<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Full ack.<br>
<br>
Metrics contain even more sensitive information like the GPS
position of the car.<br>
<br>
Is there a reason to a) keep "echo" open and b) not move it into the
"test" framework?<br>
<br>
The "help" command in its current form has a very precise view of
itself :)<br>
<br>
How about something like this:<br>
<br>
<tt>Enter a single "?" to get the root command list.<br>
Commands can have multiple levels of subcommands.</tt><tt><br>
</tt><tt>Use "command […] ?" to get the list of subcommands and
parameters.</tt><tt><br>
</tt><tt>Commands can be abbreviated, push <TAB> for auto
completion at any level.<br>
</tt><tt>Use "enable" to enter secure (admin) mode.<br>
</tt><br>
<br>
Regards,<br>
Michael<br>
<br>
<br>
<div class="moz-cite-prefix">Am 18.03.2018 um 09:43 schrieb Mark
Webb-Johnson:<br>
</div>
<blockquote type="cite"
cite="mid:5DA5F658-64D0-4CB1-A92F-14455B7D4A35@webb-johnson.net">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
Steve,
<div class=""><br class="">
</div>
<div class="">Thanks for this. Very helpful at this critical
stage.</div>
<div class=""><br class="">
</div>
<div class="">In general, I think your criteria is correct:</div>
<div class=""><br class="">
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding:
0px;" class="">
<div class="">
<blockquote type="cite" class="">My assumption going in is
that all someone should be able to do before<br class="">
enabling is to look at status that does not include
sensitive info.</blockquote>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">When not in secure mode, only very basic stuff
should be usable. So, boot, enable, echo, exit, help, etc, are
all ok. The ‘time status’ is fine, but no ‘time set’. etc.</div>
<div class=""><br class="">
</div>
<div class="">The others should not be visible, imho. Metrics,
Module, obdii; all should be secure mode only.</div>
<div class=""><br class="">
</div>
<div class="">To answer your specific questions:</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">1. obdii, server and simcom
appear to allow their full functionality,<br class="">
including starting and stopping operations, in non-secure
mode. That<br class="">
seems wrong.<br class="">
</blockquote>
<div class=""><br class="">
</div>
<div class="">The “simcom status”, “server v2 status”, “server
v3 status” are fine, but the others should be secure only.</div>
<div class=""><br class="">
</div>
<blockquote type="cite" class="">2. event, metrics and notify
all allow tracing to be turned on or<br class="">
off. Is that safe?<br class="">
</blockquote>
<div class=""><br class="">
</div>
I think these should be secure only.</div>
<div class=""><br class="">
</div>
<div class="">Metrics should probably be secure only as there is
some private information shown there (such as ICCID, etc).</div>
<div class=""><br class="">
<blockquote type="cite" class="">3. time allows setting the time
in non-secure mode. That may not be<br class="">
critical in this system, but could mess up timed activities.<br
class="">
</blockquote>
<div class=""><br class="">
</div>
<div class="">The “time status” is fine, but “time set” is
secure mode only.</div>
<br class="">
<blockquote type="cite" class="">4. Setting the vehicle module
should require being enabled, no?<br class="">
</blockquote>
<div class=""><br class="">
</div>
Yes. Secure mode only.</div>
<div class=""><br class="">
<blockquote type="cite" class="">5. Is it OK to list the metrics
in non-secure mode? Is any of that<br class="">
information sensitive enough that it should be prevented? (We
don't<br class="">
have the option to show some metrics and not others at this
point.)<br class="">
</blockquote>
<div class=""><br class="">
</div>
No. Better not. Secure mode only.</div>
<div class=""><br class="">
<blockquote type="cite" class="">6. The module command only
allowed the subcommand 'factory' which did<br class="">
not allow any subcommand, so the right fix there is to just
make the<br class="">
whole command require secure mode. This observation exposed a
bug in<br class="">
the code to construct the usage string, which I fixed.</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">Yes. Secure mode for the whole thing.</div>
<div class=""><br class="">
</div>
<div class="">Regards, Mark</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 18 Mar 2018, at 3:23 PM, Stephen Casner
<<a href="mailto:casner@acm.org" class=""
moz-do-not-send="true">casner@acm.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Mark asked me to check whether the 'secure'
flag is set appropriately<br class="">
in the various command invocation contexts. I began
with the console<br class="">
command list where there are a number of questionable
settings. My<br class="">
assumption going in is that all someone should be able
to do before<br class="">
enabling is to look at status that does not include
sensitive info.<br class="">
However, there are several commands that do more.<br
class="">
<br class="">
All of these commands are at least partially enabled in
non-secure<br class="">
mode:<br class="">
<br class="">
OVMS > ?<br class="">
boot BOOT framework<br class="">
echo Test getchar<br class="">
enable Enter secure mode<br class="">
event EVENT framework<br class="">
exit End console session<br class="">
help Ask for help<br class="">
metrics METRICS framework<br class="">
module MODULE framework<br class="">
network NETWORK framework<br class="">
notify NOTIFICATION framework<br class="">
obdii OBDII framework<br class="">
server OVMS Server Connection framework<br
class="">
simcom SIMCOM framework<br class="">
time TIME framework<br class="">
vehicle Vehicle framework<br class="">
<br class="">
The harmless ones are 'boot', which just shows status,
'echo', 'exit'<br class="">
and 'help'. Of course, 'enable' needs to be here to
change state.<br class="">
But I have questions about all the others:<br class="">
<br class="">
1. obdii, server and simcom appear to allow their full
functionality,<br class="">
including starting and stopping operations, in
non-secure mode. That<br class="">
seems wrong.<br class="">
<br class="">
2. event, metrics and notify all allow tracing to be
turned on or<br class="">
off. Is that safe?<br class="">
<br class="">
3. time allows setting the time in non-secure mode.
That may not be<br class="">
critical in this system, but could mess up timed
activities.<br class="">
<br class="">
4. Setting the vehicle module should require being
enabled, no?<br class="">
<br class="">
5. Is it OK to list the metrics in non-secure mode? Is
any of that<br class="">
information sensitive enough that it should be
prevented? (We don't<br class="">
have the option to show some metrics and not others at
this point.)<br class="">
<br class="">
6. The module command only allowed the subcommand
'factory' which did<br class="">
not allow any subcommand, so the right fix there is to
just make the<br class="">
whole command require secure mode. This observation
exposed a bug in<br class="">
the code to construct the usage string, which I fixed.<br
class="">
<br class="">
So, basically, the question is what do we want someone
to be able to<br class="">
do in non-secure mode?<br class="">
<br class="">
-- Steve<br
class="">
_______________________________________________<br
class="">
OvmsDev mailing list<br class="">
<a href="mailto:OvmsDev@lists.teslaclub.hk" class=""
moz-do-not-send="true">OvmsDev@lists.teslaclub.hk</a><br
class="">
<a class="moz-txt-link-freetext" href="http://lists.teslaclub.hk/mailman/listinfo/ovmsdev">http://lists.teslaclub.hk/mailman/listinfo/ovmsdev</a><br
class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.teslaclub.hk">OvmsDev@lists.teslaclub.hk</a>
<a class="moz-txt-link-freetext" href="http://lists.teslaclub.hk/mailman/listinfo/ovmsdev">http://lists.teslaclub.hk/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="160">--
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26
</pre>
</body>
</html>