mirror of
https://github.com/tzapu/WiFiManager.git
synced 2026-04-27 00:55:52 +03:00
[GH-ISSUE #1380] Insecure onDemandAP #1183
Labels
No labels
📶 WiFi
🕸️ HTTP
Branch
DEV Help Wanted
Discussion
Documentation
ESP32
Example
Good First Issue
Hotfix
In Progress
Incomplete
Needs Feeback
Priority
QA
Question
Task
Upstream/Dependancy
bug
duplicate
enhancement
invalid
pull-request
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/WiFiManager#1183
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Desat on GitHub (Mar 28, 2022).
Original GitHub issue: https://github.com/tzapu/WiFiManager/issues/1380
First of all: My English is not that good but I'm trying my best.
Basic Infos
Hardware
WiFimanager Branch/Release: Master or 2.0.10-beta
Esp8266/Esp32: ESP32
Hardware: ESP-Wroom-32
Core Version: Espressif 1.0.6
Description
Problem description
Settings in IDE
Module: AZ-Delivery ESP32 Dev Board
Additional libraries: none
Sketch
A slightly modified advanced example version.
#include <WiFiManager.h> // https://github.com/tzapu/WiFiManager
#define TRIGGER_PIN 0
bool wm_nonblocking = true; // change to true to use non blocking
WiFiManager wm; // global wm instance
void setup() {
WiFi.mode(WIFI_STA); // explicitly set mode, esp defaults to STA+AP
Serial.begin(115200);
while(!Serial);
Serial.setDebugOutput(true);
Serial.println("\n Starting");
pinMode(TRIGGER_PIN, INPUT);
// wm.resetSettings(); // wipe settings
if(wm_nonblocking) wm.setConfigPortalBlocking(false);
const char* menu[] = {"wifi","info","param","sep","close","exit","restart","erase"};
wm.setMenu(menu,8);
wm.setClass("invert");
wm.setConfigPortalTimeout(60); // auto close configportal after n seconds
wm.setCaptivePortalEnable(true); // disable captive portal redirection
wm.setAPClientCheck(true); // avoid timeout if client connected to softap
wm.setShowInfoErase(true); // do not show erase button on info page
wm.setScanDispPerc(true); // show RSSI as percentage not graph icons
bool res;
res = wm.autoConnect("AutoConnectAP","password"); // password protected ap
if(!res) {
Serial.println("Failed to connect or hit timeout");
}
else {
Serial.println("connected...yeey :)");
}
}
void checkButton(){
if ( digitalRead(TRIGGER_PIN) == LOW ) {
delay(500);
if( digitalRead(TRIGGER_PIN) == LOW ){
Serial.println("Button Pressed");
delay(3000); // reset delay hold
if( digitalRead(TRIGGER_PIN) == LOW ){
Serial.println("Button Held");
Serial.println("Erasing Config, restarting");
wm.resetSettings();
ESP.restart();
}
}
}
void loop() {
if(wm_nonblocking) wm.process(); // avoid delays() in loop when non-blocking and other long running code
checkButton();
}
#END
When I start the "onDemandAP" for the first time after storing the WiFi credentials, it is started with a password query.
If I now let the time-out elapse or log in with a password and then also log off with "Exit", an insecure access without a password query is started when "onDemandAP" is activated again.
Restarting the dev board or leaving it without power does not change the situation, which from the second "onDemandAP" I only create an insecure access.
Do you have an idea or are you not aware of the error yet?
If you need more information about my system, I'll be happy to answer it.
First of all, I just set up my system again a few days ago with the new Arduino IDE and also Visual Studio Code with PlatformIO.
But I also have to say thank you because I finally found a WiFi manager that also saves the credentials.
Two years ago I gave up because I hadn't found anything useful.
Only the " captive portal redirection" on the PC (Opera) is unfortunately not the IP of the AP but the MSN start page.
However , it works perfectly on the mobile phone .
@tablatronix commented on GitHub (Mar 29, 2022):
WiFi.mode(WiFi_STA); in setup
esp auto starts in ap mode on its own
@Desat commented on GitHub (Mar 29, 2022):
Yes, that's correct, but that's not the problem.
The problem is that if the ESP has no network credentials stored, the ESP starts the "AutoConnectAP" with a secure connection.
Here I now enter my network credentials and it starts as expected in station mode.
If I now request an "onDemandAP" it will also be started as a secure connection with the specified network credentials, in addition to the "station mode".
Up to here everything is as expected.
But if the login timeout expires or I log in "with a password" and then log out via "exit", it still behaves as expected.
However, from now on every further requested "onDemandAP" (even after a reboot of the ESP) will be established with an insecure connection although a secure connection should actually be established.
I, and theoretically anyone who is not authorized to do so, can connect to the ESP "without a password".
Either the ESP is not able to create a secure access again, even after a reboot, or the library has taken the wrong path somewhere.
I hope I was able to explain the problem clearly with my "Google" translated English.
@tablatronix commented on GitHub (Mar 29, 2022):
Are you sure your device is not just saving the password and resusing it again? Like osx does
wm.startConfigPortal("OnDemandAP","12345678")
should always be wpa2
@tablatronix commented on GitHub (Mar 29, 2022):
can you show screenshots or a video, I do not understand exactly
@Desat commented on GitHub (Mar 29, 2022):
Yes i am sure. :) my devices show the wifi icon without the small lock icon. also i remove the known ESP AP networks before testing.
At the first onDemandAP it is WPA2 but all following onDemandAP are without security. i can make a screenshot from the network scan on my mobile phone where you can see that the wifi icon has no lock icon. But i see you have the same problem. the first onDemandAP is secure btw ;) Do you still need the screenshots?
@tablatronix commented on GitHub (Mar 29, 2022):
I do not reproduce, that was a mistake, I forgot I was starting that one anonymous in my test.
When you say the following? What do you mean?
Like if I press a button and do wm.startConfigPortal("OnDemandAP","12345678")
everytime I press it its the same..
Have you done a full erase? Have you made sure you are setting wifi mode to sta only in your code?
@Desat commented on GitHub (Mar 29, 2022):
its the original WiFiManager-2.0.10-beta library with the original example "Advanced". but i see now the "AutoConnectAP" makes an insecure wifi network. i hope i have another unused ESP32 board at home. My test outside the WiFiManager works fine with "onDemandAP". on off on off all times no problem.
@tablatronix commented on GitHub (Mar 29, 2022):
hmm
advanced.ino
res = wm.autoConnect("AutoConnectAP","password"); // password protected ap
@Desat commented on GitHub (Mar 29, 2022):
I know, but I have no idea how to erase all potentially corrupted data from the ESP. You can hardly find reasonable Wifi managers or explanations in my language and the English help has rarely been successful in realizing my actual project.
Unfortunately, I can no longer use the WiFi manager for myself, which does not necessarily have to be due to the library. I would search the library myself for the error, but unfortunately my knowledge is too weak and the library too "powerful". But otherwise a very strong tool if the hardware plays along. Thumbs up for all the work that went into it. But I'll leave it at that and don't want to keep other important projects from happening. Keep it up and maybe I'll try it again with different hardware.
@tablatronix commented on GitHub (Mar 29, 2022):
Ok I might be seeing the same issue, let me keep testing.
@tablatronix commented on GitHub (Mar 29, 2022):
This seems to be something in the ESP lib, and unknown bug, maybe corrupt memory, I will keep testing for a workaround.
I tried another esp and its fine, so its a strange issue.
@Desat commented on GitHub (Mar 29, 2022):
i have tested several times with the following code:
The code snippets were taken from "Wifi-Manager Library".
The "onDemandAP" build alway a secure wifi connection.
I think an error in the ESP32 Lib could be ruled out with this.
But my knowledge of the ESP32 is at lower level.
@tablatronix commented on GitHub (Mar 29, 2022):
you will want to be checking the return of WiFi.softAP()
should be boolean true on success or false,
same for softAPdisconnect
@Desat commented on GitHub (Mar 29, 2022):
yes of cours but i check it with network scan on my mobile phone. The softAPdisconnect return value is every time false.
if have now added the Wifi.getMode() before and after the softAPdisconnect. Before the value is 3 (WIFI_MODE_APSTA) after the value is 1 (WIFI_MODE_STA) . everything as expected.
You could actually use it as feedback for "startConfigPortal", right? As far as I've read and I remember correctly, the return value there is always false, I think.
@tablatronix commented on GitHub (Mar 30, 2022):
Yeah softapdisconnect fails alot not sure why
@tablatronix commented on GitHub (Mar 30, 2022):
still debugging, are you calling resetsettings at all? It seems to be hit or miss here, let me try your code
@Desat commented on GitHub (Mar 30, 2022):
Did you mean "erase" in config portal?
If so, yes several times.
Which kind of code? My last code that i posted yesterday? But with the return value from "softApdisconnect" and the AP start command?
@tablatronix commented on GitHub (Mar 30, 2022):
I am just trying to find what can cause this, I can reproduce very rarely in my own code, and never in your example.
I am on 1.0.6 also
Ill keep testing
@Desat commented on GitHub (Mar 30, 2022):
I have now installed the ESP32 Core Version 2.0.2. There, the "onDemandAP" seems to always work securely now (tested 4 times first). The error message "[ERROR] disconnect configportal - softAPdisconnect FAILED" when exiting the softAP has also disappeared.
just the part
if (!wm.startConfigPortal("OnDemandAP","password")) {
Serial.println("failed to connect or hit timeout");
still seems to just return False. But it can also be because of "bool wm_nonblocking = true; ".
I will continue to test the secure access point.
Maybe it's because of this highlighted original ESP32 library code
Extract Core1.0.6 WiFiAP.cpp Line 196
`
bool WiFiAPClass::softAPdisconnect(bool wifioff)
{
bool ret;
wifi_config_tconf;
**
*conf.ap.ssid = 0;
*conf.ap.password = 0;
conf.ap.authmode = WIFI_AUTH_OPEN; // auth must be open if pass=0
ret = esp_wifi_set_config(WIFI_IF_AP, &conf) == ESP_OK;
**
}
`
Extract Core 2.0.2 WiFi.cpp Line 213
`
bool WiFiAPClass::softAPdisconnect(bool wifioff)
{
bool ret;
wifi_config_tconf;
wifi_softap_config(&conf);
} `
@tablatronix commented on GitHub (Mar 30, 2022):
That is where I have been debugging, I think the issue is in the sdk inside esp_wifi_set_config, because everything passes.
If i had to guess Its a race condition, with enableap/setconfig , I would bet adding a delay somewhere would fix this..
Also theres this..
authmode appears to be blank in config, So I am not about to debug dumping the flash memory to test this more especially if its fixed in 2.0
@Desat commented on GitHub (Mar 30, 2022):
in the core 2.0.2 of the esp32 the problem doesn't exist anymore, so it's ok for me.
Of course there could be another error in Core 2.0.2, namely that the station mode logs off after about 7 minutes because of "Reason: 2 - AUTH_EXPIRE" but that wasn't the real problem and I think everyone can live with that .
The auto mode also has a small problem when connecting, but by and large at least the security of the "onDemandAP" works with the core 2.0.2.
But since my knowledge is not yet big enough to confirm that, it's just a guess on my part ;)
@tablatronix commented on GitHub (Mar 30, 2022):
Yeah I will note this to espressif only because its a major issue, so ill log all my info and bin and report it.
I have not heard of the auth expire, only the reboot auth fail/expire issue
@tablatronix commented on GitHub (Mar 30, 2022):
https://github.com/espressif/arduino-esp32/issues/5038
@Desat commented on GitHub (Mar 30, 2022):
this is also new in core 2.0.2
every second boot of the esp32 in unable to connect in station mode (see timestamp 20:16:50.605)
@tablatronix commented on GitHub (Mar 30, 2022):
I linked an issue above for this that suggests it is the lack of authmode comparison in the equals assertion check that causes startap to return true even if auth setting failed.
@tablatronix commented on GitHub (Mar 30, 2022):
also this issue is known and fixes are in the works for it in the ESP sdk and in lib
I added a fix to wm to workaround it also
#1067
_aggresiveReconn@Desat commented on GitHub (Mar 30, 2022):
It's funny, actually I just wanted to have a simple way of entering the WiFi credentials via a Nextion display and the ESP32 then using them for the next restart. Haven't had any success so far, because the credentials are only accepted as "const" and my programming skills are really on the lower level. Let alone understand the "persistent" feature.
@tablatronix commented on GitHub (Mar 30, 2022):
ah, you might want to try making a const char* in your sketch, and memcpy them from the inputs, not sure how you are getting them in , as strings? etc. but you will probably have to do a copy to make sure the memory is safe when you pass it to the begin()
or if you want to just use WM then you can use
@Desat commented on GitHub (Mar 30, 2022):
Actually, I would like to use as few libraries as possible because my project is a "digital analogue clock" with addressable LEDs and the memory on the ESP is also limited. In addition to the clock function, temperature, humidity and air pressure should also be shown on the display. The WiFi access was originally only intended to be used for time synchronization, but I'm thinking about an OTA update function. Furthermore, a calendar function with public holidays, sunrise and sunset and moon phases was planned for the display. In addition, a spectrum analyzer as a "decoration effect" and a brightness sensor to adjust the luminosity of the LEDs depending on the interior brightness.
Yes, it's "just" a small project for someone whose programming skills are on the lower level / simplest basics.
Oh I forgot the gyroscope :oD