homebridge-tuya-plus 3.2.0 → 3.3.0-beta.1

package/lib/TuyaAccessory.js

@@ -22,7 +22,11 @@ class TuyaAccessory extends EventEmitter {
         this.state = {};
         this._cachedBuffer = Buffer.allocUnsafe(0);
 
-        this._msgQueue = async.queue(this[this.context.version < 3.2 ? '_msgHandler_3_1' : this.context.version === '3.4' ? '_msgHandler_3_4' : '_msgHandler_3_3'].bind(this), 1);
+        this._msgQueue = async.queue(this[
+            this.context.version < 3.2 ? '_msgHandler_3_1' :
+            this.context.version === '3.3' ? '_msgHandler_3_3' :
+            this.context.version === '3.4' ? '_msgHandler_3_4' : '_msgHandler_3_5'
+        ].bind(this), 1);
 
         if (this.context.version >= 3.2) {
             this.context.pingGap = Math.min(this.context.pingGap || 9, 9);
@@ -102,7 +106,7 @@ class TuyaAccessory extends EventEmitter {
         };
 
         this._socket.on('connect', () => {
-            if (this.context.version !== '3.4') {
+            if (this.context.version !== '3.4' && this.context.version !== '3.5') {
                 clearTimeout(this._socket._connTimeout);
 
                 this.connected = true;
@@ -122,13 +126,13 @@ class TuyaAccessory extends EventEmitter {
             if (this.context.intro === false) return;
             this.connected = true;
 
-            if (this.context.version === '3.4') {
+            if (this.context.version === '3.4' || this.context.version === '3.5') {
                 this._tmpLocalKey = crypto.randomBytes(16);
                 const payload = {
                     data: this._tmpLocalKey,
                     encrypted: true,
                     cmd: 3 //CommandType.BIND
-                }
+                };
                 this._send(payload);
             } else {
                 this.update();
@@ -139,18 +143,28 @@ class TuyaAccessory extends EventEmitter {
             this._cachedBuffer = Buffer.concat([this._cachedBuffer, msg]);
 
             do {
-                let startingIndex = this._cachedBuffer.indexOf('000055aa', 'hex');
+                let startingIndex;
+                if (this.context.version === '3.5') {
+                    startingIndex = this._cachedBuffer.indexOf('00006699', 'hex');
+                } else {
+                    startingIndex = this._cachedBuffer.indexOf('000055aa', 'hex');
+                }
                 if (startingIndex === -1) {
                     this._cachedBuffer = Buffer.allocUnsafe(0);
                     break;
                 }
                 if (startingIndex !== 0) this._cachedBuffer = this._cachedBuffer.slice(startingIndex);
 
-                let endingIndex = this._cachedBuffer.indexOf('0000aa55', 'hex');
+                let endingIndex;
+                if (this.context.version === '3.5') {
+                    endingIndex = this._cachedBuffer.indexOf('00009966', 'hex');
+                    if (endingIndex !== -1) endingIndex += 4;
+                } else {
+                    endingIndex = this._cachedBuffer.indexOf('0000aa55', 'hex');
+                    if (endingIndex !== -1) endingIndex += 4;
+                }
                 if (endingIndex === -1) break;
 
-                endingIndex += 4;
-
                 this._msgQueue.push({msg: this._cachedBuffer.slice(0, endingIndex)});
 
                 this._cachedBuffer = this._cachedBuffer.slice(endingIndex);
@@ -489,6 +503,125 @@ class TuyaAccessory extends EventEmitter {
         callback();
     }
 
+    /*
+     * 3.5 Protocol message handler
+     */
+    _msgHandler_3_5(task, callback) {
+        if (!(task.msg instanceof Buffer)) return callback();
+
+        const len = task.msg.length;
+        if (len < 22 ||
+            task.msg.readUInt32BE(0) !== 0x00006699 ||
+            task.msg.readUInt32BE(len - 4) !== 0x00009966) return callback();
+
+        const declaredLen = task.msg.readUInt32BE(14);
+        if ((len - 22) < declaredLen) return callback();
+
+        const cmd = task.msg.readUInt32BE(10);
+
+        if (cmd === 7 || cmd === 13) return callback(); // ignoring
+        if (cmd === 9) {
+            if (this._socket._pinger) clearTimeout(this._socket._pinger);
+            this._socket._pinger = setTimeout(() => {
+                this._socket._ping();
+            }, (this.context.pingGap || 20) * 1000);
+            return callback();
+        }
+
+        const iv = task.msg.slice(18, 30);
+        const encrypted = task.msg.slice(30, len - 20); // remove tag + footer
+        const tag = task.msg.slice(len - 20, len - 4);
+        const aad = task.msg.slice(4, 18); // UUUU + seq + cmd + len (14 bytes)
+
+        let decrypted;
+        try {
+            const decipher = crypto.createDecipheriv('aes-128-gcm', this.session_key ?? this.context.key, iv);
+            decipher.setAAD(aad);
+            decipher.setAuthTag(tag);
+            decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        } catch(ex) {
+            this.log.info(`Failed to decrypt message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, ex);
+            return callback();
+        }
+
+        // strip return code if present (first 4 bytes)
+        let payload = decrypted;
+        if (decrypted.length > 4) {
+            try {
+                JSON.parse(decrypted.toString('utf8'));
+            } catch(_) {
+                payload = decrypted.slice(4);
+            }
+        }
+
+        // remove leading version header
+        if (payload.indexOf(this.context.version) === 0) payload = payload.slice(15);
+
+        // Attempt JSON parse
+        let parsedPayload;
+        try {
+            parsedPayload = JSON.parse(payload.toString('utf8'));
+            if (parsedPayload && parsedPayload.data) {
+                const tmp = parsedPayload;
+                parsedPayload = tmp.data;
+                parsedPayload.t = tmp.t;
+            }
+        } catch(_) {
+            parsedPayload = payload; // may be buffer during key exchange
+        }
+
+        // ---- Handle 3‑way key exchange ----
+        if (cmd === 4 && Buffer.isBuffer(parsedPayload)) {
+            this._tmpRemoteKey = parsedPayload.subarray(0, 16);
+            const calcLocalHmac = hmac(this._tmpLocalKey, this.context.key).toString('hex');
+            const expLocalHmac = parsedPayload.slice(16, 48).toString('hex');
+            if (calcLocalHmac !== expLocalHmac) {
+                throw new Error(`HMAC mismatch(keys): expected ${expLocalHmac}, was ${calcLocalHmac}. ${parsedPayload.toString('hex')}`);
+            }
+
+            const payloadToSend = {
+                data: hmac(this._tmpRemoteKey, this.context.key),
+                encrypted: true,
+                cmd: 5 // CommandType.RENAME_DEVICE equivalent
+            };
+            this._send(payloadToSend);
+            clearTimeout(this._socket._connTimeout);
+
+            // derive session key
+            let tmpKey = xorBuffers(this._tmpLocalKey, this._tmpRemoteKey);
+            this.session_key = encrypt35(tmpKey, this.context.key, this._tmpLocalKey.slice(0, 12));
+
+            this.connected = true;
+            this.update();
+            this.emit('connect');
+            if (this._socket._pinger) clearTimeout(this._socket._pinger);
+            this._socket._pinger = setTimeout(() => this._socket._ping(), 1000);
+            return callback();
+        }
+
+        if (cmd === 10 && parsedPayload === 'json obj data unvalid') {
+            this.log.info(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
+            this.emit('change', {}, this.state);
+            return callback();
+        }
+
+        switch (cmd) {
+            case 8:
+            case 10:
+            case 16:
+                if (parsedPayload && parsedPayload.dps) {
+                    this._change(parsedPayload.dps);
+                } else {
+                    this.log.info(`Malformed message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
+                }
+                break;
+            default:
+                this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
+        }
+
+        callback();
+    }
+
     update(o) {
         const dps = {};
         let hasDataPoint = false;
@@ -514,25 +647,25 @@ class TuyaAccessory extends EventEmitter {
                 t,
                 dps
             };
-            const data = this.context.version === '3.4'
-              ? {
-                  data: {
-                      ...payload,
-                      ctype: 0,
-                      t: undefined
-                  },
-                  protocol:5,
-                  t
-              }
-              : payload
+            const data = (this.context.version === '3.4' || this.context.version === '3.5')
+                ? {
+                    data: {
+                        ...payload,
+                        ctype: 0,
+                        t: undefined
+                    },
+                    protocol: 5,
+                    t
+                }
+                : payload;
             result = this._send({
                 data,
-                cmd: this.context.version === '3.4' ? 13 : 7
+                cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 13 : 7
             });
             if (result !== true) this.log.info(" Result", result);
             if (this.context.sendEmptyUpdate) {
                 //this.log.info(" Sending", this.context.name, 'empty signature');
-                this._send({cmd: this.context.version === '3.4' ? 13 : 7});
+                this._send({cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 13 : 7});
             }
         } else {
             //this.log.info(`Sending first query to ${this.context.name} (${this.context.version})`);
@@ -541,7 +674,7 @@ class TuyaAccessory extends EventEmitter {
                     gwId: this.context.id,
                     devId: this.context.id
                 },
-                cmd: this.context.version === '3.4' ? 16 : 10
+                cmd: (this.context.version === '3.4' || this.context.version === '3.5') ? 16 : 10
             });
         }
 
@@ -570,7 +703,8 @@ class TuyaAccessory extends EventEmitter {
 
         if (this.context.version < 3.2) return this._send_3_1(o);
         if (this.context.version === '3.3') return this._send_3_3(o);
-        return this._send_3_4(o);
+        if (this.context.version === '3.4') return this._send_3_4(o);
+        return this._send_3_5(o);
     }
 
     _send_3_1(o) {
@@ -645,16 +779,6 @@ class TuyaAccessory extends EventEmitter {
         return this._socket.write(payload);
     }
 
-    _fakeUpdate(dps) {
-        this.log.info('Fake update:', JSON.stringify(dps));
-        Object.keys(dps).forEach(dp => {
-            this.state[dp] = dps[dp];
-        });
-        setTimeout(() => {
-            this.emit('change', dps, this.state);
-        }, 1000);
-    }
-
     _send_3_4(o) {
         let {cmd, data} = {...o};
 
@@ -713,19 +837,105 @@ class TuyaAccessory extends EventEmitter {
 
         return this._socket.write(buffer);
     }
+
+    /*
+     * 3.5 Protocol send
+     */
+    _send_3_5(o) {
+        let {cmd, data} = {...o};
+        // data processing similar to 3.4
+        if (!data) data = Buffer.allocUnsafe(0);
+        if (!(data instanceof Buffer)) {
+            if (typeof data !== 'string') data = JSON.stringify(data);
+            data = Buffer.from(data);
+        }
+
+        if (cmd !== 10 && cmd !== 9 && cmd !== 16 && cmd !== 3 && cmd !== 5 && cmd !== 18) {
+            const buffer = Buffer.alloc(data.length + 15);
+            Buffer.from('3.5').copy(buffer, 0);
+            data.copy(buffer, 15);
+            data = buffer;
+        }
+
+        const iv = crypto.randomBytes(12);
+
+        // Increment sequence counter unless empty dp-update
+        if ((cmd !== 7 && cmd !== 13) || data.length) this._sendCounter++;
+
+        const unknownBuf = Buffer.alloc(2); // always 0x0000
+        const seqBuf = Buffer.alloc(4);
+        seqBuf.writeUInt32BE(this._sendCounter, 0);
+        const cmdBuf = Buffer.alloc(4);
+        cmdBuf.writeUInt32BE(cmd, 0);
+        const lenField = 12 + data.length + 16; // iv + payload + tag
+        const lenBuf = Buffer.alloc(4);
+        lenBuf.writeUInt32BE(lenField, 0);
+
+        const aad = Buffer.concat([unknownBuf, seqBuf, cmdBuf, lenBuf]);
+
+        const key = this.session_key ?? this.context.key;
+        const cipher = crypto.createCipheriv('aes-128-gcm', key, iv);
+        cipher.setAAD(aad);
+        const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+        const tag = cipher.getAuthTag();
+
+        const prefixBuf = Buffer.from('00006699', 'hex');
+        const footerBuf = Buffer.from('00009966', 'hex');
+
+        const packet = Buffer.concat([
+            prefixBuf,
+            unknownBuf,
+            seqBuf,
+            cmdBuf,
+            lenBuf,
+            iv,
+            encrypted,
+            tag,
+            footerBuf
+        ]);
+
+        return this._socket.write(packet);
+    }
+
+    _fakeUpdate(dps) {
+        this.log.info('Fake update:', JSON.stringify(dps));
+        Object.keys(dps).forEach(dp => {
+            this.state[dp] = dps[dp];
+        });
+        setTimeout(() => {
+            this.emit('change', dps, this.state);
+        }, 1000);
+    }
 }
 
+/* ------------------ Helper utilities ------------------- */
 const encrypt34 = (data, encryptKey) => {
     const cipher = crypto.createCipheriv('aes-128-ecb', encryptKey, null);
     cipher.setAutoPadding(false);
     let encrypted = cipher.update(data);
     cipher.final();
     return encrypted;
-}
+};
+
+// 3.5 encryption helper (AES‑128‑GCM). Returns ciphertext buffer.
+const encrypt35 = (data, encryptKey, iv) => {
+    const cipher = crypto.createCipheriv('aes-128-gcm', encryptKey, iv);
+    cipher.setAAD(Buffer.alloc(0));
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    /* auth tag is cipher.getAuthTag() but not required here */
+    return encrypted;
+};
 
 const hmac = (data, hmacKey) => {
-    return crypto.createHmac('sha256',hmacKey).update(data, 'utf8').digest();
-}
+    return crypto.createHmac('sha256', hmacKey).update(data, 'utf8').digest();
+};
+
+const xorBuffers = (a, b) => {
+    const len = Math.min(a.length, b.length);
+    const out = Buffer.alloc(len);
+    for (let i = 0; i < len; i++) out[i] = a[i] ^ b[i];
+    return out;
+};
 
 const crc32LookupTable = [];
 (() => {
@@ -742,5 +952,4 @@ const getCRC32 = buffer => {
     return ~crc;
 };
 
-
 module.exports = TuyaAccessory;

package/lib/TuyaDiscovery.js

@@ -4,6 +4,12 @@ const EventEmitter = require('events');
 
 const UDP_KEY = Buffer.from('6c1ec8e2bb9bb59ab50b0daf649b410a', 'hex');
 
+const GCM_DISCOVERY_KEY = crypto.createHash('md5').update('yGAdlopoPVldABfn').digest(); // v3.5 UDP/GCM key
+const PREFIX_55AA = 0x000055aa; // v3.1-3.4
+const PREFIX_6699 = 0x00006699; // v3.5
+const SUFFIX_AA55 = 0x0000aa55;
+const SUFFIX_9966 = 0x00009966;
+
 class TuyaDiscovery extends EventEmitter {
     constructor() {
         super();
@@ -30,6 +36,8 @@ class TuyaDiscovery extends EventEmitter {
         this._running = true;
         this._start(6666);
         this._start(6667);
+        this._start(7000); // v3.5 direct-reply port
+        this._sendV35Probe(); // broadcast a probe so silent 3.5 devices answer us
 
         return this;
     }
@@ -101,42 +109,107 @@ class TuyaDiscovery extends EventEmitter {
 
     _onDgramMessage(port, msg, info) {
         const len = msg.length;
-      //  this.log.info(`Discovery - UDP from ${info.address}:${port} 0x${msg.readUInt32BE(0).toString(16).padStart(8, '0')}...0x${msg.readUInt32BE(len - 4).toString(16).padStart(8, '0')}`);
-        if (len < 16 ||
-            msg.readUInt32BE(0) !== 0x000055aa ||
-            msg.readUInt32BE(len - 4) !== 0x0000aa55
-        ) {
-            this.log.error(`Discovery - UDP from ${info.address}:${port}`, msg.toString('hex'));
+        const prefix = msg.readUInt32BE(0);
+        const suffix = msg.readUInt32BE(len - 4);
+
+        /* 3.1-3.4 packets: 0x55AA … 0xAA55
+           3.5  packets: 0x6699 … 0x9966  */
+        const isV34Frame = prefix === 0x000055aa && suffix === 0x0000aa55;
+        const isV35Frame = prefix === 0x00006699 && suffix === 0x00009966;
+
+        if (!isV34Frame && !isV35Frame) {
+            // Not a Tuya discovery frame – ignore.
             return;
         }
 
-        const size = msg.readUInt32BE(12);
+        if (isV34Frame) {
+            // original logic v3.1-3.4 devices
+            return this._handleV34(msg, port, info);
+        }
+
+        /* v3.5 handling */
+        return this._handleV35(msg, port, info);
+    }
+
+    _handleV34(pkt, port, info) {
+        const len  = pkt.length;
+        const size = pkt.readUInt32BE(12);
+
         if (len - size < 8) {
             this.log.error(`Discovery - UDP from ${info.address}:${port} size ${len - size}`);
             return;
         }
 
-        //const result = {cmd: msg.readUInt32BE(8)};
-        const cleanMsg = msg.slice(len - size + 4, len - 8);
+        const cleanMsg = pkt.slice(len - size + 4, len - 8);
 
         let decryptedMsg;
-        if (port === 6667) {
+        if (port === 6667) { // encrypted replies
             try {
                 const decipher = crypto.createDecipheriv('aes-128-ecb', UDP_KEY, '');
-                decryptedMsg = decipher.update(cleanMsg, 'utf8', 'utf8');
-                decryptedMsg += decipher.final('utf8');
-            } catch (ex) {}
+                decryptedMsg   = decipher.update(cleanMsg, 'utf8', 'utf8');
+                decryptedMsg  += decipher.final('utf8');
+            } catch (_) { /* ignore */ }
         }
 
         if (!decryptedMsg) decryptedMsg = cleanMsg.toString('utf8');
 
         try {
             const result = JSON.parse(decryptedMsg);
-            if (result && result.gwId && result.ip) this._onDiscover(result);
-            else this.log.error(`Discovery - UDP from ${info.address}:${port} decrypted`, cleanMsg.toString('hex'));
+            if (result && result.gwId && result.ip) {
+                this._onDiscover(result);
+            } else {
+                this.log.error(`Discovery - UDP from ${info.address}:${port} decrypted`, cleanMsg.toString('hex'));
+            }
         } catch (ex) {
             this.log.error(`Discovery - Failed to parse discovery response on port ${port}: ${decryptedMsg}`);
-            this.log.error(`Discovery - Failed to parse discovery raw message on port ${port}: ${msg.toString('hex')}`);
+            this.log.error(`Discovery - Failed to parse discovery raw message on port ${port}: ${pkt.toString('hex')}`);
+        }
+    }
+
+
+    /*
+     * Handle protocol-3.5 discovery replies (0x6699 … 0x9966, AES-GCM).
+     *
+     * Packet layout (offsets after the 4-byte prefix):
+     *   0-3   sequence   (uint32)
+     *   4-7   command    (0 for discovery)
+     *   8-11  length     (uint32 – bytes that follow up to but NOT incl. suffix)
+     *   12-23 IV         (12 bytes – GCM nonce)
+     *   24-(n-17) cipher (variable)
+     *   n-16  tag        (16-byte GCM auth tag)
+     *   n-13 … n-1  0x00
+     *   n     n+3 suffix 0x9966
+     */
+    _handleV35(pkt, srcPort, info) {
+        try {
+            const len = pkt.length;
+            const iv      = pkt.slice(16, 28);               // 12-byte nonce
+            const cipher  = pkt.slice(28, len - 20);         // ciphertext
+            const tag     = pkt.slice(len - 20, len - 4);    // 16-byte tag
+            const aad     = pkt.slice(4, 28);                // seq+cmd+len+IV
+
+            const decipher = crypto.createDecipheriv(
+                'aes-128-gcm',
+                GCM_DISCOVERY_KEY,   // static key defined at top of file
+                iv
+            );
+            decipher.setAuthTag(tag);
+            decipher.setAAD(aad);
+
+            const jsonStr = Buffer.concat([
+                decipher.update(cipher),
+                decipher.final()
+            ]).toString('utf8');
+
+            const payload = JSON.parse(jsonStr);
+            if (payload && payload.gwId && payload.ip) {
+                this._onDiscover(payload);
+            }
+        } catch (ex) {
+            this.log.error(
+                `Discovery v3.5 – failed to decrypt packet from ${info.address}:${srcPort}:`,
+                ex.message
+            );
         }
     }
 
@@ -146,6 +219,8 @@ class TuyaDiscovery extends EventEmitter {
         data.id = data.gwId;
         delete data.gwId;
 
+        data.version = data.version || '3.5' // Every pre-3.5 device does include version in its broadcast
+
         this.discovered.set(data.id, data.ip);
 
         this.emit('discover', data);
@@ -160,6 +235,27 @@ class TuyaDiscovery extends EventEmitter {
             });
         }
     }
+
+    _sendV35Probe() {
+        const socket = dgram.createSocket('udp4');
+        const payload = Buffer.from('{"from":"app","ip":"255.255.255.255"}');
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-128-gcm', GCM_DISCOVERY_KEY, iv);
+        cipher.setAAD(Buffer.alloc(14)); // UUUU+seq+cmd+len = zeros OK for probe
+        const enc = Buffer.concat([cipher.update(payload), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const len = Buffer.alloc(4); len.writeUInt32BE(iv.length + enc.length + tag.length, 0);
+        const frame = Buffer.concat([
+            Buffer.from([0,0,0,0x66,0x99].slice(0,4)), // 6699 prefix
+            Buffer.alloc(14), // UUUU + seq + cmd (0) + len placeholder
+            len,
+            iv,
+            enc,
+            tag,
+            Buffer.from('00009966','hex')
+        ]);
+        socket.send(frame, 7000, '255.255.255.255', () => socket.close());
+    }
 }
 
 module.exports = new TuyaDiscovery();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-tuya-plus",
-  "version": "3.2.0",
+  "version": "3.3.0-beta.1",
   "description": "A community-maintained Homebridge plugin for controlling Tuya devices locally over LAN. Includes new features, fixes, and updated device support.",
   "main": "index.js",
   "scripts": {