Skip to content

Commit 1dc92c6

Browse files
fbeutin-ledgerfbeutin-ledger
committed
Use correct certificate
1 parent 22be902 commit 1dc92c6

8 files changed

Lines changed: 40 additions & 21 deletions

‎src/clear_signing/handle_provide_alt_resolution.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,7 @@ int handle_provide_alt_resolution(void) {
148148
CX_ASSERT(cx_hash_final((cx_hash_t *) &tlv_extracted.hash_ctx, tlv_hash));
149149
buffer_t hash = {.ptr = tlv_hash, .size = sizeof(tlv_hash)};
150150

151-
// TODO: Use correct key usage once determined (reusing SWAP_TEMPLATE for development)
152-
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_SWAP_TEMPLATE;
151+
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_CALLDATA;
153152
cx_curve_t curve = CX_CURVE_SECP256K1;
154153
check_signature_with_pki_status_t err =
155154
check_signature_with_pki(hash, &expected_key_usage, &curve, tlv_extracted.signature);

‎src/clear_signing/handle_provide_enum_variant.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,7 @@ int handle_provide_enum_variant(void) {
199199
CX_ASSERT(cx_hash_final((cx_hash_t *) &tlv_extracted.hash_ctx, tlv_hash));
200200
buffer_t hash = {.ptr = tlv_hash, .size = sizeof(tlv_hash)};
201201

202-
// TODO: Use correct key usage once determined (reusing SWAP_TEMPLATE for development)
203-
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_SWAP_TEMPLATE;
202+
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_CALLDATA;
204203
cx_curve_t curve = CX_CURVE_SECP256K1;
205204
check_signature_with_pki_status_t err =
206205
check_signature_with_pki(hash, &expected_key_usage, &curve, tlv_extracted.signature);

‎src/clear_signing/handle_provide_instruction_info.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -219,8 +219,7 @@ int handle_provide_instruction_info(void) {
219219
CX_ASSERT(cx_hash_final((cx_hash_t *) &tlv_extracted.hash_ctx, tlv_hash));
220220
buffer_t hash = {.ptr = tlv_hash, .size = sizeof(tlv_hash)};
221221

222-
// TODO: Use correct key usage once determined (reusing SWAP_TEMPLATE for development)
223-
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_SWAP_TEMPLATE;
222+
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_CALLDATA;
224223
cx_curve_t curve = CX_CURVE_SECP256K1;
225224
check_signature_with_pki_status_t err =
226225
check_signature_with_pki(hash, &expected_key_usage, &curve, tlv_extracted.signature);

‎src/clear_signing/handle_provide_token_account_state.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,7 @@ int handle_provide_token_account_state(void) {
160160
CX_ASSERT(cx_hash_final((cx_hash_t *) &tlv_extracted.hash_ctx, tlv_hash));
161161
buffer_t hash = {.ptr = tlv_hash, .size = sizeof(tlv_hash)};
162162

163-
// TODO: Use correct key usage once determined (reusing SWAP_TEMPLATE for development)
164-
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_SWAP_TEMPLATE;
163+
uint8_t expected_key_usage = CERTIFICATE_PUBLIC_KEY_USAGE_CALLDATA;
165164
cx_curve_t curve = CX_CURVE_SECP256K1;
166165
check_signature_with_pki_status_t err =
167166
check_signature_with_pki(hash, &expected_key_usage, &curve, tlv_extracted.signature);

‎tests/application_client/solana.py‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
TRUSTED_NAME_PARTNER,
1313
DYNAMIC_TOKEN_PARTNER,
1414
INSTRUCTION_DESCRIPTOR_PARTNER,
15+
GENERIC_CLEAR_SIGNING_PARTNER,
1516
TRANSACTION_CHECK_PARTNER,
1617
)
1718

@@ -476,9 +477,9 @@ def provide_token_account_state(self,
476477
payload += format_tlv(TokenAccountStateTag.OWNER, owner)
477478
payload += format_tlv(TokenAccountStateTag.PRE_BALANCE, pre_balance)
478479
payload += format_tlv(TokenAccountStateTag.SIGNATURE,
479-
INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
480+
GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
480481

481-
self.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
482+
self.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
482483
self._exchange_split(CLA, INS.INS_TOKEN_ACCOUNT_STATE, P1_NON_CONFIRM, payload)
483484

484485
def provide_alt_resolution(self,
@@ -493,9 +494,9 @@ def provide_alt_resolution(self,
493494
payload += format_tlv(AltResolutionTag.ENTRY_INDEX, entry_index)
494495
payload += format_tlv(AltResolutionTag.RESOLVED_ADDRESS, resolved_address)
495496
payload += format_tlv(AltResolutionTag.SIGNATURE,
496-
INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
497+
GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
497498

498-
self.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
499+
self.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
499500
self._exchange_split(CLA, INS.INS_ALT_RESOLUTION, P1_NON_CONFIRM, payload)
500501

501502
def provide_enum_variant(self,
@@ -515,9 +516,9 @@ def provide_enum_variant(self,
515516
if variant_payload:
516517
payload += format_tlv(EnumVariantTag.PAYLOAD, variant_payload)
517518
payload += format_tlv(EnumVariantTag.SIGNATURE,
518-
INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
519+
GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
519520

520-
self.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
521+
self.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
521522
self._exchange_split(CLA, INS.INS_ENUM_VARIANT, P1_NON_CONFIRM, payload)
522523

523524
def provide_instruction_info(self,
@@ -550,9 +551,9 @@ def provide_instruction_info(self,
550551
if owner_assoc_owner_value is not None:
551552
payload += format_tlv(InstructionInfoTag.OWNER_ASSOC_OWNER, owner_assoc_owner_value)
552553
payload += format_tlv(InstructionInfoTag.SIGNATURE,
553-
INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
554+
GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
554555

555-
self.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
556+
self.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
556557
self._exchange_split(CLA, INS.INS_INSTRUCTION_INFO, P1_NON_CONFIRM, payload)
557558

558559

‎tests/application_client/solana_signing_partners.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,18 @@
3434
},
3535
)
3636

37+
GENERIC_CLEAR_SIGNING_PARTNER = SigningPartner(
38+
pem_key_path=_KEYCHAIN_DIR / "generic_clear_signing.pem",
39+
cert_pub_key_usage=CertificatePubKeyUsage.CALLDATA,
40+
certificates={
41+
DeviceType.NANOSP: "01010102010211040000000212010013020002140101160400000000201547656E657269635F436C6561725F5369676E696E673002000831010B32012133210274F13B7525D70381B4518AEE3E4F2186BC29D742B8F4A43EC2308271A3C0448B34010135010315463044022019CEF0856803902FC94B673A671C4E386788DDC4A6EF22D365438D3D138FB20302202D41D35112FC4A0EC15293CFBBA01283EA63DCB4DAA878CE3BB71F02D0EBF75B",
42+
DeviceType.NANOX: "01010102010211040000000212010013020002140101160400000000201547656E657269635F436C6561725F5369676E696E673002000831010B32012133210274F13B7525D70381B4518AEE3E4F2186BC29D742B8F4A43EC2308271A3C0448B34010135010215473045022100DDFFCD0927531E4B7AE7F50A4D00F798BF57A97206A96B4B5FD6CE0B2500A883022067B82D374B42709FB74081995A081415B1D3A821C85735524B4E953718B581CC",
43+
DeviceType.STAX: "01010102010211040000000212010013020002140101160400000000201547656E657269635F436C6561725F5369676E696E673002000831010B32012133210274F13B7525D70381B4518AEE3E4F2186BC29D742B8F4A43EC2308271A3C0448B34010135010415473045022100CCEA5B70EF750843253DD4D73AD9A4995048A73110A73E22C433B333512C02AA02204AE6AB7D41EEC17214340DB2353DAA758393018EE354A8E1460749E6753FE6F7",
44+
DeviceType.FLEX: "01010102010211040000000212010013020002140101160400000000201547656E657269635F436C6561725F5369676E696E673002000831010B32012133210274F13B7525D70381B4518AEE3E4F2186BC29D742B8F4A43EC2308271A3C0448B34010135010515453043022043577F849FC5289A6A99D08BA2BF86D91E8F9D9C64E3D61AC26894B176E7907C021F79F371637EC24A5BE82D2A01AD6E2286DAAF14EFE2068407AF502BB9056F4C",
45+
DeviceType.APEX_P: "01010102010211040000000212010013020002140101160400000000201547656E657269635F436C6561725F5369676E696E673002000831010B32012133210274F13B7525D70381B4518AEE3E4F2186BC29D742B8F4A43EC2308271A3C0448B34010135010615463044022030778A3C826E2E90DE11C73F195EA0C00BF501108C531666A23EA1F525E5BC59022042FB4BBCC594FF4B134B81A6527BC660E7F523060E121012CA96C04F125471FB",
46+
},
47+
)
48+
3749
INSTRUCTION_DESCRIPTOR_PARTNER = SigningPartner(
3850
pem_key_path=_KEYCHAIN_DIR / "instruction_descriptor.pem",
3951
cert_pub_key_usage=CertificatePubKeyUsage.SWAP_TEMPLATE,

‎tests/python/conftest.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,16 @@ def sol(backend):
3030
# Pytest is trying to do "smart" stuff and reorders tests using parametrize by alphabetical order of parameter
3131
# This breaks the backend scope optim. We disable this
3232
def pytest_collection_modifyitems(config, items):
33+
# The full generic clear-signing flow (finalize + NBGL review navigation) does
34+
# not yet run on Nano X. Skip those deep tests there while keeping the ones that
35+
# only validate PKI certificate acceptance and APDU verification. Deep tests are
36+
# identified by their use of the scenario_navigator fixture.
37+
if config.getoption("--device") == "nanox":
38+
skip_deep = pytest.mark.skip(reason="Generic clear-signing review flow not yet supported on Nano X")
39+
for item in items:
40+
if "test_clear_signing" in item.nodeid and "scenario_navigator" in item.fixturenames:
41+
item.add_marker(skip_deep)
42+
3343
def param_part(item):
3444
# Sort by node id as usual
3545
return item.nodeid

‎tests/python/test_clear_signing.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
from application_client.solana import (SolanaClient, INS, CLA, P2_NONE, P1_NON_CONFIRM, ErrorType,
1414
TokenAccountStateTag, AltResolutionTag, EnumVariantTag,
1515
InstructionInfoTag, ValueTag)
16-
from application_client.solana_signing_partners import INSTRUCTION_DESCRIPTOR_PARTNER
16+
from application_client.solana_signing_partners import GENERIC_CLEAR_SIGNING_PARTNER
1717
from application_client.solana_cmd_builder import verify_signature
1818
from application_client.tlv import format_tlv
1919
from application_client import solana_utils as SOL
@@ -263,9 +263,9 @@ def test_token_account_state_wrong_struct_type(backend):
263263
payload += format_tlv(TokenAccountStateTag.MINT, b'\x22' * 32)
264264
payload += format_tlv(TokenAccountStateTag.OWNER, b'\x33' * 32)
265265
payload += format_tlv(TokenAccountStateTag.PRE_BALANCE, 0)
266-
payload += format_tlv(TokenAccountStateTag.SIGNATURE, INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
266+
payload += format_tlv(TokenAccountStateTag.SIGNATURE, GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
267267

268-
sol.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
268+
sol.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
269269
with pytest.raises(ExceptionRAPDU) as exc_info:
270270
sol._exchange_split(CLA, INS.INS_TOKEN_ACCOUNT_STATE, P1_NON_CONFIRM, payload)
271271
assert exc_info.value.status == ErrorType.INVALID_TOKEN_ACCOUNT_STATE
@@ -283,9 +283,9 @@ def test_token_account_state_wrong_version(backend):
283283
payload += format_tlv(TokenAccountStateTag.MINT, b'\x22' * 32)
284284
payload += format_tlv(TokenAccountStateTag.OWNER, b'\x33' * 32)
285285
payload += format_tlv(TokenAccountStateTag.PRE_BALANCE, 0)
286-
payload += format_tlv(TokenAccountStateTag.SIGNATURE, INSTRUCTION_DESCRIPTOR_PARTNER.sign(payload))
286+
payload += format_tlv(TokenAccountStateTag.SIGNATURE, GENERIC_CLEAR_SIGNING_PARTNER.sign(payload))
287287

288-
sol.send_pki_certificate(INSTRUCTION_DESCRIPTOR_PARTNER)
288+
sol.send_pki_certificate(GENERIC_CLEAR_SIGNING_PARTNER)
289289
with pytest.raises(ExceptionRAPDU) as exc_info:
290290
sol._exchange_split(CLA, INS.INS_TOKEN_ACCOUNT_STATE, P1_NON_CONFIRM, payload)
291291
assert exc_info.value.status == ErrorType.INVALID_TOKEN_ACCOUNT_STATE

0 commit comments

Comments
 (0)