SMTP Event Server

[iNotMario]

I very recently installed bluecherry, and it seemed to be missing this particular feature. So i made a very simple bash script that will suffice.

This is fairly straight forward, but what it does is use socat to listen to the mail port and execute a script upon connection.
It then uses the /tmp/bluecherry_trigger socket to inform bluecherry of motion.

You can install this by putting the smtp_trigger folder in /opt and then adding the smtp-trigger.service file to systemd. Just enable --now, and you're off to the races. You can, of course, float your boat however you want.

It does absolutely no authentication. It will humor any cameras that try to use it.
Of course it doesn't support TLS either, but some cameras wont speak unless it acts like it does, even when TLS is off.
This in mind, firewall it off from non-camera networks.

smtp_trigger.tar.gz
smtp-trigger.service.txt

[curtishall]

Interesting. Does your camera not support ONVIF motion triggering?

[curtishall]

I would be interested in seeing any faulty XML you can provide or access to this camera so we can ultimately better support these cameras in our ONVIF detection.

[iNotMario]

Absolutely, i'll turn it on and grab a strace. I was looking at this yesterday, but i didn't save it.

[iNotMario]

Interesting, to me, at first glance... this looks very different from what agsh's onvif seems to get.

So i'm guessing this has more to do with the subscription itself...

POST /onvif/events_service?session=6
Host: 1.5.9.105
User-Agent: gSOAP/2.8
Content-Type: application/soap+xml; charset=utf-8; action=\"http://www.onvif.org/ver10/events/wsdl/PullPointSubscription/PullMessagesRequest\"
Content-Length: 1557
Connection: close
Accept-Encoding: gzip,deflate
SOAPAction: \"http://www.onvif.org/ver10/events/wsdl/PullPointSubscription/PullMessagesRequest\"

<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\"><SOAP-ENV:Header><wsa5:Action xmlns:wsa5=\"http://www.w3.org/2005/08/addressing\" SOAP-ENV:mustUnderstand=\"true\">http://www.onvif.org/ver10/events/wsdl/PullPointSubscription/PullMessagesResponse</wsa5:Action><wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" SOAP-ENV:mustUnderstand=\"true\"><wsu:Timestamp xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" wsu:Id=\"Time\"><wsu:Created>2021-05-05T19:01:22Z</wsu:Created><wsu:Expires>2021-05-05T19:01:32Z</wsu:Expires></wsu:Timestamp><wsse:UsernameToken xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" wsu:Id=\"Auth\"><wsse:Username>admin</wsse:Username><wsse:Password Type=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest\">OOnSbVmesK/sjcCFvyatrmEMhXA=</wsse:Password><wsse:Nonce EncodingType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary\">guuSYOsTb2cqE+9zCD/q9pxyHuQ=</wsse:Nonce><wsu:Created>2021-05-05T19:01:22Z</wsu:Created></wsse:UsernameToken></wsse:Security></SOAP-ENV:Header><SOAP-ENV:Body><tev:PullMessages xmlns:tev=\"http://www.onvif.org/ver10/events/wsdl\"><tev:Timeout>PT8S</tev:Timeout><tev:MessageLimit>10</tev:MessageLimit></tev:PullMessages></SOAP-ENV:Body></SOAP-ENV:Envelope>

HTTP/1.1 200 OK
Content-type: application/soap+xml; charset=utf-8
Access-Control-Allow-Origin: *
Content-Length: 3769
Connection: keep-alive

<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:chan=\"http://schemas.microsoft.com/ws/2005/02/duplex\" xmlns:c14n=\"http://www.w3.org/2001/10/xml-exc-c14n#\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:saml1=\"urn:oasis:names:tc:SAML:1.0:assertion\" xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" xmlns:xenc=\"http://www.w3.org/2001/04/xmlenc#\" xmlns:wsc=\"http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsa5=\"http://www.w3.org/2005/08/addressing\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:wsdd=\"http://schemas.xmlsoap.org/ws/2005/04/discovery\" xmlns:xmime=\"http://tempuri.org/xmime.xsd\" xmlns:xop=\"http://www.w3.org/2004/08/xop/include\" xmlns:tt=\"http://www.onvif.org/ver10/schema\" xmlns:wsrfbf=\"http://docs.oasis-open.org/wsrf/bf-2\" xmlns:wstop=\"http://docs.oasis-open.org/wsn/t-1\" xmlns:wsrfr=\"http://docs.oasis-open.org/wsrf/r-2\" xmlns:d3=\"http://www.onvif.org/ver10/network/wsdl/RemoteDiscoveryBinding\" xmlns:d4=\"http://www.onvif.org/ver10/network/wsdl/DiscoveryLookupBinding\" xmlns:dn=\"http://www.onvif.org/ver10/network/wsdl\" xmlns:tan2=\"http://www.onvif.org/ver20/analytics/wsdl/AnalyticsEngineBinding\" xmlns:tan3=\"http://www.onvif.org/ver20/analytics/wsdl/RuleEngineBinding\" xmlns:tan=\"http://www.onvif.org/ver20/analytics/wsdl\" xmlns:tds=\"http://www.onvif.org/ver10/device/wsdl\" xmlns:tev2=\"http://www.onvif.org/ver10/events/wsdl/NotificationProducerBinding\" xmlns:tev3=\"http://www.onvif.org/ver10/events/wsdl/EventBinding\" xmlns:tev4=\"http://www.onvif.org/ver10/events/wsdl/SubscriptionManagerBinding\" xmlns:tev=\"http://www.onvif.org/ver10/events/wsdl\" xmlns:tev5=\"http://www.onvif.org/ver10/events/wsdl/PullPointSubscriptionBinding\" xmlns:tev6=\"http://www.onvif.org/ver10/events/wsdl/NotificationConsumerBinding\" xmlns:tev7=\"http://www.onvif.org/ver10/events/wsdl/CreatePullPointBinding\" xmlns:tev8=\"http://www.onvif.org/ver10/events/wsdl/PausableSubscriptionManagerBinding\" xmlns:wsnt=\"http://docs.oasis-open.org/wsn/b-2\" xmlns:tev9=\"http://www.onvif.org/ver10/events/wsdl/PullPointBinding\" xmlns:timg=\"http://www.onvif.org/ver20/imaging/wsdl\" xmlns:tmd=\"http://www.onvif.org/ver10/deviceIO/wsdl\" xmlns:tptz=\"http://www.onvif.org/ver20/ptz/wsdl\" xmlns:tr2=\"http://www.onvif.org/ver20/media/wsdl\" xmlns:trt=\"http://www.onvif.org/ver10/media/wsdl\" xmlns:tns1=\"http://www.onvif.org/ver10/topics\" xmlns:ter=\"http://www.onvif.org/ver10/error\" xmlns:trc=\"http://www.onvif.org/ver10/recording/wsdl\" xmlns:trp=\"http://www.onvif.org/ver10/replay/wsdl\" xmlns:tse=\"http://www.onvif.org/ver10/search/wsdl\" xmlns:ns1=\"http://www.placeholder.org/ver10/tmp/schema\" xmlns:ns2=\"http://www.placeholder.org/ver10/tmp/wsdl\" xmlns:extxsd=\"http://www.onvifext.com/onvif/ext/ver10/schema\">
        <SOAP-ENV:Header>
                <wsa5:Action SOAP-ENV:mustUnderstand=\"true\">http://www.onvif.org/ver10/events/wsdl/PullPointSubscription/PullMessagesResponse</wsa5:Action>
        </SOAP-ENV:Header>
        <SOAP-ENV:Body>
                <tev:PullMessagesResponse>
                        <tev:CurrentTime>2021-05-05T19:01:23Z</tev:CurrentTime>
                        <tev:TerminationTime>2021-05-05T19:01:23Z</tev:TerminationTime>
                        <wsnt:NotificationMessage>
                                <wsnt:Topic Dialect=\"http://www.onvif.org/ver10/tev/topicExpression/ConcreteSet\"></wsnt:Topic>
                                <wsnt:Message></wsnt:Message>
                        </wsnt:NotificationMessage>
                </tev:PullMessagesResponse>
        </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Oops, something went wrong:
SOAP 1.2 fault SOAP-ENV:Sender[no subcode]
"Validation constraint violation: occurrence constraint violation in element 'wsnt:Message'"

No need to sanitize this, the passwords involved are defaults and IPs are non routeable.

[iNotMario]

agsh's onvif creates this conversation:

POST /onvif/events_service?session=11 HTTP/1.1
Content-Type: application/soap+xml
Content-Length: 1076
charset: utf-8
Host: 1.5.9.105
Connection: close

<s:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:a=\"http://www.w3.org/2005/08/addressing\"><s:Header><Security s:mustUnderstand=\"1\" xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"><UsernameToken><Username>admin</Username><Password Type=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest\">eKPbc2yAMutcz7wzOfvEsPzaj7g=</Password><Nonce EncodingType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary\">kiIqTu6OKn2VdnR5rrTPUg==</Nonce><Created xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\">2021-05-05T19:27:17.455Z</Created></UsernameToken></Security><a:To>http://1.5.9.105/onvif/events_service?session=11</a:To></s:Header><s:Body xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><PullMessages xmlns=\"http://www.onvif.org/ver10/events/wsdl\"><Timeout>PT5S</Timeout><MessageLimit>10</MessageLimit></PullMessages></s:Body></s:Envelope>

HTTP/1.1 200 OK
Content-type: application/soap+xml; charset=utf-8
Access-Control-Allow-Origin: *
Content-Length: 4129
Connection: keep-alive

<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:chan=\"http://schemas.microsoft.com/ws/2005/02/duplex\" xmlns:c14n=\"http://www.w3.org/2001/10/xml-exc-c14n#\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:saml1=\"urn:oasis:names:tc:SAML:1.0:assertion\" xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" xmlns:xenc=\"http://www.w3.org/2001/04/xmlenc#\" xmlns:wsc=\"http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsa5=\"http://www.w3.org/2005/08/addressing\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:wsdd=\"http://schemas.xmlsoap.org/ws/2005/04/discovery\" xmlns:xmime=\"http://tempuri.org/xmime.xsd\" xmlns:xop=\"http://www.w3.org/2004/08/xop/include\" xmlns:tt=\"http://www.onvif.org/ver10/schema\" xmlns:wsrfbf=\"http://docs.oasis-open.org/wsrf/bf-2\" xmlns:wstop=\"http://docs.oasis-open.org/wsn/t-1\" xmlns:wsrfr=\"http://docs.oasis-open.org/wsrf/r-2\" xmlns:d3=\"http://www.onvif.org/ver10/network/wsdl/RemoteDiscoveryBinding\" xmlns:d4=\"http://www.onvif.org/ver10/network/wsdl/DiscoveryLookupBinding\" xmlns:dn=\"http://www.onvif.org/ver10/network/wsdl\" xmlns:tan2=\"http://www.onvif.org/ver20/analytics/wsdl/AnalyticsEngineBinding\" xmlns:tan3=\"http://www.onvif.org/ver20/analytics/wsdl/RuleEngineBinding\" xmlns:tan=\"http://www.onvif.org/ver20/analytics/wsdl\" xmlns:tds=\"http://www.onvif.org/ver10/device/wsdl\" xmlns:tev2=\"http://www.onvif.org/ver10/events/wsdl/NotificationProducerBinding\" xmlns:tev3=\"http://www.onvif.org/ver10/events/wsdl/EventBinding\" xmlns:tev4=\"http://www.onvif.org/ver10/events/wsdl/SubscriptionManagerBinding\" xmlns:tev=\"http://www.onvif.org/ver10/events/wsdl\" xmlns:tev5=\"http://www.onvif.org/ver10/events/wsdl/PullPointSubscriptionBinding\" xmlns:tev6=\"http://www.onvif.org/ver10/events/wsdl/NotificationConsumerBinding\" xmlns:tev7=\"http://www.onvif.org/ver10/events/wsdl/CreatePullPointBinding\" xmlns:tev8=\"http://www.onvif.org/ver10/events/wsdl/PausableSubscriptionManagerBinding\" xmlns:wsnt=\"http://docs.oasis-open.org/wsn/b-2\" xmlns:tev9=\"http://www.onvif.org/ver10/events/wsdl/PullPointBinding\" xmlns:timg=\"http://www.onvif.org/ver20/imaging/wsdl\" xmlns:tmd=\"http://www.onvif.org/ver10/deviceIO/wsdl\" xmlns:tptz=\"http://www.onvif.org/ver20/ptz/wsdl\" xmlns:tr2=\"http://www.onvif.org/ver20/media/wsdl\" xmlns:trt=\"http://www.onvif.org/ver10/media/wsdl\" xmlns:tns1=\"http://www.onvif.org/ver10/topics\" xmlns:ter=\"http://www.onvif.org/ver10/error\" xmlns:trc=\"http://www.onvif.org/ver10/recording/wsdl\" xmlns:trp=\"http://www.onvif.org/ver10/replay/wsdl\" xmlns:tse=\"http://www.onvif.org/ver10/search/wsdl\" xmlns:ns1=\"http://www.placeholder.org/ver10/tmp/schema\" xmlns:ns2=\"http://www.placeholder.org/ver10/tmp/wsdl\" xmlns:extxsd=\"http://www.onvifext.com/onvif/ext/ver10/schema\">
	<SOAP-ENV:Header>
		<wsa5:To SOAP-ENV:mustUnderstand=\"true\">http://1.5.9.105/onvif/events_service?session=11</wsa5:To>
		<wsa5:Action SOAP-ENV:mustUnderstand=\"true\">http://www.onvif.org/ver10/events/wsdl/PullPointSubscription/PullMessagesResponse</wsa5:Action>
	</SOAP-ENV:Header>
	<SOAP-ENV:Body>
		<tev:PullMessagesResponse>
			<tev:CurrentTime>2021-05-05T19:27:18Z</tev:CurrentTime>
			<tev:TerminationTime>2021-05-05T19:28:18Z</tev:TerminationTime>
			<wsnt:NotificationMessage>
				<wsnt:Topic Dialect=\"http://www.onvif.org/ver10/tev/topicExpression/ConcreteSet\">tns1:IntelligentAnalysis/PDAlarm</wsnt:Topic>
				<wsnt:Message><tt:Message UtcTime=\"2021-05-05T19:27:18Z\" PropertyOperation=\"Changed\"><tt:Source><tt:SimpleItem Name=\"Source\" Value=\"VideoSourceToken\"/></tt:Source><tt:Data><tt:SimpleItem Name=\"IsPDAlarm\" Value=\"true\"/></tt:Data></tt:Message></wsnt:Message>
			</wsnt:NotificationMessage>
		</tev:PullMessagesResponse>
	</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

This, of course, makes more sense. Though this still wouldn't work with the filter being used in the onvif_tool.

[iNotMario]

Worth mentioning that there may be more context to these tcp sessions. I've never looked at the ONVIF protocol until yesterday, so i am by no means proficient with it.