Tapo P110M Authenticate Failure #1353
Comments
|
Could you try rebooting the device to see if that helps? Some users have reported that a reboot (or removing and replugging the device) has suddenly made their devices work. |
|
Thanks for your quick response. I unplugged it and then plugged it back in. I tried adding it, having the integration search the whole subnet. The integration found the plug, I selected it, entered my authentication info, and it failed, with the message “ Invalid authentication: Server response doesn't match our challenge on ip 192.168.x.x”.Any additional thoughts or info I can provide?Regards, Jeff Edelheit12518 Chasbarb TerraceOak Hill, VA 20171-2468(703) 758-0241 (h)(703) 626-4605 (c)On Dec 9, 2024, at 6:51 PM, Teemu R. ***@***.***> wrote:
Could you try rebooting the device to see if that helps? Some users have reported that a reboot (or removing and replugging the device) has suddenly made their devices work.
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>
|
|
This issue is also tracked on this ticket: I own several P110M which I bought a few days ago, all run the same latest firmware and under the same account. They were all configured within the same 30min via the Tapo app. Only the very first one that I have set up allows me to authenticate successfully, all the others fail.
I have also tried to remove one of the devices from the app, even reset it to factory default (long press the power button) - done several times. Nothing works. The above command will only be able to successfully authenticate against the only P110M in my account that works, but not the others. Edit: One difference I've noticed is that the one that accepts the auth states |
|
According to the Tapo Android app decompiled code, there is some evidence that there is a special treatment for "tss" (TP-Link Simple Setup) Onboarding Source devices. and This is the relevant code. Edit: Not sure if/where this is used at this stage... or if this even related to how the client hash gets computed |
|
@Thireus is this fixable I havent a clue. Trying to prevent myself from going to another device. |
|
@barney34, yes this is fixable. Need to reverse the device firmware (Tapo apps don't appear to use the local KLAP protocol... they communicate with the cloud via TLS) and implement the same algorithm that computes the hash for these "tss" devices. Can you confirm your device also shows "tss" when you --debug? This is the line of code that should trigger: python-kasa/kasa/transports/klaptransport.py Lines 221 to 223 in f0abc28 But it doesn't because the local_seed_auth_hash is different from the server_hash. Which to me would suggest the local_seed_auth_hash may be computed incorrectly of these "tss" devices. My guess is that the credentials need to be in a different format. |
|
@Thireus I dont know how to do that but if you tell me I can figure it out |
Where host is you device's IP, username and password are your tapo account credentials. |
|
@Thireus when my work I get a full dump when mine goes offline the IP I can still ping but cant not run the debug against the device it in some terrible state. I have to reboot it to get it back even the local power and or dimmers wont work but the IP I can ping
DEBUG [DISCOVERY] 192.168.100.125 >> {'system': {'get_sysinfo': {}}} discover.py:326 |
|
@barney34, I could be wrong but it looks like to me that you may have some firewall on your network blocking http communications to the device... try to access http://192.168.100.125/ to see if that works. |
|
@Thireus it works in about 30 seconds when the device comes back on line. I can ping the device the whole time. I dont want to derail the conversation.
== Primary features == == Information == == Configuration == == Debug == DEBUG Adding query for <Module Schedule (schedule) for 192.168.100.125>: {'schedule': {'get_rules': {}, 'get_next_action': {}}} iotdevice.py:411 |
|
@barney34, I would suggest to try connect the device to a different network to troubleshoot if this is an issue with your network. As for the authentication issue that some P110M devices are facing:
At this stage this is all speculations... If this is a defect, then they can easily correct it with a firmware update. If this is intentional, until we get a copy of the firmware or they update the same on the iOS/Android apps we will have quite a hard time figuring out which special operations are performed for handshake1...
|
|
Alright, I've figured it out! I had a good intuition initially that it had something to do with tss, the solution only became clear once I found what TSS was about... tss = "TP-Link Simple Setup" - https://community.tp-link.com/en/home/forum/topic/692206 tss is an Oboarding protocol which allows new devices that you plug in to obtain the configuration (credentials and WiFi password) from existing devices on your network. If you plug in a new device and there are existing Tapo devices on your network that also support tss, then this is the onboarding protocol that will be used, and it would appear that it completely breaks local KLAP. I suppose this might be because the credentials are shared with additional hashing or in a different format when the device uses tss onboarding. So there is indeed a different treatment when tss is used to onboard new devices. Here is how you can fix the KLAP auth issue on your devices:
Hope this helps! All my P110M are now working as expected with Home Assistant and they are all on the latest firmware. Edit: it's still unclear if TP-Link broke KLAP with TSS in the latest firmware because of a new hashing mechanism when TSS has been used at onboarding OR if there is a bug with their firmware... Time will tell I suppose. In the meantime this issue should probably remain opened, because if there is a different hashing mechanism when TSS is used it means it could be ported to python-kasa after reverse engineering it. |
TSS breaks local authentication for new firmware - See python-kasa/python-kasa#1353 (comment)
TSS breaks local authentication for new firmware - See python-kasa/python-kasa#1353 (comment)
|
With a few more manual steps inside the Tapo app I was able to add a new P110M device without unplugging all my existing devices:
|
I have a Tapo H200 and two Tapo P110M plugs. All three devices have been added to the Tapo app and the H200 and one P110M were successfully integrated with HA (i.e., successfully authenticates to tplinkcloud.com). The second P110M fails to authenticate even though I'm using the same account name and password.
I've taken the following actions:
I've attached the debug log.
debug log.txt
The text was updated successfully, but these errors were encountered: