前言

在Home Assistant 折腾笔记一文中，我们曾提及Home Assistant Cloud。

Home Assistant Cloud是什么

Home Assistant Cloud提供安全的远程连接，允许你远程控制设备(在你外出的时候)，也允许Amazon Alexa and Google Assistant控制Home Assistant实例.

目前该服务由Home Assistant的合作伙伴Nabu Casa, Inc提供。Nabu Casa, Inc由Home Assistant 和 Hass.io的联合创始人创建。

Home Assistant Cloud目前由Nabu Casa, Inc提供， nabucasa client是开源的:nabucasa（我当前本地安装的版本是0.14），对于hass_nabucasa的交互逻辑，可以从测试代码中学习:test_cloud_api.py。

但在国内使用，延迟比较严重，哪天被墙了也难说。本文试图对Home Assistant Cloud 进行分析，为今后自行构建Home Assistant Cloud server提供参考，这个工作颇似我们此前对Scratch做的分析。

思路

为了理解Home Assistant Cloud的工作原理，我们将从前端开始，观察通信过程，之后跟踪到Home Assistant后端源码里(nabucasa组件是核心部分)，最后对Home Assistant Cloud server进行推断。

前端分析(通信过程)

首先打开Home Assistant Cloud: http://127.0.0.1:8123/config/cloud/account

我们从登陆开始:

登陆

POST: http://127.0.0.1:8123/api/cloud/login

Request Payload: {"email":"EMAIL","password":"PASSWORD"}

Response: {"success": true}

登陆完成之后， websocket发送message:{"type":"cloud/status","id":18}

收到:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

{
  "success": true,
  "id": 18,
  "result": {
    "logged_in": true,
    "prefs": {
      "alexa_enabled": false,
      "google_secure_devices_pin": null,
      "google_enabled": false,
      "remote_enabled": false,
      "cloudhooks": {
        "xxx": {
          "cloudhook_id": "xxx",
          "managed": true,
          "cloudhook_url": "https://hooks.nabu.casa/xxxxxx",
          "webhook_id": "xxx"
        }
      },
      "cloud_user": "xx",
      "google_entity_configs": {}
    },
    "email": "EMAIL",
    "remote_certificate": null,
    "alexa_entities": {
      "include_entities": [],
      "exclude_domains": [],
      "include_domains": [],
      "exclude_entities": []
    },
    "cloud": "connecting",
    "remote_connected": false,
    "alexa_domains": [
      "fan",
      "automation",
      "group",
      "alert",
      "cover",
      "lock",
      "script",
      "sensor",
      "binary_sensor",
      "climate",
      "scene",
      "input_boolean",
      "switch",
      "media_player",
      "light"
    ],
    "remote_domain": null,
    "google_entities": {
      "include_entities": [],
      "exclude_domains": [],
      "include_domains": [],
      "exclude_entities": []
    }
  },
  "type": "result"
}

之后前端继续发送两条websocket消息:

{"type":"webhook/list","id":19}, 返回:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "success": true,
  "id": 19,
  "result": [
    {
      "domain": "locative",
      "name": "Locative",
      "webhook_id": "xxxx"
    }
  ],
  "type": "result"
}

{"type":"cloud/subscription","id":20}, 返回:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

{
  "success": true,
  "id": 20,
  "result": {
    "customer_exists": true,
    "renewal_active": false,
    "status": 200,
    "subscription": {
      "canceled_at": 1560481412,
      "cancel_at_period_end": true,
      "trial_end": 1563148800,
      "status": "trialing",
      "current_period_end": 1563148800
    },
    "human_description": "Trial user. Trial expires Jul 15, 2019.",
    "delete_requested": false,
    "provider": null,
    "source": null,
    "plan_renewal_date": 1563148800,
    "billing_plan_type": "trial"
  },
  "type": "result"
}

开启Remote Control

点击Remote Control 右边的按钮，将打开远程控制模式。点击之后前端发送websocket消息:

{"type":"cloud/remote/connect","id":20}， 返回内容同前头{"type":"cloud/status","id":18}相似

{"type":"cloud/status","id":21}, 返回内容同前头{"type":"cloud/status","id":18}相似

关闭Remote Control

{"type":"cloud/remote/disconnect","id":22}, 返回内容同前头{"type":"cloud/status","id":18}相似

打开显示在页面的链接:https://xxx.ui.nabu.casa, 可以进行远程控制了！控制界面完全相同，目前猜测是建立了一个透明管道，就像ngrok那样

开启alax

{"type":"cloud/update_prefs","alexa_enabled":true,"id":24}, 返回{"success": true, "id": 24, "result": null, "type": "result"}

后端分析

根据前端的websocket message，逆向找到对应的后端源码是比较简单的一件事。

我们重点关注一下handle{"type":"cloud/remote/connect","id":20}消息的后端源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@websocket_api.require_admin
@_require_cloud_login
@websocket_api.async_response
@_ws_handle_cloud_errors
@websocket_api.websocket_command({
    'type': 'cloud/remote/connect'
})
async def websocket_remote_connect(hass, connection, msg):
    """Handle request for connect remote."""
    cloud = hass.data[DOMAIN] # 
    await cloud.client.prefs.async_update(remote_enabled=True)
    await cloud.remote.connect()
    connection.send_result(msg['id'], _account_data(cloud))

nabucasa client部分对应的源码

阅读RemoteUI class可以发现cloud非常值得关注，cloud作为RemoteUI初始化参数传入，我们跟踪RemoteUI的初始化过程，可以追溯到:self.remote = RemoteUI(self), nabucasa client与云相关的所有秘密都可以从这儿找到。

云端分析

从前头的讨论我们感觉Home Assistant Cloud有些像ngrok server。使用ngrok好像也完全做得到这些事。 本质是把局域网服务暴露到外网。

远程页面如何通信

Remote Control现实的公网控制页面https://xxx.ui.nabu.casa/ 是如何控制我们的设备的呢，可以发现，它使用的websocket通道为 wss://xxx.ui.nabu.casa/api/websocket,采用的message和本地完全一样。

看起来是个透明代理。

从证书信息和后端源码可知证书使用 letsencrypt.org(有效期为3个月，会自动更新)

隐藏目录

登陆之后，观察.homeassistant/.cloud目录, 有以下文件:

  • acme_account.pem
  • acme_reg.json
  • production_auth.json
  • remote_fullchain.pem
  • remote_private.pem

.storage/cloud内容为:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

{
    "data": {
        "alexa_enabled": false,
        "cloud_user": "xxx",
        "cloudhooks": {
            "xxx": {
                "cloudhook_id": "xxx",
                "cloudhook_url": "https://hooks.nabu.casa/xxx",
                "managed": true,
                "webhook_id": "xxx"
            }
        },
        "google_enabled": false,
        "google_secure_devices_pin": null,
        "remote_enabled": true
    },
    "key": "cloud",
    "version": 1
}

参考