Feature/dlklap transport by tedholtz · Pull Request #1729 · python-kasa/python-kasa · GitHub

Summary

Adds first-class support for the TP-Link DL100 smart lock via a new
DlklapTransport and a Lock SmartModule. Closes #1693.

The DL100 speaks DLKLAP, a proprietary KLAP variant that runs over plain
HTTP :80 and requires a cloud-assisted handshake0 step to mint a
per-session controlKey before the usual KLAP handshake1/handshake2 and
AES-128-CBC session encryption. This transport implements that full pipeline
and slots into the existing Transport / Protocol / Device layering.

What is DLKLAP?

Standard KLAP handshakes are fully local. DLKLAP inserts two cloud round-trips:

Cloud login (wap.tplinkcloud.com) → account token + accountId.
handshake0 to the lock over HTTP → a 236-char base64 secret (this
also wakes the lock's radio).
control-key exchange (*.tplinknbu.com) binds that secret to a
per-session controlKey.
handshake1 / handshake2 then proceed like KLAP, deriving the AES session
keys (lsk/ldk/iv) used for /app/request.

Full protocol write-up is in #1693.

Changes

kasa/transports/dlklaptransport.py — DlklapTransport(BaseTransport)
- _DlklapSession. Implements
  handshake0 → control-key → handshake1 → handshake2 → session-key derivation,
  session caching, and single-retry re-handshake on failure. Handshakes are
  serialized (asyncio.Lock) since a second handshake0 invalidates the first
  control key (device error 15033).
kasa/smart/modules/lock.py — Lock(SmartModule):
is_locked, lock(), unlock(), battery, battery_low.
Device/discovery wiring — DeviceEncryptionType.Dlklap = "DLKLAP",
DeviceFamily.SmartTapoLock = "SMART.TAPOLOCK", DeviceType.Lock, the
SMART.DLKLAP → (SmartProtocol, DlklapTransport) mapping in
device_factory.py, and the SMART.TAPOLOCK → DeviceType.Lock mapping in
smartdevice.py.
Tests — tests/smart/modules/test_lock.py (mocked, no live device) plus a
redacted DL100 fixture folded into the parametrized SMART suite.
pyproject.toml — adds httpx to dependencies.

Behavior notes for reviewers

httpx used directly (not HttpClient) in the transport. This is
deliberate: the 33-byte binary handshake0 body must be sent verbatim, and
wrapping middleware re-encodes the text/plain payload and breaks the
handshake. Happy to revisit if there's a preferred integration point.
verify=False is scoped to a single call. The control-key host presents
TP-Link's private CA (not a public root), so TLS verification is disabled for
that one request only (# noqa: S501 with a comment). The cloud login
call, which carries the account password, stays fully verified.
Battery lives on the Lock module because the DL100 lacks the
battery_detect component, so the generic BatterySensor never loads.
Lock-status polarity is counterintuitive and verified: 0 = LOCKED
(bolt extended), 1 = UNLOCKED. Confirmed against decompiled
EnumDoorLockStatus and the live device — not inverted.

Testing

Unit tests: pytest tests/smart/modules/test_lock.py — all pass
(module presence, is_locked polarity, lock()/unlock() payload with
owner-forbidden fields excluded, battery).
Full suite: pytest tests/ — 22,856 passed, 883 skipped, 0 failures,
including the test_devtools.py fixture round-trip check.
Type/lint: mypy clean on the new files; ruff/ruff format clean.
Live device: verified end-to-end against a real DL100 (fw 1.0.17) via
device_factory.connect() → update() — is_locked=True (lock_status 0),
battery_level=81, battery_low=False.

Known limitations / follow-ups

_ensure_device_id can't disambiguate multiple locks on one account (the
cloud device list has no LAN IP), so it picks the sole SMART.TAPOLOCK.
A future config override could address multi-lock setups.
The DL100 advertises a speaker component it doesn't implement
(getVolume → UNKNOWN_METHOD_ERROR); handled gracefully (module marked
unavailable). Cosmetic device quirk, not a bug.
This transport requires cloud round-trips (wap.tplinkcloud.com, tplinknbu.com) mid-handshake. The DL100 mints its controlKey via the cloud (there's no local-only path). The correct local-first implementation necessarily includes these minimal cloud round-trips.

... (use the commit body from the spec)

Codecov Report

❌ Patch coverage is 96.89655% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.39%. Comparing base (a29d061) to head (50e83fd).

Files with missing lines	Patch %	Lines
kasa/transports/dlklaptransport.py	97.17%	4 Missing and 3 partials ⚠️
kasa/smart/modules/lock.py	94.11%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1729      +/-   ##
==========================================
+ Coverage   93.29%   93.39%   +0.10%     
==========================================
  Files         157      159       +2     
  Lines        9932    10222     +290     
  Branches     1022     1052      +30     
==========================================
+ Hits         9266     9547     +281     
- Misses        471      475       +4     
- Partials      195      200       +5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

CodeQL False Positive: SHA256 is required by the DLKLAP handshake (auth-hash derivation), not password storage. Mirrors the existing _sha256 in klaptransport.py, which carries the same # noqa: S324. Safe to dismiss.

Thanks for this work @tedholtz

Hope it gets committed so I can test it out!

I have 2 locks, a DL105 and a DL110. I was able to get them both working with this by adding the models in device_fixtures and changing _ensure_device_id to look up the MAC address for the IP and match on that:

mac = get_mac_address(ip=self._host)
mac = mac.replace(":", "").upper()
locks = [d for d in devices if d.get("deviceMac") == mac]

I have 2 locks, a DL105 and a DL110. I was able to get them both working ...

@rale thanks for testing.

tedholtz added 5 commits July 24, 2026 18:20

create an initial implementation of dlklap and a dl100 lock

31deb96

Add battery to lock.py

830816d

unit tests. mostly passing.

ead358a

all unit tests are passing.

4c69f02

feat: add DlklapTransport and Lock module for DL100 smart lock

99154ef

... (use the commit body from the spec)

tedholtz mentioned this pull request Jul 25, 2026

Add support for Tapo DL100 Smart Wi-Fi Door Lock (uses DLKLAP encryption over HTTP) #1693

Open

github-advanced-security Bot found potential problems Jul 25, 2026

View reviewed changes

Comment thread kasa/transports/dlklaptransport.py Fixed

tedholtz added 2 commits July 25, 2026 12:27

resolve mypy and generate-supported failures for Lock module

74a5749

resolve pre-commit and security failures for the DL100 Lock module

0a3e6a6

tedholtz added 2 commits July 25, 2026 13:05

add unit tests for the DLKLAP transport

f382c3f

fix linting errors

50e83fd

tedholtz commented Jul 27, 2026

View reviewed changes

Feature/dlklap transport by tedholtz · Pull Request #1729 · python-kasa/python-kasa · GitHub

Uh oh!

Uh oh!

Feature/dlklap transport - #1729

Feature/dlklap transport#1729
tedholtz wants to merge 9 commits into
python-kasa:masterfrom
tedholtz:feature/dlklap-transport

tedholtz commented Jul 25, 2026 •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jul 25, 2026 •
edited
Loading

Uh oh!

Uh oh!

tedholtz Jul 27, 2026 •
edited
Loading

Uh oh!

Uh oh!

smithad150 commented Jul 30, 2026

Uh oh!

rale commented Aug 2, 2026 •
edited
Loading

Uh oh!

Uh oh!

tedholtz commented Aug 2, 2026 •
edited
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants



		def _sha256(payload: bytes) -> bytes:
		return hashlib.sha256(payload).digest() # noqa: S324

Feature/dlklap transport by tedholtz · Pull Request #1729 · python-kasa/python-kasa · GitHub

Uh oh!

Uh oh!

Feature/dlklap transport - #1729

Feature/dlklap transport#1729tedholtz wants to merge 9 commits intopython-kasa:masterpython-kasa/python-kasa:masterfrom tedholtz:feature/dlklap-transporttedholtz/python-kasa:feature/dlklap-transportCopy head branch name to clipboard

Conversation

tedholtz commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What is DLKLAP?

Changes

Behavior notes for reviewers

Testing

Known limitations / follow-ups

Uh oh!

Uh oh!

codecov Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tedholtz Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

smithad150 commented Jul 30, 2026

Uh oh!

rale commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tedholtz commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Feature/dlklap transport#1729
tedholtz wants to merge 9 commits into
python-kasa:masterfrom
tedholtz:feature/dlklap-transport

tedholtz commented Jul 25, 2026 •
edited
Loading

codecov Bot commented Jul 25, 2026 •
edited
Loading

tedholtz Jul 27, 2026 •
edited
Loading

rale commented Aug 2, 2026 •
edited
Loading

tedholtz commented Aug 2, 2026 •
edited
Loading