103 Commits

Include renames

Author	SHA1	Message	Date
James Rich	20284840a8	Report the ack proof verdict to the client (#11965) ... * Report the ack proof verdict to the client * Test that a proven ack reaches the phone as VALID * Say why the verdict clear and the pending gate sit where they do	2026-09-25 13:33:58 +00:00
Jonathan BennettandClaude Opus 5	57bdedf324	Bind the ack proof to the node we addressed, not the ack's sender (#11932) ... * Bind the ack proof to the node we addressed, not the ack's sender The MAC proves only that its author holds a pairwise key with us, and every keyed peer holds one. ackProofVerify looks the key up by getFrom(p) - the ack's claimed sender - and nothing compared that against the node we actually sent to, so C, whose authoritative key we hold, could read our packet id out of the cleartext header and mint a receipt for a packet that went to B. It verified VALID. "An authenticated delivery receipt from the actual recipient" was not what the code delivered. Guard on orig->packet->to before verifying. Since that establishes getFrom(p) == orig->packet->to, the existing key lookup is then correct and AckProof.cpp is untouched. Bailing out rather than verifying against the recipient key and reporting INVALID is deliberate twice over: it skips the X25519 an attacker would otherwise choose when we pay, and a third-party ack is "not a receipt" rather than "a forged receipt" - naks from intermediates (NO_CHANNEL, PKI_UNKNOWN_PUBKEY, MAX_RETRANSMIT) legitimately come from a node that is not the destination and must not be logged as proof mismatches. A broadcast original has no single recipient, so there is nothing to bind to. Also correct the header doc. It claimed channel (non-PKI) traffic gets nothing from this, but isProvableAck tests only the ack's shape: a DM that travelled under channel encryption still gets a proven ack when we hold the peer's key, because the secret comes from X25519 rather than from the channel. That is more coverage than the receipt needs and it costs one X25519 per ack generated - both worth stating rather than implying the opposite. test_proof_from_third_peer_fails_under_recipient_key pins the property the guard relies on: Carol's proof for a packet Alice sent to Bob verifies under Carol's key and fails under Bob's. The guard itself is not directly assertable while every branch of the verdict switch returns true. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012hLcVif8GDEmA2k77hmFG8 * Make the sender check honor ACK_PROOF_ENFORCE The mismatch branch returned true unconditionally. Today every branch of this function returns true, so that reads as equivalent - but if enforcement is ever switched on it is a hole rather than a no-op. The sender field is not authenticated, so an attacker would simply address the ack from anyone other than the node we sent to, take the early return, and skip the proof requirement entirely. Hold only success acks to it. A nak legitimately arrives from an intermediate rather than from the destination - NO_CHANNEL, PKI_UNKNOWN_PUBKEY and MAX_RETRANSMIT all do - so naks keep today's behavior in either mode. Broadcast gets its own unconditional return rather than sharing the condition. orig->packet->to is NODENUM_BROADCAST there and can never equal any sender, so folding it into the sender check would, under enforcement, stop every reliable broadcast from ever being acked. This does not make enforcement sound on its own and the comment says so: ABSENT still permits, so spoofing the sender and omitting the proof gets through regardless, and ABSENT cannot be made to block for the reasons recorded at ACK_PROOF_ENFORCE. The narrower point is that a flag named "enforce" should not have a branch that silently ignores it. Raised by CodeRabbit on #11932. Its reading - that this is a live authorization bypass a third party can use to suppress retransmissions - does not hold: the sender field is unauthenticated either way, and perhapsGenerateImplicitAckForOwn Overheard already clears a pending retransmission on a replayed copy of our own ciphertext, with no ack and no key involved. The structural point stands on its own merits. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012hLcVif8GDEmA2k77hmFG8 * Avoid cppcheck's duplicateValueTernary in the enforce check `return isAck ? !ACK_PROOF_ENFORCE : true` has the same value in both arms while the flag is off, which is the whole point of the line - and is exactly what cppcheck reports: style: Same value in both branches of ternary operator. [duplicateValueTernary] That failed the `check` matrix on every platform. Write it as an if, which expresses the same thing and does not trip the rule, and say so in a comment so it does not get folded back into a ternary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012hLcVif8GDEmA2k77hmFG8 --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-09-24 07:15:54 +00:00
Jonathan BennettandClaude Opus 5	6f3f0bd7c2	Prove explicit acks with Routing.ack_proof (#11877) ... * Prove explicit acks with Routing.ack_proof Explicit acks are ROUTING_APP packets, and ROUTING_APP is excluded from PKC, so an ack travels under channel encryption alone - and the default channel key is public. Anyone in range can forge one, and the client grants its strongest delivery claim on the strength of the ack's unauthenticated `from`. Where the acknowledged packet was PKI encrypted the endpoints already share a Curve25519 secret, so the recipient can prove receipt in ~10 encoded bytes: ack_proof = HMAC-SHA256(shared_key, "ack" | LE32(from) | LE32(to) | LE32(request_id) | routing)[0..8) where `routing` is the encoded Routing message without the ack_proof field, taken as received with that byte range removed rather than re-encoded. Excising keeps the value a function of the received bytes alone, so it does not depend on two implementations' encoders agreeing and does not drop fields this build has never heard of. For the same reason the sender appends the field rather than setting it on a decoded struct and re-encoding. What this does and does not buy. It buys an authenticated delivery receipt from the actual recipient, which is the property a forged ack costs a user and which matters where people act on a delivery confirmation. It does NOT protect the retransmission loop, and must not be described as if it does: perhapsGenerateImplicitAckForOwnOverheard clears a pending retransmission on any overheard rebroadcast of our own (from, id), header-only and keyless, so replaying the originator's own ciphertext stops their retries more cheaply than forging an ack. No ack authentication of any kind closes that path. Advisory only, and deliberately not a step toward enforcement. A rule requiring a proof once a peer has sent one would make a missing proof destroy the only delivery signal we have, on state the user cannot see: the proof needs the peer to hold our key, and peer-side eviction, a downgrade or a factory reset are all invisible to us. A valid proof marks the ack verified; anything else behaves exactly as today. The client renders the difference. Verification costs one X25519 and nothing caches the shared secret, so ackProofPermitsAction gates on findPendingPacket first - otherwise a forged ack naming any packet id, which is visible in the cleartext header, would force a DH. Depends on meshtastic/protobufs#1094 for the generated field. * test: correct a comment that predates ack_proof being generated The wire-roundtrip test described ack_proof as an unknown field, which was true while the prototype hand-encoded it. The field is generated now, so this build understands it - but older firmware does not, which is the case the assertion actually covers. * Fix the EXCLUDE_PKI test build, and format Two copies of test_proof_binds_error_reason and test_proof_binds_direction were sitting in the #else branch of test_ack_proof, where Identity, makeIdentity, makeAck, becomeNode, crypto and ACK_PROOF_SIZE do not exist. They were also unregistered, so they were dead code that only served to break the build. The native suite never compiles that branch, so a local run could not see it. Also apply clang-format to a declaration that had been wrapped by hand. * Exempt test_ack_proof from trufflehog's Lob false positive Same detector and same shape as the three suites already listed here: it stitches nearby hex literals into one candidate string, and this suite's node numbers and request ids (0x0A0A0A0A, 0x0B0B0B0B, 0xABCD1234) happen to match a Lob API key. The suite holds no literal key material - every key it uses comes from crypto->generateKeyPair at runtime. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012hLcVif8GDEmA2k77hmFG8 --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-09-17 22:24:29 +00:00
5 people	ee15508494	time: arm the remaining 0-means-unset stamps through the helpers (#11830) ... * time: add skipZero/safeMillis/timerEndsAtMillis helpers skipZero() steps a millis value past 0, since stored stamps and deadlines conventionally use 0 for "unset" and the one tick per ~49.7-day wrap that lands on 0 would otherwise read as never-set. safeMillis() covers a bare stamp; timerEndsAtMillis(delayMs) covers a deadline, where the sum is what has to dodge 0 - a non-zero read plus a delay lands there once per wrap - so it is not safeMillis() + delayMs. * time: replace hand-rolled zero-dodging with the UptimeClock helpers PacketHistory rxTimeMsec, EncryptedStorage s_lastFailMillis (stamps), and SGM41562 lastRefreshMs_ / NextHopRouter learnedAtMsec (ternary stamps) each hand-rolled skipZero() in place; swap in safeMillis()/skipZero() directly. HapticFeedback pulseOffAt/delayedPulseAt and GPS fixHoldEnds hand-rolled the deadline form - millis() + delay, then remap a 0 result to 1 - swap in timerEndsAtMillis(delay). No behavior change; each site keeps the value it already computed. * time: guard the remaining 0-means-unset deadline/stamp writes rebootAtMsec, shutdownAtMsec, and NotificationRenderer::alertBannerUntil are all read back with a bare == 0 / != 0 check for 'not scheduled', but every write site computed millis() + delay (or a bare millis() stamp) with no guard against landing exactly on 0 - the same wrap hazard skipZero() exists for, just never applied here. Route every rebootAtMsec/shutdownAtMsec/alertBannerUntil write through timerEndsAtMillis()/safeMillis(); RadioLibInterface's reboot-on-stuck-tx sums an already-captured stamp rather than "now", so it goes through skipZero() directly instead. No behavior change outside the ~1-in-2^32 wrap window each site was already exposed to. * time: guard three more 0-means-unset deadline writes ntp_renew (ethClient.cpp), suppressTouchTapUntilMs (Events.cpp), and tx_after (RadioLibInterface.cpp) all read back 0 as a real state - forced NTP renewal, no suppress window active, no TX delay armed, respectively - but each arm site wrote a bare millis()/getMillis() + delay with no guard against the sum landing exactly on 0. Route each through Time::timerEndsAtMillis(). No behavior change outside the wrap window each site was already exposed to. Refresh the Throttle.h TODO list to note ntp_renew is converted too. * motion: guard the calibration deadline and use Throttle::deadlinePassed endCalibrationAt's arm site wrote millis() + calibrateFor with no guard against landing on 0, the same value finishCalibrationIfExpired()/ drawFrameCalibration() treat as "not calibrating". Route it through Time::timerEndsAtMillis(). Also swap finishCalibrationIfExpired()'s hand-rolled (int32_t)(now - deadline) < 0 for Throttle::deadlinePassed(): same wrap-safe comparison the codebase already provides, without the signed-cast pattern Throttle.h documents as implementation-defined past INT32_MAX, and it drops the file's last direct millis() call in favor of the Time:: wrapper the rest of it already uses. * time: fix Throttle::execute()'s own zero-dodging Both places execute() writes *lastExecutionMs - the first-ever-run branch and the regular update - used bare Time::getMillis() with no guard against landing on 0, which is the exact sentinel this function reads back as "never run" one line above. A hit there makes the next call re-fire immediately instead of respecting minumumIntervalMs. Capture now via Time::safeMillis() once; every use downstream (the elapsed comparison, the stored value) is then safe by construction instead of needing the guard reapplied at each write. * revert some safeMillis cases where overflow is a bad thing * test(uptime): pin skipZero/safeMillis/timerEndsAtMillis at the wrap boundary Covers the zero case, an ordinary nonzero value, and a sum that lands exactly on 0 from a nonzero start - the case timerEndsAtMillis() exists for, and the one the prior suite had no direct coverage of. * time: restore the route-health write normalization and put it on one clock noteRouteLearned()/noteRouteSuccess() lost their `now ? now : 1` normalization, leaving learnedAtMsec able to store 0 - which getOrAllocRouteHealth() reads as an ever-growing age, making the slot the first eviction candidate and permanently stale. Normalize at the write, where the block comment already says it happens, so every caller is covered rather than just today's two. Both callers, the two isRouteStale() sites and doRetransmissions() now read Time::getMillis(), so the stamp and every comparison against it share a clock. doRetransmissions() goes back to getMillis(): its `now` feeds only comparisons, never a 0-sentinel field, so skipping zero there only cost accuracy. * time: read the haptic, InkHUD and calibration deadlines on the write's clock These three deadlines were converted to Time::timerEndsAtMillis() on the write side while their reads stayed on millis(), so each spanned two clocks and would fire immediately or never under an injected test clock. Convert the reads to match: HapticFeedback::scheduleNext()/runOnce(), the InkHUD tap-suppression window, and the calibration countdown's read-back of screen->getEndCalibration(). MotionSensor's sampledAtMs is left alone - its write and read are both millis() and consistent already. * time: correct the sentinel notes to match what the code actually does The Throttle.h enumeration claimed the remaining timerEndsAtMillis() callers "already dodge the sentinel", which reads as a completeness claim the same branch contradicts: RadioLibInterface's tx_after and activeReceiveStart are both 0=unarmed and both still arm from bare millis(). Name them instead, so the deadline-type conversion has the real list. The ntp_renew entry now separates a deliberate 0 ("due now", forced at link-up) from a computed one, which is what changed there. The three TODO(elapsed-stamp) blocks ran four and five lines against the repo's one-or-two rule, and two of them argued their case wrongly. Throttle.cpp implied safeMillis() simply doesn't help; in fact neither store is safe on the wrap tick - the 1 underflows a same-instant read, the 0 re-takes the never-run branch - which is the symmetry worth recording. PacketHistory.cpp called its dodge "reflecting the previous pattern" when it is load-bearing: rxTimeMsec 0 means "empty slot" (PacketHistory.h:21) and insert() drops a record stamped 0 outright, so without it a packet arriving on the wrap tick is never stored and loses its dedup. Also picks up trunk fmt's trailing-whitespace fix in Throttle.cpp and the comment realignment in SGM41562.cpp that this branch's added comment knocked out. * test(nexthop): pin the route-health stamp against the 0 sentinel The uptime suite covers skipZero/safeMillis/timerEndsAtMillis themselves, but nothing covered a call site, so the branch deleted noteRouteLearned()'s normalization and stayed green. None of the existing route-health tests pass 0 as `now` - they use 1000, learnAt, or millis() - (TTL + 5000) - which is exactly the gap the regression went through. Both new tests fail with "Expected 0 to be not equal to 0" when the skipZero() is backed out of NextHopRouter, and pass with it. noteRouteSuccess() only refreshes an existing record, so its twin learns a route first to reach the write. Also drops a self-referential assertion in the uptime suite: comparing getMillis() against safeMillis() passes even if safeMillis() does no dodge at all, so it now asserts the literal. * discard safemillis for skipzero (better semantics and therefore maintainability) and make consistent use of getmillis where it is called (to permit testing) * more wrapzero safety * STM gets some too * time: stop the next 0-means-unset deadline being armed from raw millis() The fields this branch armed through Time::timerEndsAtMillis() / Time::skipZero() are the kind that get added by copy-paste: `rebootAtMsec = millis() + N` appears at twenty-odd sites across six files, and the next module to defer a reboot will be written from one of them. Nothing catches the mistake afterwards - the sum lands on 0 for one tick per ~49.7-day wrap, so a test run, a soak and a bench session all pass while a pending reboot, shutdown, DFU jump or banner expiry is silently dropped. Two guards, at the two places it can go wrong. The helpers themselves: skipZero() is constexpr, so its contract is now pinned by static_assert in the header rather than only by test_uptime_clock. The asserts are chosen against the two plausible rewrites - `ms | 1` perturbs every even value and `ms + 1` turns the last tick of the wrap into the 0 the function exists to avoid. Both compile, and both pass a test that only checks skipZero(0); each trips a distinct assert here, naming the failure mode. The call sites: bin/lint-unset-sentinel-millis.sh flags a sentinel field in src/ assigned from a raw millis()/getMillis() read, and names the helper to use. It is name-driven because the 0 contract is declared in src/main.h and enforced in six other files, so no single-file scan can infer it; every one of the thirteen fields was checked to actually test against 0 before being listed. nagCycleCutoff and LinuxJoystick's nextRepeatX/nextRepeatY are deliberately absent - their unset state is a separate bool - and the nine remaining `millis() + x` sites in src/ are locals that never store 0 for anything to misread. Blocking, unlike its note-level neighbours: there is no run-time enforcer to pair with, and the tree has zero violations today, so gating costs nothing. Scoped to src/ so test_uptime_clock can keep building raw wrap values on purpose. bin/test-lint-unset-sentinel-millis.sh pins the scanner against 23 fixtures - reads, disarms, shadowing locals, comments, string literals and the already-fixed forms all have to stay quiet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * time: guard the four 0-means-unset stamps this branch had missed Sweeping src/ for the `if (stamp && <deadline check>)` idiom - the shape that makes 0 mean "unset" - turned up four stamps still armed from a raw clock read, so the new lint rule would have had to either ignore them or go red on checkout. Each is the same one-tick-per-wrap hole the rest of the branch closes: * TrackballInterruptBase lastInterruptTime, armed in all four ISR handlers and explicitly disarmed to 0 at the threshold reset. getMillis() is the ISR-safe read by construction - it compiles to millis() outside PIO_UNIT_TESTING - and skipZero() is pure, so neither adds anything to interrupt context. * NeighborInfoModule lastSentReply, read as `if (lastSentReply && ...)` before the 3-minute reply throttle. Needed the UptimeClock.h include. * PositionModule lastSentReply, same throttle; already on the injectable clock but still missing the guard. * NodeDB lastSort, whose own read spells the sentinel out as `lastSort == 0 ||`. On the wrap tick each would read as never-stamped: a trackball debounce window lost, a neighbour or position reply sent inside the throttle it was meant to respect, one extra NodeDB sort. Cheap individually, which is why they were missed. All four are now listed in bin/lint-unset-sentinel-millis.sh, so the rule covers every field in the tree that actually tests against 0 rather than a subset, and the header records the eight stamps left off for the opposite reason - their unset state is a separate flag (isNagging, busyTx, heldX/heldY, formatted_this_boot, heartbeat, gotwind, haveSample, lastIaqValid), so 0 is a value they may legally hold. The rule is silent across src/ on this tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * lint: let a site opt out of the sentinel rule, with its reason on the record The rule is blocking, so it needs an escape hatch for the site where 0 genuinely is a legal timestamp - and the hatch should cost something, or it becomes the first thing anyone reaches for. `unset-sentinel-ok: <reason>` in a comment on the write, or on a comment line above it, suppresses that one statement: // unset-sentinel-ok: busyTx carries the armed state, so 0 is a legal stamp here lastTxStart = Time::getMillis(); The reason is mandatory. A bare `unset-sentinel-ok`, or a colon with nothing after it, is reported instead of honoured - with a message saying so - so the only way to silence a site is to write down why it is safe. trunk-ignore still works, but this states the justification at the write and also applies when the script runs outside trunk. The marker is read from comment text collected during the same character-level pass that strips comments and literals, not by re-scanning the raw line. That is what keeps it out of reach of data: LOG_DEBUG("unset-sentinel-ok: ...") mutes nothing, because a string literal is not a comment. It is also consumed by the statement it was written for, so it cannot leak onto the next write - while still carrying across any number of intervening comment lines to the statement below, which is where a real justification wants to be written. Twelve fixtures added for the new behaviour: both comment styles, block and multi-line block comments, the bare form, the marker-in-a-string cases, and three leak cases. 35 total, all green, under bash 3.2 as well. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * lint: watch the separate-flag stamps too, with their exemption stated at the write The nine stamps whose armed state lives in a companion boolean were previously just absent from the rule's list, which meant the reasoning for leaving them out existed only as prose in a shell script. They are now listed and individually opted out at the write, naming the flag that actually carries the armed state: // unset-sentinel-ok: haveSample carries the armed state, so 0 is a legal stamp lastSampleMs = Time::getMillis(); The point is what happens later. If someone rewrites `if (haveSample && ...)` as `if (lastSampleMs && ...)`, the field has silently acquired the 0 contract; with the opt-out sitting at the write, the claim to re-examine is in front of whoever makes that edit instead of buried in bin/. Every exemption was checked against its real read sites before being written, and three candidates did not survive that check. They stay off the list, because listing one would mean stamping an opt-out over a claim that does not hold: * nagCycleCutoff. handleInputEvent reads `if (nagCycleCutoff != UINT32_MAX)` without consulting isNagging, so at that read the field is its own armed flag with UINT32_MAX as the sentinel - and the arm at ExternalNotificationModule .cpp:521 can land exactly there. skipZero() cannot help: it lifts 0 to 1 and leaves UINT32_MAX alone, which UptimeClock.h's own static_assert pins. There is also a live boot-state bug behind this - the in-class initializer is 1 while isNagging starts false - and fixing the read is a behaviour change that belongs in its own PR. * TouchScreenBase::_start. Overloaded as an event stamp AND a `+ 30000` suppression deadline compared by signed subtraction, so a near-zero value reads as "long ago" rather than "armed 30s out" and LONG_PRESS re-fires. skipZero() does not fix this one either: 1 reads as long-ago exactly as 0 does. It needs the stamp and the deadline held separately. * StoreForwardModule::retry_delay. No reads at all today, so nothing misbehaves yet; exempting it now would pre-approve the raw arm for whoever implements the retry its own comment promises. The rule is silent across src/ on this tree, and the header records all three rejections so the next person does not have to re-derive them. The self-test's negative fixture no longer uses nagCycleCutoff as its example of a safely unlisted field - that would have encoded the opposite of what the header says. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(time,lint): guard the recomputed tx_after, and judge one write at a time Two review findings, both real. setTransmitDelay() recomputes p->tx_after from a clamp of three candidates, and that recomputation was still raw. Two lines above it, `if (p->tx_after)` is the read that takes 0 as "no delay wanted", so a clamp landing on 0 drops the CSMA backoff and the packet goes out immediately instead of after its computed delay. The first arm site in this function was already guarded; this one was missed because the value is not a plain `now + delay` and so does not fit timerEndsAtMillis() - it takes skipZero() instead. The narrowing order matters here and is spelled out at the site: add_delay is unsigned long, 64-bit on the portduino host, so the clamp can exceed UINT32_MAX there. skipZero() on the wide value would pass 0x100000000 through as non-zero and the store to this uint32_t field would then truncate it back to the 0 being avoided, so the cast comes first. The lint rule judged each write by the wrong text. rhs was taken from the write to the end of the accumulated statement, so a neighbour on the same line decided the verdict - and it was wrong in both directions: rebootAtMsec = millis() + 5; shutdownAtMsec = Time::timerEndsAtMillis(10); the later helper call suppressed a genuine raw arm rebootAtMsec = otherDeadline; shutdownAtMsec = millis(); the later millis() reported a safe copy rhs is now cut at its own semicolon. Six fixtures cover it, including both cases above, two raw writes on one line, two helper writes on one line, and a statement split across lines, which must still see its whole right-hand side. 41 fixtures total, green under bash 3.2. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * time: arm the remaining 0-means-unset stamps through the helpers The follow-up sweep to the sixteen fields the previous commits covered. A field here uses 0 to mean "unset" - some read spells `if (f)`, `f != 0`, `f == 0 ||` or `f > 0`, or a site disarms it with `f = 0` - but it was armed from a raw clock read, so once per ~49.7-day wrap it stores the value its own readers treat as never-set. 34 fields, 58 arm sites. The rule could not have found most of them first. It treated `field = <variable>` as inheriting whatever that variable did, which made the commonest shape in the tree invisible: one `now = millis()` at the top of a runOnce(), then several `xStartTime = now` below it. Listing those names would have bought no protection at all, so the scanner now tracks a local assigned from a clock and treats a write from it as the raw arm it is. One hop, one function, name-based, and it forgets a local reassigned from anything else; taint is dropped at each function boundary. Twelve fixtures pin it, including the negative cases - no leak across functions, `now` does not match `nowMs`, and neither `==` nor `+=` records anything. That pass immediately found a site the previous commits missed: setTransmitDelay() recomputes p->tx_after from a tainted `now`, two lines under the `if (p->tx_after)` read that takes 0 as "no delay wanted". Three of the fields are worth naming because the consequence is not cosmetic: * UpDownInterruptBase press/up/downStartTime - xDetected is only cleared INSIDE the block guarded by `xDetected && xStartTime > 0`, so a stored 0 makes both the entry and the exit condition unreachable and that button is dead for the rest of the boot, not for one tick. * PhoneAPI lastContactMsec - ServerAPI reads `lastContactMsec > 0` before the TCP idle close, and the field stays 0 until the next inbound packet, so a client that never speaks again leaks the socket for the life of the connection. * EInkDisplay lastDrawMsec - `if (lastDrawMsec)` gates every plain display() call on a keyframe having been shown, so a stored 0 stops the screen updating until something calls Screen::forceDisplay() again. TransmitHistory needed more than its arm sites. getLastSentToMeshMillis() returns 0 to mean "module has never sent", and besides the two stores, both reconstruction helpers end in `millis() - msAgo`, which can produce a 0 of their own. All three computed returns are guarded; the deliberate `return 0;` sentinels are untouched. Judged and deliberately not changed: * nRF54L15 connect_time_ms is armed from k_uptime_get_32(), not millis(). It is guarded with skipZero() but keeps its own clock - swapping in Time::getMillis() would have it compared against a k_uptime now at the watchdog read. The rule now recognises that clock too, so listing the field is not an empty gesture. * RotaryEncoderInterruptBase pressStartTime shares a name with the UpDown field and has a different contract: no read here tests the stamp against 0, pressDetected is the only armed flag. Opted out at the write. Its lastPressLongEventTime sibling IS a `== 0` latch and is fixed. * PositionModule line 38 copies a value the enclosing `if (restored != 0)` has already proven non-zero. Opted out. * pmMeasureStarted, adminKeyFallbackRefillMs, the two autosave stamps and scrollStartDelay are lazy initialisations whose wrap behaviour costs at most one interval and drops nothing. Left alone, and not listed. 47 lint fixtures green, the rule silent across src/, full native suite 1421/1421. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * time: dodge the wrap at the clock read, not only at the store Review on #11830 made a point that was right and that this branch had wrong. Applying skipZero() at the STORE while a reader measures elapsed time against a raw clock splits the two sides apart for one tick per ~49.7-day wrap: the stamp becomes 1 while `now` is still 0, so `now - stamp` is UINT32_MAX and a brand new stamp reads as about 49.7 days old. Every elapsed-since guard then fires when it must not. Concretely, UpDownInterruptBase computed `now - pressStartTime` and emitted a long press for a fresh press, and TraceRouteModule read `now - lastTraceRouteTime < cooldownMs` as false and bypassed its cooldown. So the dodge moves to the read. Time::stampMillis() is getMillis() with the one 0 tick called 1; a site that both stores a stamp and measures against stamps reads the clock once through it and stores that value directly. Nine files, and the 1 ms skew is the same one skipZero() already documents. Where the clock arrives as a PARAMETER the store keeps its own skipZero() as well, because the function cannot assume the caller dodged anything. Removing that was a real regression and test_nexthop_routing caught it: noteRouteLearned() and noteRouteSuccess() are called with a literal 0 by test_health_learn_never_stores_zero_sentinel and test_health_success_never_stores_zero_sentinel, which assert the store normalises it - 0 is the empty-slot marker getOrAllocRouteHealth() evicts on. The two guards compose without shifting twice, since skipZero() of a non-zero value is itself. trySmartBroadcast() and directResponseAllowed() have the same parameter shape and keep their store-side guard for the same reason. Only stores fed by a stampMillis() local in the same function are bare. EInkParallelDisplay was missed the first time: the third class in the family, still storing skipZero(getMillis()) while rate-limiting against a raw millis() local. Normalised like its siblings. The lint rule gained three false positives with the class-scope tracking, all of them shapes that are not class bodies at all: template <class T> void f(T x) { uint32_t lastSort = millis(); } class Foo { void tick() { uint32_t lastSort = millis(); } }; void g(struct Bar *b) { uint32_t lastSort = millis(); } Two causes. pending_class matched class/struct anywhere on the line, so a template parameter list and an elaborated type in a parameter list both marked the following FUNCTION body as class scope; it is anchored to the start of the line now. And update_scope() runs at the end of a line, so a body opened earlier on the same line had not been counted when the statement was judged; is_declaration() now also counts unmatched braces earlier in the statement. The rule is blocking and `template <class T>` is ordinary C++, so these would have reddened files nobody touched. note_taint() also never received the per-write `;` cut the judging path was given earlier in review, so on a line holding two statements it learned taint from the neighbour. Same cut applied. Five tests in test_uptime_clock pin the contract, including one that asserts the old store-only shape really does produce UINT32_MAX, and one that pins the 1 ms skew at 399 rather than 400 so nobody "corrects" it back into a raw read. Lint fixtures 53 -> 65. Full native suite 1426/1426, rule silent across src/. Known residual, deliberately not changed: a store that dodges zero while its reader measures through a Throttle:: helper still splits for that one tick, because those helpers read the clock internally and raw. About eight sites tree-wide, including PositionModule trySmartBroadcast and the lastContactMsec TCP idle check. Closing it means making Throttle read through the dodge, which was proposed on #11692 and declined there pending a caller audit, so fixing one site here would only make the tree inconsistent. The direction is also the same one the un-dodged code already took: a fresh stamp reads as old, and the guards involved were already passing on a 0 stamp. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * lint: a dodged value is safe to copy, not to do arithmetic on Two more review findings on the rule, both real, both false negatives. Arithmetic on an already-dodged value was excused. stampMillis() guarantees only its own result, so `now + 5000` can carry a non-zero stamp straight back onto the sentinel - 0xFFFFEC78 + 5000 is exactly 0. That sum is precisely what Time::timerEndsAtMillis() exists to dodge, and the rule was waving it through because a helper name appeared somewhere in the expression. Worse, a fixture asserted that behaviour was correct, so the self-test was pinning the hole open. A local holding a dodged value is now tracked separately from a tainted one: it may be stored or copied straight through, but + or - applied at the OUTERMOST level is reported and the message points at timerEndsAtMillis(). Depth-aware, so the operator inside Time::skipZero(getMillis() - msAgo) is still fine, and so is the `(d == 0) ? 0 : timerEndsAtMillis(d)` arming form, which has no top-level operator at all. The wrong fixture is replaced by four: store-through, copy one more hop, arithmetic on a dodged local, and arithmetic on a direct helper call. A class body that opens and closes on one line was never recognised. The header check rejected it because the line ends in a semicolon, which a one-liner body always does, and even once armed the class brace counted as a function body and excused the member. Both halves fixed: the header arms on the brace rather than on the absence of a semicolon, and when the body opened on the statement being judged, one unmatched brace is class scope while two is a method body inside it. Getting that wrong first broke every multi-line class, because setting the per-statement flag without also arming pending_class meant update_scope() never registered the body - the three existing class fixtures caught it. 72 fixtures, green under bash 3.2, shellcheck clean, rule silent across src/. No src/ or test/ file changes, so the native suite is untouched by this commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * style(time): trim comments to the house limit --------- Co-authored-by: Tom <116762865+Nestpebble@users.noreply.github.com> Co-authored-by: nomdetom <nomdetom@protonmail.com> Co-authored-by: Tom <116762865+NomDeTom@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 12:19:02 +00:00
4 people	80cfa52665	Add zero guards on time calculations where they were missing (#11692) ... * time: add skipZero/safeMillis/timerEndsAtMillis helpers skipZero() steps a millis value past 0, since stored stamps and deadlines conventionally use 0 for "unset" and the one tick per ~49.7-day wrap that lands on 0 would otherwise read as never-set. safeMillis() covers a bare stamp; timerEndsAtMillis(delayMs) covers a deadline, where the sum is what has to dodge 0 - a non-zero read plus a delay lands there once per wrap - so it is not safeMillis() + delayMs. * time: replace hand-rolled zero-dodging with the UptimeClock helpers PacketHistory rxTimeMsec, EncryptedStorage s_lastFailMillis (stamps), and SGM41562 lastRefreshMs_ / NextHopRouter learnedAtMsec (ternary stamps) each hand-rolled skipZero() in place; swap in safeMillis()/skipZero() directly. HapticFeedback pulseOffAt/delayedPulseAt and GPS fixHoldEnds hand-rolled the deadline form - millis() + delay, then remap a 0 result to 1 - swap in timerEndsAtMillis(delay). No behavior change; each site keeps the value it already computed. * time: guard the remaining 0-means-unset deadline/stamp writes rebootAtMsec, shutdownAtMsec, and NotificationRenderer::alertBannerUntil are all read back with a bare == 0 / != 0 check for 'not scheduled', but every write site computed millis() + delay (or a bare millis() stamp) with no guard against landing exactly on 0 - the same wrap hazard skipZero() exists for, just never applied here. Route every rebootAtMsec/shutdownAtMsec/alertBannerUntil write through timerEndsAtMillis()/safeMillis(); RadioLibInterface's reboot-on-stuck-tx sums an already-captured stamp rather than "now", so it goes through skipZero() directly instead. No behavior change outside the ~1-in-2^32 wrap window each site was already exposed to. * time: guard three more 0-means-unset deadline writes ntp_renew (ethClient.cpp), suppressTouchTapUntilMs (Events.cpp), and tx_after (RadioLibInterface.cpp) all read back 0 as a real state - forced NTP renewal, no suppress window active, no TX delay armed, respectively - but each arm site wrote a bare millis()/getMillis() + delay with no guard against the sum landing exactly on 0. Route each through Time::timerEndsAtMillis(). No behavior change outside the wrap window each site was already exposed to. Refresh the Throttle.h TODO list to note ntp_renew is converted too. * motion: guard the calibration deadline and use Throttle::deadlinePassed endCalibrationAt's arm site wrote millis() + calibrateFor with no guard against landing on 0, the same value finishCalibrationIfExpired()/ drawFrameCalibration() treat as "not calibrating". Route it through Time::timerEndsAtMillis(). Also swap finishCalibrationIfExpired()'s hand-rolled (int32_t)(now - deadline) < 0 for Throttle::deadlinePassed(): same wrap-safe comparison the codebase already provides, without the signed-cast pattern Throttle.h documents as implementation-defined past INT32_MAX, and it drops the file's last direct millis() call in favor of the Time:: wrapper the rest of it already uses. * time: fix Throttle::execute()'s own zero-dodging Both places execute() writes *lastExecutionMs - the first-ever-run branch and the regular update - used bare Time::getMillis() with no guard against landing on 0, which is the exact sentinel this function reads back as "never run" one line above. A hit there makes the next call re-fire immediately instead of respecting minumumIntervalMs. Capture now via Time::safeMillis() once; every use downstream (the elapsed comparison, the stored value) is then safe by construction instead of needing the guard reapplied at each write. * revert some safeMillis cases where overflow is a bad thing * test(uptime): pin skipZero/safeMillis/timerEndsAtMillis at the wrap boundary Covers the zero case, an ordinary nonzero value, and a sum that lands exactly on 0 from a nonzero start - the case timerEndsAtMillis() exists for, and the one the prior suite had no direct coverage of. * time: restore the route-health write normalization and put it on one clock noteRouteLearned()/noteRouteSuccess() lost their `now ? now : 1` normalization, leaving learnedAtMsec able to store 0 - which getOrAllocRouteHealth() reads as an ever-growing age, making the slot the first eviction candidate and permanently stale. Normalize at the write, where the block comment already says it happens, so every caller is covered rather than just today's two. Both callers, the two isRouteStale() sites and doRetransmissions() now read Time::getMillis(), so the stamp and every comparison against it share a clock. doRetransmissions() goes back to getMillis(): its `now` feeds only comparisons, never a 0-sentinel field, so skipping zero there only cost accuracy. * time: read the haptic, InkHUD and calibration deadlines on the write's clock These three deadlines were converted to Time::timerEndsAtMillis() on the write side while their reads stayed on millis(), so each spanned two clocks and would fire immediately or never under an injected test clock. Convert the reads to match: HapticFeedback::scheduleNext()/runOnce(), the InkHUD tap-suppression window, and the calibration countdown's read-back of screen->getEndCalibration(). MotionSensor's sampledAtMs is left alone - its write and read are both millis() and consistent already. * time: correct the sentinel notes to match what the code actually does The Throttle.h enumeration claimed the remaining timerEndsAtMillis() callers "already dodge the sentinel", which reads as a completeness claim the same branch contradicts: RadioLibInterface's tx_after and activeReceiveStart are both 0=unarmed and both still arm from bare millis(). Name them instead, so the deadline-type conversion has the real list. The ntp_renew entry now separates a deliberate 0 ("due now", forced at link-up) from a computed one, which is what changed there. The three TODO(elapsed-stamp) blocks ran four and five lines against the repo's one-or-two rule, and two of them argued their case wrongly. Throttle.cpp implied safeMillis() simply doesn't help; in fact neither store is safe on the wrap tick - the 1 underflows a same-instant read, the 0 re-takes the never-run branch - which is the symmetry worth recording. PacketHistory.cpp called its dodge "reflecting the previous pattern" when it is load-bearing: rxTimeMsec 0 means "empty slot" (PacketHistory.h:21) and insert() drops a record stamped 0 outright, so without it a packet arriving on the wrap tick is never stored and loses its dedup. Also picks up trunk fmt's trailing-whitespace fix in Throttle.cpp and the comment realignment in SGM41562.cpp that this branch's added comment knocked out. * test(nexthop): pin the route-health stamp against the 0 sentinel The uptime suite covers skipZero/safeMillis/timerEndsAtMillis themselves, but nothing covered a call site, so the branch deleted noteRouteLearned()'s normalization and stayed green. None of the existing route-health tests pass 0 as `now` - they use 1000, learnAt, or millis() - (TTL + 5000) - which is exactly the gap the regression went through. Both new tests fail with "Expected 0 to be not equal to 0" when the skipZero() is backed out of NextHopRouter, and pass with it. noteRouteSuccess() only refreshes an existing record, so its twin learns a route first to reach the write. Also drops a self-referential assertion in the uptime suite: comparing getMillis() against safeMillis() passes even if safeMillis() does no dodge at all, so it now asserts the literal. * discard safemillis for skipzero (better semantics and therefore maintainability) and make consistent use of getmillis where it is called (to permit testing) * more wrapzero safety * STM gets some too * time: stop the next 0-means-unset deadline being armed from raw millis() The fields this branch armed through Time::timerEndsAtMillis() / Time::skipZero() are the kind that get added by copy-paste: `rebootAtMsec = millis() + N` appears at twenty-odd sites across six files, and the next module to defer a reboot will be written from one of them. Nothing catches the mistake afterwards - the sum lands on 0 for one tick per ~49.7-day wrap, so a test run, a soak and a bench session all pass while a pending reboot, shutdown, DFU jump or banner expiry is silently dropped. Two guards, at the two places it can go wrong. The helpers themselves: skipZero() is constexpr, so its contract is now pinned by static_assert in the header rather than only by test_uptime_clock. The asserts are chosen against the two plausible rewrites - `ms | 1` perturbs every even value and `ms + 1` turns the last tick of the wrap into the 0 the function exists to avoid. Both compile, and both pass a test that only checks skipZero(0); each trips a distinct assert here, naming the failure mode. The call sites: bin/lint-unset-sentinel-millis.sh flags a sentinel field in src/ assigned from a raw millis()/getMillis() read, and names the helper to use. It is name-driven because the 0 contract is declared in src/main.h and enforced in six other files, so no single-file scan can infer it; every one of the thirteen fields was checked to actually test against 0 before being listed. nagCycleCutoff and LinuxJoystick's nextRepeatX/nextRepeatY are deliberately absent - their unset state is a separate bool - and the nine remaining `millis() + x` sites in src/ are locals that never store 0 for anything to misread. Blocking, unlike its note-level neighbours: there is no run-time enforcer to pair with, and the tree has zero violations today, so gating costs nothing. Scoped to src/ so test_uptime_clock can keep building raw wrap values on purpose. bin/test-lint-unset-sentinel-millis.sh pins the scanner against 23 fixtures - reads, disarms, shadowing locals, comments, string literals and the already-fixed forms all have to stay quiet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * time: guard the four 0-means-unset stamps this branch had missed Sweeping src/ for the `if (stamp && <deadline check>)` idiom - the shape that makes 0 mean "unset" - turned up four stamps still armed from a raw clock read, so the new lint rule would have had to either ignore them or go red on checkout. Each is the same one-tick-per-wrap hole the rest of the branch closes: * TrackballInterruptBase lastInterruptTime, armed in all four ISR handlers and explicitly disarmed to 0 at the threshold reset. getMillis() is the ISR-safe read by construction - it compiles to millis() outside PIO_UNIT_TESTING - and skipZero() is pure, so neither adds anything to interrupt context. * NeighborInfoModule lastSentReply, read as `if (lastSentReply && ...)` before the 3-minute reply throttle. Needed the UptimeClock.h include. * PositionModule lastSentReply, same throttle; already on the injectable clock but still missing the guard. * NodeDB lastSort, whose own read spells the sentinel out as `lastSort == 0 ||`. On the wrap tick each would read as never-stamped: a trackball debounce window lost, a neighbour or position reply sent inside the throttle it was meant to respect, one extra NodeDB sort. Cheap individually, which is why they were missed. All four are now listed in bin/lint-unset-sentinel-millis.sh, so the rule covers every field in the tree that actually tests against 0 rather than a subset, and the header records the eight stamps left off for the opposite reason - their unset state is a separate flag (isNagging, busyTx, heldX/heldY, formatted_this_boot, heartbeat, gotwind, haveSample, lastIaqValid), so 0 is a value they may legally hold. The rule is silent across src/ on this tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * lint: let a site opt out of the sentinel rule, with its reason on the record The rule is blocking, so it needs an escape hatch for the site where 0 genuinely is a legal timestamp - and the hatch should cost something, or it becomes the first thing anyone reaches for. `unset-sentinel-ok: <reason>` in a comment on the write, or on a comment line above it, suppresses that one statement: // unset-sentinel-ok: busyTx carries the armed state, so 0 is a legal stamp here lastTxStart = Time::getMillis(); The reason is mandatory. A bare `unset-sentinel-ok`, or a colon with nothing after it, is reported instead of honoured - with a message saying so - so the only way to silence a site is to write down why it is safe. trunk-ignore still works, but this states the justification at the write and also applies when the script runs outside trunk. The marker is read from comment text collected during the same character-level pass that strips comments and literals, not by re-scanning the raw line. That is what keeps it out of reach of data: LOG_DEBUG("unset-sentinel-ok: ...") mutes nothing, because a string literal is not a comment. It is also consumed by the statement it was written for, so it cannot leak onto the next write - while still carrying across any number of intervening comment lines to the statement below, which is where a real justification wants to be written. Twelve fixtures added for the new behaviour: both comment styles, block and multi-line block comments, the bare form, the marker-in-a-string cases, and three leak cases. 35 total, all green, under bash 3.2 as well. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * lint: watch the separate-flag stamps too, with their exemption stated at the write The nine stamps whose armed state lives in a companion boolean were previously just absent from the rule's list, which meant the reasoning for leaving them out existed only as prose in a shell script. They are now listed and individually opted out at the write, naming the flag that actually carries the armed state: // unset-sentinel-ok: haveSample carries the armed state, so 0 is a legal stamp lastSampleMs = Time::getMillis(); The point is what happens later. If someone rewrites `if (haveSample && ...)` as `if (lastSampleMs && ...)`, the field has silently acquired the 0 contract; with the opt-out sitting at the write, the claim to re-examine is in front of whoever makes that edit instead of buried in bin/. Every exemption was checked against its real read sites before being written, and three candidates did not survive that check. They stay off the list, because listing one would mean stamping an opt-out over a claim that does not hold: * nagCycleCutoff. handleInputEvent reads `if (nagCycleCutoff != UINT32_MAX)` without consulting isNagging, so at that read the field is its own armed flag with UINT32_MAX as the sentinel - and the arm at ExternalNotificationModule .cpp:521 can land exactly there. skipZero() cannot help: it lifts 0 to 1 and leaves UINT32_MAX alone, which UptimeClock.h's own static_assert pins. There is also a live boot-state bug behind this - the in-class initializer is 1 while isNagging starts false - and fixing the read is a behaviour change that belongs in its own PR. * TouchScreenBase::_start. Overloaded as an event stamp AND a `+ 30000` suppression deadline compared by signed subtraction, so a near-zero value reads as "long ago" rather than "armed 30s out" and LONG_PRESS re-fires. skipZero() does not fix this one either: 1 reads as long-ago exactly as 0 does. It needs the stamp and the deadline held separately. * StoreForwardModule::retry_delay. No reads at all today, so nothing misbehaves yet; exempting it now would pre-approve the raw arm for whoever implements the retry its own comment promises. The rule is silent across src/ on this tree, and the header records all three rejections so the next person does not have to re-derive them. The self-test's negative fixture no longer uses nagCycleCutoff as its example of a safely unlisted field - that would have encoded the opposite of what the header says. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(time,lint): guard the recomputed tx_after, and judge one write at a time Two review findings, both real. setTransmitDelay() recomputes p->tx_after from a clamp of three candidates, and that recomputation was still raw. Two lines above it, `if (p->tx_after)` is the read that takes 0 as "no delay wanted", so a clamp landing on 0 drops the CSMA backoff and the packet goes out immediately instead of after its computed delay. The first arm site in this function was already guarded; this one was missed because the value is not a plain `now + delay` and so does not fit timerEndsAtMillis() - it takes skipZero() instead. The narrowing order matters here and is spelled out at the site: add_delay is unsigned long, 64-bit on the portduino host, so the clamp can exceed UINT32_MAX there. skipZero() on the wide value would pass 0x100000000 through as non-zero and the store to this uint32_t field would then truncate it back to the 0 being avoided, so the cast comes first. The lint rule judged each write by the wrong text. rhs was taken from the write to the end of the accumulated statement, so a neighbour on the same line decided the verdict - and it was wrong in both directions: rebootAtMsec = millis() + 5; shutdownAtMsec = Time::timerEndsAtMillis(10); the later helper call suppressed a genuine raw arm rebootAtMsec = otherDeadline; shutdownAtMsec = millis(); the later millis() reported a safe copy rhs is now cut at its own semicolon. Six fixtures cover it, including both cases above, two raw writes on one line, two helper writes on one line, and a statement split across lines, which must still see its whole right-hand side. 41 fixtures total, green under bash 3.2. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Tom <116762865+Nestpebble@users.noreply.github.com> Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-12 10:54:50 +00:00
3 people	9461670f49	Add relaying node and RSSI/SNR to the implicit-ack routing packet (#10767) ... When we overhear another node rebroadcast one of our own packets, we generate an implicit-ack ROUTING packet for the local sending process. That ack is delivered locally to the phone, so pass the overheard rebroadcast as a relay source and copy its relay_node and the rx_rssi / rx_snr we heard it at onto the ack. This lets the connected client see which node relayed our packet and the link quality, instead of only learning that the packet was repeated. allocAckNak / sendAckNak gain an optional relaySource parameter. The ack is sent to ourselves (to == us), so Router::send() is bypassed and does not overwrite these fields with our own. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-08-26 22:01:57 +00:00
Ben Meadors	f57ee0bd71	fix(mesh): restore the implicit ACK for our own overheard PKI DMs (#11502) ... * fix(mesh): restore the implicit ACK for our own overheard PKI DMs A DM we originate is PKI-encrypted to the recipient, so when we overhear it being rebroadcast we cannot decrypt it. perhapsHandleReceived() classifies it DECODE_OPAQUE and returns before shouldFilterReceived() runs, which is where the implicit ACK for our own transmission is generated. The client therefore never receives the ROUTING_APP ack it renders as "Delivered to mesh" for a DM, and the message sits in "sending" until it either succeeds outright or times out as max retransmissions. The ACK only needs the packet header (from/id), not the decoded payload, so split it out of shouldFilterReceived() into perhapsGenerateImplicitAckForOwnOverheard() and also call it from the opaque short-circuit for packets that are from us. Behavior on the decodable path is unchanged. Broadcasts on a PSK channel decode normally and always reached the generator, which is why channel messages were unaffected and only DMs showed the symptom. * test: rename implicit-ack tests to avoid a trufflehog false positive The camelCase identifiers tripped trunk's trufflehog/Lob secret detector. * test: shorten one test name past trunk's Lob secret-detector pattern trufflehog's Lob rule matches test_ followed by exactly 35 word characters, which both new test names happened to hit. Unrelated to the fix.	2026-08-14 12:15:31 -05:00
Benjamin FaershteinandBen Meadors	a400143090	fix: improve acknowledged unicast retry reliability (#11320) ... * Improve acknowledged unicast retry reliability * Fix merged next-hop routing tests --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-08-13 13:55:53 -04:00
4 people	546b9d9e40	Block coordinate traffic on configured event channels (#11045) ... * Block coordinate traffic on configured event channels Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Suppress event coordinates in reliable relay paths Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Reject blocked phone coordinates before rate limiting Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Prevent event coordinates from reaching MQTT Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Add event coordinate policy preference Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Test event coordinate policy in native CI Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Make event policy test tolerate a full NodeDB Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Test Router event coordinate enforcement Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Test PhoneAPI event coordinate retry handling Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Test reliable event coordinate suppression Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Test MQTT event coordinate suppression Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Run event policy behavioral suites in native CI Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * tests: address CodeRabbit review feedback - test_event_channel_phone_api: complete the setUp/tearDown save-restore pair. GlobalState now carries cryptLock and myNodeInfo; setUp() nulls cryptLock before constructing MockRouter (Router's ctor asserts it is unset), and tearDown() restores both so the suite leaves no global mutated. Not reachable today - the globals start null in this binary - but the pair was asymmetric. - Replace the strcpy calls this branch added on Channel.settings.name (char[12]) with the bounded form the rest of the test tree already uses, strncpy(dst, src, sizeof(dst) - 1). Covers the flagged site in test_nexthop_routing plus the six equivalents in test_event_channel_phone_api, test_mqtt and test_position_precision, which trip the same ast-grep dangerous-buffer-functions-cpp rule. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-11 12:34:08 +00:00
Benjamin Faershtein	9a37250438	fix(router): clear failed reliable send retries (#11267) ... * fix(router): clear failed reliable send retries * test(router): cover failed interface enqueue * fix(router): retain retries after duty cycle limits	2026-07-30 11:00:32 +00:00
Andrew Yong	0ae44d7017	fix(router): null-check packetPool/clientNotificationPool allocations (#10948) ... On platforms where these pools are heap-backed (MemoryDynamic - used whenever there isn't enough static RAM for a fixed pool, e.g. ARCH_STM32WL or BOARD_HAS_PSRAM), allocCopy()/allocZeroed() return nullptr on allocation failure and already log a warning, but most callers dereferenced the result unconditionally. Under real heap pressure this reliably produced a HardFault - reproduced on STM32WL hardware under sustained mesh traffic, including the RX entry point (RadioLibInterface::handleReceiveInterrupt) where every received packet is allocated. Adds null checks at all call sites that were missing one, mirroring the guard pattern already used correctly elsewhere in the same files (e.g. RadioInterface.cpp's sendErrorNotification). On allocation failure, callers now skip the send/retransmission/notification and log nothing further (the allocator already did) rather than crash. Assisted-by: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Andrew Yong <me@ndoo.sg>	2026-07-09 04:36:36 -05:00
Tom	fd62322876	Log tidy (#10798) ... * clarify channel number formatting and fix the fixed-width padded nodeIDs * use the explicit 0x%08x for packets and nodeIDs throughout * LLM instructions	2026-06-30 12:44:25 -05:00
3 people	22072c5f4b	Pr1.5 tmm nexthop (#10745) ... * TrafficManagement: flat unified cache + persistent next-hop overflow store Reworks the TrafficManagementModule cache layer (policing behaviour unchanged from upstream) and adds a routing-hint overflow store: - Flatten the ring: replace the cuckoo-hashed unified cache and the bucketed PSRAM NodeInfo index with plain flat arrays + linear scan (same idiom as WarmNodeStore). At LoRa packet rates an O(n) scan of the cache is negligible, and it removes a large amount of hashing/displacement complexity. The cache entry is 11 B; timestamps use a uniform +1 presence-offset so a 0 byte always means "empty" across every sub-store. Adds rebaseEpoch() so cached state survives the ~19 h relative-timestamp horizon instead of being flushed. - Next-hop overflow cache: setNextHop/getNextHopHint store a confirmed last-byte relay for a destination, written only from NextHopRouter's ACK-confirmed decision (and mirrored from TraceRoute). NextHopRouter::getNextHop falls back to this cache when the hot NodeDB has no hint, so DMs/relays to long-tail nodes keep routing after the node ages out of NodeInfoLite. - Persistence: preloadNextHopsFromNodeDB warm-starts the cache from persisted NodeInfoLite hints on first maintenance pass; next_hop entries are kept alive across the maintenance sweep (no TTL) and never clobbered by a stale preload. All packet-policing logic (rate limit, position dedup, unknown-packet drop, NodeInfo direct response, hop exhaustion) is the existing upstream behaviour, untouched. HAS_TRAFFIC_MANAGEMENT defaults on so the module is compiled in. (see note). Tests: upstream policing suite now actually runs (adds the MeshTypes.h include that gates HAS_TRAFFIC_MANAGEMENT) plus 4 next-hop tests. Role-aware throttles, politeness, precision clamp, port-interval and mesh-radius gating — and the rate-limit >255 saturation fix — are deferred to the advanced-TMM branch. Note: default dedup movement grid moves to ~91m, which also means 1.5km required to end up with the same signature position - coarser and therefore further than before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * TrafficManagement: fix cppcheck constVariablePointer warning `node` in preloadNextHopsFromNodeDB() is never written through — mark it const to satisfy cppcheck's constVariablePointer check in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add multi-hop NextHop recovery tests and unit tests for routing reliability - Introduced a new test suite for multi-hop NextHop directed-message delivery and relay recovery in `test_nexthop_multihop_recovery.py`. This includes tests for end-to-end delivery and recovery after relay drop. - Implemented unit tests in `test_main.cpp` for NextHop routing reliability mitigations, covering: - M1: Ambiguity-aware last-byte resolution. - M2: NextHopRouter's strict-neighbor gate and hop limit checks. - M3: Route-health freshness and failure decay. - Enhanced mock classes to facilitate controlled testing of node behaviors and routing logic. * grafting fixed * Address Copilot review for PR #10735 (NextHop improvements) - docs/nexthop-routing-reliability.md: update status from "no code changes yet" to reflect that mitigations and tests are implemented RAM pressure and MIGRATION_VERBOSE concerns addressed upstream in PR2.5 (per-platform TRAFFIC_MANAGEMENT_CACHE_SIZE) and PR2 (verbose default=0) respectively; (0,0) sentinel fixed in PR2.5. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * CI: fix cppcheck constVariablePointer and test include path - NextHopRouter.cpp: qualify two RouteHealth *h locals as const — only read for stale-route checks, never mutated through the pointer - Router.cpp: qualify meshtastic_NodeInfoLite *node as const in shouldDecrementHopLimit — only read for favorite/role predicate - test_position_module/test_main.cpp: change bare PositionModule.h to modules/PositionModule.h — build_flags sets -Isrc, not -Isrc/modules, so the bare form fails to resolve in the native PlatformIO test env Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * WarmStore: cache device role + protected category in last_heard low bits Steal the low 6 bits of WarmNodeEntry.last_heard to carry an evicted node's device role (4 bits) and a protected category (2 bits) for the hop-trim path, at zero record-size cost (entry stays 40 B; no RAM/flash growth). The high bits remain a real unix-seconds timestamp, quantised to 64 s — ample for warm LRU ordering of long-tail nodes. - absorb() packs role/protectedCat; place()/ring replay store the raw word so metadata round-trips through flash. LRU compares masked time (warmTimeOf). - take() rehydration masks the metadata bits and restores the cached role so a re-admitted node isn't stuck at CLIENT until its next NodeInfo. - NodeDB classifies the category (favorite/ignored/verified -> Flag; tracker/sensor/tak_tracker -> Role) at each eviction site. - WarmNodeStore::lookupMeta() exposes role/category to consumers. - Bump WARM_RING_MAGIC (WRNG->WRN2): old rings read as erased and rebuild; warm data is a non-critical evictee cache, so discard-on-upgrade is safe. Tests: test_warm_store 11/11 (new meta round-trip + quantisation-aware ordering); NodeDB compiles (test_nodedb_blocked 4/4). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WarmStore: migrate v1 rings/files by discarding last_heard, not the data Previously the WRNG->WRN2 magic bump treated old rings as erased, discarding all warm entries — including the PKI public keys that let evicted nodes keep decrypting DMs. Instead, read v1 (WRNG / WRM1) records and keep each node's identity + public key, discarding only last_heard (its low bits would otherwise be misread as the new role/protected metadata). Records re-rank and re-learn their role on next contact. - Ring backend (nRF52840): ringReadHeader accepts both magics and reports v1 via an out-param; replay zeroes last_heard for v1 records. If the active head page is v1, force a rotation so new v2 records never land in a v1-headered page (which would discard their freshly-set role on the next load). Legacy pages convert to v2 as the ring rotates. - File backend (warm.dat): bump WARM_STORE_MAGIC WRM1->WRM2; accept WRM1, verify CRC against the stored bytes, then discard last_heard and mark dirty so the next save rewrites as v2. Tests: test_warm_store 12/12 (adds test_ws_v1_migration_discardsLastHeard: key survives, role/protected reset). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WarmStore: guard role bit-width + test eviction carries role/protected - static_assert that the device role enum still fits the 4-bit warm metadata field (WARM_ROLE_MASK); fails the build loudly if a new role is added past 15 rather than silently truncating role on eviction. (Max role today = 12.) - Add test_migration_carriesRoleAndProtectedIntoWarm: a demoted TRACKER lands in the warm tier with its key, role=TRACKER and protected category=Role; a demoted CLIENT carries role=CLIENT/None. Exercises the NodeDB eviction path + warmProtectedCategory classification (the warm-store unit tests only cover absorb() directly). Tests: test_nodedb_blocked 5/5. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix copilot comments * fix(test): restore #if HAS_TRAFFIC_MANAGEMENT guard in TMM test The rebase onto PR1.5 lost the top-level HAS_TRAFFIC_MANAGEMENT guard that PR1.5 introduced, leaving the #else/#endif tail orphaned and causing compile errors on non-TMM builds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-06-19 19:52:58 -05:00
4 people	94bb21ecc7	2.8: NodeDB shrink, decoupling, and restructuring (#10413) ... * 2.8: NodeDB refactor to decouple satellite entries and decrease size * Regen * Refactor node mute handling to use dedicated functions for clarity and consistency * Develop ref * Fix NodeDB review follow-ups Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/6b1d6cf6-ed6b-43b6-95cb-8e141757664e Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Address review validation nits Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/6b1d6cf6-ed6b-43b6-95cb-8e141757664e Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Trunk * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Extract legacy NodeDatabase migration * Fix remaining NodeDB review issues Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/c76b9a5a-7244-4fbc-9ef0-98091d8caaea Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Fixes * Trunk * Fix latest review compile follow-ups Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/5198da01-ec4c-4c16-8a09-68b8e6d5d410 Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Fix cppcheck style warnings Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/e60287ba-4ece-46e0-83d8-a6d89664c0bb Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Change pointer type for mesh node in set_favorite function * Change pointer types for mesh node references to const in multiple applets * Add NodeDB layout v25 documentation and migration guidelines * Remove tests for uninitialized PacketHistory state due to undefined behavior * Fix code block formatting in copilot instructions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-05-09 15:12:10 -05:00
Eric SeveranceandBen Meadors	f710cd6ecb	Support fully direct request/responses (#9455) ... Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-01-28 14:14:01 -06:00
Jorropo	beb268ff25	Revert "add a .clang-format file (#9154)" (#9172) ... I thought git would be smart enough to understand all the whitespace changes but even with all the flags I know to make it ignore theses it still blows up if there are identical changes on both sides. I have a solution but it require creating a new commit at the merge base for each conflicting PR and merging it into develop. I don't think blowing up all PRs is worth for now, maybe if we can coordinate this for V3 let's say. This reverts commit 0d11331d18.	2026-01-04 05:15:53 -06:00
Jorropo	0d11331d18	add a .clang-format file (#9154)	2026-01-03 14:19:24 -06:00
Eric Severance	1b2dc10e77	Calculate hops correctly even when hop_start==0 (#9120) ... * Calculate hops correctly even when hop_start==0. * Use the same type (int8_t) in the loop, avoiding signed/unsigned mismatches. * Clarify defaultIfUnknown is returned for encrypted packets.	2025-12-30 15:31:35 -06:00
GUVWAFandBen Meadors	68250dc937	Mark implicit ACK for MQTT as MQTT transport (#8939) ... * Mark implicit ACK for MQTT as MQTT transport * TRUNK * Fix build * Make sure implicit ACKs from MQTT do not stop retransmissions in ReliableRouter --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2025-12-12 05:19:32 -06:00
GUVWAF	e8296914a5	Calculate airtime of transmitted and received packets separately (#8205)	2025-10-04 05:29:25 -05:00
Mike RobbinsandBen Meadors	f7469159cf	Reliable ACKs for DMs (#8165) ... * RoutingModule::sendAckNak takes ackWantsAck arg to set want_ack on the ACK itself * Use reliable delivery for traceroute requests (which will be copied to traceroute responses by setReplyTo) * Update ReliableRouter::sniffReceived to use ReliableRouter::shouldSuccessAckWithWantAck * Use isFromUs * Update MockRoutingModule::sendAckNak to include ackWantsAck argument (currently ignored) --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2025-10-01 15:31:53 -05:00
3 people	1d3c47c5fa	Make sure to ACK ACKs/replies if next-hop routing is used (#8052) ... * Make sure to ACK ACKs/replies if next-hop routing is used To stop their retransmissions; hop limit of 0 is enough * Update src/mesh/ReliableRouter.cpp Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-09-20 06:37:40 -05:00
Ben Meadors	e17c50bb86	Put guards in place around debug heap operations (#7955) ... * Put guards in place around debug heap operations * Add macros to clean up code * Add pointer as well	2025-09-11 07:57:42 -05:00
Jonathan Bennett	e7741c20e4	Add LOG_HEAP log type, and more heap debug messages (#7937)	2025-09-09 10:29:07 -05:00
GUVWAF	a25bfd264c	Only stop retransmissions when receiving implicit ACK over LoRa (#7872) ... * Only stop retransmissions when receiving implicit ACK over LoRa * trunk fmt	2025-09-05 12:00:23 -05:00
+919 people	99d3e5eb70	2.6 changes (#5806) ... * 2.6 protos * [create-pull-request] automated change (#5789) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Hello world support for UDP broadcasts over the LAN on ESP32 (#5779) * UDP local area network meshing on ESP32 * Logs * Comment * Update UdpMulticastThread.h * Changes * Only use router->send * Make NodeDatabase (and file) independent of DeviceState (#5813) * Make NodeDatabase (and file) independent of DeviceState * 70 * Remove logging statement no longer needed * Explicitly set CAD symbols, improve slot time calculation and adjust CW size accordingly (#5772) * File system persistence fixes * [create-pull-request] automated change (#6000) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Update ref * Back to 80 * [create-pull-request] automated change (#6002) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * 2.6 <- Next hop router (#6005) * Initial version of NextHopRouter * Set original hop limit in header flags * Short-circuit to FloodingRouter for broadcasts * If packet traveled 1 hop, set `relay_node` as `next_hop` for the original transmitter * Set last byte to 0xFF if it ended at 0x00 As per an idea of @S5NC * Also update next-hop based on received DM for us * temp * Add 1 retransmission for intermediate hops when using NextHopRouter * Add next_hop and relayed_by in PacketHistory for setting next-hop and handle flooding fallback * Update protos, store multiple relayers * Remove next-hop update logic from NeighborInfoModule * Fix retransmissions * Improve ACKs for repeated packets and responses * Stop retransmission even if there's not relay node * Revert perhapsRebroadcast() * Remove relayer if we cancel a transmission * Better checking for fallback to flooding * Fix newlines in traceroute print logs * Stop retransmission for original packet * Use relayID * Also when want_ack is set, we should try to retransmit * Fix cppcheck error * Fix 'router' not in scope error * Fix another cppcheck error * Check for hop_limit and also update next hop when `hop_start == hop_limit` on ACK Also check for broadcast in `getNextHop()` * Formatting and correct NUM_RETRANSMISSIONS * Update protos * Start retransmissions in NextHopRouter if ReliableRouter didn't do it * Handle repeated/fallback to flooding packets properly First check if it's not still in the TxQueue * Guard against clients setting `next_hop`/`relay_node` * Don't cancel relay if we were the assigned next-hop * Replies (e.g. tapback emoji) are also a valid confirmation of receipt --------- Co-authored-by: GUVWAF <thijs@havinga.eu> Co-authored-by: Thomas Göttgens <tgoettgens@gmail.com> Co-authored-by: Tom Fifield <tom@tomfifield.net> Co-authored-by: GUVWAF <78759985+GUVWAF@users.noreply.github.com> * fix "native" compiler errors/warnings NodeDB.h * fancy T-Deck / SenseCAP Indicator / unPhone / PICOmputer-S3 TFT screen (#3259) * lib update: light theme * fix merge issue * lib update: home buttons + button try-fix * lib update: icon color fix * lib update: fix instability/crash on notification * update lib: timezone * timezone label * lib update: fix set owner * fix spiLock in RadioLibInterface * add picomputer tft build * picomputer build * fix compiler error std::find() * fix merge * lib update: theme runtime config * lib update: packet logger + T-Deck Plus * lib update: mesh detector * lib update: fix brightness & trackball crash * try-fix less paranoia * sensecap indicator updates * lib update: indicator fix * lib update: statistic & some fixes * lib-update: other T-Deck touch driver * use custom touch driver for Indicator * lower tft task prio * prepare LVGL ST7789 driver * lib update: try-fix audio * Drop received packets from self * Additional decoded packet ignores * Honor flip & color for Heltec T114 and T190 (#4786) * Honor TFT_MESH color if defined for Heltec T114 or T190 * Temporary: point lib_deps at fork of Heltec's ST7789 library For demo only, until ST7789 is merged * Update lib_deps; tidy preprocessor logic * Download debian files after firmware zip * set title for protobufs bump PR (#4792) * set title for version bump PR (#4791) * Enable Dependabot * chore: trunk fmt * fix dependabot syntax (#4795) * fix dependabot syntax * Update dependabot.yml * Update dependabot.yml * Bump peter-evans/create-pull-request from 6 to 7 in /.github/workflows (#4797) * Bump docker/build-push-action from 5 to 6 in /.github/workflows (#4800) * Actions: Semgrep Images have moved from returntocorp to semgrep (#4774) https://hub.docker.com/r/returntocorp/semgrep notes: "We've moved! Official Docker images for Semgrep now available at semgrep/semgrep." Patch updates our CI workflow for these images. Co-authored-by: Ben Meadors <benmmeadors@gmail.com> * Bump meshtestic from `31ee3d9` to `37245b3` (#4799) Bumps [meshtestic](https://github.com/meshtastic/meshTestic) from `31ee3d9` to `37245b3`. - [Commits](https://github.com/meshtastic/meshTestic/compare/31ee3d90c8bef61e835c3271be2c7cda8c4a5cc2...37245b3d612a9272f546bbb092837bafdad46bc2) --- updated-dependencies: - dependency-name: meshtestic dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [create-pull-request] automated change (#4789) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Bump pnpm/action-setup from 2 to 4 in /.github/workflows (#4798) Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 2 to 4. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v2...v4) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Raspberry Pico2 - needs protos * Re-order doDeepSleep (#4802) Make sure PMU sleep takes place before I2C ends * [create-pull-request] automated change * heltec-wireless-bridge requires Proto PR first * feat: trigger class update when protobufs are changed * meshtastic/ is a test suite; protobufs/ contains protobufs; * Update platform-native to pick up portduino crash fix (#4807) * Hopefully extract and commit to meshtastic.github.io * CI fixes * [Board] DIY "t-energy-s3_e22" (#4782) * New variant "t-energy-s3_e22" - Lilygo T-Energy-S3 - NanoVHF "Mesh-v1.06-TTGO-T18" board - Ebyte E22 Series * add board_level = extra * Update variant.h --------- Co-authored-by: Thomas Göttgens <tgoettgens@gmail.com> Co-authored-by: Tom Fifield <tom@tomfifield.net> * Consolidate variant build steps (#4806) * poc: consolidate variant build steps * use build-variant action * only checkout once and clean up after run * Revert "Consolidate variant build steps (#4806)" (#4816) This reverts commit 9f8d86cb25. * Make Ublox code more readable (#4727) * Simplify Ublox code Ublox comes in a myriad of versions and settings. Presently our configuration code does a lot of branching based on versions being or not being present. This patch adds version detection earlier in the piece and branches on the set gnssModel instead to create separate setup methods for Ublox 6, Ublox 7/8/9, and Ublox10. Additionally, adds a macro to make the code much shorter and more readable. * Make trunk happy * Make trunk happy --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com> * Consider the LoRa header when checking packet length * Minor fix (#4666) * Minor fixes It turns out setting a map value with the index notation causes an lookup that can be avoided with emplace. Apply this to one line in the StoreForward module. Fix also Cppcheck-determined highly minor performance increase by passing gpiochipname as a const reference :) The amount of cycles used on this laptop while learning about these callouts from cppcheck is unlikely to ever be more than the cycles saved by the fixes ;) * Update PortduinoGlue.cpp * Revert "Update classes on protobufs update" (#4824) * Revert "Update classes on protobufs update" * remove quotes to fix trunk. --------- Co-authored-by: Tom Fifield <tom@tomfifield.net> * Implement optional second I2C bus for NRF52840 Enabled at compile-time if WIRE_INFERFACES_COUNT defined as 2 * Add I2C bus to Heltec T114 header pins SDA: P0.13 SCL: P0.16 Uses bus 1, leaving bus 0 routed to the unpopulated footprint for the RTC (general future-proofing) * Tidier macros * Swap SDA and SCL SDA=P0.16, SCL=P0.13 * Refactor and consolidate time window logic (#4826) * Refactor and consolidate windowing logic * Trunk * Fixes * More * Fix braces and remove unused now variables. There was a brace in src/mesh/RadioLibInterface.cpp that was breaking compile on some architectures. Additionally, there were some brace errors in src/modules/Telemetry/AirQualityTelemetry.cpp src/modules/Telemetry/EnvironmentTelemetry.cpp src/mesh/wifi/WiFiAPClient.cpp Move throttle include in WifiAPClient.cpp to top. Add Default.h to sleep.cpp rest of files just remove unused now variables. * Remove a couple more meows --------- Co-authored-by: Tom Fifield <tom@tomfifield.net> * Rename message length headers and set payload max to 255 (#4827) * Rename message length headers and set payload max to 255 * Add MESHTASTIC_PKC_OVERHEAD * compare to MESHTASTIC_HEADER_LENGTH --------- Co-authored-by: Thomas Göttgens <tgoettgens@gmail.com> * Check for null before printing debug (#4835) * fix merge * try-fix crash * lib update: fix neighbors * fix GPIO0 mode after I2S audio * lib update: audio fix * lib update: fixes and improvements * extra * added ILI9342 (from master) * device-ui persistency * review update * fix request, add handled * fix merge issue * fix merge issue * remove newline * remove newlines from debug log * playing with locks; but needs more testing * diy mesh-tab initial files * board definition for mesh-tab (not yet used) * use DISPLAY_SET_RESOLUTION to avoid hw dependency in code * no telemetry for Indicator * 16MB partition for Indicator * 8MB partition for Indicator * stability: add SPI lock before saving via littleFS * dummy for config transfer (#5154) * update indicator (due to compile and linker errors) * remove faulty partition line * fix missing include * update indicator board * update mesh-tab ILI9143 TFT * fix naming * mesh-tab targets * try: disable duplicate locks * fix nodeDB erase loop when free mem returns invalid value (0, -1). * upgrade toolchain for nrf52 to gcc 9.3.1 * try-fix (workaround) T-Deck audio crash * update mesh-tab tft configs * set T-Deck audio to unused 48 (mem mclk) * swap mclk to gpio 21 * update meshtab voltage divider * update mesh-tab ini * Fixed the issue that indicator device uploads via rp2040 serial port in some cases. * Fixed the issue that the touch I2C address definition was not effective. * Fixed the issue that the wifi configuration saved to RAM did not take effect. * rotation fix; added ST7789 3.2" display * dreamcatcher: assign GPIO44 to audio mclk * mesh-tab touch updates * add mesh-tab powersave as default * fix DIO1 wakeup * mesh-tab: enable alert message menu * Streamline board definitions for first tech preview. (#5390) * Streamline board definitions for first tech preview. TBD: Indicator Support * add point-of-checkin * use board/unphone.json --------- Co-authored-by: mverch67 <manuel.verch@gmx.de> * fix native targets * add RadioLib debugging options for (T-Deck) * fix T-Deck build * fix native tft targets for rpi * remove wrong debug defines * t-deck-tft button is handled in device-ui * disable default lightsleep for indicator * Windows Support - Trunk and Platformio (#5397) * Add support for GPG * Add usb device support * Add trunk.io to devcontainer * Trunk things * trunk fmt * formatting * fix trivy/DS002, checkov/CKV_DOCKER_3 * hide docker extension popup * fix trivy/DS026, checkov/CKV_DOCKER_2 * fix radioLib warnings for T-Deck target * wake screen with button only * use custom touch driver * define wake button for unphone * use board definition for mesh-tab * mesh-tab rotation upside-down * update platform native * use MESH_TAB hardware model definition * radioLib update (fix crash/assert) * reference seeed indicator fix commit arduino-esp32 * Remove unneeded file change :) * disable serial module and tcp socket api for standalone devices (#5591) * disable serial module and tcp socket api for standalone devices * just disable webserver, leave wifi available * disable socket api * mesh-tab: lower I2C touch frequency * log error when packet queue is full * add more locking for shared SPI devices (#5595) * add more locking for shared SPI devices * call initSPI before the lock is used * remove old one * don't double lock * Add missing unlock * More missing unlocks * Add locks to SafeFile, remove from `readcb`, introduce some LockGuards * fix lock in setupSDCard() * pull radiolib trunk with SPI-CS fixes * change ContentHandler to Constructor type locks, where applicable --------- Co-authored-by: mverch67 <manuel.verch@gmx.de> Co-authored-by: GUVWAF <thijs@havinga.eu> Co-authored-by: Manuel <71137295+mverch67@users.noreply.github.com> * T-Deck: revert back to lovyanGFX touch driver * T-Deck: increase allocated PSRAM by 50% * mesh-tab: streamline target definitions * update RadioLib 7.1.2 * mesh-tab: fix touch rotation 4.0 inch display * Mesh-Tab platformio: 4.0inch: increase SPI frequency to max * mesh-tab: fix rotation for 3.5 IPS capacitive display * mesh-tab: fix rotation for 3.2 IPS capacitive display * restructure device-ui library into sub-directories * preparations for generic DisplayDriverFactory * T-Deck: increase LVGL memory size * update lib * trunk fmt --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: todd-herbert <herbert.todd@gmail.com> Co-authored-by: Jason Murray <15822260+scruplelesswizard@users.noreply.github.com> Co-authored-by: Jason Murray <jason@chaosaffe.io> Co-authored-by: Tom Fifield <tom@tomfifield.net> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> Co-authored-by: Thomas Göttgens <tgoettgens@gmail.com> Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz> Co-authored-by: Austin <vidplace7@gmail.com> Co-authored-by: virgil <virgil.wang.cj@gmail.com> Co-authored-by: Mark Trevor Birss <markbirss@gmail.com> Co-authored-by: Kalle Lilja <15094562+ThatKalle@users.noreply.github.com> Co-authored-by: GUVWAF <thijs@havinga.eu> * Version this * Update platformio.ini (#6006) * tested higher speed and it works * Un-extra * Add -tft environments to the ci matrix * Exclude unphone tft for now. Something is wonky * fixed Indicator touch issue (causing IO expander issues), added more RAM * update lib * fixed Indicator touch issue (causing IO expander issues), added more RAM (#6013) * increase T-Deck PSRAM to avoid too early out-of-memory when messages fill up the storage * update device-ui lib * Fix T-Deck SD card detection (#6023) * increase T-Deck PSRAM to avoid too early out-of-memory when messages fill up the storage * fix SDCard for T-Deck; allow SPI frequency config * meshtasticd: Add X11 480x480 preset (#6020) * Littlefs per device * 2.6 update * [create-pull-request] automated change (#6037) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * InkHUD UI for E-Ink (#6034) * Decouple ButtonThread from sleep.cpp Reorganize sleep observables. Don't call ButtonThread methods inside doLightSleep. Instead, handle in class with new lightsleep Observables. * InkHUD: initial commit (WIP) Publicly discloses the current work in progress. Not ready for use. * feat: battery icon * chore: implement meshtastic/firmware #5454 Clean up some inline functions * feat: menu & settings for "jump to applet" * Remove the beforeRender pattern It hugely complicates things. If we can achieve acceptable performance without it, so much the better. * Remove previous Map Applet Needs re-implementation to work without the beforeRender pattern * refactor: reimplement map applet Doesn't require own position Doesn't require the beforeRender pattern to precalculate; now all-at-once in render Lays groundwork for fixed-size map with custom background image * feat: autoshow Allow user to select which applets (if any) should be automatically brought to foreground when they have new data to display * refactor: tidy-up applet constructors misc. jobs including: - consistent naming - move initializer-list-only constructors to header - give derived applets unique identifiers for MeshModule and OSThread logging * hotfix: autoshow always uses FAST update In future, it *will* often use FAST, but this will be controlled by a WindowManager component which has not yet been written. Hotfixed, in case anybody is attempting to use this development version on their deployed devices. * refactor: bringToForeground no longer requests FAST update In situations where an applet has moved to foreground because of user input, requestUpdate can be manually called, to upgrade to FAST refresh. More permanent solution for #23e1dfc * refactor: extract string storage from ThreadedMessageApplet Separates the code responsible for storing the limited message history, which was previously part of the ThreadedMessageApplet. We're now also using this code to store the "most recent message". Previously, this was stored in the `InkHUD::settings` struct, which was much less space-efficient. We're also now storing the latest DM, laying the foundation for an applet to display only DMs, which will complement the threaded message applet. * fix: text wrapping Attempts to fix a disparity between `Applet::printWrapped` and `Applet::getWrappedTextHeight`, which would occasionally cause a ThreadedMessageApplet message to render "too short", overlapping other text. * fix: purge old constructor This one slipped through the last commit.. * feat: DM Applet Useful in combination with the ThreadedMessageApplets, which don't show DMs * fix: applets shouldn't handle events while deactivated Only one or two applets were actually doing this, but I'm making a habit of having all applets return early from their event handling methods (as good practice), even if those methods are disabled elsewhere (e.g. not observing observable, return false from wantPacket) * refactor: allow requesting update without requesting autoshow Some applets may want to redraw, if they are displayed, but not feel the information is worth being brought to foreground for. Example: ActiveNodesApplet, when purging old nodes from list. * feat: custom "Recently Active" duration Allows users to tailor how long nodes will appear in the "Recents" applets, to suit the activity level of their mesh. * refactor: rename some applets * fix: autoshow * fix: getWrappedTextHeight Remove the "simulate" option from printWrapped; too hard to keep inline with genuine printing (because of AdafruitGFX Fonts' xAdvance, mabye?). Instead of simulating, we printWrapped as normal, and discard pixel output by setting crop. Both methods are similarly inefficient, apparently. * fix: text wrapping in ThreadedMessageApplet Wrong arguments were passed to Applet::printWrapped * feat: notifications for text messages Only shown if current applet does not already display the same info. Autoshow takes priority over notifications, if both would be used to display the same info. * feat: optimize FAST vs FULL updates New UpdateMediator class counts the number of each update type, and suggets which one to use, if the code doesn't already have an explicit prefence. Also performs "maintenance refreshes" unprovoked if display is not given an opportunity to before a FULL refresh through organic use. * chore: update todo list * fix: rare lock-up of buttons * refactor: backlight Replaces the initial proof-of-concept frontlight code for T-Echo Presses less than 5 seconds momentarily illuminate the display Presses longer than 5 seconds latch the light, requiring another tap to disable If user has previously removed the T-Echo's capacitive touch button (some DIY projects), the light is controlled by the on-screen menu. This fallback is used by all T-Echo devices, until a press of the capacitive touch button is detected. * feat: change tile with aux button Applied to VM-E290. Working as is, but a refactor of WindowManager::render is expected shortly, which will also tidy code from this push. * fix: specify out-of-the-box tile assignments Prevents placeholder applet showing on initial boot, for devices which use a mult-tile layout by default (VM-E290) * fix: verify settings version when loading * fix: wrong settings version * refactor: remove unimplemented argument from requestUpdate Specified whether or not to update "async", however the implementation was slightly broken, Applet::requestUpdate is only handled next time WindowManager::runOnce is called. This didn't allow code to actually await an update, which was misleading. * refactor: renaming Applet::render becomes Applet::onRender. Tile::displayedApplet becomes Tile::assignedApplet. New onRender method name allows us to move some of the pre and post render code from WindowManager into new Applet::render method, which will call onRender for us. * refactor: rendering Bit of a tidy-up. No intended change in behavior. * fix: optimize refresh times Shorter wait between retrying update if display was previously busy. Set anticipated update durations closer to observed values. No signifacant performance increase, but does decrease the amount of polling required. * feat: blocking update for E-Ink Option to wait for display update to complete before proceeding. Important when shutting down the device. * refactor: allow system applets to lock rendering Temporarily prevents other applets from rendering. * feat: boot and shutdown screens * feat: BluetoothStatus Adds a meshtastic::Status object which exposes the state of the Bluetooth connection. Intends to allow decoupling of UI code. * feat: Bluetooth pairing screen * fix: InkHUD defaults not honored * fix: random Bluetooth pin for NicheGraphics UIs * chore: button interrupts tested * fix: emoji reactions show as blank messages * fix: autoshow and notification triggered by outgoing message * feat: save InkHUD data before reboot Implemented with a new Observable. Previously, config and a few recent messages were saved on shutdown. These were lost if the device rebooted, for example when firmware settings were changed by a client. Now, the InkHUD config and recent messages saved on reboot, the same as during an intentional shutdown. * feat: imperial distances Controlled by the config.display.units setting * fix: hide features which are not yet implemented * refactor: faster rendering Previously, only tiles which requested update were re-rendered. Affected tiles had their region blanked before render, pixel by pixel. Benchmarking revealed that it is significantly faster to memset the framebuffer and redraw all tiles. * refactor: tile ownership Tiles and Applets now maintain a reciprocal link, which is enforced by asserts. Less confusing than the old situation, where an applet and a tile may disagree on their relationship. Empty tiles are now identified by a nullptr *Applet, instead of by having the placeholderApplet assigned. * fix: notifications and battery when menu open Do render notifications in front of menu; don't render battery icon in front of menu. * fix: simpler defaults Don't expose new users to multiplexed applets straight away: make them enable the feature for themselves. * fix: Inputs::TwoButton interrupts, when only one button in use * fix: ensure display update is complete when ESP32 enters light sleep Many panels power down automatically, but some require active intervention from us. If light sleep (ESP32) occurs during a display update, these panels could potentially remain powered on, applying voltage the pixels for an extended period of time, and potentially damaging the display. * fix: honor per-variant user tile limit Set as the default value for InkHUD::settings.userTiles.maxCount in nicheGraphics.h * feat: initial InkHUD support for Wireless Paper v1.1 and VM-E213 * refactor: Heard and Recents Applets Tidier code, significant speed boost. Possibly no noticable change in responsiveness, but rendering now spends much less time blocking execution, which is important for correction functioning of the other firmware components. * refactor: use a common pio base config Easier to make any future PlatformIO config changes * feat: tips Show information that we think the user might find helpful. Some info shown first boot only. Other info shown when / if relevant. * fix: text wrapping for '\n' Previously, the newline was honored, but the adojining word was not printed. * Decouple ButtonThread from sleep.cpp Reorganize sleep observables. Don't call ButtonThread methods inside doLightSleep. Instead, handle in class with new lightsleep Observables. * feat: BluetoothStatus Adds a meshtastic::Status object which exposes the state of the Bluetooth connection. Intends to allow decoupling of UI code. * feat: observable for reboot * refactor: Heltec VM-E290 installDefaultConfig * fix: random Bluetooth pin for NicheGraphics UIs * update device-ui: fix touch/crash issue while light sleep * Collect inkhud * fix: InkHUD shouldn't nag about timezone (#6040) * Guard eink drivers w/ MESHTASTIC_INCLUDE_NICHE_GRAPHICS * Case sensitive perhaps? * More case-sensitivity instances * Moar * RTC * Yet another case issue! * Sigh... * MUI: BT programming mode (#6046) * allow BT connection with disabled MUI * Update device-ui --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com> * MUI: fix nag timeout, disable BT programming mode for native (#6052) * allow BT connection with disabled MUI * Update device-ui * MUI: fix nag timeout default and remove programming mode for native --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com> * remove debuglog leftover * Wireless Paper: remove stray board_level = extra (#6060) Makes sure the InkHUD version gets build into the release zip * Fixed persistence stragglers from NodeDB / Device State divorce (#6059) * Increase `MAX_THREADS` for InkHUD variants with WiFi (#6064) * Licensed usage compliance (#6047) * Prevent psk and legacy admin channel on licensed mode * Move it * Consolidate warning strings * More holes * Device UI submodule bump * Prevent licensed users from rebroadcasting unlicensed traffic (#6068) * Prevent licensed users from rebroadcasting unlicensed traffic * Added method and enum to make user license status more clear * MUI: move UI initialization out of main.cpp and adding lightsleep observer + mutex (#6078) * added device-ui to lightSleep observers for handling graceful sleep; refactoring main.cpp * bump lib version * Update device-ui * unPhone TFT: include into build, enable SD card, increase PSRAM (#6082) * unPhone-tft: include into build, enable SD card, increase assigned PSRAM * lib update * Backup / migrate pub private keys when upgrading to new files in 2.6 (#6096) * Save a backup of pub/private keys before factory reset * Fix licensed mode warning * Unlock spi on else file doesn't exist * Update device-ui * Update protos and device-ui * [create-pull-request] automated change (#6129) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Proto * [create-pull-request] automated change (#6131) * Proto update for backup * [create-pull-request] automated change (#6133) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Update protobufs * Space * [create-pull-request] automated change (#6144) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Protos * [create-pull-request] automated change (#6152) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com> * Updeet * device-ui lib update * fix channel OK button * device-lib update: fix settings panel -> no scrolling * device-ui lib: last minute update * defined(SENSECAP_INDICATOR) * MUI hot-fix pub/priv keys * MUI hot-fix username dialog * MUI: BT programming mode button * Update protobufs --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: GUVWAF <78759985+GUVWAF@users.noreply.github.com> Co-authored-by: GUVWAF <thijs@havinga.eu> Co-authored-by: Thomas Göttgens <tgoettgens@gmail.com> Co-authored-by: Tom Fifield <tom@tomfifield.net> Co-authored-by: mverch67 <manuel.verch@gmx.de> Co-authored-by: Manuel <71137295+mverch67@users.noreply.github.com> Co-authored-by: todd-herbert <herbert.todd@gmail.com> Co-authored-by: Jason Murray <15822260+scruplelesswizard@users.noreply.github.com> Co-authored-by: Jason Murray <jason@chaosaffe.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz> Co-authored-by: Austin <vidplace7@gmail.com> Co-authored-by: virgil <virgil.wang.cj@gmail.com> Co-authored-by: Mark Trevor Birss <markbirss@gmail.com> Co-authored-by: Kalle Lilja <15094562+ThatKalle@users.noreply.github.com> Co-authored-by: rcarteraz <robert.l.carter2@gmail.com>	2025-03-01 06:18:33 -06:00
GUVWAF	f4b0e19a65	Fix another heap leak (#5328)	2024-11-12 10:59:29 -06:00
Ben Meadors	f769c50fa5	More reduction (#5256) ... * Now with even fewer ings * Ye * Mo * QMA6100PSensor	2024-11-04 19:15:59 -06:00
Ben Meadors	50dac38a1b	Pass#2: Lots more savings in logs and string reduction surgery (#5251) ... * Pass#2: Lots more savings in logs and string reduction surgery * Don't need Thread suffix either * Warn	2024-11-04 12:16:25 -06:00
GUVWAF	da7424a604	Improve ACK logic for responses and repeated packets (#5232) ... * Don't send ACKs to responses over multiple hops * Move repeated sending logic to `wasSeenRecently()` * Add exception for simulator for duplicate packets from PhoneAPI * Add short debug message	2024-11-03 06:21:45 -06:00
Technologyman00	bee474ee54	Spell check all Code (#5228) ... * Spelling Fixes * More Spelling Errors * More Spelling Checks * fixed wording * Undo mesh\generated changes * Missed one file on readd * missed second file	2024-11-03 09:25:05 +08:00
Thomas GöttgensandBen Meadors	05e4a639a1	remove newline from logging statements. (#5022) ... remove newline from logging statements in code. The LOG_* functions will now magically add it at the end. --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2024-10-14 15:11:43 +11:00
GUVWAF	673fe294f3	Add rxDupe, txRelay and txRelayCanceled to LocalStats (#4936) ... * Introduce `isFromUs()` and `isToUs()` * Add rxDupe, txRelay and txRelayCanceled to LocalStats	2024-10-04 06:28:51 -05:00
Ben MeadorsandGUVWAF	18f12584ab	Consolidate and shrink down the re-used strings in logs (#4907) ... * Consolidate and shrink down the re-used strings in GPS * Condense all the things --------- Co-authored-by: GUVWAF <thijs@havinga.eu>	2024-10-01 15:38:36 -05:00
Jonathan Bennett	5bc17a9911	Key regen and MQTT fix (#4585) ... * Add public key regen * Properly label and handle PKI MQTT packets * Extra debug message to indicate PKI_UNKNOWN_PUBKEY * Ternary! * Don't call non-existant function on stm32 * Actually fix STM32 compilation	2024-08-29 16:28:03 -05:00
Jonathan Bennett	f439081674	Don't segfault on PKI from unknown nodes	2024-08-18 14:11:39 -05:00
Jonathan Bennett	8ef72a5c08	Shorter nodeinfo timeout redux (#4458) ... * Add shorterTimeout bool to sendOurNodeInfo * Respond to likely PKI decode errors with a quick nodeinfo * Protbufs * Move to PKI_UNKNOWN_PUBKEY for PKI decode error	2024-08-14 17:17:53 -05:00
Jonathan Bennett	f3fa8daedf	Revert "Add Routing_Error_NONE" ... This reverts commit e1985fa0f9.	2024-08-13 18:45:40 -05:00
Jonathan Bennett	308c0a6bb8	Add Routing_Error_NONE	2024-08-13 18:45:40 -05:00
Ben MeadorsandJonathan Bennett	59cc57fc29	Event mode: Enforce reliable hop limit and disallow default public MQTT (#4343) ... * Event mode: Enforce reliable hop limit * Event mode: Short circuit wantsLink on MQTT for default broker address * Just enforce at channels level since everything uses this * For events never forward packets with excessive hop_limit * In EVENT_MODE, don't respond with hop_limit set more then the configured max. * Correct hop_start when correcting hop_limit in event mode. * Make EVENT_MODE work from userPrefs.h * Event mode: Disallow Router or Repeater roles --------- Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>	2024-07-29 20:16:47 -05:00
Jonathan BennettandBen Meadors	dfcd0d14f6	Add MaxNodes to Native config (#3427) ... * Add MaxNodes to Native * It compiles... * Convert nodedb to use new * Closer but still broken. * Finally working * Remove unintended lines * Don't include a pointer * Capitalization matters. * avoid rename in protocol regen * When trimming the nodeDB, start with a cleanup * Remove extra cleanupMeshDB() call for now --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2024-03-21 09:06:37 -05:00
Manuel	e16689a0d6	fix heap use after delete (#3373)	2024-03-11 12:45:59 -05:00
GUVWAFandBen Meadors	585805c3b9	Add original hop limit to header to determine hops used (#3321) ... * Set `hop_start` in header to determine how many hops each packet traveled * Set hopLimit of response according to hops used by request * Identify neighbors based on `hopStart` and `hopLimit` * NeighborInfo: get all packets and assume a default broadcast interval * Add fail-safe in case node in between is running modified firmware * Add `viaMQTT` and `hopsAway` to NodeInfo * Replace `HOP_RELIABLE` with hopStart for repeated packet --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2024-03-08 07:13:57 -06:00
GUVWAFandBen Meadors	bcbc2f229d	Only cancel packet in Tx queue if it was already sent out via LoRa (#3191) ... To avoid canceling a transmission if it was already ACKed via MQTT Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2024-02-09 17:36:16 -06:00
IhorNehrutsa	9c683f4c87	Fix LOG_DEBUG messages when no DEBUG_PORT. (#2485) ... * Fix LOG_DEBUG messages when no DEBUG_PORT. * Fix LOG_DEBUG messages when no DEBUG_PORT. * Fix LOG_DEBUG messages when no DEBUG_PORT. * Fix LOG_DEBUG messages when no DEBUG_PORT.	2023-05-13 05:33:14 -05:00
Manuel	1f99d4756a	Fix: Sporadig crashes and reboot (#2366) ... * Fix: Sporadig crashes with reboot * Revert "Fix: Sporadig crashes with reboot" This reverts commit 59b65749f5. * Fix: Sporadig crashes and reboot	2023-03-17 19:53:29 -05:00
GUVWAFandBen Meadors	408c555f0f	Add airtime of current received/transmitted packet to nextTx time of all pending retransmissions (#2309) ... To avoid unnecessary retransmissions when sending them too early Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2023-02-25 19:51:38 -06:00
Thomas Göttgens	d830398fc5	Check if there's something there before we free it	2023-02-21 20:01:56 +01:00
Thomas Göttgens	2e80a4ed87	tryfix #2228 as suggested by @mverch67	2023-02-21 14:53:27 +01:00
Thomas Göttgens	6fdb93cd16	re-add namespacing in protobufs. Let's see what i missed. Portduino likely ... ... Checking in generated on purpose.	2023-01-21 21:23:24 +01:00