From d8342846959a0bfecdb98b8d9df43e774fb8ac08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?= Date: Sun, 23 Aug 2026 22:19:53 +0200 Subject: [PATCH] v0.3.6 --- BUILD_REPORT.md | 54 +++----- Cargo.lock | 2 +- Cargo.toml | 2 +- FILE_MANIFEST.sha256 | 14 +- README.md | 6 +- docs/LXC.md | 4 +- .../gree_controller/manifest.json | 2 +- src/protocol/crypto.rs | 54 ++++++-- src/protocol/gree.rs | 125 ++++++++++++++++-- 9 files changed, 199 insertions(+), 64 deletions(-) diff --git a/BUILD_REPORT.md b/BUILD_REPORT.md index 259f15f..0916f4b 100644 --- a/BUILD_REPORT.md +++ b/BUILD_REPORT.md @@ -1,57 +1,45 @@ -# GREE Controller v0.3.5 - build and validation report +# GREE Controller v0.3.6 - build and validation report ## Scope -Version 0.3.5 focuses on mixed-generation GREE networks and mobile day-to-day control. +Version 0.3.6 fixes real-device binding failures observed on a mixed five-unit GREE network in a multi-NIC LXC. -### GREE protocol fixes +### Protocol fixes -- corrected the standard AES-128-ECB generic key, -- corrected the standard AES-128-GCM generic key, -- GCM now uses the fixed 12-byte nonce and `qualcomm-test` AAD used by EWPE/GREE Wi-Fi modules, -- discovery detects GCM by the response `tag` and decrypts it with the GCM generic key, -- discovery supports Auto/V1/V2 filtering and 1-10 repeated scan passes, -- protocol packets use `cid="app"`, `i=1` for bind and `i=0` for status/commands, -- Celsius commands follow the standard command payload and use whole-degree `SetTem`; `TemRec` is not misused as a Celsius half-degree flag, -- bind refreshes the device with a direct scan and falls back between ECB/GCM, -- discovery attempts an immediate bind and persists the successful protocol/key, -- status falls back to a smaller core property list if a model rejects the extended list, -- command failure triggers one fresh-bind retry before returning an error, -- polling also performs a one-time rebind/retry before increasing the communication failure counter. +- GREE AES-GCM decoding now accepts non-canonical Base64 trailing bits and optional padding. This matches the forgiving decoding behavior used by established Python GREE implementations and fixes `Invalid last symbol ... offset 21` errors from real Wi-Fi modules. +- GCM decrypted payloads discard `0xff` filler bytes used by some modules. +- ECB decoding keeps normal PKCS#7 validation but has a compatibility fallback that trims decrypted data at the last JSON `}` when a legacy module returns non-standard padding. +- Bind waits ignore late discovery packets instead of accidentally treating a `dev` packet as the bind result. +- Before each bind, the controller refreshes the short GREE bind window with a subnet broadcast scan when the device is on a directly connected IPv4 network. The same UDP socket is then used immediately for the bind request. +- ECB/GCM fallback remains enabled and successful binding persists the detected protocol and device key. -### Availability behavior +### Multi-NIC behavior -- one UDP timeout no longer immediately marks a device offline, -- a device is marked offline after 3 consecutive communication failures, -- successful bind/poll/command resets the failure counter. - -### Web UI - -- newly discovered units open a friendly-name step, and they can also be renamed later from the Devices view, -- unnamed units receive a model/MAC-based fallback name instead of `Klimatyzator GREE`, -- discovery dialog exposes Auto/V1/V2, scan passes and total scan time, -- zone cards have direct +/- 0.5 C controller setpoint controls; physical GREE setpoints are normalized to whole Celsius degrees, -- zone cards have direct Heat/Cool buttons without opening the edit dialog. +- If `GREE_CONTROLLER_GREE_INTERFACE` is configured, all GREE UDP sockets are bound to the current IPv4 address of that interface. +- If no GREE interface is configured, the controller now automatically selects the local IPv4 address whose subnet contains the target GREE device. For the reported LXC this resolves `10.87.65.x` traffic to the `10.87.65.27/25` interface instead of leaving the socket bound to `0.0.0.0`. +- The automatically selected subnet broadcast is also used to refresh the bind window (for example `10.87.65.127:7000`). ## Validation performed | Check | Result | |---|---| | JavaScript syntax (`node --check web/app.js`) | PASS | -| JSON parsing for EN/PL language packs | PASS | +| EN/PL JSON parsing | PASS | | Shell syntax (`bash -n scripts/*.sh`) | PASS | | Python syntax for scripts and HA integration | PASS | | SQL remains centralized in `src/queries.rs` | PASS | +| No operator `.sh`/`.py` scripts in the project root | PASS | | Package naming remains `gree_controller` / `GREE_CONTROLLER_*` | PASS | +| ZIP integrity | performed during release packaging | -A full `./scripts/dev.sh --check` was attempted in the packaging environment, but Rust is not preinstalled and DNS access to `sh.rustup.rs` is blocked there. Final Rust type-check, tests and release build are therefore performed by `scripts/update.sh` or `scripts/install.sh` inside the target LXC. +The packaging environment does not contain the Rust toolchain, so the final Rust type-check, tests and optimized build are intentionally performed by `scripts/update.sh` on the target LXC before the installed binary is replaced. -Recommended LXC update: +## Recommended LXC test ```bash sudo ./scripts/update.sh -./scripts/service.sh health -journalctl -u gree-controller -n 150 --no-pager +sudo ./scripts/configure-gree-network.sh eth1 +journalctl -u gree-controller -f ``` -For the reported mixed-model network, start discovery with **Auto (V1 + V2)**, 3 passes and 6000 ms. If fewer units appear, run V1-only and V2-only scans separately and inspect the service log. +Expected request logs should show a concrete local address such as `10.87.65.27:` rather than `0.0.0.0:`. diff --git a/Cargo.lock b/Cargo.lock index e2b6e5b..e75ee59 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -633,7 +633,7 @@ dependencies = [ [[package]] name = "gree-controller" -version = "0.3.5" +version = "0.3.6" dependencies = [ "aes", "aes-gcm", diff --git a/Cargo.toml b/Cargo.toml index b9ac325..93e1d15 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "gree-controller" -version = "0.3.5" +version = "0.3.6" edition = "2021" authors = ["GREE Controller contributors"] description = "Standalone local GREE HVAC controller with Web UI, SQLite and Home Assistant sensor support" diff --git a/FILE_MANIFEST.sha256 b/FILE_MANIFEST.sha256 index c0775b8..a83f605 100644 --- a/FILE_MANIFEST.sha256 +++ b/FILE_MANIFEST.sha256 @@ -1,14 +1,14 @@ 6b10bf7903a32a6cdd902d990911105589690deafe7da12e5b3b9c994c1fd4f6 ./.env.example 2fe1cf4e544fead5ae58436145a5b45e7a5a105143dfd815d28e307c94d5d19b ./.gitignore -6a321094970809e697c2bab8b7861abc0808496b1c143a667dec30bded1a1758 ./BUILD_REPORT.md -0a3b167534311a32306c567814562adefe2c5f9d1302a1b3426288801915cf65 ./Cargo.toml +d75023129d63417a5af399567944d99a65c4570e1cef671ba2f68fdd734fd8d1 ./BUILD_REPORT.md +baad3cddff5a160ac1e5f5200838c83bd1edc2a3d4dec09b95b8858a1a4bfeb7 ./Cargo.toml 19b2943504acb8f8de280f873a8dbec4bb6ebbe3870b158f5655d4fb8c298f5f ./LICENSE -c8f9e1cbc54329e2dad226245a8bbd3f17de416c5e6cbb3a43469d77e6006916 ./README.md +349344b41f5bb6680079c5ed95f6294c9c9df6a73bdbda452d351033abf4768a ./README.md a4fa9bfee9735ed8ed95ea31456e0cce503d82502ae3f550108ffca51b0f0c3d ./build.rs 37453ecce2c7290ecae5ada4249cfd36bc70fb50c479aa680b74e4f1bc707251 ./docs/API.md 234dd200e380a13ecd3e61b4ea455f6f08d64ce89382077dee80684acadb9703 ./docs/HOME_ASSISTANT_MIGRATION.md 7a88d6e76fda21e5d34ab351e26bc10dc1f8f7b3055505aefad1df7c56d65ae4 ./docs/LOCALIZATION.md -26ca44b749930ee15cdfde8106198e621b322ae1e5c60a7bd8a1680489b83de9 ./docs/LXC.md +456b65737d3b4579e40edba2655c0cb1a63620d8a7bfa0f8844acf81b21fc374 ./docs/LXC.md a728ddc324613671932bd83522155b09c7503d4fbcd0d04d8e217676ea9e10e4 ./docs/PROJECT_SPEC.md 33214270b96ac4c64e3db41c11e54158792b4a87ee5668c651bad571766b591a ./home-assistant/README.md f8e8559fe10fe523ac5bc9aac25c6e26e862f679d502e8f3c39f38a0a8e40911 ./home-assistant/custom_components/gree_controller/__init__.py @@ -18,7 +18,7 @@ fde31b8e020fd36be2d9d9b1e554254f5da8a1cc593240ebb8d78820154dd790 ./home-assista e1821b74859bc40773a6ee39e6ccc9650980b62af50d6426b46cdb3e3a90d200 ./home-assistant/custom_components/gree_controller/const.py 2d27d7cb67c53e819b99a0302cd0bd339c27e3e2dfc85e07d30c31f505f740b5 ./home-assistant/custom_components/gree_controller/coordinator.py 5a96fe8f5c035c34f1339370270cd078056202d09e236dec75735be11de92a7d ./home-assistant/custom_components/gree_controller/entity_map.py -4eca7d2c224282fde1db22a5010bcf0a3d17f2342c206371a9202314be0d7b56 ./home-assistant/custom_components/gree_controller/manifest.json +23fc6d9d7136492db8dc046e3f54c65070e5f65e1c6303ecab1bac5ef686661d ./home-assistant/custom_components/gree_controller/manifest.json 6bddb7b4620021ecd2099a86a77ef5c7f2c2dcd3d07d5db4e7b4c4ce6d3e8c03 ./home-assistant/custom_components/gree_controller/translations/en.json 13f30e2dcdcedbd1b6c3f99c2335e0487108fd72c8e86922368b84f2fa2038ae ./home-assistant/custom_components/gree_controller/translations/pl.json 4513070521d3dda0efb0d974a86ba674494cfb2b66fe9e5cac5b1b0430dede97 ./home-assistant/generated/gree_controller_entities.example.json @@ -44,8 +44,8 @@ ae3b496749a3fd723b243d9bea92e5d76249f52814c80359ad9bac53abacb074 ./src/error.rs f85cb4ba6435843431d93779aa0653fd24ec8987e06ef36efde096cbea321d7a ./src/home_assistant.rs 27eca87a9078aad7a7a4ef1fc39ce7ddaffcf05466acb995d571e0a35dfe898c ./src/main.rs a5923f8fb72ebac68c13e4767dd35012041e2783167969521e757bf502fafabd ./src/models.rs -286a38d9e5a2380fad26f8fdb0393dfbcf22d208de8b753a4ba65282eec4ce40 ./src/protocol/crypto.rs -e940d3344ca34a7c8c0821b054044cfec0ef12637e0104f31cbd5de69c3e1c8a ./src/protocol/gree.rs +7fc31fbf8841a073a1544b8c7a6390f1a15b56087486ca0596a8418340fa232a ./src/protocol/crypto.rs +53e6fdb575da4790cdf88013073b973461fb9ace362fbe51dda95c0eaadf2365 ./src/protocol/gree.rs a910bd9432a393740c0f6fab52bfcb551f0ea756718d66d290fd2610767cf07c ./src/protocol/mod.rs c80164631bba476db29469fa43b28d73f68412c06bafabe2143ab8d4cd330a52 ./src/queries.rs 521070a4c63bec73372cf4873f20c5fad23c37db4df7199bcc5bf6f6e566b3f6 ./src/state.rs diff --git a/README.md b/README.md index 1fc66eb..366a1b0 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Standalone local GREE air-conditioner controller written in Rust. It runs on a regular Linux host or an LXC container and provides a mobile-first web interface without depending on the vendor cloud. -Current version: **0.3.5**. +Current version: **0.3.6**. ## Highlights @@ -35,7 +35,7 @@ See [`BUILD_REPORT.md`](BUILD_REPORT.md) for package validation details and [`do On Debian, Ubuntu or an LXC container: ```bash -unzip gree-controller-v0.3.5.zip +unzip gree-controller-v0.3.6.zip cd gree-controller chmod +x scripts/*.sh ./scripts/dev.sh @@ -92,7 +92,7 @@ The selected appearance is stored in the `gree_controller_theme` cookie. The int 5. New devices immediately open a naming step so you can enter room-friendly names such as **Salon** or **Sypialnia**. They can also be renamed later from **Devices -> Rename**. Re-discovery preserves your custom name. 6. If LXC/VLAN broadcast does not pass, add the unit manually with IP and MAC/CID. -Version 0.3.5 uses the EWPE/GREE protocol constants for ECB and GCM, the fixed GCM nonce/AAD, standard `cid=app`, correct packet `i` values, and a fresh scan before bind. A single lost UDP response no longer marks a device offline; three consecutive communication failures are required. +Version 0.3.6 additionally uses forgiving GREE Base64 decoding for non-canonical GCM tags seen on real Wi-Fi modules, automatically selects the directly connected local IPv4 interface for unicast GREE traffic, and refreshes the short bind window with a subnet broadcast immediately before bind. A single lost UDP response no longer marks a device offline; three consecutive communication failures are required. ## LXC/systemd installation and updates diff --git a/docs/LXC.md b/docs/LXC.md index 5becbcb..4f345ae 100644 --- a/docs/LXC.md +++ b/docs/LXC.md @@ -117,6 +117,8 @@ When the LXC has a management interface and a dedicated GREE network, configure ```env GREE_CONTROLLER_GREE_INTERFACE=eth1 GREE_CONTROLLER_DISCOVERY_BROADCAST=auto + +This explicit interface configuration is recommended for predictable LXC deployments. Version 0.3.6 also automatically selects the directly connected local IPv4 address for a GREE device when the interface variable is omitted; for example, a target in `10.87.65.0/25` selects the local address on that subnet. GREE_CONTROLLER_SIMULATE=false GREE_CONTROLLER_AUTO_SEED=false ``` @@ -139,6 +141,6 @@ Use `scripts/network-debug.sh` for routing diagnostics. ## Mixed GREE model generations -Version 0.3.5 can discover both AES-ECB and AES-GCM modules. In the Web UI choose **Discover -> Auto (V1 + V2)** and use 3-5 scan passes. If a family is still missing, repeat with V1-only and V2-only to see which protocol its Wi-Fi module answers with. +Version 0.3.6 can discover both AES-ECB and AES-GCM modules. In the Web UI choose **Discover -> Auto (V1 + V2)** and use 3-5 scan passes. If a family is still missing, repeat with V1-only and V2-only to see which protocol its Wi-Fi module answers with. A single command/status timeout no longer immediately flips a device offline; offline requires three consecutive communication failures. diff --git a/home-assistant/custom_components/gree_controller/manifest.json b/home-assistant/custom_components/gree_controller/manifest.json index 4a185ee..9cdc2d4 100644 --- a/home-assistant/custom_components/gree_controller/manifest.json +++ b/home-assistant/custom_components/gree_controller/manifest.json @@ -1,7 +1,7 @@ { "domain": "gree_controller", "name": "GREE Controller", - "version": "0.3.5", + "version": "0.3.6", "config_flow": true, "integration_type": "hub", "iot_class": "local_polling", diff --git a/src/protocol/crypto.rs b/src/protocol/crypto.rs index 7b027a8..74b2bb6 100644 --- a/src/protocol/crypto.rs +++ b/src/protocol/crypto.rs @@ -1,7 +1,14 @@ use aes::{Aes128, cipher::{BlockDecrypt, BlockEncrypt, KeyInit, generic_array::GenericArray}}; use aes_gcm::{Aes128Gcm, Nonce, aead::{AeadInPlace, KeyInit as AeadKeyInit}}; use anyhow::{anyhow, bail, Context, Result}; -use base64::{engine::general_purpose::STANDARD, Engine}; +use base64::{ + alphabet, + engine::{ + general_purpose::{GeneralPurpose, GeneralPurposeConfig, STANDARD}, + DecodePaddingMode, + }, + Engine, +}; /// Shared discovery/bind key used by the original AES-128-ECB protocol. pub const GENERIC_GREE_V1_KEY: &str = "a3K8Bx%2r8Y7#xDh"; @@ -11,6 +18,17 @@ pub const GENERIC_GREE_V2_KEY: &str = "{yxAHAY_Lm6pbC/<"; const GCM_NONCE: [u8; 12] = [0x54, 0x40, 0x78, 0x44, 0x49, 0x67, 0x5a, 0x51, 0x6c, 0x5e, 0x63, 0x13]; const GCM_AAD: &[u8] = b"qualcomm-test"; +// Some GREE Wi-Fi modules emit technically non-canonical Base64: padding may +// be omitted and unused trailing bits can be set. Python's base64 decoder, +// used by the established GREE implementations, accepts those packets. Keep +// encoding canonical but use a forgiving decoder for device-originated data. +const GREE_BASE64_DECODE: GeneralPurpose = GeneralPurpose::new( + &alphabet::STANDARD, + GeneralPurposeConfig::new() + .with_decode_padding_mode(DecodePaddingMode::Indifferent) + .with_decode_allow_trailing_bits(true), +); + pub fn normalize_key(key: &str) -> Result<[u8; 16]> { let bytes = key.as_bytes(); if bytes.len() == 16 { @@ -44,7 +62,7 @@ pub fn encrypt_v1(key: &str, plaintext: &[u8]) -> Result { pub fn decrypt_v1(key: &str, ciphertext_b64: &str) -> Result> { let key = normalize_key(key)?; let cipher = Aes128::new_from_slice(&key).map_err(|_| anyhow!("invalid AES key"))?; - let mut data = STANDARD.decode(ciphertext_b64).context("invalid base64 packet")?; + let mut data = GREE_BASE64_DECODE.decode(ciphertext_b64).context("invalid base64 packet")?; if data.is_empty() || data.len() % 16 != 0 { bail!("invalid AES-ECB ciphertext length") } @@ -52,10 +70,19 @@ pub fn decrypt_v1(key: &str, ciphertext_b64: &str) -> Result> { cipher.decrypt_block(GenericArray::from_mut_slice(block)); } let pad = *data.last().ok_or_else(|| anyhow!("empty plaintext"))? as usize; - if pad == 0 || pad > 16 || data.len() < pad || data[data.len() - pad..].iter().any(|v| *v as usize != pad) { - bail!("invalid PKCS#7 padding") + let valid_padding = pad > 0 + && pad <= 16 + && data.len() >= pad + && data[data.len() - pad..].iter().all(|v| *v as usize == pad); + if valid_padding { + data.truncate(data.len() - pad); + } else if let Some(last_json_byte) = data.iter().rposition(|byte| *byte == b'}') { + // Legacy GREE implementations are deliberately tolerant here: some + // modules return non-standard padding but the JSON itself is valid. + data.truncate(last_json_byte + 1); + } else { + bail!("invalid AES-ECB padding and no JSON terminator") } - data.truncate(data.len() - pad); Ok(data) } @@ -81,13 +108,15 @@ pub fn encrypt_v2(key: &str, plaintext: &[u8]) -> Result { pub fn decrypt_v2(key: &str, ciphertext_b64: &str, tag_b64: &str) -> Result> { let key = normalize_key(key)?; let cipher = ::new_from_slice(&key).map_err(|_| anyhow!("invalid AES-GCM key"))?; - let tag_bytes = STANDARD.decode(tag_b64).context("invalid GCM tag")?; - if tag_bytes.len() != 16 { bail!("invalid GCM tag length") } - let mut data = STANDARD.decode(ciphertext_b64).context("invalid GCM ciphertext")?; + let tag_bytes = GREE_BASE64_DECODE.decode(tag_b64).context("invalid GCM tag")?; + if tag_bytes.len() != 16 { bail!("invalid GCM tag length: {} bytes", tag_bytes.len()) } + let mut data = GREE_BASE64_DECODE.decode(ciphertext_b64).context("invalid GCM ciphertext")?; let nonce = Nonce::from_slice(&GCM_NONCE); let tag = GenericArray::from_slice(&tag_bytes); cipher.decrypt_in_place_detached(nonce, GCM_AAD, &mut data, tag) .map_err(|_| anyhow!("AES-GCM authentication failed"))?; + // A few modules append 0xff filler bytes to decrypted JSON. + data.retain(|byte| *byte != 0xff); Ok(data) } @@ -108,4 +137,13 @@ mod tests { let encrypted = encrypt_v2(GENERIC_GREE_V2_KEY, value).unwrap(); assert_eq!(decrypt_v2(GENERIC_GREE_V2_KEY, &encrypted.ciphertext, &encrypted.tag).unwrap(), value); } + + #[test] + fn gree_base64_accepts_noncanonical_trailing_bits() { + // 16 zero bytes canonically end with `A==`. `B==` carries the same + // useful two bits but has non-zero unused trailing bits. Python's + // base64.b64decode accepts it and real GREE modules emit this form. + let decoded = GREE_BASE64_DECODE.decode("AAAAAAAAAAAAAAAAAAAAAB==").unwrap(); + assert_eq!(decoded, vec![0_u8; 16]); + } } diff --git a/src/protocol/gree.rs b/src/protocol/gree.rs index 5cb3edd..a9264ef 100644 --- a/src/protocol/gree.rs +++ b/src/protocol/gree.rs @@ -27,11 +27,24 @@ impl GreeClient { Self { controller_id, interface } } - async fn udp_socket(&self, broadcast: bool) -> Result { + async fn udp_socket(&self, broadcast: bool, target_hint: Option) -> Result { let socket = if let Some(interface) = self.interface.as_deref() { let ip = interface_ipv4(interface)?; UdpSocket::bind(SocketAddrV4::new(ip, 0)).await .with_context(|| format!("cannot bind GREE UDP socket to {ip} from interface {interface}"))? + } else if let Some(target) = target_hint { + if let Some(config) = local_ipv4_config_for_target(target)? { + tracing::debug!( + target = %target, + interface = %config.interface, + local_ip = %config.ip, + "Automatically selected local interface for GREE UDP" + ); + UdpSocket::bind(SocketAddrV4::new(config.ip, 0)).await + .with_context(|| format!("cannot bind GREE UDP socket to {} on {}", config.ip, config.interface))? + } else { + UdpSocket::bind("0.0.0.0:0").await? + } } else { UdpSocket::bind("0.0.0.0:0").await? }; @@ -39,6 +52,19 @@ impl GreeClient { Ok(socket) } + fn bind_scan_target(&self, target: SocketAddr) -> Result { + let SocketAddr::V4(target_v4) = target else { return Ok(target); }; + let broadcast = if let Some(interface) = self.interface.as_deref() { + let (_, broadcast) = interface_ipv4_config(interface)?; + Some(broadcast) + } else { + local_ipv4_config_for_target(*target_v4.ip())?.map(|config| config.broadcast) + }; + Ok(broadcast + .map(|ip| SocketAddr::V4(SocketAddrV4::new(ip, target_v4.port()))) + .unwrap_or(target)) + } + fn discovery_target(&self, configured: &str) -> Result { let value = configured.trim(); if value.eq_ignore_ascii_case("auto") || value.to_ascii_lowercase().starts_with("auto:") { @@ -57,7 +83,8 @@ impl GreeClient { /// protocol_filter: 0=auto/both, 1=ECB only, 2=GCM only. pub async fn discover(&self, broadcast: &str, duration: Duration, protocol_filter: u8, passes: u8) -> Result> { let target = self.discovery_target(broadcast)?; - let socket = self.udp_socket(true).await?; + let target_hint = match target { SocketAddr::V4(addr) => Some(*addr.ip()), SocketAddr::V6(_) => None }; + let socket = self.udp_socket(true, target_hint).await?; let local = socket.local_addr()?; let passes = passes.clamp(1, 10); tracing::info!( @@ -219,13 +246,30 @@ impl GreeClient { async fn bind_attempt(&self, device: &Device, version: u8) -> Result { let target = self.device_target(device)?; - let socket = self.udp_socket(false).await?; + let target_hint = match target { SocketAddr::V4(addr) => Some(*addr.ip()), SocketAddr::V6(_) => None }; + let socket = self.udp_socket(true, target_hint).await?; - // Some Wi-Fi modules only accept bind shortly after a scan. A direct scan - // refreshes that window and works across routed/VLAN deployments too. - socket.send_to(br#"{"t":"scan"}"#, target).await?; + // Binding is time-sensitive on older GREE Wi-Fi modules. Refresh the + // bind window with a subnet broadcast when the target is on a directly + // connected network. A unicast scan remains the fallback for routed + // deployments. Keep the same UDP socket for scan + bind. + let scan_target = self.bind_scan_target(target)?; + tracing::debug!(device=%device.id, target=%target, scan_target=%scan_target, local=%socket.local_addr()?, "Refreshing GREE bind window"); + socket.send_to(br#"{"t":"scan"}"#, scan_target).await?; let mut scan_buf = vec![0_u8; 16 * 1024]; - let _ = timeout(Duration::from_millis(900), socket.recv_from(&mut scan_buf)).await; + let scan_deadline = Instant::now() + Duration::from_millis(1500); + while Instant::now() < scan_deadline { + let remaining = scan_deadline.saturating_duration_since(Instant::now()); + match timeout(remaining, socket.recv_from(&mut scan_buf)).await { + Ok(Ok((_size, source))) if source.ip() == target.ip() => { + tracing::debug!(device=%device.id, source=%source, "Received scan response immediately before bind"); + break; + } + Ok(Ok(_)) => continue, + Ok(Err(err)) => return Err(err.into()), + Err(_) => break, + } + } let inner = json!({"mac": device.mac, "t": "bind", "uid": 0}); let generic_key = if version == 2 { GENERIC_GREE_V2_KEY } else { GENERIC_GREE_V1_KEY }; @@ -328,7 +372,9 @@ impl GreeClient { } async fn request(&self, device: &Device, inner: &Value, key: &str, binding: bool, protocol_version: u8) -> Result { - let socket = self.udp_socket(false).await?; + let target = self.device_target(device)?; + let target_hint = match target { SocketAddr::V4(addr) => Some(*addr.ip()), SocketAddr::V6(_) => None }; + let socket = self.udp_socket(false, target_hint).await?; self.request_on_socket(device, inner, key, binding, protocol_version, &socket).await } @@ -371,7 +417,16 @@ impl GreeClient { Err(err) => { last_decode_error = Some(anyhow!("invalid GREE JSON response: {err}")); continue; } }; if let Some(pack) = response.get("pack").and_then(Value::as_object) { - return Ok(Value::Object(pack.clone())); + let decoded = Value::Object(pack.clone()); + if binding { + let response_type = decoded.get("t").and_then(Value::as_str).unwrap_or_default(); + if !response_type.eq_ignore_ascii_case("bindok") { + tracing::debug!(source=%source, response_type=%response_type, "Ignoring non-bind packet while waiting for GREE bind response"); + continue; + } + } + if let Some(err) = decoded.get("err").filter(|v| !v.is_null()) { bail!("GREE device error: {err}") } + return Ok(decoded); } let Some(pack) = response.get("pack").and_then(Value::as_str) else { continue; }; let clear = if version == 2 { @@ -409,6 +464,58 @@ impl GreeClient { } } +#[derive(Debug, Clone)] +struct LocalIpv4Config { + interface: String, + ip: Ipv4Addr, + broadcast: Ipv4Addr, + prefix_len: u32, +} + +#[cfg(target_os = "linux")] +fn local_ipv4_config_for_target(target: Ipv4Addr) -> Result> { + use std::{ffi::CStr, ptr}; + unsafe { + let mut addrs: *mut libc::ifaddrs = ptr::null_mut(); + if libc::getifaddrs(&mut addrs) != 0 { return Err(std::io::Error::last_os_error()).context("getifaddrs failed"); } + let mut current = addrs; + let mut best: Option = None; + while !current.is_null() { + let ifa = &*current; + if !ifa.ifa_name.is_null() && !ifa.ifa_addr.is_null() && !ifa.ifa_netmask.is_null() + && (*ifa.ifa_addr).sa_family as i32 == libc::AF_INET + { + let interface = CStr::from_ptr(ifa.ifa_name).to_string_lossy().into_owned(); + let addr = &*(ifa.ifa_addr as *const libc::sockaddr_in); + let mask_addr = &*(ifa.ifa_netmask as *const libc::sockaddr_in); + let ip = Ipv4Addr::from(addr.sin_addr.s_addr.to_ne_bytes()); + let mask = Ipv4Addr::from(mask_addr.sin_addr.s_addr.to_ne_bytes()); + let ip_u32 = u32::from(ip); + let mask_u32 = u32::from(mask); + let target_u32 = u32::from(target); + if !ip.is_loopback() && (ip_u32 & mask_u32) == (target_u32 & mask_u32) { + let prefix_len = mask_u32.count_ones(); + let candidate = LocalIpv4Config { + interface, + ip, + broadcast: Ipv4Addr::from(ip_u32 | !mask_u32), + prefix_len, + }; + if best.as_ref().map(|current| prefix_len > current.prefix_len).unwrap_or(true) { + best = Some(candidate); + } + } + } + current = ifa.ifa_next; + } + libc::freeifaddrs(addrs); + Ok(best) + } +} + +#[cfg(not(target_os = "linux"))] +fn local_ipv4_config_for_target(_target: Ipv4Addr) -> Result> { Ok(None) } + #[cfg(target_os = "linux")] fn interface_ipv4_config(interface: &str) -> Result<(Ipv4Addr, Ipv4Addr)> { use std::{ffi::CStr, ptr};