homebridge-tuya-plus 3.13.0 → 3.13.1-dev.2

package/lib/TuyaAccessory.js

@@ -23,16 +23,35 @@ class TuyaAccessory extends EventEmitter {
             ...props,
         };
 
+        // The version can arrive as a string ('3.4', from broadcasts) or a number (3.4,
+        // from config.json). Keep a canonical string for protocol headers and a float for
+        // capability checks so devices reporting newer versions (e.g. a future 3.6) are
+        // handled by the newest stack instead of falling into a broken legacy path.
+        if (this.context.version === undefined || this.context.version === null || String(this.context.version).trim() === '') {
+            this.context.version = '3.5';
+        } else {
+            this.context.version = String(this.context.version).trim();
+        }
+        this._protocolVersion = parseFloat(this.context.version);
+        if (isNaN(this._protocolVersion)) {
+            if (this.log) this.log.warn(`Unrecognized protocol version "${this.context.version}" for ${this.context.name}; assuming 3.5.`);
+            this.context.version = '3.5';
+            this._protocolVersion = 3.5;
+        }
+        if (this._protocolVersion > 3.5 && this.log) {
+            this.log.info(`${this.context.name} reports protocol ${this.context.version}, newer than the newest known Tuya LAN protocol (3.5); using the 3.5 (GCM) stack with ${this.context.version} headers.`);
+        }
+
         this.state = {};
         this._cachedBuffer = Buffer.allocUnsafe(0);
 
         this._msgQueue = async.queue(this[
-            this.context.version < 3.2 ? '_msgHandler_3_1' :
-            this.context.version === '3.3' ? '_msgHandler_3_3' :
-            this.context.version === '3.4' ? '_msgHandler_3_4' : '_msgHandler_3_5'
+            this._protocolVersion < 3.2 ? '_msgHandler_3_1' :
+            this._protocolVersion < 3.4 ? '_msgHandler_3_3' :
+            this._protocolVersion < 3.5 ? '_msgHandler_3_4' : '_msgHandler_3_5'
         ].bind(this), 1);
 
-        if (this.context.version >= 3.2) {
+        if (this._protocolVersion >= 3.2) {
             this.context.pingGap = Math.min(this.context.pingGap || 9, 9);
             //this.log.info(`Changing ping gap for ${this.context.name} to ${this.context.pingGap}s`);
         }
@@ -110,7 +129,7 @@ class TuyaAccessory extends EventEmitter {
         };
 
         this._socket.on('connect', () => {
-            if (this.context.version !== '3.4' && this.context.version !== '3.5') {
+            if (this._protocolVersion < 3.4) {
                 clearTimeout(this._socket._connTimeout);
 
                 this.connected = true;
@@ -130,7 +149,7 @@ class TuyaAccessory extends EventEmitter {
             if (this.context.intro === false) return;
             this.connected = true;
 
-            if (this.context.version === '3.4' || this.context.version === '3.5') {
+            if (this._protocolVersion >= 3.4) {
                 this._tmpLocalKey = crypto.randomBytes(16);
                 const payload = {
                     data: this._tmpLocalKey,
@@ -148,7 +167,7 @@ class TuyaAccessory extends EventEmitter {
 
             do {
                 let startingIndex;
-                if (this.context.version === '3.5') {
+                if (this._protocolVersion >= 3.5) {
                     startingIndex = this._cachedBuffer.indexOf('00006699', 'hex');
                 } else {
                     startingIndex = this._cachedBuffer.indexOf('000055aa', 'hex');
@@ -160,7 +179,7 @@ class TuyaAccessory extends EventEmitter {
                 if (startingIndex !== 0) this._cachedBuffer = this._cachedBuffer.slice(startingIndex);
 
                 let endingIndex;
-                if (this.context.version === '3.5') {
+                if (this._protocolVersion >= 3.5) {
                     endingIndex = this._cachedBuffer.indexOf('00009966', 'hex');
                     if (endingIndex !== -1) endingIndex += 4;
                 } else {
@@ -207,9 +226,21 @@ class TuyaAccessory extends EventEmitter {
             }
         });
 
-        this._socket.on('close', err => {
+        this._socket.on('close', () => {
             this.connected = false;
             this.session_key = null;
+
+            // A heartbeat timer must never outlive its socket. The pinger
+            // callbacks act on `this._socket`, so a stale timer left over from a
+            // dead socket would later fire against a freshly reconnected one and
+            // trip a spurious ERR_PING_TIMED_OUT. Clearing it here covers every
+            // teardown path (error-driven destroy as well as the graceful end
+            // below).
+            if (this._socket._pinger) {
+                clearTimeout(this._socket._pinger);
+                this._socket._pinger = null;
+            }
+
             //this.log.info('Closed connection with', this.context.name);
         });
 
@@ -217,6 +248,32 @@ class TuyaAccessory extends EventEmitter {
             this.connected = false;
             this.session_key = null;
             this.log.info('Disconnected from', this.context.name);
+
+            // The device closed the connection on its own. This is routine for
+            // many Tuya devices (e.g. LED ceiling lights) that recycle their
+            // long-lived LAN sockets every few minutes. Previously nothing here
+            // tore the socket down or reconnected: the heartbeat timer kept
+            // running and, because `connected` is now false, its pings went
+            // nowhere until the full ping timeout elapsed and emitted a
+            // misleading "ERR_PING_TIMED_OUT" ~30s later - which was the only
+            // thing that ultimately triggered a reconnect. Tear down and
+            // reconnect promptly instead, so recovery is quick and the logs
+            // reflect what actually happened (a clean disconnect, not a ping
+            // failure).
+            if (this._socket._pinger) {
+                clearTimeout(this._socket._pinger);
+                this._socket._pinger = null;
+            }
+
+            // Destroying first means a trailing RST can't resurface as an
+            // 'error' and schedule a second, competing reconnect.
+            this._socket.destroy();
+
+            if (!this._socket._errorReconnect) {
+                this._socket._errorReconnect = setTimeout(() => {
+                    process.nextTick(this._connect.bind(this));
+                }, 5000);
+            }
         });
     }
 
@@ -336,7 +393,8 @@ class TuyaAccessory extends EventEmitter {
             return callback();
         }
 
-        let versionPos = task.msg.indexOf('3.3');
+        let versionPos = task.msg.indexOf(this.context.version);
+        if (versionPos === -1) versionPos = task.msg.indexOf('3.3');
         if (versionPos === -1) versionPos = task.msg.indexOf('3.2');
         const cleanMsg = task.msg.slice(versionPos === -1 ? len - size + ((task.msg.readUInt32BE(16) & 0xFFFFFF00) ? 0 : 4) : 15 + versionPos, len - 8);
 
@@ -410,7 +468,7 @@ class TuyaAccessory extends EventEmitter {
             return callback();
         }
 
-        let versionPos = task.msg.indexOf('3.4');
+        let versionPos = task.msg.indexOf(this.context.version);
         const cleanMsg = task.msg.slice(versionPos === -1 ? len - size + ((task.msg.readUInt32BE(16) & 0xFFFFFF00) ? 0 : 4) : 15 + versionPos, len - 0x24);
 
         const expectedCrc = task.msg.slice(len - 0x24, task.msg.length - 4).toString('hex');
@@ -430,7 +488,7 @@ class TuyaAccessory extends EventEmitter {
 
         let parsedPayload;
         try {
-            if (decryptedMsg.indexOf(this.context.version) === 0) {
+            if (hasVersionHeader(decryptedMsg)) {
                 decryptedMsg = decryptedMsg.slice(15)
             }
             let res =  JSON.parse(decryptedMsg)
@@ -508,7 +566,8 @@ class TuyaAccessory extends EventEmitter {
     }
 
     /*
-     * 3.5 Protocol message handler
+     * 3.5+ Protocol message handler (0x6699 frames, AES-128-GCM). Also used for any
+     * newer version a device may report (e.g. 3.6) until a format change is documented.
      */
     _msgHandler_3_5(task, callback) {
         if (!(task.msg instanceof Buffer)) return callback();
@@ -558,8 +617,8 @@ class TuyaAccessory extends EventEmitter {
             }
         }
 
-        // remove leading version header
-        if (payload.indexOf(this.context.version) === 0) payload = payload.slice(15);
+        // remove leading version header ("3.x" + 12 bytes), whichever 3.x the device used
+        if (hasVersionHeader(payload)) payload = payload.slice(15);
 
         // Attempt JSON parse
         let parsedPayload;
@@ -651,7 +710,7 @@ class TuyaAccessory extends EventEmitter {
                 t,
                 dps
             };
-            const data = (this.context.version === '3.4' || this.context.version === '3.5')
+            const data = this._protocolVersion >= 3.4
                 ? {
                     data: {
                         ...payload,
@@ -664,12 +723,12 @@ class TuyaAccessory extends EventEmitter {
                 : payload;
             result = this._send({
                 data,
-                cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 13 : 7
+                cmd: this._protocolVersion >= 3.4 ? 13 : 7
             });
             if (result !== true) this.log.info(" Result", result);
             if (this.context.sendEmptyUpdate) {
                 //this.log.info(" Sending", this.context.name, 'empty signature');
-                this._send({cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 13 : 7});
+                this._send({cmd: this._protocolVersion >= 3.4 ? 13 : 7});
             }
         } else {
             //this.log.info(`Sending first query to ${this.context.name} (${this.context.version})`);
@@ -678,7 +737,7 @@ class TuyaAccessory extends EventEmitter {
                     gwId: this.context.id,
                     devId: this.context.id
                 },
-                cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 16 : 10
+                cmd: this._protocolVersion >= 3.4 ? 16 : 10
             });
         }
 
@@ -705,9 +764,9 @@ class TuyaAccessory extends EventEmitter {
         if (this.context.fake) return;
         if (!this.connected) return false;
 
-        if (this.context.version < 3.2) return this._send_3_1(o);
-        if (this.context.version === '3.3') return this._send_3_3(o);
-        if (this.context.version === '3.4') return this._send_3_4(o);
+        if (this._protocolVersion < 3.2) return this._send_3_1(o);
+        if (this._protocolVersion < 3.4) return this._send_3_3(o);
+        if (this._protocolVersion < 3.5) return this._send_3_4(o);
         return this._send_3_5(o);
     }
 
@@ -759,9 +818,9 @@ class TuyaAccessory extends EventEmitter {
             cmd.toString(16).padStart(8, '0'), //command
             '00000000' //size
         ];
-        //version
+        //version ("3.x" + 12 null bytes, e.g. '332e33...' for 3.3)
         if (cmd === 7 && !data) hex.push('00000000');
-        else if (cmd !== 9 && cmd !== 10) hex.push('332e33000000000000000000000000');
+        else if (cmd !== 9 && cmd !== 10) hex.push(Buffer.concat([Buffer.from(this.context.version), Buffer.alloc(12)]).toString('hex'));
         //data
         if (data) {
             const cipher = crypto.createCipheriv('aes-128-ecb', this.context.key, '');
@@ -804,10 +863,10 @@ class TuyaAccessory extends EventEmitter {
           cmd !== 3 &&
           cmd !== 5 &&
           cmd !== 18) {
-            // Add 3.4 header
+            // Add version header (the version the device reported, e.g. '3.4')
             // check this: mqc_very_pcmcd_mcd(int a1, unsigned int a2)
             const buffer = Buffer.alloc(data.length + 15);
-            Buffer.from('3.4').copy(buffer, 0);
+            Buffer.from(this.context.version).copy(buffer, 0);
             data.copy(buffer, 15);
             data = buffer;
         }
@@ -843,7 +902,8 @@ class TuyaAccessory extends EventEmitter {
     }
 
     /*
-     * 3.5 Protocol send
+     * 3.5+ Protocol send (0x6699 frames, AES-128-GCM). Also used for any newer version
+     * a device may report (e.g. 3.6) until a format change is documented.
      */
     _send_3_5(o) {
         let {cmd, data} = {...o};
@@ -855,8 +915,9 @@ class TuyaAccessory extends EventEmitter {
         }
 
         if (cmd !== 10 && cmd !== 9 && cmd !== 16 && cmd !== 3 && cmd !== 5 && cmd !== 18) {
+            // Version header uses the version the device reported (3.5, or newer like 3.6)
             const buffer = Buffer.alloc(data.length + 15);
-            Buffer.from('3.5').copy(buffer, 0);
+            Buffer.from(this.context.version).copy(buffer, 0);
             data.copy(buffer, 15);
             data = buffer;
         }
@@ -934,6 +995,12 @@ const hmac = (data, hmacKey) => {
     return crypto.createHmac('sha256', hmacKey).update(data, 'utf8').digest();
 };
 
+// Payloads of protocol 3.2+ may start with a 15-byte version header: "3.x" followed by
+// 12 bytes. Match any "3.<digit>" so replies still parse when the device answers with a
+// different minor version than the one we connected with.
+const hasVersionHeader = buf =>
+    buf.length >= 15 && buf[0] === 0x33 && buf[1] === 0x2e && buf[2] >= 0x30 && buf[2] <= 0x39;
+
 const xorBuffers = (a, b) => {
     const len = Math.min(a.length, b.length);
     const out = Buffer.alloc(len);

package/lib/TuyaDiscovery.js

@@ -4,11 +4,12 @@ const EventEmitter = require('events');
 
 const UDP_KEY = Buffer.from('6c1ec8e2bb9bb59ab50b0daf649b410a', 'hex');
 
-const GCM_DISCOVERY_KEY = crypto.createHash('md5').update('yGAdlopoPVldABfn').digest(); // v3.5 UDP/GCM key
+const GCM_DISCOVERY_KEY = crypto.createHash('md5').update('yGAdlopoPVldABfn').digest(); // v3.5+ UDP/GCM key
 const PREFIX_55AA = 0x000055aa; // v3.1-3.4
-const PREFIX_6699 = 0x00006699; // v3.5
+const PREFIX_6699 = 0x00006699; // v3.5+
 const SUFFIX_AA55 = 0x0000aa55;
 const SUFFIX_9966 = 0x00009966;
+const REQ_DEVINFO = 0x25; // v3.5+ broadcast probe command (FR_TYPE_BOARDCAST_LPV34/REQ_DEVINFO)
 
 class TuyaDiscovery extends EventEmitter {
     constructor() {
@@ -36,8 +37,15 @@ class TuyaDiscovery extends EventEmitter {
         this._running = true;
         this._start(6666);
         this._start(6667);
-        this._start(7000); // v3.5 direct-reply port
-        this._sendV35Probe(); // broadcast a probe so silent 3.5 devices answer us
+        this._start(7000); // v3.5+ direct-reply port
+
+        // v3.5+ devices stay silent until solicited. One probe usually suffices,
+        // but UDP is lossy and the device may have been mid-boot — repeat every
+        // 6s (matches tinytuya's BROADCASTTIME) so a single dropped packet
+        // doesn't burn the entire discovery window.
+        this._sendV35Probe();
+        if (this._v35ProbeTimer) clearInterval(this._v35ProbeTimer);
+        this._v35ProbeTimer = setInterval(() => this._sendV35Probe(), 6000);
 
         return this;
     }
@@ -48,6 +56,11 @@ class TuyaDiscovery extends EventEmitter {
         this._stop(6667);
         this._stop(7000);
 
+        if (this._v35ProbeTimer) {
+            clearInterval(this._v35ProbeTimer);
+            this._v35ProbeTimer = null;
+        }
+
         return this;
     }
 
@@ -114,7 +127,9 @@ class TuyaDiscovery extends EventEmitter {
         const suffix = msg.readUInt32BE(len - 4);
 
         /* 3.1-3.4 packets: 0x55AA … 0xAA55
-           3.5  packets: 0x6699 … 0x9966  */
+           3.5+ packets: 0x6699 … 0x9966
+           The 6699 payload carries the device's "version" field (3.5, or newer like
+           3.6), which flows into TuyaAccessory and selects the protocol stack. */
         const isV34Frame = prefix === 0x000055aa && suffix === 0x0000aa55;
         const isV35Frame = prefix === 0x00006699 && suffix === 0x00009966;
 
@@ -243,25 +258,43 @@ class TuyaDiscovery extends EventEmitter {
         }
     }
 
+    // Broadcast a v3.5+ REQ_DEVINFO probe to UDP/7000. v3.5+ devices do not
+    // emit periodic plaintext broadcasts like 3.1-3.3, so they are invisible
+    // to passive listeners until something solicits them. Each correctly-formed
+    // probe causes the device to unicast its discovery JSON back to us, which
+    // _handleV35 then decodes.
+    //
+    // Frame layout (big-endian):
+    //   prefix(4) + reserved(2) + seq(4) + cmd(4) + length(4)   [14B header after prefix]
+    // + iv(12) + ciphertext(payloadLen) + tag(16) + suffix(4)
+    //
+    // AAD for GCM must be the 14 header bytes after the prefix exactly as
+    // they appear on the wire. Anything else and the receiver's auth tag
+    // verification fails and the packet is silently dropped.
     _sendV35Probe() {
-        const socket = dgram.createSocket('udp4');
         const payload = Buffer.from('{"from":"app","ip":"255.255.255.255"}');
-        const iv = crypto.randomBytes(12);
+
+        const prefix   = Buffer.from('00006699', 'hex');
+        const suffix   = Buffer.from('00009966', 'hex');
+        const reserved = Buffer.alloc(2); // 0x0000
+        const seq      = Buffer.alloc(4); // 0
+        const cmd      = Buffer.alloc(4); cmd.writeUInt32BE(REQ_DEVINFO, 0);
+        const iv       = crypto.randomBytes(12);
+        const len      = Buffer.alloc(4); len.writeUInt32BE(iv.length + payload.length + 16, 0);
+        const aad      = Buffer.concat([reserved, seq, cmd, len]);
+
         const cipher = crypto.createCipheriv('aes-128-gcm', GCM_DISCOVERY_KEY, iv);
-        cipher.setAAD(Buffer.alloc(14)); // UUUU+seq+cmd+len = zeros OK for probe
+        cipher.setAAD(aad);
         const enc = Buffer.concat([cipher.update(payload), cipher.final()]);
         const tag = cipher.getAuthTag();
-        const len = Buffer.alloc(4); len.writeUInt32BE(iv.length + enc.length + tag.length, 0);
-        const frame = Buffer.concat([
-            Buffer.from([0,0,0,0x66,0x99].slice(0,4)), // 6699 prefix
-            Buffer.alloc(14), // UUUU + seq + cmd (0) + len placeholder
-            len,
-            iv,
-            enc,
-            tag,
-            Buffer.from('00009966','hex')
-        ]);
-        socket.send(frame, 7000, '255.255.255.255', () => socket.close());
+
+        const frame = Buffer.concat([prefix, reserved, seq, cmd, len, iv, enc, tag, suffix]);
+
+        const socket = dgram.createSocket('udp4');
+        socket.bind(0, () => {
+            socket.setBroadcast(true);
+            socket.send(frame, 7000, '255.255.255.255', () => socket.close());
+        });
     }
 }