python-aidot-cameras 1.0.0b2__tar.gz → 1.0.0b3__tar.gz

{python_aidot_cameras-1.0.0b2/python_aidot_cameras.egg-info → python_aidot_cameras-1.0.0b3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 1.0.0b2
+Version: 1.0.0b3
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/aidot_cameras/camera/client.py

@@ -3477,6 +3477,22 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                     rtsp_push_url=self._keepalive_rtsp_url,
                     timeout=(_FAST_OPEN_TIMEOUT if _use_fast else 120.0),
                     reuse_peer_id=_loop_peer_id,
+                    # Ask for talk so THIS session can carry it. async_speak
+                    # reuses _stream_session only when it is talk-capable, and
+                    # an SDES session that did not ask never gets a return audio
+                    # track - so without this every press-to-talk opened a
+                    # second camera session alongside the live view, and the
+                    # camera holds a viewer slot for about 120 s after one ends.
+                    #
+                    # This changes the SDP offer on the path every SDES live
+                    # view takes, which is the kind of change that has caused
+                    # fleet-wide blackouts here, so it rests on evidence rather
+                    # than reasoning: the release harness has opened all seven
+                    # cameras talk-capable across three fleet runs with no
+                    # streaming regression. The flag reaches only the offer
+                    # (audio sendrecv + a=ssrc) and the shared talk state; it
+                    # does not touch the rtsp_push branch this loop uses.
+                    talk=True,
                 )
             except asyncio.CancelledError:
                 self._fast_attempt_override = None

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/aidot_cameras/camera/sdes_open.py

@@ -835,6 +835,42 @@ def _bridge_should_break(rc, teardown_requested: bool) -> bool:
 _MAX_PRFLX_CANDS = 4
 
 
+def _is_self_transport_address(ip, port, *, local_ip, public_ip, own_ports):
+    """Is this address US, rather than a peer that merely looks like us?
+
+    The guard exists so we never nominate our own address: doing that has this
+    host answering its own connectivity check, which would arm the media trigger
+    at nobody.  What it must NOT do is refuse the camera, and for one common
+    deployment it did - a camera in the same house reaches the TURN server from
+    the same public IP we do, so an address-only comparison called it us.  Seven
+    first-media stalls were that (`vetoed-self-ip`, ROAD-TO-1.0 item 3): the
+    camera's relay-carried Binding Request could not be answered, because the
+    branch that wraps the response in a Send Indication is guarded by this, so
+    ICE never completed and no media ever started.
+
+    ICE identifies a candidate by its transport address, and so does this: our
+    own is one ip:PORT, and a peer sharing our NAT has the same ip with a
+    different port.  Comparing the pair keeps the guard exactly as strong for
+    the case it was written for and stops it catching the camera.
+
+    ``port`` may be None where a caller genuinely does not know it. That keeps
+    the old, conservative answer - widening a decision on an address we cannot
+    fully identify would be guessing, and this guard is the safe default.
+
+    Loopback and this host's own LAN address are us on ANY port: a different
+    port there is still this machine.
+
+    Pure, so the policy is testable without a camera.
+    """
+    if not ip:
+        return False
+    if ip in {"127.0.0.1", "0.0.0.0", local_ip}:
+        return True
+    if public_ip and ip == public_ip:
+        return port is None or port in set(own_ports or ())
+    return False
+
+
 def _record_peer_reflexive(known, discovered, observed, is_self=None):
     """Learn the address a STUN probe actually arrived from.
 
@@ -859,7 +895,7 @@ def _record_peer_reflexive(known, discovered, observed, is_self=None):
     _ip, _port = observed
     if not _ip or not _port:
         return discovered
-    if is_self is not None and is_self(_ip):
+    if is_self is not None and is_self(_ip, _port):
         return discovered
     if observed in known or observed in discovered:
         return discovered
@@ -2386,14 +2422,18 @@ class _SdesOpenMixin:
                 + (f" and :{_hp_port2}" if _hp_port != _hp_port2 else "")
             )
 
-        def _is_self_peer_ip(_ip: "Optional[str]") -> bool:
-            if not _ip:
-                return False
-            if _ip in {"127.0.0.1", "0.0.0.0", local_ip}:
-                return True
-            if _public_ip and _ip == _public_ip:
-                return True
-            return False
+        # The ports our own srflx candidates advertise - the only ports on the
+        # public IP that are actually this host. Anything else there is another
+        # device behind the same NAT, which for this fleet means the camera.
+        _own_srflx_ports = (audio_port, video_port)
+
+        def _is_self_peer_ip(_ip: "Optional[str]", _port: "Optional[int]" = None
+                             ) -> bool:
+            return _is_self_transport_address(
+                _ip, _port,
+                local_ip=local_ip, public_ip=_public_ip,
+                own_ports=_own_srflx_ports,
+            )
 
         _selfloop_drop_count = 0
         _bridge_selfloop_drop_count = 0
@@ -2526,7 +2566,8 @@ class _SdesOpenMixin:
                             if _turn_peer_ip_sw and _prefer_direct_stun.get(_sock, False):
                                 pass
                             elif (_turn_peer_ip_sw and _sock in _relay_addrs
-                                    and not _is_self_peer_ip(_turn_peer_ip_sw)):
+                                    and not _is_self_peer_ip(_turn_peer_ip_sw,
+                                                             _turn_peer_port_sw)):
                                 # Arrived via TURN - respond via Send Indication
                                 _ri_sw = _relay_addrs[_sock]
                                 _t_host_sw, _t_port_sw = _ri_sw[4], _ri_sw[5]
@@ -2552,7 +2593,8 @@ class _SdesOpenMixin:
                                              + _STUN_MAGIC + os.urandom(12)
                                              + _si_body)
                                 _sock.sendto(_send_ind, (_t_host_sw, _t_port_sw))
-                            elif _turn_peer_ip_sw and _is_self_peer_ip(_turn_peer_ip_sw):
+                            elif _turn_peer_ip_sw and _is_self_peer_ip(
+                                    _turn_peer_ip_sw, _turn_peer_port_sw):
                                 # Self-loop Data Indication (peer == our own
                                 # local/srflx address). Responding via TURN
                                 # creates an endless STUN echo loop and no media.
@@ -3081,7 +3123,7 @@ class _SdesOpenMixin:
             # addresses, and still ZERO relay-carried inbound packets.
             # The direct send above is untouched, so directly reachable
             # cameras behave exactly as before.
-            if not _is_self_peer_ip(cam_addr[0]):
+            if not _is_self_peer_ip(cam_addr[0], cam_addr[1]):
                 _turn_send_indication(sock, cam_addr[0], cam_addr[1], _req)
 
         # Every candidate this session actually sent USE-CANDIDATE to, in the
@@ -4002,7 +4044,8 @@ class _SdesOpenMixin:
                         _br_cam_peer = (
                             (_br_turn_peer_ip, _br_turn_peer_port)
                             if _br_turn_peer_ip and _br_turn_peer_port
-                            and not _is_self_peer_ip(_br_turn_peer_ip)
+                            and not _is_self_peer_ip(_br_turn_peer_ip,
+                                                     _br_turn_peer_port)
                             else None
                         )
 
@@ -4110,7 +4153,9 @@ class _SdesOpenMixin:
                                 if _br_turn_peer_ip and _br_prefer_direct_stun.get(_bs, False):
                                     pass
                                 elif (_br_turn_peer_ip and _bs in _relay_addrs
-                                        and not _is_self_peer_ip(_br_turn_peer_ip)):
+                                        and not _is_self_peer_ip(
+                                            _br_turn_peer_ip,
+                                            _br_turn_peer_port)):
                                     # Arrived via TURN - respond via Send Indication
                                     _bri = _relay_addrs[_bs]
                                     _br_t_host, _br_t_port = _bri[4], _bri[5]
@@ -4143,7 +4188,8 @@ class _SdesOpenMixin:
                                         + _br_si_body
                                     )
                                     _bs.sendto(_br_send_ind, (_br_t_host, _br_t_port))
-                                elif _br_turn_peer_ip and _is_self_peer_ip(_br_turn_peer_ip):
+                                elif _br_turn_peer_ip and _is_self_peer_ip(
+                                        _br_turn_peer_ip, _br_turn_peer_port):
                                     _bridge_selfloop_drop_count += 1
                                     if (_bridge_selfloop_drop_count <= 5
                                             or _bridge_selfloop_drop_count % 50 == 0):

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-aidot-cameras"
-version = "1.0.0b2"
+version = "1.0.0b3"
 description = "Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)"
 readme = "README.md"
 license = "MIT"

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3/python_aidot_cameras.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 1.0.0b2
+Version: 1.0.0b3
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/python_aidot_cameras.egg-info/SOURCES.txt

@@ -119,6 +119,7 @@ tests/test_keyframe_prompter.py
 tests/test_lan_control.py
 tests/test_lan_retry_reaches_the_storming_devices.py
 tests/test_light_active_color_mode.py
+tests/test_live_session_carries_talk.py
 tests/test_live_stream_param.py
 tests/test_live_validate_policy.py
 tests/test_logging_caps.py
@@ -176,6 +177,7 @@ tests/test_sdes_watchdog.py
 tests/test_sdp_narrowing_properties.py
 tests/test_sdp_payload_type_narrowing.py
 tests/test_security_hardening.py
+tests/test_self_peer_is_an_address_not_an_ip.py
 tests/test_serializable_login_info.py
 tests/test_serve_loss_tolerance.py
 tests/test_serve_relay.py

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/tests/test_feature_probe_needs_a_live_session.py

@@ -79,6 +79,34 @@ def test_ptz_is_not_run_when_the_session_is_already_closed():
     assert "closed" in out["ptz_error"]
 
 
+def test_the_snapshot_reports_how_long_it_took():
+    # The SDES snapshot budget has been wrong twice and both times the only
+    # evidence was a verdict, so the replacement budget was a guess. Reporting
+    # the elapsed time makes the next runs answer it.
+    class _Snapper(_DeviceClient):
+        async def async_snapshot(self, path, timeout=10.0):
+            return False        # verdict is irrelevant here; the timing is not
+
+    out = asyncio.run(probe_features(_Snapper(), {}, _Session(alive=True)))
+    assert "snapshot_s" in out
+    assert isinstance(out["snapshot_s"], float)
+
+
+def test_the_snapshot_budget_clears_the_slowest_measured_snapshot():
+    # Measured across the fleet: SDES 17.2-23.6 s, DTLS 2.8-3.0 s. Two earlier
+    # budgets were set just above the then-known maximum and both timed out a
+    # camera afterwards, so this asserts headroom rather than a value.
+    from feature_probe import _snapshot_budget
+
+    slowest_sdes_seen = 23.6
+    sdes = _snapshot_budget({"modelId": "LK.IPC.A001064"}, 10.0)
+    assert sdes >= slowest_sdes_seen * 1.5, (
+        "an SDES budget without real headroom is how this failed twice")
+    # DTLS is a different path and an order of magnitude faster; widening it
+    # would only slow down reporting a camera that is genuinely broken.
+    assert _snapshot_budget({"modelId": "LK.IPC.A000088"}, 10.0) == 10.0
+
+
 def test_a_session_that_does_not_publish_liveness_counts_as_live():
     # Only SdesSession has is_alive - it tracks the ffmpeg the bridge dies with.
     # The DTLS session keeps no ffmpeg and publishes nothing, and absence of the

{python_aidot_cameras-1.0.0b2 → python_aidot_cameras-1.0.0b3}/tests/test_ice_peer_reflexive.py

@@ -14,7 +14,11 @@ from aidot_cameras.camera.sdes_open import (
 ADVERTISED = [("192.168.100.13", 40000)]
 
 
-def _never_self(_ip):
+def _never_self(_ip, _port=None):
+    # The predicate takes a transport address, not an address: a peer behind
+    # our own NAT shares our public IP on a different port, and refusing it on
+    # the IP alone stalled real streams. See
+    # test_self_peer_is_an_address_not_an_ip.py.
     return False
 
 
@@ -53,8 +57,8 @@ def test_our_own_address_is_never_learned():
 
     Nominating ourselves would form a pair that can never carry camera media.
     """
-    def _is_self(ip):
-        return ip == "192.168.0.110"
+    def _is_self(ip, port=None):
+        return (ip, port) == ("192.168.0.110", 3478)
 
     out = _record_peer_reflexive(
         ADVERTISED, [], ("192.168.0.110", 3478), _is_self)

python_aidot_cameras-1.0.0b3/tests/test_live_session_carries_talk.py

@@ -0,0 +1,113 @@
+"""The SDES live-view session is opened talk-capable, so talk reuses it.
+
+`async_speak` reuses `_stream_session` when it is talk-capable and otherwise
+opens a session of its own. None of the loops that set `_stream_session` opened
+with `talk=True`, and on SDES a session that did not ask for talk never gets a
+return audio track - so the reuse branch was unreachable and every press-to-talk
+opened a SECOND camera session alongside the live view. The camera holds a viewer
+slot for about 120 s after a session ends, so that is not free.
+
+The offer change this rests on is not new code: the release harness has opened
+every camera talk-capable across three fleet runs and seven cameras with no
+streaming regression. What is new is the keepalive loop asking for it.
+
+Two things are locked here, because either alone would rot:
+  - the SDES keepalive loop asks for talk;
+  - `async_speak` really does reuse a talk-capable live session instead of
+    opening another one.
+"""
+import asyncio
+import inspect
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import aidot_cameras.camera.client as cc
+
+
+def _fn_source(qualname: str) -> str:
+    for cls in vars(cc).values():
+        if isinstance(cls, type) and qualname in cls.__dict__:
+            return inspect.getsource(cls.__dict__[qualname])
+    raise AssertionError(f"{qualname} not found")
+
+
+def test_the_sdes_keepalive_loop_opens_talk_capable():
+    src = _fn_source("_sdes_keepalive_loop_inner")
+    # The loop has exactly one async_open_webrtc_stream call; it must ask for
+    # talk, or the session it publishes as _stream_session cannot carry any.
+    assert src.count("async_open_webrtc_stream") == 1, (
+        "this test assumes a single open call in the loop - re-read it if that "
+        "changed")
+    assert "talk=True" in src, (
+        "the live-view session must be talk-capable or async_speak can never "
+        "reuse it")
+
+
+class _Session:
+    """A live, talk-capable session that records what was asked of it."""
+
+    talk_supported = True
+
+    def __init__(self):
+        self.started = 0
+        self.stopped = 0
+
+    async def async_start_talk(self, provider):
+        self.started += 1
+        while provider() is not None:
+            pass                       # drain the clip as the real pump would
+        return True
+
+    async def async_stop_talk(self):
+        return True
+
+    async def stop(self):
+        self.stopped += 1
+
+
+class _Client:
+    """Just enough of the device client for async_speak's reuse branch."""
+
+    device_id = "cam"
+
+    def __init__(self, session):
+        self._stream_session = session
+        self.opens = 0
+
+    async def async_open_webrtc_stream(self, *a, **kw):
+        self.opens += 1
+        raise AssertionError("async_speak must not open a second session")
+
+    async_speak = cc.CameraMixin.async_speak
+
+
+def test_async_speak_reuses_the_live_session_instead_of_opening_another():
+    session = _Session()
+    client = _Client(session)
+    frames = iter([b"\x00" * 320] * 3)
+
+    ok = asyncio.run(client.async_speak(lambda: next(frames, None),
+                                        max_seconds=5))
+
+    assert ok is True
+    assert client.opens == 0            # no second camera session
+    assert session.started == 1
+    # And it must not close the session it borrowed - the live view is using it.
+    assert session.stopped == 0
+
+
+if __name__ == "__main__":
+    import traceback
+    _fns = [v for k, v in sorted(globals().items()) if k.startswith("test_")]
+    _fail = 0
+    for _fn in _fns:
+        try:
+            _fn()
+            print(f"PASS {_fn.__name__}")
+        except Exception:
+            _fail += 1
+            print(f"FAIL {_fn.__name__}")
+            traceback.print_exc()
+    raise SystemExit(1 if _fail else 0)

python_aidot_cameras-1.0.0b3/tests/test_self_peer_is_an_address_not_an_ip.py

@@ -0,0 +1,101 @@
+"""A camera behind our own NAT is not us, and refusing it stalls the stream.
+
+Seven first-media stall reports name `vetoed-self-ip` (see ROAD-TO-1.0 item 3).
+The shape is always the same: the camera's connectivity check reaches us as a
+TURN Data Indication whose XOR-PEER-ADDRESS is THIS host's public IP on a port
+that is not ours - because the camera sits behind the same NAT, on another
+subnet of the same house. `_is_self_peer_ip` compared the address alone, so it
+answered "that is us".
+
+Two things then break, and the second is the stall:
+
+  * the camera's address is never learned as a peer-reflexive candidate;
+  * the Binding Success Response is never sent back through the relay, because
+    the branch that wraps it in a Send Indication is guarded by the same check.
+
+With no response, the camera's check never completes, ICE never succeeds, the
+AVIO LIVING trigger is never armed and the camera never sends a byte. That is
+exactly `binding-success=0; trigger=not-sent` with no media.
+
+The safety property this check exists for is unchanged and must stay unchanged:
+nominating OUR OWN address would have us answer our own check. Our own address
+is one ip:PORT. A peer sharing our NAT has the same ip and a different port, so
+comparing the pair keeps the guard and drops the false positive - which is also
+what ICE means by a transport address.
+"""
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from aidot_cameras.camera.sdes_open import (
+    _is_self_transport_address,
+    _record_peer_reflexive,
+)
+
+LOCAL = "192.168.0.50"
+PUBLIC = "173.53.36.206"
+OURS = (41000, 41002)          # the ports our own srflx candidates advertise
+
+
+def _is_self(ip, port=None):
+    return _is_self_transport_address(
+        ip, port, local_ip=LOCAL, public_ip=PUBLIC, own_ports=OURS)
+
+
+def test_our_own_reflexive_address_is_still_refused():
+    # The guard's whole purpose. Both advertised ports, exactly as offered.
+    assert _is_self(PUBLIC, 41000) is True
+    assert _is_self(PUBLIC, 41002) is True
+
+
+def test_loopback_and_this_hosts_lan_address_are_refused_on_any_port():
+    for ip in ("127.0.0.1", "0.0.0.0", LOCAL):
+        assert _is_self(ip, 41000) is True
+        assert _is_self(ip, 59999) is True
+
+
+def test_a_camera_sharing_our_public_ip_on_another_port_is_not_us():
+    # The measured case: XOR-PEER-ADDRESS is our public IP, port 49887, which
+    # is the port the camera advertised on its own host candidate.
+    assert _is_self(PUBLIC, 49887) is False
+    assert _is_self(PUBLIC, 46836) is False
+
+
+def test_an_unknown_port_still_refuses_the_public_ip():
+    # Call sites that cannot supply a port keep the old, conservative answer.
+    # Widening those blind would be guessing, and the guard is the safe default.
+    assert _is_self(PUBLIC, None) is True
+
+
+def test_an_unrelated_address_is_never_us():
+    assert _is_self("54.144.38.43", 5349) is False
+
+
+def test_the_learner_uses_the_port_too():
+    # _record_peer_reflexive is where the address becomes a nomination target,
+    # so it has to ask the same question the same way.
+    advertised = [("192.168.100.3", 34400)]
+
+    learned = _record_peer_reflexive(
+        advertised, [], (PUBLIC, 49887), _is_self)
+    assert learned == [(PUBLIC, 49887)], "a peer behind our NAT must be learnable"
+
+    refused = _record_peer_reflexive(
+        advertised, [], (PUBLIC, 41000), _is_self)
+    assert refused == [], "our own advertised address must never be learned"
+
+
+if __name__ == "__main__":
+    import traceback
+    _fns = [v for k, v in sorted(globals().items()) if k.startswith("test_")]
+    _fail = 0
+    for _fn in _fns:
+        try:
+            _fn()
+            print(f"PASS {_fn.__name__}")
+        except Exception:
+            _fail += 1
+            print(f"FAIL {_fn.__name__}")
+            traceback.print_exc()
+    raise SystemExit(1 if _fail else 0)