Skip to content

v2.0.40 — Firmware-rule writes fixed + Clear-Rules tool + security hardening

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Jul 17:36
v2.0.40
c1b993f

⚠️ Critical fix: firmware-rule writes never persisted (Homebridge Device Rules tab)

Field debugging on a live 30-device network uncovered that every firmware-rule write through the Homebridge plugin's SOAP client was a silent no-op — the device ACKed each StoreRules upload and then discarded it. The Homebridge UI's Device Rules tab (toggle / delete / create) has never actually changed anything on a device. Three compounding bugs, now fixed in homebridge-dibby-wemo@2.0.40:

  1. Missing <processDb>1</processDb> — the client sent <StartSync>NOSYNC</StartSync> where the firmware requires processDb=1 to apply an uploaded DB. Proof: the on-device ruleDbVersion never advanced across "successful" writes; with the fix it advances and rules genuinely change.
  2. Wrong success detection — success was inferred from the absence of the word "failed"; the firmware signals success via an <errorInfo> field containing successful. Rejections were invisible.
  3. Schema-stripping rebuild — mutators rebuilt a 3-table SQLite DB from scratch; the firmware's DB has ~10 tables and ignores uploads missing its schema. All mutators now modify the device's own fetched DB in place, echoing back its original zip entry name.

Verified live: 300 firmware rules wiped across 16 devices, every wipe read-back-confirmed, DWM rules untouched.

New: Windows add-on tool — Clear Wemo Firmware Rules

Ships in the NSIS Windows installer: Start menu → Dibby Wemo Manager → Clear Wemo Firmware Rules. Wipes every native firmware rule across all Dibby-discovered devices in one confirmed pass — the dead rules left in each Wemo's on-device database since Belkin shut down their cloud. DWM rules are never touched.

  • Explicit yes confirmation; cancel-safe
  • Single StoreRules round-trip per device (no per-rule reboot storm), read-back verified
  • Bounded concurrency (default 6, DWM_CLEAR_CONCURRENCY to override), 30 s SOAP timeout, one auto-retry on connection errors
  • Devices on firmware without FetchRules (Dimmer V2 / newer Lightswitch-3_0) are skipped with a clear note
  • Clear per-device output + final summary

Security hardening

  • Code-signing password removed from the repo. The build reads WIN_CSC_KEY_PASSWORD from the environment; the plaintext value no longer lives in package.json.
  • Docker / Synology web server (docker/server.js):
    • Optional DWM_API_KEY — when set, all state-changing requests (POST/PUT/DELETE) require it via X-Api-Key or Authorization: Bearer, compared with crypto.timingSafeEqual. GETs and healthchecks stay open. The bundled web UI sends the key automatically once stored via localStorage.setItem('dwm.apiKey', …).
    • Bounded request bodies (DWM_MAX_BODY, default 1 MiB → 413 over limit)
    • Configurable CORS (DWM_CORS_ORIGIN), X-Content-Type-Options: nosniff, JSON 404 for unknown /api/* routes

Data integrity — atomic stores everywhere

The desktop app store and the Home Assistant store now carry the same protections proven in the Homebridge store: distinguish missing-file from corrupt/unreadable (never overwrite what couldn't be read), atomic tmp+rename writes, rolling .bak with corrupt-file quarantine and recovery, and an empty-write guard that refuses to flatten non-empty data.

The Homebridge scheduler heartbeat moved out of the main store into a tiny .heartbeat sidecar — the main dibby-wemo.json is no longer rewritten once per second (SD-card wear on Pi hosts, and the concurrent-write race surface behind the historical rules-wipe bug).

Carried forward

  • v2.0.39's bounded Schedule-rule enforcement (5-minute window, then human override wins)
  • v2.0.37's location search fix, v2.0.36's store data-loss protections, v2.0.35's Synology Docker root-fallback

Upgrade

  • Homebridge (important): npm install -g homebridge-dibby-wemo@2.0.40 → restart Homebridge. Device Rules tab edits now actually persist to devices.
  • Windows desktop: download Dibby Wemo Manager Setup 2.0.40.exe from this release's Assets → the new Start-menu tool appears after install.
  • Synology Container Manager / Docker: Stop → Build → Start (:latest → 2.0.40). New optional env knobs: DWM_API_KEY, DWM_CORS_ORIGIN, DWM_MAX_BODY.
  • Synology .spk: download the new .spk for your arch → Package Center → Manual Install.
  • Node-RED: npm install -g node-red-contrib-dibby-wemo@2.0.40.
  • HACS: ⋮ → Reload data → Dibby Wemo → ⋮ → Redownload → 2.0.40 → restart HA (store hardening included).
Assets 11
Loading