test: close 7.14.2 presign evidence gaps

Author: BitHighlander

keepkeylib/client.py

@@ -460,20 +460,19 @@ def _check_request(self, msg):
                     raise CallException(types.Failure_Other,
                             "Expected %s, got %s" % (pprint(expected), pprint(msg)))
 
-    def _capture_oled(self):
+    def _capture_oled(self, layout=None):
         """Capture current OLED layout to screenshot directory."""
         if not SCREENSHOT:
             return
         if not self.debug:
-            import sys
-            print("[SCREENSHOT] SKIP: no debug link", file=sys.stderr)
-            return
+            raise RuntimeError("screenshot capture requested without debug link")
         try:
-            layout = self.debug.read_layout()
+            if layout is None:
+                layout = self.debug.read_layout()
             if not layout or len(layout) < 1024:
-                import sys
-                print("[SCREENSHOT] SKIP: layout too small (%d bytes)" % (len(layout) if layout else 0), file=sys.stderr)
-                return
+                raise RuntimeError(
+                    "layout too small (%d bytes)" %
+                    (len(layout) if layout else 0))
             layout_bytes = len(layout)
             height = 64 if layout_bytes >= 2048 else 32
             rows = []
@@ -500,6 +499,7 @@ def _capture_oled(self):
             import sys, traceback
             print("[SCREENSHOT] ERROR: %s" % e, file=sys.stderr)
             traceback.print_exc(file=sys.stderr)
+            raise
 
     def callback_ButtonRequest(self, msg):
         if self.verbose:

scripts/generate-test-report.py

@@ -12,10 +12,10 @@
 import pytest
 import os
 import glob
-import ipaddress
+import hashlib
+import json
 import socket
 import sys
-from urllib.parse import urlparse
 
 import requests
 
@@ -56,22 +56,6 @@ def _patched_setUp(self):
     common.KeepKeyTest.setUp = _patched_setUp
 
 
-def _is_loopback_address(address):
-    """Allow emulator traffic while rejecting every external destination."""
-    if not isinstance(address, tuple):
-        # Unix-domain sockets are local by construction.
-        return True
-    host = address[0]
-    if isinstance(host, bytes):
-        host = host.decode('ascii')
-    if host == 'localhost':
-        return True
-    try:
-        return ipaddress.ip_address(host).is_loopback
-    except (TypeError, ValueError):
-        return False
-
-
 def _configured_emulator_endpoints(getaddrinfo):
     """Return the exact UDP names and addresses configured by the test harness."""
     names = set()
@@ -102,7 +86,6 @@ def deny_external_network(monkeypatch, request):
     original_connect = socket.socket.connect
     original_connect_ex = socket.socket.connect_ex
     original_sendto = socket.socket.sendto
-    original_request = requests.sessions.Session.request
     emulator_names, emulator_addresses = _configured_emulator_endpoints(
         original_getaddrinfo)
 
@@ -113,42 +96,43 @@ def denied(destination):
 
     def guarded_getaddrinfo(host, *args, **kwargs):
         port = args[0] if args else kwargs.get('port')
-        if (not _is_loopback_address((host, 0)) and
-                (host, port) not in emulator_names):
-            denied(host)
+        if (host, port) not in emulator_names:
+            denied((host, port))
         return original_getaddrinfo(host, *args, **kwargs)
 
-    def allowed_socket_address(address):
-        if _is_loopback_address(address):
-            return True
+    def allowed_socket_address(sock, address):
         if not isinstance(address, tuple) or len(address) < 2:
             return False
-        return ((address[0], address[1]) in emulator_names or
-                (address[0], address[1]) in emulator_addresses)
+        # No Unix sockets, TCP loopback, or arbitrary localhost ports. The
+        # authoritative suite may talk only to the two exact UDP transports
+        # configured for this emulator run.
+        if sock.family not in (socket.AF_INET, socket.AF_INET6):
+            return False
+        if (sock.type & 0x0f) != socket.SOCK_DGRAM:
+            return False
+        endpoint = (address[0], address[1])
+        return endpoint in emulator_names or endpoint in emulator_addresses
 
     def guarded_connect(sock, address):
-        if not allowed_socket_address(address):
+        if not allowed_socket_address(sock, address):
             denied(address)
         return original_connect(sock, address)
 
     def guarded_connect_ex(sock, address):
-        if not allowed_socket_address(address):
+        if not allowed_socket_address(sock, address):
             denied(address)
         return original_connect_ex(sock, address)
 
     def guarded_sendto(sock, data, *args):
         address = args[-1]
-        if not allowed_socket_address(address):
+        if not allowed_socket_address(sock, address):
             denied(address)
         return original_sendto(sock, data, *args)
 
     def guarded_request(session, method, url, *args, **kwargs):
-        hostname = urlparse(url).hostname
-        if not _is_loopback_address((hostname, 0)):
-            raise AssertionError(
-                'authoritative test attempted HTTP access: test=%s method=%s '
-                'url=%s' % (nodeid, method, url))
-        return original_request(session, method, url, *args, **kwargs)
+        raise AssertionError(
+            'authoritative test attempted HTTP access: test=%s method=%s '
+            'url=%s' % (nodeid, method, url))
 
     monkeypatch.setattr(socket, 'getaddrinfo', guarded_getaddrinfo)
     monkeypatch.setattr(socket.socket, 'connect', guarded_connect)
@@ -167,5 +151,53 @@ def pytest_sessionfinish(session, exitstatus):
     if count == 0:
         print("FATAL: KEEPKEY_SCREENSHOT=1 but 0 PNGs captured. Screenshot pipeline is broken.", file=sys.stderr)
         session.exitstatus = 1
-    else:
-        print("[SCREENSHOT] Session complete: %d PNGs captured" % count, file=sys.stderr)
+        return
+
+    try:
+        sequence_count = 0
+        for directory, _subdirs, files in os.walk(screenshot_dir):
+            if not any(name.endswith('.png') for name in files):
+                if 'frames.json' in files:
+                    raise AssertionError(
+                        'frame manifest has no PNG sequence: %s' % directory)
+                continue
+            other = sorted(name for name in files
+                           if name != 'frames.json')
+            expected = ['btn%05d.png' % i for i in range(len(other))]
+            if other != expected:
+                raise AssertionError(
+                    'non-contiguous or unexpected OLED frames in %s: '
+                    'found=%r expected=%r' % (directory, other, expected))
+            frames = []
+            for name in expected:
+                path = os.path.join(directory, name)
+                with open(path, 'rb') as handle:
+                    digest = hashlib.sha256(handle.read()).hexdigest()
+                frames.append({'file': name, 'sha256': digest})
+            manifest = {
+                'schema': 1,
+                'group': os.path.basename(directory),
+                'frame_count': len(frames),
+                'frames': frames,
+            }
+            manifest_path = os.path.join(directory, 'frames.json')
+            if os.path.isfile(manifest_path):
+                with open(manifest_path, 'r') as handle:
+                    existing = json.load(handle)
+                if existing != manifest:
+                    raise AssertionError(
+                        'frame manifest disagrees with capture: %s' %
+                        manifest_path)
+            else:
+                with open(manifest_path, 'w') as handle:
+                    json.dump(manifest, handle, sort_keys=True, indent=2)
+                    handle.write('\n')
+            sequence_count += 1
+    except (IOError, OSError, ValueError, AssertionError) as exc:
+        print('FATAL: OLED sequence manifest failure: %s' % exc,
+              file=sys.stderr)
+        session.exitstatus = 1
+        return
+
+    print("[SCREENSHOT] Session complete: %d PNGs in %d manifested sequences" %
+          (count, sequence_count), file=sys.stderr)

tests/conftest.py

@@ -0,0 +1,181 @@
+# This file is part of the KeepKey project.
+#
+# Copyright (C) 2026 KeepKey
+#
+# This library is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License version 3
+# as published by the Free Software Foundation.
+
+"""Every byte passed through firmware ``confirm_data`` must reach the OLED."""
+
+from __future__ import print_function
+
+import binascii
+
+import common
+
+from keepkeylib import messages_eos_pb2 as eos_messages
+from keepkeylib import types_pb2 as types
+from keepkeylib.tools import parse_path
+from test_msg_display_disclosure import ScreenRecorder
+
+
+PREV_HASH = binascii.unhexlify(
+    "d5f65ee80147b4bcc70b75e4bbf2d738"
+    "2021b871bd8867ef8fa525ef50864882"
+)
+EOS_PATH = parse_path("m/44'/194'/0'/0/0")
+
+
+class TestConfirmDataDisclosure(common.KeepKeyTest):
+    def setUp(self):
+        super(TestConfirmDataDisclosure, self).setUp()
+        self.requires_firmware("7.14.2")
+        self.requires_fullFeature()
+        self.setup_mnemonic_nopin_nopassphrase()
+
+    def _capture_op_return(self, payload, group):
+        tx_input = types.TxInputType(
+            address_n=[0], prev_hash=PREV_HASH, prev_index=0
+        )
+        payment = types.TxOutputType(
+            address="1MJ2tj2ThBE62zXbBYA5ZaN3fdve5CPAz1",
+            amount=380000,
+            script_type=types.PAYTOADDRESS,
+        )
+        data_output = types.TxOutputType(
+            op_return_data=payload,
+            amount=0,
+            script_type=types.PAYTOOPRETURN,
+        )
+        recorder = ScreenRecorder(
+            self.client, answer=True, screenshot_group=group
+        )
+        with recorder:
+            _, serialized = self.client.sign_tx(
+                "Bitcoin", [tx_input], [payment, data_output]
+            )
+        return recorder.fingerprint, serialized
+
+    def _capture_eos_memo(self, memo, group):
+        transaction = {
+            "chain_id": (
+                "cf057bbfb72640471fd910bcb67639c22"
+                "df9f92470936cddc1ade0e2f2e7dc4f"
+            ),
+            "transaction": {
+                "expiration": "2018-07-14T07:43:28",
+                "ref_block_num": 6439,
+                "ref_block_prefix": 2995713264,
+                "max_net_usage_words": 0,
+                "max_cpu_usage_ms": 0,
+                "delay_sec": 0,
+                "context_free_actions": [],
+                "actions": [{
+                    "account": "eosio.token",
+                    "name": "transfer",
+                    "authorization": [{
+                        "actor": "miniminimini",
+                        "permission": "active",
+                    }],
+                    "data": {
+                        "from": "miniminimini",
+                        "to": "maximaximaxi",
+                        "quantity": "1.0000 EOS",
+                        "memo": memo,
+                    },
+                }],
+                "transaction_extensions": [],
+            },
+        }
+        recorder = ScreenRecorder(
+            self.client, answer=True, screenshot_group=group
+        )
+        with recorder:
+            signed = self.client.eos_sign_tx(EOS_PATH, transaction)
+        signature = (
+            bytes(signed.signature_r),
+            bytes(signed.signature_s),
+            signed.signature_v,
+        )
+        return recorder.fingerprint, signature
+
+    def test_binary_op_return_tail_changes_oled_review(self):
+        """A byte after the old 50-byte binary preview must be displayed."""
+        common_prefix = b"\x80" + b"A" * 79
+        payload_a = common_prefix + b"X" * 16
+        payload_b = common_prefix + b"Y" + b"X" * 15
+
+        screens_a, signed_a = self._capture_op_return(payload_a, "opreturn-a")
+        # Run each member of the A/B pair from the same clean device state.
+        # Multi-page review ends with a held confirmation, so merely opening a
+        # new protocol session can retain a trailing emulator button event.
+        self.client.wipe_device()
+        self.setup_mnemonic_nopin_nopassphrase()
+        screens_b, signed_b = self._capture_op_return(payload_b, "opreturn-b")
+
+        self.assertNotEqual(signed_a, signed_b)
+        self.assertGreater(len(screens_a), 1)
+        self.assertGreater(len(screens_b), 1)
+        self.assertNotEqual(
+            screens_a, screens_b,
+            "different signed OP_RETURN tails produced identical OLED review",
+        )
+
+    def test_non_ascii_eos_memo_tail_changes_oled_review(self):
+        """A UTF-8 memo byte after the old 50-byte preview must be displayed."""
+        common_prefix = "\u00e9" + "A" * 79
+        memo_a = common_prefix + "X" * 16
+        memo_b = common_prefix + "Y" + "X" * 15
+
+        screens_a, signed_a = self._capture_eos_memo(memo_a, "eos-a")
+        self.client.wipe_device()
+        self.setup_mnemonic_nopin_nopassphrase()
+        screens_b, signed_b = self._capture_eos_memo(memo_b, "eos-b")
+
+        self.assertNotEqual(signed_a, signed_b)
+        self.assertGreater(len(screens_a), 1)
+        self.assertGreater(len(screens_b), 1)
+        self.assertNotEqual(
+            screens_a, screens_b,
+            "different signed EOS memo tails produced identical OLED review",
+        )
+
+    def test_unknown_omni_property_changes_oled_review(self):
+        """Unsupported Omni assets must disclose bytes, not a shared ticker."""
+        header = b"omni\x00\x00\x00\x00" + (999999).to_bytes(4, "big")
+        payload_a = header + (1).to_bytes(8, "big")
+        payload_b = header + (2).to_bytes(8, "big")
+
+        screens_a, signed_a = self._capture_op_return(payload_a, "omni-prop-a")
+        self.client.wipe_device()
+        self.setup_mnemonic_nopin_nopassphrase()
+        screens_b, signed_b = self._capture_op_return(payload_b, "omni-prop-b")
+
+        self.assertNotEqual(signed_a, signed_b)
+        self.assertNotEqual(
+            screens_a, screens_b,
+            "different unsupported Omni assets produced identical OLED review",
+        )
+
+    def test_unknown_omni_type_changes_oled_review(self):
+        """Unsupported Omni operations must disclose the complete payload."""
+        header = b"omni\x00\x00\x00\x01" + (31).to_bytes(4, "big")
+        payload_a = header + (1).to_bytes(8, "big")
+        payload_b = header + (2).to_bytes(8, "big")
+
+        screens_a, signed_a = self._capture_op_return(payload_a, "omni-type-a")
+        self.client.wipe_device()
+        self.setup_mnemonic_nopin_nopassphrase()
+        screens_b, signed_b = self._capture_op_return(payload_b, "omni-type-b")
+
+        self.assertNotEqual(signed_a, signed_b)
+        self.assertNotEqual(
+            screens_a, screens_b,
+            "different unsupported Omni operations produced identical review",
+        )
+
+
+if __name__ == "__main__":
+    import unittest
+    unittest.main()