homebridge-openwrt-control 0.3.9 → 0.4.0

package/CHANGELOG.md

@@ -9,6 +9,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - After update to v0.1.0 the plugin need to be reconfigured!
 
+## [0.4.0] - (25.09.2026)
+
+### Changes
+
+- added: Home Assistant MQTT discovery (`HA Discovery` option in the MQTT section). The router appears as one device with native entities: switches for radios and SSIDs, WAN connectivity sensor, radio restart, reboot, network and Wi-Fi reload buttons, clients per SSID and total, channel and TX power per radio, WAN IP, firmware, last boot, load and memory usage
+- added: optional Wi-Fi QR code image entity per access point SSID (`HA Wi-Fi QR Code` option), contains the Wi-Fi password
+- added: MQTT and RESTful keys `Radio`, `RadioRestart` and `Ssid` with `{ "id": ..., "state": ... }`, the SSID is addressed by its UCI section
+- added: MQTT availability topic (`<prefix>/Availability`, retained `online` / `offline` last will) when HA Discovery is enabled
+- added: `iwinfo` read access in the ACL file, needed for clients, channel and TX power
+- fix: a radio or SSID command sent during a poll was dropped, commands now wait for the running poll
+- fix: the `Info` topic (MQTT and RESTful) and the wireless debug log contained the full UCI wireless config with the Wi-Fi passwords, secret options (`key`, passwords, RADIUS secrets) are now masked as `***`
+- updated dependencies
+- readme update
+
+## [0.3.10] - (24.09.2026)
+
+### Changes
+
+- added: RESTFul request rate limit, 600 requests per minute per client and at most 1000 clients per minute, answered with `429` and `Retry-After`, one log warning per client and minute.
+
 ## [0.3.9] - (23.09.2026)
 
 ### Changes

package/README.md

@@ -49,7 +49,7 @@
     * Radio `Enabled/Disabled`.
     * SSID `Enabled/Disabled`.
 * Siri, automations and schortcuts control all of available functions.
-* External integrations include: [REST](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#restful-integration) and [MQTT](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#mqtt-integration).
+* External integrations include: [REST](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#restful-integration) and [MQTT](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#mqtt-integration), with [Home Assistant discovery](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#home-assistant-discovery).
 
 ## Configuration
 
@@ -107,6 +107,8 @@
 | `mqtt.clientId` | Here optional set the `Client Id` of MQTT Broker. |
 | `mqtt.prefix` | Here set the `Prefix` for `Topic` or leave empty. |
 | `mqtt.protocolVersion` | Here select the MQTT protocol version, `5.0` (default) or `3.1.1` for brokers that only support 3.1.1 (e.g. ioBroker MQTT adapter). |
+| `mqtt.haDiscovery` | If enabled, the router is published to Home Assistant with MQTT discovery, see [Home Assistant Discovery](https://github.com/grzegorz914/homebridge-openwrt-control?tab=readme-ov-file#home-assistant-discovery). |
+| `mqtt.haWifiQr` | If enabled, a QR code to join every access point SSID is published as an image entity. The QR code contains the Wi-Fi password and is sent to the MQTT broker. |
 | `mqtt.auth{}` | MQTT authorization object. |
 | `mqtt.auth.enable` | Here enable authorization for MQTT Broker. |
 | `mqtt.auth.user` | Here set the MQTT Broker `Username`. |
@@ -141,3 +143,27 @@ Subscribe using JSON `{ "SystemReboot": true }`
 | Subscribe | `Set` | `SystemReboot` | `true` | boolean | Reboot device |
 |           | `Set` | `NetworkReload` | `true` | boolean | Network reload |
 |           | `Set` | `WirelessReload` | `true` | boolean | Wireless Reload |
+|           | `Set` | `Radio` | `{ "id": "radio0", "state": true }` | object | Radio on/off, `id` is the radio name |
+|           | `Set` | `RadioRestart` | `{ "id": "radio0" }` | object | Radio restart |
+|           | `Set` | `Ssid` | `{ "id": "wifinet2", "state": true }` | object | SSID on/off, `id` is the UCI section of the wifi-iface |
+
+### Home Assistant Discovery
+
+With `mqtt.haDiscovery` the router appears in Home Assistant as one device with native entities, no custom integration needed. Main entities:
+
+| Entity | Type | Description |
+| --- | --- | --- |
+| `WAN` | binary_sensor (connectivity) | WAN interface up, `Internet` on routers without a `wan` interface |
+| `Wi-Fi 2.4 GHz`, `Wi-Fi 5 GHz`... | switch | Radio on/off |
+| `<SSID> <band>` | switch | SSID on/off |
+| `Restart Wi-Fi <band>` | button (restart) | Radio restart |
+| `Reboot`, `Reload network`, `Reload Wi-Fi` | button | System reboot, network and wireless reload |
+| `Wi-Fi clients`, `<SSID> <band> clients` | sensor | Connected clients, total and per SSID |
+| `Channel <band>`, `TX power <band>` | sensor (diagnostic) | Current radio channel and TX power in dBm |
+| `WAN IP`, `Firmware`, `Last boot`, `Load`, `Memory usage` | sensor (diagnostic) | System information |
+| `<SSID> <band> QR code` | image | QR code to join the network, only with `mqtt.haWifiQr` |
+
+* Clients, channel and TX power need `iwinfo` on the router and the updated [ACL File](https://github.com/grzegorz914/homebridge-openwrt-control/blob/main/homebridge-acl.json), system information needs `system info`. Without them these entities are not created, the rest works.
+* Switching an SSID or a radio restarts the radio, all networks of that radio disconnect for a few seconds. Do not switch off the network Home Assistant or the MQTT broker is connected through.
+* SSID entities are identified by the UCI section of the wifi-iface, renaming the network keeps the entity. Entities of a removed SSID are removed from Home Assistant.
+* Additional retained topics: `homeassistant/<component>/openwrt_<host>_<entity>/config` (discovery), `HA State` (JSON state of all entities), `Availability` (`online` / `offline` last will), `HA QR <section>` (SVG image).

package/config.schema.json

@@ -557,6 +557,24 @@
                     "functionBody": "return model.devices[arrayIndices].mqtt.enable == true;"
                   }
                 },
+                "haDiscovery": {
+                  "title": "HA Discovery",
+                  "type": "boolean",
+                  "default": false,
+                  "description": "Publish Home Assistant MQTT discovery messages so the router appears in Home Assistant with Wi-Fi switches for radios and SSIDs, WAN status, clients, system sensors and reboot / reload buttons. For clients, channel and TX power install the updated ACL file (iwinfo).",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].mqtt.enable === true;"
+                  }
+                },
+                "haWifiQr": {
+                  "title": "HA Wi-Fi QR Code",
+                  "type": "boolean",
+                  "default": false,
+                  "description": "Publish a QR code image to join each access point SSID. The QR code contains the Wi-Fi password and is published to the MQTT broker.",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].mqtt.enable === true && model.devices[arrayIndices].mqtt.haDiscovery === true;"
+                  }
+                },
                 "auth": {
                   "title": "Authorization",
                   "type": "object",
@@ -825,6 +843,8 @@
                             "devices[].mqtt.clientId",
                             "devices[].mqtt.prefix",
                             "devices[].mqtt.protocolVersion",
+                            "devices[].mqtt.haDiscovery",
+                            "devices[].mqtt.haWifiQr",
                             {
                               "key": "devices[].mqtt.auth",
                               "title": "Authorization",

package/package.json

@@ -1,7 +1,7 @@
 {
     "displayName": "OpenWrt Control",
     "name": "homebridge-openwrt-control",
-    "version": "0.3.9",
+    "version": "0.4.0",
     "description": "Homebridge plugin to control OpenWrt flashed devices.",
     "license": "MIT",
     "author": "grzegorz914",
@@ -34,9 +34,10 @@
         "node": "^20 || ^22 || ^24 || ^25 || ^26"
     },
     "dependencies": {
-        "mqtt": "^5.15.2",
         "axios": "^1.20.0",
-        "express": "^5.2.1"
+        "express": "^5.2.1",
+        "mqtt": "^5.16.0",
+        "qrcode-generator": "^2.0.4"
     },
     "keywords": [
         "homebridge",
@@ -55,4 +56,4 @@
     "scripts": {
         "test": "echo \"Error: no test specified\" && exit 1"
     }
-}
+}

package/src/hadiscovery.js

@@ -0,0 +1,257 @@
+import { readFileSync, writeFileSync } from 'fs';
+import qrcode from 'qrcode-generator';
+
+// SSIDs are UTF-8, the library encodes single bytes by default
+qrcode.stringToBytes = (text) => [...Buffer.from(text, 'utf8')];
+
+// Home Assistant MQTT discovery, native switch / binary_sensor / sensor / button / image entities.
+// Commands go back to the existing <prefix>/Set topic as the JSON keys the plugin handles.
+const BandLabel = { '2g': '2.4 GHz', '5g': '5 GHz', '6g': '6 GHz', '60g': '60 GHz' };
+
+class HaDiscovery {
+    constructor(mqtt, config) {
+        // + and # are MQTT wildcards, Home Assistant would subscribe to a pattern instead of the device topic
+        if (/[+#]/.test(mqtt.config.prefix)) {
+            throw new Error(`MQTT prefix ${mqtt.config.prefix} must not contain + or #, rename the device or set a prefix`);
+        }
+
+        this.mqtt = mqtt;
+        this.baseId = `openwrt_${String(config.host).replace(/[^a-zA-Z0-9_-]/g, '_')}`;
+        this.stateTopic = `${mqtt.config.prefix}/HA State`;
+        this.commandTopic = `${mqtt.config.prefix}/Set`;
+        this.wifiQr = config.wifiQr === true;
+        this.device = {
+            identifiers: [this.baseId],
+            name: config.name,
+            manufacturer: config.manufacturer || 'OpenWrt',
+            ...(config.model ? { model: String(config.model) } : {}),
+            ...(config.swVersion ? { sw_version: String(config.swVersion) } : {}),
+            configuration_url: `http://${config.host}`
+        };
+        this.origin = { name: 'homebridge-openwrt-control', support_url: 'https://github.com/grzegorz914/homebridge-openwrt-control' };
+
+        // Topics published before a restart, entities that no longer exist are removed on the first sync
+        this.topicsFile = config.topicsFile;
+        this.knownTopics = new Set();
+        try {
+            for (const topic of JSON.parse(readFileSync(this.topicsFile, 'utf8'))) this.knownTopics.add(topic);
+        } catch {
+            // first start, nothing published yet
+        }
+
+        this.lastConfig = {};
+        this.lastState = '';
+        this.lastImage = {};
+        this.bootTime = null;
+
+        // Sensors stay once their data was seen, a disabled radio reports no clients or channel for a while
+        // and removing the entity would break the history and dashboards in Home Assistant
+        this.seen = new Set();
+        for (const topic of this.knownTopics) {
+            const suffix = topic.split('/').at(-2)?.slice(this.baseId.length + 1);
+            if (suffix) this.seen.add(suffix);
+        }
+    }
+
+    has(suffix, available) {
+        if (available) this.seen.add(suffix);
+        return this.seen.has(suffix);
+    }
+
+    // Publish all entities of the router, remove the ones that disappeared (SSID deleted, QR code disabled)
+    async sync(info) {
+        const { entities, images } = this.build(info);
+
+        const current = new Set();
+        for (const { component, suffix, entity } of entities) {
+            current.add(await this.publishEntity(component, suffix, entity));
+        }
+
+        for (const topic of this.knownTopics) {
+            if (current.has(topic)) continue;
+            await this.mqtt.publishRetained(topic, '');
+            delete this.lastConfig[topic];
+        }
+        for (const [topic, image] of Object.entries(images)) {
+            await this.updateImage(topic, image);
+        }
+        for (const topic of Object.keys(this.lastImage)) {
+            if (!(topic in images)) await this.updateImage(topic, null);
+        }
+
+        const changed = current.size !== this.knownTopics.size || [...current].some(topic => !this.knownTopics.has(topic));
+        this.knownTopics = current;
+        if (changed && this.topicsFile) {
+            try {
+                writeFileSync(this.topicsFile, JSON.stringify([...current], null, 2));
+            } catch {
+                // not critical, stale entities stay until removed in Home Assistant
+            }
+        }
+
+        await this.updateState(this.state(info));
+    }
+
+    // Publish (or republish when changed) one retained discovery message, returns its topic
+    async publishEntity(component, suffix, entity) {
+        const objectId = `${this.baseId}_${suffix}`;
+        const topic = `${this.mqtt.haPrefix}/${component}/${objectId}/config`;
+        const config = {
+            unique_id: objectId,
+            has_entity_name: true,
+            device: this.device,
+            origin: this.origin,
+            availability_topic: this.mqtt.availabilityTopic,
+            ...entity
+        };
+
+        const payload = JSON.stringify(config);
+        if (this.lastConfig[topic] !== payload) {
+            this.lastConfig[topic] = payload;
+            await this.mqtt.publishRetained(topic, payload);
+        }
+        return topic;
+    }
+
+    async updateState(state) {
+        const payload = JSON.stringify(state);
+        if (payload === this.lastState) return false;
+        this.lastState = payload;
+        await this.mqtt.publishRetained(this.stateTopic, payload);
+        return true;
+    }
+
+    // Retained image payload, an empty payload clears the topic
+    async updateImage(topic, image) {
+        if (this.lastImage[topic] === image) return false;
+        if (image === null) delete this.lastImage[topic];
+        else this.lastImage[topic] = image;
+        await this.mqtt.publishRetained(topic, image ?? '');
+        return true;
+    }
+
+    // ---------------------------------------------------------------- entities
+    build(info) {
+        const ext = info.extendedInfo ?? {};
+        const system = ext.system ?? {};
+        const entities = [];
+        const images = {};
+        const state = (path) => `{{ value_json${path} }}`;
+        const sensor = (suffix, entity) => entities.push({ component: 'sensor', suffix, entity: { state_topic: this.stateTopic, ...entity } });
+        const button = (suffix, payload, entity) => entities.push({ component: 'button', suffix, entity: { command_topic: this.commandTopic, payload_press: JSON.stringify(payload), ...entity } });
+        const toggle = (suffix, id, key, entity) => entities.push({
+            component: 'switch', suffix, entity: {
+                state_topic: this.stateTopic,
+                command_topic: this.commandTopic,
+                payload_on: JSON.stringify({ [key]: { id, state: true } }),
+                payload_off: JSON.stringify({ [key]: { id, state: false } }),
+                state_on: 'ON',
+                state_off: 'OFF',
+                ...entity
+            }
+        });
+
+        // Router
+        entities.push({ component: 'binary_sensor', suffix: 'wan', entity: { name: info.wan ? 'WAN' : 'Internet', device_class: 'connectivity', state_topic: this.stateTopic, value_template: `{{ 'ON' if value_json.wan else 'OFF' }}` } });
+        if (this.has('wan_ip', info.wan?.ipv4)) sensor('wan_ip', { name: 'WAN IP', icon: 'mdi:ip-network', entity_category: 'diagnostic', value_template: state('.wan_ip') });
+        if (info.systemInfo?.release?.version) sensor('firmware', { name: 'Firmware', icon: 'mdi:package-variant', entity_category: 'diagnostic', value_template: state('.firmware') });
+        if (this.has('boot', system.uptime != null)) sensor('boot', { name: 'Last boot', device_class: 'timestamp', entity_category: 'diagnostic', value_template: state('.boot') });
+        if (this.has('load', system.load != null)) sensor('load', { name: 'Load', icon: 'mdi:gauge', state_class: 'measurement', entity_category: 'diagnostic', value_template: state('.load') });
+        if (this.has('memory', system.memory != null)) sensor('memory', { name: 'Memory usage', icon: 'mdi:memory', unit_of_measurement: '%', state_class: 'measurement', entity_category: 'diagnostic', value_template: state('.memory') });
+        const clientsAvailable = this.has('clients', Object.values(ext.ifaces ?? {}).some(iface => iface.clients != null));
+        if (clientsAvailable) sensor('clients', { name: 'Wi-Fi clients', icon: 'mdi:account-multiple', state_class: 'measurement', value_template: state('.clients') });
+        button('reboot', { SystemReboot: true }, { name: 'Reboot', device_class: 'restart' });
+        button('network_reload', { NetworkReload: true }, { name: 'Reload network', icon: 'mdi:lan-pending', entity_category: 'config' });
+        button('wireless_reload', { WirelessReload: true }, { name: 'Reload Wi-Fi', icon: 'mdi:wifi-refresh', entity_category: 'config' });
+
+        // Radios
+        for (const radio of info.wirelessRadios ?? []) {
+            const id = radio.name;
+            const key = this.key(id);
+            const label = BandLabel[radio.band] ?? id;
+            const radioInfo = ext.radios?.[id] ?? {};
+            toggle(`radio_${key}`, id, 'Radio', { name: `Wi-Fi ${label}`, icon: 'mdi:wifi', value_template: `{{ 'ON' if value_json.radios['${id}'].on else 'OFF' }}` });
+            button(`radio_${key}_restart`, { RadioRestart: { id } }, { name: `Restart Wi-Fi ${label}`, device_class: 'restart', entity_category: 'config' });
+            if (this.has(`radio_${key}_channel`, radioInfo.channel != null)) sensor(`radio_${key}_channel`, { name: `Channel ${label}`, icon: 'mdi:access-point', entity_category: 'diagnostic', value_template: state(`.radios['${id}'].channel`) });
+            if (this.has(`radio_${key}_txpower`, radioInfo.txpower != null)) sensor(`radio_${key}_txpower`, { name: `TX power ${label}`, icon: 'mdi:signal', unit_of_measurement: 'dBm', state_class: 'measurement', entity_category: 'diagnostic', value_template: state(`.radios['${id}'].txpower`) });
+        }
+
+        // SSIDs, the id is the UCI section so renaming the network keeps the entity
+        const uci = info.wirelessInfo?.values ?? {};
+        for (const ssid of info.wirelessSsids ?? []) {
+            if (!ssid.section || !ssid.name) continue;
+            const id = ssid.section;
+            const key = this.key(id);
+            const label = `${ssid.name} ${BandLabel[ssid.band] ?? ssid.radio ?? ''}`.trim();
+            toggle(`ssid_${key}`, id, 'Ssid', { name: label, icon: 'mdi:wifi-lock', value_template: `{{ 'ON' if value_json.ssids['${id}'].on else 'OFF' }}` });
+            if (clientsAvailable && (ssid.mode ?? 'ap') === 'ap') sensor(`ssid_${key}_clients`, { name: `${label} clients`, icon: 'mdi:account-multiple', state_class: 'measurement', value_template: state(`.ssids['${id}'].clients`) });
+
+            // QR code to join the network, access points only, contains the password so it is opt in
+            if (this.wifiQr && (ssid.mode ?? 'ap') === 'ap') {
+                const imageTopic = `${this.mqtt.config.prefix}/HA QR ${id}`;
+                entities.push({ component: 'image', suffix: `ssid_${key}_qr`, entity: { name: `${label} QR code`, icon: 'mdi:qrcode', image_topic: imageTopic, content_type: 'image/svg+xml' } });
+                images[imageTopic] = this.wifiQrCode(ssid, uci[id] ?? {});
+            }
+        }
+
+        return { entities, images };
+    }
+
+    state(info) {
+        const ext = info.extendedInfo ?? {};
+        const system = ext.system ?? {};
+
+        // Boot time from the uptime, kept while it moves less than two minutes so the sensor does not change every poll
+        if (system.uptime != null) {
+            const boot = Date.now() - system.uptime * 1000;
+            if (this.bootTime === null || Math.abs(boot - this.bootTime) > 120_000) this.bootTime = Math.floor(boot / 60_000) * 60_000;
+        }
+
+        const radios = {};
+        for (const radio of info.wirelessRadios ?? []) {
+            const radioInfo = ext.radios?.[radio.name] ?? {};
+            radios[radio.name] = { on: !radio.disabled, channel: radioInfo.channel ?? null, txpower: radioInfo.txpower ?? null };
+        }
+
+        const ssids = {};
+        let clients = null;
+        for (const ssid of info.wirelessSsids ?? []) {
+            if (!ssid.section) continue;
+            const count = ext.ifaces?.[ssid.section]?.clients ?? null;
+            ssids[ssid.section] = { on: !ssid.disabled, clients: count };
+            if (count != null) clients = (clients ?? 0) + count;
+        }
+
+        return {
+            wan: info.wan ? info.wan.up : info.linkUp === true,
+            wan_ip: info.wan?.ipv4 ?? null,
+            firmware: info.systemInfo?.release?.version ?? null,
+            boot: system.uptime != null ? new Date(this.bootTime).toISOString() : null,
+            load: system.load ?? null,
+            memory: system.memory ?? null,
+            clients,
+            radios,
+            ssids
+        };
+    }
+
+    // WIFI:T:<type>;S:<ssid>;P:<password>;H:<hidden>;; as read by the phone cameras, as SVG
+    wifiQrCode(ssid, uci) {
+        const escape = (text) => String(text ?? '').replace(/([\\;,:"])/g, '\\$1');
+        const encryption = String(uci.encryption ?? 'none');
+        const type = encryption.startsWith('wep') ? 'WEP' : ['none', 'owe'].includes(encryption) || !uci.key ? 'nopass' : 'WPA';
+        const text = `WIFI:T:${type};S:${escape(ssid.name)};${type === 'nopass' ? '' : `P:${escape(uci.key)};`}${ssid.hidden ? 'H:true;' : ''};`;
+
+        const qr = qrcode(0, 'M');
+        qr.addData(text, 'Byte');
+        qr.make();
+        return qr.createSvgTag({ cellSize: 8, margin: 4, scalable: true });
+    }
+
+    // Object id part of a radio or UCI section name
+    key(id) {
+        return String(id).replace(/[^a-zA-Z0-9_-]/g, '_');
+    }
+}
+
+export default HaDiscovery;

package/src/mqtt.js

@@ -12,12 +12,20 @@ class Mqtt extends EventEmitter {
         const isV5 = protocolVersion === 5;
         this.isV5 = isV5;
 
+        // Home Assistant discovery, availability is reported with a retained last will
+        this.haDiscovery = config.haDiscovery === true;
+        this.haPrefix = config.haPrefix || 'homeassistant';
+        this.availabilityTopic = `${config.prefix}/Availability`;
+
         const options = {
             clientId: config.clientId,
             username: config.user,
             password: config.passwd,
             protocolVersion,
             clean: !isV5,
+            ...(this.haDiscovery ? {
+                will: { topic: this.availabilityTopic, payload: 'offline', qos: 1, retain: true }
+            } : {}),
             ...(isV5 ? {
                 properties: {
                     sessionExpiryInterval: 60 * 60,
@@ -36,6 +44,7 @@ class Mqtt extends EventEmitter {
             .on('connect', async () => {
                 hasConnected = true;
                 this.emit('connected', `MQTT v${protocolVersion} connected.`);
+                if (this.haDiscovery) this.publishRetained(this.availabilityTopic, 'online').catch(() => { });
 
                 try {
                     await new Promise((resolve, reject) => {
@@ -89,6 +98,24 @@ class Mqtt extends EventEmitter {
             });
     }
 
+    publishRetained(fullTopic, payload) {
+        return new Promise((resolve, reject) => {
+            // + and # are wildcards, the client would never complete such a publish
+            if (/[+#]/.test(fullTopic)) {
+                return reject(new Error(`Invalid topic ${fullTopic}, the name or prefix must not contain + or #`));
+            }
+
+            this.mqttClient.publish(fullTopic, payload, { qos: 1, retain: true }, (error) => {
+                if (error) {
+                    if (this.config.logWarn) this.emit('warn', `MQTT Publish error: ${error.message}`);
+                    return reject(error);
+                }
+                if (this.config.logDebug) this.emit('debug', `MQTT Publish retained Topic: ${fullTopic}, Payload: ${payload}`);
+                resolve();
+            });
+        });
+    }
+
     publish(topic, message) {
         return new Promise((resolve, reject) => {
             const fullTopic = `${this.config.prefix}/${topic}`;

package/src/openwrt.js

@@ -2,6 +2,18 @@ import EventEmitter from 'events';
 import axios from 'axios';
 import ImpulseGenerator from './impulsegenerator.js';
 
+// Wi-Fi passwords and RADIUS secrets of the UCI wireless config, masked in everything published or logged
+const SecretOption = /^key[1-4]?$|pass|secret|_pwd$|^wpa_psk/i;
+export function redactWireless(wirelessInfo) {
+    if (!wirelessInfo?.values) return wirelessInfo;
+
+    const values = {};
+    for (const [section, data] of Object.entries(wirelessInfo.values)) {
+        values[section] = Object.fromEntries(Object.entries(data ?? {}).map(([option, value]) => [option, SecretOption.test(option) ? '***' : value]));
+    }
+    return { ...wirelessInfo, values };
+}
+
 class OpenWrt extends EventEmitter {
     constructor(config) {
         super();
@@ -13,6 +25,11 @@ class OpenWrt extends EventEmitter {
 
         this.lock = false;
         this.sessionId = null;
+
+        // Home Assistant discovery needs more data (system, radio channel and power, clients), read at most every 30 s
+        this.haDiscovery = config.mqtt?.enable === true && config.mqtt?.haDiscovery === true;
+        this.extendedInfo = null;
+        this.extendedInfoAt = 0;
         this.sessionExpiresAt = 0;
 
         const baseUrl = `http://${config.host}/ubus`;
@@ -46,6 +63,28 @@ class OpenWrt extends EventEmitter {
         }
     }
 
+    // Commands wait for a running poll instead of being dropped, errors are reported like the poll errors
+    async runExclusive(fn) {
+        while (this.lock) await new Promise(resolve => setTimeout(resolve, 100));
+        this.lock = true;
+
+        try {
+            await fn();
+        } catch (error) {
+            this.emit('error', `Send error: ${error.message}`);
+        } finally {
+            this.lock = false;
+        }
+    }
+
+    // Read the state now, used after a command so Home Assistant does not wait for the next poll
+    async refresh() {
+        await this.handleWithLock(async () => {
+            this.extendedInfoAt = 0;
+            await this.connect();
+        });
+    }
+
     async login() {
         const now = Date.now();
         if (this.sessionId && now < this.sessionExpiresAt) {
@@ -85,7 +124,7 @@ class OpenWrt extends EventEmitter {
 
     async connect() {
         try {
-            const openWrtInfo = { state: false, info: '', linkUp: false, systemInfo: {}, networkInfo: {}, wirelessInfo: {}, wirelessRadios: [], wirelessSsids: [], switchPorts: [] };
+            const openWrtInfo = { state: false, info: '', linkUp: false, wan: null, systemInfo: {}, networkInfo: {}, wirelessInfo: {}, wirelessRadios: [], wirelessSsids: [], switchPorts: [], extendedInfo: null };
 
             // System info
             const systemInfo = await this.ubusCall('system', 'board');
@@ -100,9 +139,13 @@ class OpenWrt extends EventEmitter {
                 return ((Array.isArray(iface['ipv4-address']) && iface['ipv4-address'].length > 0) || (Array.isArray(iface['ipv6-address']) && iface['ipv6-address'].length > 0));
             });
 
+            // WAN interface, routers without an interface named wan (access points) have none
+            const wanIface = interfaces.find(iface => iface?.interface === 'wan');
+            const wan = wanIface ? { up: wanIface.up === true, ipv4: wanIface['ipv4-address']?.[0]?.address ?? null } : null;
+
             // Wireless info
             const wirelessInfo = await this.ubusCall('uci', 'get', { config: 'wireless' });
-            if (this.logDebug) this.emit('debug', `Wireless status data: ${JSON.stringify(wirelessInfo, null, 2)}`);
+            if (this.logDebug) this.emit('debug', `Wireless status data: ${JSON.stringify(redactWireless(wirelessInfo), null, 2)}`);
 
             // Radios list
             const radios = Object.entries(wirelessInfo?.values || {}).filter(([, data]) => data['.type'] === 'wifi-device').map(([key, data]) => {
@@ -112,6 +155,7 @@ class OpenWrt extends EventEmitter {
 
                 return {
                     name,
+                    section: data['.name'] || key,
                     band,
                     disabled
                 };
@@ -132,6 +176,7 @@ class OpenWrt extends EventEmitter {
 
                 return {
                     radio,
+                    section: data['.name'] || key,
                     band,
                     name,
                     mode,
@@ -144,11 +189,13 @@ class OpenWrt extends EventEmitter {
             openWrtInfo.state = true;
             openWrtInfo.info = 'Connect Success';
             openWrtInfo.linkUp = linkUp;
+            openWrtInfo.wan = wan;
             openWrtInfo.systemInfo = systemInfo;
             openWrtInfo.networkInfo = networkInterfaces;
             openWrtInfo.wirelessInfo = wirelessInfo;
             openWrtInfo.wirelessRadios = radios;
             openWrtInfo.wirelessSsids = ssids;
+            if (this.haDiscovery) openWrtInfo.extendedInfo = await this.getExtendedInfo();
             
             this.emit('openWrtInfo', openWrtInfo);
 
@@ -158,12 +205,65 @@ class OpenWrt extends EventEmitter {
         }
     }
 
+    // System info, radio channel and power, clients per SSID. Every call is optional, a router without iwinfo or
+    // without the ACL for it still reports the rest. Cached for 30 s, the calls per interface are not needed every poll
+    async getExtendedInfo() {
+        const now = Date.now();
+        if (this.extendedInfo && now - this.extendedInfoAt < 30_000) return this.extendedInfo;
+
+        const optional = async (service, method, params) => {
+            try {
+                return await this.ubusCall(service, method, params);
+            } catch (error) {
+                if (this.logDebug) this.emit('debug', `Optional ubus call ${service} ${method} failed: ${error.message}`);
+                return null;
+            }
+        };
+
+        const info = { system: null, radios: {}, ifaces: {} };
+
+        const system = await optional('system', 'info');
+        if (system) {
+            const memory = system.memory ?? {};
+            const available = memory.available ?? ((memory.free ?? 0) + (memory.buffered ?? 0) + (memory.cached ?? 0));
+            info.system = {
+                uptime: system.uptime ?? null,
+                load: Array.isArray(system.load) ? Math.round(system.load[0] / 65536 * 100) / 100 : null,
+                memory: memory.total ? Math.round((1 - available / memory.total) * 100) : null
+            };
+        }
+
+        // Interface names of the SSID sections, from the runtime wireless status
+        const status = await optional('network.wireless', 'status');
+        for (const [radio, radioStatus] of Object.entries(status ?? {})) {
+            const radioInfo = { up: radioStatus?.up === true, channel: null, txpower: null };
+            for (const iface of radioStatus?.interfaces ?? []) {
+                if (!iface?.section || !iface?.ifname) continue;
+                const clients = await optional('iwinfo', 'assoclist', { device: iface.ifname });
+                info.ifaces[iface.section] = { ifname: iface.ifname, clients: Array.isArray(clients?.results) ? clients.results.length : null };
+
+                // Channel and power of the radio from its first interface
+                if (radioInfo.channel === null) {
+                    const ifaceInfo = await optional('iwinfo', 'info', { device: iface.ifname });
+                    radioInfo.channel = ifaceInfo?.channel ?? null;
+                    radioInfo.txpower = ifaceInfo?.txpower ?? null;
+                }
+            }
+            info.radios[radio] = radioInfo;
+        }
+
+        if (this.logDebug) this.emit('debug', `Extended info: ${JSON.stringify(info)}`);
+        this.extendedInfo = info;
+        this.extendedInfoAt = now;
+        return info;
+    }
+
     async send(type, radioName, ssidName, newSsidName = null, state, command, restart = false) {
         switch (type) {
             case 'router':
                 break;
             case 'radio':
-                await this.handleWithLock(async () => {
+                await this.runExclusive(async () => {
                     if (this.logDebug) this.emit('debug', `${restart ? 'Restart' : state ? 'Enabling' : 'Disabling'} radio ${radioName}`);
 
                     // Toggle radio
@@ -202,7 +302,7 @@ class OpenWrt extends EventEmitter {
                 });
                 break;
             case 'ssid':
-                await this.handleWithLock(async () => {
+                await this.runExclusive(async () => {
                     if (this.logDebug) this.emit('debug', `${state ? 'Enabling' : 'Disabling'} SSID ${ssidName} on ${radioName}`);
 
                     // Get wireless config with  UCI

package/src/restful.js

@@ -23,6 +23,49 @@ class RestFul extends EventEmitter {
         try {
             const app = express();
             app.set('json spaces', 2);
+
+            // Request rate limit per client, protects Homebridge from request floods (CWE-770)
+            const rateLimitWindow = 60 * 1000;
+            const rateLimitMax = 600;
+            const rateLimitClients = 1000;
+            const clients = new Map();
+            let clientsLimitWarned = 0;
+            app.use((req, res, next) => {
+                const now = Date.now();
+
+                // Drop expired windows so the map cannot grow without limit
+                if (clients.size > 100) {
+                    for (const [ip, client] of clients) {
+                        if (now - client.start >= rateLimitWindow) clients.delete(ip);
+                    }
+                }
+
+                let client = clients.get(req.ip);
+                if (!client || now - client.start >= rateLimitWindow) {
+                    // Hard limit of tracked addresses, new addresses wait until older windows expire
+                    if (!client && clients.size >= rateLimitClients) {
+                        if (now - clientsLimitWarned >= rateLimitWindow) {
+                            clientsLimitWarned = now;
+                            if (this.logWarn) this.emit('warn', `RESTFul too many clients (${rateLimitClients}) in one minute, new clients are rejected until the window ends`);
+                        }
+                        res.set('Retry-After', String(Math.ceil(rateLimitWindow / 1000)));
+                        return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                    }
+                    client = { count: 0, start: now, warned: false };
+                    clients.set(req.ip, client);
+                }
+
+                if (++client.count > rateLimitMax) {
+                    // Warn once per client and window, a flood must not flood the log too
+                    if (!client.warned && this.logWarn) this.emit('warn', `RESTFul rate limit ${rateLimitMax} requests per minute exceeded by: ${req.ip}, further requests are rejected until the window ends`);
+                    client.warned = true;
+                    res.set('Retry-After', String(Math.ceil((client.start + rateLimitWindow - now) / 1000)));
+                    return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                }
+
+                next();
+            });
+
             app.use(json());
 
             // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"

package/src/router.js

@@ -1,6 +1,9 @@
 import EventEmitter from 'events';
+import { join } from 'path';
 import RestFul from './restful.js';
 import Mqtt from './mqtt.js';
+import HaDiscovery from './hadiscovery.js';
+import { redactWireless } from './openwrt.js';
 
 let Accessory, Characteristic, Service, Categories, AccessoryUUID;
 
@@ -8,6 +11,7 @@ class Router extends EventEmitter {
     constructor(api, config, openWrt, openWrtInfo) {
         super();
 
+        this.storagePath = join(api.user.storagePath(), 'openWrt');
         Accessory = api.platformAccessory;
         Characteristic = api.hap.Characteristic;
         Service = api.hap.Service;
@@ -176,8 +180,11 @@ class Router extends EventEmitter {
             }
 
             // External integrations
-            if (this.restFulConnected) this.restFul1.update('info', openWrtInfo);
-            if (this.mqttConnected) await this.mqtt1.publish('Info', openWrtInfo);
+            // Wi-Fi passwords are masked, the full config stays internal (QR code)
+            const publicInfo = { ...openWrtInfo, wirelessInfo: redactWireless(openWrtInfo.wirelessInfo) };
+            if (this.restFulConnected) this.restFul1.update('info', publicInfo);
+            if (this.mqttConnected) await this.mqtt1.publish('Info', publicInfo);
+            await this.haSync();
         });
     }
 
@@ -210,12 +217,14 @@ class Router extends EventEmitter {
                 protocolVersion: this.mqtt.protocolVersion,
                 user: this.mqtt.auth?.user,
                 passwd: this.mqtt.auth?.passwd,
+                haDiscovery: this.mqtt.haDiscovery,
                 logWarn: this.logWarn,
                 logDebug: this.logDebug
             })
                 .on('connected', msg => {
                     this.mqttConnected = true;
                     this.emit('success', msg);
+                    this.haSync();
                 })
                 .on('set', async (key, value) => {
                     await this.setOverExternalIntegration('MQTT', key, value);
@@ -228,10 +237,66 @@ class Router extends EventEmitter {
         return true;
     }
 
+    // Home Assistant discovery, published on connect and refreshed with every poll
+    async haSync() {
+        if (!this.mqttConnected || !this.mqtt.haDiscovery) return;
+
+        try {
+            this.ha ??= new HaDiscovery(this.mqtt1, {
+                host: this.host,
+                name: this.name,
+                manufacturer: this.openWrtInfo.systemInfo.release?.distribution,
+                model: this.openWrtInfo.systemInfo.model,
+                swVersion: this.openWrtInfo.systemInfo.release?.version,
+                wifiQr: this.mqtt.haWifiQr,
+                topicsFile: join(this.storagePath, `${this.host.replace(/[^a-zA-Z0-9_-]/g, '_')}_haDiscovery.json`)
+            });
+
+            // Polls overlap with a slow broker, only one sync at a time
+            if (this.haSyncRunning) return;
+            this.haSyncRunning = true;
+            await this.ha.sync(this.openWrtInfo);
+        } catch (error) {
+            if (this.logWarn) this.emit('warn', `HA Discovery error: ${error.message ?? error}`);
+        } finally {
+            this.haSyncRunning = false;
+        }
+    }
+
+    // Radio or SSID command from Home Assistant: {"id": "<radio or UCI section>", "state": true}
+    async setWireless(integration, type, value) {
+        const id = value?.id;
+        switch (type) {
+            case 'Radio':
+            case 'RadioRestart': {
+                const radio = this.openWrtInfo.wirelessRadios.find(r => r.name === id);
+                if (!radio) break;
+                const restart = type === 'RadioRestart';
+                await this.openWrt.send('radio', radio.name, null, null, value.state === true, null, restart); //{type, radioName, ssidName, newSsidName, state, command, restart}
+                await this.openWrt.refresh();
+                return true;
+            }
+            case 'Ssid': {
+                const ssid = this.openWrtInfo.wirelessSsids.find(s => s.section === id);
+                if (!ssid) break;
+                await this.openWrt.send('ssid', ssid.radio, ssid.name, null, value.state === true, null, false); //{type, radioName, ssidName, newSsidName, state, command, restart}
+                await this.openWrt.refresh();
+                return true;
+            }
+        }
+
+        this.emit('warn', `${integration} ${type} ${id} not found`);
+        return false;
+    }
+
     async setOverExternalIntegration(integration, key, value) {
         if (!value) return false;
 
         switch (key) {
+            case 'Radio':
+            case 'RadioRestart':
+            case 'Ssid':
+                return this.setWireless(integration, key, value);
             case 'SystemReboot':
                 return this.openWrt.send('externalIntegration', null, null, null, null, 0);
             case 'NetworkReload':