Harden SSH Admission And Credential Input

tests/hidden_input/run.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Actual UART/shared remote prompt readers with deterministic host IO/RTOS fakes."""
+from pathlib import Path
+import os
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[2]
+IDF = Path(os.environ.get("IDF_PATH", str(Path.home() / ".platformio/packages/framework-espidf")))
+
+def stripped(name):
+    return "\n".join(line for line in (ROOT / name).read_text().splitlines()
+                     if not line.startswith(("#include", "#pragma once"))) + "\n"
+
+user = (ROOT / "src/user_console.c").read_text()
+password = user[user.index("static esp_err_t read_password("):user.index("static void show_generated_password(")]
+unit = ((ROOT / "tests/admin_console_boundary/fakes.h").read_text()
+        + stripped("src/admin_ssh_console.h") + stripped("src/admin_ssh_console.c")
+        + (ROOT / "tests/hidden_input/uart_fakes.h").read_text()
+        + stripped("src/console_input.c")
+        + "\n#undef printf\n#undef putchar\n#undef fflush\n"
+        + "#define USER_DATABASE_PASSWORD_CAPACITY 64U\n"
+        + "#define USER_DATABASE_PASSWORD_MIN_LENGTH 12U\n"
+        + "#define ESP_ERR_INVALID_RESPONSE 100\n" + password
+        + (ROOT / "tests/hidden_input/test.c").read_text())
+with tempfile.TemporaryDirectory(prefix="hidden-input-") as directory:
+    path = Path(directory)
+    (path / "test.c").write_text(unit)
+    subprocess.run(["cc", "-std=c11", "-Wall", "-Wextra", "-Werror", "-g",
+                    str(path / "test.c"), str(IDF / "components/console/split_argv.c"),
+                    "-o", str(path / "test")], check=True, timeout=30)
+    subprocess.run([str(path / "test")], check=True, timeout=10)