feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS) - reference/namespace-vrf/: Linux namespace/VRF network isolation docs - apps/android-agent: VPN permission check, StartResult sealed class
2026-09-13 14:39:24 +07:00
parent 88fa60901e
commit e523398fa8
31 changed files with 6766 additions and 1 deletions
@@ -0,0 +1,248 @@
+/**
+ * @file main.c
+ * @brief NexusGuard Embedded Agent - Main Entry Point
+ * 
+ * ESP32-based WireGuard agent for IoT/edge devices.
+ * Connects to NexusGuard Server Core via HTTP provisioning + heartbeat.
+ * 
+ * @version 1.0.0
+ * @date 2026-06-26
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/event_groups.h"
+#include "esp_system.h"
+#include "esp_wifi.h"
+#include "esp_event.h"
+#include "esp_log.h"
+#include "esp_ota_ops.h"
+#include "nvs_flash.h"
+
+/* Agent modules */
+#include "config.h"
+#include "wifi.h"
+#include "provision.h"
+#include "heartbeat.h"
+#include "tunnel.h"
+#include "crypto.h"
+
+static const char *TAG = "nexusguard";
+
+/* Event bits */
+#define WIFI_CONNECTED_BIT    BIT0
+#define PROVISIONED_BIT       BIT1
+#define TUNNEL_UP_BIT         BIT2
+#define HEARTBEAT_OK_BIT      BIT3
+
+static EventGroupHandle_t s_event_group;
+
+/* Agent configuration */
+static wg_config_t s_config;
+static device_state_t s_state = STATE_BOOT;
+
+/**
+ * @brief Get hardware ID from ESP32 eFuse MAC
+ */
+static void get_hardware_id(char *hwid, size_t len)
+{
+    uint8_t mac[6];
+    esp_efuse_mac_get_default(mac);
+    snprintf(hwid, len, "%02x%02x%02x%02x%02x%02x",
+             mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+}
+
+/**
+ * @brief WiFi event handler
+ */
+static void wifi_event_handler(void *arg, esp_event_base_t event_base,
+                               int32_t event_id, void *event_data)
+{
+    if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) {
+        esp_wifi_connect();
+    } else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) {
+        ESP_LOGW(TAG, "WiFi disconnected, reconnecting...");
+        esp_wifi_connect();
+        xEventGroupClearBits(s_event_group, WIFI_CONNECTED_BIT);
+    } else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) {
+        ip_event_got_ip_t *event = (ip_event_got_ip_t *)event_data;
+        ESP_LOGI(TAG, "Got IP: " IPSTR, IP2STR(&event->ip_info.ip));
+        xEventGroupSetBits(s_event_group, WIFI_CONNECTED_BIT);
+    }
+}
+
+/**
+ * @brief Initialize WiFi
+ */
+static esp_err_t init_wifi(const char *ssid, const char *password)
+{
+    ESP_LOGI(TAG, "Initializing WiFi...");
+    
+    ESP_ERROR_CHECK(esp_netif_init());
+    ESP_ERROR_CHECK(esp_event_loop_create_default());
+    esp_netif_create_default_wifi_sta();
+    
+    wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
+    ESP_ERROR_CHECK(esp_wifi_init(&cfg));
+    
+    esp_event_handler_instance_t instance_any_id;
+    esp_event_handler_instance_t instance_got_ip;
+    ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID,
+                    &wifi_event_handler, NULL, &instance_any_id));
+    ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP,
+                    &wifi_event_handler, NULL, &instance_got_ip));
+    
+    wifi_config_t wifi_config = {
+        .sta = {
+            .threshold.authmode = WIFI_AUTH_WPA2_PSK,
+        },
+    };
+    
+    strncpy((char *)wifi_config.sta.ssid, ssid, sizeof(wifi_config.sta.ssid) - 1);
+    strncpy((char *)wifi_config.sta.password, password, sizeof(wifi_config.sta.password) - 1);
+    
+    ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));
+    ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config));
+    ESP_ERROR_CHECK(esp_wifi_start());
+    
+    ESP_LOGI(TAG, "WiFi initialized, connecting to %s...", ssid);
+    
+    return ESP_OK;
+}
+
+/**
+ * @brief Main entry point
+ */
+void app_main(void)
+{
+    ESP_LOGI(TAG, "=== NexusGuard Embedded Agent v%s ===", CONFIG_NEXUS_AGENT_VERSION);
+    ESP_LOGI(TAG, "Hardware: %s", CONFIG_IDF_TARGET);
+    ESP_LOGI(TAG, "IDF Version: %s", esp_get_idf_version());
+    ESP_LOGI(TAG, "Server: %s", CONFIG_NEXUS_SERVER_URL);
+    
+    /* Initialize NVS */
+    esp_err_t ret = nvs_flash_init();
+    if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) {
+        ESP_ERROR_CHECK(nvs_flash_erase());
+        ret = nvs_flash_init();
+    }
+    ESP_ERROR_CHECK(ret);
+    
+    /* Create event group */
+    s_event_group = xEventGroupCreate();
+    
+    /* Get hardware ID */
+    char hwid[32];
+    get_hardware_id(hwid, sizeof(hwid));
+    ESP_LOGI(TAG, "Hardware ID: %s", hwid);
+    
+    /* Initialize modules */
+    ESP_ERROR_CHECK(config_init());
+    ESP_ERROR_CHECK(crypto_init());
+    
+    /* Load saved config */
+    ret = config_load(&s_config);
+    if (ret == ESP_OK && config_is_valid(&s_config)) {
+        ESP_LOGI(TAG, "Loaded saved config for device: %s", s_config.device_id);
+        xEventGroupSetBits(s_event_group, PROVISIONED_BIT);
+    } else {
+        ESP_LOGW(TAG, "No valid config found, will provision...");
+    }
+    
+    /* Initialize WiFi */
+    const char *ssid = CONFIG_NEXUS_WIFI_SSID;
+    const char *password = CONFIG_NEXUS_WIFI_PASSWORD;
+    
+    if (strlen(ssid) == 0) {
+        ESP_LOGE(TAG, "WiFi SSID not configured! Set via menuconfig or NVS.");
+        ESP_LOGE(TAG, "Run: idf.py menuconfig → Component config → NexusGuard Agent");
+        return;
+    }
+    
+    init_wifi(ssid, password);
+    
+    /* Wait for WiFi connection */
+    ESP_LOGI(TAG, "Waiting for WiFi connection...");
+    xEventGroupWaitBits(s_event_group, WIFI_CONNECTED_BIT, pdFALSE, pdTRUE, 
+                        pdMS_TO_TICKS(30000));
+    
+    if (!(xEventGroupGetBits(s_event_group) & WIFI_CONNECTED_BIT)) {
+        ESP_LOGE(TAG, "WiFi connection failed, restarting...");
+        esp_restart();
+    }
+    
+    ESP_LOGI(TAG, "WiFi connected!");
+    
+    /* Provision if needed */
+    if (!(xEventGroupGetBits(s_event_group) & PROVISIONED_BIT)) {
+        ESP_LOGI(TAG, "Provisioning device...");
+        s_state = STATE_PROVISIONING;
+        
+        const char *server_url = CONFIG_NEXUS_SERVER_URL;
+        const char *token = CONFIG_NEXUS_REG_TOKEN;
+        
+        if (strlen(server_url) == 0 || strlen(token) == 0) {
+            ESP_LOGE(TAG, "Server URL or registration token not configured!");
+            ESP_LOGE(TAG, "Run: idf.py menuconfig → Component config → NexusGuard Agent");
+            return;
+        }
+        
+        ret = provision_device(server_url, token, hwid, &s_config);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "Provisioning failed: %s", esp_err_to_name(ret));
+            ESP_LOGE(TAG, "Restarting in 5 seconds...");
+            vTaskDelay(pdMS_TO_TICKS(5000));
+            esp_restart();
+        }
+        
+        ESP_LOGI(TAG, "Provisioning successful!");
+        xEventGroupSetBits(s_event_group, PROVISIONED_BIT);
+    }
+    
+    /* Initialize WireGuard tunnel */
+    ESP_LOGI(TAG, "Initializing WireGuard tunnel...");
+    s_state = STATE_TUNNEL_UP;
+    
+    ret = tunnel_init(&s_config);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "Tunnel initialization failed: %s", esp_err_to_name(ret));
+        ESP_LOGE(TAG, "Restarting in 5 seconds...");
+        vTaskDelay(pdMS_TO_TICKS(5000));
+        esp_restart();
+    }
+    
+    ESP_LOGI(TAG, "WireGuard tunnel initialized!");
+    xEventGroupSetBits(s_event_group, TUNNEL_UP_BIT);
+    
+    /* Main heartbeat loop */
+    ESP_LOGI(TAG, "Starting heartbeat loop...");
+    s_state = STATE_HEARTBEAT;
+    
+    while (1) {
+        /* Wait for 30 seconds */
+        vTaskDelay(pdMS_TO_TICKS(30000));
+        
+        /* Check WiFi */
+        if (!(xEventGroupGetBits(s_event_group) & WIFI_CONNECTED_BIT)) {
+            ESP_LOGW(TAG, "WiFi not connected, skipping heartbeat");
+            continue;
+        }
+        
+        /* Send heartbeat */
+        bool tunnel_up = tunnel_is_up();
+        int64_t last_hs = tunnel_get_last_handshake();
+        
+        ret = heartbeat_send(&s_config, "connected", tunnel_up, last_hs);
+        if (ret != ESP_OK) {
+            ESP_LOGW(TAG, "Heartbeat failed: %s", esp_err_to_name(ret));
+            continue;
+        }
+        
+        ESP_LOGI(TAG, "Heartbeat sent (tunnel=%s)", tunnel_up ? "up" : "down");
+        
+        /* Check for config changes */
+        // TODO: Compare config hash and rebuild tunnel if needed
+    }
+}