1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
|
#include "firewall.h"
#include "dns_server.h"
#include "esp_log.h"
#include "esp_wifi.h"
#include "esp_wifi_ap_get_sta_list.h"
#include "lwip/lwip_napt.h"
#include "lwip/etharp.h"
#include "lwip/netif.h"
#include "lwip/prot/ip4.h"
#include "lwip/prot/tcp.h"
#include "lwip/prot/ip.h"
#include <string.h>
#define MAX_CLIENTS 10
static const char *TAG = "firewall";
static esp_ip4_addr_t s_ap_ip;
static uint16_t s_mining_port = 3333;
static bool s_sandbox_mint_access = false;
typedef struct {
uint32_t ip;
char mac[FW_MAX_MAC_LEN];
} fw_client_t;
static fw_client_t s_clients[MAX_CLIENTS];
static int s_client_count = 0;
esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size)
{
wifi_sta_list_t sta_list;
if (esp_wifi_ap_get_sta_list(&sta_list) == ESP_OK) {
wifi_sta_mac_ip_list_t ip_mac_list;
if (esp_wifi_ap_get_sta_list_with_ip(&sta_list, &ip_mac_list) == ESP_OK) {
for (int i = 0; i < ip_mac_list.num; i++) {
if (ip_mac_list.sta[i].ip.addr == client_ip) {
snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x",
ip_mac_list.sta[i].mac[0], ip_mac_list.sta[i].mac[1],
ip_mac_list.sta[i].mac[2], ip_mac_list.sta[i].mac[3],
ip_mac_list.sta[i].mac[4], ip_mac_list.sta[i].mac[5]);
return ESP_OK;
}
}
}
}
ip4_addr_t *entry_ip = NULL;
struct netif *entry_netif = NULL;
struct eth_addr *entry_eth = NULL;
ssize_t i = 0;
while (etharp_get_entry(i, &entry_ip, &entry_netif, &entry_eth) == ERR_OK) {
if (entry_ip && entry_ip->addr == client_ip && entry_eth) {
snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x",
entry_eth->addr[0], entry_eth->addr[1], entry_eth->addr[2],
entry_eth->addr[3], entry_eth->addr[4], entry_eth->addr[5]);
return ESP_OK;
}
i++;
}
return ESP_FAIL;
}
esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
{
s_ap_ip = ap_ip;
memset(s_clients, 0, sizeof(s_clients));
s_client_count = 0;
ip_napt_enable(s_ap_ip.addr, 1);
ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR " (NAT always on, per-client filter)", IP2STR(&s_ap_ip));
return ESP_OK;
}
void firewall_set_mining_port(uint16_t port)
{
s_mining_port = port;
}
void firewall_set_sandbox_mint_access(bool enabled)
{
s_sandbox_mint_access = enabled;
}
static bool is_sandbox_allowed(struct pbuf *p)
{
if (p->len < IP_HLEN) return false;
struct ip_hdr *iphdr = (struct ip_hdr *)p->payload;
uint32_t dest_ip_h = lwip_ntohl(iphdr->dest.addr);
uint32_t ap_ip_h = lwip_ntohl(s_ap_ip.addr);
if (dest_ip_h == ap_ip_h) {
if (iphdr->_proto == IP_PROTO_TCP) {
uint16_t dst_port = 0;
if (p->len >= IP_HLEN + TCP_HLEN) {
struct tcp_hdr *tcphdr = (struct tcp_hdr *)((uint8_t *)p->payload + IP_HLEN);
dst_port = lwip_ntohs(tcphdr->dest);
}
if (dst_port == 80 || dst_port == 2121 || dst_port == s_mining_port) {
return true;
}
}
if (iphdr->_proto == IP_PROTO_UDP) {
return true;
}
}
if (s_sandbox_mint_access && iphdr->_proto == IP_PROTO_TCP) {
return true;
}
return false;
}
int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
{
(void)dest_addr_hostorder;
if (p->len < IP_HLEN) return -1;
struct ip_hdr *iphdr = (struct ip_hdr *)p->payload;
uint32_t src_ip_h = lwip_ntohl(iphdr->src.addr);
uint32_t ap_subnet = lwip_ntohl(s_ap_ip.addr) & 0xFFFFFF00;
if ((src_ip_h & 0xFFFFFF00) != ap_subnet) {
return 1;
}
if (firewall_is_client_allowed(iphdr->src.addr)) {
return 1;
}
if (is_sandbox_allowed(p)) {
return 1;
}
return 0;
}
static fw_client_t *find_client_by_ip(uint32_t client_ip)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].ip == client_ip) return &s_clients[i];
}
return NULL;
}
static fw_client_t *find_client_by_mac(const char *mac)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].mac[0] != '\0' && strcmp(s_clients[i].mac, mac) == 0) {
return &s_clients[i];
}
}
return NULL;
}
void firewall_grant_access(uint32_t client_ip)
{
fw_client_t *existing = find_client_by_ip(client_ip);
if (existing) {
existing->ip = client_ip;
return;
}
if (s_client_count >= MAX_CLIENTS) {
ESP_LOGW(TAG, "Max clients reached, cannot grant access");
return;
}
fw_client_t *client = &s_clients[s_client_count];
client->ip = client_ip;
client->mac[0] = '\0';
firewall_get_mac_for_ip(client_ip, client->mac, sizeof(client->mac));
s_client_count++;
dns_server_set_client_authenticated(client_ip, true);
esp_ip4_addr_t ip_addr = { .addr = client_ip };
ESP_LOGI(TAG, "Access granted to " IPSTR " mac=%s", IP2STR(&ip_addr),
client->mac[0] ? client->mac : "unknown");
}
void firewall_revoke_access(uint32_t client_ip)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].ip == client_ip) {
esp_ip4_addr_t ip_addr = { .addr = client_ip };
ESP_LOGI(TAG, "Access revoked for " IPSTR " mac=%s", IP2STR(&ip_addr),
s_clients[i].mac[0] ? s_clients[i].mac : "unknown");
s_clients[i] = s_clients[s_client_count - 1];
s_client_count--;
dns_server_set_client_authenticated(client_ip, false);
return;
}
}
}
void firewall_revoke_all(void)
{
for (int i = 0; i < s_client_count; i++) {
dns_server_set_client_authenticated(s_clients[i].ip, false);
}
s_client_count = 0;
ESP_LOGI(TAG, "All client access revoked");
}
bool firewall_is_client_allowed(uint32_t client_ip)
{
return find_client_by_ip(client_ip) != NULL;
}
bool firewall_is_mac_allowed(const char *mac)
{
return find_client_by_mac(mac) != NULL;
}
int firewall_client_count(void)
{
return s_client_count;
}
|