[bug] Nodes report Secure mode when they were not Included Securely

[deccos]

Before submitting a bug please read: https://zwave-js.github.io/zwavejs2mqtt/#/troubleshooting/bug_report

Version

Build/Run method

• [ X ] Docker
• PKG
• Manually built (git clone - npm install - npm run build )

zwavejs2mqtt version: 1.1..0
zwavejs version: 6.1.3

Describe the bug

Some of my sensors are showing as Security enabled, I have never enabled security on my zwave. Discovered this when waking devices to get them to report in correctly in the control panel (they stay in RestartFromCache after a container restart). I thought this was an issue but have since learned it is not a problem.

Have a variety of devices but they all follow same pattern :
6 Aeotec Trisensors all show as Secure,
2 Aeotec sensor 6's on mains power show as No Security,
TKB Plugs are Not Secure,
Fibaro Plugs are Secure,
2 Fibaro motion detectors on battery are Secure
Controller itself (Aeotec stick) shows as Not Secure

When I say "added Securely" I mean the zwavejs2mqtt panel shows the device as Secure. There is no key set in the control panel.

To Reproduce

Excluded a node, and added it again (node 39) via the zwavejs2mqtt control panel making sure to ask for "normal" inclusion, Not Secure - , added Securely ! Device is working OK, HomeAssistant shows the motion .

Expected behavior

Since I have no key set, I would expect all my devices to be included in Non-Secure mode

Additional context

I dont know that they are actually in Secure mode, or if it is a UI glitch
The devices appear to work. This stick was originally in OZW, then running various betas of both zwavejs2matt and HA in preperation for the recent new zwaveJS integration in HA. I am using zwavejs2mqtt for the WS Server and the control panel. MQTT is disabled

Enclosed are the two log files and the JSON export for node 39

FYI, the Slack channel link on project page is expired.

node_39.zip
zwavejs2mqtt-store.zip
zwavejs2mqtt-store (1).zip

[maivorbim]

Can confirm I am having the same behaviour on two separate installations. It appears this happens randomly.

[robertsLando]

@AlCalzone, any clue?

[AlCalzone]

@robertsLando you're still treating the secure flag as a boolean :)

  "isSecure": "unknown",

[robertsLando]

Didn't know there was also unknown as valid value 😕

[deccos]

I see the PR to fix the issue in terms of displying the Security Status correctly - Secure, Insecure or Unknown. But why would it be Unknown in the first place ? Would that be caused by my legacy usage of the stick on other zwave platforms before zwavejs2mqtt ?

[AlCalzone]

That just means we don't know yet

[maivorbim]

That just means we don't know yet

Is this normal to happen even after the node is complete? Below screenshot shows a device which was included in non-secure mode, but appears as secure:

[AlCalzone]

Isn't the first "No" for secure?

[robertsLando]

It is, it's not 'unknown' anymore

[maivorbim]

Sorry, wrong crop 😨 Both devices were included in non-secure mode.

[AlCalzone]

Can you share your cache files?

[maivorbim]

Nodes 24, 26, 57, 60 and 64 are trouble nodes. Rename file to .json
eafc1bd8.txt

[AlCalzone]

At least node 24 claims that it is secure. Could it be that the device was once secure and you didn't hard-reset it before inclusion? Then it will still have the network key and communicate securely.
If you look at the logs, you should see if Security CC is used for communication with these nodes.

[maivorbim]

The devices are brand new and this is the first time they were included in a network. Unless they were factory tested with security enabled...

I have attached zwave logs. Relevant excerpts are:

00:37:49.471 DRIVER » [Node 024] [REQ] [SendData]
│ transmit options: 0x25
│ callback id: 162
└─[SecurityCCNonceGet]

00:37:50.792 DRIVER « [Node 024] [REQ] [ApplicationCommand]
└─[SecurityCCNonceReport]
nonce: 0x3a33a50dcf1a1a71
00:37:50.797 SERIAL » 0x011d00131816988161eec206c7690e894624013ad1052bb5f861442825a3e4 (31 bytes)
00:37:50.797 DRIVER » [Node 024] [REQ] [SendData]
│ transmit options: 0x25
│ callback id: 163
└─[SecurityCCCommandEncapsulation]
│ nonce id: 58
└─[SecurityCCCommandsSupportedGet]
00:37:50.800 SERIAL « [ACK] (0x06)
00:37:50.807 SERIAL « 0x0104011301e8 (6 bytes)
00:37:50.807 SERIAL » [ACK] (0x06)
00:37:50.808 DRIVER « [RES] [SendData]
was sent: true
00:37:50.827 SERIAL « 0x01070013a30000034b (9 bytes)
00:37:50.827 SERIAL » [ACK] (0x06)
00:37:50.828 DRIVER « [REQ] [SendData]
callback id: 163
transmit status: OK
00:38:00.838 SERIAL » 0x010900131a02984025a4a4 (11 bytes)

00:38:00.838 CNTRLR [Node 024] Timed out while waiting for a response from the node
00:38:00.838 CNTRLR [Node 024] Querying securely supported commands timed out, skipping Security i
nterview...
00:38:00.847 SERIAL « [ACK] (0x06)
00:38:00.847 SERIAL « 0x0104011301e8 (6 bytes)

zwavejs_358.log

[AlCalzone]

Hm okay - they respond to the nonce report and then don't respond to the query of secure commands - but at that point the node is already assumed to be secure. I'll revert zwave-js/node-zwave-js#1569, that causes this issue.