python-aidot-cameras 0.10.0__tar.gz → 0.10.1__tar.gz

{python_aidot_cameras-0.10.0/src/python_aidot_cameras.egg-info → python_aidot_cameras-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.10.0
+Version: 0.10.1
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-aidot-cameras"
-version = "0.10.0"
+version = "0.10.1"
 description = "Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)"
 readme = "README.md"
 license = "MIT"

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/camera/client.py

@@ -213,6 +213,7 @@ def _save_frame_as_jpeg(image_data: Any, output_path: str) -> bool:
                 ],
                 input=image_data.tobytes(),
                 capture_output=True,
+                timeout=15,  # bound the hang; a wedged ffmpeg must not block forever
             )
             return r.returncode == 0
     except Exception as exc:
@@ -1929,7 +1930,6 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         # ── SDES path: stream briefly to a temp TS file, extract one JPEG ──── #
         if self.is_sdes_camera:
             import os as _os
-            import subprocess as _sp
             import tempfile as _tf
 
             with _tf.NamedTemporaryFile(suffix=".ts", delete=False) as _tmpf:
@@ -1970,17 +1970,33 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 if _ffmpeg_path() is None:
                     _LOGGER.error("async_snapshot SDES: %s", _FFMPEG_MISSING_MSG)
                     return False
-                _ffmpeg_snap = _sp.run(
-                    ["ffmpeg", "-y", "-i", _tmp_ts,
-                     "-frames:v", "1", "-f", "image2", output_path],
-                    capture_output=True, timeout=15,
+                # Async subprocess (not subprocess.run): a synchronous ffmpeg
+                # here blocks the whole event loop - every camera, keepalive and
+                # MQTT drain - for up to the timeout.
+                _snap_proc = await _asyncio.create_subprocess_exec(
+                    "ffmpeg", "-y", "-i", _tmp_ts,
+                    "-frames:v", "1", "-f", "image2", output_path,
+                    stdout=_asyncio.subprocess.DEVNULL,
+                    stderr=_asyncio.subprocess.PIPE,
                 )
-                if _ffmpeg_snap.returncode == 0 and _os.path.exists(output_path):
+                try:
+                    _, _snap_err = await _asyncio.wait_for(
+                        _snap_proc.communicate(), timeout=15
+                    )
+                except TimeoutError:
+                    _snap_proc.kill()
+                    await _snap_proc.communicate()
+                    _LOGGER.warning(
+                        "async_snapshot SDES: ffmpeg frame extract timed out for %s",
+                        self.device_id,
+                    )
+                    return False
+                if _snap_proc.returncode == 0 and _os.path.exists(output_path):
                     return True
                 _LOGGER.warning(
                     "async_snapshot SDES: ffmpeg frame extract failed for %s: %s",
                     self.device_id,
-                    _ffmpeg_snap.stderr.decode(errors="replace")[-200:],
+                    (_snap_err or b"").decode(errors="replace")[-200:],
                 )
                 return False
             except Exception as _snap_exc:
@@ -2032,7 +2048,11 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
 
         if captured[0] is None:
             return False
-        return _save_frame_as_jpeg(captured[0], output_path)
+        # _save_frame_as_jpeg does a blocking PIL encode (or a blocking ffmpeg
+        # fallback); run it off the event loop so it can't stall other cameras.
+        return await _asyncio.get_running_loop().run_in_executor(
+            None, _save_frame_as_jpeg, captured[0], output_path
+        )
 
     async def async_start_streaming(self) -> None:
         """Start a persistent background WebRTC stream that updates latest_jpeg.

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/camera/lan_control.py

@@ -59,6 +59,11 @@ ATTR_KEYS = {
 }
 
 
+# Control-channel bodies are small JSON; reject anything wildly larger than that
+# so a hostile/broken LAN peer can't drive memory exhaustion via the size field.
+_MAX_FRAME_BODY = 1024 * 1024  # 1 MiB
+
+
 def _pack(msgtype: int, body: bytes) -> bytes:
     return struct.pack(">Hhi", _MAGIC, msgtype, len(body)) + body
 
@@ -69,6 +74,12 @@ async def _read_frame(reader: asyncio.StreamReader, timeout: float) -> bytes:
     The caller decrypts and parses the JSON (the AES key lives on the client)."""
     header = await asyncio.wait_for(reader.readexactly(8), timeout)
     _magic, _mtype, bodysize = struct.unpack(">HHI", header)
+    # Cap the server-supplied body size: `bodysize` is an unsigned 32-bit field
+    # (up to ~4 GiB) from a LAN host, and control-channel bodies are small JSON.
+    # Reject an implausibly large frame instead of allocating on a malicious or
+    # malfunctioning peer (mirrors the 4 MiB cap in playback._read_frame).
+    if bodysize > _MAX_FRAME_BODY:
+        raise ValueError(f"LAN control frame body too large: {bodysize} bytes")
     body = await asyncio.wait_for(reader.readexactly(bodysize), timeout)
     return body  # caller decrypts (key is on the client)
 

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/camera/models.py

@@ -30,6 +30,24 @@ from .constants import (
 _LOGGER = logging.getLogger(__name__)
 
 
+def _as_int(v: Any) -> Optional[int]:
+    """Coerce a cloud-supplied attr value to int, or None if not numeric.
+
+    Cloud/device attributes are untrusted: a non-numeric value must be skipped,
+    not raise ValueError/TypeError out of the status-refresh path.
+    """
+    try:
+        return int(v)
+    except (ValueError, TypeError):
+        return None
+
+
+def _as_bool(v: Any) -> Optional[bool]:
+    """Coerce a 0/1 (int or numeric string) attr to bool, or None if not numeric."""
+    i = _as_int(v)
+    return None if i is None else bool(i)
+
+
 class CameraStatusData(DeviceStatusData):
     """Core status plus camera fields; accepts both typed-model and dict updates."""
 
@@ -74,44 +92,41 @@ class CameraStatusData(DeviceStatusData):
         # feeders either strip them (update_from_camera_attributes) or have
         # already applied them via the model (receive_data raw-dict pass).
         # Camera attributes
-        if (v := attr.get("MotionDetection_Enable")) is not None:
-            self.motion_detection = bool(int(v))
-        if (v := attr.get("MotionDetection_Sen")) is not None:
-            self.motion_sensitivity = int(v)
-        if (v := attr.get("LedOnOff")) is not None:
-            self.status_led = bool(int(v))
-        if (v := attr.get("micEnable")) is not None:
-            self.microphone = bool(int(v))
+        # Every conversion goes through _as_int/_as_bool so a malformed value
+        # from the cloud (e.g. "on" where 0/1 is expected) is skipped rather than
+        # raising out of update() and aborting the whole status refresh.
+        if (b := _as_bool(attr.get("MotionDetection_Enable"))) is not None:
+            self.motion_detection = b
+        if (i := _as_int(attr.get("MotionDetection_Sen"))) is not None:
+            self.motion_sensitivity = i
+        if (b := _as_bool(attr.get("LedOnOff"))) is not None:
+            self.status_led = b
+        if (b := _as_bool(attr.get("micEnable"))) is not None:
+            self.microphone = b
         if (v := attr.get("nightVisionMode")) is not None:
-            try:
-                nv = int(v)
+            nv = _as_int(v)
+            if nv is not None:
                 self.night_vision_mode = {0: "auto", 1: "on", 2: "off"}.get(nv, str(nv))
-            except (ValueError, TypeError):
+            else:
                 # Camera may send string "on"/"off"/"auto" instead of 0/1/2
                 self.night_vision_mode = str(v)
-        if (v := attr.get("nightVisionIRLight")) is not None:
-            self.ir_light = bool(int(v))
-        if (v := attr.get("LightOnOff")) is not None:
-            self.floodlight = bool(int(v))
-        if (v := attr.get("trackingMode")) is not None:
-            self.ptz_tracking = bool(int(v))
-        if (v := attr.get("SoundLevel")) is not None:
-            self.speaker_volume = int(v)
+        if (b := _as_bool(attr.get("nightVisionIRLight"))) is not None:
+            self.ir_light = b
+        if (b := _as_bool(attr.get("LightOnOff"))) is not None:
+            self.floodlight = b
+        if (b := _as_bool(attr.get("trackingMode"))) is not None:
+            self.ptz_tracking = b
+        if (i := _as_int(attr.get("SoundLevel"))) is not None:
+            self.speaker_volume = i
         # Diagnostic / read-only
-        if (v := attr.get("Battery_remaining")) is not None:
-            try:
-                self.battery_remaining = int(v)
-            except (ValueError, TypeError):
-                _LOGGER.debug("swallowed exception in %s", 'update', exc_info=True)
-        if (v := attr.get("Occupancy")) is not None:
-            self.occupancy = bool(int(v))
+        if (i := _as_int(attr.get("Battery_remaining"))) is not None:
+            self.battery_remaining = i
+        if (b := _as_bool(attr.get("Occupancy"))) is not None:
+            self.occupancy = b
         if (v := attr.get("SDcardStatus")) is not None:
             self.sd_card_status = str(v)
-        if (v := attr.get("networkRssi")) is not None:
-            try:
-                self.wifi_rssi = int(v)
-            except (ValueError, TypeError):
-                _LOGGER.debug("swallowed exception in %s", 'update', exc_info=True)
+        if (i := _as_int(attr.get("networkRssi"))) is not None:
+            self.wifi_rssi = i
 
     # Cloud "properties" keys that belong to lights, not cameras.  A camera's
     # image "Dimming" must not be read as a light brightness (and could TypeError

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/camera/protocol.py

@@ -8,11 +8,13 @@ imports client.py -- the import edge is one-way (client -> protocol).
 """
 
 import asyncio
+import hashlib
 import ipaddress
 import json
 import logging
 import os
 import random
+import re
 import select
 import socket
 import struct
@@ -552,7 +554,14 @@ def _build_sprop(sps: bytes, pps: bytes) -> str:
 
 
 def _sprop_cache_path(devid: str) -> str:
-    return os.path.join(_SPROP_DIR, f"{devid}.sprop")
+    # `devid` originates from the cloud/device and is interpolated into a
+    # filesystem path, so a value containing "/", "\\", ".." or an absolute path
+    # could escape _SPROP_DIR (arbitrary read/write). Reduce it to a safe,
+    # collision-resistant filename component.
+    safe = re.sub(r"[^A-Za-z0-9_-]", "_", devid or "")
+    if not safe or len(devid or "") > 128:
+        safe = hashlib.sha256((devid or "").encode("utf-8", "replace")).hexdigest()
+    return os.path.join(_SPROP_DIR, f"{safe}.sprop")
 
 
 def _load_sprop(devid: str) -> "Optional[str]":

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/camera/webrtc_open.py

@@ -39,6 +39,47 @@ from .protocol import (
 _LOGGER = logging.getLogger(__name__)
 
 
+def _normalize_fingerprint(value: str) -> str:
+    """Normalize a sha-256 fingerprint for comparison.
+
+    Accepts either the colon-separated uppercase hex aiortc emits or an operator-
+    supplied pin that may differ in case, contain/omit colons, or carry stray
+    whitespace. Reduces both to lowercase hex with no separators.
+    """
+    return value.replace(":", "").replace(" ", "").strip().lower()
+
+
+def _dtls_pin_matches(real_fp: str, pinned_fp: str) -> bool:
+    """True if a cert's fingerprint matches the pin (format-insensitive)."""
+    return _normalize_fingerprint(real_fp) == _normalize_fingerprint(pinned_fp)
+
+
+def _verified_dtls_fingerprint(cam_cert, pinned_fp: str, cert_fp_fn) -> Optional[str]:
+    """Return the peer cert's sha-256 fingerprint, enforcing the pin if set.
+
+    Fails CLOSED under pinning: if a pin is configured, a missing peer cert or a
+    fingerprint that does not match the pin raises ``ValueError`` (which the
+    caller propagates to fail the DTLS handshake). Any error computing the
+    fingerprint is the caller's responsibility to treat as a failure when pinned.
+
+    Returns the fingerprint string, or ``None`` when no cert is present and no
+    pin is configured (accept-any default — the caller may skip verification).
+    """
+    if cam_cert is None:
+        if pinned_fp:
+            raise ValueError(
+                "DTLS peer presented no certificate; cannot verify against pin"
+            )
+        return None
+    real_fp = cert_fp_fn(cam_cert, "sha-256")
+    if pinned_fp and not _dtls_pin_matches(real_fp, pinned_fp):
+        raise ValueError(
+            f"DTLS fingerprint mismatch: camera presented {real_fp}, "
+            f"pinned {pinned_fp}"
+        )
+    return real_fp
+
+
 async def _keyframe_prompter(send_pli, first_frame, interval: float = 0.7,
                              max_tries: int = 8) -> int:
     """Send an RTCP PLI (keyframe request) immediately and then every `interval`
@@ -1221,7 +1262,15 @@ class _WebRTCOpenMixin:
                     await asyncio.wait_for(mqtt_fut, timeout=5.0)
                 except Exception:
                     pass   # MQTT thread exit errors don't affect the retry
-                return await self.async_open_webrtc_stream(
+                # Call the UNGATED impl, not the public async_open_webrtc_stream:
+                # we are already holding the global open-gate permit (acquired in
+                # async_open_webrtc_stream), and the gate's semaphore is not
+                # reentrant. Re-entering the public method here would try to
+                # acquire a second permit and deadlock whenever the gate is
+                # saturated (two SDES->DTLS fallbacks at once, or
+                # AIDOT_MAX_CONCURRENT_OPENS=1). The impl runs the same handshake
+                # under the permit we already hold.
+                return await self._async_open_webrtc_stream_impl(
                     on_frame,
                     stream_id=stream_id,
                     timeout=timeout,
@@ -2352,27 +2401,33 @@ class _WebRTCOpenMixin:
                     )
 
                 def _accept_camera_cert(self, remote_params):
-                    """Verify (if pinned) or accept the camera's actual DTLS cert."""
+                    """Verify (if pinned) or accept the camera's actual DTLS cert.
+
+                    Fails CLOSED when AIDOT_DTLS_PINNED_FP is set: a missing cert
+                    or any error computing/comparing the fingerprint fails the
+                    handshake rather than silently accepting an unverified peer.
+                    """
                     try:
                         _cam_cert = self._ssl.get_peer_certificate(
                             as_cryptography=True
                         )
-                        if _cam_cert is not None:
-                            _real_fp = _rr_cert_fp(_cam_cert, "sha-256")
-                            if _pinned_fp:
-                                if _real_fp.upper() != _pinned_fp.upper():
-                                    raise ValueError(
-                                        "DTLS fingerprint mismatch: camera "
-                                        f"presented {_real_fp}, pinned "
-                                        f"{_pinned_fp}"
-                                    )
+                        _real_fp = _verified_dtls_fingerprint(
+                            _cam_cert, _pinned_fp, _rr_cert_fp
+                        )
+                        if _real_fp is not None:
                             remote_params.fingerprints[:] = [
                                 _RRFp(algorithm="sha-256", value=_real_fp)
                             ]
                     except ValueError:
-                        raise  # pinned-fingerprint mismatch: fail the handshake
+                        raise  # pin mismatch / no cert under pin: fail the handshake
                     except Exception:
-                        pass  # cert retrieval failed; skip verification
+                        if _pinned_fp:
+                            raise  # fail closed: never accept an unverifiable cert
+                        _LOGGER.debug(
+                            "camera %s: DTLS cert retrieval failed; accept-any "
+                            "(unpinned)", getattr(self, "device_id", "?"),
+                            exc_info=True,
+                        )
 
                 for _rr_tc in pc.getTransceivers():
                     _rr_tc.receiver.transport._validate_peer_identity = (
@@ -2837,7 +2892,16 @@ class _WebRTCOpenMixin:
             # Apply DTLS cert bypass - always, whenever we patched
             # fingerprints (camera's empty-fingerprint quirk applies on
             # every webrtcResp from this firmware family).
-            if _fp_subs:
+            # Install our peer-cert validator when EITHER the camera's empty-
+            # fingerprint quirk needs the workaround (_fp_subs) OR a pin is
+            # configured. Pinning must be enforced even when the camera sent a
+            # REAL fingerprint: that fingerprint rides attacker-influenceable
+            # signaling, so a MITM can present a well-formed value matching its
+            # own cert and aiortc's native check would pass. Gating the pin on
+            # _fp_subs (empty-fingerprint only) left it silently inert for cameras
+            # that present a real fingerprint.
+            _np_pinned_fp = (os.environ.get("AIDOT_DTLS_PINNED_FP") or "").strip()
+            if _fp_subs or _np_pinned_fp:
                 import types as _np_types
                 try:
                     from aiortc.rtcdtlstransport import (
@@ -2845,11 +2909,6 @@ class _WebRTCOpenMixin:
                         certificate_digest as _np_cert_fp,
                     )
 
-                    # See AIDOT_DTLS_PINNED_FP note above: optional pinning,
-                    # otherwise accept-any with a one-time warning.
-                    _np_pinned_fp = (
-                        os.environ.get("AIDOT_DTLS_PINNED_FP") or ""
-                    ).strip()
                     if not _np_pinned_fp:
                         _LOGGER.warning(
                             "camera %s: DTLS peer certificate is NOT authenticated "
@@ -2865,21 +2924,18 @@ class _WebRTCOpenMixin:
                             _cam_cert = self._ssl.get_peer_certificate(
                                 as_cryptography=True
                             )
-                            if _cam_cert is not None:
-                                _real_fp = _np_cert_fp(_cam_cert, "sha-256")
-                                if _np_pinned_fp:
-                                    if _real_fp.upper() != _np_pinned_fp.upper():
-                                        raise ValueError(
-                                            "DTLS fingerprint mismatch: camera "
-                                            f"presented {_real_fp}, pinned "
-                                            f"{_np_pinned_fp}"
-                                        )
+                            _real_fp = _verified_dtls_fingerprint(
+                                _cam_cert, _np_pinned_fp, _np_cert_fp
+                            )
+                            if _real_fp is not None:
                                 remote_params.fingerprints[:] = [
                                     _NPFp(algorithm="sha-256", value=_real_fp)
                                 ]
                         except ValueError:
-                            raise  # pinned-fingerprint mismatch: fail handshake
+                            raise  # pin mismatch / no cert under pin: fail handshake
                         except Exception:
+                            if _np_pinned_fp:
+                                raise  # fail closed: never accept an unverifiable cert
                             _LOGGER.debug("camera %s: swallowed exception in %s", getattr(self, "device_id", "?"), '_np_accept_cam_cert', exc_info=True)
 
                     # Diag: log PC/ICE state at patch-application time so we

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/client.py

@@ -245,7 +245,12 @@ class AidotClient:
         except AidotUserOrPassIncorrect:
             raise
         except aiohttp.ClientError as e:
-            _LOGGER.error("async_post_login ClientError %s  response=%s", e, response_data)
+            # Do NOT log response_data: the login body carries accessToken /
+            # refreshToken. Log only the status code the server returned.
+            _LOGGER.error(
+                "async_post_login ClientError %s (code=%s)",
+                e, (response_data or {}).get(CONF_CODE),
+            )
             raise
 
     async def _async_fetch_user_config(self) -> None:
@@ -298,9 +303,12 @@ class AidotClient:
                 self.login_info["mqttPassword"] = pwd
                 _LOGGER.info("_async_fetch_user_config: mqttPassword stored (len=%d)", len(pwd))
             else:
+                # Do NOT log `body`: the userConfig response often still carries
+                # the live mqttPassword under an unexpected key, which is exactly
+                # when this branch fires. Log the key names only.
                 _LOGGER.warning(
                     "_async_fetch_user_config: mqttPassword not found in response. "
-                    "keys=%s  body=%s", list(data.keys()), body
+                    "keys=%s", list(data.keys())
                 )
             # Also extract MQTT clientId if provided.
             client_id = data.get("mqttClientId") or mqtt_block.get("clientId") or ""
@@ -408,7 +416,11 @@ class AidotClient:
             response.raise_for_status()
             return response_data
         except aiohttp.ClientError as e:
-            _LOGGER.error("async_get ClientError %s %s", e, response_data)
+            # Do NOT log response_data: /devices carries per-device aesKey and
+            # password. Log the response code only.
+            _LOGGER.error(
+                "async_get ClientError %s (code=%s)", e, response_data.get(CONF_CODE)
+            )
             code = response_data.get(CONF_CODE)
             if code == ServerErrorCode.TOKEN_EXPIRED:
                 if not _retry:

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/credentials.py

@@ -173,9 +173,20 @@ def _load_plain(path: str) -> dict:
 
 
 def _write_secret(path: str, data: bytes) -> None:
-    """Write binary data to path with 0600 permissions."""
-    os.makedirs(os.path.dirname(os.path.abspath(path)), exist_ok=True)
-    with open(path, "wb") as f:
+    """Write binary data to path, created atomically with 0600 permissions."""
+    d = os.path.dirname(os.path.abspath(path))
+    os.makedirs(d, exist_ok=True)
+    try:
+        os.chmod(d, 0o700)  # restrict the config dir too (best-effort)
+    except OSError:
+        pass
+    # Create with 0600 from the start so the secret is never briefly
+    # world/group-readable under the process umask (a chmod-after-open leaves a
+    # window where another local user could read the key/ciphertext).
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "wb") as f:
         f.write(data)
         f.write(b"\n")
+    # If the file pre-existed with looser perms, O_CREAT's mode was ignored;
+    # tighten it explicitly.
     os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/aidot/device_client.py

@@ -200,7 +200,13 @@ class DeviceClient(CameraMixin):
             self.ping_data = None
             self.heart_time = 10
 
-        _LOGGER.debug(f"{self._TAG}:{device}")
+        # Log a redacted subset only: the raw device record carries aesKey and
+        # password, which must not reach logs even at DEBUG.
+        if isinstance(device, dict):
+            _LOGGER.debug(
+                "%s: device id=%s modelId=%s",
+                self._TAG, device.get("id"), device.get("modelId"),
+            )
         self._init_camera_state(device, user_info)
 
     async def connect(self, ip_address) -> None:

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1/src/python_aidot_cameras.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.10.0
+Version: 0.10.1
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.10.0 → python_aidot_cameras-0.10.1}/src/python_aidot_cameras.egg-info/SOURCES.txt

@@ -44,6 +44,7 @@ tests/test_backoff.py
 tests/test_device_login_guard.py
 tests/test_device_user_info_cache.py
 tests/test_dtls_not_ready_burst.py
+tests/test_dtls_pinning.py
 tests/test_dtls_skip_signaling_wait.py
 tests/test_egress_guard.py
 tests/test_go2rtc.py
@@ -71,6 +72,7 @@ tests/test_sdes_serve_cmd.py
 tests/test_sdes_sprop.py
 tests/test_sdes_talk.py
 tests/test_sdes_watchdog.py
+tests/test_security_hardening.py
 tests/test_serve_relay.py
 tests/test_session_stats.py
 tests/test_speak.py

python_aidot_cameras-0.10.1/tests/test_dtls_pinning.py

@@ -0,0 +1,63 @@
+"""DTLS fingerprint-pinning verification (AIDOT_DTLS_PINNED_FP).
+
+These guard the fail-closed contract: with a pin configured, a missing cert or a
+non-matching fingerprint must fail the handshake, never silently accept. The
+absence of exactly this test is how the earlier fail-open bugs survived.
+"""
+
+import pytest
+
+from aidot.camera.webrtc_open import (
+    _dtls_pin_matches,
+    _normalize_fingerprint,
+    _verified_dtls_fingerprint,
+)
+
+# aiortc formats sha-256 fingerprints as uppercase colon-separated hex.
+REAL = ":".join(["AB", "CD", "EF", "01"] * 8)  # 32 bytes
+
+
+def _fp_fn(cert, alg):
+    # In these tests the "cert" object IS its fingerprint string.
+    assert alg == "sha-256"
+    return cert
+
+
+def test_normalize_strips_colons_case_and_space():
+    assert _normalize_fingerprint("AB:CD:ef 12") == "abcdef12"
+
+
+def test_pin_matches_is_format_insensitive():
+    assert _dtls_pin_matches(REAL, REAL.lower().replace(":", ""))
+    assert _dtls_pin_matches(REAL, f"  {REAL}  ")
+    assert not _dtls_pin_matches(REAL, "00:11")
+
+
+def test_matching_pin_returns_fingerprint():
+    assert _verified_dtls_fingerprint(REAL, REAL, _fp_fn) == REAL
+
+
+def test_pin_format_differences_still_match():
+    # Operator supplies the pin without colons / lowercased.
+    assert _verified_dtls_fingerprint(REAL, REAL.lower().replace(":", ""), _fp_fn) == REAL
+
+
+def test_mismatching_pin_raises():
+    with pytest.raises(ValueError, match="mismatch"):
+        _verified_dtls_fingerprint(REAL, "00:11:22", _fp_fn)
+
+
+def test_missing_cert_with_pin_fails_closed():
+    # No peer cert while pinning MUST fail, not accept-any.
+    with pytest.raises(ValueError, match="no certificate"):
+        _verified_dtls_fingerprint(None, REAL, _fp_fn)
+
+
+def test_missing_cert_without_pin_accepts():
+    assert _verified_dtls_fingerprint(None, "", _fp_fn) is None
+
+
+def test_present_cert_without_pin_returns_fingerprint():
+    # Unpinned but a cert is present: return the real fp so the caller can
+    # rewrite remote_params.fingerprints (the empty-fingerprint workaround).
+    assert _verified_dtls_fingerprint(REAL, "", _fp_fn) == REAL

python_aidot_cameras-0.10.1/tests/test_security_hardening.py

@@ -0,0 +1,67 @@
+"""Regression tests for the 0.10.x security-review hardening fixes."""
+
+import asyncio
+import os
+import struct
+
+import pytest
+
+from aidot.camera.lan_control import _MAGIC, _MAX_FRAME_BODY, _read_frame
+from aidot.camera.models import _as_bool, _as_int
+from aidot.camera.protocol import _SPROP_DIR, _sprop_cache_path
+
+
+# ── models: malformed cloud attrs are skipped, not fatal ──────────────────────
+
+def test_as_int_coerces_or_none():
+    assert _as_int("5") == 5
+    assert _as_int(5) == 5
+    assert _as_int("on") is None       # non-numeric string must not raise
+    assert _as_int(None) is None
+    assert _as_int({}) is None
+
+
+def test_as_bool_coerces_or_none():
+    assert _as_bool("0") is False
+    assert _as_bool("1") is True
+    assert _as_bool(1) is True
+    assert _as_bool("yes") is None     # non-numeric must not raise
+    assert _as_bool(None) is None
+
+
+# ── sprop cache: devid can't escape the cache dir ─────────────────────────────
+
+@pytest.mark.parametrize("devid", ["../../etc/passwd", "/etc/passwd", "a/b/c", "..", "x\\y"])
+def test_sprop_path_stays_in_cache_dir(devid):
+    p = os.path.abspath(_sprop_cache_path(devid))
+    assert os.path.dirname(p) == os.path.abspath(_SPROP_DIR)
+    assert p.endswith(".sprop")
+
+
+def test_sprop_path_normal_devid_preserved():
+    p = _sprop_cache_path("LK-IPC-A000088-abc123")
+    assert os.path.basename(p) == "LK-IPC-A000088-abc123.sprop"
+
+
+# ── LAN control: oversized frame body is rejected before allocation ───────────
+
+def test_read_frame_rejects_oversized_body():
+    async def _run():
+        reader = asyncio.StreamReader()
+        reader.feed_data(struct.pack(">HHI", _MAGIC, 1, _MAX_FRAME_BODY + 1))
+        reader.feed_eof()
+        with pytest.raises(ValueError, match="too large"):
+            await _read_frame(reader, timeout=1.0)
+
+    asyncio.run(_run())
+
+
+def test_read_frame_accepts_small_body():
+    async def _run():
+        body = b'{"ok":1}'
+        reader = asyncio.StreamReader()
+        reader.feed_data(struct.pack(">HHI", _MAGIC, 1, len(body)) + body)
+        reader.feed_eof()
+        assert await _read_frame(reader, timeout=1.0) == body
+
+    asyncio.run(_run())