Subversion Repositories ESP8266_P1_Meter

#ifndef CREDENTIAL_MANAGER_H

#define CREDENTIAL_MANAGER_H

#include <Arduino.h>

#include <IPAddress.h>

#include <vector>

#include <cstring>

#if defined(ESP32)

    #include <mbedtls/aes.h>

    #include "esp_efuse.h"

    #include "nvs_flash.h"

#elif defined(ESP8266)

    // Use local compatibility shim for AES on ESP8266 (BearSSL-backed)

    #include "compat/mbedtls_aes.h"

    #include "LittleFS.h"

#endif

/**

 * @brief Default encryption key (32 bytes for AES-256)

 * 

 * IMPORTANT: Modify this with your own 32-byte key!

 * ESP32: This is used as fallback if BLOCK_KEY0 is not programmed

 * ESP8266: This is always used (no eFuse available)

 * 

 * Example generation:

 * $ python3 -c "import os; key = os.urandom(32); print('0x' + ',0x'.join(f'{b:02x}' for b in key))"

 */

#ifndef CREDENTIAL_MANAGER_ENCRYPTION_KEY

#define CREDENTIAL_MANAGER_ENCRYPTION_KEY \

    0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, \

    0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99

#endif

/**

 * @class CredentialManager

 * @brief Manages WiFi credentials with transparent AES-256 encryption

 * 

 * Features:

 * - Automatic encryption with AES-256-CBC

 * - ESP32: Support for BLOCK_KEY0 (eFuse) with secure fallback

 * - ESP8266: User-defined encryption key (no eFuse available)

 * - Persistent storage in NVS (ESP32) or SPIFFS (ESP8266)

 * - Multiple SSID/password management

 * - Transparent: works seamlessly across platforms

 * - Passwords always encrypted in memory and storage

 */

struct WiFiCredential {

    char ssid[33];                  // Max 32 char SSID + null

    uint8_t pwd_encrypted[64];      // Encrypted password

    uint16_t pwd_len;               // Length of encrypted data

    IPAddress gateway;              // Optional static IP config

    IPAddress subnet;               // Optional static IP config    

    IPAddress local_ip;             // Optional static IP config

    IPAddress dns1;                 // Optional primary DNS (per SSID)

    IPAddress dns2;                 // Optional secondary DNS (per SSID)

};

class CredentialManager {

public:

    friend class FSWebServer;

    static const uint8_t MAX_CREDENTIALS = 5;

    static const uint8_t ENCRYPTION_KEY_SIZE = 32; // 256-bit AES

    static const uint16_t AES_BLOCK_SIZE = 16;

    /**

     * @brief Constructor - initializes the manager

     */

    CredentialManager();

    /**

     * @brief Destructor - frees resources

     */

    ~CredentialManager();

    /**

     * @brief Initialize encryption key from eFuse (ESP32) or predefined constant (ESP8266)

     * @return true if successful, false on error

     */

    bool begin();

    /**

     * @brief Return encryption security status

     * @return true if encryption is properly configured

     */

    bool isSecure() const { return m_efuse_initialized; }

    /**

     * @brief Return status description

     * @return String with security status and platform info

     */

    String getStatus() const;

    /**

     * @brief Add a WiFi credential (automatically encrypted)

     * @param credential WiFiCredential struct containing SSID and optional IP config

     * @param plaintext_password Plaintext password (will be encrypted internally)

     * @return true if successfully added

     */

    bool addCredential(const WiFiCredential& credential, const char* plaintext_password);

    /**

     * @brief Update a WiFi credential (automatically encrypted)

     * @param credential WiFiCredential struct with IP config and SSID to identify

     * @param plaintext_password Plaintext password (will be encrypted internally)

     * @return true if successfully updated

     */

    bool updateCredential(const WiFiCredential& credential, const char* plaintext_password);

    /**

     * @brief Get number of stored credentials

     * @return Credential count

     */

    uint8_t getCredentialCount() const { return m_credentials.size(); }

    /**

     * @brief Get SSID of a credential

     * @param index Credential index

     * @return SSID (nullptr if index invalid)

     */

    const char* getSSID(uint8_t index) const;

    /**

     * @brief Get decrypted password of a credential

     * @param index Credential index

     * @return Password in plaintext (automatic removal from memory after use)

     */

    String getPassword(uint8_t index);

    String getPassword(const char* ssid) {

        for (size_t i = 0; i < m_credentials.size(); i++) {

            if (strcmp(m_credentials[i].ssid, ssid) == 0) {

                return getPassword(i);

            }

        }

        return "";

    }

    /**

     * @brief Set static IP configuration for a credential

     * @param index Credential index

     * @param ip Local IP address (0.0.0.0 for DHCP)

     * @param gateway Gateway IP address

     * @param subnet Subnet mask

     * @return true if successfully set

     */

    bool setIPConfiguration(uint8_t index, IPAddress ip, IPAddress gateway, IPAddress subnet);

    /**

     * @brief Get static IP configuration for a credential

     * @param index Credential index

     * @param ip Output: Local IP address

     * @param gateway Output: Gateway IP address

     * @param subnet Output: Subnet mask

     * @return true if valid configuration exists

     */

    bool getIPConfiguration(uint8_t index, IPAddress& ip, IPAddress& gateway, IPAddress& subnet) const;

    /**

     * @brief Clear all credentials from memory

     */

    void clearAll();

    /**

     * @brief Remove a single credential by index

     * @param index Credential index

     * @return true if removed

     */

    bool removeCredential(uint8_t index);

    /**

     * @brief Remove a single credential by SSID

     * @param ssid Network SSID

     * @return true if removed

     */

    bool removeCredential(const char* ssid);

    #if defined(ESP8266)

    /**

     * @brief Set filesystem reference for persistence (ESP8266/ESP32)

     * @param fs Pointer to FS object (LittleFS or SPIFFS)

     * @note Required for saveToFS() and loadFromFS() to work on ESP8266

     */

    void setFilesystem(fs::FS* fs);

    /**

     * @brief Save credentials to filesystem (ESP8266/SPIFFS)

     * @param filepath Path to save file

     * @return true if successful

     */

    bool saveToFS(const char* filepath = "/credentials.bin");

    /**

     * @brief Load credentials from filesystem (ESP8266/SPIFFS)

     * @param filepath Path to load file from

     * @return true if at least one credential loaded

     */

    bool loadFromFS(const char* filepath = "/credentials.bin");

    #endif

    #if defined(ESP32)

    /**

     * @brief Save credentials to NVS (ESP32 only)

     * @param nvs_namespace NVS namespace to use

     * @return true if successful

     */

    bool saveToNVS(const char* nvs_namespace = "wifi_creds");

    /**

     * @brief Load credentials from NVS (ESP32 only)

     * @param nvs_namespace NVS namespace to use

     * @return true if at least one credential loaded

     */

    bool loadFromNVS(const char* nvs_namespace = "wifi_creds");

    #endif

    /**

     * @brief Get BLOCK_KEY0 status details

     * @return Technical status details

     */

    String getDebugInfo() const;

    std::vector<WiFiCredential>* getCredentials() {

        return &m_credentials;

    }

    bool checkSSIDExists(const char* ssid) const {

        for (const auto& cred : m_credentials) {

            if (strcmp(cred.ssid, ssid) == 0) {

                return true;

            }

        }

        return false;

    }

    /**

     * @brief Set HTTP webserver hostname (shared across libraries)

     */

    void setHostname(const char* hostname);

    /**

     * @brief Get HTTP webserver hostname (shared across libraries)

     */

    String getHostname() const;

    /**

     * @brief Set HTTP webserver port (shared across libraries)

     */

    // Port is fixed at construction time in AsyncFsWebServer, so it is not

    // exposed as a configurable shared option here.

protected:

    std::vector<WiFiCredential> m_credentials;

    uint8_t m_encryption_key[ENCRYPTION_KEY_SIZE];

    bool m_efuse_initialized;

    // Global options shared across libraries (hostname only)

    char m_hostname[33];            // HTTP server hostname (max 32 chars + null)

    #if defined(ESP8266)

    fs::FS* m_filesystem;

    #endif

    /**

     * @brief Load key from eFuse (ESP32) or predefined constant (ESP8266)

     */

    void initializeEncryptionKey();

    /**

     * @brief Encrypt password with AES-256-CBC

     * @param plaintext Password in plaintext

     * @param ciphertext Output encrypted buffer

     * @param cipher_len Output: length of encrypted data

     * @return true if successful

     */

    bool encryptPassword(const char* plaintext, uint8_t* ciphertext, uint16_t& cipher_len);

    /**

     * @brief Decrypt password with AES-256-CBC

     * @param ciphertext Encrypted data

     * @param cipher_len Length of encrypted data

     * @param plaintext Output password buffer

     * @param max_len Maximum buffer size

     * @return true if successful

     */

    bool decryptPassword(const uint8_t* ciphertext, uint16_t cipher_len,

                        char* plaintext, uint16_t max_len);

    /**

     * @brief Apply PKCS7 padding

     * @param data Input buffer

     * @param data_len Length of original data

     * @param padded Output buffer with padding

     * @param padded_len Output: total length with padding

     */

    void applyPKCS7Padding(const uint8_t* data, uint16_t data_len,

                           uint8_t* padded, uint16_t& padded_len);

    /**

     * @brief Remove PKCS7 padding

     * @param data Input buffer

     * @param data_len Buffer length

     * @return Length of data without padding (0 if error)

     */

    uint16_t removePKCS7Padding(uint8_t* data, uint16_t data_len);

};

#endif // CREDENTIAL_MANAGER_H