ESP32 OTA 升级怎么回退？模拟坏包、断网和新固件自检失败

# POSIX shell · 解压工程根、已进入IDF5.5.5环境
export LAB_PROJECT="$PWD"
export LAB_PASS="$HOME/esp32-labs/r05-pass"
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_PASS" -D SDKCONFIG="$LAB_PASS/sdkconfig" -D 'SDKCONFIG_DEFAULTS=sdkconfig.defaults;sdkconfig.candidate-pass.defaults' build

# POSIX shell · 独立Python3.12主机环境，已安装tools/requirements.txt
export R05_PRIVATE="$HOME/esp32-private/r05-lab-new"
python tools/generate_lab.py --out "$R05_PRIVATE" --name r05-lab.test
cp "$R05_PRIVATE/lab_ca.pem" main/server_ca.pem
python tools/ota_server.py --cert "$R05_PRIVATE/server_cert.pem" --key "$R05_PRIVATE/server.key" --image "$LAB_PASS/r05_maintenance.bin" --bind YOUR_OWN_LAN_IP --port 8443

// ---- main/main.c ----
/* SPDX-License-Identifier: MIT */
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>
#include <inttypes.h>
#include <time.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "freertos/event_groups.h"
#include "esp_log.h"
#include "esp_system.h"
#include "esp_timer.h"
#include "esp_event.h"
#include "esp_netif.h"
#include "esp_netif_sntp.h"
#include "esp_wifi.h"
#include "esp_https_ota.h"
#include "esp_ota_ops.h"
#include "nvs_flash.h"
#include "sdkconfig.h"
#include "ota_policy.h"
static const char*TAG="R05";
static EventGroupHandle_t events;
static bool network_started,sntp_started;
static int64_t last_sync_ms=-1;
extern const char ca_start[] asm("_binary_server_ca_pem_start");
static void network_event(void*arg,esp_event_base_t base,int32_t id,void*data){
 (void)arg;(void)data;
 if(base==IP_EVENT&&id==IP_EVENT_STA_GOT_IP)xEventGroupSetBits(events,1);
 if(base==WIFI_EVENT&&id==WIFI_EVENT_STA_DISCONNECTED)xEventGroupClearBits(events,1);
}
static bool network_ready(void){
 if(strstr(CONFIG_R05_SSID,"REPLACE_")||strstr(CONFIG_R05_PASSWORD,"REPLACE_")||strstr(CONFIG_R05_URL,"REPLACE_")||strstr(ca_start,"REPLACE_")){
  ESP_LOGW(TAG,"CONFIG_MISSING: own SSID/password/HTTPS origin/public CA required; values omitted");return false;
 }
 if(strncmp(CONFIG_R05_URL,"https://",8)){ESP_LOGE(TAG,"HTTPS_REQUIRED");return false;}
 if(!strlen(CONFIG_R05_SSID)||strlen(CONFIG_R05_SSID)>31||strlen(CONFIG_R05_PASSWORD)<8||strlen(CONFIG_R05_PASSWORD)>63){ESP_LOGE(TAG,"CONFIG_LENGTH_REJECT: example requires SSID1..31 bytes and WPA2 password8..63; values omitted");return false;}
 if(!network_started){
  events=xEventGroupCreate();if(!events)return false;
  ESP_ERROR_CHECK(esp_netif_init());ESP_ERROR_CHECK(esp_event_loop_create_default());esp_netif_create_default_wifi_sta();
  wifi_init_config_t init=WIFI_INIT_CONFIG_DEFAULT();ESP_ERROR_CHECK(esp_wifi_init(&init));
  ESP_ERROR_CHECK(esp_event_handler_register(WIFI_EVENT,ESP_EVENT_ANY_ID,network_event,NULL));
  ESP_ERROR_CHECK(esp_event_handler_register(IP_EVENT,IP_EVENT_STA_GOT_IP,network_event,NULL));
  ESP_ERROR_CHECK(esp_wifi_set_storage(WIFI_STORAGE_RAM));wifi_config_t wi={0};
  snprintf((char*)wi.sta.ssid,sizeof(wi.sta.ssid),"%s",CONFIG_R05_SSID);snprintf((char*)wi.sta.password,sizeof(wi.sta.password),"%s",CONFIG_R05_PASSWORD);
  wi.sta.threshold.authmode=WIFI_AUTH_WPA2_PSK;
  ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA,&wi));ESP_ERROR_CHECK(esp_wifi_start());network_started=true;
 }
 if(!(xEventGroupGetBits(events)&1)){
  esp_err_t e=esp_wifi_connect();if(e!=ESP_OK&&e!=ESP_ERR_WIFI_CONN){ESP_LOGE(TAG,"CONNECT_REQUEST=%s",esp_err_to_name(e));return false;}
  if(!(xEventGroupWaitBits(events,1,pdFALSE,pdTRUE,pdMS_TO_TICKS(15000))&1)){ESP_LOGE(TAG,"CONNECT_TIMEOUT; current app retained; retry command later");return false;}
 }
 if(!sntp_started){esp_sntp_config_t sc=ESP_NETIF_SNTP_DEFAULT_CONFIG(CONFIG_R05_SNTP);sc.wait_for_sync=true;ESP_ERROR_CHECK(esp_netif_sntp_init(&sc));sntp_started=true;}
 if(last_sync_ms<0||esp_timer_get_time()/1000-last_sync_ms>=3600000){
  if(esp_netif_sntp_sync_wait(pdMS_TO_TICKS(15000))!=ESP_OK){ESP_LOGE(TAG,"SNTP_WAIT_TIMEOUT; no insecure fallback");return false;}
  last_sync_ms=esp_timer_get_time()/1000;
 }
 if(time(NULL)<1767225600){ESP_LOGE(TAG,"CLOCK_RANGE_REJECT");return false;}return true;
}
static void perform_ota(const char*path){
 if(!network_ready())return;
 char url[256];int n=snprintf(url,sizeof(url),"%s%s",CONFIG_R05_URL,path);if(n<0||n>=(int)sizeof(url)){ESP_LOGE(TAG,"URL_TOO_LONG");return;}
 esp_http_client_config_t hc={.url=url,.cert_pem=ca_start,.timeout_ms=3000,.keep_alive_enable=false,.skip_cert_common_name_check=false};
 esp_https_ota_config_t oc={.http_config=&hc};esp_https_ota_handle_t handle=NULL;
 int64_t began=esp_timer_get_time()/1000;esp_err_t err=esp_https_ota_begin(&oc,&handle);
 if(err!=ESP_OK){ESP_LOGE(TAG,"BEGIN_REJECT=%s current app retained",esp_err_to_name(err));return;}
 do{
  if(ota_deadline(began,esp_timer_get_time()/1000)){err=ESP_ERR_TIMEOUT;break;}
  err=esp_https_ota_perform(handle);vTaskDelay(pdMS_TO_TICKS(1));
 }while(err==ESP_ERR_HTTPS_OTA_IN_PROGRESS);
 /* Network operation timeout is not a hard total deadline: each call can block. */
 if(err!=ESP_OK||!esp_https_ota_is_complete_data_received(handle)){
  ESP_LOGE(TAG,"DOWNLOAD_REJECT=%s bytes=%d; abort keeps existing boot selection",esp_err_to_name(err),esp_https_ota_get_image_len_read(handle));
  esp_err_t a=esp_https_ota_abort(handle);ESP_LOGI(TAG,"ABORT=%s",esp_err_to_name(a));return;
 }
 err=esp_https_ota_finish(handle); /* validates image and selects next boot only on success */
 if(err!=ESP_OK){ESP_LOGE(TAG,"FINISH_REJECT=%s; no success/restart claimed",esp_err_to_name(err));return;}
 ESP_LOGW(TAG,"IMAGE_SELECTED: restarting; pending candidate must self-test before VALID");fflush(stdout);vTaskDelay(pdMS_TO_TICKS(200));esp_restart();
}
static bool self_test(void){
 /* Only software/NVS availability: not Wi-Fi, peripherals or power certification. */
 uint8_t*p=malloc(1024);if(!p)return false;memset(p,0xA5,1024);bool ok=true;for(size_t i=0;i<1024;i++)if(p[i]!=0xA5)ok=false;free(p);
#if CONFIG_R05_REJECT_SELFTEST
 ok=false;
#endif
 return ok;
}
void app_main(void){
 const esp_partition_t*run=esp_ota_get_running_partition();esp_ota_img_states_t state=ESP_OTA_IMG_UNDEFINED;esp_err_t query=esp_ota_get_state_partition(run,&state);
 ESP_LOGI(TAG,"BOOT partition=%s subtype=%d query=%s state=%d role=%s reset=%d",run->label,run->subtype,esp_err_to_name(query),state,
#if CONFIG_R05_CANDIDATE
 "candidate",
#else
 "baseline",
#endif
 esp_reset_reason());
 esp_err_t e=nvs_flash_init();if(e!=ESP_OK){ESP_LOGE(TAG,"NVS=%s no auto erase; pending image left unconfirmed",esp_err_to_name(e));return;}
 if(query==ESP_OK&&state==ESP_OTA_IMG_PENDING_VERIFY){
  ESP_LOGW(TAG,"PENDING_SELFTEST: 10s observation; reset here leaves image unconfirmed");vTaskDelay(pdMS_TO_TICKS(10000));
  if(!self_test()){
   ESP_LOGE(TAG,"SELFTEST_REJECT: requesting rollback (not anti-rollback/eFuse)");fflush(stdout);e=esp_ota_mark_app_invalid_rollback_and_reboot();ESP_LOGE(TAG,"ROLLBACK_REQUEST_RETURNED=%s; do not mark valid",esp_err_to_name(e));return;
  }
  e=esp_ota_mark_app_valid_cancel_rollback();ESP_LOGI(TAG,"SELFTEST_ACCEPT mark-valid=%s",esp_err_to_name(e));if(e!=ESP_OK)return;
 }else ESP_LOGI(TAG,"NOT_PENDING: no state confirmation requested");
 fcntl(fileno(stdin),F_SETFL,O_NONBLOCK);OtaLine line={0};char cmd[32];
 ESP_LOGI(TAG,"READY: explicit complete commands ota good / ota bad / ota cut. Default placeholders never connect.");
 for(;;){int ch;while((ch=getchar())!=EOF){if(ota_line(&line,ch,cmd)){const char*path=ota_path(cmd);if(path)perform_ota(path);else ESP_LOGW(TAG,"UNKNOWN_COMMAND");}}clearerr(stdin);vTaskDelay(pdMS_TO_TICKS(20));}
}

// ---- main/ota_policy.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include <stdbool.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
typedef struct {char data[32];size_t used;bool discard;} OtaLine;
/* Complete CR/LF-delimited commands only; overflow/control chars drain line. */
static inline bool ota_line(OtaLine*s,int c,char out[32]){
 if(c=='\r'||c=='\n'){bool ok=!s->discard&&s->used>0;if(ok){memcpy(out,s->data,s->used);out[s->used]=0;}s->used=0;s->discard=false;return ok;}
 if(c<32||c>126||s->used>=31){s->discard=true;return false;}
 if(!s->discard){s->data[s->used++]=(char)c;}
 return false;
}
static inline bool ota_deadline(int64_t start,int64_t now){return now<start||now-start>=60000;}
static inline const char*ota_path(const char*command){
 if(!strcmp(command,"ota good"))return "/good.bin";
 if(!strcmp(command,"ota bad"))return "/bad.bin";
 if(!strcmp(command,"ota cut"))return "/cut.bin";
 return NULL;
}

# ---- tools/ota_server.py ----
#!/usr/bin/env python3
# SPDX-License-Identifier: MIT
"""Owned local TLS fixture: same candidate app, invalid magic, interrupted body."""
import argparse,http.server,ssl,pathlib,socket
p=argparse.ArgumentParser();p.add_argument('--cert',required=True);p.add_argument('--key',required=True);p.add_argument('--image',required=True);p.add_argument('--bind',default='127.0.0.1');p.add_argument('--port',type=int,default=8443);a=p.parse_args();image=pathlib.Path(a.image).read_bytes()
if not 32<=len(image)<=0x180000 or image[0]!=0xe9:p.error('candidate app .bin expected, <=one 0x180000-byte slot; never merged image')
class Handler(http.server.BaseHTTPRequestHandler):
 def do_GET(self):
  if self.path not in ('/good.bin','/bad.bin','/cut.bin'):self.send_error(404);return
  body=image if self.path!='/bad.bin'else b'not-an-ESP32-image\n';self.send_response(200);self.send_header('Content-Type','application/octet-stream');self.send_header('Content-Length',str(len(body)));self.end_headers()
  if self.path=='/cut.bin':self.wfile.write(body[:len(body)//2]);self.wfile.flush();self.close_connection=True;self.connection.shutdown(socket.SHUT_RDWR)
  else:self.wfile.write(body)
s=http.server.ThreadingHTTPServer((a.bind,a.port),Handler);c=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);c.minimum_version=ssl.TLSVersion.TLSv1_2;c.load_cert_chain(a.cert,a.key);s.socket=c.wrap_socket(s.socket,server_side=True);print('OWNED_TLS_FIXTURE',s.server_address,'candidate_bytes',len(image),flush=True)
try:s.serve_forever()
except KeyboardInterrupt:pass
finally:s.server_close()

# ---- tools/qemu_flash.py ----
#!/usr/bin/env python3
# SPDX-License-Identifier: MIT
"""Build ONLY a local S3 QEMU fixture, not a flash/OTA command for a board."""
import argparse,pathlib,struct,binascii,hashlib,json
p=argparse.ArgumentParser();p.add_argument('--baseline-build',required=True);p.add_argument('--candidate-build',required=True);p.add_argument('--out',required=True);a=p.parse_args();b=pathlib.Path(a.baseline_build);c=pathlib.Path(a.candidate_build);out=pathlib.Path(a.out)
parts=[(0,b/'bootloader/bootloader.bin'),(0x8000,b/'partition_table/partition-table.bin'),(0x20000,b/'r05_maintenance.bin'),(0x1a0000,c/'r05_maintenance.bin')];flash=bytearray(b'\xff'*(8*1024*1024));rows=[]
for at,f in parts:
 data=f.read_bytes()
 if f.name=='r05_maintenance.bin'and(len(data)>0x180000 or data[0]!=0xe9):p.error('app image/slot mismatch')
 flash[at:at+len(data)]=data;rows.append({'offset':at,'source':str(f),'bytes':len(data),'sha256':hashlib.sha256(data).hexdigest()})
# Fixed SDK5.5.5 esp_ota_select_entry_t; seq1 selects ota_0, stateNEW, CRC covers seq only.
seq=struct.pack('<I',1);entry=struct.pack('<I20sII',1,b'\xff'*20,0,binascii.crc32(seq,0xffffffff)&0xffffffff);flash[0xf000:0xf020]=entry
with out.open('xb')as f:f.write(flash)
(out.with_suffix('.json')).write_text(json.dumps({'scope':'Preloaded QEMU-only flash fixture, NOT an HTTPS update or Wi-Fi result. Use -snapshot; never flash this on a board.','inputs':rows,'otaEntryState':'NEW=0, sequence1, crc32(sequence,0xffffffff); other copy erased','imageSHA256':hashlib.sha256(flash).hexdigest()},indent=2)+'\n');print('QEMU_ONLY_IMAGE',out)