kleidos/src/ble/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / src / ble /

at main 5 folders 9 files

José M. Requena Plens Fix branch-clone, rounding, cast, and remaining long-tail findings 17d ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

Clear SonarCloud maintainability issues in src/ble Mechanical/behaviour-preserving fixes across the BLE subsystem (type→auto, byte-buffer→std::array, lambda capture lists, param packs, dead stores, cognitive complexity via extracted helpers). No functional change to the BLE stack. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

3 weeks ago

Harden BLE bond lifecycle and land full on-device QA coverage Defensive BLE audit of src/ble/ (audit dossier: docs/security/audit-ble.md). The stack was sound; this closes the one actionable finding plus the QA gaps. BLE-L1 (the finding): BLE bonds survived a vault wipe / factory reset — the NimBLE keystore (nimble_bond NVS), the kleidos_blnames name blob, and its RTC mirror all live in NVS, which wipeAll() never touched, so a previous owner's bonded hosts and the device IRK persisted across a factory reset. Add BondStore::factoryReset() (erases all three backing stores, radio OFF) exposed via Facade::factoryResetBonds() and wired into every wipe path (pin_state brute-force wipe, settings wipe, boot recovery, debug WIPEVAULT/lockout). Clearing the RTC mirror is essential — reconcile() would otherwise resurrect the bonds after the post-wipe reboot. Validated on-device. Native regression in test_bond_store / test_name_store. QA coverage: implement and validate the eight proposed BLE QA tests — nc-reject (QA-1), conn-param (QA-2), disconnect (QA-4), factory-reset regression (QA-5), adv-minimization (QA-7) on the mastodon Linux/BlueZ central; redaction (QA-6) + UTF-8 robustness (QA-8) in CI; and N4 eviction (QA-3) end-to-end on the DUT via the ESP32 Plus1 central. New mastodon scenarios (adv-scan, disconnect-mid-type, conn-param, evict, restore) in ble_attack.sh + ble_probe.py. Plus1 harness: unify the separate _blehost/_wifihost binaries into one command-switchable BLE+WiFi binary (m5stickc_plus1_host, MODE BLE|WIFI|NONE). Add an OWNADDR command that rotates the central's LE random-static identity (fills the DUT bond table for N4 eviction, no BlueZ). Fix two firmware bugs: the harness was mute without KLEIDOS_USB_SERIAL_CONSOLE (serial facade compiled to no-op stubs), and identity rotation broke discovery until OWNADDR/FORGET also clear the resolving list (ble_hs_resolv_list_clear_all). CVE maintenance: register CVE-2025-53470/53477 (NimBLE HCI, low-reachability) and record the advertising-report/Mesh/BlueDroid/BluFi CVEs as not-applicable; 2026 re-check found no new NimBLE CVEs. Plus readability + file:line doc-drift fixes across ble.md / cve-register.md. Gates: native 233/233, sticks3 + m5stickc_plus2 + m5stickc_plus1_host build clean, pio check no defects, clang-format/check_layout/check_variants/typos/ gitleaks/ruff/editorconfig all pass. Claude-Session: https://claude.ai/code/session_01MyjYtwfLCwUUfGVYuTQqSv

2 weeks ago

Re-check link encryption before each HID report burst (R3) Defense-in-depth: even though pairing/auth is gated up front, re-verify the live connection is still encrypted + authenticated (via ble_gap_conn_find on the active handle) immediately before ble_gatts_notify_custom, so a keystroke report is never transmitted over a link that lost security between the auth gate and the send. Fail-closed: on a non-secure state the burst aborts and no report is emitted (no keystroke bytes logged). The check is a single conn-state read on the typing hot path. Extracted into a testable link_security.h helper with a native test suite (secure → sends, insecure → aborts). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

3 weeks ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

Prompt before evicting the oldest bond when the table is full When a new host paired while all four bond slots were occupied, NimBLE's default policy silently overwrote the oldest bond — a host the user still relied on could vanish without consent (N4 / TI GAP_BONDINGS_MAX). Hold the new bond back and surface an on-device "bond table full — replace the oldest host?" prompt, mirroring the E4 re-pair confirm seam: the BLE classes only expose state (a new eviction_confirmation gate that publishes the candidate identity lock-free) and the FSM drives the popup. Deny by default — a declined or timed-out prompt rejects the new bond (unpairs the candidate from NimBLE) and keeps the existing hosts; approval evicts the least-recently-seen host and admits the new one. The decision is applied on Core 0 via a ResolveEviction command, consistent with the other bond mutations. Adds the eviction_confirmation native test (arming, candidate publication, deny-by-default timeout, wrap-safe elapsed time). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

Remediate WiFi audit findings, add resource telemetry and PMIC current Implement the WiFi subsystem defensive-audit remediations (dossier in docs/research/wifi-audit-dossier.md) plus a resource-consumption monitor and per-chip power telemetry. Security (audit findings): - OTA: real semver anti-downgrade (running vs candidate partition), rollback enabled on shipping open/_release builds, size/BLE-state guards. - Lifecycle: keyboard variants run the real goToSleep() teardown+wipe (LIFEC-001); exit() always tears down the portal (LIFEC-003); loop task subscribed to the TWDT (LIFEC-004); symmetric BLE/WiFi start guard (LIFEC-002); master key wiped before the handover reboot (LIFEC-008); on-device idle warning + panel dimming. - HTTP: DNS-rebinding Host guard with captive-portal exemption (HTTP-003, incl. the 403 reason-phrase fix found on hardware); idle-based session TTL (HTTP-001); sliding-window rate limiter (HTTP-006, native test); /stream token no longer logged (HTTP-005). - Radio: H2E-only SAE, TX-power cap, stack wifi_config_t scrub, WPA2 fail-closed, bootloader-random AP password, DHCP-DNS offer. - Web UI: stored-XSS removal via safe DOM builders, autocomplete controls, CSP meta, deterministic gzip; SPA gz regenerated. - Optimization: nothrow HTTP body alloc, std::move export responses, CPU boost around the export KDF, ~1 Hz AP snapshot poll, early never-connected AP shutdown. Telemetry / consumption: - Per-tick UI-loop latency gauge (loop_dt_us / loop_max_us) via diag helpers. - RES? extended with heap fragmentation, SoC die temperature, battery mV/%/current and VBUS (USB) mV/current. - PowerManager / IPmic gain optional current + VBUS readouts; implemented for the AXP192 (validated on a Plus1: batt 4.1 V, VBUS ~5.0 V, ~81 mA USB draw) and "n/a" on the M5PM1 / AXP2101 fleet. See docs/research/pmic-consumption-telemetry.md. QA harness (mastodon SSH rig): - portal_checks.py adds Host-guard / security-header / idle plumbing / Core-0 stress-flood checks; wifi_net.sh requests SAE H2E; run.py forwards the stress env; new pytest tests for admin lifecycle, WiFi stress-resource monitoring and AXP192 current. Verified: native 1472/1472; -Werror builds for sticks3, cardputer, sticks3_debug and m5stickc_plus1_debug; clang-format, check_variants and check_conditionals clean; HIL passes on sticks3 (via mastodon) and the AXP192 current path on the Plus1. Known limitation in plan/plus1-softap-nomem.md: the admin SoftAP hits ESP_ERR_NO_MEM on the no-PSRAM Plus1 (pre-existing DRAM exhaustion). Claude-Session: https://claude.ai/code/session_01NYGJirRyAokBs9idYmGLxi

2 weeks ago

ble_hid_manager.cpp

Fix all readability-identifier-naming findings and the heal-surfaced defects Rename every identifier flagged by the .clang-tidy naming policy: file-scope and function-local statics gain the s_ prefix, static class members of BleHidManager and AdminPortal move from bare/member-style names to s_ camelBack, static/constexpr constants take k + PascalCase (kDummies, kNames, kDemos, kEventNames, kAdvHidUuid, the generated AaFont atlas symbols), snake_case parameters/locals in secure_allocator become camelBack, the OKLab intermediates in gradient.cpp get real names, and the mbedtls_aes_context compat alias is retired in favor of VaultAesContext at every call site. The AaFont symbol rename is applied in the generator (scripts/fonts/convert_fonts.py) and mirrored into the generated files. External ABI contracts that cannot be renamed (app_main, NimBLE C symbols, the __wrap_ linker prefix, the std-container/std::string API spellings of InplaceVector/InplaceString) are NOLINT-suppressed with rationale. Also fix what the healed parse newly surfaced: brace-init the va_list locals flagged by cppcoreguidelines-init-variables and use auto for the two static_cast initializers in totp_screen_controller, and rename the s_-prefixed range-for loop variables in bond_store, name_store_task, and ble_event_bus. clang-tidy: 239 -> 117 findings; identifier-naming, init-variables, and use-auto are now at zero. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

ble_hid_manager.h

Fix all readability-identifier-naming findings and the heal-surfaced defects Rename every identifier flagged by the .clang-tidy naming policy: file-scope and function-local statics gain the s_ prefix, static class members of BleHidManager and AdminPortal move from bare/member-style names to s_ camelBack, static/constexpr constants take k + PascalCase (kDummies, kNames, kDemos, kEventNames, kAdvHidUuid, the generated AaFont atlas symbols), snake_case parameters/locals in secure_allocator become camelBack, the OKLab intermediates in gradient.cpp get real names, and the mbedtls_aes_context compat alias is retired in favor of VaultAesContext at every call site. The AaFont symbol rename is applied in the generator (scripts/fonts/convert_fonts.py) and mirrored into the generated files. External ABI contracts that cannot be renamed (app_main, NimBLE C symbols, the __wrap_ linker prefix, the std-container/std::string API spellings of InplaceVector/InplaceString) are NOLINT-suppressed with rationale. Also fix what the healed parse newly surfaced: brace-init the va_list locals flagged by cppcoreguidelines-init-variables and use auto for the two static_cast initializers in totp_screen_controller, and rename the s_-prefixed range-for loop variables in bond_store, name_store_task, and ble_event_bus. clang-tidy: 239 -> 117 findings; identifier-naming, init-variables, and use-auto are now at zero. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 weeks ago

Style: group-open/close consistency (matching multi-line vs triple-slash) Round 2 of the Doxygen group-marker pass (post b0dd0b0). The previous round converted 60 /// @} -> /** @} */ but had a state- machine bug: it converted closings whose openings were still triple-slash (/// @name X + /// @{), leaving them mismatched. It also missed the inverse case: /// @} closings whose openings were multi-line (/** @name X + * @{\n */). This pass fixes both directions using a stack-based state machine that walks the source top-to-bottom: - Push a frame on each @{ opening, tagged with the opening comment style (triple-slash or multi-line) and a 'force triple-slash' flag (true for @addtogroup / @defgroup openings). - On each @} close, pop the top frame and rewrite the close to match the expected style. @addtogroup / @defgroup closings are always triple-slash, per the project rule. Changes: - 60 /// @} reverted to /** @} */ (round-1 over-conversions) - 43 /// @} converted to /** @} */ (missed multi-line openings) --- 103 conversions across 29 files; idempotent on second run. Scope: src/**/*.{h,cpp,hpp} minus brands/generated/, strings_gen*, index_html_gz.h, and tools/. No function body, signature, include, or Doxygen block content was touched. doxygen Doxyfile still exits 0.

1 month ago

keyboard_layouts.cpp

style: rephrase comments flagged as commented-out code (S125) These were never commented-out code — they are explanatory comments that S125's heuristic misreads because they contain code-like tokens (a trailing ';', '=', or 'name(args)'). Reword them as plain prose (e.g. 'BtnA=up' -> 'BtnA scrolls up', 'HMAC-SHA1(secret, counter)' -> 'HMAC-SHA1 over the secret and counter', '// 59 ;' -> '// 59 semicolon'), which keeps the documentation and reads better — no Won't-Fix/accept needed.

1 month ago

keyboard_layouts.h

style(conditionals): annotate every gated #endif with its condition Add a trailing '// <condition>' comment to all 679 previously-bare #endif directives across src/ (the matched #if/#ifdef/#ifndef condition, long compound expressions truncated). Improves navigation of the nested variant/feature gates. Generated assets (index_html_gz.h, ui/brands/generated/) are excluded. A small clang-format reindent in tdeck_keyboard.cpp rides along (the file became part of the change set). Comment-only; no behavior change.

1 month ago