Connections from home hub blocked/denied

[forfuncsake]

Hi @brutella, firstly I want to say thanks - this project is fantastic!

I recently hacked together a proxy for a basic HTTP API on my DIY garage door opener (https://github.com/forfuncsake/garagedoor/tree/master/cmd/gdhk). Everything works well from my iPhone, but I was never able to connect remotely. I initially put it down to the fact that my ATV3 was probably not supported as a home hub anymore (as this is my first and only HomeKit accessory).

Then I discovered these messages in the log: INFO 2018/03/22 20:19:51 Client xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx is unknown and INFO 2018/03/22 18:20:35 Non-admin controllers are not allowed to add pairings

...and was able to reproduce them by attempting remote access - meaning that the ATV was, in fact, trying to connect to the proxy, but was not authorised.

This commit of hc, titled "Don't allow non-admin client to add additional pairing" looked like the cause of the second log message, so I rebuilt my project with hc pinned to the previous commit, and remote access started working.

I would like to understand why the changes in that commit are required, or if my scenario is a corner case that requires a code change.

Devices/OS: iPhone6 on iOS 10.3.1 ATV3 on tvOS 7.2.2 (latest)

Thanks.

[brutella]

As specified in HAP 4.11, only admin controllers are allowed to add pairings to an accessory. In your case the iPhone wants to tell the garage door opener proxy the encryptions keys of the Apple TV, so that the Apple TV gets access to the accessory if the iPhone establishes a remote connection through it.

The check was added to hc to conform to the HAP specification. Maybe HomeKit prior to iOS 11 didn't set the admin bit correctly?

[forfuncsake]

I have completed some rudimentary testing on this. Order of steps was as follows:

• Built proxy on the earlier commit; Remote access worked.
• Updated iPhone to iOS 11.3; Left accessory alone; Remote access continues to work
• Rebuilt proxy from latest master and started a parallel instance

On the rebuilt instance I was able to add and control the accessory while on WiFi, but when I was "remote" the new accessory showed as "No response" and the messages from above continued to be logged.

It therefore appears to be related to the older tvOS we're stuck on with the ATV3. Would you be open to a PR that provides an option to bypass that restriction for ATV3 remote access to work?

[justinkiang]

Looks like ATV4 is also having this problem

[brutella]

This should work now.