An experimental video stream aggregator
https://git.wbinvd.org/sdvr
- C 81.8%
- C++ 16.7%
- Makefile 1.5%
sdvr: An experimental video stream aggregator ============================================= SDVR is an open source system to aggregate the output from remote cameras, and run arbitrary code against every frame in real time. The goal of the project is to scale to both huge numbers of cameras, and huge numbers of local video data consumers per camera. SDVR is intended to be "secure by default": servers and clients mutually authenticate each other using persistent ECDSA keys (like SSH), and all data exchanged is encrypted. No user configuration is required, it "just works". SDVR supports streaming video over TCP, UDP, and raw ethernet frames. Proof of concept over localhost with your webcam: $ sudo apt install make gcc g++ $ sudo apt install libnacl-dev libavcodec-dev libsdl2-dev liburcu-dev $ make -j -s $ ./sdvrd & $ ./psdl & $ ./sdvrc To use the raw ethernet support, specify the inbound interface on the server: $ sudo ./sdvrd -i enp7s0 ...and provide both the outbound interface and destination MAC on the client: $ sudo ./sdvrc -u -d 80:61:5f:08:b2:ba -o enxac7f3ee6b3be This is still a work in progress, and parts of it are very messy. Design ------ SDVR has three pieces: the client, the daemon, and the consumer(s). The clients run on the systems with the camera(s) attached. Currently, only V4L2 on Linux is supported, with broader support being a long term goal if this project gains any traction. The daemon recieves the data, decrypts it, and makes it available to consumers locklessly via ring buffers in /dev/shm. The daemon doesn't know or care how many consumers there are: it just buffers the data. A theoretically unlimited number of consumers can consume a given data stream out of the same shared memory in real time. Currently, output.h defines the C++ interface, which decodes the video. Two small proofs of concept derive it: psdl.cpp, which uses libsdl2 to render each connected video stream in its own window; and prec.cpp, which writes it to disk. Protocol -------- The primary motivation for the novel protocol was to provide encryption and mutual authentication in a more user friendly way than SSL/TLS. Eventually, it will probably make sense to use a more standard container format for the video data itself. The video is not padded: for compressed formats, it is important to understand that this leaks information about the video stream. Cryptography ------------ The security model is inspired by OpenSSH: cameras and servers use persistent ECDSA keys to authenticate each other. No configuration is necessary: just like SSH, the keys are remembered after the first connection, and all subsequent connections will be protected against MITM attacks. The key exchange and authenticated encryption are implemented using Curve25519 and xsalsa20/AESPoly1305 primitives from the NaCl library by Daniel J Bernstein. The implementation provides perfect forward security. Keydata is stored in ~/.sdvr/ for both servers and clients. Servers and clients can run on the same machine (over localhost), the filenames do not conflict.