kleidos/src/vault/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / src / vault /

at main 33 files

José M. Requena Plens Add the WiFi-station store and NTP clock-sync backend 6d ago

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

Harden the time core: atomic setDateTime, cached trust reads, UTC-exact TOTP epoch - F1: totp_epoch.h converts the RTC reading with the exact UTC civil-calendar converter (rtc::internal::dateTimeToEpoch) instead of local-time mktime; the native suite now pins hard-coded UTC vectors (1767225600 / 1783472461) so a local-time regression fails under a non-UTC host TZ instead of cancelling out. - F2: add rtc::setDateTime (one applyEpoch on the internal backend; one 7-byte I2C burst over regs 0x02..0x08 on the BM8563 via new IRtc::writeDateTime) and use it in setClockCommit and the admin portal handleSetTime (gmtime_r path removed). - F3: cache the NVS seed floor (internal) and the VL/integrity verdict (BM8563, ~1 s TTL via millis32, invalidated by every time write) so clockTrust() no longer opens an NVS handle / hits the I2C bus per UI frame; caches are atomics and never change what is returned. - F4: getValidTime reads through new rtc::getDateTime — one gettimeofday (internal) / one latched burst read (BM8563) — so date and time can no longer straddle a midnight rollover. - F5: correct the audit-log timestamp docs (UTC, not local; any trusted clock, not only BM8563) and refresh rtc-internal.md. Native 1626/1626; sticks3/gray/plus2/coreink debug builds clean under -Werror; variant/conditional/layout guards, doxygen and pio check green. Claude-Session: https://claude.ai/code/session_01U878bNJtg9bCvAMM8CFKqS

1 week ago

brute_force_guard.cpp

Fix clang-tidy braces, init-variables, and use-auto findings

1 week ago

brute_force_guard.h

Gate brute-force lockout on ClockTrust with a monotonic countdown for volatile clocks Migrate the brute-force lockout write/read paths from rtc::isAvailable() to rtc::clockTrust(). On a battery-backed Backed clock the behavior is unchanged (absolute wall-clock deadline). On any clock below Backed (Volatile/None) the lockout fails closed: it stores no forgeable wall-clock deadline and instead persists the intended lock duration (bf_lock_sec, MAC-authenticated) and measures the cooldown against a monotonic source (platform/Clock monotonicMillis) anchored in RAM. A forward wall-clock jump cannot shorten it; a reboot/deep-sleep loses the RAM anchor and re-establishes the full lock (over-locks, never releases early). The attempt-counter MAC and wipe-at-10 hard guarantees are untouched. Also reconcile the Task-2 minor: soften the rtc_internal_clock.h header comment that over-claimed a monotonic-floor guarantee on getTime (the floor is a convenience output of evaluateTrust and is not applied to the raw wall-clock read; lockout monotonicity comes from the dedicated monotonic source, not the wall clock). Claude-Session: https://claude.ai/code/session_01U878bNJtg9bCvAMM8CFKqS

1 week ago

credential_repository.cpp

fix(crypto): reject undersized cipher output buffer (CRY-06) Add capacity check in VaultCrypto::encrypt and encryptWithContext: if totalLen > *cipherLen on entry, return false before any write. Add a defensive overflow guard for plainLen + padLen. Fix all five callers that were initialising cipherLen = 0 (credential_repository, totp_repository, vault_index, vault_rekey, test_vault_store) to pass the actual buffer capacity on entry, matching the documented In/out contract. Three new native tests cover the undersized-buffer rejection (RED→GREEN TDD cycle verified) and confirm the sufficient-capacity path round-trips. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

credential_repository.h

Document src/vault/ Doxygen: fix @ref/@param, complete public API (§18) Resolve all 49 src/vault/ Doxygen warnings (WARN_AS_ERROR): - Qualify file-header/cross-scope @ref targets fully (kleidos::vault::VaultMeta, DerivedKeys, CredentialRecord, ...) so they resolve; drop a stray trailing colon and @ref parentheses. - Convert record_codec Writer/Reader @c-brief accessors that carry parameters/return into full /** */ blocks with @param/@return. - Add the missing @param generation to CredentialRepository::save/load. Comment-only pass; no code changed. Native suite (1168) still passes. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago

export_passphrase.cpp

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

export_passphrase.h

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

fix(vault): wipe backup-meta tag + CSV-import credential buffers on all paths (M1/M2) M1 (vault_backup.cpp): add secureWipe(tag) on both exit paths of the meta-validation block in importAll — the HMAC tag was wiped on neither the error return nor the success path. M2 (sd_vault.cpp / importCsv): wipe credPass/credUser/credName/credUrl before the credName-empty continue and before the vault-full break; wipe fields+line before the final return result; wipe line before the UNKNOWN-format early return. No parsing logic changed. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

Add encrypted SD vault export/import plumbing and diceware generator Task 4.2b core. Adds SdVault::exportVaultEncrypted / importVaultEncrypted / hasEncryptedBackup: the vault is serialized to the JSON backup boundary (VaultStore::exportAll), sealed with crypto::wrapExport (independent 200k PBKDF2, encrypt-then-MAC) and written to /kleidos/backup.kexp; restore reverses it via unwrapExport (verify-before-decrypt) + VaultStore::importAll. Every buffer holding plaintext, the envelope, or the recovered plaintext is zeroized with VaultCrypto::secureWipe. Unlike the raw export the .kexp needs no keyfile co-location guard (it is independently passphrase-protected). Adds vault/export_passphrase: a host-testable diceware generator that draws uniformly-random words from an injected wordlist reader using the hardware RNG facade (never rand()), joins them, and fails closed on overflow/reader error. Six EFF-large words give ~77.5 bits. Native: registers vault/test_export_passphrase (generation shape, membership, randomness, oversize/reader-failure fail-closed, entropy, and a generated- passphrase envelope round-trip) and wires export_passphrase.cpp into the native build_src_filter. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

secure_allocator.h

Fix cppcoreguidelines-owning-memory and no-malloc findings Convert the telemetry ring buffer and completion semaphore to std::unique_ptr (nothrow new kept so OOM still returns false under -fno-exceptions; the two reset(new ...) sites carry that rationale). SecureAllocator keeps raw malloc/realloc/free by design — it IS the allocator layer behind ArduinoJson's raw void* contract and must control the exact free moment to secureWipe every block — so the class is wrapped in a NOLINT block stating that constraint (owner-sanctioned outcome for crypto memory management). Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

totp_repository.cpp

fix(crypto): reject undersized cipher output buffer (CRY-06) Add capacity check in VaultCrypto::encrypt and encryptWithContext: if totalLen > *cipherLen on entry, return false before any write. Add a defensive overflow guard for plainLen + padLen. Fix all five callers that were initialising cipherLen = 0 (credential_repository, totp_repository, vault_index, vault_rekey, test_vault_store) to pass the actual buffer capacity on entry, matching the documented In/out contract. Three new native tests cover the undersized-buffer rejection (RED→GREEN TDD cycle verified) and confirm the sufficient-capacity path round-trips. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

totp_repository.h

Document src/vault/ Doxygen: fix @ref/@param, complete public API (§18) Resolve all 49 src/vault/ Doxygen warnings (WARN_AS_ERROR): - Qualify file-header/cross-scope @ref targets fully (kleidos::vault::VaultMeta, DerivedKeys, CredentialRecord, ...) so they resolve; drop a stray trailing colon and @ref parentheses. - Convert record_codec Writer/Reader @c-brief accessors that carry parameters/return into full /** */ blocks with @param/@return. - Add the missing @param generation to CredentialRepository::save/load. Comment-only pass; no code changed. Native suite (1168) still passes. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago

vault_backup.cpp

Fix clang-tidy braces, init-variables, and use-auto findings

1 week ago

fix(vault): make encrypted SD backup/restore actually persist + full-replace restore Mounting the SD card for a backup drops the LittleFS mount on shared-SPI boards (SD on SPI2 + display), so every vault read/write during export/import silently no-oped: exports captured only the cached meta (no credentials), restores wrote nothing while still reporting SDIMPORT_OK. Re-mount LittleFS at the start of the export/import vault work so the data actually round-trips. Found via HIL on tdeck. - vault_backup export/import re-ensure the LittleFS mount before touching the vault. - Pass VaultStore's cached, MAC-verified meta to the backup module instead of re-opening meta.bin (which also fails once the SD is mounted) — VaultStore owns meta.bin I/O. readMetaRecord() removed; signature bool sessionUnlocked -> const VaultMetaRecord* currentMeta (null = locked). - Restore is now full-replace (owner decision): slots absent from the backup are purged so the restored vault equals the backup exactly, not a merge that would leave stale credentials behind. - QA sd_export/sd_import wrapper timeout 20s -> 90s: the fixed 200k export KDF is ~62s on classic ESP32. - Native: add full-replace regression test; byte-equivalence preserved (26/26). - Verified end-to-end on tdeck (S3) HIL round-trip. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

vault_envelope.h

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

vault_import.cpp

refactor(vault): collapse meta.bin format to v1, drop v2->v3 migration Kleidos is pre-production with no installed base. Simplify by collapsing the current vault metadata format to a single version (0x01) and deleting all v2 backward-compatibility and v2->v3 migration machinery. Rejection of any unexpected version or size is now the only policy (matching vault_envelope.h). - kMetaFormatVersion: 0x03 -> 0x01; kMetaFormatVersionLegacy / kMetaSizeV2 / kMetaLegacyAuthedSize removed from vault_meta.h - serializeAuthed: now returns void, always writes pinLength (no legacy branch) - parse: accepts only len==kMetaSize with version==kMetaFormatVersion; rejects all other lengths and version bytes unconditionally - serialize/computeMac: drop authedLen variable, use kMetaAuthedSize directly - vault_store/rekey/import/backup: remove kMetaSizeV2 size-check alternatives - test_vault_meta: remove test_parse_migratesLegacyV2Meta; rename test_metaVersion_isV3 -> test_metaVersion_isV1; update test_parse_rejectsWrongVersion to use 0x02 (was 0x01, which is now the valid version); add kMetaSize+1 rejection case Net test delta: -1 (1320 -> 1319 passing; all remaining tests green). Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

docs: restore the Doxygen gate to exit 0 (pages workflow red since the KDF merge) Doc-comment-only changes, no code touched. `doxygen Doxyfile` (1.17.0, the version CI pins) has been failing on main with 42 errors, keeping the GitHub Pages deploy red. Two error classes: - Unresolvable @ref targets (file-level-block refs to members/forward declarations, .cpp-internal constants, enum-class enumerators) replaced with @c in pin_policy.h, export_passphrase.h, secure_allocator.h, vault_import.h and vault_meta.h. - Missing @param/@return blocks completed: SecureAllocator::deallocate / ::reallocate, web::adminsd::handleSdVaultImport, web::isCsvTrimChar, and CsvRow::appendChar / nextField / field. doxygen Doxyfile now exits 0 with zero warnings and scripts/check_doc_coverage.py reports full coverage. Claude-Session: https://claude.ai/code/session_01JW42m5zhzTUT8eapHvSvPB

2 weeks ago

vault_index.cpp

fix(crypto): reject undersized cipher output buffer (CRY-06) Add capacity check in VaultCrypto::encrypt and encryptWithContext: if totalLen > *cipherLen on entry, return false before any write. Add a defensive overflow guard for plainLen + padLen. Fix all five callers that were initialising cipherLen = 0 (credential_repository, totp_repository, vault_index, vault_rekey, test_vault_store) to pass the actual buffer capacity on entry, matching the documented In/out contract. Three new native tests cover the undersized-buffer rejection (RED→GREEN TDD cycle verified) and confirm the sufficient-capacity path round-trips. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

Document src/vault/ Doxygen: fix @ref/@param, complete public API (§18) Resolve all 49 src/vault/ Doxygen warnings (WARN_AS_ERROR): - Qualify file-header/cross-scope @ref targets fully (kleidos::vault::VaultMeta, DerivedKeys, CredentialRecord, ...) so they resolve; drop a stray trailing colon and @ref parentheses. - Convert record_codec Writer/Reader @c-brief accessors that carry parameters/return into full /** */ blocks with @param/@return. - Add the missing @param generation to CredentialRepository::save/load. Comment-only pass; no code changed. Native suite (1168) still passes. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago

Fix branch-clone, rounding, cast, and remaining long-tail findings - bugprone-branch-clone (12): fold genuinely identical switch arms (typing status map, PM1 power levels, wake-cause names, glyph fallback), merge the duplicated small-panel atlas ladder, rebuild scaleFor as per-panel constexpr scale tables (lookup-table idiom), restructure the modal confirm poll around explicit hold/press predicates (also clears the DeMorgan finding), and NOLINT the one per-SoC gated ADC calibration switch with rationale. - bugprone-casting-through-void (13): use direct reinterpret_cast (the documented pro-type-reinterpret-cast deviation) for byte/sockaddr views; keep the SPI slot two-step through void* with rationale (it exists to satisfy -Werror=cast-align next to the static_asserts). - bugprone-incorrect-roundings (9): std::lroundf instead of +0.5 casts. - cert-dcl50-cpp (5): rationale NOLINTs on the printf-style formatters (a parameter pack cannot produce the va_list vsnprintf needs). - cppcoreguidelines-pro-type-const-cast: const-correct the WordReader ctx (API + trampoline + tests, const_cast deleted); NOLINT the two std <cstring>-convention mutable overloads. - Long tail: explicit void* casts + sizeof(T) rationale in rtos_queue, range-for loop conversions, 0x80-mask instead of int8_t reinterpret for the AXP2101 gauge, uint8_t slot subscript, parenthesized -1 pin macros, extended the __wrap_log_printf ABI suppression to the reserved-identifier aliases, integer-center tween targets. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

Document src/vault/ Doxygen: fix @ref/@param, complete public API (§18) Resolve all 49 src/vault/ Doxygen warnings (WARN_AS_ERROR): - Qualify file-header/cross-scope @ref targets fully (kleidos::vault::VaultMeta, DerivedKeys, CredentialRecord, ...) so they resolve; drop a stray trailing colon and @ref parentheses. - Convert record_codec Writer/Reader @c-brief accessors that carry parameters/return into full /** */ blocks with @param/@return. - Add the missing @param generation to CredentialRepository::save/load. Comment-only pass; no code changed. Native suite (1168) still passes. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago

refactor(vault): collapse meta.bin format to v1, drop v2->v3 migration Kleidos is pre-production with no installed base. Simplify by collapsing the current vault metadata format to a single version (0x01) and deleting all v2 backward-compatibility and v2->v3 migration machinery. Rejection of any unexpected version or size is now the only policy (matching vault_envelope.h). - kMetaFormatVersion: 0x03 -> 0x01; kMetaFormatVersionLegacy / kMetaSizeV2 / kMetaLegacyAuthedSize removed from vault_meta.h - serializeAuthed: now returns void, always writes pinLength (no legacy branch) - parse: accepts only len==kMetaSize with version==kMetaFormatVersion; rejects all other lengths and version bytes unconditionally - serialize/computeMac: drop authedLen variable, use kMetaAuthedSize directly - vault_store/rekey/import/backup: remove kMetaSizeV2 size-check alternatives - test_vault_meta: remove test_parse_migratesLegacyV2Meta; rename test_metaVersion_isV3 -> test_metaVersion_isV1; update test_parse_rejectsWrongVersion to use 0x02 (was 0x01, which is now the valid version); add kMetaSize+1 rejection case Net test delta: -1 (1320 -> 1319 passing; all remaining tests green). Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

docs: restore the Doxygen gate to exit 0 (pages workflow red since the KDF merge) Doc-comment-only changes, no code touched. `doxygen Doxyfile` (1.17.0, the version CI pins) has been failing on main with 42 errors, keeping the GitHub Pages deploy red. Two error classes: - Unresolvable @ref targets (file-level-block refs to members/forward declarations, .cpp-internal constants, enum-class enumerators) replaced with @c in pin_policy.h, export_passphrase.h, secure_allocator.h, vault_import.h and vault_meta.h. - Missing @param/@return blocks completed: SecureAllocator::deallocate / ::reallocate, web::adminsd::handleSdVaultImport, web::isCsvTrimChar, and CsvRow::appendChar / nextField / field. doxygen Doxyfile now exits 0 with zero warnings and scripts/check_doc_coverage.py reports full coverage. Claude-Session: https://claude.ai/code/session_01JW42m5zhzTUT8eapHvSvPB

2 weeks ago

vault_rekey.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

fix(pin): store PIN length in authenticated meta.bin, not standalone NVS The active timing-arc PIN length was persisted in a standalone NVS key `pin_len`, neither atomic with nor lifecycle-bound to the PIN verifier in `meta.bin`. This caused a deterministic brick: `wipeAll()` erases LittleFS but not NVS, so `pin_len` survived a panic-wipe; onboarding then created a 4-digit PIN while `pin_len` stayed (e.g.) 8, making the arc demand 8 digits for an unenterable PIN -> lockout -> wipe -> lockout forever. Change-PIN also wrote the verifier to meta.bin then `pin_len` to NVS separately, so a power-loss between them desynced length and verifier. Move the PIN length INTO meta.bin (the authenticated root of trust): - Add a 1-byte `pinLength` field to `VaultMetaRecord` and the serialized record, placed before the tag so the existing HMAC authenticates it. Bump the meta format v2 (0x02) -> v3 (0x03); `kMetaSize` grows by one byte. - Migrate: `parse` accepts both sizes; a legacy v2 record defaults `pinLength` to 4 and, via a version-aware `serializeAuthed`/`computeMac`, still authenticates and unlocks. `serialize` always writes v3 (upgrade-on-write). - `provision` records `pinLength` (default 4 for a fresh vault). `VaultRekey` / `VaultStore::rekey` carry `newPinLength` and flip it atomically with the new verifier in the same meta write. - Boot and PIN entry read the length from the parsed meta via new `VaultStore::getStoredPinLength()` (pre-unlock, no key), clamped defensively. - Remove the standalone NVS `pin_len` key (boot read + change-PIN write). meta.bin is now the single source of truth: a wipe destroys it, so a re-provision resets the length to the default -> the brick loop is gone. - Update every meta reader (store/rekey/backup/import) to accept both v2 and v3 record sizes so existing 4-digit vaults keep working and a change-PIN on a not-yet-upgraded v2 vault still reads its old meta. - MINOR: log the post-rekey `unlockVault` failure in change_pin_controller. Tests: crash-atomicity (rekey commits length+verifier in one meta record), wipe->reprovision resets length, and old-v2-meta migration; existing 4/6/8 length-agnostic crypto test kept. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

vault_store.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

Round 4: bool/enum @return → @retval per value

1 month ago

Clear SonarCloud maintainability issues in hal/drivers/crypto/vault/platform/web Mechanical/behaviour-preserving fixes (const-correctness, type→auto, byte-buffer→ std::array, param packs, dead stores, cognitive complexity via extracted helpers e.g. pbkdf2DeriveBlock) across hal, drivers, crypto, vault, platform, ota, web, main. No functional/crypto-semantic change. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

3 weeks ago

wifi_repository.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago

wifi_repository.h

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

6 days ago