system security / Google Assistant!

[uudruid74]

I'm thinking there should be some sort of security on learnCommand, or on re-learning an existing command? Maybe a host whitelist?

Thoughts on the best way to handle it?

[radinsky]

Yes, it's easy to create whitelist array and to get the self.client_address[0] from the request.

[uudruid74]

I've managed to get Google Assistant integrated, a significant milestone. However, to make things easy, I used IFTTT (if this then that) and the "WebHooks" service they have to send random HTML requests. This can be expanded to way beyond just Google Assistant since IFTTT supports just about anything as a trigger. If you want to lower the temperature of house when a stock rises, I think you could do that!

However, WebHooks requests are made from the Internet, so security is a major concern. Here is a list of security-related issues I've implemented (about to push to my tree) for comment. All in "General"

• serverAddress = IP to listen on, rather than 0.0.0.0
• serverPort = listen port (defaults to 8080)
• learnFrom = IP addresses that can issue new commands to learn from (default is any)
• broadcastAddress = a pending patch to python-broadlink will allow device discover to use a specified broadcast IP
• Autodetect = if set to an int, do device discovery and add detected devices to settings.ini Timeout in the given seconds. This option won't persist and is auto-cleared.
• allowOverwrite = if set to anything, allow learned commands to overwrite an existing entry. The default is to deny changing a command that is already learned
• restrictAccess = restrict all operations to this list of IPs
• password = allow password-protected POST operations from any address

If password is specified, then GET operations are only allowed from hosts in restrictAccess. GET operations won't need a password, but they'll only be allowed from specific hosts. There is currently no way to restrict hosts AND require a password, but serverAddress combined with firewall rules on the underlying host would be solution for the security paranoid, setting password and not restrictAccess.

[uudruid74]

Resolved by #13