kevin/meshtastic_firmware
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

Merge pull request #11148 from NomDeTom/flash-clawback

Browse Source 
claw back some space from signing policies
This commit is contained in:
Ben Meadors
2026-07-22 08:54:23 -05:00
committed by GitHub
co-authored by GitHub
parent f90c1340de 583248c19d
commit 9662c818b5
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mesh/Router.cpp
+8 -6
View File
@@ -70,8 +70,8 @@ static uint8_t bytes[MAX_LORA_PAYLOAD_LEN + 1] __attribute__((__aligned__));
struct RoutingAuthCache { struct RoutingAuthCache {
bool valid = false; bool valid = false;
meshtastic_Config_SecurityConfig_PacketSignaturePolicy policy = // Deliberately NOT initialized in-class as this eats flash space.
meshtastic_Config_SecurityConfig_PacketSignaturePolicy_PACKET_SIGNATURE_POLICY_BALANCED; meshtastic_Config_SecurityConfig_PacketSignaturePolicy policy;
meshtastic_MeshPacket wire = meshtastic_MeshPacket_init_zero; meshtastic_MeshPacket wire = meshtastic_MeshPacket_init_zero;
meshtastic_MeshPacket authenticated = meshtastic_MeshPacket_init_zero; meshtastic_MeshPacket authenticated = meshtastic_MeshPacket_init_zero;
}; };
@@ -161,6 +161,8 @@ Router::Router() : concurrency::OSThread("Router"), fromRadioQueue(MAX_RX_FROMRA
cryptLock = new concurrency::Lock(); cryptLock = new concurrency::Lock();
if (!routingAuthCacheLock) if (!routingAuthCacheLock)
routingAuthCacheLock = new concurrency::Lock(); routingAuthCacheLock = new concurrency::Lock();
// Runtime default for the auth-cache snapshot policy. Keep it here, saves flash.
routingAuthCache.policy = meshtastic_Config_SecurityConfig_PacketSignaturePolicy_PACKET_SIGNATURE_POLICY_BALANCED;
} }
bool Router::shouldDecrementHopLimit(const meshtastic_MeshPacket *p) bool Router::shouldDecrementHopLimit(const meshtastic_MeshPacket *p)
@@ -705,7 +707,7 @@ RoutingAuthVerdict passesRoutingAuthGate(meshtastic_MeshPacket *p)
#if !(MESHTASTIC_EXCLUDE_PKI) && !(MESHTASTIC_EXCLUDE_XEDDSA) #if !(MESHTASTIC_EXCLUDE_PKI) && !(MESHTASTIC_EXCLUDE_XEDDSA)
concurrency::LockGuard g(cryptLock); concurrency::LockGuard g(cryptLock);
if (!checkXeddsaReceivePolicy(&authCandidate)) { if (!checkXeddsaReceivePolicy(&authCandidate)) {
LOG_WARN("Already-decoded packet rejected by signature policy before routing state update"); LOG_WARN("Already-decoded packet rejected by signature policy");
return RoutingAuthVerdict::REJECT; return RoutingAuthVerdict::REJECT;
} }
#endif #endif
@@ -716,15 +718,15 @@ RoutingAuthVerdict passesRoutingAuthGate(meshtastic_MeshPacket *p)
} }
const DecodeState state = perhapsDecode(&authCandidate); const DecodeState state = perhapsDecode(&authCandidate);
if (state == DecodeState::DECODE_POLICY_REJECT) { if (state == DecodeState::DECODE_POLICY_REJECT) {
LOG_WARN("Packet rejected by signature policy before routing state update"); LOG_WARN("Packet rejected by signature policy");
return RoutingAuthVerdict::REJECT; return RoutingAuthVerdict::REJECT;
} }
if (state == DecodeState::DECODE_FATAL) { if (state == DecodeState::DECODE_FATAL) {
LOG_WARN("Fatal decode error before routing state update"); LOG_WARN("Fatal decode error, dropping packet");
return RoutingAuthVerdict::REJECT; return RoutingAuthVerdict::REJECT;
} }
if (state == DecodeState::DECODE_FAILURE) { if (state == DecodeState::DECODE_FAILURE) {
LOG_WARN("Decryptable packet failed decoding/authentication before routing state update"); LOG_WARN("Decryptable packet failed decoding, dropping packet");
return RoutingAuthVerdict::REJECT; return RoutingAuthVerdict::REJECT;
} }