ENT-1686/1687: Harden OpenCV RTSPS capture opens

Add FFmpeg open timeout to bound global TLS lock hold, pin CAP_FFMPEG
for rtsps:// URLs, and log when allow_self_signed maps to full bypass
on the OpenCV path.

Author: Nicholas Vergunst

inference/core/interfaces/camera/rtsp_opencv_tls.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 import os
 import threading
 from contextlib import contextmanager
@@ -15,6 +16,10 @@
 
 OPENCV_FFMPEG_CAPTURE_OPTIONS_ENV_VAR = "OPENCV_FFMPEG_CAPTURE_OPTIONS"
 SSL_CERT_FILE_ENV_VAR = "SSL_CERT_FILE"
+# FFmpeg RTSP socket timeout (microseconds). Bounds global-lock hold during capture open.
+_RTSPS_OPEN_TIMEOUT_US = 5_000_000
+
+logger = logging.getLogger(__name__)
 
 _opencv_rtsps_tls_lock = threading.Lock()
 
@@ -48,6 +53,11 @@ def _build_rtsps_tls_option_overrides() -> Dict[str, str]:
         # rfdm maps allow_self_signed to 126 (unknown-CA only). FFmpeg only
         # supports full verify on/off, so treat both 0 and 126 as tls_verify;0.
         if stripped in {"0", "126"}:
+            if stripped == "126":
+                logger.warning(
+                    "OpenCV/FFmpeg RTSPS cannot enforce partial TLS validation; "
+                    "tls_validation_flags=126 (allow_self_signed) maps to tls_verify=0"
+                )
             overrides["tls_verify"] = "0"
         else:
             overrides["tls_verify"] = "1"
@@ -73,10 +83,13 @@ def build_opencv_ffmpeg_capture_options(video: str) -> Optional[str]:
         return None
 
     overrides = _build_rtsps_tls_option_overrides()
-    return merge_opencv_ffmpeg_capture_options(
-        os.environ.get(OPENCV_FFMPEG_CAPTURE_OPTIONS_ENV_VAR),
-        overrides,
-    )
+    existing = os.environ.get(OPENCV_FFMPEG_CAPTURE_OPTIONS_ENV_VAR)
+    merged = _parse_opencv_ffmpeg_capture_options(existing or "")
+    for key, value in overrides.items():
+        merged[key] = value
+    if "stimeout" not in merged and "timeout" not in merged:
+        merged["stimeout"] = str(_RTSPS_OPEN_TIMEOUT_US)
+    return _format_opencv_ffmpeg_capture_options(merged)
 
 
 @contextmanager

inference/core/interfaces/camera/video_source.py

@@ -35,6 +35,7 @@
     StreamOperationNotAllowedError,
 )
 from inference.core.interfaces.camera.rtsp_opencv_tls import opencv_rtsps_tls_env
+from inference.core.interfaces.camera.rtsp_tls import is_rtsps_url
 from inference.core.interfaces.camera.source_reference_sanitizer import (
     sanitize_source_reference,
 )
@@ -150,6 +151,8 @@ def __init__(self, video: Union[str, int]):
         with opencv_rtsps_tls_env(video), capture_process_stderr() as captured_stderr:
             if _consumes_camera_on_jetson(video=video):
                 self.stream = cv2.VideoCapture(video, cv2.CAP_V4L2)
+            elif isinstance(video, str) and is_rtsps_url(video):
+                self.stream = cv2.VideoCapture(video, cv2.CAP_FFMPEG)
             else:
                 self.stream = cv2.VideoCapture(video)
         self._connection_error_message = extract_stream_open_error(

tests/inference/unit_tests/core/interfaces/camera/test_rtsp_opencv_tls.py

@@ -30,6 +30,7 @@ def test_build_options_rtsps_default_strict_verify(
     assert got is not None
     assert "rtsp_transport;tcp" in got
     assert "tls_verify;1" in got
+    assert "stimeout;5000000" in got
 
 
 def test_build_options_rtsps_with_ca(monkeypatch: pytest.MonkeyPatch) -> None: