Fix HDPath validation and CLA in recovery app (Zondax#10)

* fix hdpath validation

* bump version

* fix cla for generic

* add API avail recovery app

* update zxlib and js

Makefile

@@ -48,6 +48,14 @@ zemu_install: tests_tools_build
 
 test_all:
 	make zemu_install
+
+	echo "Testing recovery"
+	make clean
+	SUBSTRATE_PARSER_FULL=1 COIN=AVAIL_RECOVERY make
+	cd tests_zemu && yarn test_recovery && cd ..
+
+	echo "Testing standard"
+	make clean
 	SUBSTRATE_PARSER_FULL=1 make
 	make clean_build
 	SUBSTRATE_PARSER_FULL=1 SUPPORT_SR25519=1 make buildS

app/Makefile.version

@@ -3,4 +3,4 @@ APPVERSION_M=1
 # This is the `spec_version` field of `Runtime`
 APPVERSION_N=39
 # This is the patch version of this release
-APPVERSION_P=0
+APPVERSION_P=1

app/src/apdu_handler.c

@@ -43,8 +43,13 @@ void extractHDPath(uint32_t rx, uint32_t offset) {
 
     memcpy(hdPath, G_io_apdu_buffer + offset, sizeof(uint32_t) * HDPATH_LEN_DEFAULT);
 
+#ifdef RECOVERY_APP
+    const bool mainnet = hdPath[0] == HDPATH_0_DEFAULT &&
+                         hdPath[1] == HDPATH_1_RECOVERY;
+#else
     const bool mainnet = hdPath[0] == HDPATH_0_DEFAULT &&
                          hdPath[1] == HDPATH_1_DEFAULT;
+#endif
 
     if (!mainnet) {
         THROW(APDU_CODE_DATA_INVALID);
@@ -249,9 +254,15 @@ void handleApdu(volatile uint32_t *flags, volatile uint32_t *tx, uint32_t rx) {
     {
         TRY
         {
+#ifdef RECOVERY_APP
+            if (G_io_apdu_buffer[OFFSET_CLA] != CLA_RECOVERY) {
+                THROW(APDU_CODE_CLA_NOT_SUPPORTED);
+            }
+#else
             if (G_io_apdu_buffer[OFFSET_CLA] != CLA) {
                 THROW(APDU_CODE_CLA_NOT_SUPPORTED);
             }
+#endif
 
             if (rx < APDU_MIN_LENGTH) {
                 THROW(APDU_CODE_WRONG_LENGTH);

app/src/substrate/substrate_coin.h

@@ -21,13 +21,14 @@ extern "C" {
 
 #define COIN_ADDR_TYPE 42
 #define CLA 0xbc
+#define CLA_RECOVERY 0xbe
 
 #define INS_SIGN_RAW 0x03
 
 #define HDPATH_LEN_DEFAULT 5
 #define HDPATH_0_DEFAULT (0x80000000 | 0x2c)
 #define HDPATH_1_DEFAULT (0x80000000 | 0x2c5)
-#define HDPATH_1_RECOVERY (0x80000000 | 0x2c5)
+#define HDPATH_1_RECOVERY (0x80000000 | 0x162)
 
 #define HDPATH_2_DEFAULT (0x80000000u | 0u)
 #define HDPATH_3_DEFAULT (0u)

tests_zemu/package.json

@@ -15,30 +15,31 @@
   ],
   "scripts": {
     "clean": "ts-node tests/pullImageKillOld.ts",
-    "test": "yarn clean && jest --maxConcurrency 3"
+    "test": "yarn clean && jest --maxConcurrency 3 --testPathIgnorePatterns recovery.test.ts",
+    "test_recovery": "yarn clean && jest --maxConcurrency 3 recovery.test.ts"
   },
   "dependencies": {
-    "@zondax/ledger-substrate": "^1.0.0",
-    "@zondax/zemu": "^0.51.0"
+    "@zondax/ledger-substrate": "^1.0.1",
+    "@zondax/zemu": "^0.53.0"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/ledgerhq__hw-transport": "^4.21.8",
-    "@typescript-eslint/eslint-plugin": "^8.12.2",
-    "@typescript-eslint/parser": "^8.12.2",
+    "@typescript-eslint/eslint-plugin": "^8.18.1",
+    "@typescript-eslint/parser": "^8.18.1",
     "blakejs": "^1.2.1",
     "crypto-js": "4.2.0",
     "ed25519-supercop": "^2.0.1",
-    "eslint": "^9.13.0",
+    "eslint": "^9.17.0",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-jest": "^28.8.3",
+    "eslint-plugin-jest": "^28.9.0",
     "eslint-plugin-prettier": "^5.2.1",
     "jest": "29.7.0",
     "jssha": "^3.3.1",
-    "prettier": "^3.3.3",
+    "prettier": "^3.4.2",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",
-    "typescript": "^5.6.3"
+    "typescript": "^5.7.2"
   }
 }

tests_zemu/tests/recovery.test.ts

@@ -0,0 +1,119 @@
+/** ******************************************************************************
+ *  (c) 2020 Zondax GmbH
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ ******************************************************************************* */
+
+import Zemu, { ButtonKind, DEFAULT_START_OPTIONS, isTouchDevice } from '@zondax/zemu'
+import { newSubstrateApp } from '@zondax/ledger-substrate'
+import { APP_SEED, models } from './common'
+
+const defaultOptions = {
+  ...DEFAULT_START_OPTIONS,
+  logging: true,
+  custom: `-s "${APP_SEED}"`,
+  X11: false,
+}
+
+const expected_address_recovery = '5HAeMNeM1XzB9ab742XyV8rM4u1wsAUiQQod61n9cjMTrKbn'
+const expected_pk_recovery = 'e1b4d72d27b3e91b9b6116555b4ea17138ddc12ca7cdbab30e2e0509bd848419'
+
+jest.setTimeout(180000)
+
+describe('Standard', function () {
+  test.concurrent.each(models)('can start and stop container', async function (m) {
+    const sim = new Zemu(m.path)
+    try {
+      await sim.start({ ...defaultOptions, model: m.name })
+    } finally {
+      await sim.close()
+    }
+  })
+
+  test.concurrent.each(models)('get address recovery', async function (m) {
+    const sim = new Zemu(m.path)
+    try {
+      await sim.start({ ...defaultOptions, model: m.name })
+      const app = newSubstrateApp(sim.getTransport(), 'AvailRecovery')
+
+      const resp = await app.getAddress(0x80000000, 0x80000000, 0x80000000)
+
+      console.log(resp)
+
+      expect(resp.return_code).toEqual(0x9000)
+      expect(resp.error_message).toEqual('No errors')
+
+      expect(resp.address).toEqual(expected_address_recovery)
+      expect(resp.pubKey).toEqual(expected_pk_recovery)
+    } finally {
+      await sim.close()
+    }
+  })
+
+  test.concurrent.each(models)('show address recovery', async function (m) {
+    const sim = new Zemu(m.path)
+    try {
+      await sim.start({
+        ...defaultOptions,
+        model: m.name,
+        approveKeyword: isTouchDevice(m.name) ? 'Confirm' : '',
+        approveAction: ButtonKind.ApproveTapButton,
+      })
+      const app = newSubstrateApp(sim.getTransport(), 'AvailRecovery')
+
+      const respRequest = app.getAddress(0x80000000, 0x80000000, 0x80000000, true)
+      // Wait until we are not in the main menu
+      await sim.waitUntilScreenIsNot(sim.getMainMenuSnapshot())
+      await sim.compareSnapshotsAndApprove('.', `${m.prefix.toLowerCase()}-recovery_show_address`)
+
+      const resp = await respRequest
+
+      console.log(resp)
+
+      expect(resp.return_code).toEqual(0x9000)
+      expect(resp.error_message).toEqual('No errors')
+
+      expect(resp.address).toEqual(expected_address_recovery)
+      expect(resp.pubKey).toEqual(expected_pk_recovery)
+    } finally {
+      await sim.close()
+    }
+  })
+
+  test.concurrent.each(models)('show address recovery - reject', async function (m) {
+    const sim = new Zemu(m.path)
+    try {
+      await sim.start({
+        ...defaultOptions,
+        model: m.name,
+        approveKeyword: isTouchDevice(m.name) ? 'Confirm' : '',
+      })
+      const app = newSubstrateApp(sim.getTransport(), 'AvailRecovery')
+
+      const respRequest = app.getAddress(0x80000000, 0x80000000, 0x80000000, true)
+      // Wait until we are not in the main menu
+      await sim.waitUntilScreenIsNot(sim.getMainMenuSnapshot())
+
+      await sim.compareSnapshotsAndReject('.', `${m.prefix.toLowerCase()}-recovery_show_address_reject`)
+
+      const resp = await respRequest
+      console.log(resp)
+
+      expect(resp.return_code).toEqual(0x6986)
+      expect(resp.error_message).toEqual('Transaction rejected')
+
+    } finally {
+      await sim.close()
+    }
+  })
+})