From bd7735af3d142e379ca1d0680f7a6c4656f0e174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bla=C5=BE=20Kristan?= Date: Mon, 26 May 2025 18:00:45 +0200 Subject: [PATCH] Securing OTA update - prevent settings change if not using private IP address or same subnet - prevent OTA from differnet subnet if PIN is not set - ability to revert firmware --- wled00/cfg.cpp | 2 ++ wled00/data/settings_sec.htm | 3 +++ wled00/data/update.htm | 19 ++++++++++++--- wled00/set.cpp | 1 + wled00/wled.h | 1 + wled00/wled_server.cpp | 46 ++++++++++++++++++++++++++++++++---- wled00/xml.cpp | 1 + 7 files changed, 66 insertions(+), 7 deletions(-) diff --git a/wled00/cfg.cpp b/wled00/cfg.cpp index fcdf4ff4..86f9d153 100644 --- a/wled00/cfg.cpp +++ b/wled00/cfg.cpp @@ -740,6 +740,7 @@ bool deserializeConfig(JsonObject doc, bool fromFS) { CJSON(aOtaEnabled, ota[F("aota")]); #endif getStringFromJson(otaPass, pwd, 33); //normally not present due to security + CJSON(otaSameSubnet, ota[F("same-subnet")]); } #ifdef WLED_ENABLE_DMX @@ -1218,6 +1219,7 @@ void serializeConfig(JsonObject root) { #ifndef WLED_DISABLE_OTA ota[F("aota")] = aOtaEnabled; #endif + ota[F("same-subnet")] = otaSameSubnet; #ifdef WLED_ENABLE_DMX JsonObject dmx = root.createNestedObject("dmx"); diff --git a/wled00/data/settings_sec.htm b/wled00/data/settings_sec.htm index 2db798cf..7f462704 100644 --- a/wled00/data/settings_sec.htm +++ b/wled00/data/settings_sec.htm @@ -57,6 +57,9 @@

Software Update


Enable ArduinoOTA:
+ Only allow update from same network/WiFi:
+ ⚠ If you are using multiple VLANs (i.e. IoT or guest network) either set PIN or disable this option.
+ Disabling this option will make your device less secure.

Backup & Restore

⚠ Restoring presets/configuration will OVERWRITE your current presets/configuration.
diff --git a/wled00/data/update.htm b/wled00/data/update.htm index 96ba821e..8b39b1cc 100644 --- a/wled00/data/update.htm +++ b/wled00/data/update.htm @@ -3,9 +3,20 @@ WLED Update +