Integration offers firmware updates? And offers to update past broken firmware level?

[brianjmurrell]

I have my C200 walled off from the Internet to be absolutely sure my video is not leaking out to the Internet. In the past that has meant not getting any firmware updates though, without removing the firewall block, updating the firmware and then re-enabling the block.

I'm pleasantly surprised to see that this integration is now offering firmware updates, even for my firewalled C200.

I am noticing however that it's currently offering firmware version 1.3.15 Build 240715 Rel.43073n. Isn't the 240715 in that version beyond the 230921 the the big warning in the README warns about not updating beyond?

If so, should the integration be offering firwmware upgrades beyond that version? Is it prudent perhaps to suppress updates beyond the last one that works at least until a new one is released by TP-Link that addresses the issues?

FWIW, I seem to currently have 1.3.14 Build 240513 Rel.43636n(5553) in my camera (at least according to the integrations's update availability dialog) and it seems to be working still, but I surely will not be updating it until the new one with the issues resolved is released for fear of breaking the status quo.

[JurajNyiri]

Integration exposes what is inside a camera. Camera requires internet access in order to detect an update or download an upgrade. If it detects, or downloads an upgrade, it can reach internet.

[brianjmurrell]

I can assure you that my camera does not (usually[1]) have access to the Internet. Here is it trying:

11:44:01.097097 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2571376 ecr 0,nop,wscale 3], length 0
11:44:02.093209 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2571476 ecr 0,nop,wscale 3], length 0
11:44:04.093251 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2571676 ecr 0,nop,wscale 3], length 0
11:44:06.104226 ARP, Request who-has 10.75.22.254 tell 10.75.22.219, length 46
11:44:06.104278 ARP, Reply 10.75.22.254 is-at 90:fb:a6:4c:02:5c, length 28
11:44:08.103220 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2572077 ecr 0,nop,wscale 3], length 0
11:44:16.133197 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2572880 ecr 0,nop,wscale 3], length 0
11:44:32.173225 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2574484 ecr 0,nop,wscale 3], length 0
11:44:37.183302 ARP, Request who-has 10.75.22.254 tell 10.75.22.219, length 46
11:44:37.183334 ARP, Reply 10.75.22.254 is-at 90:fb:a6:4c:02:5c, length 28
11:45:04.293162 IP 10.75.22.219.49378 > 18.209.138.57.443: Flags [S], seq 1146268030, win 14600, options [mss 1460,sackOK,TS val 2577696 ecr 0,nop,wscale 3], length 0
11:45:09.303296 ARP, Request who-has 10.75.22.254 tell 10.75.22.219, length 46
11:45:09.303322 ARP, Reply 10.75.22.254 is-at 90:fb:a6:4c:02:5c, length 28
11:46:08.458498 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2584112 ecr 0,nop,wscale 3], length 0
11:46:09.453240 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2584212 ecr 0,nop,wscale 3], length 0
11:46:11.453267 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2584412 ecr 0,nop,wscale 3], length 0
11:46:13.463261 ARP, Request who-has 10.75.22.254 tell 10.75.22.219, length 46
11:46:13.463306 ARP, Reply 10.75.22.254 is-at 90:fb:a6:4c:02:5c, length 28
11:46:15.463130 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2584813 ecr 0,nop,wscale 3], length 0
11:46:23.493207 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2585616 ecr 0,nop,wscale 3], length 0
11:46:39.533240 IP 10.75.22.219.52115 > 3.222.230.137.443: Flags [S], seq 1178459594, win 14600, options [mss 1460,sackOK,TS val 2587220 ecr 0,nop,wscale 3], length 0
11:46:44.543320 ARP, Request who-has 10.75.22.254 tell 10.75.22.219, length 46
11:46:44.543343 ARP, Reply 10.75.22.254 is-at 90:fb:a6:4c:02:5c, length 28

As you can see, it tries and tries yet cannot reach the Internet.

So if the camera requires access to the Internet for a firmware update, is the integration (allegedly) just getting that firmware update availability from the camera (which presumably got it from the Internet)? IOW is it my camera that that is telling the integration that a 1.3.15 Build 240715 Rel.43073n update is available?

[1] Except, as I previously noted, when I temporarily allow the camera access to do an update.

[JurajNyiri]

Yes I wrote that functionality. It gets the update information from the camera itself.

[brianjmurrell]

So the camera is remembering this update availability even through power cycles?

So presumably, given that I have the Internet blocked, if I did try to execute the update in the HASS integration, it would fail due to lack of access?

As an aside, I do wish TP-Link would make it clear how one can block all access to "the cloud" except for updates, whether that is by IP address/ports or even with DNS filtering/blocking.

[JurajNyiri]

Correct. I do not know exactly how and when it grabs the update from the camera point of view.