feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule

- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS) - reference/namespace-vrf/: Linux namespace/VRF network isolation docs - apps/android-agent: VPN permission check, StartResult sealed class
2026-09-13 14:39:24 +07:00
parent 88fa60901e
commit e523398fa8
31 changed files with 6766 additions and 1 deletions
@@ -0,0 +1,106 @@
+/**
+ * @file tunnel.c
+ * @brief WireGuard Tunnel Management (Stub)
+ *
+ * TODO: Integrate wireguard-esp32 component for actual WireGuard tunnel.
+ * These are stubs that log and maintain state for the heartbeat loop.
+ */
+
+#include <string.h>
+#include <time.h>
+#include "tunnel.h"
+#include "config.h"
+#include "esp_log.h"
+
+static const char *TAG = "nexus_tunnel";
+
+/* Tunnel state */
+static bool s_tunnel_up = false;
+static int64_t s_last_handshake = 0;
+
+esp_err_t tunnel_init(const wg_config_t *config)
+{
+    if (config == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_LOGI(TAG, "Initializing WireGuard tunnel...");
+    ESP_LOGI(TAG, "  Device: %s", config->device_id);
+    ESP_LOGI(TAG, "  Endpoint: %s", config->endpoint);
+    ESP_LOGI(TAG, "  Internal IP: %s", config->internal_ip);
+    ESP_LOGI(TAG, "  Allowed IPs: %s", config->allowed_ips);
+
+    /* TODO: integrate wireguard-esp32 component */
+    /* Steps when integrated:
+     * 1. Parse private_key hex to binary
+     * 2. Parse server_pub hex to binary
+     * 3. Parse preshared_key hex to binary
+     * 4. Create WireGuard device with private_key
+     * 5. Add peer with server_pub, preshared_key, endpoint
+     * 6. Set peer allowed_ips
+     * 7. Start WireGuard tunnel
+     */
+
+    /* Stub: mark tunnel as up and record handshake time */
+    s_tunnel_up = true;
+    s_last_handshake = (int64_t)time(NULL);
+
+    ESP_LOGI(TAG, "WireGuard tunnel initialized (stub)");
+    return ESP_OK;
+}
+
+esp_err_t tunnel_apply_config(const wg_config_t *config)
+{
+    if (config == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_LOGI(TAG, "Applying WireGuard config...");
+    ESP_LOGI(TAG, "  Endpoint: %s", config->endpoint);
+
+    /* TODO: integrate wireguard-esp32 component */
+    /* Steps when integrated:
+     * 1. Stop existing tunnel
+     * 2. Reconfigure device with new keys
+     * 3. Reconfigure peer with new endpoint/allowed_ips
+     * 4. Restart tunnel
+     */
+
+    s_tunnel_up = true;
+    s_last_handshake = (int64_t)time(NULL);
+
+    ESP_LOGI(TAG, "WireGuard config applied (stub)");
+    return ESP_OK;
+}
+
+esp_err_t tunnel_rebuild(const wg_config_t *config)
+{
+    if (config == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_LOGI(TAG, "Rebuilding WireGuard tunnel...");
+
+    /* Mark tunnel down during rebuild */
+    s_tunnel_up = false;
+
+    /* Apply new config */
+    esp_err_t err = tunnel_apply_config(config);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Tunnel rebuild failed: %s", esp_err_to_name(err));
+        return err;
+    }
+
+    ESP_LOGI(TAG, "WireGuard tunnel rebuilt successfully");
+    return ESP_OK;
+}
+
+int64_t tunnel_get_last_handshake(void)
+{
+    return s_last_handshake;
+}
+
+bool tunnel_is_up(void)
+{
+    return s_tunnel_up;
+}