Skip to content

Commit 0f00c95

Browse files
blazoncekblazoncek
authored
Merge pull request #4700 from wled/secure-ota
Securing OTA update
2 parents bbfe90d + a147f41 commit 0f00c95

File tree

7 files changed

+71
-7
lines changed

7 files changed

+71
-7
lines changed

‎wled00/cfg.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -740,6 +740,7 @@ bool deserializeConfig(JsonObject doc, bool fromFS) {
740740
CJSON(aOtaEnabled, ota[F("aota")]);
741741
#endif
742742
getStringFromJson(otaPass, pwd, 33); //normally not present due to security
743+
CJSON(otaSameSubnet, ota[F("same-subnet")]);
743744
}
744745

745746
#ifdef WLED_ENABLE_DMX
@@ -1218,6 +1219,7 @@ void serializeConfig(JsonObject root) {
12181219
#ifndef WLED_DISABLE_OTA
12191220
ota[F("aota")] = aOtaEnabled;
12201221
#endif
1222+
ota[F("same-subnet")] = otaSameSubnet;
12211223

12221224
#ifdef WLED_ENABLE_DMX
12231225
JsonObject dmx = root.createNestedObject("dmx");

‎wled00/data/settings_sec.htm‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ <h2>Security & Update setup</h2>
5757
<h3>Software Update</h3>
5858
<button type="button" onclick="U()">Manual OTA Update</button><br>
5959
<div id="aOTA">Enable ArduinoOTA: <input type="checkbox" name="AO"></div>
60+
Only allow update from same network/WiFi: <input type="checkbox" name="SU"><br>
61+
<i class="warn">&#9888; If you are using multiple VLANs (i.e. IoT or guest network) either set PIN or disable this option.<br>
62+
Disabling this option will make your device less secure.</i><br>
6063
<hr id="backup">
6164
<h3>Backup & Restore</h3>
6265
<div class="warn">&#9888; Restoring presets/configuration will OVERWRITE your current presets/configuration.<br>

‎wled00/data/update.htm‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,20 @@
33
<head>
44
<meta content='width=device-width' name='viewport'>
55
<title>WLED Update</title>
6+
<script src="common.js" async type="text/javascript"></script>
67
<script>
78
function B() { window.history.back(); }
8-
function U() { document.getElementById("uf").style.display="none";document.getElementById("msg").style.display="block"; }
9+
var cnfr = false;
10+
function cR() {
11+
if (!cnfr) {
12+
var bt = gId('rev');
13+
bt.style.color = "red";
14+
bt.innerText = "Revert!";
15+
cnfr = true;
16+
return;
17+
}
18+
window.open(getURL("/update?revert"),"_self");
19+
}
920
function GetV() {/*injected values here*/}
1021
</script>
1122
<style>
@@ -15,15 +26,17 @@
1526

1627
<body onload="GetV()">
1728
<h2>WLED Software Update</h2>
18-
<form method='POST' action='./update' id='uf' enctype='multipart/form-data' onsubmit="U()">
29+
<form method='POST' action='./update' id='upd' enctype='multipart/form-data' onsubmit="toggle('upd')">
1930
Installed version: <span class="sip">##VERSION##</span><br>
2031
Download the latest binary: <a href="https://github.com/wled-dev/WLED/releases" target="_blank"
2132
style="vertical-align: text-bottom; display: inline-flex;">
2233
<img src="https://img.shields.io/github/release/wled-dev/WLED.svg?style=flat-square"></a><br>
2334
<input type='file' name='update' required><br> <!--should have accept='.bin', but it prevents file upload from android app-->
2435
<button type="submit">Update!</button><br>
36+
<hr class="sml">
37+
<button id="rev" type="button" onclick="cR()">Revert update</button><br>
2538
<button type="button" onclick="B()">Back</button>
2639
</form>
27-
<div id="msg"><b>Updating...</b><br>Please do not close or refresh the page :)</div>
40+
<div id="Noupd" class="hide"><b>Updating...</b><br>Please do not close or refresh the page :)</div>
2841
</body>
2942
</html>

‎wled00/set.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -612,6 +612,7 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
612612
aOtaEnabled = request->hasArg(F("AO"));
613613
#endif
614614
//createEditHandler(correctPIN && !otaLock);
615+
otaSameSubnet = request->hasArg(F("SU"));
615616
}
616617
}
617618

‎wled00/wled.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -593,6 +593,7 @@ WLED_GLOBAL bool aOtaEnabled _INIT(true); // ArduinoOTA allows easy upda
593593
#else
594594
WLED_GLOBAL bool aOtaEnabled _INIT(false); // ArduinoOTA allows easy updates directly from the IDE. Careful, it does not auto-disable when OTA lock is on
595595
#endif
596+
WLED_GLOBAL bool otaSameSubnet _INIT(true); // prevent OTA updates from other subnets (e.g. internet) if no PIN is set
596597
WLED_GLOBAL char settingsPIN[5] _INIT(WLED_PIN); // PIN for settings pages
597598
WLED_GLOBAL bool correctPIN _INIT(!strlen(settingsPIN));
598599
WLED_GLOBAL unsigned long lastEditTime _INIT(0);

‎wled00/wled_server.cpp‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ static const char s_redirecting[] PROGMEM = "Redirecting...";
1616
static const char s_content_enc[] PROGMEM = "Content-Encoding";
1717
static const char s_unlock_ota [] PROGMEM = "Please unlock OTA in security settings!";
1818
static const char s_unlock_cfg [] PROGMEM = "Please unlock settings using PIN code!";
19+
static const char s_rebooting [] PROGMEM = "Rebooting now...";
1920
static const char s_notimplemented[] PROGMEM = "Not implemented";
2021
static const char s_accessdenied[] PROGMEM = "Access Denied";
2122
static const char _common_js[] PROGMEM = "/common.js";
@@ -31,6 +32,22 @@ static bool isIp(const String &str) {
3132
return true;
3233
}
3334

35+
static bool inSubnet(const IPAddress &ip, const IPAddress &subnet, const IPAddress &mask) {
36+
return (((uint32_t)ip & (uint32_t)mask) == ((uint32_t)subnet & (uint32_t)mask));
37+
}
38+
39+
static bool inSameSubnet(const IPAddress &client) {
40+
return inSubnet(client, Network.localIP(), Network.subnetMask());
41+
}
42+
43+
static bool inLocalSubnet(const IPAddress &client) {
44+
return inSubnet(client, IPAddress(10,0,0,0), IPAddress(255,0,0,0)) // 10.x.x.x
45+
|| inSubnet(client, IPAddress(192,168,0,0), IPAddress(255,255,0,0)) // 192.168.x.x
46+
|| inSubnet(client, IPAddress(172,16,0,0), IPAddress(255,240,0,0)) // 172.16.x.x
47+
|| (inSubnet(client, IPAddress(4,3,2,0), IPAddress(255,255,255,0)) && apActive) // WLED AP
48+
|| inSameSubnet(client); // same subnet as WLED device
49+
}
50+
3451
/*
3552
* Integrated HTTP web server page declarations
3653
*/
@@ -130,7 +147,7 @@ static String msgProcessor(const String& var)
130147
if (optt < 60) //redirect to settings after optionType seconds
131148
{
132149
messageBody += F("<script>setTimeout(RS,");
133-
messageBody +=String(optt*1000);
150+
messageBody += String(optt*1000);
134151
messageBody += F(")</script>");
135152
} else if (optt < 120) //redirect back after optionType-60 seconds, unused
136153
{
@@ -270,7 +287,7 @@ void initServer()
270287
});
271288

272289
server.on(F("/reset"), HTTP_GET, [](AsyncWebServerRequest *request){
273-
serveMessage(request, 200,F("Rebooting now..."),F("Please wait ~10 seconds..."),129);
290+
serveMessage(request, 200, FPSTR(s_rebooting), F("Please wait ~10 seconds."), 131);
274291
doReboot = true;
275292
});
276293

@@ -385,10 +402,16 @@ void initServer()
385402
if (Update.hasError()) {
386403
serveMessage(request, 500, F("Update failed!"), F("Please check your file and retry!"), 254);
387404
} else {
388-
serveMessage(request, 200, F("Update successful!"), F("Rebooting..."), 131);
405+
serveMessage(request, 200, F("Update successful!"), FPSTR(s_rebooting), 131);
389406
doReboot = true;
390407
}
391408
},[](AsyncWebServerRequest *request, String filename, size_t index, uint8_t *data, size_t len, bool isFinal){
409+
IPAddress client = request->client()->remoteIP();
410+
if (((otaSameSubnet && !inSameSubnet(client)) && !strlen(settingsPIN)) || (!otaSameSubnet && !inLocalSubnet(client))) {
411+
DEBUG_PRINTLN(F("Attempted OTA update from different/non-local subnet!"));
412+
request->send(401, FPSTR(CONTENT_TYPE_PLAIN), FPSTR(s_accessdenied));
413+
return;
414+
}
392415
if (!correctPIN || otaLock) return;
393416
if(!index){
394417
DEBUG_PRINTLN(F("OTA Update Start"));
@@ -573,6 +596,11 @@ void serveSettings(AsyncWebServerRequest* request, bool post) {
573596
}
574597

575598
if (post) { //settings/set POST request, saving
599+
IPAddress client = request->client()->remoteIP();
600+
if (!inLocalSubnet(client)) { // includes same subnet check
601+
serveMessage(request, 401, FPSTR(s_accessdenied), FPSTR(s_redirecting), 123);
602+
return;
603+
}
576604
if (subPage != SUBPAGE_WIFI || !(wifiLock && otaLock)) handleSettingsSet(request, subPage);
577605

578606
char s[32];
@@ -624,7 +652,19 @@ void serveSettings(AsyncWebServerRequest* request, bool post) {
624652
case SUBPAGE_DMX : content = PAGE_settings_dmx; len = PAGE_settings_dmx_length; break;
625653
#endif
626654
case SUBPAGE_UM : content = PAGE_settings_um; len = PAGE_settings_um_length; break;
627-
case SUBPAGE_UPDATE : content = PAGE_update; len = PAGE_update_length; break;
655+
case SUBPAGE_UPDATE : content = PAGE_update; len = PAGE_update_length;
656+
#ifdef ARDUINO_ARCH_ESP32
657+
if (request->hasArg(F("revert")) && inLocalSubnet(request->client()->remoteIP()) && Update.canRollBack()) {
658+
doReboot = Update.rollBack();
659+
if (doReboot) {
660+
serveMessage(request, 200, F("Reverted to previous version!"), FPSTR(s_rebooting), 133);
661+
} else {
662+
serveMessage(request, 500, F("Rollback failed!"), F("Please reboot and retry."), 254);
663+
}
664+
return;
665+
}
666+
#endif
667+
break;
628668
#ifndef WLED_DISABLE_2D
629669
case SUBPAGE_2D : content = PAGE_settings_2D; len = PAGE_settings_2D_length; break;
630670
#endif

‎wled00/xml.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,7 @@ void getSettingsJS(byte subPage, Print& settingsScript)
591591
printSetFormCheckbox(settingsScript,PSTR("NO"),otaLock);
592592
printSetFormCheckbox(settingsScript,PSTR("OW"),wifiLock);
593593
printSetFormCheckbox(settingsScript,PSTR("AO"),aOtaEnabled);
594+
printSetFormCheckbox(settingsScript,PSTR("SU"),otaSameSubnet);
594595
char tmp_buf[128];
595596
snprintf_P(tmp_buf,sizeof(tmp_buf),PSTR("WLED %s (build %d)"),versionString,VERSION);
596597
printSetClassElementHTML(settingsScript,PSTR("sip"),0,tmp_buf);
@@ -662,6 +663,9 @@ void getSettingsJS(byte subPage, Print& settingsScript)
662663
VERSION);
663664

664665
printSetClassElementHTML(settingsScript,PSTR("sip"),0,tmp_buf);
666+
#ifndef ARDUINO_ARCH_ESP32
667+
settingsScript.print(F("toggle('rev');")); // hide revert button on ESP8266
668+
#endif
665669
}
666670

667671
if (subPage == SUBPAGE_2D) // 2D matrices

0 commit comments

Comments
 (0)