Honor Router 3 Login

README.md

Description

This flow will try to login on a Honor Router 3 located at address 192.168.3.1 which is the default address for this kind of router.

Setup

To set it up, you need to specify your administrative password for the router inside the Login inject node as msg.password. The Login&HB will take care of login on to the router administrative website and will ensure that the connection remains open by sending Heartbeat request the same way a browser would do. As outputs from this Login&HB subflow, you get the required cookies and csrf if you want to use POST requests to change values inside the router. You also get a 5s timer Heartbeat signal if you want to regulary check some data inside the router.

To stop the Heartbeat signal, send a message with reset = true to the subflow.

This flow should work with Huawei AX3 and possibly Huawei AX3 Pro but it has not been tested.

flow.json

[{"id":"10d86f80.af0b61","type":"subflow","name":"Login&HB","info":"","category":"","in":[{"x":60,"y":380,"wires":[{"id":"44af9fa1.1a288"}]}],"out":[{"x":2400,"y":320,"wires":[{"id":"60bb9b65.be2fe4","port":0}]},{"x":2400,"y":400,"wires":[{"id":"d10ef033.7c78b","port":0}]}],"env":[],"meta":{},"color":"#DDAA99"},{"id":"88942fc3.9c1f1","type":"switch","z":"10d86f80.af0b61","name":"New Cookies?","property":"responseCookies","propertyType":"msg","rules":[{"t":"nnull"},{"t":"else"}],"checkall":"true","repair":false,"outputs":2,"x":740,"y":200,"wires":[["eadb0f06.86c3"],["5765be21.0f1af"]]},{"id":"eadb0f06.86c3","type":"change","z":"10d86f80.af0b61","name":"Set New cookies","rules":[{"t":"set","p":"cookies","pt":"flow","to":"responseCookies","tot":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":930,"y":180,"wires":[["5765be21.0f1af"]]},{"id":"ab26aafc.4c51c8","type":"http request","z":"10d86f80.af0b61","name":"user_login_nonce","method":"POST","ret":"obj","paytoqs":"ignore","url":"http://192.168.3.1/api/system/user_login_nonce","tls":"","persist":true,"proxy":"","authType":"","x":630,"y":160,"wires":[["88942fc3.9c1f1"]]},{"id":"af6f90c6.4d487","type":"switch","z":"10d86f80.af0b61","name":"Err = 0 ?","property":"payload.err","propertyType":"msg","rules":[{"t":"eq","v":"0","vt":"num"}],"checkall":"true","repair":false,"outputs":1,"x":1260,"y":240,"wires":[["b10a7334.aba4"]]},{"id":"905bd407.00a528","type":"switch","z":"10d86f80.af0b61","name":"Errcode = 1 ?","property":"payload.errcode","propertyType":"msg","rules":[{"t":"eq","v":"1","vt":"num"}],"checkall":"true","repair":false,"outputs":1,"x":1280,"y":200,"wires":[["49a534a7.1d709c"]]},{"id":"5765be21.0f1af","type":"change","z":"10d86f80.af0b61","name":"Set CSRF","rules":[{"t":"set","p":"csrf.csrf_token","pt":"flow","to":"payload.csrf_token","tot":"msg"},{"t":"set","p":"csrf.csrf_param","pt":"flow","to":"payload.csrf_param","tot":"msg"},{"t":"delete","p":"headers","pt":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":1100,"y":200,"wires":[["905bd407.00a528","af6f90c6.4d487"]]},{"id":"6515af37.facd1","type":"function","z":"10d86f80.af0b61","name":"CreateFirstNonce","func":"var CryptoJS = context.global.cryptojs;\n\nvar ret = {payload:{}};\nvar firstNonce = CryptoJS.lib.WordArray.random(32).toString();\nvar csrf = flow.get(\"csrf\")|| {csrf_token:\"\", csrf_param:\"\"};\nret.cookies=flow.get(\"cookies\")|| [];\nret.payload = {data:{username:'admin',firstnonce:firstNonce}, \n    csrf:csrf\n}\n\nret.firstNonce = firstNonce;\nret.password = msg.password;\nreturn ret;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":530,"y":120,"wires":[["ab26aafc.4c51c8"]]},{"id":"49a534a7.1d709c","type":"link out","z":"10d86f80.af0b61","name":"","links":["dbe092c.e07b87"],"x":1455,"y":200,"wires":[]},{"id":"dbe092c.e07b87","type":"link in","z":"10d86f80.af0b61","name":"","links":["49a534a7.1d709c"],"x":75,"y":80,"wires":[["f119464b.47b4e8"]]},{"id":"b10a7334.aba4","type":"function","z":"10d86f80.af0b61","name":"CreateUserLoginProof","func":"var CryptoJS = context.global.cryptojs;\n\nvar password = msg.password;\n\nvar salt = CryptoJS.enc.Hex.parse(msg.payload.salt);\nvar iter = msg.payload.iterations;\nvar finalNonce = msg.payload.servernonce;\nvar firstNonce = msg.firstNonce;\nvar authMsg = firstNonce + \",\" + finalNonce + \",\" + finalNonce;\n\nvar saltPassword = CryptoJS.PBKDF2(password, salt, {\n                keySize: 8,\n                iterations:iter,\n                hasher: CryptoJS.algo.SHA256\n            }).toString();\nvar serverKey = CryptoJS.HmacSHA256(CryptoJS.enc.Hex.parse(saltPassword), \"Server Key\");\nvar clientKey = CryptoJS.HmacSHA256(CryptoJS.enc.Hex.parse(saltPassword), \"Client Key\").toString();\nvar hasher256 = CryptoJS.algo.SHA256.create();\nhasher256.update(CryptoJS.enc.Hex.parse(clientKey));\nvar storekey = hasher256.finalize();\nstorekey = storekey.toString();\nvar clientsignature = CryptoJS.HmacSHA256(CryptoJS.enc.Hex.parse(storekey), authMsg);\n\nclientsignature = clientsignature.toString();\nclientsignature = CryptoJS.enc.Hex.parse(clientsignature);\nclientKey = CryptoJS.enc.Hex.parse(clientKey);\nfor (var i = 0; i < clientKey.sigBytes/4; i++) {\n  clientKey.words[i] = clientKey.words[i] ^ clientsignature.words[i]\n}\nvar csrf = flow.get(\"csrf\");\nvar ret = {payload:{}};\nret.cookies=flow.get(\"cookies\");\nvar param1 = {data:{clientproof:clientKey.toString(),finalnonce:finalNonce},\n    csrf:csrf\n};\n\nret.password = password;\nret.payload = param1;\nreturn ret;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":1440,"y":240,"wires":[["7c7e24ff.d72eec"]]},{"id":"7c7e24ff.d72eec","type":"http request","z":"10d86f80.af0b61","name":"user_login_proof","method":"POST","ret":"obj","paytoqs":"ignore","url":"http://192.168.3.1/api/system/user_login_proof","tls":"","persist":true,"proxy":"","authType":"","x":1470,"y":280,"wires":[["c2d65127.c2bea"]]},{"id":"c2d65127.c2bea","type":"switch","z":"10d86f80.af0b61","name":"New Cookies?","property":"responseCookies","propertyType":"msg","rules":[{"t":"nnull"},{"t":"else"}],"checkall":"true","repair":false,"outputs":2,"x":1500,"y":320,"wires":[["4579e542.e2538c"],["3d3cf09.f49d81"]]},{"id":"4579e542.e2538c","type":"change","z":"10d86f80.af0b61","name":"Set New cookies","rules":[{"t":"set","p":"cookies","pt":"flow","to":"responseCookies","tot":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":1710,"y":300,"wires":[["3d3cf09.f49d81"]]},{"id":"3d3cf09.f49d81","type":"change","z":"10d86f80.af0b61","name":"Set CSRF","rules":[{"t":"set","p":"csrf.csrf_token","pt":"flow","to":"payload.csrf_token","tot":"msg"},{"t":"set","p":"csrf.csrf_param","pt":"flow","to":"payload.csrf_param","tot":"msg"},{"t":"delete","p":"headers","pt":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":1880,"y":320,"wires":[["e5c80eb0.8e9e1","a508c846.9661a8"]]},{"id":"60bb9b65.be2fe4","type":"change","z":"10d86f80.af0b61","name":"Build Output Msg","rules":[{"t":"set","p":"payload.csrf","pt":"msg","to":"csrf","tot":"flow"},{"t":"set","p":"payload.cookies","pt":"msg","to":"cookies","tot":"flow"}],"action":"","property":"","from":"","to":"","reg":false,"x":2250,"y":320,"wires":[[]]},{"id":"d3696eb1.20247","type":"trigger","z":"10d86f80.af0b61","name":"","op1":"1","op2":"0","op1type":"num","op2type":"str","duration":"-5","extend":false,"overrideDelay":false,"units":"s","reset":"","bytopic":"all","topic":"topic","outputs":1,"x":1540,"y":420,"wires":[["57154bb9.7a6464"]]},{"id":"701151b.d024bb","type":"http request","z":"10d86f80.af0b61","name":"HeartBeat","method":"GET","ret":"txt","paytoqs":"ignore","url":"http://192.168.3.1/api/system/heartbeat","tls":"","persist":true,"proxy":"","authType":"","x":1910,"y":420,"wires":[["19c0fdee.2f0a92"]]},{"id":"57154bb9.7a6464","type":"change","z":"10d86f80.af0b61","name":"Set cookies","rules":[{"t":"set","p":"cookies","pt":"msg","to":"cookies","tot":"flow"}],"action":"","property":"","from":"","to":"","reg":false,"x":1720,"y":420,"wires":[["701151b.d024bb"]]},{"id":"b8918fa2.f4649","type":"change","z":"10d86f80.af0b61","name":"Retry = 2","rules":[{"t":"set","p":"retry","pt":"flow","to":"2","tot":"num"}],"action":"","property":"","from":"","to":"","reg":false,"x":360,"y":140,"wires":[["6515af37.facd1"]]},{"id":"f119464b.47b4e8","type":"change","z":"10d86f80.af0b61","name":"Retry --","rules":[{"t":"set","p":"retry","pt":"flow","to":"$number($flowContext(\"retry\")) - 1","tot":"jsonata"}],"action":"","property":"","from":"","to":"","reg":false,"x":200,"y":80,"wires":[["8f66939f.d9cd5"]]},{"id":"8f66939f.d9cd5","type":"switch","z":"10d86f80.af0b61","name":"Retry > 0","property":"retry","propertyType":"flow","rules":[{"t":"gt","v":"0","vt":"num"}],"checkall":"true","repair":false,"outputs":1,"x":360,"y":80,"wires":[["6515af37.facd1"]]},{"id":"44af9fa1.1a288","type":"switch","z":"10d86f80.af0b61","name":"Reset?","property":"reset","propertyType":"msg","rules":[{"t":"true"},{"t":"else"}],"checkall":"true","repair":false,"outputs":2,"x":200,"y":380,"wires":[["d3696eb1.20247","e5c80eb0.8e9e1"],["b8918fa2.f4649"]]},{"id":"e5c80eb0.8e9e1","type":"trigger","z":"10d86f80.af0b61","name":"","op1":"","op2":"1","op1type":"nul","op2type":"str","duration":"100","extend":false,"overrideDelay":false,"units":"ms","reset":"","bytopic":"all","topic":"topic","outputs":1,"x":1520,"y":380,"wires":[["d3696eb1.20247"]]},{"id":"19c0fdee.2f0a92","type":"switch","z":"10d86f80.af0b61","name":"Status","property":"statusCode","propertyType":"msg","rules":[{"t":"eq","v":"200","vt":"num"},{"t":"eq","v":"404","vt":"num"}],"checkall":"true","repair":false,"outputs":2,"x":2150,"y":420,"wires":[["d10ef033.7c78b"],["3e0fb68b.5f678a"]]},{"id":"d10ef033.7c78b","type":"function","z":"10d86f80.af0b61","name":"True","func":"var ret = {payload:true}\nreturn ret;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":2290,"y":400,"wires":[[]]},{"id":"3e0fb68b.5f678a","type":"function","z":"10d86f80.af0b61","name":"Password","func":"var ret = {password:msg.password}\nreturn ret;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":2300,"y":440,"wires":[["181759e9.f755e6"]]},{"id":"181759e9.f755e6","type":"link out","z":"10d86f80.af0b61","name":"","links":["b208f39.ec6ce1"],"x":2395,"y":440,"wires":[]},{"id":"b208f39.ec6ce1","type":"link in","z":"10d86f80.af0b61","name":"","links":["181759e9.f755e6"],"x":75,"y":140,"wires":[["b8918fa2.f4649"]]},{"id":"a508c846.9661a8","type":"function","z":"10d86f80.af0b61","name":"Clear Msg","func":"var ret = {payload:{}};\nret.payload = msg.payload;\nreturn ret;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":2050,"y":320,"wires":[["60bb9b65.be2fe4"]]},{"id":"129b52f6.433dad","type":"tab","label":"Flow 2","disabled":false,"info":""},{"id":"7baf21c2.11976","type":"inject","z":"129b52f6.433dad","name":"Login","props":[{"p":"password","v":"your_password","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","x":270,"y":240,"wires":[["5285e5cd.cee1ac"]]},{"id":"5285e5cd.cee1ac","type":"subflow:10d86f80.af0b61","z":"129b52f6.433dad","name":"","env":[],"x":460,"y":260,"wires":[["e4e0eebb.e1a23"],["7babbd7b.95b944"]]},{"id":"eb86165c.436e18","type":"inject","z":"129b52f6.433dad","name":"Stop HB","props":[{"p":"reset","v":"true","vt":"bool"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payloadType":"str","x":280,"y":280,"wires":[["5285e5cd.cee1ac"]]},{"id":"e4e0eebb.e1a23","type":"change","z":"129b52f6.433dad","name":"Set Cookies and CSRF","rules":[{"t":"set","p":"csrf","pt":"flow","to":"payload.csrf","tot":"msg"},{"t":"set","p":"cookies","pt":"flow","to":"payload.cookies","tot":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":670,"y":240,"wires":[["6c0aa160.d1813"]]},{"id":"22c3825c.2836de","type":"http request","z":"129b52f6.433dad","name":"HostInfo","method":"GET","ret":"obj","paytoqs":"ignore","url":"http://192.168.3.1/api/system/HostInfo","tls":"","persist":true,"proxy":"","authType":"","x":820,"y":280,"wires":[["c6b4493f.f20118"]]},{"id":"7babbd7b.95b944","type":"change","z":"129b52f6.433dad","name":"","rules":[{"t":"set","p":"cookies","pt":"msg","to":"cookies","tot":"flow"}],"action":"","property":"","from":"","to":"","reg":false,"x":640,"y":280,"wires":[["22c3825c.2836de","14a89781.d05a78"]]},{"id":"c6b4493f.f20118","type":"debug","z":"129b52f6.433dad","name":"","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"payload","targetType":"msg","statusVal":"","statusType":"auto","x":1010,"y":280,"wires":[]},{"id":"14a89781.d05a78","type":"http request","z":"129b52f6.433dad","name":"Wan","method":"GET","ret":"obj","paytoqs":"ignore","url":"http://192.168.3.1/api/ntwk/wan?type=active","tls":"","persist":true,"proxy":"","authType":"","x":810,"y":320,"wires":[["771e653d.365dfc"]]},{"id":"6c0aa160.d1813","type":"debug","z":"129b52f6.433dad","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":930,"y":240,"wires":[]},{"id":"771e653d.365dfc","type":"debug","z":"129b52f6.433dad","name":"","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"payload","targetType":"msg","statusVal":"","statusType":"auto","x":1010,"y":320,"wires":[]}]

Hi there, just installed and password set, but I got a
TypeError: Cannot read properties of undefined (reading 'lib')
for the node: CreateFirstNonce, how can I try to debug it? is it still working?

index.html page contains de CSRF token and params and RSAn for next steps

you will nee to get user_login_nonce steps.. and user_login_proof steps in order to be able to authenticate properly in the router look for store.js in your router it should contain the SCRAM algoritm used.. most likely your router has fix admin user and you only input password to login to the router.

i got my script working on my AX2 routers... now playing in adding useraccount_scram password change code.