Ben MeadorsandGitHub
0e84c1a827
Audit of the XEdDSA packet-signing implementation (#10478) surfaced several issues in when unsigned packets are accepted on receive or emitted on send. This fixes them and adds regression coverage. - Unicast NodeInfo exchange no longer breaks against signer nodes: the NodeInfoModule downgrade drop is gated to broadcasts, since senders never sign unicast (want_response replies, directed exchanges). - Replace the payload-size sign heuristic with an exact encoded-size gate (signedDataFits) and mirror it on the receive side, removing a dead band where 167-168 B broadcasts were signed then failed TOO_LARGE. - Extract the receive policy into checkXeddsaReceivePolicy() and apply it to plaintext-MQTT decoded downlink, which previously skipped signature verification and downgrade protection entirely. - Reject signatures whose length is neither 0 nor 64 as malformed, so a crafted partial signature can't inflate the size estimate and dodge the unsigned-downgrade drop. - Hold cryptLock on the MQTT verify path (shared Ed25519 key cache). - Clear any client-preset signature on packets we originate, on all builds. - Randomized (hedged) signing per the Signal XEdDSA spec: bump the meshtastic/Crypto pin to the build where XEdDSA::sign mixes 32 bytes of caller randomness into the nonce as Z (meshtastic/Crypto#3), and seed those bytes in xeddsa_sign from HardwareRNG (checked, with a seeded-CSPRNG fallback). test_crypto pins that repeated signs differ and both verify. Adds test coverage: test_packet_signing groups A-E (receive matrix, send policy, NodeInfo backstop, encoding invariants, decoded-ingress policy), test_mqtt end-to-end downlink cases, and a test_crypto randomization check.
58 lines
2.0 KiB
INI
58 lines
2.0 KiB
INI
[nrf52_base]
|
|
; Instead of the standard nordicnrf52 platform, we use our fork which has our added variant files
|
|
platform =
|
|
# renovate: datasource=custom.pio depName=platformio/nordicnrf52 packageName=platformio/platform/nordicnrf52
|
|
platformio/nordicnrf52@10.12.0
|
|
extends = arduino_base
|
|
platform_packages =
|
|
; our custom Git version with C++17 support in platform.txt
|
|
# TODO renovate
|
|
platformio/framework-arduinoadafruitnrf52 @ https://github.com/meshtastic/Adafruit_nRF52_Arduino#master
|
|
; Don't renovate toolchain-gccarmnoneeabi
|
|
platformio/toolchain-gccarmnoneeabi@~1.90301.0
|
|
|
|
extra_scripts =
|
|
${env.extra_scripts}
|
|
extra_scripts/nrf52_extra.py
|
|
pre:extra_scripts/nrf52_lto.py
|
|
extra_scripts/nrf52_warm_region.py ; post-link guard: image must end below the 12 KB warm-store raw-flash region at 0xEA000-0xED000
|
|
|
|
build_type = release
|
|
build_flags =
|
|
-include variants/nrf52840/cpp_overrides/lfs_util.h
|
|
${arduino_base.build_flags}
|
|
-Wno-unused-variable
|
|
-Isrc/platform/nrf52
|
|
-DLFS_NO_ASSERT ; Disable LFS assertions , see https://github.com/meshtastic/firmware/pull/3818
|
|
-DMESHTASTIC_EXCLUDE_AUDIO=1
|
|
-DMESHTASTIC_EXCLUDE_PAXCOUNTER=1
|
|
-Os
|
|
-std=gnu++17
|
|
-flto ; whole-image LTO (~-60KB) on every nrf52840 target; nrf52_lto.py (pre: extra_script) keeps the interrupt handlers out of LTO so they survive
|
|
-fmerge-all-constants ; fold identical constants image-wide (~0.7KB; same flag stm32 uses)
|
|
build_unflags =
|
|
-Ofast
|
|
-Og
|
|
-ggdb3
|
|
-ggdb2
|
|
-g3
|
|
-g2
|
|
-g
|
|
-g1
|
|
-g0
|
|
-std=c++11
|
|
-std=gnu++11
|
|
|
|
build_src_filter =
|
|
${arduino_base.build_src_filter} +<platform/nrf52/> -<nimble/> -<mesh/wifi/> -<mesh/api/> -<mesh/http/> -<modules/esp32> -<mesh/eth/> -<mesh/raspihttp> -<serialization/>
|
|
|
|
lib_deps=
|
|
${arduino_base.lib_deps}
|
|
${radiolib_base.lib_deps}
|
|
# renovate: datasource=github-tags depName=meshtastic/Crypto packageName=meshtastic/Crypto
|
|
https://github.com/meshtastic/Crypto/archive/591ff9a690e8168ccb7a36abde8d7783e448d395.zip
|
|
|
|
lib_ignore =
|
|
BluetoothOTA
|
|
lvgl
|