Cricalix.Net

Eir F3000 (F@st 5366) pains

As a bid to save some money, I changed ISPs this week, and while the switchover was absolutely painless (compared to what it used to be like to change DSL providers), the lump of hardware Eir supply is a bit less than painless.

The F3000 box that they send out is a Sagemcom device, potentially a F@ST 5366s (the manual linked by Eir is for the 5360, which might just be a class of devices). It has some bugs.

The biggest I’ve noticed to date is that you cannot change the IP address of the device. Eir set it to 192.168.1.254, and you cannot change it. Sure, you can enter a new IP (say 192.168.1.253), and it’ll say everything succeeded, but it’ll never change the IP address.

Looking at the traffic from the browser to the device, and the replies, it becomes kind of obvious what’s wrong. First, the request – based on some other evidence, it looks like they’re using XMO.js.

{"request":
  {"id":106,
   "session-id":1277710771,
   "priority":false,
   "actions":[ 
       {"id":0,
      "method":"setValue",
      "xpath":"Device/DHCPv4/Server/Pools/Pool[Alias='DEFAULT_POOL']/DNSServers",
      "parameters":{"value":"192.168.1.253"}
    },
    ]
  }
}

Then a response from the device

{  
  "reply":
    {"uid":0,
     "id":106,
     "error":{
      "code":16777236,
      "description":"XMO_REQUEST_ACTION_ERR"
     },
     "actions":[      
      {"uid":1,
        "id":0,
        "error":{
          "code":16777309,
          "description":"XMO_NON_WRITABLE_PARAMETER_ERR"
        },
        "callbacks":[]
     },
   ]
 }
}

So yeah, about that UI that lets me try to set a non-writable parameter.

I wonder how this made it past QA. The UI doesn’t even detect that it got an error back from the server on the device.

I went looking to see if I could do a replay “attack” to try and change another parameter (the request actually changes 4 things) to just change the device IP without changing the DNS value, but there’s nonces and checksums on the request; pretty well built, just not well tested.

I’ve spent 1.5 hours trying to reach Eir so far, and 14 phone calls. the first time was an hour-long wait in a queue to find out that the person couldn’t help. The next 13.. well, I reached a human once, who said they weren’t technical support (despite that being the number I called), and was I sure I’d called 1890260260 (I had). The other 12 calls all dropped me like I was a hot rock when I tried other options in the voice tree.

Amazing.

I may just have to try putting the device into bridge mode, and setting up one of my small devices to act as a router running PPPoE.

Tags:

, ,