homebridge-openwrt-control 0.3.8 → 0.3.10

package/CHANGELOG.md

@@ -9,6 +9,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - After update to v0.1.0 the plugin need to be reconfigured!
 
+## [0.3.10] - (24.09.2026)
+
+### Changes
+
+- added: RESTFul request rate limit, 600 requests per minute per client and at most 1000 clients per minute, answered with `429` and `Retry-After`, one log warning per client and minute.
+
+## [0.3.9] - (23.09.2026)
+
+### Changes
+
+- fix: MQTT client had `protocolVersion: 5` hardcoded, so brokers that only support MQTT 3.1.1 (e.g. the ioBroker MQTT adapter) accepted the TCP connection, failed the handshake, and got disconnected every second forever, with nothing published and no error logged. Added a `Protocol Version` option (5.0 / 3.1.1) in the MQTT section, and a one-time warning if no successful connection is established within 30 seconds
+- readme update
+- sample config update
+
 ## [0.3.8] - (23.09.2026)
 
 ### Added
@@ -16,6 +30,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
 - readme update
 
+## [0.3.7] - (13.09.2026)
+
+### Changes
+
+- bump dependencies
+
 ## [0.3.6] - (11.05.2026)
 
 ## Changes

package/README.md

@@ -106,6 +106,7 @@
 | `mqtt.port` | Here set the `Port` for MQTT Broker, default 1883. |
 | `mqtt.clientId` | Here optional set the `Client Id` of MQTT Broker. |
 | `mqtt.prefix` | Here set the `Prefix` for `Topic` or leave empty. |
+| `mqtt.protocolVersion` | Here select the MQTT protocol version, `5.0` (default) or `3.1.1` for brokers that only support 3.1.1 (e.g. ioBroker MQTT adapter). |
 | `mqtt.auth{}` | MQTT authorization object. |
 | `mqtt.auth.enable` | Here enable authorization for MQTT Broker. |
 | `mqtt.auth.user` | Here set the MQTT Broker `Username`. |

package/config.schema.json

@@ -538,6 +538,25 @@
                     "functionBody": "return model.devices[arrayIndices].mqtt.enable == true;"
                   }
                 },
+                "protocolVersion": {
+                  "title": "Protocol Version",
+                  "type": "integer",
+                  "default": 5,
+                  "oneOf": [
+                    {
+                      "title": "5.0",
+                      "enum": [5]
+                    },
+                    {
+                      "title": "3.1.1",
+                      "enum": [4]
+                    }
+                  ],
+                  "description": "MQTT protocol version used to connect to the broker. Some brokers (e.g. the ioBroker MQTT adapter) only support 3.1.1 and will silently reject 5.0 connections.",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].mqtt.enable == true;"
+                  }
+                },
                 "auth": {
                   "title": "Authorization",
                   "type": "object",
@@ -805,6 +824,7 @@
                             "devices[].mqtt.port",
                             "devices[].mqtt.clientId",
                             "devices[].mqtt.prefix",
+                            "devices[].mqtt.protocolVersion",
                             {
                               "key": "devices[].mqtt.auth",
                               "title": "Authorization",

package/package.json

@@ -1,7 +1,7 @@
 {
     "displayName": "OpenWrt Control",
     "name": "homebridge-openwrt-control",
-    "version": "0.3.8",
+    "version": "0.3.10",
     "description": "Homebridge plugin to control OpenWrt flashed devices.",
     "license": "MIT",
     "author": "grzegorz914",

package/src/mqtt.js

@@ -8,35 +8,47 @@ class Mqtt extends EventEmitter {
 
         const url = `mqtt://${config.host}:${config.port}`;
         const subscribeTopic = `${config.prefix}/Set`;
+        const protocolVersion = config.protocolVersion === 4 ? 4 : 5;
+        const isV5 = protocolVersion === 5;
+        this.isV5 = isV5;
 
         const options = {
             clientId: config.clientId,
             username: config.user,
             password: config.passwd,
-            protocolVersion: 5,
-            clean: false,
-            properties: {
-                sessionExpiryInterval: 60 * 60,
-                userProperties: {
-                    source: 'node-client'
+            protocolVersion,
+            clean: !isV5,
+            ...(isV5 ? {
+                properties: {
+                    sessionExpiryInterval: 60 * 60,
+                    userProperties: {
+                        source: 'node-client'
+                    }
                 }
-            }
+            } : {})
         };
 
+        const startTime = Date.now();
+        let hasConnected = false;
+        let warnedStalled = false;
+
         this.mqttClient = connect(url, options)
             .on('connect', async () => {
-                this.emit('connected', 'MQTT v5 connected.');
+                hasConnected = true;
+                this.emit('connected', `MQTT v${protocolVersion} connected.`);
 
                 try {
                     await new Promise((resolve, reject) => {
                         this.mqttClient.subscribe(subscribeTopic,
                             {
                                 qos: 1,
-                                properties: {
-                                    userProperties: {
-                                        type: 'subscription'
+                                ...(isV5 ? {
+                                    properties: {
+                                        userProperties: {
+                                            type: 'subscription'
+                                        }
                                     }
-                                }
+                                } : {})
                             },
                             (error) => {
                                 if (error) return reject(error);
@@ -69,6 +81,10 @@ class Mqtt extends EventEmitter {
                 if (config.logDebug) this.emit('debug', 'MQTT Reconnecting...');
             })
             .on('close', () => {
+                if (!hasConnected && !warnedStalled && Date.now() - startTime > 30000) {
+                    warnedStalled = true;
+                    this.emit('warn', `MQTT has not connected after 30s of retries using protocol v${protocolVersion}. Check broker address, credentials, and whether the broker supports this MQTT protocol version.`);
+                }
                 if (config.logDebug) this.emit('debug', 'MQTT Connection closed.');
             });
     }
@@ -81,13 +97,15 @@ class Mqtt extends EventEmitter {
             this.mqttClient.publish(fullTopic, publishMessage,
                 {
                     qos: 1,
-                    properties: {
-                        contentType: 'application/json',
-                        userProperties: {
-                            source: 'node',
-                            action: 'set'
+                    ...(this.isV5 ? {
+                        properties: {
+                            contentType: 'application/json',
+                            userProperties: {
+                                source: 'node',
+                                action: 'set'
+                            }
                         }
-                    }
+                    } : {})
                 },
                 (error) => {
                     if (error) {

package/src/restful.js

@@ -23,6 +23,49 @@ class RestFul extends EventEmitter {
         try {
             const app = express();
             app.set('json spaces', 2);
+
+            // Request rate limit per client, protects Homebridge from request floods (CWE-770)
+            const rateLimitWindow = 60 * 1000;
+            const rateLimitMax = 600;
+            const rateLimitClients = 1000;
+            const clients = new Map();
+            let clientsLimitWarned = 0;
+            app.use((req, res, next) => {
+                const now = Date.now();
+
+                // Drop expired windows so the map cannot grow without limit
+                if (clients.size > 100) {
+                    for (const [ip, client] of clients) {
+                        if (now - client.start >= rateLimitWindow) clients.delete(ip);
+                    }
+                }
+
+                let client = clients.get(req.ip);
+                if (!client || now - client.start >= rateLimitWindow) {
+                    // Hard limit of tracked addresses, new addresses wait until older windows expire
+                    if (!client && clients.size >= rateLimitClients) {
+                        if (now - clientsLimitWarned >= rateLimitWindow) {
+                            clientsLimitWarned = now;
+                            if (this.logWarn) this.emit('warn', `RESTFul too many clients (${rateLimitClients}) in one minute, new clients are rejected until the window ends`);
+                        }
+                        res.set('Retry-After', String(Math.ceil(rateLimitWindow / 1000)));
+                        return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                    }
+                    client = { count: 0, start: now, warned: false };
+                    clients.set(req.ip, client);
+                }
+
+                if (++client.count > rateLimitMax) {
+                    // Warn once per client and window, a flood must not flood the log too
+                    if (!client.warned && this.logWarn) this.emit('warn', `RESTFul rate limit ${rateLimitMax} requests per minute exceeded by: ${req.ip}, further requests are rejected until the window ends`);
+                    client.warned = true;
+                    res.set('Retry-After', String(Math.ceil((client.start + rateLimitWindow - now) / 1000)));
+                    return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                }
+
+                next();
+            });
+
             app.use(json());
 
             // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"

package/src/router.js

@@ -207,6 +207,7 @@ class Router extends EventEmitter {
                 port: this.mqtt.port || 1883,
                 clientId: `${this.name}_${Math.random().toString(16).slice(3)}`,
                 prefix: this.mqtt.prefix ? `${this.openWrtInfo.systemInfo.model}/${this.mqtt.prefix}/${this.name}` : `${this.openWrtInfo.systemInfo.model}/${this.name}`,
+                protocolVersion: this.mqtt.protocolVersion,
                 user: this.mqtt.auth?.user,
                 passwd: this.mqtt.auth?.passwd,
                 logWarn: this.logWarn,