Generic Camera integration's RTSP camera streams (from Dahua XVR) no longer work after upgrade to 2023.4.5

[Chef-de-IT]

The problem

Dahua DVR's and XVR's (as well as other companies' similar products that are rebadged Dahuas or Hickvision or use the same chipsets - which covers a large % of the market) make analog (CVBS, HD-CVI, AHD, etc) cameras' streams which they receive & digitze, transcoded to MP4 and such, and available on the network.

In the Dahua's case, the format of such streams is, for video:
rtsp://[XVR's IP]:554/cam/realmonitor?channel=[Channel#]&subtype=1&unicast=true&proto=Onvif
... and for stills:
https://[XVR's IP]/onvifsnapshot/media_service/snapshot?channel=12&subtype=0

After the upgrade to 2023.4.5, this no longer works for such analog cameras' streams from the DVR's and XVR's. The camera windows are gray with a broken icon in the middle. The natively IP cameras, however, using the same exact integration, are working just fine. There are errors in the log (see below).

What version of Home Assistant Core has the issue?

2023.4.5

What was the last working version of Home Assistant Core?

2023.2

What type of installation are you running?

Home Assistant OS

Integration causing the issue

Generic Camera

Link to integration documentation on our website

https://www.home-assistant.io/integrations/generic/

Diagnostics information

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

In HomeAssistant Core logs:



Logger: aiohttp.server
Source: components/generic/camera.py:202
First occurred: 10:47:27 AM (16 occurrences)
Last logged: 11:02:52 AM
Error handling request

Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/aiohttp/web_protocol.py", line 433, in _handle_request
    resp = await request_handler(request)
  File "/usr/local/lib/python3.10/site-packages/aiohttp/web_app.py", line 504, in _handle
    resp = await handler(request)
  File "/usr/local/lib/python3.10/site-packages/aiohttp/web_middlewares.py", line 117, in impl
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/security_filter.py", line 85, in security_filter_middleware
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/forwarded.py", line 100, in forwarded_middleware
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/request_context.py", line 28, in request_context_middleware
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/ban.py", line 80, in ban_middleware
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/auth.py", line 235, in auth_middleware
    return await handler(request)
  File "/usr/src/homeassistant/homeassistant/components/http/view.py", line 146, in handle
    result = await result
  File "/usr/src/homeassistant/homeassistant/components/camera/__init__.py", line 734, in get
    return await self.handle(request, camera)
  File "/usr/src/homeassistant/homeassistant/components/camera/__init__.py", line 752, in handle
    image = await _async_get_image(
  File "/usr/src/homeassistant/homeassistant/components/camera/__init__.py", line 171, in _async_get_image
    if image_bytes := await camera.async_camera_image(
  File "/usr/src/homeassistant/homeassistant/components/generic/camera.py", line 202, in async_camera_image
    response = await async_client.get(
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1757, in get
    return await self.request(
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1533, in request
    return await self.send(request, auth=auth, follow_redirects=follow_redirects)
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1620, in send
    response = await self._send_handling_auth(
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1648, in _send_handling_auth
    response = await self._send_handling_redirects(
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1685, in _send_handling_redirects
    response = await self._send_single_request(request)
  File "/usr/local/lib/python3.10/site-packages/httpx/_client.py", line 1722, in _send_single_request
    response = await transport.handle_async_request(request)
  File "/usr/local/lib/python3.10/site-packages/httpx/_transports/default.py", line 353, in handle_async_request
    resp = await self._pool.handle_async_request(req)
  File "/usr/local/lib/python3.10/site-packages/httpcore/_async/connection_pool.py", line 253, in handle_async_request
    raise exc
  File "/usr/local/lib/python3.10/site-packages/httpcore/_async/connection_pool.py", line 237, in handle_async_request
    response = await connection.handle_async_request(request)
  File "/usr/local/lib/python3.10/site-packages/httpcore/_async/connection.py", line 86, in handle_async_request
    raise exc
  File "/usr/local/lib/python3.10/site-packages/httpcore/_async/connection.py", line 63, in handle_async_request
    stream = await self._connect(request)
  File "/usr/local/lib/python3.10/site-packages/httpcore/_async/connection.py", line 150, in _connect
    stream = await stream.start_tls(**kwargs)
  File "/usr/local/lib/python3.10/site-packages/httpcore/backends/asyncio.py", line 78, in start_tls
    raise exc
  File "/usr/local/lib/python3.10/site-packages/httpcore/backends/asyncio.py", line 69, in start_tls
    ssl_stream = await anyio.streams.tls.TLSStream.wrap(
  File "/usr/local/lib/python3.10/site-packages/anyio/streams/tls.py", line 122, in wrap
    await wrapper._call_sslobject_method(ssl_object.do_handshake)
  File "/usr/local/lib/python3.10/site-packages/anyio/streams/tls.py", line 130, in _call_sslobject_method
    result = func(*args)
  File "/usr/local/lib/python3.10/ssl.py", line 975, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:997)

Additional information

No response

[home-assistant]

Hey there @davet2001, mind taking a look at this issue as it has been labeled with an integration (generic) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of generic can trigger bot actions by commenting:

• @home-assistant close Closes the issue.
• @home-assistant rename Awesome new title Renames the issue.
• @home-assistant reopen Reopen the issue.
• @home-assistant unassign generic Removes the current integration label and assignees on the issue, add the integration domain after the command.

_{^{(message by CodeOwnersMention)}}

---

generic documentation
generic source
_{^{(message by IssueLinks)}}

[Chef-de-IT]

@bdraco Nick: this might be related

[xyvyx1]

Can confirm similar behavior with stills using a Dahua Color-4k-X camera.

These URLs work via Chrome after providing basic-auth credentials:
http://[Camera IP]/cgi-bin/snapshot.cgi
http://[Camera IP]/onvifsnapshot/media_service/snapshot?channel=1&subtype=0

They do not work within the integration using either inline credentials or populating the basic auth form items.
I have the "verify SSL certificate" unchecked & am only attempting http connections; the camera doesn't have any sort of certs/ssl enabled.

Omitting the Still Image URL and using the RTSP-stream only works, although the "preview" during configuration comes up blank. When adding the entity to a dashboard, however, it does render a still image refreshed every 10 seconds.

Viewing the live RTSP stream, however, only works smoothly when using the lower-resolution substream 1.
this particular camera has 2 substreams.
Stream 1 is H.264H at 704x480 @ 10FPS.
Stream 2 is H.265 at 1280x720 @ 10FPS

FWIW, my local connection to HA is secure using a local domain-generated certificate. Given Chef's error above, it sounds SSL / TLS related.

[bdraco]

It’s likely openssl3 changes.

probably needs to explicitly allow older ssl versions and turn off some security flags to work

[bdraco]

Actually I think this is a regression from centralizing the ssl context

https://github.com/home-assistant/core/blob/dev/homeassistant/util/ssl.py

Aiohttp didn’t allow sslv2 and sslv3 but httpx did

[Chef-de-IT]

Actually I think this is a regression from centralizing the ssl context

https://github.com/home-assistant/core/blob/dev/homeassistant/util/ssl.py

Aiohttp didn’t allow sslv2 and sslv3 but httpx did

Interesting. But if the URLs are http not https, shouldn't SSL only affect the latter?

[bdraco]

If it’s not https it won’t matter and you have a different issue

[bdraco]

Is this problem for generic cameras or onvif

it’s labeled generic but it looks like it should be onvif

[bdraco]

Are you manually using the onvif endpoints with generic cameras?

[home-assistant]

Hey there @hunterjm, mind taking a look at this issue as it has been labeled with an integration (onvif) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of onvif can trigger bot actions by commenting:

• @home-assistant close Closes the issue.
• @home-assistant rename Awesome new title Renames the issue.
• @home-assistant reopen Reopen the issue.
• @home-assistant unassign onvif Removes the current integration label and assignees on the issue, add the integration domain after the command.

_{^{(message by CodeOwnersMention)}}

---

onvif documentation
onvif source
_{^{(message by IssueLinks)}}

[bdraco]

I can adjust the ssl setup to fix the exception you posted but I'm not 100% sure it will fix your issue