Password>
        <wsse:Nonce>LKqI6G/AikKCQrN0zqZFlg==</wsse:Nonce>
        <wsu:Created>2010-09-16T07:50:45Z</wsu:Created>
      </wsse:UsernameToken>
    </wsse:Security>
  </SOAP-ENV:Header>
  <SOAP-ENV:Body>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>  

In this example, the xml namespace wsse is declared in the SOAP envelope, and utilised in the Envelope Header.

The following is a SOAP shorthand version of the same above request, which works with many Onvif cameras that do not support the above SOAP message format.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" 
  xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
  <s:Header>
    <Security s:mustUnderstand="1" 
      xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <UsernameToken>
        <Username>username</Username>
        <Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">
          tuOSpGlFlIXsozq4HFNeeGeFLEI=
        </Password>
        <Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">
          LKqI6G/AikKCQrN0zqZFlg==
        </Nonce>
        <Created xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
          2010-09-16T07:50:45Z
        </Created>
      </UsernameToken>
    </Security>
  </s:Header>
  <s:Body 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  </s:Body>
</s:Envelope>",

In the example above, the xml namespace wsse is defined in the soap envelope, as well as in the Header Security payload.

[ZerOne]

When using the Onvif protocol to query the batch of Onvif Cameras for manufacturer information, although all cameras responded with data, very few cameras actually responded with informative data.

Many cameras responded with generic data such as “Camera Manufacturer” for the camera make / manufacturer, or results such as “IP Camera” for the Camera model.
Some cameras responded with the Manufacturer of the Camera’s System on Chip manufacturer, (The supplier of the camera processor), rather than the actual manufacturer of the camera, which further rendered the results of the Onvif request useless.

Due to this, it is determined that it would be impossible to determine the make or model of a camera based on the Onvif information provided, and that it would consequently be impossible to dynamically query the camera using hacky methods to obtain or set camera information, based on identification of the camera and its Onvif limitations.

Although some Onvif protocol elements were not supported on many cameras, some of the critical camera information could be obtained via similar Onvif protocol requests.
For example, the Camera stream encoding could be obtained by issuing an Onvif GET_VIDEO_ENCODER_CONFIGURATIONS request, or alternatively could be obtained via GET_VIDEO_PROFILES, or GET_VIDEO_STREAM.
Video Resolutions could be obtained from GET_VIDEO_SOURCES, or GET_VIDEO_STREAMS.

This allowed for obtaining required data from the camera regarding stream configurations by utilising multiple Onvif requests for a non compliant camera, until the required data has been supplied.