1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
#include "firewall.h"
#include "dns_server.h"
#include "esp_log.h"
#include "lwip/lwip_napt.h"
#include <string.h>
#define MAX_CLIENTS 10
static const char *TAG = "firewall";
static esp_ip4_addr_t s_ap_ip;
static bool s_nat_enabled = false;
typedef struct {
uint32_t ip;
} fw_client_t;
static fw_client_t s_clients[MAX_CLIENTS];
static int s_client_count = 0;
esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
{
s_ap_ip = ap_ip;
memset(s_clients, 0, sizeof(s_clients));
s_client_count = 0;
ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR, IP2STR(&s_ap_ip));
return ESP_OK;
}
void firewall_enable_nat(void)
{
if (s_nat_enabled) return;
ip_napt_enable(s_ap_ip.addr, 1);
s_nat_enabled = true;
ESP_LOGI(TAG, "NAT enabled");
}
void firewall_disable_nat(void)
{
if (!s_nat_enabled) return;
ip_napt_enable(s_ap_ip.addr, 0);
s_nat_enabled = false;
ESP_LOGI(TAG, "NAT disabled");
}
void firewall_grant_access(uint32_t client_ip)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].ip == client_ip) return;
}
if (s_client_count >= MAX_CLIENTS) {
ESP_LOGW(TAG, "Max clients reached, cannot grant access");
return;
}
s_clients[s_client_count].ip = client_ip;
s_client_count++;
dns_server_set_client_authenticated(client_ip, true);
esp_ip4_addr_t ip_addr = { .addr = client_ip };
ESP_LOGI(TAG, "Access granted to " IPSTR, IP2STR(&ip_addr));
}
void firewall_revoke_access(uint32_t client_ip)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].ip == client_ip) {
s_clients[i] = s_clients[s_client_count - 1];
s_client_count--;
dns_server_set_client_authenticated(client_ip, false);
esp_ip4_addr_t ip_addr = { .addr = client_ip };
ESP_LOGI(TAG, "Access revoked for " IPSTR, IP2STR(&ip_addr));
return;
}
}
}
void firewall_revoke_all(void)
{
for (int i = 0; i < s_client_count; i++) {
dns_server_set_client_authenticated(s_clients[i].ip, false);
}
s_client_count = 0;
ESP_LOGI(TAG, "All client access revoked");
}
bool firewall_is_client_allowed(uint32_t client_ip)
{
for (int i = 0; i < s_client_count; i++) {
if (s_clients[i].ip == client_ip) return true;
}
return false;
}
int firewall_client_count(void)
{
return s_client_count;
}
|