BLE GATT 配置：让 read、write、notify 和安全门各司其职

CONFIG_BT_NIMBLE_SECURITY_ENABLE=y
CONFIG_BT_NIMBLE_SM_SC=y
CONFIG_BT_NIMBLE_SM_SC_ONLY=1
CONFIG_BT_NIMBLE_SM_LVL=4
# CONFIG_BT_NIMBLE_SM_LEGACY is not set
# CONFIG_BT_NIMBLE_SM_SC_DEBUG_KEYS is not set
# CONFIG_BT_NIMBLE_NVS_PERSIST is not set

/* SPDX-License-Identifier: MIT */
#include <string.h>
#include <inttypes.h>
#include "esp_log.h"
#include "esp_random.h"
#include "driver/gpio.h"
#include "nvs_flash.h"
#include "nimble/nimble_port.h"
#include "nimble/nimble_port_freertos.h"
#include "nimble/nimble_npl.h"
#include "host/ble_hs.h"
#include "host/ble_sm.h"
#include "host/util/util.h"
#include "services/gap/ble_svc_gap.h"
#include "services/gatt/ble_svc_gatt.h"
#include "gatt_model.h"
static const char *TAG="W06";
static const ble_uuid128_t svc_uuid=BLE_UUID128_INIT(0x02,0xd7,0x77,0xb8,0xf2,0x6c,0x55,0x9d,0x92,0x4c,0x8a,0x8c,0xa7,0x49,0xfb,0x36);
static const ble_uuid128_t status_uuid=BLE_UUID128_INIT(0x03,0xd7,0x77,0xb8,0xf2,0x6c,0x55,0x9d,0x92,0x4c,0x8a,0x8c,0xa7,0x49,0xfb,0x36);
static const ble_uuid128_t config_uuid=BLE_UUID128_INIT(0x04,0xd7,0x77,0xb8,0xf2,0x6c,0x55,0x9d,0x92,0x4c,0x8a,0x8c,0xa7,0x49,0xfb,0x36);
static uint16_t status_handle;static uint8_t own_addr_type;static uint32_t sequence;static w06_config_t config={.interval_s=5};static w06_link_t link={.handle=UINT16_MAX};static struct ble_npl_callout timer;
static bool maintenance(void){return gpio_get_level(GPIO_NUM_5)==0;}
static void schedule(void){int rc=ble_npl_callout_reset(&timer,ble_npl_time_ms_to_ticks32(config.interval_s*1000U));if(rc)ESP_LOGE(TAG,"status timer rc=%d",rc);}
static w06_security_t security(uint16_t handle){struct ble_gap_conn_desc d;if(ble_gap_conn_find(handle,&d))return (w06_security_t){0};return (w06_security_t){d.sec_state.encrypted,d.sec_state.authenticated,d.sec_state.key_size};}
static int access(uint16_t conn,uint16_t attr,struct ble_gatt_access_ctxt *ctxt,void *arg){
 (void)attr;const bool is_config=arg!=NULL;
 if(ctxt->op==BLE_GATT_ACCESS_OP_READ_CHR){
  if(!is_config){uint8_t out[8];w06_status(&config,sequence,out);return os_mbuf_append(ctxt->om,out,sizeof(out))?BLE_ATT_ERR_INSUFFICIENT_RES:0;}
  int e=w06_secure(security(conn));if(e)return e;uint8_t out[4]={1,(uint8_t)config.interval_s,(uint8_t)(config.interval_s>>8),config.led?1:0};return os_mbuf_append(ctxt->om,out,sizeof(out))?BLE_ATT_ERR_INSUFFICIENT_RES:0;
 }
 if(!is_config||ctxt->op!=BLE_GATT_ACCESS_OP_WRITE_CHR)return BLE_ATT_ERR_WRITE_NOT_PERMITTED;
 const size_t length=OS_MBUF_PKTLEN(ctxt->om);if(length!=4)return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
 uint8_t bytes[4];if(os_mbuf_copydata(ctxt->om,0,4,bytes))return BLE_ATT_ERR_UNLIKELY;
 int e=w06_write(&config,bytes,sizeof(bytes),security(conn),maintenance());
 if(e){ESP_LOGW(TAG,"WRITE rejected ATT=0x%02x; config unchanged",e);return e;}
 gpio_set_level(GPIO_NUM_4,config.led);schedule();ESP_LOGI(TAG,"WRITE accepted RAM interval=%u LED_command=%u; not observed light",config.interval_s,config.led);return 0;
}
static const struct ble_gatt_svc_def services[]={
 {.type=BLE_GATT_SVC_TYPE_PRIMARY,.uuid=&svc_uuid.u,.characteristics=(struct ble_gatt_chr_def[]){
  {.uuid=&status_uuid.u,.access_cb=access,.flags=BLE_GATT_CHR_F_READ|BLE_GATT_CHR_F_NOTIFY,.val_handle=&status_handle},
  {.uuid=&config_uuid.u,.access_cb=access,.arg=(void*)1,.flags=BLE_GATT_CHR_F_READ|BLE_GATT_CHR_F_WRITE|BLE_GATT_CHR_F_READ_ENC|BLE_GATT_CHR_F_READ_AUTHEN|BLE_GATT_CHR_F_WRITE_ENC|BLE_GATT_CHR_F_WRITE_AUTHEN,.min_key_size=16},
  {0}}},{0}};
static void advertise(void);
static int gap_event(struct ble_gap_event *event,void *arg){
 (void)arg;
 switch(event->type){
 case BLE_GAP_EVENT_CONNECT:
  if(event->connect.status){ESP_LOGW(TAG,"connect failed=%d",event->connect.status);advertise();return 0;}
  w06_connect(&link,event->connect.conn_handle);ESP_LOGI(TAG,"CONNECTED handle=%u; subscription reset",link.handle);
  if(maintenance()){int rc=ble_gap_security_initiate(link.handle);ESP_LOGI(TAG,"security request rc=%d; verify private UART PIN",rc);}return 0;
 case BLE_GAP_EVENT_DISCONNECT:w06_disconnect(&link);ESP_LOGI(TAG,"DISCONNECTED; no pending notifications/history");advertise();return 0;
 case BLE_GAP_EVENT_SUBSCRIBE:
  if(event->subscribe.attr_handle==status_handle){w06_subscription(&link,event->subscribe.conn_handle,event->subscribe.cur_notify);}
  return 0;
 case BLE_GAP_EVENT_ENC_CHANGE:{
  w06_security_t s=security(event->enc_change.conn_handle);ESP_LOGI(TAG,"SECURITY status=%d encrypted=%u authenticated=%u key_bytes=%u",event->enc_change.status,s.encrypted,s.authenticated,s.key_size);
  if(event->enc_change.status||w06_secure(s)){ble_gap_terminate(event->enc_change.conn_handle,BLE_ERR_AUTH_FAIL);}
  return 0;}
 case BLE_GAP_EVENT_PASSKEY_ACTION:{
  if(!maintenance()||event->passkey.params.action!=BLE_SM_IOACT_DISP){ESP_LOGW(TAG,"pairing rejected: maintenance closed or unsupported IO action; no JustWorks acceptance");ble_gap_terminate(event->passkey.conn_handle,BLE_ERR_AUTH_FAIL);return 0;}
  uint32_t number,limit=UINT32_MAX-(UINT32_MAX%1000000U);do{number=esp_random();}while(number>=limit);
  struct ble_sm_io io={.action=BLE_SM_IOACT_DISP,.passkey=number%1000000U};ESP_LOGW(TAG,"PRIVATE PAIRING PIN %06"PRIu32" (this attempt only; do not publish UART log)",io.passkey);
  int rc=ble_sm_inject_io(event->passkey.conn_handle,&io);if(rc)ESP_LOGW(TAG,"inject PIN rc=%d",rc);return 0;}
 case BLE_GAP_EVENT_REPEAT_PAIRING:ESP_LOGW(TAG,"repeat pairing refused; no automatic bond deletion");return BLE_GAP_REPEAT_PAIRING_IGNORE;
 default:return 0;
 }
}
static void advertise(void){
 struct ble_hs_adv_fields fields={0};fields.flags=BLE_HS_ADV_F_DISC_GEN|BLE_HS_ADV_F_BREDR_UNSUP;fields.uuids128=(ble_uuid128_t*)&svc_uuid;fields.num_uuids128=1;fields.uuids128_is_complete=1;
 int rc=ble_gap_adv_set_fields(&fields);if(rc){ESP_LOGE(TAG,"adv_fields rc=%d",rc);return;}
 struct ble_hs_adv_fields scan={0};const char *name="HW-W06";scan.name=(const uint8_t*)name;scan.name_len=strlen(name);scan.name_is_complete=1;rc=ble_gap_adv_rsp_set_fields(&scan);if(rc){ESP_LOGE(TAG,"scan_rsp rc=%d",rc);return;}
 struct ble_gap_adv_params p={0};p.conn_mode=BLE_GAP_CONN_MODE_UND;p.disc_mode=BLE_GAP_DISC_MODE_GEN;rc=ble_gap_adv_start(own_addr_type,NULL,BLE_HS_FOREVER,&p,gap_event,NULL);ESP_LOGI(TAG,"advertise rc=%d",rc);
}
static void timer_event(struct ble_npl_event *event){
 (void)event;++sequence;
 if(link.connected&&link.subscribed){uint8_t out[8];w06_status(&config,sequence,out);struct os_mbuf *om=ble_hs_mbuf_from_flat(out,sizeof(out));if(!om)ESP_LOGW(TAG,"notify allocation failed");else{int rc=ble_gatts_notify_custom(link.handle,status_handle,om);ESP_LOGI(TAG,"NOTIFY queued rc=%d seq=%"PRIu32"; no phone receipt ACK",rc,sequence);}}
 schedule();
}
static void reset(int reason){w06_disconnect(&link);ESP_LOGW(TAG,"host reset=%d",reason);}
static void sync_ready(void){int rc=ble_hs_util_ensure_addr(0);if(!rc)rc=ble_hs_id_infer_auto(0,&own_addr_type);if(rc){ESP_LOGE(TAG,"identity rc=%d",rc);return;}advertise();schedule();}
static void host_task(void *arg){(void)arg;nimble_port_run();nimble_port_freertos_deinit();}
void app_main(void){
 gpio_config_t led={.pin_bit_mask=1ULL<<4,.mode=GPIO_MODE_OUTPUT};ESP_ERROR_CHECK(gpio_config(&led));gpio_set_level(GPIO_NUM_4,0);
 gpio_config_t arm={.pin_bit_mask=1ULL<<5,.mode=GPIO_MODE_INPUT};ESP_ERROR_CHECK(gpio_config(&arm));
 esp_err_t e=nvs_flash_init();if(e!=ESP_OK){ESP_LOGE(TAG,"NVS=%s; no automatic erase",esp_err_to_name(e));return;}
 e=nimble_port_init();if(e!=ESP_OK){ESP_LOGE(TAG,"NimBLE init=%s",esp_err_to_name(e));return;}
 ble_hs_cfg.reset_cb=reset;ble_hs_cfg.sync_cb=sync_ready;ble_hs_cfg.sm_io_cap=BLE_HS_IO_DISPLAY_ONLY;ble_hs_cfg.sm_mitm=1;ble_hs_cfg.sm_sc=1;ble_hs_cfg.sm_sc_only=1;ble_hs_cfg.sm_sec_lvl=4;ble_hs_cfg.sm_bonding=0;
 ble_svc_gap_init();ble_svc_gatt_init();ble_svc_gap_device_name_set("HW-W06");int rc=ble_gatts_count_cfg(services);if(!rc)rc=ble_gatts_add_svcs(services);if(rc){ESP_LOGE(TAG,"GATT register rc=%d",rc);return;}
 ble_npl_callout_init(&timer,nimble_port_get_dflt_eventq(),timer_event,NULL);nimble_port_freertos_init(host_task);
 ESP_LOGI(TAG,"W06 SC-only, authenticated16B key for config, physicalLOW for write; RAM only, no default PIN/bond persistence");
}