HSM refactor by Autofix · Pull Request #61 · brainstorm/ssh-stamp

Autofix · 2026-02-20T13:03:36Z

This PR is for the big refactor required by the HSM (Hierachical State Machine). Fixes #25

Summary of changes:

main.rs now contains the HSM which steps through each state so we can be certain of what has been run and configured at each point. Each state calls out to other functions and will only proceed to the next state once a valid result has been returned.
Currently the device will software reset if any error is encountered.
UART is only established after making an ssh connection to first read the required UART pins from ssh environment variables.
pins.rs has been removed and the pin config is instead stored as u8 in config.rs. Pins are only setup once after reading the value from the config. This occurs in the uart embassy task which has been moved from main.rs to buffered_uart.rs
src/storage.rs renamed to store.rs to avoid naming conflict with workspace.

Additionally this PR is built upon:

Config/ssh changes and dependency updates from https://github.com/brainstorm/ssh-stamp/tree/fix_passwd_auth
Storage Workspace from https://github.com/jubeormk1/ssh-stamp/blob/sftp-ota/

…om sunset for ssh-stamp...

…/proc_macros...

…assumptions around mutexes and rename Fl/FlashCo fig struct names

…onfigure the UART's pins at runtime (possible?) and also pass the config object around (safely/mutex-ing) too

…t a CriticalSectionRawMutex for the SSHConfig. Next up: figure out non-unsafe() ways to steal() pins for the UART pins

…channel, needs more work/thought... also PeripheralRef is not present in 1.0.0-beta.1

Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

@jubeormk1

… call is now required. The partition checking/handling functionalities might be relevant to @jubeormk1 too, btw

…with the UART operation, need to debug further

…X/TX/CTS/RTS... etc.. pin assignment and at-runtime validation et al Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

…h into fix_passwd_auth

@mmalenic

…erialization/deserialization "on the wire" of SSHConfig, unfortunately /cc @mmalenic

Introduced custom Errors Introduced env vars and started refactoring accordingly. Config and peripherals are borrow checker challenges. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

….. PinConfig no longer needs a new() method but OTOH resolve_pin() requires a bit more rework (or remove it altogether?)

Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

… PinConfig::new()... Also channel cannot send at the end of uart_task() because there's an infinite loop right before. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Use channels to send individual pins around... probably we should refactor to Signal instead since message size N=1. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

…ass SSH's env events

… lifetimes and futures. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

WARNING: use --release We *strongly* recommend using release profile when building esp-hal. The dev profile can potentially be one or more orders of magnitude slower than release, and may cause issues with timing-senstive peripherals and/or devices.

brainstorm

Thanks for fixing the suggestions! 🚀

Over to you @jubeormk1 (and @mmalenic, but only if you feel like it ;))

…l warn us if and when something breaks. Helps with not having to bump minor versions continuously, see https://words.filippo.io/dependabot/ for a gist of the idea

brainstorm · 2026-02-21T12:51:30Z

@jubeormk1 @Autofix @mmalenic ☝🏻 As of commit 8fcdafd, we have no hardcoded hostkey, it gets generated on-device and stored on FlashConfig. Subsequent re-flashes of code-only do not overwrite that private key (but it's still possible to exfiltrate it via flash dump, of course).

From now on you'll see the typical SSH prompt when testing on-device:

The authenticity of host '192.168.4.1 (192.168.4.1)' can't be established.
ED25519 key fingerprint is SHA256:zTQSC+4Fofl/j4vmg2jBhUDFwONeB+PKMSdke1bYzdQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is expected/normal, we should not support private key generation off-device (and then shuttling it over env vars, as previously discussed).

I've tested in on-hardware (esp32c6) and seems to work, but I need to setup the serial side test jig and/or I'll revisit Julio's remote testing jig as soon as this PR is merged.

Still doesn't fix the pub auth itself (more work required), but at least we longer have hardcoded privkeys in code...

brainstorm · 2026-02-21T14:18:35Z

HSM nit/design question: the device gets reset after 3 unsuccessful password auth attempts while using the following SSH client options to force password auth:

$ ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password zssh@192.168.4.1

See the events and reboot happening thereafter:

(...)
Entering connection_loop and prog_loop is next...
[src/serve.rs:233] "Preparing bridge" = "Preparing bridge"
ServEvent::Hostkeys
ServEvent::FirstAuth
ServEvent::PasswordAuth
ServEvent::PasswordAuth
ServEvent::PasswordAuth
WARN - rx complete ()
ESP-ROM:esp32c6-20220919
Build:Sep 19 2022
rst:0x3 (LP_SW_HPSYS),boot:0xc (SPI_FAST_FLASH_BOOT)
(...)

I'll try to fix it myself as I'm implementing password auth logic now (issue #20), just raising the issue, we should just close the connection instead of rebooting the whole device.

Autofix · 2026-02-21T14:42:09Z

I'll try to fix it myself as I'm implementing password auth logic now (issue #20), just raising the issue, we should just close the connection instead of rebooting the whole device.

I agree. My next step on implementing the HSM is managing the return/fail cases rather than software resets, so I can have a look into that next. I'll write a follow up of the remaining HSM parts in issue #25 after this PR is merged.

.vscode/settings.json

src/espressif/buffered_uart.rs

jubeormk1 · 2026-02-22T03:25:11Z

src/espressif/hash.rs

@@ -0,0 +1,28 @@
+use esp_hal::hmac::Hmac;


Difficult to follow which Hmac is which, could we name esp_hal::hmac::Hmac as EspHmac to avoid the type confusion?

I agree they should be changed but @brainstorm will need to answer this.
Probably it shouldn't be done with this PR.

jubeormk1 · 2026-02-22T03:31:22Z

src/espressif/mod.rs

 pub mod net;
 pub mod rng;
+// TODO: Specialise for Espressif, tricky since it seems to require burning eFuses?:
+// https://github.com/esp-rs/esp-hal/blob/main/examples/src/bin/hmac.rs


broken link. New one: https://github.com/esp-rs/esp-hal/blob/ab1474d1ec74e2c92ccb5c894a5cb42251ee68f7/examples/peripheral/hmac/src/main.rs
and
https://docs.espressif.com/projects/rust/esp-hal/1.0.0/esp32c6/esp_hal/hmac/index.html

Probably shouldn't be done with this PR.

jubeormk1 · 2026-02-22T03:38:33Z

README.md

I like it.

Thanks for taking your time to provide the default pins.

jubeormk1 · 2026-02-22T03:38:50Z

rust-toolchain.toml

 # SPDX-License-Identifier: GPL-3.0-or-later

 [toolchain]
+#channel = "nightly"


I would remove this line

jubeormk1 · 2026-02-22T03:41:11Z

Cargo.toml

 [workspace.dependencies]
-
-sunset = { git = "https://github.com/mkj/sunset", default-features = false, features = [
+sunset = { git = "https://github.com/jubeormk1/sunset", branch = "dev/sftp-start", default-features = false, features = [


At this point, you do not need to point to my fork/branch I would keep it out but it is ot a big deal. Same for sunset-async and sunset-sshwire-derive

Is this because you still have not merged your ssh-stamp sftp branch into main? We can leave it for now if you think it will still take some time to merge your sunset fork.

Agree with @Autofix, I think it's important to have the OTA (even if it's on a personal fork for now) so that it's part the sec audit... hopefully on a not-so-distant future PR you can get the sunset OTA bits merged upstream before the beginning of March?

Cargo.toml

jubeormk1 · 2026-02-22T03:47:22Z

Cargo.toml


 [features]
 ipv6 = []
+default = ["esp32c6", "sftp-ota"]


The sftp-ota feature at this point is a placeholder. Maybe I left it there, but looking at it I don't think that it should be default

I think calling --no-default-features with every build command disables this anyway. I'll remove the entire line.

…h-stamp PR brainstorm#61

jubeormk1

Hi!

It was fun reviewing this. Thanks for considering my comments and well done in general

brainstorm and others added 30 commits June 1, 2025 16:12

Add SSH config storage support

4e769ad

Update references to sunset config system(s)

c01b70d

[ci skip] Continue adapting config/storage/flashstorage interfaces fr…

dd07731

…om sunset for ssh-stamp...

[ci skip] Stubborn 'unresolved import' for SSHEncode/SSHDecode traits…

359dede

…/proc_macros...

[ci skip] Same SSHDecode/SSHEncode 'unresolved import' issue /cc @mkj

717bed1

[ci skip] Apply @mkj's fix for sshwire derive, compiles now, thx :D

97f5338

[ci skip] Init config/storage from main, will most probably refactor …

d46b3d5

…assumptions around mutexes and rename Fl/FlashCo fig struct names

[ci skip] Pass config through tasks

6bf0573

Merge branch 'main' into fix_passwd_auth

96c910a

[ci skip] AnyPin::steal is unsafe(), need to find a way to safely rec…

8077954

…onfigure the UART's pins at runtime (possible?) and also pass the config object around (safely/mutex-ing) too

[ci skip] Switch to multi-thread (feature flag) in sunset-async to ge…

c981001

…t a CriticalSectionRawMutex for the SSHConfig. Next up: figure out non-unsafe() ways to steal() pins for the UART pins

[ci skip] Experiment with suggestions given on esp-rs/esp-hal matrix …

e8b7cbe

…channel, needs more work/thought... also PeripheralRef is not present in 1.0.0-beta.1

[ci skip] This should be simpler, too much mutex/static cell/etc...

7f98af9

Use SunsetMutex() for the UART reconfiguration scheme.

30e2fe7

Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Change default SSID string (instead of using server id string)

d416aea

When updating espflash to 4.x, esp_bootloader_esp_idf::esp_app_desc()…

517eed8

… call is now required. The partition checking/handling functionalities might be relevant to @jubeormk1 too, btw

Disable custom partitions for now and SunsetMutex seems to interfere …

ff30894

…with the UART operation, need to debug further

Merge branch 'main' into fix_passwd_auth

90b4321

Fix mutex issues with uart_task and draft PinConfig struct/impl for R…

0d6ee1a

…X/TX/CTS/RTS... etc.. pin assignment and at-runtime validation et al Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Merge branch 'fix_passwd_auth' of github.com:brainstorm/esp_hosted_ss…

0419520

…h into fix_passwd_auth

Complex types such as Mutex<CriticalSectionRawMutex> complicate the s…

a0bebbd

…erialization/deserialization "on the wire" of SSHConfig, unfortunately /cc @mmalenic

Cargo.lock

24c009e

[ci skip] Working through PinConfig types issues, small cleanup

7f9f399

Serializable type on Pinconfig.

6be7ce2

Introduced custom Errors Introduced env vars and started refactoring accordingly. Config and peripherals are borrow checker challenges. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

[ci skip] Testing/refactoring idea proposed in brainstorm#44 (comment).…

6630c64

….. PinConfig no longer needs a new() method but OTOH resolve_pin() requires a bit more rework (or remove it altogether?)

[ci skip] Big mess, ignore macro-heavy experiment :-S

c35a3c6

Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Adding channels and realising that unsafe is almost surely needed for…

becd503

… PinConfig::new()... Also channel cannot send at the end of uart_task() because there's an infinite loop right before. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Get rid of unsafe via .degrade and Option<> (thx @bugadani for the tip!)

bb7cdfa

Use channels to send individual pins around... probably we should refactor to Signal instead since message size N=1. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Cleanup before considering Signals (instead of channels) and how to p…

7e6ec0e

…ass SSH's env events

Attempt to use automatic Send/Receive PinChannel struct... issue with…

9968552

… lifetimes and futures. Co-authored-by: Marko Malenic <mmalenic1@gmail.com>

Autofix added 6 commits February 21, 2026 12:41

Fix ESP32-S2 target compilation. Target will still not run.

0e92030

Restore OTA Packer build to config.toml

f093b7f

Fix clippy lint errors for ESP32-C6.

a0d1789

Update README with default UART pins for all targets.

557b649

Change to stable branch for building OTA packer.

f38b8cf

Autofix requested a review from brainstorm February 21, 2026 02:38

brainstorm changed the title ~~HSM refactor (Issue 25)~~ HSM refactor Feb 21, 2026

brainstorm approved these changes Feb 21, 2026

View reviewed changes

brainstorm added 2 commits February 21, 2026 13:47

Leverage semver to pin HAL versions to only major API changes, CI wil…

d9dfdd1

…l warn us if and when something breaks. Helps with not having to bump minor versions continuously, see https://words.filippo.io/dependabot/ for a gist of the idea

Get rid of hardcoded hostkey, fixes issue brainstorm#21

8fcdafd