core: disable passphrase_always_on_device when turning off passphrase

core/src/storage/device.py

@@ -160,6 +160,8 @@ def load_settings(
     passphrase_always_on_device: bool = None,
     display_rotation: int = None,
 ) -> None:
+    if use_passphrase is False:
+        passphrase_always_on_device = False
     if label is not None:
         common.set(_NAMESPACE, _LABEL, label.encode(), True)  # public
     if use_passphrase is not None:

tests/device_tests/test_msg_applysettings.py

@@ -74,6 +74,40 @@ class TestMsgApplysettings:
 
         assert client.features.passphrase_protection is True
 
+    @pytest.mark.setup_client(passphrase=False)
+    @pytest.mark.skip_t1
+    def test_apply_settings_passphrase_on_device(self, client):
+        # enable passphrase
+        with client:
+            client.set_expected_responses(EXPECTED_RESPONSES_NOPIN)
+            device.apply_settings(client, use_passphrase=True)
+
+        assert client.features.passphrase_protection is True
+
+        # enable force on device
+        with client:
+            client.set_expected_responses(EXPECTED_RESPONSES_NOPIN)
+            device.apply_settings(client, passphrase_always_on_device=True)
+
+        assert client.features.passphrase_protection is True
+        assert client.features.passphrase_always_on_device is True
+
+        # turning off the passphrase should also clear the always_on_device setting
+        with client:
+            client.set_expected_responses(EXPECTED_RESPONSES_NOPIN)
+            device.apply_settings(client, use_passphrase=False)
+
+        assert client.features.passphrase_protection is False
+        assert client.features.passphrase_always_on_device is False
+
+        # and turning it back on does not modify always_on_device
+        with client:
+            client.set_expected_responses(EXPECTED_RESPONSES_NOPIN)
+            device.apply_settings(client, use_passphrase=True)
+
+        assert client.features.passphrase_protection is True
+        assert client.features.passphrase_always_on_device is False
+
     @pytest.mark.skip_t2
     def test_apply_homescreen(self, client):
         img = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00\x00\x00\x00\x04\x80\x00\x00\x00\x00\x00\x00\x00\x00\x04\x88\x02\x00\x00\x00\x02\x91\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x90@\x00\x11@\x00\x00\x00\x00\x00\x00\x08\x00\x10\x92\x12\x04\x00\x00\x05\x12D\x00\x00\x00\x00\x00 \x00\x00\x08\x00Q\x00\x00\x02\xc0\x00\x00\x00\x00\x00\x00\x00\x10\x02 \x01\x04J\x00)$\x00\x00\x00\x00\x80\x00\x00\x00\x00\x08\x10\xa1\x00\x00\x02\x81 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\tP\x00\x00\x00\x00\x00\x00 \x00\x00\xa0\x00\xa0R \x12\x84\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x08\x00\tP\x00\x00\x00\x00 \x00\x04 \x00\x80\x02\x00@\x02T\xc2 \x00\x00\x00\x00\x00\x00\x00\x10@\x00)\t@\n\xa0\x80\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x80@\x14\xa9H\x04\x00\x00\x88@\x00\x00\x00\x00\x00\x02\x02$\x00\x15B@\x00\nP\x00\x00\x00\x00\x00\x80\x00\x00\x91\x01UP\x00\x00 \x02\x00\x00\x00\x00\x00\x00\x02\x08@ Z\xa5 \x00\x00\x80\x00\x00\x00\x00\x00\x00\x08\xa1%\x14*\xa0\x00\x00\x02\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00@\xaa\x91 \x00\x05E\x80\x00\x00\x00\x00\x00\x02*T\x05-D\x00\x00\x05 @\x00\x00\x00\x00\x00%@\x80\x11V\xa0\x88\x00\x05@\xb0\x00\x00\x00\x00\x00\x818$\x04\xabD \x00\x06\xa1T\x00\x00\x00\x00\x02\x03\xb8\x01R\xd5\x01\x00\x00\x05AP\x00\x00\x00\x00\x08\xadT\x00\x05j\xa4@\x00\x87ah\x00\x00\x00\x00\x02\x8d\xb8\x08\x00.\x01\x00\x00\x02\xa5\xa8\x10\x00\x00\x00*\xc1\xec \n\xaa\x88 \x02@\xf6\xd0\x02\x00\x00\x00\x0bB\xb6\x14@U"\x80\x00\x01{`\x00\x00\x00\x00M\xa3\xf8 \x15*\x00\x00\x00\x10n\xc0\x04\x00\x00\x02\x06\xc2\xa8)\x00\x96\x84\x80\x00\x00\x1b\x00\x00\x80@\x10\x87\xa7\xf0\x84\x10\xaa\x10\x00\x00D\x00\x00\x02 \x00\x8a\x06\xfa\xe0P\n-\x02@\x00\x12\x00\x00\x00\x00\x10@\x83\xdf\xa0\x00\x08\xaa@\x00\x00\x01H\x00\x05H\x04\x12\x01\xf7\x81P\x02T\t\x00\x00\x00 \x00\x00\x84\x10\x00\x00z\x00@)* \x00\x00\x01\n\xa0\x02 \x05\n\x00\x00\x05\x10\x84\xa8\x84\x80\x00\x00@\x14\x00\x92\x10\x80\x00\x04\x11@\tT\x00\x00\x00\x00\n@\x00\x08\x84@$\x00H\x00\x12Q\x02\x00\x00\x00\x00\x90\x02A\x12\xa8\n\xaa\x92\x10\x04\xa8\x10@\x00\x00\x04\x04\x00\x04I\x00\x04\x14H\x80"R\x01\x00\x00\x00!@\x00\x00$\xa0EB\x80\x08\x95hH\x00\x00\x00\x84\x10 \x05Z\x00\x00(\x00\x02\x00\xa1\x01\x00\x00\x04\x00@\x82\x00\xadH*\x92P\x00\xaaP\x00\x00\x00\x00\x11\x02\x01*\xad\x01\x00\x01\x01"\x11D\x08\x00\x00\x10\x80 \x00\x81W\x80J\x94\x04\x08\xa5 !\x00\x00\x00\x02\x00B*\xae\xa1\x00\x80\x10\x01\x08\xa4\x00\x00\x00\x00\x00\x84\x00\t[@"HA\x04E\x00\x84\x00\x00\x00\x10\x00\x01J\xd5\x82\x90\x02\x00!\x02\xa2\x00\x00\x00\x00\x00\x00\x00\x05~\xa0\x00 \x10\n)\x00\x11\x00\x00\x00\x00\x00\x00!U\x80\xa8\x88\x82\x80\x01\x00\x00\x00\x00\x00\x00H@\x11\xaa\xc0\x82\x00 *\n\x00\x00\x00\x00\x00\x00\x00\x00\n\xabb@ \x04\x00! \x84\x00\x00\x00\x00\x02@\xa5\x15A$\x04\x81(\n\x00\x00\x00\x00\x00\x00 \x01\x10\x02\xe0\x91\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x01 \xa9\tQH@\x91 P\x00\x00\x00\x00\x00\x00\x08\x00\x00\xa0T\xa5\x00@\x80\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00\x00\x00\x00\xa2\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00 T\xa0\t\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00@\x02\xa0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x10\x00\x00\x10\x02\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00@\x04\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x08@\x10\x00\x00\x00\x00'

tests/ui_tests/fixtures.json

@@ -9,9 +9,10 @@
 "test_cancel.py::test_cancel_message_via_initialize[message1]": "5a80508a71a9ef64f94762b07636f90e464832f0f4a3102af8fa1a8c69e94586",
 "test_msg_applysettings.py-test_apply_settings": "b698654871541258f97d58ada0f010b2d77b74829791566746cad619d3740a94",
 "test_msg_applysettings.py-test_apply_settings_passphrase": "fb38537b921f8064f7ea6e1a584e70a8be74968a3be6726b7d36cf57de0d7865",
-"test_msg_backup_device.py::test_backup_bip39": "749f543f21fe0005ef43b00e23162cf68522d1460cee5cc77d933324e85b5ded",
+"test_msg_applysettings.py-test_apply_settings_passphrase_on_device": "3e6527e227bdde54f51bc9c417b176d0d87fdb6c40c4761368f50eb201b4beed",
-"test_msg_backup_device.py::test_backup_slip39_advanced": "efb31ae0ed0565d0c044e0aeabe3d32a524e99155d50d6b72100627c68a1d472",
+"test_msg_backup_device.py::test_backup_bip39": "2b63928444b8188eb2241fc03a3b9bc81191cfa9bbf3ef5431894c04ee0ed01f",
-"test_msg_backup_device.py::test_backup_slip39_basic": "ffef65aa4bb5f265644a5df0063542c3f261f815db65914893a690760d0d0b6a",
+"test_msg_backup_device.py::test_backup_slip39_advanced": "31900e0e8ad694ce894eee1ce289b425558c1fcd7bcb6128a19c049af436d35f",
+"test_msg_backup_device.py::test_backup_slip39_basic": "be4d88d882851ce1ddc45165c35952b23121ddca1a811c7fd7c7ef9d31989e8c",
 "test_msg_backup_device.py::test_interrupt_backup_fails": "225b3da1acac6e9a65106fcc4a01de8a44de035aedb4dcc21c09f439199fdf40",
 "test_msg_backup_device.py::test_no_backup_fails": "93039a9472cfc9058563bd56e4a3dbe2e41af64744a61f6ee3255a04bd3a9366",
 "test_msg_backup_device.py::test_no_backup_show_entropy_fails": "14fcdd2ded299ca099a35966cc9f21204b31de8d6bab9ec91cb64537bd70440c",
@@ -37,15 +38,15 @@
 "test_msg_cardano_sign_tx_slip39_basic.py::test_cardano_sign_tx[1097911063-inputs2-outputs2-transacti": "32edff90a2fecf74bf7e3e46794a48924082c069b9d1e57adb531749ac71e4af",
 "test_msg_cardano_sign_tx_slip39_basic.py::test_cardano_sign_tx[764824073-inputs0-outputs0-transactio": "85fb1f1bf90131d6cd04e58b2303bf8d3b9a641b1f418852bc27c4432d427976",
 "test_msg_cardano_sign_tx_slip39_basic.py::test_cardano_sign_tx[764824073-inputs1-outputs1-transactio": "15f55a8fc499364aa239c319100072d16ae5dc1ee9dd0db3cd1795363fde679a",
-"test_msg_change_wipe_code_t2.py::test_set_pin_to_wipe_code": "140d6e384534174c1a52fa720b2f996dcdb361cc65d84797f9671ad4cecf02a7",
+"test_msg_change_wipe_code_t2.py::test_set_pin_to_wipe_code": "85e21add9954b5337d904ce4be7081f89a20bcfce29bf8e9d9a97ffcf5f49329",
-"test_msg_change_wipe_code_t2.py::test_set_remove_wipe_code": "f9c56d1ed0115710cefa5314aa4ad01c7411bb84ad8f8e98a7443b4671873226",
+"test_msg_change_wipe_code_t2.py::test_set_remove_wipe_code": "8e416c0701362edd8cc6c4c8aec431bb57194e6428d8a56a5971c6fe0bf15535",
-"test_msg_change_wipe_code_t2.py::test_set_wipe_code_mismatch": "2d2eacb3bab1e5309d0f8b2beb054fd7785d0003aa320f38cf436b3aedbe6fb8",
+"test_msg_change_wipe_code_t2.py::test_set_wipe_code_mismatch": "e8568ac366ab049eefb9e1432d715e87e70caf221c09f8218b84457135534ffd",
-"test_msg_change_wipe_code_t2.py::test_set_wipe_code_to_pin": "1cc2877a4e4094ef1a0a4179fb112bdc60486cdd267e1b72ce40883db97d1e47",
+"test_msg_change_wipe_code_t2.py::test_set_wipe_code_to_pin": "fae7e054fe144430194a4e397fff10248502f45a262126b74861a6355ee1b51d",
-"test_msg_changepin_t2.py::test_change_failed": "bf6e8b1755a81ae2084f9b04a6f610b41d754cba81022a13cf2b7eb15b55c9fc",
+"test_msg_changepin_t2.py::test_change_failed": "40f80fefd6e4efe64cf8b14ba2a1a874ddd4f31ab65d7bd61dffa97d86f0f91a",
-"test_msg_changepin_t2.py::test_change_pin": "045f39cd2ad20558fbeee44247d92681865498b425df7d2f7baf9afc1e36085d",
+"test_msg_changepin_t2.py::test_change_pin": "6443da0118554742cab25d6922d8b0d7823c19e38e75b7dce2e1732051f4c409",
-"test_msg_changepin_t2.py::test_remove_pin": "ae73fc8cbf11ff8b67543972170eb633b23b99c5c352d67b936a36b97b167651",
+"test_msg_changepin_t2.py::test_remove_pin": "a2ee854a1cd8d90cc0ca675762a7f95fcffddef9e38c91c314335a8a9c98ef71",
-"test_msg_changepin_t2.py::test_set_failed": "7462bd9aa640743efe71d74608b5e20232c723af3340c8c1296f7657e7688c40",
+"test_msg_changepin_t2.py::test_set_failed": "1a2d5cfe59d2f19a3cf55216339de0577c4d087470b245b74cd1fe2c2808f84c",
-"test_msg_changepin_t2.py::test_set_pin": "783ba04900ad3b78e30af3d3af1e5f807cdb9b09f40312aa2301e7d73043dffc",
+"test_msg_changepin_t2.py::test_set_pin": "2d58362050595b2445e569cabcd909e956ffe6c4390610d882e21b14c4974af5",
 "test_msg_cipherkeyvalue.py-test_decrypt": "166d85b1bf11aeaeb5b93ef5d047b6f8910c28b8fce1d853e6912d89d7bfca2f",
 "test_msg_cipherkeyvalue.py-test_decrypt_badlen": "5a80508a71a9ef64f94762b07636f90e464832f0f4a3102af8fa1a8c69e94586",
 "test_msg_cipherkeyvalue.py-test_encrypt": "3a37e4004c87bc6df6a8fa7c93b6fe3e3524986914709fda2f9c99ba0ff69775",
@@ -378,15 +379,15 @@
 "test_passphrase_slip39_advanced.py::test_256bit_passphrase": "69b6b8b22c819e1282d7d2c14b31bf8d015c81ac05fe034540dbb11c8a20dbdb",
 "test_passphrase_slip39_basic.py::test_2of5_passphrase": "1e00b1a7840bc144b98b7bce26f74fc913a0abf9d1c500571d7803b6b2e0943c",
 "test_passphrase_slip39_basic.py::test_3of6_passphrase": "1e00b1a7840bc144b98b7bce26f74fc913a0abf9d1c500571d7803b6b2e0943c",
-"test_reset_backup.py::test_skip_backup_manual[0-backup_flow_bip39]": "1002b2e5c75fcd7dc8d421283e2eccb5b747a4014af274ad335b3cff7d27db9d",
+"test_reset_backup.py::test_skip_backup_manual[0-backup_flow_bip39]": "80a614b20d172be640c28cdcee6ba7fc7dadd5329fa08e1ec8f6a55a80ceb2f9",
-"test_reset_backup.py::test_skip_backup_manual[1-backup_flow_slip39_basic]": "c37acfae2609b03bd84f9eb53b0642c73b16cf78300271fc94a6d9a311b144b9",
+"test_reset_backup.py::test_skip_backup_manual[1-backup_flow_slip39_basic]": "7695c4ffca95c263baa82ae17ce6faf9335bd07c6964beb900a75b61a515c245",
-"test_reset_backup.py::test_skip_backup_manual[2-backup_flow_slip39_advanced]": "26d8bbbdc25f3105f60fd2367fbb765e41ebd42b8545c42fd9398b62233ec363",
+"test_reset_backup.py::test_skip_backup_manual[2-backup_flow_slip39_advanced]": "e0a4139cfc344909deb2b6b2398d223ce4ddf0cdb2d9975d03454537d9be2152",
-"test_reset_backup.py::test_skip_backup_msg[0-backup_flow_bip39]": "6e26d95a67a27f5bb0fc2bb5eaaca01bce3a30e20391ccb5208179edb768b52e",
+"test_reset_backup.py::test_skip_backup_msg[0-backup_flow_bip39]": "30a8d39c13b89aa0bf2820bf780b8962829c9d8cd70b8c95fc98b6ef7b3ead9c",
-"test_reset_backup.py::test_skip_backup_msg[1-backup_flow_slip39_basic]": "bea2ebcb056e300f5b8f731af8ee284bf38d3cc725b79d0772fd85f7b09d32bd",
+"test_reset_backup.py::test_skip_backup_msg[1-backup_flow_slip39_basic]": "e08feca49017cbe4a2ff22b7255fb9f8db659c79709affcf2954f2ade6924a57",
-"test_reset_backup.py::test_skip_backup_msg[2-backup_flow_slip39_advanced]": "fd2001fe6960aa7c527266a4030a93bb189435703033cba7337a77c534b87e89",
+"test_reset_backup.py::test_skip_backup_msg[2-backup_flow_slip39_advanced]": "b980c758e8c0aacf6cbb047a9f1acaf3a1d1f3ab84a01ee9e52e5c466caf344c",
 "test_sdcard.py::test_sd_format": "6bb7486932a5d38cdbb9b1368ee92aca3fad384115c744feadfade80c1605dd8",
 "test_sdcard.py::test_sd_no_format": "f47e897caee95cf98c1b4506732825f853c4b8afcdc2713e38e3b4055973c9ac",
-"test_sdcard.py::test_sd_protect_unlock": "621294fce5df0a5f381450647b3a45d71696cca0c46bec368a0fea675709956d",
+"test_sdcard.py::test_sd_protect_unlock": "d3e288eb1aabb712f0f850ea68497a3ded00340ff4b39471aa8cb8f84bde0b33",
 "test_u2f_counter.py::test_u2f_counter": "7d96a4d262b9d8a2c1158ac1e5f0f7b2c3ed5f2ba9d6235a014320313f9488fe",
 "test_zerosig.py-test_one_zero_signature": "4099761c664ac57e9506abeb6a52cf898297c0dd592e2a394d008c5db7e62356",
 "test_zerosig.py-test_two_zero_signature": "46e0f1749af632a75a6c6ccc2deb4591a925428db000c52008ecb940ec673a6f"