SMM password change #64

User story

As a machine builder securing a SOMANET Safe Motion drive,
I want to change the SMM password from Motion Master,
so that only people who know the new password can change the drive's safety configuration.

Context

Action 7 of OS command 11 changes the SMM password (#59). It needs an active login, and it takes 48 bytes in fs-buffer: two 24-byte fields. The drive passes the buffer to the SMM unchanged (somanet_software sc_certified/module_smm/src/acyclic_communication.c:38, :237).

The two sources disagree on the second field. The OS command document, a confidential internal draft, describes it as the new password followed by a confirmation of the new password (page 49). oblac sends the new password followed by the old password (oblac libs/motion-master-client/src/lib/smm.ts:259-268). The firmware does not decide, because the SMM checks the payload. oblac's version is the one in use.

oblac then restarts the SMM with action 15. It does not check the result of action 7 before the restart, so a refused change still restarts the SMM and reports success (motion-master-req-res-client.ts:5395-5418). Its documentation says a new password must be at least 4 characters. OBLAC Drives checks only that both fields are given and at most 24 characters (oblac-drives/src/app/shared/smm-change-password-modal/smm-change-password-modal.component.ts:26-35).

Acceptance criteria

• An smm-change-password procedure takes username, oldPassword and newPassword. It logs in with the old password, sends action 7, and restarts the SMM with action 15 only when action 7 succeeded.
• A refused action 7 fails the procedure with the SMM's refusal and does not restart the SMM.
• A new password longer than 24 bytes in UTF-8, or shorter than 4 characters, is refused with 400 before any OS command.
• The payload layout is the one the bench test below confirms.
• The procedure logs out on every exit path before the restart.
• Neither password is logged, stored, or returned in the procedure snapshot.
• The step list separates login, change and restart.
• The Safety page of SMM parameters and readouts #60 has a Change password form with the old password, the new password typed twice, and the rules above.
• Hardware-verified on a Circulo Safe Motion drive: the oblac payload, new then old, and the document's payload, new then new. The test records which one the SMM accepts in NEXTGEN.md, and the procedure sends that one. The test also checks that a login with the new password works after the restart.

Out of scope

• Resetting a forgotten password.

Notes

• This issue depends on SMM OS command 11 and login #59 and SMM safety status, acknowledge and restart #63, for the restart.

References

• oblac: libs/motion-master-client/src/lib/smm.ts:259-268, motion-master-req-res-client.ts:5395-5418
• OBLAC Drives: src/app/shared/smm-change-password-modal/
• SMM OS command 11 and login: SMM OS command 11 and login #59
• SMM safety status, acknowledge and restart: SMM safety status, acknowledge and restart #63