|
CDC Badge OS
Firmware for the CDC Badge v1.0 hardware security key
|
Namespaces | |
| namespace | cp437 |
| namespace | hash |
Classes | |
| class | AttestationKeyService |
| class | CpuStats |
| On-demand aggregate CPU-load read-out from FreeRTOS run-time stats. More... | |
| class | GcmContext |
| RAII wrapper around mbedtls_gcm_context. Non-copyable, non-movable. More... | |
| struct | Event |
| class | EventBus |
| struct | TropicWipeResult |
| class | IChallengeResponder |
| Challenge-response provider interface. More... | |
| class | IKeyboardProvider |
| struct | ModuleMenuItem |
| Menu item registered by a module. More... | |
| struct | LockScreenContextItem |
| Lock screen context menu item registered by a module. More... | |
| class | IModule |
| Module interface that extends IService with module-specific features. More... | |
| class | IService |
| class | ModuleBase |
| Base implementation that handles common module lifecycle boilerplate. More... | |
| class | ModuleRegistry |
| class | PinManager |
| struct | CapsFreeDeleter |
| Deleter for buffers allocated via heap_caps_malloc. More... | |
| struct | CStdFreeDeleter |
| Deleter for buffers allocated via malloc/realloc. More... | |
| struct | FileCloseDeleter |
| Deleter for FILE* opened with std::fopen. More... | |
| class | NvsScope |
| RAII wrapper for an NVS handle. More... | |
| class | MutexGuard |
| RAII wrapper for a FreeRTOS semaphore / mutex. More... | |
| class | RecursiveMutexGuard |
| Scoped guard for a FreeRTOS recursive mutex. More... | |
| class | ServiceRegistry |
| class | SlotManager |
| Manages logical-to-physical RMEM slot mapping for module storage layers. More... | |
| class | SystemLock |
| Global lockdown latch. More... | |
| class | TropicSlotMap |
| class | TropicStorage |
| struct | UsbHidCallbacks |
| struct | UsbInterfaceSpec |
| class | UsbManager |
| struct | SlotMapEntry |
Typedefs | |
| using | EventHandler = void(*)(const Event&) |
| using | ModuleInitFunc = void(*)() |
| template<typename T> | |
| using | PsramUniquePtr = std::unique_ptr<T[], CapsFreeDeleter> |
| template<typename T> | |
| using | CStdUniquePtr = std::unique_ptr<T, CStdFreeDeleter> |
| unique_ptr for buffers allocated via realloc/malloc (e.g. esp_http_client body chunks). | |
| using | FilePtr = std::unique_ptr<std::FILE, FileCloseDeleter> |
| unique_ptr for FILE* handles. Destructor calls std::fclose. | |
Functions | |
| void | writeBe32 (uint8_t *out, uint32_t v) |
| Writes a 32-bit value to a buffer in big-endian order. | |
| uint32_t | readBe32 (const uint8_t *in) |
| Reads a 32-bit value from a buffer in big-endian order. | |
| void | writeBe16 (uint8_t *out, uint16_t v) |
| Writes a 16-bit value to a buffer in big-endian order. | |
| uint16_t | readBe16 (const uint8_t *in) |
| Reads a 16-bit value from a buffer in big-endian order. | |
| bool | aesGcm256Seal (const uint8_t key[32], const uint8_t *iv, size_t ivLen, const uint8_t *aad, size_t aadLen, const uint8_t *pt, size_t ptLen, uint8_t *ctOut, uint8_t tagOut[16]) |
Encrypts pt with AES-256-GCM and produces a 16-byte tag. | |
| bool | aesGcm256Open (const uint8_t key[32], const uint8_t *iv, size_t ivLen, const uint8_t *aad, size_t aadLen, const uint8_t *ct, size_t ctLen, const uint8_t tag[16], uint8_t *ptOut) |
Authenticates and decrypts ct with AES-256-GCM. | |
| TropicWipeResult | wipeTropic (hal::ISecureElement *se, uint16_t progressEvery=0, void(*onRmemProgress)(uint16_t current, uint16_t total)=nullptr) |
| Iterates every TROPIC01 ECC slot (0..ECC_SLOT_COUNT-1) and R-Memory slot (0..RMEM_SLOT_COUNT-1), deleting whatever is currently populated. Sets sessionReady=false and returns immediately if no active SE session is available. | |
| esp_err_t | wipeNvs () |
| Erases the NVS partition and re-initializes it blank. | |
| void | selfDestruct () |
| Triggers a full factory wipe on the next boot and restarts. | |
| IKeyboardProvider * | getKeyboard () |
| template<typename T> | |
| PsramUniquePtr< T > | psramAlloc (std::size_t count) noexcept |
Allocate count elements of T in PSRAM (8-bit capable region). | |
| FilePtr | openFile (const char *path, const char *mode) noexcept |
| Open a FILE* and wrap it in a FilePtr. | |
| const char * | skipSpaces (const char *s) |
| Advances over leading ASCII whitespace in a C string. | |
| const char * | nextToken (const char *s, char *out, size_t outSize) |
| Extracts one whitespace-delimited token from a string. | |
| void | unescapeSpaces (char *s) |
| Replaces every \ escape sequence with a single space character in-place. | |
| static void | removeNameFromList (const char *list, const char *name, char *dest, size_t capacity) |
| Removes a name from a comma-separated list, in place. | |
| static bool | addNameToList (char *list, const char *name, size_t capacity) |
| Appends a name to a comma-separated list, in place. | |
| static bool | verify_payload_signature (hal::ISecureElement *se, const uint8_t *payload, size_t payload_len, const uint8_t *sig, size_t sig_len) |
| Loads serialized PIN/KDF state from secure-element R-Memory. | |
| static const char * | serviceTypeName (ServiceType type) |
| Converts a service type enum to a log-friendly string. | |
Variables | |
| constexpr const char * | kBootProfileNs = "boot_profile" |
| constexpr const char * | kBootProfileKey = "profile" |
| static constexpr const char * | MODULES_NVS_NAMESPACE = "modules" |
| NVS garbage collection for removed modules. | |
| static constexpr const char * | MODULES_NVS_KEY = "list" |
| static constexpr const char * | MODULES_NVS_KEY_DISABLED = "disabled" |
| static constexpr size_t | MAX_MODULE_LIST_SIZE = 256 |
| static const SlotMapEntry | kSlotMap [] |
| static constexpr size_t | kSlotMapCount = sizeof(kSlotMap) / sizeof(kSlotMap[0]) |
| static constexpr uint8_t | CACHE_VERSION = 1 |
| static constexpr const char * | NVS_NAMESPACE = "tr01_meta" |
| static constexpr const char * | NVS_KEY_HEADER = "hdr" |
| using cdc::core::CStdUniquePtr = std::unique_ptr<T, CStdFreeDeleter> |
| using cdc::core::EventHandler = void(*)(const Event&) |
Event handler function type
Definition at line 66 of file EventBus.h.
| using cdc::core::FilePtr = std::unique_ptr<std::FILE, FileCloseDeleter> |
| using cdc::core::ModuleInitFunc = void(*)() |
Module Registry - manages all registered modules
Provides:
Definition at line 18 of file ModuleRegistry.h.
| using cdc::core::PsramUniquePtr = std::unique_ptr<T[], CapsFreeDeleter> |
|
strong |
Event types for system-wide communication
Definition at line 11 of file EventBus.h.
|
strong |
Reason the system entered lockdown.
Definition at line 11 of file SystemLock.h.
|
strong |
|
strong |
Classified cause of a failed startModule() call.
| Enumerator | |
|---|---|
| SlotError | Module reported a slot-map error. |
| UsbBudgetFull | HID interface budget is exhausted. |
| Generic | Start failed for an unspecified reason. |
Definition at line 23 of file ModuleRegistry.h.
|
strong |
Service lifecycle states
| Enumerator | |
|---|---|
| UNINITIALIZED | |
| INITIALIZED | |
| STARTED | |
| STOPPED | |
| ERROR | |
Definition at line 10 of file IService.h.
|
strong |
Well-known service types for typed service discovery. Use these with provide<T>() and request<T>() for type-safe inter-module communication.
| Enumerator | |
|---|---|
| KEYBOARD | |
| CHALLENGE_RESPONDER | |
| CLIPBOARD | |
| NOTIFICATION | |
Definition at line 12 of file ServiceRegistry.h.
|
strong |
| Enumerator | |
|---|---|
| Fido | |
| Keyboard | |
| Ccid | |
Definition at line 8 of file UsbManager.h.
|
strong |
| Enumerator | |
|---|---|
| Hid | |
| Ccid | |
Definition at line 14 of file UsbManager.h.
|
static |
Appends a name to a comma-separated list, in place.
Adds name to list, inserting a leading comma when the list is non-empty. No action is taken when the resulting string would exceed capacity.
| list | In/out buffer holding the comma-separated list. |
| name | Name to append. |
| capacity | Size of list in bytes including the null terminator. |
Definition at line 715 of file ModuleRegistry.cpp.
References name.
Referenced by cdc::core::ModuleRegistry::setModuleEnabled().
|
inline |
Authenticates and decrypts ct with AES-256-GCM.
| key | 32-byte AES key. |
| iv | Initialization vector / nonce. |
| ivLen | IV length in bytes (12 for the canonical GCM nonce). |
| aad | Additional authenticated data (may be nullptr if aadLen is 0). |
| aadLen | AAD length in bytes. |
| ct | Ciphertext input. |
| ctLen | Ciphertext length in bytes. |
| tag | 16-byte authentication tag. |
| ptOut | Plaintext output buffer of at least ctLen bytes. |
Definition at line 79 of file Crypto.h.
References cdc::core::GcmContext::get().
Referenced by host_aes_gcm_decrypt(), and load_slot_decrypted().
|
inline |
Encrypts pt with AES-256-GCM and produces a 16-byte tag.
| key | 32-byte AES key. |
| iv | Initialization vector / nonce. |
| ivLen | IV length in bytes (12 for the canonical GCM nonce). |
| aad | Additional authenticated data (may be nullptr if aadLen is 0). |
| aadLen | AAD length in bytes. |
| pt | Plaintext input. |
| ptLen | Plaintext length in bytes. |
| ctOut | Ciphertext output buffer of at least ptLen bytes. |
| tagOut | 16-byte authentication tag output. |
Definition at line 48 of file Crypto.h.
References cdc::core::GcmContext::get().
Referenced by host_aes_gcm_encrypt(), and save_slot_encrypted().
| IKeyboardProvider * cdc::core::getKeyboard | ( | ) |
Convenience function to get keyboard provider
Definition at line 6 of file IKeyboardProvider.cpp.
References cdc::core::ServiceRegistry::instance(), KEYBOARD, and cdc::core::ServiceRegistry::request().
Referenced by cdc::mod_2fa::OathCodeView::getFooterHint(), cdc::ui::BlePairingView::onEnter(), cdc::ui::BlePairingView::onExit(), cdc::mod_2fa::OathCodeView::onKey(), cdc::mod_password::onTypePassword(), and cdc::mod_password::showDetails().
|
inline |
Extracts one whitespace-delimited token from a string.
Supports \ (backslash-space) as an escaped literal space inside a token, so tokens may contain space characters when escaped.
| s | Input cursor position. |
| out | Output token buffer (will be null-terminated on success). |
| outSize | Output buffer capacity. |
Definition at line 31 of file StringUtils.h.
References skipSpaces().
|
inlinenoexcept |
Open a FILE* and wrap it in a FilePtr.
| path | File path. |
| mode | fopen mode string. |
Definition at line 87 of file Raii.h.
Referenced by cdc::os_ui::BackupManager::exportTo(), cdc::plugin_manager::PluginManager::getManifest(), host_fs_read(), host_fs_view(), host_fs_write(), cdc::os_ui::BackupManager::importFrom(), cdc::plugin_manager::Plugin::loadLangOverlay(), and cdc::plugin_manager::PluginStorage::setDisabled().
|
noexcept |
Allocate count elements of T in PSRAM (8-bit capable region).
Definition at line 51 of file Raii.h.
Referenced by cdc::mod_gpg::cmd_gpg_export_signed(), cdc::mod_gpg::cmd_gpg_recv_list(), cdc::os_ui::BackupManager::exportTo(), cdc::os_ui::BackupManager::importFrom(), cdc::ui::InfoView::init(), cdc::plugin_manager::Plugin::loadLangOverlay(), cdc::mod_gpg::rebuildReceivedList(), cdc::plugin_manager::register_host_imports(), and cdc::core::CpuStats::sample().
|
inline |
|
inline |
|
static |
Removes a name from a comma-separated list, in place.
Iterates through tokens of the input list and writes back the result with any token equal to name filtered out. Other tokens keep their original order. The destination must have capacity for at least capacity bytes (including the terminating null) and may alias list.
| list | Source comma-separated list (must be null-terminated). |
| name | Token to remove (case-sensitive, exact match). |
| dest | Destination buffer to receive the filtered list. |
| capacity | Size of dest in bytes including the null terminator. |
Definition at line 666 of file ModuleRegistry.cpp.
References name.
Referenced by cdc::core::ModuleRegistry::setModuleEnabled().
| void cdc::core::selfDestruct | ( | ) |
Triggers a full factory wipe on the next boot and restarts.
Erases the build-profile marker (kBootProfileNs / kBootProfileKey) from NVS, commits, then reboots. The boot path detects the absent marker and wipes all NVS plus every TROPIC01 ECC/R-Memory slot before reseeding it. The function does not return.
Definition at line 60 of file FactoryReset.cpp.
References kBootProfileKey, and kBootProfileNs.
Referenced by cdc::ui::onPinVerify().
|
static |
Converts a service type enum to a log-friendly string.
| type | Service type to convert. |
Definition at line 14 of file ServiceRegistry.cpp.
References CHALLENGE_RESPONDER, CLIPBOARD, KEYBOARD, and NOTIFICATION.
|
inline |
Advances over leading ASCII whitespace in a C string.
| s | Input string pointer. |
Definition at line 13 of file StringUtils.h.
Referenced by nextToken().
|
inline |
Replaces every \ escape sequence with a single space character in-place.
| s | Mutable null-terminated string buffer. |
Definition at line 61 of file StringUtils.h.
Referenced by cdc::mod_password::cmd_password_add(), and cdc::mod_password::cmd_password_edit().
|
static |
Loads serialized PIN/KDF state from secure-element R-Memory.
Verifies the ECDSA-P256 attestation signature appended to a stored PIN payload. The signature is produced over the first PAYLOAD_SIZE bytes with the chip-bound key in ECC slot 0 (AttestationKeyService).
If the chip-bound public key has changed (slot 0 was regenerated, e.g. by an attacker who managed to rewrite that slot via the pairing key), the verification will fail and the caller will trigger a re-init with fresh defaults. The signature itself uses random-k ECDSA, so re-saving the same payload produces a different signature — that is fine, only verification matters here.
Definition at line 126 of file PinManager.cpp.
References cdc::core::PinManager::ATTESTATION_ECC_SLOT, curve, cdc::hal::ISecureElement::eccGetPublicKey(), LOG_W, cdc::hal::OK, cdc::hal::P256, SHA256_DIGEST_SIZE, and TAG.
| esp_err_t cdc::core::wipeNvs | ( | ) |
Erases the NVS partition and re-initializes it blank.
Definition at line 46 of file FactoryReset.cpp.
Referenced by checkBuildProfileAndWipeNvs(), and cdc::serial::cmdNvsClear().
| TropicWipeResult cdc::core::wipeTropic | ( | hal::ISecureElement * | se, |
| uint16_t | progressEvery = 0, | ||
| void(* | onRmemProgress )(uint16_t current, uint16_t total) = nullptr ) |
Iterates every TROPIC01 ECC slot (0..ECC_SLOT_COUNT-1) and R-Memory slot (0..RMEM_SLOT_COUNT-1), deleting whatever is currently populated. Sets sessionReady=false and returns immediately if no active SE session is available.
| se | Secure element instance. |
| progressEvery | When non-zero, onRmemProgress is invoked every progressEvery R-Memory slots and once on completion. Ignored when onRmemProgress is null. |
| onRmemProgress | Optional progress callback receiving (current, total). |
Definition at line 11 of file FactoryReset.cpp.
References cdc::hal::ISecureElement::ECC_SLOT_COUNT, cdc::hal::ISecureElement::eccDelete(), cdc::core::TropicWipeResult::eccDeleted, cdc::hal::ISecureElement::eccSlotUsed(), cdc::hal::ISecureElement::isSessionActive(), LOG_E, cdc::hal::OK, cdc::hal::ISecureElement::RMEM_SLOT_COUNT, cdc::core::TropicWipeResult::rmemDeleted, cdc::hal::ISecureElement::rmemErase(), cdc::hal::ISecureElement::rmemSlotUsed(), cdc::core::TropicWipeResult::sessionReady, and TAG.
Referenced by cdc::serial::cmdTr01Wipe(), and wipeTropicForFactoryReset().
|
inline |
|
inline |
Writes a 32-bit value to a buffer in big-endian order.
| out | Destination buffer of at least four bytes. |
| v | Value to encode. |
Definition at line 17 of file Bytes.h.
Referenced by u2f_authenticate().
|
staticconstexpr |
Definition at line 13 of file TropicStorage.cpp.
Referenced by cdc::core::TropicStorage::init().
|
inlineconstexpr |
Definition at line 14 of file FactoryReset.h.
Referenced by checkBuildProfileAndWipeNvs(), seedBuildProfile(), and selfDestruct().
|
inlineconstexpr |
NVS namespace and key of the build-profile marker. The boot path (main.cpp) seeds this key after a completed factory wipe and treats its absence on the next boot as a trigger to wipe NVS and TROPIC01. Shared so the self-destruct trigger erases exactly the key the boot path reads.
Definition at line 13 of file FactoryReset.h.
Referenced by checkBuildProfileAndWipeNvs(), seedBuildProfile(), and selfDestruct().
|
static |
Definition at line 26 of file TropicSlotMap.cpp.
Referenced by cdc::core::TropicSlotMap::computeMapSignature(), cdc::core::TropicSlotMap::forEachRange(), cdc::core::TropicSlotMap::getRangeByModuleId(), and cdc::core::TropicSlotMap::getRangeByName().
Definition at line 31 of file TropicSlotMap.cpp.
Referenced by cdc::core::TropicSlotMap::computeMapSignature(), cdc::core::TropicSlotMap::forEachRange(), cdc::core::TropicSlotMap::getRangeByModuleId(), and cdc::core::TropicSlotMap::getRangeByName().
|
staticconstexpr |
Definition at line 436 of file ModuleRegistry.cpp.
|
staticconstexpr |
Definition at line 434 of file ModuleRegistry.cpp.
|
staticconstexpr |
Definition at line 435 of file ModuleRegistry.cpp.
|
staticconstexpr |
NVS garbage collection for removed modules.
Definition at line 433 of file ModuleRegistry.cpp.
|
staticconstexpr |
Definition at line 15 of file TropicStorage.cpp.
|
staticconstexpr |
Definition at line 14 of file TropicStorage.cpp.