search

ParadoxAlarmInterface / pai

Paradox Magellan, Spectra and EVO, with MQTT, Signal, Pushbullet, Pushover and others
https://gitter.im/paradox-alarm-interface
Eclipse Public License 2.0
340 stars 91 forks source link

Feature: connect to IP150 using Panel ID + PC password #35

Closed kobuki closed 5 years ago

kobuki commented 5 years ago

Currently it's not possible to connect to IP150 v4.10+ modules (I have a v4.30). They are connectable via recent BabayWare on port 10000 using the Panel ID and PC password of the panel, so I think it could be possible to connect using the same method. I haven't found a way to do so using current code.

jpbarraca commented 5 years ago

As far as we know we cannot connect to panels V4.10 without using the SiteID.

Can you use wireshark and capture a session with babyware? You can send it to my email.

kobuki commented 5 years ago

Well, yeah. There are 2 methods that are working for me:

  1. Panel S/N + IP module password
  2. Site ID + email + IP module password

IP module pw is always just 0000. In addition it's required to set the Panel ID and PC password, otherwise BabyWare can't connect. It uses a cloud service to connect back to the module it seems. Direct IP connection is not working. I can create a capture but I remember reading elsewhere that the module and BabyWare is using an encrypted connection making it pretty hard to see unencrypted traffic. I'll see what I can do about that.

jpbarraca commented 5 years ago

We support method 2 with encryption support. Maybe we can find how method 1 works.

kobuki commented 5 years ago

I tried method 2 but it doesn't work. I might have use the wrong settings. How should I configure the script to be able to use that method? I set IP_CONNECTION_SITEID and IP_CONNECTION_EMAIL. Do I need anything else? Now it just says:

2018-12-22 01:22:27,728 - ERROR - PAI.paradox.connections.ip_connection - Error connecting to IP Module: 248

jpbarraca commented 5 years ago

Can you enable full debug with packet dumps?

kobuki commented 5 years ago

Sure, I just did a run with packet dumps. What should I do with it? I have a debug log with my private site data so I can't send it to you like that, is there a part which I can copy-paste and can help you identify the problem?

jpbarraca commented 5 years ago

The relevant part are the first ten or so messages, which should be encrypted.

kobuki commented 5 years ago

Here's the start of the log. I changed private info. I don't know what's in the encrypted packet data, though. The number in the Error connecting to IP Module: 43 part always changes, which is weird.

2018-12-22 10:03:44,807 - INFO     - PAI - Starting Paradox Alarm Interface
2018-12-22 10:03:44,807 - INFO     - PAI - Console Log level set to 10
2018-12-22 10:03:45,808 - INFO     - PAI - Using IP Connection
2018-12-22 10:03:45,871 - INFO     - PAI - Starting...
2018-12-22 10:03:45,871 - INFO     - PAI.paradox.paradox - Connecting to interface
2018-12-22 10:03:45,872 - INFO     - PAI.paradox.connections.ip_connection - Connecting to Site: xxx
2018-12-22 10:03:45,872 - DEBUG    - PAI.paradox.connections.ip_connection - Getting site info
2018-12-22 10:03:46,038 - DEBUG    - PAI.paradox.connections.ip_connection - Site Info: {
    "site": [
        {
            "module": [
                {
                    "swport": 10000,
                    "panelSerial": "xxx",
                    "type": "IP150",
                    "mac": "xxx",
                    "lastUpdate": "2018-12-22T09:01:25Z",
                    "port": 80,
                    "xoraddr": "xxx",
                    "name": null,
                    "API": null,
                    "ipAddress": "xxx",
                    "serial": "xxx"
                },
                {
                    "panelSerial": "xxx",
                    "type": "PCS250",
                    "mac": "xxx",
                    "name": null,
                    "port": 10000,
                    "xoraddr": "xxx",
                    "lastUpdate": "2018-12-22T08:54:27Z",
                    "API": null,
                    "ipAddress": "xxx",
                    "serial": "xxx"
                }
            ],
            "name": "xxx",
            "email": "xxx@xxx",
            "daysLeft": 1091,
            "paid": 1,
            "sitePanelStatus": 1
        }
    ]
}
2018-12-22 10:03:46,223 - INFO     - PAI.paradox.connections.ip_connection - Connected to Site: xxx
2018-12-22 10:03:46,223 - DEBUG    - PAI.paradox.connections.ip_connection - Connecting to IP Panel
2018-12-22 10:03:46,223 - DEBUG    - PAI.paradox.connections.ip_connection - IP Connection established
2018-12-22 10:03:46,224 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'REDACTED'
2018-12-22 10:03:46,340 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'REDACTED'
2018-12-22 10:03:46,342 - ERROR    - PAI.paradox.connections.ip_connection - Error connecting to IP Module: 43
jpbarraca commented 5 years ago

Can you test with the dev branch and paste the log? You may ommit things like you are doing.

kobuki commented 5 years ago

It's from the dev branch. Spits a little more info, but practically the same result so far.

2018-12-22 10:24:50,519 - INFO     - PAI - Starting Paradox Alarm Interface
2018-12-22 10:24:50,519 - INFO     - PAI - Console Log level set to 10
2018-12-22 10:24:51,521 - INFO     - PAI - Using IP Connection
2018-12-22 10:24:51,586 - INFO     - PAI - Starting...
2018-12-22 10:24:51,586 - INFO     - PAI.paradox.paradox - Connecting to interface
2018-12-22 10:24:51,586 - INFO     - PAI.paradox.connections.ip_connection - Connecting to Site: xxx
2018-12-22 10:24:51,586 - DEBUG    - PAI.paradox.connections.ip_connection - Getting site info
2018-12-22 10:24:51,751 - DEBUG    - PAI.paradox.connections.ip_connection - Site Info: {
    "site": [
        {
            "name": "xxx",
            "daysLeft": 1091,
            "email": "xxx@xxx",
            "sitePanelStatus": 1,
            "module": [
                {
                    "xoraddr": "xxx",
                    "port": 80,
                    "swport": 10000,
                    "lastUpdate": "2018-12-22T09:21:30Z",
                    "API": null,
                    "serial": "xxx",
                    "mac": "xxx",
                    "ipAddress": "xxx",
                    "name": null,
                    "type": "IP150",
                    "panelSerial": "xxx"
                },
                {
                    "xoraddr": "xxx",
                    "name": null,
                    "panelSerial": "xxx",
                    "lastUpdate": "2018-12-22T09:24:36Z",
                    "API": null,
                    "serial": "xxx",
                    "mac": "xxx",
                    "ipAddress": "xxx",
                    "type": "PCS250",
                    "port": 10000
                }
            ],
            "paid": 1
        }
    ]
}
2018-12-22 10:24:51,752 - DEBUG    - PAI.paradox.connections.ip_connection - STUN TCP Change Request
2018-12-22 10:24:51,835 - DEBUG    - PAI.paradox.connections.ip_connection - STUN TCP Binding Request
2018-12-22 10:24:51,860 - DEBUG    - PAI.paradox.connections.ip_connection - STUN Connect Request
2018-12-22 10:24:51,886 - DEBUG    - PAI.paradox.connections.ip_connection - STUN Connection Bind Request
2018-12-22 10:24:51,936 - INFO     - PAI.paradox.connections.ip_connection - Connected to Site: xxx
2018-12-22 10:24:51,936 - DEBUG    - PAI.paradox.connections.ip_connection - Connecting to IP Panel
2018-12-22 10:24:51,937 - DEBUG    - PAI.paradox.connections.ip_connection - IP Connection established
2018-12-22 10:24:51,937 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'REDACTED'
2018-12-22 10:24:52,220 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'REDACTED'
2018-12-22 10:24:52,222 - ERROR    - PAI.paradox.connections.ip_connection - Error connecting to IP Module: 108
jpbarraca commented 5 years ago

The authentication to the IP Module is failing. I updated the debug messages to provide better feedback.

kobuki commented 5 years ago

I'm using the same connection details as in BabyWare. I'm sure the Site ID and email are right, but I specify 0000 as IP module password. This cannot be set up anywhere, and BabyWare accepts it without problems. What can be wrong here? Relevant config lines are below.

IP_CONNECTION_PASSWORD = b'0000'        # IP Module password
IP_CONNECTION_SITEID = 'xxx'             # SITE ID. IF defined, connection will be made through this method.
IP_CONNECTION_EMAIL = 'xxx@xxx'              # Email registered in the site
...
PASSWORD = b'0000'                      # PC Password. Set to None if Panel has no Password
kobuki commented 5 years ago

OK, by specifying REDACTED' as IP module password, it went further, but stops at a later point. It's a Spectra SP5500, maybe it's not supported by this app?

2018-12-22 11:51:31,655 - DEBUG    - PAI.paradox.connections.ip_connection - Authenticating with IP Module
2018-12-22 11:51:31,656 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa07000309f0000001eeeeeeeeeeeeee3a62e8127909db980f51850ace578683'
2018-12-22 11:51:31,825 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa1b000129f0000000eeeeeeeeeeae16f133fe6a700869c3ebe0c21dc00bdc929b9b985c24db6b5d3a97822fff088804'
2018-12-22 11:51:31,827 - INFO     - PAI.paradox.connections.ip_connection - Authentication Success. Panel version 20, firmware: 4.48, serial: 7107935b
2018-12-22 11:51:31,827 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa00000309f2000001eeeeeeeeeeeeee'
2018-12-22 11:51:31,873 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa01000129f2000000eeeeeeeeee080fa0b1fc9e2e83e9b587d54731ae4e2190'
2018-12-22 11:51:31,874 - DEBUG    - PAI.paradox.connections.ip_connection - F2 answer: b'00'
2018-12-22 11:51:31,874 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa00000309f3000001eeeeeeeeeeeeee'
2018-12-22 11:51:31,920 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa1100012bf3000000eeeeeeeeeee2168218c8bad6eb67aa27065417567ced52a0b1fc9e2e83e9b587d54731ae4e2190'
2018-12-22 11:51:31,922 - DEBUG    - PAI.paradox.connections.ip_connection - F3 answer: b'0100000000000000000000000000000000'
2018-12-22 11:51:31,922 - DEBUG    - PAI.paradox.connections.ip_connection - Sending F8
2018-12-22 11:51:31,924 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa26000309f8000001eeeeeeeeeeeeee29a33f68a899bec9e6fb40e2cc008c26ca194c262ff970c292513971f28e74720607e8fe11b79bce7963746967a02d8d'
2018-12-22 11:51:31,971 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa0100016bf8000000eeeeeeeeee410d31578310265ee81a1d78b189abdf08aa'
2018-12-22 11:51:31,972 - DEBUG    - PAI.paradox.connections.ip_connection - F8 answer: b'01'
2018-12-22 11:51:31,972 - INFO     - PAI.paradox.connections.ip_connection - Session Established with IP Module
2018-12-22 11:51:31,972 - INFO     - PAI.paradox.paradox - Connecting to panel
2018-12-22 11:51:31,972 - INFO     - PAI.paradox.paradox - Initiating communication
2018-12-22 11:51:31,973 - DEBUG    - PAI.paradox.paradox - PC -> A b'72000000000000000000000000000000000000000000000000000000000000000000000072'
2018-12-22 11:51:31,974 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa2500040900000a01eeeeeeeeeeeeee0d979acea25a7b473103c5688491350fca194c262ff970c292513971f28e74720243998d16a86d2295f3135ddf47bd62'
2018-12-22 11:51:32,109 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa2500026300000000ee00eeeeeecb1b6b75747d87efd109984c95666f301188c01940eadea3b76b410e45b7f31ae06057e2192e3a8e091b1fed22dac2d57da1'
2018-12-22 11:51:32,111 - DEBUG    - PAI.paradox.paradox - PC <- A b'72ff04020001a41e01049400280c843b09910206020b02140972f3575350353530300000bd'
2018-12-22 11:51:32,112 - DEBUG    - PAI.paradox.paradox - Container: 
    fields = Container: 
        length = 36
        offset2 = 36
        data = b'r\xff\x04\x02\x00\x01\xa4\x1e\x01\x04\x94\x00(\x0c\x84;'... (truncated, total 36)
        value = Container: 
            po = Container: 
                command = 7
                message_center = 2
            new_protocol = 255
            protocol_id = 4
            protocol = Container: 
                version = 2
                revision = 0
                build = 1
            family_id = 164
            product_id = (enum) (unknown) 30
            talker = (enum) CONTROLLER_APPLICATION 1
            application = Container: 
                version = 4
                revision = 148
                build = 0
            serial_number = b'(\x0c\x84;' (total 4)
            hardware = Container: 
                version = 9
                revision = 145
            bootloader = Container: 
                version = 2
                revision = 6
                build = 2
                day = 11
                month = 2
                year = 20
            processor_id = 9
            encryption_id = 114
            reserved0 = b'\xf3W' (total 2)
            label = b'SP5500\x00\x00' (total 8)
        offset1 = 0
    checksum = b'\xbd' (total 1)
2018-12-22 11:51:32,113 - INFO     - PAI.paradox.paradox - Found Panel SP5500 version 4.148 build 0
2018-12-22 11:51:32,113 - INFO     - PAI.paradox.paradox - Starting communication
2018-12-22 11:51:32,113 - DEBUG    - PAI.paradox.paradox - PC -> A b'5f200000000000000000000000000000000000000000000000000000000000000002000081'
2018-12-22 11:51:32,115 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa2500040900000a01eeeeeeeeeeeeee6ae37699dbab5460e1e70b1c1b06c1b3ca194c262ff970c292513971f28e7472beddbdb8866d47c74c603619af5d072a'
2018-12-22 11:51:32,250 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa2500026300000000ee00eeeeeeed1b08500ab366995f9e6cfc6fceb50a07ddca194c262ff970c292513971f28e74726ea520c9a95f6b3ef8494102de4f6cfc'
2018-12-22 11:51:32,253 - DEBUG    - PAI.paradox.paradox - PC <- A b'00000000150494004358000000000000000000000000000000000000000000000000000048'
2018-12-22 11:51:32,253 - DEBUG    - PAI.paradox.paradox - Container: 
    fields = Container: 
        length = 36
        offset2 = 36
        data = b'\x00\x00\x00\x00\x15\x04\x94\x00CX\x00\x00\x00\x00\x00\x00'... (truncated, total 36)
        value = Container: 
            po = Container: 
                command = 0
                status = Container: 
                    reserved = False
                    alarm_reporting_pending = False
                    Windload_connected = False
                    NeWare_connected = False
            not_used0 = b'\x00\x00\x00' (total 3)
            product_id = (enum) SPECTRA_SP5500 21
            firmware = Container: 
                version = 4
                revision = 148
                build = 0
            panel_id = 17240
            not_used1 = b'\x00\x00\x00\x00\x00' (total 5)
            transceiver = Container: 
                firmware_build = 0
                family = 0
                firmware_version = 0
                firmware_revision = 0
                noise_floor_level = 0
                status = Container: 
                    not_used = 0
                    noise_floor_high = False
                    constant_carrier = False
                hardware_revision = 0
            not_used2 = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' (total 14)
        offset1 = 0
    checksum = b'H' (total 1)
2018-12-22 11:51:32,254 - INFO     - PAI.paradox.hardware.spectra_magellan.panel - Initializing communication
2018-12-22 11:51:32,254 - DEBUG    - PAI.paradox.paradox - PC -> A b'00000000150494004358a9221900000000000000000000000000000000000000000200002e'
2018-12-22 11:51:32,256 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa2500040900000a01eeeeeeeeeeeeeefcd0a0b77caf3765eaa8b75834ef29d6ca194c262ff970c292513971f28e7472765b736c2dd20a40c465dea2c3a9a00c'
2018-12-22 11:51:32,391 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa2500026300000000ee00eeeeeecb1c082bdac841c92c3b68c942a7fef0043bca194c262ff970c292513971f28e74720c02ecaa979ec4dd44510675aef4b88c'
2018-12-22 11:51:32,394 - DEBUG    - PAI.paradox.paradox - PC <- A b'70001200000000000000000000000000000000000000000000000000000000000000000082'
2018-12-22 11:51:32,394 - DEBUG    - PAI.paradox.paradox - Container: 
    fields = Container: 
        length = 36
        offset2 = 36
        data = b'p\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'... (truncated, total 36)
        value = Container: 
            po = Container: 
                command = 112
            not_used0 = 0
            validation_byte = 18
            not_used1 = None
            message = (enum) (unknown) 0
            source_id = (enum) NonValid_Source 0
            user_high = 0
            user_low = 0
        offset1 = 0
    checksum = b'\x82' (total 1)
2018-12-22 11:51:32,395 - WARNING  - PAI.paradox.paradox - Got ERROR Message: 0
2018-12-22 11:51:32,395 - ERROR    - PAI.paradox.hardware.spectra_magellan.panel - Initialization Failed
2018-12-22 11:51:32,395 - ERROR    - PAI - Unable to connect to alarm
jpbarraca commented 5 years ago

That panel should be fully supported. The error '700012' indicates that the Panel Password is wrong. Try setting the PASSWORD to None or b'0000' and check that you are really setting it to None or b'0000'. The password in that message is not what i would expect if the value in the conf file is b'0000'

kobuki commented 5 years ago

Right, I was testing 0000 and the real PC password, and also None, none of those work. Can I get my keypad to display the required password? Although BabyWare accepts my known password which I extracted from the keypad back when I still had an older IP150 (pre-1.40) so I'm a bit confused here.

kobuki commented 5 years ago

It's just occurred to me maybe the newer firmware (4.30) of the IP150v2 is the problem? Maybe they devised a new encoding method for password or comms. I have to use the latest BW to be able to connect.

yozik04 commented 5 years ago

Try 'paradox' as password.

yozik04 commented 5 years ago

IP_CONNECTION_PASSWORD is textual. By default it is 'paradox' as I know. PASSWORD is keypad password which can be '0000'

kobuki commented 5 years ago

I'm using:

IP_CONNECTION_PASSWORD = b'paradox'        # IP Module password
IP_CONNECTION_SITEID = 'real_site_id'             # SITE ID. IF defined, connection will be made through this method.
IP_CONNECTION_EMAIL = 'real@email'              # Email registered in the site
PASSWORD = xxxx                      # PC Password. Set to None if Panel has no Password

I tried b'0000', None, b'real_4-digit_password', or installer code, master code in place of xxxx, none of them work. Using the PC password in BW always works.

jpbarraca commented 5 years ago

The password in the packet seems to be sent as 'a9' which is incorrect. It should be 'aa' or '00'. Probably a problem when encoding the password.

Set the password to b'\xaa' and try.

kobuki commented 5 years ago

b'\xaa' throws exception (something about lenght mismatch), b'\xaa\xaa' goes through, but same error.

2018-12-22 15:50:21,470 - INFO     - PAI.paradox.hardware.spectra_magellan.panel - Initializing communication
2018-12-22 15:50:21,471 - DEBUG    - PAI.paradox.paradox - PC -> A b'00000000150494004358aaaa190000000000000000000000000000000000000000020000b7'
2018-12-22 15:50:21,472 - DEBUG    - PAI.paradox.connections.ip_connection - PC -> IP b'aa2500040900000a01eeeeeeeeeeeeeefa3644fa6fa38fa21384b9f34a8b6bae2af2eadc5396d48b7c31b31b247fa021b7f0737ae4bb9937ed1b0078e5aa41cb'
2018-12-22 15:50:21,607 - DEBUG    - PAI.paradox.connections.ip_connection - IP -> PC b'aa2500026300000000ee00eeeeeed51effca46cf0c796fa8a393e7f32a330c572af2eadc5396d48b7c31b31b247fa021fe6274cbad35755dbef2166fffa5cc5e'
2018-12-22 15:50:21,609 - DEBUG    - PAI.paradox.paradox - PC <- A b'70001200000000000000000000000000000000000000000000000000000000000000000082'
2018-12-22 15:50:21,610 - DEBUG    - PAI.paradox.paradox - Container:
    fields = Container:
        length = 36
        value = Container:
            po = Container:
                command = 112
            not_used0 = 0
            validation_byte = 18
            not_used1 = None
            message = (enum) (unknown) 0
            source_id = (enum) NonValid_Source 0
            user_high = 0
            user_low = 0
        offset2 = 36
        offset1 = 0
        data = b'p\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'... (truncated, total 36)
    checksum = b'\x82' (total 1)
2018-12-22 15:50:21,610 - WARNING  - PAI.paradox.paradox - Got ERROR Message: 0
2018-12-22 15:50:21,610 - ERROR    - PAI.paradox.hardware.spectra_magellan.panel - Initialization Failed
2018-12-22 15:50:21,611 - ERROR    - PAI - Unable to connect to alarm
kobuki commented 5 years ago

Got it working, finally! Let's suppose my panel password is '1234', then the following line works:

PASSWORD = b'\x12\x34'

Weird, but neither 0x1234 nor 0x3412 is working.

It's spitting out a lot of info continuously, time to test it using MQTT. Thanks for the help so far. I think it would be useful to handle this setting akin to the rest of the 4-digit password fields, so when I write b'1234' it gets converted to its expected binary representation internally.

jpbarraca commented 5 years ago

It should be converted... seems like we have a bug

jpbarraca commented 5 years ago

Can you confirm it is working with the latest master branch?

kobuki commented 5 years ago

Yes, master 2c51be3 fixes it, just checked.

jpbarraca commented 5 years ago

Great news.