datadunia
e523398fa8
- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS) - reference/namespace-vrf/: Linux namespace/VRF network isolation docs - apps/android-agent: VPN permission check, StartResult sealed class
249 lines
7.9 KiB
C
249 lines
7.9 KiB
C
/**
|
|
* @file main.c
|
|
* @brief NexusGuard Embedded Agent - Main Entry Point
|
|
*
|
|
* ESP32-based WireGuard agent for IoT/edge devices.
|
|
* Connects to NexusGuard Server Core via HTTP provisioning + heartbeat.
|
|
*
|
|
* @version 1.0.0
|
|
* @date 2026-06-26
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include "freertos/FreeRTOS.h"
|
|
#include "freertos/task.h"
|
|
#include "freertos/event_groups.h"
|
|
#include "esp_system.h"
|
|
#include "esp_wifi.h"
|
|
#include "esp_event.h"
|
|
#include "esp_log.h"
|
|
#include "esp_ota_ops.h"
|
|
#include "nvs_flash.h"
|
|
|
|
/* Agent modules */
|
|
#include "config.h"
|
|
#include "wifi.h"
|
|
#include "provision.h"
|
|
#include "heartbeat.h"
|
|
#include "tunnel.h"
|
|
#include "crypto.h"
|
|
|
|
static const char *TAG = "nexusguard";
|
|
|
|
/* Event bits */
|
|
#define WIFI_CONNECTED_BIT BIT0
|
|
#define PROVISIONED_BIT BIT1
|
|
#define TUNNEL_UP_BIT BIT2
|
|
#define HEARTBEAT_OK_BIT BIT3
|
|
|
|
static EventGroupHandle_t s_event_group;
|
|
|
|
/* Agent configuration */
|
|
static wg_config_t s_config;
|
|
static device_state_t s_state = STATE_BOOT;
|
|
|
|
/**
|
|
* @brief Get hardware ID from ESP32 eFuse MAC
|
|
*/
|
|
static void get_hardware_id(char *hwid, size_t len)
|
|
{
|
|
uint8_t mac[6];
|
|
esp_efuse_mac_get_default(mac);
|
|
snprintf(hwid, len, "%02x%02x%02x%02x%02x%02x",
|
|
mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
|
|
}
|
|
|
|
/**
|
|
* @brief WiFi event handler
|
|
*/
|
|
static void wifi_event_handler(void *arg, esp_event_base_t event_base,
|
|
int32_t event_id, void *event_data)
|
|
{
|
|
if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_START) {
|
|
esp_wifi_connect();
|
|
} else if (event_base == WIFI_EVENT && event_id == WIFI_EVENT_STA_DISCONNECTED) {
|
|
ESP_LOGW(TAG, "WiFi disconnected, reconnecting...");
|
|
esp_wifi_connect();
|
|
xEventGroupClearBits(s_event_group, WIFI_CONNECTED_BIT);
|
|
} else if (event_base == IP_EVENT && event_id == IP_EVENT_STA_GOT_IP) {
|
|
ip_event_got_ip_t *event = (ip_event_got_ip_t *)event_data;
|
|
ESP_LOGI(TAG, "Got IP: " IPSTR, IP2STR(&event->ip_info.ip));
|
|
xEventGroupSetBits(s_event_group, WIFI_CONNECTED_BIT);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Initialize WiFi
|
|
*/
|
|
static esp_err_t init_wifi(const char *ssid, const char *password)
|
|
{
|
|
ESP_LOGI(TAG, "Initializing WiFi...");
|
|
|
|
ESP_ERROR_CHECK(esp_netif_init());
|
|
ESP_ERROR_CHECK(esp_event_loop_create_default());
|
|
esp_netif_create_default_wifi_sta();
|
|
|
|
wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
|
|
ESP_ERROR_CHECK(esp_wifi_init(&cfg));
|
|
|
|
esp_event_handler_instance_t instance_any_id;
|
|
esp_event_handler_instance_t instance_got_ip;
|
|
ESP_ERROR_CHECK(esp_event_handler_instance_register(WIFI_EVENT, ESP_EVENT_ANY_ID,
|
|
&wifi_event_handler, NULL, &instance_any_id));
|
|
ESP_ERROR_CHECK(esp_event_handler_instance_register(IP_EVENT, IP_EVENT_STA_GOT_IP,
|
|
&wifi_event_handler, NULL, &instance_got_ip));
|
|
|
|
wifi_config_t wifi_config = {
|
|
.sta = {
|
|
.threshold.authmode = WIFI_AUTH_WPA2_PSK,
|
|
},
|
|
};
|
|
|
|
strncpy((char *)wifi_config.sta.ssid, ssid, sizeof(wifi_config.sta.ssid) - 1);
|
|
strncpy((char *)wifi_config.sta.password, password, sizeof(wifi_config.sta.password) - 1);
|
|
|
|
ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));
|
|
ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &wifi_config));
|
|
ESP_ERROR_CHECK(esp_wifi_start());
|
|
|
|
ESP_LOGI(TAG, "WiFi initialized, connecting to %s...", ssid);
|
|
|
|
return ESP_OK;
|
|
}
|
|
|
|
/**
|
|
* @brief Main entry point
|
|
*/
|
|
void app_main(void)
|
|
{
|
|
ESP_LOGI(TAG, "=== NexusGuard Embedded Agent v%s ===", CONFIG_NEXUS_AGENT_VERSION);
|
|
ESP_LOGI(TAG, "Hardware: %s", CONFIG_IDF_TARGET);
|
|
ESP_LOGI(TAG, "IDF Version: %s", esp_get_idf_version());
|
|
ESP_LOGI(TAG, "Server: %s", CONFIG_NEXUS_SERVER_URL);
|
|
|
|
/* Initialize NVS */
|
|
esp_err_t ret = nvs_flash_init();
|
|
if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) {
|
|
ESP_ERROR_CHECK(nvs_flash_erase());
|
|
ret = nvs_flash_init();
|
|
}
|
|
ESP_ERROR_CHECK(ret);
|
|
|
|
/* Create event group */
|
|
s_event_group = xEventGroupCreate();
|
|
|
|
/* Get hardware ID */
|
|
char hwid[32];
|
|
get_hardware_id(hwid, sizeof(hwid));
|
|
ESP_LOGI(TAG, "Hardware ID: %s", hwid);
|
|
|
|
/* Initialize modules */
|
|
ESP_ERROR_CHECK(config_init());
|
|
ESP_ERROR_CHECK(crypto_init());
|
|
|
|
/* Load saved config */
|
|
ret = config_load(&s_config);
|
|
if (ret == ESP_OK && config_is_valid(&s_config)) {
|
|
ESP_LOGI(TAG, "Loaded saved config for device: %s", s_config.device_id);
|
|
xEventGroupSetBits(s_event_group, PROVISIONED_BIT);
|
|
} else {
|
|
ESP_LOGW(TAG, "No valid config found, will provision...");
|
|
}
|
|
|
|
/* Initialize WiFi */
|
|
const char *ssid = CONFIG_NEXUS_WIFI_SSID;
|
|
const char *password = CONFIG_NEXUS_WIFI_PASSWORD;
|
|
|
|
if (strlen(ssid) == 0) {
|
|
ESP_LOGE(TAG, "WiFi SSID not configured! Set via menuconfig or NVS.");
|
|
ESP_LOGE(TAG, "Run: idf.py menuconfig → Component config → NexusGuard Agent");
|
|
return;
|
|
}
|
|
|
|
init_wifi(ssid, password);
|
|
|
|
/* Wait for WiFi connection */
|
|
ESP_LOGI(TAG, "Waiting for WiFi connection...");
|
|
xEventGroupWaitBits(s_event_group, WIFI_CONNECTED_BIT, pdFALSE, pdTRUE,
|
|
pdMS_TO_TICKS(30000));
|
|
|
|
if (!(xEventGroupGetBits(s_event_group) & WIFI_CONNECTED_BIT)) {
|
|
ESP_LOGE(TAG, "WiFi connection failed, restarting...");
|
|
esp_restart();
|
|
}
|
|
|
|
ESP_LOGI(TAG, "WiFi connected!");
|
|
|
|
/* Provision if needed */
|
|
if (!(xEventGroupGetBits(s_event_group) & PROVISIONED_BIT)) {
|
|
ESP_LOGI(TAG, "Provisioning device...");
|
|
s_state = STATE_PROVISIONING;
|
|
|
|
const char *server_url = CONFIG_NEXUS_SERVER_URL;
|
|
const char *token = CONFIG_NEXUS_REG_TOKEN;
|
|
|
|
if (strlen(server_url) == 0 || strlen(token) == 0) {
|
|
ESP_LOGE(TAG, "Server URL or registration token not configured!");
|
|
ESP_LOGE(TAG, "Run: idf.py menuconfig → Component config → NexusGuard Agent");
|
|
return;
|
|
}
|
|
|
|
ret = provision_device(server_url, token, hwid, &s_config);
|
|
if (ret != ESP_OK) {
|
|
ESP_LOGE(TAG, "Provisioning failed: %s", esp_err_to_name(ret));
|
|
ESP_LOGE(TAG, "Restarting in 5 seconds...");
|
|
vTaskDelay(pdMS_TO_TICKS(5000));
|
|
esp_restart();
|
|
}
|
|
|
|
ESP_LOGI(TAG, "Provisioning successful!");
|
|
xEventGroupSetBits(s_event_group, PROVISIONED_BIT);
|
|
}
|
|
|
|
/* Initialize WireGuard tunnel */
|
|
ESP_LOGI(TAG, "Initializing WireGuard tunnel...");
|
|
s_state = STATE_TUNNEL_UP;
|
|
|
|
ret = tunnel_init(&s_config);
|
|
if (ret != ESP_OK) {
|
|
ESP_LOGE(TAG, "Tunnel initialization failed: %s", esp_err_to_name(ret));
|
|
ESP_LOGE(TAG, "Restarting in 5 seconds...");
|
|
vTaskDelay(pdMS_TO_TICKS(5000));
|
|
esp_restart();
|
|
}
|
|
|
|
ESP_LOGI(TAG, "WireGuard tunnel initialized!");
|
|
xEventGroupSetBits(s_event_group, TUNNEL_UP_BIT);
|
|
|
|
/* Main heartbeat loop */
|
|
ESP_LOGI(TAG, "Starting heartbeat loop...");
|
|
s_state = STATE_HEARTBEAT;
|
|
|
|
while (1) {
|
|
/* Wait for 30 seconds */
|
|
vTaskDelay(pdMS_TO_TICKS(30000));
|
|
|
|
/* Check WiFi */
|
|
if (!(xEventGroupGetBits(s_event_group) & WIFI_CONNECTED_BIT)) {
|
|
ESP_LOGW(TAG, "WiFi not connected, skipping heartbeat");
|
|
continue;
|
|
}
|
|
|
|
/* Send heartbeat */
|
|
bool tunnel_up = tunnel_is_up();
|
|
int64_t last_hs = tunnel_get_last_handshake();
|
|
|
|
ret = heartbeat_send(&s_config, "connected", tunnel_up, last_hs);
|
|
if (ret != ESP_OK) {
|
|
ESP_LOGW(TAG, "Heartbeat failed: %s", esp_err_to_name(ret));
|
|
continue;
|
|
}
|
|
|
|
ESP_LOGI(TAG, "Heartbeat sent (tunnel=%s)", tunnel_up ? "up" : "down");
|
|
|
|
/* Check for config changes */
|
|
// TODO: Compare config hash and rebuild tunnel if needed
|
|
}
|
|
}
|