using SPIFFS for cert, eeprom for the rest
This commit is contained in:
parent
c86be9feb4
commit
a08ea4803b
8 changed files with 175 additions and 263 deletions
|
@ -29,50 +29,4 @@ typedef struct firewall_rule
|
||||||
struct firewall_rule *next;
|
struct firewall_rule *next;
|
||||||
} firewall_rule_t;
|
} firewall_rule_t;
|
||||||
|
|
||||||
String protocol_to_string(firewall_protocol_t &protocol)
|
|
||||||
{
|
|
||||||
switch (protocol)
|
|
||||||
{
|
|
||||||
case FW_TCP:
|
|
||||||
return "TCP";
|
|
||||||
case FW_UDP:
|
|
||||||
return "UDP";
|
|
||||||
default:
|
|
||||||
return "ALL";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall_protocol_t string_to_protocol(std::string &protocol)
|
|
||||||
{
|
|
||||||
if (protocol.compare("TCP") == 0)
|
|
||||||
return FW_TCP;
|
|
||||||
else if (protocol.compare("UDP") == 0)
|
|
||||||
return FW_UDP;
|
|
||||||
else
|
|
||||||
return FW_ALL;
|
|
||||||
}
|
|
||||||
|
|
||||||
String target_to_string(firewall_target_t &target)
|
|
||||||
{
|
|
||||||
switch (target)
|
|
||||||
{
|
|
||||||
case FW_REJECT:
|
|
||||||
return "REJECT";
|
|
||||||
case FW_DROP:
|
|
||||||
return "DROP";
|
|
||||||
default:
|
|
||||||
return "ACCEPT";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall_target_t string_to_target(std::string &target)
|
|
||||||
{
|
|
||||||
if (target.compare("REJECT") == 0)
|
|
||||||
return FW_REJECT;
|
|
||||||
else if (target.compare("DROP") == 0)
|
|
||||||
return FW_DROP;
|
|
||||||
else
|
|
||||||
return FW_ACCEPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -1,8 +1,8 @@
|
||||||
#include "esp32FirewallAPI.hpp"
|
#include "esp32API.hpp"
|
||||||
|
|
||||||
namespace firewall
|
namespace firewall
|
||||||
{
|
{
|
||||||
esp32FirewallApi::esp32FirewallApi(const uint16_t port)
|
API::API(const uint16_t port)
|
||||||
{
|
{
|
||||||
this->setup_certificate();
|
this->setup_certificate();
|
||||||
this->server = new HTTPSServer(this->certificate, port, 5);
|
this->server = new HTTPSServer(this->certificate, port, 5);
|
||||||
|
@ -15,17 +15,20 @@ namespace firewall
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
esp32FirewallApi::~esp32FirewallApi()
|
API::~API()
|
||||||
{
|
{
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::handle_clients()
|
void API::handle_clients()
|
||||||
{
|
{
|
||||||
this->server->loop();
|
this->server->loop();
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::setup_certificate()
|
void API::setup_certificate()
|
||||||
{
|
{
|
||||||
|
this->certificate = retrieve_certificate();
|
||||||
|
if (certificate != NULL)
|
||||||
|
return;
|
||||||
log_i("Creating the certificate...");
|
log_i("Creating the certificate...");
|
||||||
this->certificate = new SSLCert();
|
this->certificate = new SSLCert();
|
||||||
int createCertResult = createSelfSignedCert(
|
int createCertResult = createSelfSignedCert(
|
||||||
|
@ -40,42 +43,34 @@ namespace firewall
|
||||||
while (true)
|
while (true)
|
||||||
delay(500);
|
delay(500);
|
||||||
}
|
}
|
||||||
|
store_certificate(certificate);
|
||||||
log_i("Creating the certificate was successful");
|
log_i("Creating the certificate was successful");
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::setup_routing()
|
void API::setup_routing()
|
||||||
{
|
{
|
||||||
ResourceNode *get_firewall_rule = new ResourceNode("/api/v1/firewall/*", "GET", std::bind(&esp32FirewallApi::get_firewall_rule_handler, this, std::placeholders::_1, std::placeholders::_2));
|
ResourceNode *get_firewall_rule = new ResourceNode("/api/v1/firewall/*", "GET", std::bind(&API::get_firewall_rule_handler, this, std::placeholders::_1, std::placeholders::_2));
|
||||||
ResourceNode *get_firewall_rules = new ResourceNode("/api/v1/firewall", "GET", std::bind(&esp32FirewallApi::get_firewall_rules_handler, this, std::placeholders::_1, std::placeholders::_2));
|
ResourceNode *get_firewall_rules = new ResourceNode("/api/v1/firewall", "GET", std::bind(&API::get_firewall_rules_handler, this, std::placeholders::_1, std::placeholders::_2));
|
||||||
ResourceNode *post_firewall = new ResourceNode("/api/v1/firewall", "POST", std::bind(&esp32FirewallApi::post_firewall_handler, this, std::placeholders::_1, std::placeholders::_2));
|
ResourceNode *post_firewall = new ResourceNode("/api/v1/firewall", "POST", std::bind(&API::post_firewall_handler, this, std::placeholders::_1, std::placeholders::_2));
|
||||||
ResourceNode *delete_firewall = new ResourceNode("/api/v1/firewall/*", "DELETE", std::bind(&esp32FirewallApi::delete_firewall_handler, this, std::placeholders::_1, std::placeholders::_2));
|
ResourceNode *delete_firewall = new ResourceNode("/api/v1/firewall/*", "DELETE", std::bind(&API::delete_firewall_handler, this, std::placeholders::_1, std::placeholders::_2));
|
||||||
ResourceNode *restart_device = new ResourceNode("/api/v1/device/restart", "GET", std::bind(&esp32FirewallApi::restart_device_handler, this, std::placeholders::_1, std::placeholders::_2));
|
ResourceNode *not_found = new ResourceNode("", "GET", std::bind(&API::not_found_handler, this, std::placeholders::_1, std::placeholders::_2));
|
||||||
ResourceNode *not_found = new ResourceNode("", "GET", std::bind(&esp32FirewallApi::not_found_handler, this, std::placeholders::_1, std::placeholders::_2));
|
|
||||||
this->server->registerNode(get_firewall_rule);
|
this->server->registerNode(get_firewall_rule);
|
||||||
this->server->registerNode(get_firewall_rules);
|
this->server->registerNode(get_firewall_rules);
|
||||||
this->server->registerNode(post_firewall);
|
this->server->registerNode(post_firewall);
|
||||||
this->server->registerNode(delete_firewall);
|
this->server->registerNode(delete_firewall);
|
||||||
this->server->registerNode(restart_device);
|
|
||||||
this->server->setDefaultNode(not_found);
|
this->server->setDefaultNode(not_found);
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::restart_device_handler(HTTPRequest *request, HTTPResponse *response)
|
void API::not_found_handler(HTTPRequest *request, HTTPResponse *response)
|
||||||
{
|
|
||||||
this->json_message_response(response, "restarting device in 2 sec", 200);
|
|
||||||
sleep(2000);
|
|
||||||
esp_restart();
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32FirewallApi::not_found_handler(HTTPRequest *request, HTTPResponse *response)
|
|
||||||
{
|
{
|
||||||
this->json_message_response(response, "not found", 404);
|
this->json_message_response(response, "not found", 404);
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::get_firewall_rule_handler(HTTPRequest *request, HTTPResponse *response)
|
void API::get_firewall_rule_handler(HTTPRequest *request, HTTPResponse *response)
|
||||||
{
|
{
|
||||||
ResourceParameters *params = request->getParams();
|
ResourceParameters *params = request->getParams();
|
||||||
int rule_number = atoi(params->getPathParameter(0).c_str());
|
int rule_number = atoi(params->getPathParameter(0).c_str());
|
||||||
firewall_rule_t *rule_ptr = this->get_rule_from_firewall(rule_number);
|
firewall_rule_t *rule_ptr = get_rule_from_firewall(rule_number);
|
||||||
if (rule_ptr == NULL)
|
if (rule_ptr == NULL)
|
||||||
{
|
{
|
||||||
this->json_message_response(response, "rule not found", 404);
|
this->json_message_response(response, "rule not found", 404);
|
||||||
|
@ -88,17 +83,17 @@ namespace firewall
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::get_firewall_rules_handler(HTTPRequest *request, HTTPResponse *response)
|
void API::get_firewall_rules_handler(HTTPRequest *request, HTTPResponse *response)
|
||||||
{
|
{
|
||||||
this->json_generic_response(response, this->construct_json_firewall(), 200);
|
this->json_generic_response(response, this->construct_json_firewall(), 200);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool esp32FirewallApi::request_has_firewall_parameter(ResourceParameters *params)
|
bool API::request_has_firewall_parameter(ResourceParameters *params)
|
||||||
{
|
{
|
||||||
return params->isQueryParameterSet("source") || params->isQueryParameterSet("destination") || params->isQueryParameterSet("protocol") || params->isQueryParameterSet("target");
|
return params->isQueryParameterSet("source") || params->isQueryParameterSet("destination") || params->isQueryParameterSet("protocol") || params->isQueryParameterSet("target");
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::post_firewall_handler(HTTPRequest *request, HTTPResponse *response)
|
void API::post_firewall_handler(HTTPRequest *request, HTTPResponse *response)
|
||||||
{
|
{
|
||||||
ResourceParameters *params = request->getParams();
|
ResourceParameters *params = request->getParams();
|
||||||
if (request_has_firewall_parameter(params))
|
if (request_has_firewall_parameter(params))
|
||||||
|
@ -121,8 +116,7 @@ namespace firewall
|
||||||
params->getQueryParameter("target", target);
|
params->getQueryParameter("target", target);
|
||||||
rule_ptr->target = string_to_target(target);
|
rule_ptr->target = string_to_target(target);
|
||||||
|
|
||||||
this->add_rule_to_firewall(rule_ptr);
|
add_rule_to_firewall(rule_ptr);
|
||||||
this->eeprom_write_firewall_rule(rule_ptr);
|
|
||||||
this->json_generic_response(response, this->construct_json_firewall_rule(rule_ptr), 200);
|
this->json_generic_response(response, this->construct_json_firewall_rule(rule_ptr), 200);
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
@ -131,11 +125,11 @@ namespace firewall
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::delete_firewall_handler(HTTPRequest *request, HTTPResponse *response)
|
void API::delete_firewall_handler(HTTPRequest *request, HTTPResponse *response)
|
||||||
{
|
{
|
||||||
ResourceParameters *params = request->getParams();
|
ResourceParameters *params = request->getParams();
|
||||||
int rule_number = atoi(params->getPathParameter(0).c_str());
|
int rule_number = atoi(params->getPathParameter(0).c_str());
|
||||||
if (this->delete_rule_from_firewall(rule_number))
|
if (delete_rule_from_firewall(rule_number))
|
||||||
{
|
{
|
||||||
this->json_message_response(response, "firewall rule deleted", 200);
|
this->json_message_response(response, "firewall rule deleted", 200);
|
||||||
}
|
}
|
||||||
|
@ -145,14 +139,14 @@ namespace firewall
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::json_generic_response(HTTPResponse *response, String serialized, const uint16_t response_code)
|
void API::json_generic_response(HTTPResponse *response, String serialized, const uint16_t response_code)
|
||||||
{
|
{
|
||||||
response->setHeader("Content-Type", "application/json");
|
response->setHeader("Content-Type", "application/json");
|
||||||
response->setStatusCode(response_code);
|
response->setStatusCode(response_code);
|
||||||
response->println(serialized);
|
response->println(serialized);
|
||||||
}
|
}
|
||||||
|
|
||||||
void esp32FirewallApi::json_message_response(HTTPResponse *response, String message, const uint16_t response_code)
|
void API::json_message_response(HTTPResponse *response, String message, const uint16_t response_code)
|
||||||
{
|
{
|
||||||
response->setHeader("Content-Type", "application/json");
|
response->setHeader("Content-Type", "application/json");
|
||||||
response->setStatusCode(response_code);
|
response->setStatusCode(response_code);
|
||||||
|
@ -163,7 +157,7 @@ namespace firewall
|
||||||
response->println(serialized);
|
response->println(serialized);
|
||||||
}
|
}
|
||||||
|
|
||||||
String esp32FirewallApi::construct_json_firewall_rule(firewall_rule_t *rule_ptr)
|
String API::construct_json_firewall_rule(firewall_rule_t *rule_ptr)
|
||||||
{
|
{
|
||||||
StaticJsonDocument<256> doc;
|
StaticJsonDocument<256> doc;
|
||||||
doc["key"] = rule_ptr->key;
|
doc["key"] = rule_ptr->key;
|
||||||
|
@ -176,13 +170,13 @@ namespace firewall
|
||||||
return response;
|
return response;
|
||||||
}
|
}
|
||||||
|
|
||||||
String esp32FirewallApi::construct_json_firewall()
|
String API::construct_json_firewall()
|
||||||
{
|
{
|
||||||
firewall_rule_t *rule_ptr = this->head;
|
firewall_rule_t *rule_ptr = head;
|
||||||
// Size for approx. 12 Rules
|
// Size for approx. 12 Rules
|
||||||
StaticJsonDocument<2048> doc;
|
StaticJsonDocument<2048> doc;
|
||||||
String response;
|
String response;
|
||||||
doc["amount_of_rules"] = this->amount_of_rules;
|
doc["amount_of_rules"] = amount_of_rules;
|
||||||
JsonArray rules = doc.createNestedArray("rules");
|
JsonArray rules = doc.createNestedArray("rules");
|
||||||
while (rule_ptr != NULL)
|
while (rule_ptr != NULL)
|
||||||
{
|
{
|
|
@ -1,5 +1,5 @@
|
||||||
#ifndef ESP32_FIREWALL_API_HPP
|
#ifndef ESP32_API_HPP
|
||||||
#define ESP32_FIREWALL_API_HPP
|
#define ESP32_API_HPP
|
||||||
|
|
||||||
#include "HTTPSServer.hpp"
|
#include "HTTPSServer.hpp"
|
||||||
#include "SSLCert.hpp"
|
#include "SSLCert.hpp"
|
||||||
|
@ -7,13 +7,14 @@
|
||||||
#include "HTTPResponse.hpp"
|
#include "HTTPResponse.hpp"
|
||||||
#include "ArduinoJson.h"
|
#include "ArduinoJson.h"
|
||||||
|
|
||||||
|
#include "FirewallTypes.h"
|
||||||
#include "esp32Firewall.hpp"
|
#include "esp32Firewall.hpp"
|
||||||
|
|
||||||
using namespace httpsserver;
|
using namespace httpsserver;
|
||||||
|
|
||||||
namespace firewall
|
namespace firewall
|
||||||
{
|
{
|
||||||
class esp32FirewallApi : public esp32Firewall
|
class API : public Firewall
|
||||||
{
|
{
|
||||||
private:
|
private:
|
||||||
HTTPSServer *server;
|
HTTPSServer *server;
|
||||||
|
@ -26,7 +27,6 @@ namespace firewall
|
||||||
bool request_has_firewall_parameter(ResourceParameters *);
|
bool request_has_firewall_parameter(ResourceParameters *);
|
||||||
void post_firewall_handler(HTTPRequest *, HTTPResponse *);
|
void post_firewall_handler(HTTPRequest *, HTTPResponse *);
|
||||||
void delete_firewall_handler(HTTPRequest *, HTTPResponse *);
|
void delete_firewall_handler(HTTPRequest *, HTTPResponse *);
|
||||||
void restart_device_handler(HTTPRequest *, HTTPResponse *);
|
|
||||||
void not_found_handler(HTTPRequest *, HTTPResponse *);
|
void not_found_handler(HTTPRequest *, HTTPResponse *);
|
||||||
|
|
||||||
void json_generic_response(HTTPResponse *, String, const uint16_t);
|
void json_generic_response(HTTPResponse *, String, const uint16_t);
|
||||||
|
@ -35,8 +35,8 @@ namespace firewall
|
||||||
String construct_json_firewall();
|
String construct_json_firewall();
|
||||||
|
|
||||||
public:
|
public:
|
||||||
esp32FirewallApi(const uint16_t = 8080);
|
API(const uint16_t = 8080);
|
||||||
~esp32FirewallApi();
|
~API();
|
||||||
void handle_clients();
|
void handle_clients();
|
||||||
};
|
};
|
||||||
}
|
}
|
|
@ -2,133 +2,24 @@
|
||||||
|
|
||||||
namespace firewall
|
namespace firewall
|
||||||
{
|
{
|
||||||
esp32Firewall::esp32Firewall()
|
Firewall::Firewall()
|
||||||
{
|
{
|
||||||
this->setup_eeprom();
|
this->amount_of_rules = retrieve_settings_value("amount_of_rules");
|
||||||
}
|
for (uint8_t i = 0; i < this->amount_of_rules; i++)
|
||||||
|
|
||||||
esp32Firewall::~esp32Firewall()
|
|
||||||
{
|
|
||||||
}
|
|
||||||
|
|
||||||
String esp32Firewall::protocol_to_string(firewall_protocol_t &protocol)
|
|
||||||
{
|
|
||||||
switch (protocol)
|
|
||||||
{
|
{
|
||||||
case FW_TCP:
|
firewall_rule_t *rule_ptr = retrieve_firewall_rule(i);
|
||||||
return "TCP";
|
add_rule_to_firewall(rule_ptr);
|
||||||
case FW_UDP:
|
|
||||||
return "UDP";
|
|
||||||
default:
|
|
||||||
return "ALL";
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
firewall_protocol_t esp32Firewall::string_to_protocol(std::string &protocol)
|
Firewall::~Firewall()
|
||||||
{
|
{
|
||||||
if (protocol.compare("TCP") == 0)
|
|
||||||
return FW_TCP;
|
|
||||||
else if (protocol.compare("UDP") == 0)
|
|
||||||
return FW_UDP;
|
|
||||||
else
|
|
||||||
return FW_ALL;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
String esp32Firewall::target_to_string(firewall_target_t &target)
|
void Firewall::add_rule_to_firewall(firewall_rule_t *rule_ptr)
|
||||||
{
|
|
||||||
switch (target)
|
|
||||||
{
|
|
||||||
case FW_REJECT:
|
|
||||||
return "REJECT";
|
|
||||||
case FW_DROP:
|
|
||||||
return "DROP";
|
|
||||||
default:
|
|
||||||
return "ACCEPT";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall_target_t esp32Firewall::string_to_target(std::string &target)
|
|
||||||
{
|
|
||||||
if (target.compare("REJECT") == 0)
|
|
||||||
return FW_REJECT;
|
|
||||||
else if (target.compare("DROP") == 0)
|
|
||||||
return FW_DROP;
|
|
||||||
else
|
|
||||||
return FW_ACCEPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::setup_eeprom()
|
|
||||||
{
|
|
||||||
EEPROM.begin(this->eeprom_size);
|
|
||||||
this->amount_of_rules = EEPROM.read(this->eeprom_settings_head);
|
|
||||||
uint8_t security_number = EEPROM.read(this->eeprom_settings_head + 1);
|
|
||||||
if (this->amount_of_rules > 50 || security_number != this->security_number)
|
|
||||||
{
|
|
||||||
this->amount_of_rules = 0;
|
|
||||||
EEPROM.write(this->eeprom_settings_head, this->amount_of_rules);
|
|
||||||
EEPROM.write(this->eeprom_settings_head + 1, this->security_number);
|
|
||||||
EEPROM.commit();
|
|
||||||
}
|
|
||||||
log_i("Amount of existing Rules %i", this->amount_of_rules);
|
|
||||||
this->eeprom_read_firewall_rules();
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::eeprom_write_firewall_rule(firewall_rule_t *rule_ptr)
|
|
||||||
{
|
|
||||||
EEPROM.write(this->eeprom_settings_head, this->amount_of_rules);
|
|
||||||
EEPROM.writeString(this->eeprom_rules_head, rule_ptr->source);
|
|
||||||
this->eeprom_rules_head += IPV4ADDRESS_LENGTH;
|
|
||||||
EEPROM.writeString(this->eeprom_rules_head, rule_ptr->destination);
|
|
||||||
this->eeprom_rules_head += IPV4ADDRESS_LENGTH;
|
|
||||||
EEPROM.write(this->eeprom_rules_head, rule_ptr->protocol);
|
|
||||||
this->eeprom_rules_head += sizeof(firewall_protocol_t);
|
|
||||||
EEPROM.write(this->eeprom_rules_head, rule_ptr->target);
|
|
||||||
this->eeprom_rules_head += sizeof(firewall_target_t);
|
|
||||||
EEPROM.commit();
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::eeprom_write_firewall_rules()
|
|
||||||
{
|
|
||||||
this->eeprom_rules_head = eeprom_start_firewall_rules;
|
|
||||||
firewall_rule_t *rule_ptr = this->head;
|
|
||||||
while (rule_ptr != NULL)
|
|
||||||
{
|
|
||||||
this->eeprom_write_firewall_rule(rule_ptr);
|
|
||||||
rule_ptr = rule_ptr->next;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::eeprom_read_firewall_rule(uint8_t &eeprom_address, uint8_t &rule_nr)
|
|
||||||
{
|
|
||||||
firewall_rule_t *rule_ptr = (firewall_rule_t *)malloc(sizeof(firewall_rule_t));
|
|
||||||
rule_ptr->key = rule_nr;
|
|
||||||
strcpy(rule_ptr->source, EEPROM.readString(eeprom_address).c_str());
|
|
||||||
eeprom_address += IPV4ADDRESS_LENGTH;
|
|
||||||
strcpy(rule_ptr->destination, EEPROM.readString(eeprom_address).c_str());
|
|
||||||
eeprom_address += IPV4ADDRESS_LENGTH;
|
|
||||||
rule_ptr->protocol = static_cast<firewall_protocol_t>(EEPROM.read(eeprom_address));
|
|
||||||
eeprom_address += sizeof(firewall_protocol_t);
|
|
||||||
rule_ptr->target = static_cast<firewall_target_t>(EEPROM.read(eeprom_address));
|
|
||||||
eeprom_address += sizeof(firewall_target_t);
|
|
||||||
add_rule_to_firewall(rule_ptr);
|
|
||||||
log_i("%s, %s, %s, %s",
|
|
||||||
rule_ptr->source,
|
|
||||||
rule_ptr->destination,
|
|
||||||
protocol_to_string(rule_ptr->protocol),
|
|
||||||
target_to_string(rule_ptr->target));
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::eeprom_read_firewall_rules()
|
|
||||||
{
|
|
||||||
uint8_t eeprom_address = eeprom_start_firewall_rules;
|
|
||||||
for (uint8_t i = 1; i <= this->amount_of_rules; i++)
|
|
||||||
{
|
|
||||||
eeprom_read_firewall_rule(eeprom_address, i);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void esp32Firewall::add_rule_to_firewall(firewall_rule_t *rule_ptr)
|
|
||||||
{
|
{
|
||||||
|
store_settings_value("amount_of_rules", this->amount_of_rules);
|
||||||
|
store_firewall_rule(rule_ptr);
|
||||||
firewall_rule_t *temp;
|
firewall_rule_t *temp;
|
||||||
if (this->head == NULL)
|
if (this->head == NULL)
|
||||||
{
|
{
|
||||||
|
@ -146,7 +37,7 @@ namespace firewall
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
firewall_rule_t *esp32Firewall::get_rule_from_firewall(uint8_t key)
|
firewall_rule_t *Firewall::get_rule_from_firewall(uint8_t key)
|
||||||
{
|
{
|
||||||
firewall_rule_t *rule_ptr = this->head;
|
firewall_rule_t *rule_ptr = this->head;
|
||||||
if (this->head == NULL)
|
if (this->head == NULL)
|
||||||
|
@ -167,7 +58,7 @@ namespace firewall
|
||||||
return rule_ptr;
|
return rule_ptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool esp32Firewall::delete_rule_from_firewall(uint8_t key)
|
bool Firewall::delete_rule_from_firewall(uint8_t key)
|
||||||
{
|
{
|
||||||
if (this->head == NULL)
|
if (this->head == NULL)
|
||||||
{
|
{
|
||||||
|
@ -205,7 +96,52 @@ namespace firewall
|
||||||
}
|
}
|
||||||
free(current_rule_ptr);
|
free(current_rule_ptr);
|
||||||
this->amount_of_rules--;
|
this->amount_of_rules--;
|
||||||
this->eeprom_write_firewall_rules();
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
String Firewall::protocol_to_string(firewall_protocol_t &protocol)
|
||||||
|
{
|
||||||
|
switch (protocol)
|
||||||
|
{
|
||||||
|
case FW_TCP:
|
||||||
|
return "TCP";
|
||||||
|
case FW_UDP:
|
||||||
|
return "UDP";
|
||||||
|
default:
|
||||||
|
return "ALL";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall_protocol_t Firewall::string_to_protocol(std::string &protocol)
|
||||||
|
{
|
||||||
|
if (protocol.compare("TCP") == 0)
|
||||||
|
return FW_TCP;
|
||||||
|
else if (protocol.compare("UDP") == 0)
|
||||||
|
return FW_UDP;
|
||||||
|
else
|
||||||
|
return FW_ALL;
|
||||||
|
}
|
||||||
|
|
||||||
|
String Firewall::target_to_string(firewall_target_t &target)
|
||||||
|
{
|
||||||
|
switch (target)
|
||||||
|
{
|
||||||
|
case FW_REJECT:
|
||||||
|
return "REJECT";
|
||||||
|
case FW_DROP:
|
||||||
|
return "DROP";
|
||||||
|
default:
|
||||||
|
return "ACCEPT";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall_target_t Firewall::string_to_target(std::string &target)
|
||||||
|
{
|
||||||
|
if (target.compare("REJECT") == 0)
|
||||||
|
return FW_REJECT;
|
||||||
|
else if (target.compare("DROP") == 0)
|
||||||
|
return FW_DROP;
|
||||||
|
else
|
||||||
|
return FW_ACCEPT;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,26 +1,14 @@
|
||||||
#ifndef ESP32_FIREWALL_HPP
|
#ifndef ESP32_FIREWALL_HPP
|
||||||
#define ESP32_FIREWALL_HPP
|
#define ESP32_FIREWALL_HPP
|
||||||
|
|
||||||
#include "EEPROM.h"
|
|
||||||
#include "FirewallTypes.h"
|
#include "FirewallTypes.h"
|
||||||
|
#include "esp32Storage.hpp"
|
||||||
#define eeprom_start_firewall_rules 4
|
#include "WString.h"
|
||||||
|
|
||||||
namespace firewall
|
namespace firewall
|
||||||
{
|
{
|
||||||
class esp32Firewall
|
class Firewall : public Storage
|
||||||
{
|
{
|
||||||
private:
|
|
||||||
uint16_t eeprom_size = 512;
|
|
||||||
uint8_t security_number = 93;
|
|
||||||
int eeprom_settings_head = 0;
|
|
||||||
int eeprom_rules_head = eeprom_start_firewall_rules;
|
|
||||||
|
|
||||||
void setup_eeprom();
|
|
||||||
void eeprom_write_firewall_rules();
|
|
||||||
void eeprom_read_firewall_rule(uint8_t &, uint8_t &);
|
|
||||||
void eeprom_read_firewall_rules();
|
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
uint8_t amount_of_rules = 0;
|
uint8_t amount_of_rules = 0;
|
||||||
struct firewall_rule *head = NULL;
|
struct firewall_rule *head = NULL;
|
||||||
|
@ -29,16 +17,14 @@ namespace firewall
|
||||||
firewall_rule_t *get_rule_from_firewall(uint8_t);
|
firewall_rule_t *get_rule_from_firewall(uint8_t);
|
||||||
bool delete_rule_from_firewall(uint8_t);
|
bool delete_rule_from_firewall(uint8_t);
|
||||||
|
|
||||||
void eeprom_write_firewall_rule(firewall_rule_t *);
|
String protocol_to_string(firewall_protocol_t &protocol);
|
||||||
|
firewall_protocol_t string_to_protocol(std::string &protocol);
|
||||||
String protocol_to_string(firewall_protocol_t &);
|
String target_to_string(firewall_target_t &target);
|
||||||
firewall_protocol_t string_to_protocol(std::string &);
|
firewall_target_t string_to_target(std::string &target);
|
||||||
String target_to_string(firewall_target_t &);
|
|
||||||
firewall_target_t string_to_target(std::string &);
|
|
||||||
|
|
||||||
public:
|
public:
|
||||||
esp32Firewall();
|
Firewall();
|
||||||
~esp32Firewall();
|
~Firewall();
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -4,12 +4,27 @@ namespace firewall
|
||||||
{
|
{
|
||||||
Storage::Storage()
|
Storage::Storage()
|
||||||
{
|
{
|
||||||
|
this->mount_spiffs();
|
||||||
}
|
}
|
||||||
|
|
||||||
Storage::~Storage()
|
Storage::~Storage()
|
||||||
{
|
{
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void Storage::mount_spiffs()
|
||||||
|
{
|
||||||
|
if (!SPIFFS.begin(false))
|
||||||
|
{
|
||||||
|
if (!SPIFFS.begin(true))
|
||||||
|
{
|
||||||
|
log_e("SPIFFS cannot be mounted");
|
||||||
|
while (true)
|
||||||
|
delay(500);
|
||||||
|
};
|
||||||
|
}
|
||||||
|
log_i("SPIFFS mounted");
|
||||||
|
}
|
||||||
|
|
||||||
uint8_t Storage::retrieve_settings_value(const char *key)
|
uint8_t Storage::retrieve_settings_value(const char *key)
|
||||||
{
|
{
|
||||||
uint8_t amount_of_rules;
|
uint8_t amount_of_rules;
|
||||||
|
@ -61,35 +76,64 @@ namespace firewall
|
||||||
|
|
||||||
httpsserver::SSLCert *Storage::retrieve_certificate()
|
httpsserver::SSLCert *Storage::retrieve_certificate()
|
||||||
{
|
{
|
||||||
this->memory.begin("certificate", true);
|
File keyFile = SPIFFS.open("/key.der");
|
||||||
uint16_t cert_data_length = this->memory.getBytesLength("cert_data");
|
File certFile = SPIFFS.open("/cert.der");
|
||||||
unsigned char cert_data[cert_data_length];
|
if (!keyFile || !certFile || keyFile.size() == 0 || certFile.size() == 0)
|
||||||
this->memory.getBytes("cert_data", cert_data, cert_data_length);
|
{
|
||||||
|
log_w("No certificate found in SPIFFS");
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
size_t keySize = keyFile.size();
|
||||||
|
size_t certSize = certFile.size();
|
||||||
|
|
||||||
uint16_t pk_data_length = this->memory.getBytesLength("pk_data");
|
uint8_t *keyBuffer = new uint8_t[keySize];
|
||||||
unsigned char pk_data[pk_data_length];
|
if (keyBuffer == NULL)
|
||||||
this->memory.getBytes("pk_data", pk_data, pk_data_length);
|
{
|
||||||
|
log_w("Not enough memory to load privat key");
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
uint8_t *certBuffer = new uint8_t[certSize];
|
||||||
|
if (certBuffer == NULL)
|
||||||
|
{
|
||||||
|
delete[] keyBuffer;
|
||||||
|
log_w("Not enough memory to load certificate");
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
keyFile.read(keyBuffer, keySize);
|
||||||
|
certFile.read(certBuffer, certSize);
|
||||||
|
|
||||||
uint16_t pk_length = this->memory.getUInt("pk_length", 0);
|
keyFile.close();
|
||||||
|
certFile.close();
|
||||||
uint16_t cert_length = this->memory.getUInt("pk_length", 0);
|
return new httpsserver::SSLCert(certBuffer, certSize, keyBuffer, keySize);
|
||||||
this->memory.end();
|
|
||||||
|
|
||||||
return new httpsserver::SSLCert(cert_data, cert_length, pk_data, pk_length);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void Storage::store_certificate(httpsserver::SSLCert *certificate)
|
void Storage::store_certificate(httpsserver::SSLCert *certificate)
|
||||||
{
|
{
|
||||||
unsigned char *pk_data = certificate->getPKData();
|
File keyFile = SPIFFS.open("/key.der");
|
||||||
unsigned char *cert_data = certificate->getCertData();
|
File certFile = SPIFFS.open("/cert.der");
|
||||||
uint16_t pk_length = certificate->getPKLength();
|
bool failure = false;
|
||||||
uint16_t cert_length = certificate->getCertLength();
|
|
||||||
|
|
||||||
this->memory.begin("certificate", false);
|
keyFile = SPIFFS.open("/key.der", FILE_WRITE);
|
||||||
this->memory.putBytes("pk_data", pk_data, sizeof(pk_data));
|
if (!keyFile || !keyFile.write(certificate->getPKData(), certificate->getPKLength()))
|
||||||
this->memory.putBytes("cert_data", cert_data, sizeof(cert_data));
|
{
|
||||||
this->memory.putUInt("pk_length", pk_length);
|
log_w("Could not write /key.der");
|
||||||
this->memory.putUInt("cert_length", cert_length);
|
failure = true;
|
||||||
this->memory.end();
|
}
|
||||||
|
if (keyFile)
|
||||||
|
keyFile.close();
|
||||||
|
|
||||||
|
certFile = SPIFFS.open("/cert.der", FILE_WRITE);
|
||||||
|
if (!certFile || !certFile.write(certificate->getCertData(), certificate->getCertLength()))
|
||||||
|
{
|
||||||
|
log_w("Could not write /key.der");
|
||||||
|
failure = true;
|
||||||
|
}
|
||||||
|
if (certFile)
|
||||||
|
certFile.close();
|
||||||
|
|
||||||
|
if (failure)
|
||||||
|
{
|
||||||
|
log_w("Certificate could not be stored permanently, generating new certificate on reboot...");
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -2,6 +2,7 @@
|
||||||
#define ESP32_STORAGE_HPP
|
#define ESP32_STORAGE_HPP
|
||||||
|
|
||||||
#include "Preferences.h"
|
#include "Preferences.h"
|
||||||
|
#include "SPIFFS.h"
|
||||||
#include "FirewallTypes.h"
|
#include "FirewallTypes.h"
|
||||||
#include "mbedtls/md.h"
|
#include "mbedtls/md.h"
|
||||||
#include "SSLCert.hpp"
|
#include "SSLCert.hpp"
|
||||||
|
@ -12,6 +13,7 @@ namespace firewall
|
||||||
{
|
{
|
||||||
private:
|
private:
|
||||||
Preferences memory;
|
Preferences memory;
|
||||||
|
void mount_spiffs();
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
uint8_t retrieve_settings_value(const char *);
|
uint8_t retrieve_settings_value(const char *);
|
||||||
|
|
|
@ -1,11 +1,8 @@
|
||||||
#include "theSecrets.h"
|
#include "theSecrets.h"
|
||||||
#include "WiFi.h"
|
#include "WiFi.h"
|
||||||
|
#include "esp32API.hpp"
|
||||||
|
|
||||||
#include "esp32FirewallAPI.hpp"
|
firewall::API *firewall_api;
|
||||||
#include "esp32Storage.hpp"
|
|
||||||
|
|
||||||
firewall::esp32FirewallApi *firewall_api;
|
|
||||||
firewall::Storage *storage;
|
|
||||||
|
|
||||||
void setup_wifi()
|
void setup_wifi()
|
||||||
{
|
{
|
||||||
|
@ -25,11 +22,10 @@ void setup_wifi()
|
||||||
void setup()
|
void setup()
|
||||||
{
|
{
|
||||||
setup_wifi();
|
setup_wifi();
|
||||||
// firewall_api = new esp32FirewallApi;
|
firewall_api = new firewall::API;
|
||||||
storage = new firewall::Storage;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void loop()
|
void loop()
|
||||||
{
|
{
|
||||||
// firewall_api->handle_clients();
|
firewall_api->handle_clients();
|
||||||
}
|
}
|
Reference in a new issue