SpeedportHybrid.class.php

   1 <?php
   2 /**
   3  * @author      Jan Altensen (Stricted)
   4  * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
   5  * @copyright   2015 Jan Altensen (Stricted)
   6  */
   7 class SpeedportHybrid {
   8         /**
   9          * password-challenge
  10          * @var string
  11          */
  12         private $challenge = '';
  13
  14         /**
  15          * csrf_token
  16          * @var string
  17          */
  18         private $token = '';
  19
  20         /**
  21          * hashed password
  22          * @var string
  23          */
  24         private $hash = '';
  25
  26         /**
  27          * session cookie
  28          * @var string
  29          */
  30         private $session = '';
  31
  32         /**
  33          * router url
  34          * @var string
  35          */
  36         private $url = '';
  37
  38         /**
  39          * derivedk cookie
  40          * @var string
  41          */
  42         private $derivedk = '';
  43
  44         public function __construct ($password, $url = 'http://speedport.ip/') {
  45                 $this->url = $url;
  46                 $this->getChallenge();
  47
  48                 if (empty($this->challenge)) {
  49                         throw new Exception('unable to get the challenge from the router');
  50                 }
  51
  52                 $login = $this->login($password);
  53
  54                 if ($login === false) {
  55                         throw new Exception('unable to login');
  56                 }
  57         }
  58
  59         /**
  60          * Requests the password-challenge from the router.
  61          */
  62         public function getChallenge () {
  63                 $path = 'data/Login.json';
  64                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'challengev' => 'null');
  65                 $data = $this->sentRequest($path, $fields);
  66                 $data = json_decode($data['body'], true);
  67                 $data = $this->getValues($data);
  68
  69                 if (isset($data['challengev']) && !empty($data['challengev'])) {
  70                         $this->challenge = $data['challengev'];
  71                 }
  72         }
  73
  74         /**
  75          * login into the router with the given password
  76          *
  77          * @param       string  $password
  78          * @return      boolean
  79          */
  80         public function login ($password) {
  81                 $path = 'data/Login.json';
  82                 $this->hash = hash('sha256', $this->challenge.':'.$password);
  83                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash);
  84                 $data = $this->sentRequest($path, $fields);
  85                 $json = json_decode($data['body'], true);
  86                 $json = $this->getValues($json);
  87                 if (isset($json['login']) && $json['login'] == 'success') {
  88                         if (isset($data['header']['Set-Cookie']) && !empty($data['header']['Set-Cookie'])) {
  89                                 preg_match('/^.*(SessionID_R3=[a-z0-9]*).*/i', $data['header']['Set-Cookie'], $match);
  90                                 if (isset($match[1]) && !empty($match[1])) {
  91                                         $this->session = $match[1];
  92                                 }
  93                                 else {
  94                                         throw new Exception('unable to get the session cookie from the router');
  95                                 }
  96
  97                                 // calculate derivedk
  98                                 $this->derivedk = hash_pbkdf2('sha1', hash('sha256', $password), substr($this->challenge, 0, 16), 1000, 32);
  99
 100                                 // get the csrf_token
 101                                 $this->token = $this->getToken();
 102
 103                                 return true;
 104                         }
 105                 }
 106
 107                 return false;
 108         }
 109
 110         /**
 111          * logout
 112          *
 113          * @return      array
 114          */
 115         public function logout () {
 116                 $path = 'data/Login.json';
 117                 $fields = array('logout' => 'byby');
 118                 $data = $this->sentRequest($path, $fields);
 119                 // reset challenge and session
 120                 $this->challenge = '';
 121                 $this->session = '';
 122                 $this->token = "";
 123
 124                 $json = json_decode($data['body'], true);
 125
 126                 return $json;
 127         }
 128
 129         /**
 130          * reboot the router
 131          *
 132          * @return      array
 133          */
 134         public function reboot () {
 135                 $path = 'data/Reboot.json';
 136                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'reboot_device' => 'true');
 137                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 138                 $data = $this->sentRequest($path, $fields, $cookie);
 139
 140                 $json = json_decode($data['body'], true);
 141
 142                 return $json;
 143         }
 144
 145         /**
 146          * change dsl connection status
 147          *
 148          * @param       string  $status
 149          */
 150         public function changeConnectionStatus ($status) {
 151                 $path = 'data/Connect.json';
 152
 153                 if ($status == 'online' || $status == 'offline') {
 154                         $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'req_connect' => $status);
 155                         $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 156                         $data = $this->sentRequest($path, $fields, $cookie);
 157
 158                         $json = json_decode($this->decrypt($data['body']), true);
 159
 160                         return $json;
 161                 }
 162                 else {
 163                         throw new Exception();
 164                 }
 165         }
 166
 167         /**
 168          * return the given json as array
 169          *
 170          * @param       string  $file
 171          * @return      array
 172          */
 173         public function getData ($file) {
 174                 $path = 'data/'.$file.'.json';
 175                 $fields = array();
 176                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 177                 $data = $this->sentRequest($path, $fields, $cookie);
 178
 179                 if (empty($data['body'])) {
 180                         throw new Exception('unable to get '.$file.' data');
 181                 }
 182
 183                 $json = json_decode($data['body'], true);
 184
 185                 return $json;
 186         }
 187
 188         /**
 189          * get the router syslog
 190          *
 191          * @return      array
 192          */
 193         public function getSyslog() {
 194                 $path = 'data/Syslog.json';
 195                 $fields = array('exporttype' => '0');
 196                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 197                 $data = $this->sentRequest($path, $fields, $cookie);
 198
 199                 if (empty($data['body'])) {
 200                         throw new Exception('unable to get syslog data');
 201                 }
 202
 203                 return explode("\n", $data['body']);
 204         }
 205
 206         /**
 207          * get the Missed Calls from router
 208          *
 209          * @return      array
 210          */
 211         public function getMissedCalls() {
 212                 $path = 'data/ExportMissedCalls.json';
 213                 $fields = array('exporttype' => '1');
 214                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 215                 $data = $this->sentRequest($path, $fields, $cookie);
 216
 217                 if (empty($data['body'])) {
 218                         throw new Exception('unable to get syslog data');
 219                 }
 220
 221                 return explode("\n", $data['body']);
 222         }
 223
 224         /**
 225          * get the Taken Calls from router
 226          *
 227          * @return      array
 228          */
 229         public function getTakenCalls() {
 230                 $path = 'data/ExportTakenCalls.json';
 231                 $fields = array('exporttype' => '2');
 232                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 233                 $data = $this->sentRequest($path, $fields, $cookie);
 234
 235                 if (empty($data['body'])) {
 236                         throw new Exception('unable to get syslog data');
 237                 }
 238
 239                 return explode("\n", $data['body']);
 240         }
 241
 242         /**
 243          * get the Dialed Calls from router
 244          *
 245          * @return      array
 246          */
 247         public function getDialedCalls() {
 248                 $path = 'data/ExportDialedCalls.json';
 249                 $fields = array('exporttype' => '3');
 250                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 251                 $data = $this->sentRequest($path, $fields, $cookie);
 252
 253                 if (empty($data['body'])) {
 254                         throw new Exception('unable to get syslog data');
 255                 }
 256
 257                 return explode("\n", $data['body']);
 258         }
 259
 260         /**
 261          * reconnect LTE
 262          *
 263          * @return      array
 264          */
 265         public function reconnectLte () {
 266                 $path = 'data/modules.json';
 267                 $fields = array('csrf_token' => $this->token, 'lte_reconn' => '1');
 268                 $fields = $this->encrypt($fields);
 269                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 270                 $data = $this->sentRequest($path, $fields, $cookie, 2);
 271                 $json = json_decode($data['body'], true);
 272
 273                 return $json;
 274         }
 275
 276         /**
 277          * reset the router to Factory Default
 278          * not tested
 279          *
 280          * @return      array
 281          */
 282         public function resetToFactoryDefault () {
 283                 $path = 'data/resetAllSetting.json';
 284                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'reset_all' => 'true');
 285                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 286                 $data = $this->sentRequest($path, $fields, $cookie);
 287                 $json = json_decode($data['body'], true);
 288
 289                 return $json;
 290         }
 291
 292
 293         /**
 294          * check if firmware is actual
 295          *
 296          * @return      array
 297          */
 298         public function checkFirmware () {
 299                 $path = 'data/checkfirmware.json';
 300                 $fields = array('checkfirmware' => 'true');
 301                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 302                 $data = $this->sentRequest($path, $fields, $cookie);
 303
 304                 if (empty($data['body'])) {
 305                         throw new Exception('unable to get checkfirmware data');
 306                 }
 307
 308                 $json = json_decode($data['body'], true);
 309
 310                 return $json;
 311         }
 312
 313         /**
 314          * decrypt data from router
 315          *
 316          * @param       string  $data
 317          * @return      array
 318          */
 319         private function decrypt ($data) {
 320                 require_once 'CryptLib/CryptLib.php';
 321                 $factory = new CryptLib\Cipher\Factory();
 322                 $aes = $factory->getBlockCipher('rijndael-128');
 323
 324                 $iv = hex2bin(substr($this->challenge, 16, 16));
 325                 $adata = hex2bin(substr($this->challenge, 32, 16));
 326                 $dkey = hex2bin($this->derivedk);
 327                 $enc = hex2bin($data);
 328
 329                 $aes->setKey($dkey);
 330                 $mode = $factory->getMode('ccm', $aes, $iv, [ 'adata' => $adata, 'lSize' => 7]);
 331
 332                 $mode->decrypt($enc);
 333
 334                 return $mode->finish();
 335         }
 336
 337         /**
 338          * decrypt data for the router
 339          *
 340          * @param       array   $data
 341          * @return      string
 342          */
 343         private function encrypt ($data) {
 344                 require_once 'CryptLib/CryptLib.php';
 345                 $factory = new CryptLib\Cipher\Factory();
 346                 $aes = $factory->getBlockCipher('rijndael-128');
 347
 348                 $iv = hex2bin(substr($this->challenge, 16, 16));
 349                 $adata = hex2bin(substr($this->challenge, 32, 16));
 350                 $dkey = hex2bin($this->derivedk);
 351
 352                 $aes->setKey($dkey);
 353                 $mode = $factory->getMode('ccm', $aes, $iv, [ 'adata' => $adata, 'lSize' => 7]);
 354                 $mode->encrypt(http_build_query($data));
 355
 356                 return bin2hex($mode->finish());
 357         }
 358
 359         /**
 360          * get the values from array
 361          *
 362          * @param       array   $array
 363          * @return      array
 364          */
 365         private function getValues($array) {
 366                 $data = array();
 367                 foreach ($array as $item) {
 368                         $data[$item['varid']] = $item['varvalue'];
 369                 }
 370
 371                 return $data;
 372         }
 373
 374         /**
 375          * sends the request to router
 376          *
 377          * @param       string  $path
 378          * @param       mixed   $fields
 379          * @param       string  $cookie
 380          * @param       integer $count
 381          * @return      array
 382          */
 383         private function sentRequest ($path, $fields, $cookie = '', $count = 0) {
 384                 $url = $this->url.$path;
 385                 $ch = curl_init();
 386                 curl_setopt($ch, CURLOPT_URL, $url);
 387
 388                 if (!empty($fields)) {
 389                         if (is_array($fields)) {
 390                                 curl_setopt($ch, CURLOPT_POST, count($fields));
 391                                 curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($fields));
 392                         }
 393                         else {
 394                                 curl_setopt($ch, CURLOPT_POST, $count);
 395                                 curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
 396                         }
 397                 }
 398
 399                 if (!empty($cookie)) {
 400                         curl_setopt($ch, CURLOPT_COOKIE, $cookie);
 401                 }
 402
 403                 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 404                 curl_setopt($ch, CURLOPT_HEADER, true);
 405
 406                 if ($cookie) {
 407
 408                 }
 409
 410                 $result = curl_exec($ch);
 411
 412                 $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
 413                 $header = substr($result, 0, $header_size);
 414                 $body = substr($result, $header_size);
 415                 curl_close($ch);
 416
 417                 // fix invalid json
 418
 419                 $body = preg_replace("/(\r\n)|(\r)/", "\n", $body);
 420                 $body = preg_replace('/\'/i', '"', $body);
 421                 $body = preg_replace("/\[\s+\]/i", '[ {} ]', $body);
 422                 $body = preg_replace("/},\s+]/", "}\n]", $body);
 423
 424                 return array('header' => $this->parse_headers($header), 'body' => $body);
 425         }
 426
 427         /**
 428          * get the csrf_token
 429          *
 430          * @return      string
 431          */
 432         private function getToken () {
 433                 $path = 'html/content/overview/index.html?lang=de';
 434                 $fields = array();
 435                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 436                 $data = $this->sentRequest($path, $fields, $cookie);
 437
 438                 if (empty($data['body'])) {
 439                         throw new Exception('unable to get csrf_token');
 440                 }
 441
 442                 $a = explode('csrf_token = "', $data['body']);
 443                 $a = explode('";', $a[1]);
 444
 445                 if (isset($a[0]) && !empty($a[0])) {
 446                         return $a[0];
 447                 }
 448                 else {
 449                         throw new Exception('unable to get csrf_token');
 450                 }
 451         }
 452
 453         /**
 454          * parse the curl return header into an array
 455          *
 456          * @param       string  $response
 457          * @return      array
 458          */
 459         private function parse_headers($response) {
 460                 $headers = array();
 461                 $header_text = substr($response, 0, strpos($response, "\r\n\r\n"));
 462
 463                 $header_text = explode("\r\n", $header_text);
 464                 foreach ($header_text as $i => $line) {
 465                         if ($i === 0) {
 466                                 $headers['http_code'] = $line;
 467                         }
 468                         else {
 469                                 list ($key, $value) = explode(': ', $line);
 470                                 $headers[$key] = $value;
 471                         }
 472                 }
 473
 474                 return $headers;
 475         }
 476 }