ArduPilot / ArduPilot/MissionPlanner
Message Signing and Timestamp Rejection Possibly out of spec
- Dominant language
- C#
- Stars
- 2.4k
- Forks
- 2.9k
- Avg merge
- 19h 16m
- Merged PRs (30d)
- 4
Description
#### Issue details
_Please describe the problem, or desired feature_
It appears that MissionPlanner may be handling timestamps on signed messages from peripheral devices slightly out of spec. It seems to have to do with accepting timestamps on a single link and the same system id, by two different components. The spec says: "The timestamp on incoming signed messages should be checked against the previous timestamp for the incoming (linkID,srcSystem,SrcComponent) tuple and the message rejected if it is smaller." The issue has to do with this tuple and the definition of SrcComponent. Certain timestamps appear to be improperly rejected.
The scenario involves a three component system attached in series. The GCS connected to the FCS connected to the OBC. In this setup, the following scenario seem to function as expected: (1) GCS and OBC are signing and the FCS is not. Signed messages are received by the OBC and unsigned messages are accepted from the FCS. If the FCS is signing and the OBC is not, the messages appear to be rejected. It looks like the GCS is interpreting the SETUP_SIGNING command to apply to all components on a given system id and link, even if only the autopilot component is specified in the target. I am not sure if this is spec behavior or not. In my system, the OBC ignores a SETUP_SIGNING command which it is not specified as the target compid.
However the scenario that seems out of spec is when all three systems are signing. In this case, MissionPlanner seems to reject properly signed messages if the timestamps between these two components on the same link are not synchronized. In fact, even synchonizing does not seem to always work. It appears that MissionPlanner may be expecting UTC or rejecting messages smaller than some threshold?
The latter is speculation based on the following behavior. The OBC does not have an RTC. If it receives a system time message, the time is synchronized and the scenario above seems to work okay. However, the autopilot only sends system time messages once the GPS link is established. The OBC cannot store previously acquired UTC because of issues with persistent storage specs.
The workaround has been to synchronize the OBC utc baseline with the incoming GCS timestamps. Basically approximate the UTC as the last timestamp received. Everything appears to function correctly, but it doesn't seem this is necessary according to spec. The OBC should be able to use the internal cpu clock until it acquires a valid UTC (which is greater) because the (sysid, obc compid, and link) tuple would be unique for that sequence, regardless of starting point. When the UTC comes in, it advances the timestamps.
#### Version
_What version was the issue encountered with_
1.3.79
#### Platform
[ ] All
[ ] AntennaTracker
[x ] Copter
[ ] Plane
[ ] Rover
[ ] Sub
#### Airframe type
_What type of airframe (flying wing, glider, hex, Y6, octa etc)_
X Quad
#### Hardware type
_What autopilot hardware was used? (pixhawk, pixracer, PX4FMU etc)_
px4 fmuv5
#### Logs
_Please provide a link to any relevant logs that show the issue_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the three-component signed-message scenario described for Mission Planner 1.3.79, comparing timestamp handling for each (linkID, srcSystem, srcComponent) tuple with the quoted specification. Done means determining whether properly signed messages from distinct components are rejected without UTC synchronization and documenting a reproducible result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100