Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,12 @@ dkms.conf
components/**/build
components/**/sdkconfig
components/**/sdkconfig.old
components/**/managed_components
components/**/dependencies.lock
.idea/
.cache/
cmake-build-*/
release_notes.txt

# generation script temp files
esp_wifi_preprocessed.h
Expand Down
Original file line number Diff line number Diff line change
@@ -1,26 +1,42 @@
menu "Example Configuration"

config ESP_WIFI_LOCAL_ENABLE
bool "Enable Local WiFi"
default y
help
Enable local WiFi station connection.

config ESP_WIFI_REMOTE_ENABLE
bool "Enable Remote WiFi"
default y
help
Enable remote WiFi station connection.

config ESP_WIFI_LOCAL_SSID
string "Local WiFi SSID"
default "myssid"
depends on ESP_WIFI_LOCAL_ENABLE
help
SSID (network name) for the example to connect to.

config ESP_WIFI_LOCAL_PASSWORD
string "Local WiFi Password"
default "mypassword"
depends on ESP_WIFI_LOCAL_ENABLE
help
WiFi password (WPA or WPA2) for the example to use.

config ESP_WIFI_REMOTE_SSID
string "Remote WiFi SSID"
default "myssid"
depends on ESP_WIFI_REMOTE_ENABLE
help
SSID (network name) for the example to connect to.

config ESP_WIFI_REMOTE_PASSWORD
string "Remote WiFi Password"
default "mypassword"
depends on ESP_WIFI_REMOTE_ENABLE
help
WiFi password (WPA or WPA2) for the example to use.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,10 @@ static EventGroupHandle_t s_wifi_event_group;
#define WIFI_REMOTE_FAIL_BIT BIT3
#define WIFI_REMOTE_BITS (WIFI_REMOTE_CONNECTED_BIT | WIFI_REMOTE_FAIL_BIT)

static const char *TAG_local = "two_stations_local";
static const char *TAG_remote = "two_stations_remote";

static int s_retry_num = 0;

#if CONFIG_ESP_WIFI_LOCAL_ENABLE
static const char *TAG_local = "two_stations_local";

static void event_handler(void* arg, esp_event_base_t event_base,
int32_t event_id, void* event_data)
Expand All @@ -72,6 +71,10 @@ static void event_handler(void* arg, esp_event_base_t event_base,
xEventGroupSetBits(s_wifi_event_group, WIFI_CONNECTED_BIT);
}
}
#endif

#if CONFIG_ESP_WIFI_REMOTE_ENABLE
static const char *TAG_remote = "two_stations_remote";

static void event_handler_remote(void* arg, esp_event_base_t event_base,
int32_t event_id, void* event_data)
Expand All @@ -94,6 +97,7 @@ static void event_handler_remote(void* arg, esp_event_base_t event_base,
xEventGroupSetBits(s_wifi_event_group, WIFI_REMOTE_CONNECTED_BIT);
}
}
#endif

static void init_system_components(void)
{
Expand All @@ -102,6 +106,7 @@ static void init_system_components(void)
ESP_ERROR_CHECK(esp_event_loop_create_default());
}

#if CONFIG_ESP_WIFI_LOCAL_ENABLE
static void wifi_init_sta(void)
{
esp_netif_create_default_wifi_sta();
Expand Down Expand Up @@ -136,7 +141,9 @@ static void wifi_init_sta(void)
ESP_LOGE(TAG_local, "UNEXPECTED EVENT");
}
}
#endif

#if CONFIG_ESP_WIFI_REMOTE_ENABLE
static void wifi_init_remote_sta(void)
{
wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
Expand Down Expand Up @@ -168,6 +175,7 @@ static void wifi_init_remote_sta(void)
ESP_LOGE(TAG_remote, "UNEXPECTED EVENT");
}
}
#endif

void app_main(void)
{
Expand All @@ -180,6 +188,12 @@ void app_main(void)
ESP_ERROR_CHECK(ret);

init_system_components();

#if CONFIG_ESP_WIFI_LOCAL_ENABLE
wifi_init_sta();
#endif

#if CONFIG_ESP_WIFI_REMOTE_ENABLE
wifi_init_remote_sta();
#endif
}
9 changes: 9 additions & 0 deletions components/wifi_remote_over_eppp/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,15 @@ if ESP_WIFI_REMOTE_LIBRARY_EPPP
string "Server key"
default "--- Please copy content of the Client key ---"

config WIFI_RMT_OVER_EPPP_SERVER_CN
string "Server common name"
default "espressif.local"
help
Common name of the EPPP server.
This is checked when establishing a TLS connection
between the EPPP client and server. This CN should
match the CN in your server certificate.

endif # ESP_WIFI_REMOTE_LIBRARY_EPPP

endmenu # Wi-Fi Remote over EPPP
6 changes: 6 additions & 0 deletions components/wifi_remote_over_eppp/scripts/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
CLIENT_*
SERVER_*
*.crt
*.key
*.srl
*.csr
117 changes: 117 additions & 0 deletions components/wifi_remote_over_eppp/scripts/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
# Test Certificate Generation

This directory contains scripts for generating test certificates and keys for the WiFi Remote over EPPP component.

## Overview

The WiFi Remote over EPPP component uses TLS with mutual authentication for secure communication between the host and slave devices. This requires certificates and keys for both parties.

## Certificate Generation Script

The `generate_test_certs.sh` script generates a complete set of test certificates and keys suitable for development and testing purposes.

### Usage

```bash
./generate_test_certs.sh [SERVER_CN] [CLIENT_CN]
```

**Parameters:**
- `SERVER_CN`: Server certificate common name (default: espressif.local)
- `CLIENT_CN`: Client certificate common name (default: client_cn)

**Examples:**
```bash
# Use default values (espressif.local, client_cn)
./generate_test_certs.sh

# Specify custom server CN
./generate_test_certs.sh myserver.local

# Specify both server and client CN
./generate_test_certs.sh myserver.local myclient.local

# Show help
./generate_test_certs.sh --help
```

### Generated Files

The script generates the following files:

**Certificate Authority:**
- `ca.crt` - Root CA certificate
- `ca.key` - Root CA private key

**Server Certificates:**
- `SERVER_CA` - CA certificate for server validation (copy of ca.crt)
- `SERVER_CRT` - Server certificate
- `SERVER_KEY` - Server private key

**Client Certificates:**
- `CLIENT_CA` - CA certificate for client validation (copy of ca.crt)
- `CLIENT_CRT` - Client certificate
- `CLIENT_KEY` - Client private key

**Configuration Output:**
The script also outputs ESP-IDF configuration options in the correct format for direct use in `sdkconfig` or menuconfig.

## Configuration

### Host Device (RPC Client)

For the host device running the WiFi Remote client, configure these options:

```bash
CONFIG_WIFI_RMT_OVER_EPPP_SERVER_CA="<SERVER_CA content>"
CONFIG_WIFI_RMT_OVER_EPPP_CLIENT_CRT="<CLIENT_CRT content>"
CONFIG_WIFI_RMT_OVER_EPPP_CLIENT_KEY="<CLIENT_KEY content>"
```

### Slave Device (RPC Server)

For the slave device running the WiFi Remote server, configure these options:

```bash
CONFIG_WIFI_RMT_OVER_EPPP_CLIENT_CA="<CLIENT_CA content>"
CONFIG_WIFI_RMT_OVER_EPPP_SERVER_CRT="<SERVER_CRT content>"
CONFIG_WIFI_RMT_OVER_EPPP_SERVER_KEY="<SERVER_KEY content>"
```

## Security Notes

⚠️ **Important Security Considerations:**

1. **Test Certificates Only**: These certificates are generated for development and testing purposes only. They use a self-signed CA and should not be used in production environments.

2. **Default Common Name**: The default server common name is `espressif.local`. This should be changed to match your actual server hostname in production.

3. **Certificate Validity**: Generated certificates are valid for 365 days from creation.

4. **Key Strength**: Certificates use RSA 2048-bit keys, which is suitable for most applications but may need to be updated for high-security requirements.

## Integration with Examples

These certificates are used by the WiFi Remote examples:

- **MQTT Example**: Uses client certificates to connect to the remote WiFi interface
- **Server Example**: Uses server certificates to authenticate incoming connections

For detailed setup instructions, refer to the README files in the respective example directories:
- [MQTT Example](../../esp_wifi_remote/examples/mqtt/README.md)
- [Server Example](../../esp_wifi_remote/examples/server/README.md)

## Troubleshooting

**Certificate Mismatch Errors:**
- Ensure the common name in the server certificate matches the hostname used by the client
- Verify that both devices are using certificates from the same CA

**Connection Failures:**
- Check that all required certificate configurations are properly set
- Ensure the certificate content includes the full PEM format (including headers and footers)
- Verify that the UART/SPI connection pins are correctly configured

**Certificate Expiration:**
- Regenerate certificates if they have expired (365 days from generation)
- Update all configuration files with the new certificate content
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,24 @@ function sign_with_ca { # Params: [KEY_FILE] [CN] [CRT_FILE]

function export_config { # Params: [FILE/CONFIG_NAME]
content=`cat $1 | sed '/---/d' | tr -d '\n'`
echo "CONFIG_ESP_WIFI_REMOTE_EPPP_$1=\"${content}\""
echo "CONFIG_WIFI_RMT_OVER_EPPP_$1=\"${content}\""
}

if [ -z "$1" ]; then
echo "Usage $0 <SERVER_CN> [CLIENT_CN]"
exit 1;
# Check for help flag or too many arguments
if [ "$1" = "--help" ] || [ $# -gt 2 ]; then
echo "Usage: $0 [SERVER_CN] [CLIENT_CN]"
echo " SERVER_CN: Server certificate common name (default: espressif.local)"
echo " CLIENT_CN: Client certificate common name (default: client_cn)"
echo ""
echo "Examples:"
echo " $0 # Uses defaults: espressif.local, client_cn"
echo " $0 myserver.local # Uses: myserver.local, client_cn"
echo " $0 myserver.local myclient.local # Uses: myserver.local, myclient.local"
exit 0
fi

SERVER_CN=$1
# Set defaults and handle arguments
SERVER_CN="${1-espressif.local}"
CLIENT_CN="${2-client_cn}"

echo "Server's CN: $SERVER_CN"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ RpcInstance *RpcEngine::init_client()
cfg.clientcert_bytes = sizeof(client::crt);
cfg.clientkey_buf = client::key;
cfg.clientkey_bytes = sizeof(client::key);
cfg.common_name = "espressif.local";
cfg.common_name = CONFIG_WIFI_RMT_OVER_EPPP_SERVER_CN;

ESP_RETURN_ON_FALSE(tls_ = esp_tls_init(), nullptr, TAG, "Failed to create ESP-TLS instance");
int retries = 0;
Expand Down