From 851801f50f1282ab1db5f8a241dbd245f59e447e Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 23 May 2026 04:10:28 +0530 Subject: Phase 5: Wire main/ shims to components/tollgate_core - session.c/h: thin shim casting session_t* <-> tg_session_t*, delegates to tollgate_core_session_* - firewall.c/h: keeps ESP-specific lwIP hooks, delegates allowlist to tollgate_core_fw_* - cashu.c/h: shim delegates to tollgate_core_cashu_*, multi-mint via config directly - mining_payment.c: shim delegates to tollgate_core_mining_* - tollgate_main.c: calls tollgate_core_init(tollgate_esp_get_platform(), ap_ip) in start_services() - tollgate_esp: removed target_sources for standalone sources, depends on tollgate_core component - tollgate_core component: added tollgate_core_get_platform(), tg_payment_method_t enum - Unit tests: updated Makefile for component source compilation, all 22 tests pass - Hardware verified: Board A boots, AP visible, 5/6 smoke tests pass (internet test needs upstream WiFi) --- main/firewall.c | 124 ++++++++++---------------------------------------------- 1 file changed, 21 insertions(+), 103 deletions(-) (limited to 'main/firewall.c') diff --git a/main/firewall.c b/main/firewall.c index ae0eda7..077d16c 100644 --- a/main/firewall.c +++ b/main/firewall.c @@ -1,70 +1,23 @@ #include "firewall.h" #include "dns_server.h" +#include "tollgate_core.h" +#include "tollgate_core_firewall.h" #include "esp_log.h" -#include "esp_wifi.h" -#include "esp_wifi_ap_get_sta_list.h" -#include "lwip/lwip_napt.h" -#include "lwip/etharp.h" #include "lwip/netif.h" +#include "lwip/lwip_napt.h" #include "lwip/prot/ip4.h" #include "lwip/prot/tcp.h" #include "lwip/prot/ip.h" #include -#define MAX_CLIENTS 10 - static const char *TAG = "firewall"; static esp_ip4_addr_t s_ap_ip; static uint16_t s_mining_port = 3333; static bool s_sandbox_mint_access = false; -typedef struct { - uint32_t ip; - char mac[FW_MAX_MAC_LEN]; -} fw_client_t; - -static fw_client_t s_clients[MAX_CLIENTS]; -static int s_client_count = 0; - -esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size) -{ - wifi_sta_list_t sta_list; - if (esp_wifi_ap_get_sta_list(&sta_list) == ESP_OK) { - wifi_sta_mac_ip_list_t ip_mac_list; - if (esp_wifi_ap_get_sta_list_with_ip(&sta_list, &ip_mac_list) == ESP_OK) { - for (int i = 0; i < ip_mac_list.num; i++) { - if (ip_mac_list.sta[i].ip.addr == client_ip) { - snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x", - ip_mac_list.sta[i].mac[0], ip_mac_list.sta[i].mac[1], - ip_mac_list.sta[i].mac[2], ip_mac_list.sta[i].mac[3], - ip_mac_list.sta[i].mac[4], ip_mac_list.sta[i].mac[5]); - return ESP_OK; - } - } - } - } - - ip4_addr_t *entry_ip = NULL; - struct netif *entry_netif = NULL; - struct eth_addr *entry_eth = NULL; - ssize_t i = 0; - while (etharp_get_entry(i, &entry_ip, &entry_netif, &entry_eth) == ERR_OK) { - if (entry_ip && entry_ip->addr == client_ip && entry_eth) { - snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x", - entry_eth->addr[0], entry_eth->addr[1], entry_eth->addr[2], - entry_eth->addr[3], entry_eth->addr[4], entry_eth->addr[5]); - return ESP_OK; - } - i++; - } - return ESP_FAIL; -} - esp_err_t firewall_init(esp_ip4_addr_t ap_ip) { s_ap_ip = ap_ip; - memset(s_clients, 0, sizeof(s_clients)); - s_client_count = 0; ip_napt_enable(s_ap_ip.addr, 1); ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR " (NAT always on, per-client filter)", IP2STR(&s_ap_ip)); return ESP_OK; @@ -80,6 +33,11 @@ void firewall_set_sandbox_mint_access(bool enabled) s_sandbox_mint_access = enabled; } +esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size) +{ + return tollgate_core_fw_get_mac_for_ip(client_ip, mac_out, mac_out_size); +} + static bool is_sandbox_allowed(struct pbuf *p) { if (p->len < IP_HLEN) return false; @@ -129,84 +87,44 @@ int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder) return 0; } -static fw_client_t *find_client_by_ip(uint32_t client_ip) -{ - for (int i = 0; i < s_client_count; i++) { - if (s_clients[i].ip == client_ip) return &s_clients[i]; - } - return NULL; -} - -static fw_client_t *find_client_by_mac(const char *mac) -{ - for (int i = 0; i < s_client_count; i++) { - if (s_clients[i].mac[0] != '\0' && strcmp(s_clients[i].mac, mac) == 0) { - return &s_clients[i]; - } - } - return NULL; -} - void firewall_grant_access(uint32_t client_ip) { - fw_client_t *existing = find_client_by_ip(client_ip); - if (existing) { - existing->ip = client_ip; - return; - } - if (s_client_count >= MAX_CLIENTS) { - ESP_LOGW(TAG, "Max clients reached, cannot grant access"); - return; - } - - fw_client_t *client = &s_clients[s_client_count]; - client->ip = client_ip; - client->mac[0] = '\0'; - firewall_get_mac_for_ip(client_ip, client->mac, sizeof(client->mac)); - s_client_count++; - + tollgate_core_fw_grant(client_ip); dns_server_set_client_authenticated(client_ip, true); + char mac[18] = {0}; + tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac)); esp_ip4_addr_t ip_addr = { .addr = client_ip }; ESP_LOGI(TAG, "Access granted to " IPSTR " mac=%s", IP2STR(&ip_addr), - client->mac[0] ? client->mac : "unknown"); + mac[0] ? mac : "unknown"); } void firewall_revoke_access(uint32_t client_ip) { - for (int i = 0; i < s_client_count; i++) { - if (s_clients[i].ip == client_ip) { - esp_ip4_addr_t ip_addr = { .addr = client_ip }; - ESP_LOGI(TAG, "Access revoked for " IPSTR " mac=%s", IP2STR(&ip_addr), - s_clients[i].mac[0] ? s_clients[i].mac : "unknown"); - s_clients[i] = s_clients[s_client_count - 1]; - s_client_count--; - dns_server_set_client_authenticated(client_ip, false); - return; - } - } + tollgate_core_fw_revoke(client_ip); + dns_server_set_client_authenticated(client_ip, false); + + esp_ip4_addr_t ip_addr = { .addr = client_ip }; + ESP_LOGI(TAG, "Access revoked for " IPSTR, IP2STR(&ip_addr)); } void firewall_revoke_all(void) { - for (int i = 0; i < s_client_count; i++) { - dns_server_set_client_authenticated(s_clients[i].ip, false); - } - s_client_count = 0; + tollgate_core_fw_revoke_all(); ESP_LOGI(TAG, "All client access revoked"); } bool firewall_is_client_allowed(uint32_t client_ip) { - return find_client_by_ip(client_ip) != NULL; + return tollgate_core_is_client_allowed(client_ip); } bool firewall_is_mac_allowed(const char *mac) { - return find_client_by_mac(mac) != NULL; + return tollgate_core_fw_is_mac_allowed(mac); } int firewall_client_count(void) { - return s_client_count; + return tollgate_core_allowed_client_count(); } -- cgit v1.2.3