sascha/esphome
1
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2025-09-29 00:22:21 +01:00
Code Issues Releases Wiki Activity

stack it

Browse Source
This commit is contained in:
J. Nick Koston
2025-09-26 23:40:50 -05:00
parent 6430ae80cf
commit e5868a79a2
2 changed files with 48 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
esphome/components/esphome/ota/ota_esphome.cpp
View File

@@ -575,43 +575,58 @@ void ESPHomeOTAComponent::yield_and_feed_watchdog_() {
#ifdef USE_OTA_PASSWORD #ifdef USE_OTA_PASSWORD
void ESPHomeOTAComponent::log_auth_warning_(const LogString *msg) { ESP_LOGW(TAG, "Auth: %s", LOG_STR_ARG(msg)); } void ESPHomeOTAComponent::log_auth_warning_(const LogString *msg) { ESP_LOGW(TAG, "Auth: %s", LOG_STR_ARG(msg)); }
bool ESPHomeOTAComponent::select_auth_type_() {
#ifdef USE_OTA_SHA256
bool client_supports_sha256 = (this->ota_features_ & FEATURE_SUPPORTS_SHA256_AUTH) != 0;
#ifdef ALLOW_OTA_DOWNGRADE_MD5
// Allow fallback to MD5 if client doesn't support SHA256
if (client_supports_sha256) {
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_SHA256_AUTH;
return true;
}
#ifdef USE_OTA_MD5
this->log_auth_warning_(LOG_STR("Using MD5 for compatibility (deprecated)"));
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_AUTH;
return true;
#else
this->log_auth_warning_(LOG_STR("Client doesn't support SHA256 and MD5 is disabled"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false;
#endif // USE_OTA_MD5
#else // !ALLOW_OTA_DOWNGRADE_MD5
// Require SHA256
if (!client_supports_sha256) {
this->log_auth_warning_(LOG_STR("Client requires SHA256"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false;
}
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_SHA256_AUTH;
return true;
#endif // ALLOW_OTA_DOWNGRADE_MD5
#else // !USE_OTA_SHA256
#ifdef USE_OTA_MD5
// Only MD5 available
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_AUTH;
return true;
#else
// No auth methods available
this->log_auth_warning_(LOG_STR("No auth methods available"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false;
#endif // USE_OTA_MD5
#endif // USE_OTA_SHA256
}
bool ESPHomeOTAComponent::handle_auth_send_() { bool ESPHomeOTAComponent::handle_auth_send_() {
// Initialize auth buffer if not already done // Initialize auth buffer if not already done
if (!this->auth_buf_) { if (!this->auth_buf_) {
// Determine which auth type to use // Select auth type based on client capabilities and configuration
#ifdef USE_OTA_SHA256 if (!this->select_auth_type_()) {
bool client_supports_sha256 = (this->ota_features_ & FEATURE_SUPPORTS_SHA256_AUTH) != 0;
#ifdef ALLOW_OTA_DOWNGRADE_MD5
if (client_supports_sha256) {
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_SHA256_AUTH;
} else {
#ifdef USE_OTA_MD5
this->log_auth_warning_(LOG_STR("Using MD5 for compatibility (deprecated)"));
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_AUTH;
#else
this->log_auth_warning_(LOG_STR("Client doesn't support SHA256 and MD5 is disabled"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false;
#endif // USE_OTA_MD5
}
#else // !ALLOW_OTA_DOWNGRADE_MD5
if (!client_supports_sha256) {
this->log_auth_warning_(LOG_STR("Client requires SHA256"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false; return false;
} }
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_SHA256_AUTH;
#endif // ALLOW_OTA_DOWNGRADE_MD5
#else // !USE_OTA_SHA256
#ifdef USE_OTA_MD5
this->auth_type_ = ota::OTA_RESPONSE_REQUEST_AUTH;
#else
this->log_auth_warning_(LOG_STR("No auth methods available"));
this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_AUTH_INVALID);
return false;
#endif // USE_OTA_MD5
#endif // USE_OTA_SHA256
// Generate nonce with appropriate hasher // Generate nonce with appropriate hasher
bool success = false; bool success = false;

1
esphome/components/esphome/ota/ota_esphome.h
View File

@@ -46,6 +46,7 @@ class ESPHomeOTAComponent : public ota::OTAComponent {
#ifdef USE_OTA_PASSWORD #ifdef USE_OTA_PASSWORD
bool handle_auth_send_(); bool handle_auth_send_();
bool handle_auth_read_(); bool handle_auth_read_();
bool select_auth_type_();
bool prepare_auth_nonce_(HashBase *hasher); bool prepare_auth_nonce_(HashBase *hasher);
bool verify_hash_auth_(HashBase *hasher, size_t hex_size); bool verify_hash_auth_(HashBase *hasher, size_t hex_size);
size_t get_auth_hex_size_() const; size_t get_auth_hex_size_() const;