speedport.class.php

   1 <?php
   2 /**
   3  * @author      Jan Altensen (Stricted)
   4  * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
   5  * @copyright   2015 Jan Altensen (Stricted)
   6  */
   7 class speedport {
   8         /**
   9          * password-challenge
  10          * @var string
  11          */
  12         private $challenge = '';
  13
  14         /**
  15          * csrf_token
  16          * @var string
  17          */
  18         private $token = '';
  19
  20         /**
  21          * hashed password
  22          * @var string
  23          */
  24         private $hash = '';
  25
  26         /**
  27          * session cookie
  28          * @var string
  29          */
  30         private $session = '';
  31
  32         /**
  33          * router url
  34          * @var string
  35          */
  36         private $url = '';
  37
  38         /**
  39          * derivedk cookie
  40          * @var string
  41          */
  42         private $derivedk = '';
  43
  44         public function __construct ($password, $url = 'http://speedport.ip/') {
  45                 $this->url = $url;
  46                 $this->getChallenge();
  47
  48                 if (empty($this->challenge)) {
  49                         throw new Exception('unable to get the challenge from the router');
  50                 }
  51
  52                 $login = $this->login($password);
  53
  54                 if ($login === false) {
  55                         throw new Exception('unable to login');
  56                 }
  57         }
  58
  59         /**
  60          * Requests the password-challenge from the router.
  61          */
  62         public function getChallenge () {
  63                 $path = 'data/Login.json';
  64                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'challengev' => 'null');
  65                 $data = $this->sentRequest($path, $fields);
  66                 $data = json_decode($data['body'], true);
  67                 if ($data[1]['varid'] == 'challengev') {
  68                         $this->challenge = $data[1]['varvalue'];
  69                 }
  70         }
  71
  72         /**
  73          * login into the router with the given password
  74          *
  75          * @param       string  $password
  76          * @return      boolean
  77          */
  78         public function login ($password) {
  79                 $path = 'data/Login.json';
  80                 $this->hash = hash('sha256', $this->challenge.':'.$password);
  81                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash);
  82                 $data = $this->sentRequest($path, $fields);
  83                 $json = json_decode($data['body'], true);
  84                 if ($json[15]['varid'] == 'login' && $json[15]['varvalue'] == 'success') {
  85                         if (isset($data['header']['Set-Cookie']) && !empty($data['header']['Set-Cookie'])) {
  86                                 preg_match('/^.*(SessionID_R3=[a-z0-9]*).*/i', $data['header']['Set-Cookie'], $match);
  87                                 if (isset($match[1]) && !empty($match[1])) {
  88                                         $this->session = $match[1];
  89                                 }
  90                                 else {
  91                                         throw new Exception('unable to get the session cookie from the router');
  92                                 }
  93
  94                                 // calculate derivedk
  95                                 $this->derivedk = hash_pbkdf2('sha1', hash('sha256', $password), substr($this->challenge, 0, 16), 1000, 32);
  96
  97                                 // get the csrf_token
  98                                 $this->token = $this->getToken();
  99
 100                                 return true;
 101                         }
 102                 }
 103
 104                 return false;
 105         }
 106
 107         /**
 108          * logout
 109          *
 110          * @return      array
 111          */
 112         public function logout () {
 113                 $path = 'data/Login.json';
 114                 $fields = array('logout' => 'byby');
 115                 $data = $this->sentRequest($path, $fields);
 116                 // reset challenge and session
 117                 $this->challenge = '';
 118                 $this->session = '';
 119
 120                 $json = json_decode($data['body'], true);
 121
 122                 return $json;
 123         }
 124
 125         /**
 126          * reboot the router
 127          *
 128          * @return      array
 129          */
 130         public function reboot () {
 131                 $path = 'data/Reboot.json';
 132                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'reboot_device' => 'true');
 133                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 134                 $data = $this->sentRequest($path, $fields, $cookie);
 135
 136                 $json = json_decode($data['body'], true);
 137
 138                 return $json;
 139         }
 140
 141         /**
 142          * change dsl connection status
 143          *
 144          * @param       string  $status
 145          */
 146         public function changeConnectionStatus ($status) {
 147                 $path = 'data/Connect.json';
 148
 149                 if ($status == 'online' || $status == 'offline') {
 150                         $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'req_connect' => $status);
 151                         $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 152                         $this->sentRequest($path, $fields, $cookie);
 153                 }
 154                 else {
 155                         throw new Exception();
 156                 }
 157         }
 158
 159         /**
 160          * return the given json as array
 161          *
 162          * the following paths are known to be valid:
 163          * /data/dsl.json
 164          * /data/interfaces.json
 165          * /data/arp.json
 166          * /data/session.json
 167          * /data/dhcp_client.json
 168          * /data/dhcp_server.json
 169          * /data/ipv6.json
 170          * /data/dns.json
 171          * /data/routing.json
 172          * /data/igmp_proxy.json
 173          * /data/igmp_snooping.json
 174          * /data/wlan.json
 175          * /data/module.json
 176          * /data/memory.json
 177          * /data/speed.json
 178          * /data/webdav.json
 179          * /data/bonding_client.json
 180          * /data/bonding_tunnel.json
 181          * /data/filterlist.json
 182          * /data/bonding_tr181.json
 183          * /data/letinfo.json
 184          *
 185          * /data/Status.json (No login needed)
 186          *
 187          * @param       string  $file
 188          * @return      array
 189          */
 190         public function getData ($file) {
 191                 $path = 'data/'.$file.'.json';
 192                 $fields = array();
 193                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 194                 $data = $this->sentRequest($path, $fields, $cookie);
 195
 196                 if (empty($data['body'])) {
 197                         throw new Exception('unable to get '.$file.' data');
 198                 }
 199
 200                 $json = json_decode($data['body'], true);
 201
 202                 return $json;
 203         }
 204
 205         /**
 206          * get the router syslog
 207          *
 208          * @return      array
 209          */
 210         public function getSyslog() {
 211                 $path = 'data/Syslog.json';
 212                 $fields = array('exporttype' => '0');
 213                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 214                 $data = $this->sentRequest($path, $fields, $cookie);
 215
 216                 if (empty($data['body'])) {
 217                         throw new Exception('unable to get syslog data');
 218                 }
 219
 220                 return explode("\n", $data['body']);
 221         }
 222
 223         /**
 224          * get the Missed Calls from router
 225          *
 226          * @return      array
 227          */
 228         public function getMissedCalls() {
 229                 $path = 'data/ExportMissedCalls.json';
 230                 $fields = array('exporttype' => '1');
 231                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 232                 $data = $this->sentRequest($path, $fields, $cookie);
 233
 234                 if (empty($data['body'])) {
 235                         throw new Exception('unable to get syslog data');
 236                 }
 237
 238                 return explode("\n", $data['body']);
 239         }
 240
 241         /**
 242          * get the Taken Calls from router
 243          *
 244          * @return      array
 245          */
 246         public function getTakenCalls() {
 247                 $path = 'data/ExportTakenCalls.json';
 248                 $fields = array('exporttype' => '2');
 249                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 250                 $data = $this->sentRequest($path, $fields, $cookie);
 251
 252                 if (empty($data['body'])) {
 253                         throw new Exception('unable to get syslog data');
 254                 }
 255
 256                 return explode("\n", $data['body']);
 257         }
 258
 259         /**
 260          * get the Dialed Calls from router
 261          *
 262          * @return      array
 263          */
 264         public function getDialedCalls() {
 265                 $path = 'data/ExportDialedCalls.json';
 266                 $fields = array('exporttype' => '3');
 267                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 268                 $data = $this->sentRequest($path, $fields, $cookie);
 269
 270                 if (empty($data['body'])) {
 271                         throw new Exception('unable to get syslog data');
 272                 }
 273
 274                 return explode("\n", $data['body']);
 275         }
 276
 277         /**
 278          * reconnect LTE
 279          *
 280          * @return      array
 281          */
 282         public function reconnectLte () {
 283                 $path = 'data/modules.json';
 284                 $fields = array('csrf_token' => $this->token, 'lte_reconn' => '1');
 285                 $fields = $this->encrypt($fields);
 286                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 287                 $data = $this->sentRequest($path, $fields, $cookie, 2);
 288                 $json = json_decode($data['body'], true);
 289
 290                 return $json;
 291         }
 292
 293         /*
 294         // i dont want test this :D, feel free to test it and report if it works or not
 295         public function resetToFactoryDefault () {
 296                 $path = 'data/resetAllSetting.json';
 297                 $fields = array('csrf_token' => 'nulltoken', 'showpw' => 0, 'password' => $this->hash, 'reset_all' => 'true');
 298                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 299                 $data = $this->sentRequest($path, $fields, $cookie);
 300                 $json = json_decode($data['body'], true);
 301
 302                 return $json;
 303         }
 304         */
 305
 306         /**
 307          * check if firmware is actual
 308          *
 309          * @return      array
 310          */
 311         public function checkFirmware () {
 312                 $path = 'data/checkfirmware.json';
 313                 $fields = array('checkfirmware' => 'true');
 314                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 315                 $data = $this->sentRequest($path, $fields, $cookie);
 316
 317                 if (empty($data['body'])) {
 318                         throw new Exception('unable to get checkfirmware data');
 319                 }
 320
 321                 $json = json_decode($data['body'], true);
 322
 323                 return $json;
 324         }
 325
 326         /**
 327          * decrypt data from router
 328          *
 329          * @param       string  $data
 330          * @return      array
 331          */
 332         public function decrypt ($data) {
 333                 require_once 'CryptLib/CryptLib.php';
 334                 $factory = new CryptLib\Cipher\Factory();
 335                 $aes = $factory->getBlockCipher('rijndael-128');
 336
 337                 $iv = hex2bin(substr($this->challenge, 16, 16));
 338                 $adata = hex2bin(substr($this->challenge, 32, 16));
 339                 $dkey = hex2bin($this->derivedk);
 340                 $enc = hex2bin($data);
 341
 342                 $aes->setKey($dkey);
 343                 $mode = $factory->getMode('ccm', $aes, $iv, [ 'adata' => $adata, 'lSize' => 7]);
 344
 345                 $mode->decrypt($enc);
 346
 347                 return $mode->finish();
 348         }
 349
 350         /**
 351          * decrypt data for the router
 352          *
 353          * @param       array   $data
 354          * @return      string
 355          */
 356         public function encrypt ($data) {
 357                 require_once 'CryptLib/CryptLib.php';
 358                 $factory = new CryptLib\Cipher\Factory();
 359                 $aes = $factory->getBlockCipher('rijndael-128');
 360
 361                 $iv = hex2bin(substr($this->challenge, 16, 16));
 362                 $adata = hex2bin(substr($this->challenge, 32, 16));
 363                 $dkey = hex2bin($this->derivedk);
 364
 365                 $aes->setKey($dkey);
 366                 $mode = $factory->getMode('ccm', $aes, $iv, [ 'adata' => $adata, 'lSize' => 7]);
 367                 $mode->encrypt(http_build_query($data));
 368
 369                 return bin2hex($mode->finish());
 370         }
 371
 372         /**
 373          * sends the request to router
 374          *
 375          * @param       string  $path
 376          * @param       mixed   $fields
 377          * @param       string  $cookie
 378          * @param       integer $count
 379          * @return      array
 380          */
 381         private function sentRequest ($path, $fields, $cookie = '', $count = 0) {
 382                 $url = $this->url.$path;
 383                 $ch = curl_init();
 384                 curl_setopt($ch, CURLOPT_URL, $url);
 385
 386                 if (!empty($fields)) {
 387                         if (is_array($fields)) {
 388                                 curl_setopt($ch, CURLOPT_POST, count($fields));
 389                                 curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($fields));
 390                         }
 391                         else {
 392                                 curl_setopt($ch, CURLOPT_POST, $count);
 393                                 curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
 394                         }
 395                 }
 396
 397                 if (!empty($cookie)) {
 398                         curl_setopt($ch, CURLOPT_COOKIE, $cookie);
 399                 }
 400
 401                 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 402                 curl_setopt($ch, CURLOPT_HEADER, true);
 403
 404
 405                 if ($cookie) {
 406
 407                 }
 408
 409                 $result = curl_exec($ch);
 410
 411                 $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
 412                 $header = substr($result, 0, $header_size);
 413                 $body = substr($result, $header_size);
 414                 curl_close($ch);
 415
 416                 // fix invalid json
 417
 418                 $body = preg_replace("/(\r\n)|(\r)/", "\n", $body);
 419                 $body = preg_replace('/\'/i', '"', $body);
 420                 $body = preg_replace("/\[\s+\]/i", '[ {} ]', $body);
 421                 $body = preg_replace("/},\s+]/", "}\n]", $body);
 422
 423                 return array('header' => $this->parse_headers($header), 'body' => $body);
 424         }
 425
 426         /**
 427          * get the csrf_token
 428          *
 429          * @return      string
 430          */
 431         private function getToken () {
 432                 $path = 'html/content/overview/index.html?lang=de';
 433                 $fields = array();
 434                 $cookie = 'challengev='.$this->challenge.'; '.$this->session;
 435                 $data = $this->sentRequest($path, $fields, $cookie);
 436
 437                 if (empty($data['body'])) {
 438                         throw new Exception('unable to get csrf_token');
 439                 }
 440
 441                 $a = explode('csrf_token = "', $data['body']);
 442                 $a = explode('";', $a[1]);
 443
 444                 if (isset($a[0]) && !empty($a[0])) {
 445                         return $a[0];
 446                 }
 447                 else {
 448                         throw new Exception('unable to get csrf_token');
 449                 }
 450         }
 451
 452         /**
 453          * parse the curl return header into an array
 454          *
 455          * @param       string  $response
 456          * @return      array
 457          */
 458         private function parse_headers($response) {
 459                 $headers = array();
 460                 $header_text = substr($response, 0, strpos($response, "\r\n\r\n"));
 461
 462                 foreach (explode("\r\n", $header_text) as $i => $line) {
 463                         if ($i === 0) {
 464                                 $headers['http_code'] = $line;
 465                         }
 466                         else {
 467                                 list ($key, $value) = explode(': ', $line);
 468                                 $headers[$key] = $value;
 469                         }
 470                 }
 471
 472                 return $headers;
 473         }
 474 }