Merge upstream dev fixes

Include anonymous-request reply-path bounds validation and the upstream ThinkNode M6 GPS REINIT fix.

examples/simple_repeater/MyMesh.cpp

@@ -481,11 +481,10 @@ static int cmp_neighbours_weakest_to_strongest(const void* a, const void* b) {
 uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
   if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
     // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding
 
-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
     // data += (uint8_t)reply_path_len * reply_path_hash_size;
 
     memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -500,11 +499,10 @@ uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t send
 uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
   if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
     // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding
 
-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
     // data += (uint8_t)reply_path_len * reply_path_hash_size;
 
     memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -520,11 +518,10 @@ uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender
 uint8_t MyMesh::handleAnonClockReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
   if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
     // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding
 
-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
     // data += (uint8_t)reply_path_len * reply_path_hash_size;
 
     memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -2333,7 +2330,7 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m
     data[len] = 0;  // ensure null terminator
     uint8_t reply_len;
 
-    reply_path_len = -1;
+    reply_path_len = 0xFF;
     if (data[4] == 0 || data[4] >= ' ') {   // is password, ie. a login request
       reply_len = handleLoginReq(sender, secret, timestamp, &data[4], packet->isRouteFlood());
     } else if (data[4] == ANON_REQ_TYPE_REGIONS && packet->isRouteDirect()) {
@@ -2353,13 +2350,12 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m
       mesh::Packet* path = createPathReturn(sender, secret, packet->path, packet->path_len,
                                             PAYLOAD_TYPE_RESPONSE, reply_data, reply_len);
       if (path) sendFloodReply(path, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
-    } else if (reply_path_len < 0) {
+    } else if (reply_path_len == 0xFF) {
       mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
       if (reply) sendFloodReply(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
     } else {
       mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
-      uint8_t path_len = ((reply_path_hash_size - 1) << 6) | (reply_path_len & 63);
-      if (reply) sendDirect(reply, reply_path,  path_len, SERVER_RESPONSE_DELAY);
+      if (reply) sendDirect(reply, reply_path, reply_path_len, SERVER_RESPONSE_DELAY);
     }
   }
 }

examples/simple_repeater/MyMesh.h

@@ -242,8 +242,7 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks
 #endif
   uint8_t reply_data[MAX_PACKET_PAYLOAD];
   uint8_t reply_path[MAX_PATH_SIZE];
-  int8_t  reply_path_len;
-  uint8_t reply_path_hash_size;
+  uint8_t reply_path_len;
   TransportKeyStore key_store;
   RegionMap region_map, temp_map;
   RegionEntry* load_stack[8];

variants/thinknode_m6/variant.cpp

@@ -32,6 +32,6 @@ void initVariant() {
   digitalWrite(PIN_GPS_EN, HIGH);
   // PIN_GPS_RESET (pin 29 / REINIT) is intentionally left floating (input).
   // Driving it HIGH holds the L76K silent, so it never streams NMEA and the
-  // firmware reports "no GPS". Letting it float lets the module run.
-  // See GPS_RESET (-1) in variant.h.
+  // firmware reports "no GPS". Letting it float lets the module run, matching
+  // the Meshtastic M6 variant. See GPS_RESET (-1) in variant.h.
 }

variants/thinknode_m6/variant.h

@@ -102,12 +102,11 @@
 #define PIN_GPS_RX              (2)
 #define PIN_GPS_TX              (3)
 #define PIN_GPS_EN              (6)    // EN
-// The L76K REINIT pad must float during normal operation.  Driving GPIO29 as
-// a reset line leaves some M6 units unable to acquire or retain a fix.
 #define PIN_GPS_RESET           (29)   // REINIT - must FLOAT; driving it (esp. HIGH) silences the L76K
 // The M6's L76K streams NMEA on its own and must not have its REINIT pin driven.
 // Tell the location provider there is no reset pin so it never touches pin 29
-// (driving it HIGH holds the module silent).
+// (driving it HIGH holds the module silent). Matches Meshtastic, which leaves
+// this pin as an input. See variant.cpp (pin 29 is intentionally not configured).
 #define GPS_RESET               (-1)
 #define PIN_GPS_STANDBY         (30)   // STANDBY
 #define PIN_GPS_PPS             (31)