RTSP Source 401 after v1.6.0

[emeryao]

Which version are you using?

v1.6.0

Which operating system are you using?

• Linux amd64 Docker

Describe the issue

Hi Team,
Here is my story.

I have 3 different model of TP-Link cameras and added to the mediamtx.yml

at the version of 1.4.x of mediamtx all 3 cameras works perfectly
after upgrade to version 1.5.x one the camera goes down with the log of ERR [path ipc001] [RTSP source] bad status code: 401 (Unauthorized)

and when I update mediamtx to 1.6.0 two of the cameras going down with the 401 message only one camera works for now 😂

I'm pretty sure all the cameras are fine and can be lived with PotPlayer and VLC with the same rtsp url in mediamtx.yml

Describe how to replicate the issue

Did you attach the server logs?

yes

Did you attach a network dump?

no

[aler9]

Hello, this can be certainly fixed but you need to provide a server log with option logLevel: debug, in which the handshake with the cameras (and the resulting 401 status code) is clearly visible. Otherwise the bug cannot be replicated.

[emeryao]

• here is the server log for the issue

2024/04/28 06:49:18 INF [HLS] [muxer tplink] created (requested by 192.168.1.10:49370)
2024/04/28 06:49:18 INF [path tplink] [RTSP source] started on demand
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] connecting
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [c->s] OPTIONS rtsp://192.168.1.13/stream1 RTSP/1.0
CSeq: 1
User-Agent: gortsplib
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [s->c] RTSP/1.0 200 OK
CSeq: 1
Date: Sun, Apr 28 2024 06:49:17 GMT
Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE, GET_PARAMETER, SET_PARAMETER, MULTITRANS
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [c->s] DESCRIBE rtsp://192.168.1.13/stream1 RTSP/1.0
Accept: application/sdp
CSeq: 2
User-Agent: gortsplib
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [s->c] RTSP/1.0 401 Unauthorized
CSeq: 2
Date: Sun, Apr 28 2024 06:49:17 GMT
WWW-Authenticate: Basic realm="TP-LINK IP-Camera"
WWW-Authenticate: Digest realm="TP-LINK IP-Camera", nonce="6100befdab6f407276c35030a302430b"
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [c->s] DESCRIBE rtsp://192.168.1.13/stream1 RTSP/1.0
Accept: application/sdp
Authorization: Digest username="admin", realm="TP-LINK IP-Camera", nonce="6100befdab6f407276c35030a302430b", uri="rtsp://192.168.1.13/stream1", response="7db77e7ba9fbbd76d723098ede1ed217", algorithm="MD5"
CSeq: 3
User-Agent: gortsplib
2024/04/28 06:49:18 DEB [path tplink] [RTSP source] [s->c] RTSP/1.0 401 Unauthorized
CSeq: 3
Date: Sun, Apr 28 2024 06:49:17 GMT
WWW-Authenticate: Basic realm="TP-LINK IP-Camera"
WWW-Authenticate: Digest realm="TP-LINK IP-Camera", nonce="21f7b6b2a54d22f10777ae5cff14b6ad"
2024/04/28 06:49:18 ERR [path tplink] [RTSP source] bad status code: 401 (Unauthorized)

• below is the part of the mediamtx.yml config file

rtsp: yes
# List of enabled RTSP transport protocols.
# UDP is the most performant, but doesn't work when there's a NAT/firewall between
# server and clients, and doesn't support encryption.
# UDP-multicast allows to save bandwidth when clients are all in the same LAN.
# TCP is the most versatile, and does support encryption.
# The handshake is always performed with TCP.
protocols: [udp, multicast, tcp]
# Encrypt handshakes and TCP streams with TLS (RTSPS).
# Available values are "no", "strict", "optional".
encryption: 'no'
# Address of the TCP/RTSP listener. This is needed only when encryption is "no" or "optional".
rtspAddress: :8554
# Address of the TCP/TLS/RTSPS listener. This is needed only when encryption is "strict" or "optional".
rtspsAddress: :8322
# Address of the UDP/RTP listener. This is needed only when "udp" is in protocols.
rtpAddress: :8000
# Address of the UDP/RTCP listener. This is needed only when "udp" is in protocols.
rtcpAddress: :8001
# IP range of all UDP-multicast listeners. This is needed only when "multicast" is in protocols.
multicastIPRange: 224.1.0.0/16
# Port of all UDP-multicast/RTP listeners. This is needed only when "multicast" is in protocols.
multicastRTPPort: 8002
# Port of all UDP-multicast/RTCP listeners. This is needed only when "multicast" is in protocols.
multicastRTCPPort: 8003
# Path to the server key. This is needed only when encryption is "strict" or "optional".
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
serverKey: server.key
# Path to the server certificate. This is needed only when encryption is "strict" or "optional".
serverCert: server.crt
# Authentication methods. Available are "basic" and "digest".
# "digest" doesn't provide any additional security and is available for compatibility only.
rtspAuthMethods: [basic]

pathDefaults:
  ###############################################
  # Default path settings -> General

  # Source of the stream. This can be:
  # * publisher -> the stream is provided by a RTSP, RTMP, WebRTC or SRT client
  # * rtsp://existing-url -> the stream is pulled from another RTSP server / camera
  # * rtsps://existing-url -> the stream is pulled from another RTSP server / camera with RTSPS
  # * rtmp://existing-url -> the stream is pulled from another RTMP server / camera
  # * rtmps://existing-url -> the stream is pulled from another RTMP server / camera with RTMPS
  # * http://existing-url/stream.m3u8 -> the stream is pulled from another HLS server / camera
  # * https://existing-url/stream.m3u8 -> the stream is pulled from another HLS server / camera with HTTPS
  # * udp://ip:port -> the stream is pulled with UDP, by listening on the specified IP and port
  # * srt://existing-url -> the stream is pulled from another SRT server / camera
  # * whep://existing-url -> the stream is pulled from another WebRTC server / camera
  # * wheps://existing-url -> the stream is pulled from another WebRTC server / camera with HTTPS
  # * redirect -> the stream is provided by another path or server
  # * rpiCamera -> the stream is provided by a Raspberry Pi Camera
  # If path name is a regular expression, $G1, G2, etc will be replaced
  # with regular expression groups.
  source: publisher
  # If the source is a URL, and the source certificate is self-signed
  # or invalid, you can provide the fingerprint of the certificate in order to
  # validate it anyway. It can be obtained by running:
  # openssl s_client -connect source_ip:source_port </dev/null 2>/dev/null | sed -n '/BEGIN/,/END/p' > server.crt
  # openssl x509 -in server.crt -noout -fingerprint -sha256 | cut -d "=" -f2 | tr -d ':'
  sourceFingerprint:
  # If the source is a URL, it will be pulled only when at least
  # one reader is connected, saving bandwidth.
  sourceOnDemand: yes
  # If sourceOnDemand is "yes", readers will be put on hold until the source is
  # ready or until this amount of time has passed.
  sourceOnDemandStartTimeout: 10s
  # If sourceOnDemand is "yes", the source will be closed when there are no
  # readers connected and this amount of time has passed.
  sourceOnDemandCloseAfter: 10s
  # Maximum number of readers. Zero means no limit.
  maxReaders: 0
  # SRT encryption passphrase require to read from this path
  srtReadPassphrase:
  # If the stream is not available, redirect readers to this path.
  # It can be can be a relative path (i.e. /otherstream) or an absolute RTSP URL.
  fallback:

  ###############################################
  # Default path settings -> Record and playback

  # Record streams to disk.
  record: no
  # Enable serving recordings with the playback server.
  playback: no
  # Path of recording segments.
  # Extension is added automatically.
  # Available variables are %path (path name), %Y %m %d %H %M %S %f %s (time in strftime format)
  recordPath: ./recordings/%path/%Y-%m-%d_%H-%M-%S-%f
  # Format of recorded segments.
  # Available formats are "fmp4" (fragmented MP4) and "mpegts" (MPEG-TS).
  recordFormat: fmp4
  # fMP4 segments are concatenation of small MP4 files (parts), each with this duration.
  # MPEG-TS segments are concatenation of 188-bytes packets, flushed to disk with this period.
  # When a system failure occurs, the last part gets lost.
  # Therefore, the part duration is equal to the RPO (recovery point objective).
  recordPartDuration: 100ms
  # Minimum duration of each segment.
  recordSegmentDuration: 1h
  # Delete segments after this timespan.
  # Set to 0s to disable automatic deletion.
  recordDeleteAfter: 24h

  ###############################################
  # Default path settings -> Publisher source (when source is "publisher")

  # Allow another client to disconnect the current publisher and publish in its place.
  overridePublisher: yes
  # SRT encryption passphrase required to publish to this path
  srtPublishPassphrase:

  ###############################################
  # Default path settings -> RTSP source (when source is a RTSP or a RTSPS URL)

  # Transport protocol used to pull the stream. available values are "automatic", "udp", "multicast", "tcp".
  rtspTransport: automatic
  # Support sources that don't provide server ports or use random server ports. This is a security issue
  # and must be used only when interacting with sources that require it.
  rtspAnyPort: no
  # Range header to send to the source, in order to start streaming from the specified offset.
  # available values:
  # * clock: Absolute time
  # * npt: Normal Play Time
  # * smpte: SMPTE timestamps relative to the start of the recording
  rtspRangeType:
  # Available values:
  # * clock: UTC ISO 8601 combined date and time string, e.g. 20230812T120000Z
  # * npt: duration such as "300ms", "1.5m" or "2h45m", valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
  # * smpte: duration such as "300ms", "1.5m" or "2h45m", valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
  rtspRangeStart:

  ###############################################
  # Default path settings -> Redirect source (when source is "redirect")

  # RTSP URL which clients will be redirected to.
  sourceRedirect:

  ###############################################
  # Default path settings -> Raspberry Pi Camera source (when source is "rpiCamera")

  # ID of the camera
  rpiCameraCamID: 0
  # width of frames
  rpiCameraWidth: 1920
  # height of frames
  rpiCameraHeight: 1080
  # flip horizontally
  rpiCameraHFlip: false
  # flip vertically
  rpiCameraVFlip: false
  # brightness [-1, 1]
  rpiCameraBrightness: 0
  # contrast [0, 16]
  rpiCameraContrast: 1
  # saturation [0, 16]
  rpiCameraSaturation: 1
  # sharpness [0, 16]
  rpiCameraSharpness: 1
  # exposure mode.
  # values: normal, short, long, custom
  rpiCameraExposure: normal
  # auto-white-balance mode.
  # values: auto, incandescent, tungsten, fluorescent, indoor, daylight, cloudy, custom
  rpiCameraAWB: auto
  # auto-white-balance fixed gains. This can be used in place of rpiCameraAWB.
  # format: [red,blue]
  rpiCameraAWBGains: [0, 0]
  # denoise operating mode.
  # values: off, cdn_off, cdn_fast, cdn_hq
  rpiCameraDenoise: 'off'
  # fixed shutter speed, in microseconds.
  rpiCameraShutter: 0
  # metering mode of the AEC/AGC algorithm.
  # values: centre, spot, matrix, custom
  rpiCameraMetering: centre
  # fixed gain
  rpiCameraGain: 0
  # EV compensation of the image [-10, 10]
  rpiCameraEV: 0
  # Region of interest, in format x,y,width,height
  rpiCameraROI:
  # whether to enable HDR on Raspberry Camera 3.
  rpiCameraHDR: false
  # tuning file
  rpiCameraTuningFile:
  # sensor mode, in format [width]:[height]:[bit-depth]:[packing]
  # bit-depth and packing are optional.
  rpiCameraMode:
  # frames per second
  rpiCameraFPS: 30
  # period between IDR frames
  rpiCameraIDRPeriod: 60
  # bitrate
  rpiCameraBitrate: 1000000
  # H264 profile
  rpiCameraProfile: main
  # H264 level
  rpiCameraLevel: '4.1'
  # Autofocus mode
  # values: auto, manual, continuous
  rpiCameraAfMode: continuous
  # Autofocus range
  # values: normal, macro, full
  rpiCameraAfRange: normal
  # Autofocus speed
  # values: normal, fast
  rpiCameraAfSpeed: normal
  # Lens position (for manual autofocus only), will be set to focus to a specific distance
  # calculated by the following formula: d = 1 / value
  # Examples: 0 moves the lens to infinity.
  #           0.5 moves the lens to focus on objects 2m away.
  #           2 moves the lens to focus on objects 50cm away.
  rpiCameraLensPosition: 0.0
  # Specifies the autofocus window, in the form x,y,width,height where the coordinates
  # are given as a proportion of the entire image.
  rpiCameraAfWindow:
  # enables printing text on each frame.
  rpiCameraTextOverlayEnable: false
  # text that is printed on each frame.
  # format is the one of the strftime() function.
  rpiCameraTextOverlay: '%Y-%m-%d %H:%M:%S - MediaMTX'

  ###############################################
  # Default path settings -> Hooks

  # Command to run when this path is initialized.
  # This can be used to publish a stream when the server is launched.
  # This is terminated with SIGINT when the program closes.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnInit:
  # Restart the command if it exits.
  runOnInitRestart: no

  # Command to run when this path is requested by a reader
  # and no one is publishing to this path yet.
  # This can be used to publish a stream on demand.
  # This is terminated with SIGINT when there are no readers anymore.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by first reader)
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnDemand:
  # Restart the command if it exits.
  runOnDemandRestart: no
  # Readers will be put on hold until the runOnDemand command starts publishing
  # or until this amount of time has passed.
  runOnDemandStartTimeout: 10s
  # The command will be closed when there are no
  # readers connected and this amount of time has passed.
  runOnDemandCloseAfter: 10s
  # Command to run when there are no readers anymore.
  # Environment variables are the same of runOnDemand.
  runOnUnDemand:

  # Command to run when the stream is ready to be read, whenever it is
  # published by a client or pulled from a server / camera.
  # This is terminated with SIGINT when the stream is not ready anymore.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by publisher)
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  # * MTX_SOURCE_TYPE: source type
  # * MTX_SOURCE_ID: source ID
  runOnReady:
  # Restart the command if it exits.
  runOnReadyRestart: no
  # Command to run when the stream is not available anymore.
  # Environment variables are the same of runOnReady.
  runOnNotReady:

  # Command to run when a client starts reading.
  # This is terminated with SIGINT when a client stops reading.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by reader)
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  # * MTX_READER_TYPE: reader type
  # * MTX_READER_ID: reader ID
  runOnRead:
  # Restart the command if it exits.
  runOnReadRestart: no
  # Command to run when a client stops reading.
  # Environment variables are the same of runOnRead.
  runOnUnread:

  # Command to run when a recording segment is created.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  # * MTX_SEGMENT_PATH: segment file path
  runOnRecordSegmentCreate:

  # Command to run when a recording segment is complete.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  # * MTX_SEGMENT_PATH: segment file path
  runOnRecordSegmentComplete:

###############################################
# Path settings

# Settings in "paths" are applied to specific paths, and the map key
# is the name of the path.
# Any setting in "pathDefaults" can be overridden here.
# It's possible to use regular expressions by using a tilde as prefix,
# for example "~^(test1|test2)$" will match both "test1" and "test2",
# for example "~^prefix" will match all paths that start with "prefix".
paths:
  tplink:
    source: rtsp://admin:[email protected]/stream1

[emeryao]

it seems that a digest auth was used to authenticate with the camera but the camera seems not supporting in that way @aler9

[aler9]

@emeryao thanks for providing the log, please test this nightly release and let me know if it fixes the issues (click on "Artifacts", "binaries"):
https://github.com/bluenviron/mediamtx/actions/runs/8945300574

[bobocancan]

I have exactly the same issue with cameras from the same brand(TP-Link)

[aler9]

@bobocancan if you want to solve the issue, download and test the nightly release attached in the previous post and let me know if it fixes the problem. If it doesn't attach server logs with logLevel: debug option.

[bobocancan]

Thank you for your reply Alessandro. I am using the docker version, not really sure how I can replace the binary.

…

On Mon, 6 May 2024 at 19:14, Alessandro Ros ***@***.***> wrote: @bobocancan <https://github.com/bobocancan> if you want to solve the issue, download and test the nightly release attached in the previous post and let me know if it fixes the problem. If it doesn't attach server logs with logLevel: debug option. — Reply to this email directly, view it on GitHub <#3116 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIGL5XHGFYH375CR34R6CPTZA5CXPAVCNFSM6AAAAABEKH2Q2KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJVGUZDMMRRGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[emeryao]

Sorry for the late repsponse since my computer went down during the weekend and I just fixed it 😅

Below is the debug log of the binary from https://github.com/bluenviron/mediamtx/actions/runs/8945300574

2024/05/07 09:43:57 INF [HLS] [muxer stdhqipc64] created (requested by 192.168.1.10:48930)
2024/05/07 09:43:57 INF [path stdhqipc64] [RTSP source] started on demand
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] connecting
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [c->s] OPTIONS rtsp://192.168.1.13/stream1 RTSP/1.0
CSeq: 1
User-Agent: gortsplib
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [s->c] RTSP/1.0 200 OK
CSeq: 1
Date: Tue, May 07 2024 09:43:57 GMT
Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE, GET_PARAMETER, SET_PARAMETER, MULTITRANS
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [c->s] DESCRIBE rtsp://192.168.1.13/stream1 RTSP/1.0
Accept: application/sdp
CSeq: 2
User-Agent: gortsplib
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [s->c] RTSP/1.0 401 Unauthorized
CSeq: 2
Date: Tue, May 07 2024 09:43:57 GMT
WWW-Authenticate: Basic realm="TP-LINK IP-Camera"
WWW-Authenticate: Digest realm="TP-LINK IP-Camera", nonce="96fa3da3bceda6441e098764e178ed07"
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [c->s] DESCRIBE rtsp://192.168.1.13/stream1 RTSP/1.0
Accept: application/sdp
Authorization: Digest username="admin", realm="TP-LINK IP-Camera", nonce="96fa3da3bceda6441e098764e178ed07", uri="rtsp://192.168.1.13/stream1", response="a4a81d810668524205e0c4131196aec7"
CSeq: 3
User-Agent: gortsplib
2024/05/07 09:43:57 DEB [path stdhqipc64] [RTSP source] [s->c] RTSP/1.0 401 Unauthorized
CSeq: 3
Date: Tue, May 07 2024 09:43:57 GMT
WWW-Authenticate: Basic realm="TP-LINK IP-Camera"
WWW-Authenticate: Digest realm="TP-LINK IP-Camera", nonce="8a007ab52cc509a445f4b55fb6144b1c"
2024/05/07 09:43:57 ERR [path stdhqipc64] [RTSP source] bad status code: 401 (Unauthorized)
2024/05/07 09:44:02 DEB [path stdhqipc64] [RTSP source] connecting
2024/05/07 09:44:02 DEB [path stdhqipc64] [RTSP source] [c->s] OPTIONS rtsp://192.168.1.13/stream1 RTSP/1.0
CSeq: 1
User-Agent: gortsplib
2024/05/07 09:44:03 DEB [path stdhqipc64] [RTSP source] [s->c] RTSP/1.0 200 OK

@aler9

[aler9]

@emeryao thanks for the feedback, it seems like my patch was unable to solve the issue. Can you post the same log but using v1.4.2 (last working version)? in this way we can check why v1.4.2 was working and my patch was not (BTW i was not able to spot differences between v1.4.2 and my patch). Also check whether credentials are correct.

[emeryao]

@aler9 your patch just works after the camera rebooted with the nightly build 🎉

and it's still a 401 with the version 1.8.1 even if the camera was just rebooted

[aler9]

perfect, i'm merging the patch.

[github-actions]

This issue is mentioned in release v1.8.2 🚀
Check out the entire changelog by clicking here

[github-actions]

This issue is being locked automatically because it has been closed for more than 6 months.
Please open a new issue in case you encounter a similar problem.