[harmonyhub] "Failed communicating with Harmony Hub" with firmware 4.15.206

As part of a “security related fix” Logitech has closed access to the undocumented XMPP API on port 5222 of their Hub with firmware 4.15.206:

Harmony Hub firmware (v4.15.206)

Logitech released a firmware update for Harmony hub-based remotes which addresses security vulnerabilities brought to our attention by a third-party cyber security firm. Logitech takes our customers’ security seriously, and we work diligently to fix these type of issues as they’re discovered. >We are aware that some customers using Harmony APIs which were never documented, nor supported Harmony features. While it is unfortunate that customers using these features are affected by this fix, the overall security of our products and all of our customers is our priority.

As a result the binding is no longer able to communicate with Hubs running the 4.15.206 firmware.

For example the following exception is logged due to this issue:

2018-12-17 14:43:46.248 [DEBUG] [b.internal.handler.HarmonyHubHandler] - Could not connect to HarmonyHub at 192.168.0.204
java.lang.RuntimeException: Failed communicating with Harmony Hub
	at net.whistlingfish.harmony.HarmonyClient.connect(HarmonyClient.java:193) ~[?:?]
	at net.whistlingfish.harmony.HarmonyClient.connect(HarmonyClient.java:118) ~[?:?]
	at org.openhab.binding.harmonyhub.internal.handler.HarmonyHubHandler.connect(HarmonyHubHandler.java:238) ~[?:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:?]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) [?:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:?]
	at java.lang.Thread.run(Thread.java:748) [?:?]
Caused by: org.jivesoftware.smack.SmackException$ConnectionException: The following addresses failed: '192.168.0.204:5222' failed because: /192.168.0.204 exception: java.net.ConnectException: Connection refused (Connection refused)
	at org.jivesoftware.smack.SmackException$ConnectionException.from(SmackException.java:277) ~[?:?]
	at org.jivesoftware.smack.tcp.XMPPTCPConnection.connectUsingConfiguration(XMPPTCPConnection.java:617) ~[?:?]
	at org.jivesoftware.smack.tcp.XMPPTCPConnection.connectInternal(XMPPTCPConnection.java:888) ~[?:?]
	at org.jivesoftware.smack.AbstractXMPPConnection.connect(AbstractXMPPConnection.java:377) ~[?:?]
	at net.whistlingfish.harmony.HarmonyClient.connect(HarmonyClient.java:129) ~[?:?]
	... 9 more

These are the known workarounds for keeping the XMPP API enabled:

• Stay on the 4.15.201 firmware (and not sync to trigger updates)
• After an upgrade to 4.15.206 restore the 4.15.193 firmware using the MyHarmony application
• After an upgrade to 4.15.206 install the “developer” 4.15.210 firmware using the MyHarmony application

To remain on the 4.15.193, 4.15.201 versions internet access (or specific servers) has to be blocked to those Hubs). As a result some functionality of the Phone Apps will no longer work.

As a workaround we might be able to use another undocumented Websocket API.

See also:

• Firmware release notes
• Vulnerabilities found by Tenable fixed by Logitech
• openHAB community thread
  • Firmware downgrade instructions
  • Developer only firmware
  • Websocket protocol implementations
• Logitech community
  • Harmony Hub Firmware Update Fixes Vulnerabilities (includes “developer” 4.15.210 firmware instructions)
  • Harmony Hub FW 4.15.206
• Logitech MyHarmony software downloads (Windows/macOS only)

[Celaeno1]

@vbier @NickWaterton @NicoVermeir I’ve installed org.openhab.binding.harmonyhub-2.5.0-SNAPSHOT.zip (on build 1486) and it is running without any problems, I’m also still on firmware v4.15.201.

[digitaldan]

@wborn I could not leave it alone 😃 I have our binding working against the new websocket library, changes were fairly limited,

https://github.com/digitaldan/openhab2-addons/commit/863c4b79b8fd948eacecd133b4d6a41e4e8a8cd1

The new websocket library needs some minor cleanup, logging and use of futures mostly, but is in good shape. I ported over the shell classes from the original library if people want to try out the command line version (see readme)

https://github.com/digitaldan/harmony-client/

I have a 2.5 snapshot jar I can post on my clone if anyone is interested