mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-05-03 22:03:00 +00:00
* fix(wifi): create truly open AP via nmcli connection add; add captive portal to nmcli path nmcli device wifi hotspot always attaches a WPA2 PSK on Bookworm/Trixie and silently ignores post-creation security modifications, causing users to be prompted for an unknown password. Switch to nmcli connection add with 802-11-wireless.mode ap and no security section — NM cannot auto-add a password to a profile that has no 802-11-wireless-security block. Also: - Remove dead DEFAULT_AP_PASSWORD / ap_password config field (stored but never passed to hostapd or nmcli, causing user confusion) - Add iptables port 80→5000 redirect to the nmcli AP path so captive portal auto-popup works on phones without hostapd (previously only worked on the hostapd path) - Clean up iptables rules on disable for the nmcli path - Improve LED message on AP enable: show SSID, "No password", and IP:port on both paths so users know exactly how to connect - Fix systemd template: replace hardcoded /home/ledpi/LEDMatrix/ with __PROJECT_ROOT_DIR__ placeholder (install script already writes correct path) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): address Codacy review findings in AP mode implementation - Validate ap_ssid/ap_channel from config before passing to subprocess (printable ASCII ≤32 chars; channel 1-14) to prevent command injection - Fix INPUT iptables rule: PREROUTING redirects port 80→5000 so the INPUT chain sees dport=5000, not 80. Old INPUT rule on port 80 was a no-op. - Refactor iptables setup/teardown into _setup_iptables_redirect() and _teardown_iptables_redirect() helpers, eliminating duplicate logic in the hostapd and nmcli paths - Save/restore ip_forward state (via /tmp/ledmatrix_ip_forward_saved) instead of forcing it to 0 on cleanup, which could break VPNs or bridges already relying on forwarding - nmcli path skips ip_forward management entirely: NM's ipv4.method=shared already manages it for the duration of the connection - Fix _get_ap_status_nmcli() verification: new 'connection add type wifi' profiles have type '802-11-wireless', not 'hotspot', so verification was always returning False. Now also matches by our known connection name. - Remove SSID-based connection deletion: deleting any profile whose SSID matched the AP SSID could destroy a user's saved home WiFi profile. Now only deletes by our application-managed profile names. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(plugins): fix async race in refreshPlugins; use cache TTL to gate re-swap metadata fetch refreshPlugins() called searchPluginStore(true) and showNotification() immediately after refreshInstalledPlugins() without awaiting the returned Promise, so window.installedPlugins could still be stale when the store rendered its Installed/Reinstall badges. Chain .then() so both run only after the fetch completes. In initializePlugins(), the re-swap path always passed fetchCommitInfo=false to searchPluginStore, skipping GitHub metadata even when the 5-minute cache TTL had expired. Add storeCacheExpired() helper and compute isReswapWarm = _reswap && !storeCacheExpired() so fresh metadata is fetched whenever the cache is cold, regardless of whether the render is a first load or a tab re-swap. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address three wifi_manager and one plugins_manager review findings wifi_manager.py: - _create_hostapd_config: use _validate_ap_config() for ssid/channel instead of raw self.config values; strip newlines from SSID to prevent config-file injection via the generated hostapd.conf - _setup_iptables_redirect: check return codes of sysctl ip_forward enable and both iptables -A calls; on any failure log the error output, call _teardown_iptables_redirect() to restore state, and return False instead of silently succeeding - _enable_ap_mode_nmcli_hotspot: on AP verification failure roll back fully — tear down iptables redirect, delete the LEDMatrix-Setup-AP connection profile, clear the LED message — before returning False plugins_manager.js: - initializePlugins: chain searchPluginStore(!isReswapWarm) inside loadInstalledPlugins().then() so window.installedPlugins is populated before the store renders Installed/Reinstall badges (same pattern applied to refreshPlugins() in the previous commit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): use _find_command_path for iptables/sysctl; harden ip_forward save/restore Add _find_command_path() helper that extends _check_command()'s sbin-aware lookup to return the absolute binary path rather than a boolean. Use it in _setup_iptables_redirect and _teardown_iptables_redirect so iptables and sysctl are resolved via /sbin or /usr/sbin even when those directories are absent from PATH in systemd service environments. Also harden the ip_forward save/restore logic: - Read ip_forward from /proc/sys/net/ipv4/ip_forward (no subprocess, no PATH dependency) instead of spawning sysctl -n - Skip the sysctl -w ip_forward=1 write when the value is already "1" to avoid mutating state owned by another service (VPN, NM shared mode, bridge) - Track save success via presence of the save file: if the /proc read or file write fails, leave the file absent so teardown knows not to restore - In _teardown_iptables_redirect, only restore ip_forward when the save file exists; if absent, leave the current value untouched rather than forcing "0" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): check _setup_iptables_redirect return; fix hostapd LED SSID; teardown on exception - Both AP startup paths (hostapd and nmcli) now check the bool returned by _setup_iptables_redirect() and treat False as a hard failure: the hostapd path stops hostapd/dnsmasq and returns an error tuple; the nmcli path brings down and deletes the LEDMatrix-Setup-AP profile and clears the LED message - _enable_ap_mode_hostapd's LED message now calls _validate_ap_config() to get the same sanitized SSID that _create_hostapd_config() uses, so the displayed name always matches the AP actually broadcast by hostapd - _setup_iptables_redirect's outer except block now calls _teardown_iptables_redirect() before returning False so partial iptables/ ip_forward state is always cleaned up on unexpected exceptions; cleanup exceptions are caught and logged separately Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(wifi): add unit tests for AP mode — open network, iptables, LED, cleanup ordering Six pytest unit tests covering the five review scenarios. All subprocess and filesystem side-effects are mocked so the tests run without root, hardware, or a Pi OS environment. 1. test_nmcli_ap_profile_has_no_security_params — asserts the nmcli connection add command has no key-mgmt / psk / WPA arguments and sets mode=ap. 2. test_iptables_nat_rules_added_on_ap_start — verifies _setup_iptables_redirect emits a PREROUTING REDIRECT 80→5000 rule and an INPUT ACCEPT rule for port 5000 (not 80, which never hits INPUT after PREROUTING rewrites it). 3. test_iptables_rules_and_ip_forward_reverted_on_teardown — verifies the -D PREROUTING/-D INPUT calls and that sysctl restores the saved ip_forward value and removes the save file. 4. test_ip_forward_not_restored_when_save_file_absent — verifies teardown skips sysctl when the save file was never written, preventing blind ip_forward=0 on systems using ip_forward for VPNs or NM shared mode. 5. test_led_message_shows_ssid_no_password_and_url — asserts the LED message includes the SSID, 'No password', and the 192.168.4.1:5000 setup URL. 6. test_existing_ap_profiles_deleted_before_new_profile_created — asserts all known profile names are targeted for deletion before 'nmcli connection add'. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(wifi): adopt adsb-feeder-image hotspot patterns — DNS spoofing, connectivity check, idle timeout, wrong-password UX, watchdog escalation Inspired by the production-proven approach in dirkhh/adsb-feeder-image. 1. DNS spoofing for automatic captive-portal popup (Change 1 — Critical) Write /etc/NetworkManager/dnsmasq-shared.d/ledmatrix-captive.conf with address=/#/192.168.4.1 before nmcli connection up so NM's built-in dnsmasq (ipv4.method=shared) resolves every hostname to the AP IP. This triggers the OS captive-portal popup automatically on iOS / Android / Windows / macOS — no manual navigation to 192.168.4.1:5000/setup required. New helpers: _write_nm_dnsmasq_captive_conf / _remove_nm_dnsmasq_captive_conf. New constants: NM_DNSMASQ_SHARED_DIR / NM_DNSMASQ_SHARED_CONF. 2. Real internet connectivity check (Change 2 — High) Add _check_internet_connectivity() (ping 8.8.8.8 + HTTP fallback). check_and_manage_ap_mode() now considers a device "disconnected" when nmcli shows connected but no real internet reachability, matching adsb-feeder's multi-method gateway/DNS/HTTP test approach. 3. AP idle timeout (Change 3 — Medium) Track _ap_enabled_at timestamp in enable_ap_mode(). Add _has_ap_clients() using 'iw dev <iface> station dump'. check_and_manage_ap_mode() auto-disables AP after ap_idle_timeout_minutes (default 15) with no associated clients. 4. Wrong-password error feedback (Change 4 — Medium) _connect_nmcli() detects "Secrets were required" / "authentication rejected" in nmcli stderr and prefixes the message with "wrong_password: ". The /api/v3/wifi/connect route propagates error_type="wrong_password" in the JSON response. captive_setup.html shows "Incorrect password — try again" (keeping the form active) instead of the generic failure message. 5. Escalating watchdog NM restart (Change 5 — Low) wifi_monitor_daemon.py tracks _consecutive_internet_failures. After _nm_restart_threshold (5) consecutive checks where nmcli shows connected but internet is unreachable, restart NetworkManager as a recovery step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): restore safe AP-enable trigger; decouple internet check from AP logic The previous commit introduced _check_internet_connectivity() into check_and_manage_ap_mode(), which shared the same _disconnected_checks counter that triggers AP enable. This created a false-positive risk: 90 seconds of packet loss on working WiFi would enable AP mode and kick off the connection. Fix: restore nmcli association state as the sole AP-enable trigger (original, safe behaviour). The internet connectivity check is now used only in the daemon watchdog for the NM-restart escalation — matching how adsb-feeder-image actually structures the two concerns (initial setup detection vs. ongoing monitoring). Also clarify daemon comment: the connectivity check runs once per cycle in the watchdog block, not inside check_and_manage_ap_mode, so there is no double-call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): remove PMF setting from open AP profile — breaks nmcli connection add on Trixie NM 1.52+ 802-11-wireless-security.pmf is only valid within a security section that also includes key-mgmt. Adding it to an open-network profile causes NM 1.52+ to reject the connection add with 'key-mgmt: property is missing'. PMF has no meaning for open APs (it only applies to WPA2/WPA3), so the setting is simply removed rather than worked around. Found by testing on devpi (Trixie, NM 1.52.1). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): add nftables fallback for port redirect; graceful degradation when neither available Tested on devpi (Trixie, NM 1.52.1): iptables is not installed; nftables is. The original code called _setup_iptables_redirect() and treated 'iptables not found' as a hard failure, rolling back the entire AP setup. Changes: - _setup_iptables_redirect() now tries iptables first, then nftables as a fallback. When neither is available it logs a warning and returns True so the AP still comes up (DNS spoofing still triggers the captive portal popup; users land on port 5000 directly instead of being auto-redirected from 80). - Split into _setup_iptables_redirect_iptables() and _setup_iptables_redirect_nftables() for clarity. - Added _redirect_backend instance var ("iptables" | "nftables" | None) so _teardown_iptables_redirect() uses the same tool that setup used. - nftables teardown: deletes the 'ledmatrix' table (clean, no leftover rules). - iptables teardown: unchanged logic (ip_forward save/restore). - Also removed the PMF workaround for Trixie: 802-11-wireless-security.pmf requires key-mgmt to also be set, breaking open-network creation on NM 1.52+. Open APs have no management frame protection by definition. - Update teardown test to set _redirect_backend = "iptables" before calling it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(wifi): public check_internet_connectivity(); absolute systemctl path; stricter mode assertion wifi_manager.py: - Add public check_internet_connectivity() wrapping the private method so the daemon does not reach into the private API wifi_monitor_daemon.py: - Call wifi_manager.check_internet_connectivity() instead of the private _check_internet_connectivity() - Use /usr/bin/systemctl (absolute path) instead of bare "systemctl" - Wrap NM restart in try/except with check=True; only reset _consecutive_internet_failures on success — on CalledProcessError or other exception, log the error and leave the counter unchanged so the next cycle retries test/test_wifi_manager_ap.py: - Replace loose `assert "ap" in add_calls[0]` (list-membership check that could be satisfied by any element equal to "ap") with an explicit key/value check: locate "802-11-wireless.mode" in the command list and assert the next element is exactly "ap" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Chuck <chuck@example.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
236 lines
10 KiB
Python
Executable File
236 lines
10 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
WiFi Monitor Daemon
|
|
|
|
Monitors WiFi connection status and automatically enables/disables access point mode
|
|
when there is no active WiFi connection.
|
|
"""
|
|
|
|
import sys
|
|
import time
|
|
import logging
|
|
import signal
|
|
from pathlib import Path
|
|
|
|
# Add project root to path (parent of scripts/utils/)
|
|
sys.path.insert(0, str(Path(__file__).parent.parent.parent))
|
|
|
|
from src.wifi_manager import WiFiManager
|
|
|
|
# Configure logging
|
|
logging.basicConfig(
|
|
level=logging.INFO,
|
|
format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
|
|
handlers=[
|
|
logging.StreamHandler(sys.stdout),
|
|
logging.FileHandler('/var/log/ledmatrix-wifi-monitor.log')
|
|
]
|
|
)
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
class WiFiMonitorDaemon:
|
|
"""Daemon to monitor WiFi and manage AP mode"""
|
|
|
|
def __init__(self, check_interval=30):
|
|
"""
|
|
Initialize the WiFi monitor daemon
|
|
|
|
Args:
|
|
check_interval: Seconds between WiFi status checks
|
|
"""
|
|
self.check_interval = check_interval
|
|
self.wifi_manager = WiFiManager()
|
|
self.running = True
|
|
self.last_state = None
|
|
# Counts consecutive checks where nmcli says "connected" but internet is unreachable.
|
|
# After _nm_restart_threshold failures, NetworkManager is restarted as a recovery step.
|
|
self._consecutive_internet_failures = 0
|
|
self._nm_restart_threshold = 5 # ~2.5 min at 30s interval
|
|
|
|
# Register signal handlers for graceful shutdown
|
|
signal.signal(signal.SIGINT, self._signal_handler)
|
|
signal.signal(signal.SIGTERM, self._signal_handler)
|
|
|
|
def _signal_handler(self, signum, frame):
|
|
"""Handle shutdown signals"""
|
|
logger.info(f"Received signal {signum}, shutting down...")
|
|
self.running = False
|
|
|
|
def run(self):
|
|
"""Main daemon loop"""
|
|
logger.info("WiFi Monitor Daemon started")
|
|
logger.info(f"Check interval: {self.check_interval} seconds")
|
|
|
|
# Log initial configuration
|
|
auto_enable = self.wifi_manager.config.get("auto_enable_ap_mode", True)
|
|
ap_ssid = self.wifi_manager.config.get("ap_ssid", "LEDMatrix-Setup")
|
|
logger.info(f"Configuration: auto_enable_ap_mode={auto_enable}, ap_ssid={ap_ssid}")
|
|
|
|
# Log initial status
|
|
initial_status = self.wifi_manager.get_wifi_status()
|
|
initial_ethernet = self.wifi_manager._is_ethernet_connected()
|
|
logger.info(f"Initial status: WiFi connected={initial_status.connected}, "
|
|
f"Ethernet connected={initial_ethernet}, AP active={initial_status.ap_mode_active}")
|
|
if initial_status.connected:
|
|
logger.info(f" WiFi SSID: {initial_status.ssid}, IP: {initial_status.ip_address}, Signal: {initial_status.signal}%")
|
|
|
|
while self.running:
|
|
try:
|
|
# Get current status before checking
|
|
status = self.wifi_manager.get_wifi_status()
|
|
ethernet_connected = self.wifi_manager._is_ethernet_connected()
|
|
|
|
# Check WiFi status and manage AP mode
|
|
state_changed = self.wifi_manager.check_and_manage_ap_mode()
|
|
|
|
# Get updated status after check
|
|
updated_status = self.wifi_manager.get_wifi_status()
|
|
updated_ethernet = self.wifi_manager._is_ethernet_connected()
|
|
|
|
current_state = {
|
|
'connected': updated_status.connected,
|
|
'ethernet_connected': updated_ethernet,
|
|
'ap_active': updated_status.ap_mode_active,
|
|
'ssid': updated_status.ssid
|
|
}
|
|
|
|
# Log state changes with detailed information
|
|
if current_state != self.last_state:
|
|
logger.info("=== State Change Detected ===")
|
|
if updated_status.connected:
|
|
logger.info(f"WiFi connected: {updated_status.ssid} (IP: {updated_status.ip_address}, Signal: {updated_status.signal}%)")
|
|
else:
|
|
logger.info("WiFi disconnected (no active connection)")
|
|
|
|
if updated_ethernet:
|
|
logger.info("Ethernet connected")
|
|
else:
|
|
logger.debug("Ethernet not connected")
|
|
|
|
if updated_status.ap_mode_active:
|
|
logger.info(f"AP mode ACTIVE - SSID: {ap_ssid} (IP: 192.168.4.1)")
|
|
else:
|
|
logger.debug("AP mode inactive")
|
|
|
|
if state_changed:
|
|
logger.info("AP mode state was changed by check_and_manage_ap_mode()")
|
|
|
|
logger.info("=============================")
|
|
self.last_state = current_state.copy()
|
|
else:
|
|
# Log periodic status (less verbose)
|
|
if updated_status.connected:
|
|
logger.debug(f"Status check: WiFi={updated_status.ssid} ({updated_status.signal}%), "
|
|
f"Ethernet={updated_ethernet}, AP={updated_status.ap_mode_active}")
|
|
else:
|
|
logger.debug(f"Status check: WiFi=disconnected, Ethernet={updated_ethernet}, AP={updated_status.ap_mode_active}")
|
|
|
|
# Escalating recovery: if nmcli reports connected but actual internet
|
|
# is unreachable for several consecutive checks, restart NetworkManager.
|
|
# This is done HERE (not inside check_and_manage_ap_mode) to keep the
|
|
# AP-enable trigger clean and avoid false-positive AP enables from
|
|
# transient packet loss on otherwise working WiFi.
|
|
if updated_status.connected and not updated_status.ap_mode_active:
|
|
if not self.wifi_manager.check_internet_connectivity():
|
|
self._consecutive_internet_failures += 1
|
|
logger.warning(
|
|
f"Internet unreachable despite nmcli connection "
|
|
f"({self._consecutive_internet_failures}/{self._nm_restart_threshold})"
|
|
)
|
|
if self._consecutive_internet_failures >= self._nm_restart_threshold:
|
|
logger.warning("Restarting NetworkManager to recover internet connectivity")
|
|
try:
|
|
subprocess.run(
|
|
["/usr/bin/systemctl", "restart", "NetworkManager"],
|
|
capture_output=True, timeout=20, check=True
|
|
)
|
|
self._consecutive_internet_failures = 0
|
|
except subprocess.CalledProcessError as e:
|
|
logger.error(f"NetworkManager restart failed (rc={e.returncode}); "
|
|
"keeping failure counter unchanged")
|
|
except Exception as e:
|
|
logger.error(f"NetworkManager restart error: {e}; "
|
|
"keeping failure counter unchanged")
|
|
else:
|
|
self._consecutive_internet_failures = 0
|
|
else:
|
|
self._consecutive_internet_failures = 0
|
|
|
|
# Sleep until next check
|
|
time.sleep(self.check_interval)
|
|
|
|
except KeyboardInterrupt:
|
|
logger.info("Received keyboard interrupt, shutting down...")
|
|
self.running = False
|
|
break
|
|
except Exception as e:
|
|
logger.error(f"Error in monitor loop: {e}", exc_info=True)
|
|
logger.error(f"Error details - type: {type(e).__name__}, args: {e.args}")
|
|
# Log current state for debugging
|
|
try:
|
|
error_status = self.wifi_manager.get_wifi_status()
|
|
logger.error(f"State at error: WiFi={error_status.connected}, AP={error_status.ap_mode_active}")
|
|
except Exception as state_error:
|
|
logger.error(f"Could not get state at error: {state_error}")
|
|
# Continue running even if there's an error
|
|
time.sleep(self.check_interval)
|
|
|
|
logger.info("WiFi Monitor Daemon stopped")
|
|
|
|
# Ensure AP mode is disabled on shutdown if WiFi or Ethernet is connected
|
|
logger.info("Performing cleanup on shutdown...")
|
|
try:
|
|
status = self.wifi_manager.get_wifi_status()
|
|
ethernet_connected = self.wifi_manager._is_ethernet_connected()
|
|
logger.info(f"Final status: WiFi={status.connected}, Ethernet={ethernet_connected}, AP={status.ap_mode_active}")
|
|
|
|
if (status.connected or ethernet_connected) and status.ap_mode_active:
|
|
if status.connected:
|
|
logger.info(f"Disabling AP mode on shutdown (WiFi is connected to {status.ssid})")
|
|
elif ethernet_connected:
|
|
logger.info("Disabling AP mode on shutdown (Ethernet is connected)")
|
|
|
|
success, message = self.wifi_manager.disable_ap_mode()
|
|
if success:
|
|
logger.info(f"AP mode disabled successfully: {message}")
|
|
else:
|
|
logger.warning(f"Failed to disable AP mode: {message}")
|
|
else:
|
|
logger.debug("AP mode cleanup not needed (not active or no network connection)")
|
|
except Exception as e:
|
|
logger.error(f"Error during shutdown cleanup: {e}", exc_info=True)
|
|
|
|
|
|
def main():
|
|
"""Main entry point"""
|
|
import argparse
|
|
|
|
parser = argparse.ArgumentParser(description='WiFi Monitor Daemon for LED Matrix')
|
|
parser.add_argument(
|
|
'--interval',
|
|
type=int,
|
|
default=30,
|
|
help='Check interval in seconds (default: 30)'
|
|
)
|
|
parser.add_argument(
|
|
'--foreground',
|
|
action='store_true',
|
|
help='Run in foreground (for debugging)'
|
|
)
|
|
|
|
args = parser.parse_args()
|
|
|
|
daemon = WiFiMonitorDaemon(check_interval=args.interval)
|
|
|
|
try:
|
|
daemon.run()
|
|
except Exception as e:
|
|
logger.error(f"Fatal error: {e}", exc_info=True)
|
|
sys.exit(1)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|
|
|