From dcd3e072739c47f1a4201b2df9f95209b4ee800d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bla=C5=BE=20Kristan?= Date: Mon, 26 May 2025 18:00:45 +0200 Subject: [PATCH] Securing OTA update - prevent settings change if not using private IP address or same subnet - prevent OTA from differnet subnet if PIN is not set - ability to revert firmware --- wled00/cfg.cpp | 2 ++ wled00/data/settings_sec.htm | 3 +++ wled00/data/update.htm | 19 ++++++++++++--- wled00/set.cpp | 1 + wled00/wled.h | 1 + wled00/wled_server.cpp | 46 ++++++++++++++++++++++++++++++++---- wled00/xml.cpp | 1 + 7 files changed, 66 insertions(+), 7 deletions(-) diff --git a/wled00/cfg.cpp b/wled00/cfg.cpp index d3415efd6..bb918f30d 100644 --- a/wled00/cfg.cpp +++ b/wled00/cfg.cpp @@ -631,6 +631,7 @@ bool deserializeConfig(JsonObject doc, bool fromFS) { CJSON(aOtaEnabled, ota[F("aota")]); #endif getStringFromJson(otaPass, pwd, 33); //normally not present due to security + CJSON(otaSameSubnet, ota[F("same-subnet")]); } #ifdef WLED_ENABLE_DMX @@ -1127,6 +1128,7 @@ void serializeConfig(JsonObject root) { #ifndef WLED_DISABLE_OTA ota[F("aota")] = aOtaEnabled; #endif + ota[F("same-subnet")] = otaSameSubnet; #ifdef WLED_ENABLE_DMX JsonObject dmx = root.createNestedObject("dmx"); diff --git a/wled00/data/settings_sec.htm b/wled00/data/settings_sec.htm index 2db798cf4..7f4627049 100644 --- a/wled00/data/settings_sec.htm +++ b/wled00/data/settings_sec.htm @@ -57,6 +57,9 @@

Software Update


Enable ArduinoOTA:
+ Only allow update from same network/WiFi:
+ ⚠ If you are using multiple VLANs (i.e. IoT or guest network) either set PIN or disable this option.
+ Disabling this option will make your device less secure.

Backup & Restore

⚠ Restoring presets/configuration will OVERWRITE your current presets/configuration.
diff --git a/wled00/data/update.htm b/wled00/data/update.htm index 96ba821e8..8b39b1cce 100644 --- a/wled00/data/update.htm +++ b/wled00/data/update.htm @@ -3,9 +3,20 @@ WLED Update +