Update protobufs and classes

src/mesh/generated/meshtastic/admin.pb.cpp

@@ -15,6 +15,9 @@ PB_BIND(meshtastic_AdminMessage_InputEvent, meshtastic_AdminMessage_InputEvent,
 PB_BIND(meshtastic_AdminMessage_OTAEvent, meshtastic_AdminMessage_OTAEvent, AUTO)
 
 
+PB_BIND(meshtastic_LockdownAuth, meshtastic_LockdownAuth, AUTO)
+
+
 PB_BIND(meshtastic_HamParameters, meshtastic_HamParameters, AUTO)
 
 

src/mesh/generated/meshtastic/admin.pb.h

@@ -130,6 +130,41 @@ typedef struct _meshtastic_AdminMessage_OTAEvent {
     meshtastic_AdminMessage_OTAEvent_ota_hash_t ota_hash;
 } meshtastic_AdminMessage_OTAEvent;
 
+typedef PB_BYTES_ARRAY_T(32) meshtastic_LockdownAuth_passphrase_t;
+/* Lockdown passphrase delivery payload.
+
+ One message handles three operations distinguished by content:
+   - Provision (first-time): passphrase set, lock_now=false. Firmware
+     generates DEK, wraps with passphrase-derived KEK, persists.
+   - Unlock: passphrase set, lock_now=false. Firmware verifies
+     passphrase against stored DEK, unlocks storage, authorizes the
+     connection that delivered this packet.
+   - Lock now: lock_now=true, passphrase ignored. Firmware revokes
+     all client auth and reboots into the locked state.
+
+ Firmware decides between provision and unlock based on its own state
+ (whether a DEK file already exists). Clients do not need to track
+ which case applies. */
+typedef struct _meshtastic_LockdownAuth {
+    /* Passphrase bytes (1-32). Empty when lock_now is true.
+ Capped to 32 to match the proto cap on related security fields. */
+    meshtastic_LockdownAuth_passphrase_t passphrase;
+    /* Optional override of the boot-count token TTL granted on success.
+ 0 = use firmware default (TOKEN_DEFAULT_BOOTS).
+ On reboot the firmware decrements this; when it reaches 0 the
+ device boots fully locked and requires a fresh passphrase. */
+    uint32_t boots_remaining;
+    /* Optional wall-clock expiry for the unlock token, as absolute
+ Unix-epoch seconds. 0 = no time limit (only the boot-count TTL
+ applies). On boot, if the device RTC is set and now > this value,
+ the token is treated as expired. */
+    uint32_t valid_until_epoch;
+    /* If true, ignore passphrase fields, immediately revoke all
+ connection-level admin authorization, and reboot the device into
+ the locked state. Always honoured regardless of current lock state. */
+    bool lock_now;
+} meshtastic_LockdownAuth;
+
 /* Parameters for setting up Meshtastic for ameteur radio usage */
 typedef struct _meshtastic_HamParameters {
     /* Amateur radio call sign, eg. KD2ABC */
@@ -384,6 +419,15 @@ typedef struct _meshtastic_AdminMessage {
         meshtastic_AdminMessage_OTAEvent ota_request;
         /* Parameters and sensor configuration */
         meshtastic_SensorConfig sensor_config;
+        /* Lockdown passphrase delivery / unlock / lock-now command for hardened
+     firmware builds (see MESHTASTIC_LOCKDOWN). Used to provision the
+     passphrase on first boot, unlock encrypted storage on subsequent
+     reboots, re-verify on already-unlocked devices to authorize a new
+     client connection, or immediately re-lock the device.
+
+     Replaces the earlier scheme that repurposed SecurityConfig.private_key
+     to carry passphrase bytes; that hack is retired. */
+        meshtastic_LockdownAuth lockdown_auth;
     };
     /* The node generates this key and sends it with any get_x_response packets.
  The client MUST include the same key with any set_x commands. Key expires after 300 seconds.
@@ -429,6 +473,7 @@ extern "C" {
 
 
 
+
 #define meshtastic_KeyVerificationAdmin_message_type_ENUMTYPE meshtastic_KeyVerificationAdmin_MessageType
 
 
@@ -441,6 +486,7 @@ extern "C" {
 #define meshtastic_AdminMessage_init_default     {0, {0}, {0, {0}}}
 #define meshtastic_AdminMessage_InputEvent_init_default {0, 0, 0, 0}
 #define meshtastic_AdminMessage_OTAEvent_init_default {_meshtastic_OTAMode_MIN, {0, {0}}}
+#define meshtastic_LockdownAuth_init_default     {{0, {0}}, 0, 0, 0}
 #define meshtastic_HamParameters_init_default    {"", 0, 0, ""}
 #define meshtastic_NodeRemoteHardwarePinsResponse_init_default {0, {meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default}}
 #define meshtastic_SharedContact_init_default    {0, false, meshtastic_User_init_default, 0, 0}
@@ -453,6 +499,7 @@ extern "C" {
 #define meshtastic_AdminMessage_init_zero        {0, {0}, {0, {0}}}
 #define meshtastic_AdminMessage_InputEvent_init_zero {0, 0, 0, 0}
 #define meshtastic_AdminMessage_OTAEvent_init_zero {_meshtastic_OTAMode_MIN, {0, {0}}}
+#define meshtastic_LockdownAuth_init_zero        {{0, {0}}, 0, 0, 0}
 #define meshtastic_HamParameters_init_zero       {"", 0, 0, ""}
 #define meshtastic_NodeRemoteHardwarePinsResponse_init_zero {0, {meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero}}
 #define meshtastic_SharedContact_init_zero       {0, false, meshtastic_User_init_zero, 0, 0}
@@ -470,6 +517,10 @@ extern "C" {
 #define meshtastic_AdminMessage_InputEvent_touch_y_tag 4
 #define meshtastic_AdminMessage_OTAEvent_reboot_ota_mode_tag 1
 #define meshtastic_AdminMessage_OTAEvent_ota_hash_tag 2
+#define meshtastic_LockdownAuth_passphrase_tag   1
+#define meshtastic_LockdownAuth_boots_remaining_tag 2
+#define meshtastic_LockdownAuth_valid_until_epoch_tag 3
+#define meshtastic_LockdownAuth_lock_now_tag     4
 #define meshtastic_HamParameters_call_sign_tag   1
 #define meshtastic_HamParameters_tx_power_tag    2
 #define meshtastic_HamParameters_frequency_tag   3
@@ -560,6 +611,7 @@ extern "C" {
 #define meshtastic_AdminMessage_nodedb_reset_tag 100
 #define meshtastic_AdminMessage_ota_request_tag  102
 #define meshtastic_AdminMessage_sensor_config_tag 103
+#define meshtastic_AdminMessage_lockdown_auth_tag 104
 #define meshtastic_AdminMessage_session_passkey_tag 101
 
 /* Struct field encoding specification for nanopb */
@@ -621,7 +673,8 @@ X(a, STATIC,   ONEOF,    INT32,    (payload_variant,factory_reset_config,factory
 X(a, STATIC,   ONEOF,    BOOL,     (payload_variant,nodedb_reset,nodedb_reset), 100) \
 X(a, STATIC,   SINGULAR, BYTES,    session_passkey, 101) \
 X(a, STATIC,   ONEOF,    MESSAGE,  (payload_variant,ota_request,ota_request), 102) \
-X(a, STATIC,   ONEOF,    MESSAGE,  (payload_variant,sensor_config,sensor_config), 103)
+X(a, STATIC,   ONEOF,    MESSAGE,  (payload_variant,sensor_config,sensor_config), 103) \
+X(a, STATIC,   ONEOF,    MESSAGE,  (payload_variant,lockdown_auth,lockdown_auth), 104)
 #define meshtastic_AdminMessage_CALLBACK NULL
 #define meshtastic_AdminMessage_DEFAULT NULL
 #define meshtastic_AdminMessage_payload_variant_get_channel_response_MSGTYPE meshtastic_Channel
@@ -644,6 +697,7 @@ X(a, STATIC,   ONEOF,    MESSAGE,  (payload_variant,sensor_config,sensor_config)
 #define meshtastic_AdminMessage_payload_variant_key_verification_MSGTYPE meshtastic_KeyVerificationAdmin
 #define meshtastic_AdminMessage_payload_variant_ota_request_MSGTYPE meshtastic_AdminMessage_OTAEvent
 #define meshtastic_AdminMessage_payload_variant_sensor_config_MSGTYPE meshtastic_SensorConfig
+#define meshtastic_AdminMessage_payload_variant_lockdown_auth_MSGTYPE meshtastic_LockdownAuth
 
 #define meshtastic_AdminMessage_InputEvent_FIELDLIST(X, a) \
 X(a, STATIC,   SINGULAR, UINT32,   event_code,        1) \
@@ -659,6 +713,14 @@ X(a, STATIC,   SINGULAR, BYTES,    ota_hash,          2)
 #define meshtastic_AdminMessage_OTAEvent_CALLBACK NULL
 #define meshtastic_AdminMessage_OTAEvent_DEFAULT NULL
 
+#define meshtastic_LockdownAuth_FIELDLIST(X, a) \
+X(a, STATIC,   SINGULAR, BYTES,    passphrase,        1) \
+X(a, STATIC,   SINGULAR, UINT32,   boots_remaining,   2) \
+X(a, STATIC,   SINGULAR, UINT32,   valid_until_epoch,   3) \
+X(a, STATIC,   SINGULAR, BOOL,     lock_now,          4)
+#define meshtastic_LockdownAuth_CALLBACK NULL
+#define meshtastic_LockdownAuth_DEFAULT NULL
+
 #define meshtastic_HamParameters_FIELDLIST(X, a) \
 X(a, STATIC,   SINGULAR, STRING,   call_sign,         1) \
 X(a, STATIC,   SINGULAR, INT32,    tx_power,          2) \
@@ -737,6 +799,7 @@ X(a, STATIC,   OPTIONAL, UINT32,   set_accuracy,      1)
 extern const pb_msgdesc_t meshtastic_AdminMessage_msg;
 extern const pb_msgdesc_t meshtastic_AdminMessage_InputEvent_msg;
 extern const pb_msgdesc_t meshtastic_AdminMessage_OTAEvent_msg;
+extern const pb_msgdesc_t meshtastic_LockdownAuth_msg;
 extern const pb_msgdesc_t meshtastic_HamParameters_msg;
 extern const pb_msgdesc_t meshtastic_NodeRemoteHardwarePinsResponse_msg;
 extern const pb_msgdesc_t meshtastic_SharedContact_msg;
@@ -751,6 +814,7 @@ extern const pb_msgdesc_t meshtastic_SHTXX_config_msg;
 #define meshtastic_AdminMessage_fields &meshtastic_AdminMessage_msg
 #define meshtastic_AdminMessage_InputEvent_fields &meshtastic_AdminMessage_InputEvent_msg
 #define meshtastic_AdminMessage_OTAEvent_fields &meshtastic_AdminMessage_OTAEvent_msg
+#define meshtastic_LockdownAuth_fields &meshtastic_LockdownAuth_msg
 #define meshtastic_HamParameters_fields &meshtastic_HamParameters_msg
 #define meshtastic_NodeRemoteHardwarePinsResponse_fields &meshtastic_NodeRemoteHardwarePinsResponse_msg
 #define meshtastic_SharedContact_fields &meshtastic_SharedContact_msg
@@ -768,6 +832,7 @@ extern const pb_msgdesc_t meshtastic_SHTXX_config_msg;
 #define meshtastic_AdminMessage_size             511
 #define meshtastic_HamParameters_size            31
 #define meshtastic_KeyVerificationAdmin_size     25
+#define meshtastic_LockdownAuth_size             48
 #define meshtastic_NodeRemoteHardwarePinsResponse_size 496
 #define meshtastic_SCD30_config_size             27
 #define meshtastic_SCD4X_config_size             29

src/mesh/generated/meshtastic/config.pb.h

@@ -198,7 +198,9 @@ typedef enum _meshtastic_Config_DisplayConfig_OledType {
     /* Can not be auto detected but set by proto. Used for 128x64 screens */
     meshtastic_Config_DisplayConfig_OledType_OLED_SH1107 = 3,
     /* Can not be auto detected but set by proto. Used for 128x128 screens */
-    meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_128_128 = 4
+    meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_128_128 = 4,
+    /* Can not be auto detected but set by proto. Used for 64x128 rotated screens */
+    meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_ROTATED = 5
 } meshtastic_Config_DisplayConfig_OledType;
 
 typedef enum _meshtastic_Config_DisplayConfig_DisplayMode {
@@ -720,8 +722,8 @@ extern "C" {
 #define _meshtastic_Config_DisplayConfig_DisplayUnits_ARRAYSIZE ((meshtastic_Config_DisplayConfig_DisplayUnits)(meshtastic_Config_DisplayConfig_DisplayUnits_IMPERIAL+1))
 
 #define _meshtastic_Config_DisplayConfig_OledType_MIN meshtastic_Config_DisplayConfig_OledType_OLED_AUTO
-#define _meshtastic_Config_DisplayConfig_OledType_MAX meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_128_128
-#define _meshtastic_Config_DisplayConfig_OledType_ARRAYSIZE ((meshtastic_Config_DisplayConfig_OledType)(meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_128_128+1))
+#define _meshtastic_Config_DisplayConfig_OledType_MAX meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_ROTATED
+#define _meshtastic_Config_DisplayConfig_OledType_ARRAYSIZE ((meshtastic_Config_DisplayConfig_OledType)(meshtastic_Config_DisplayConfig_OledType_OLED_SH1107_ROTATED+1))
 
 #define _meshtastic_Config_DisplayConfig_DisplayMode_MIN meshtastic_Config_DisplayConfig_DisplayMode_DEFAULT
 #define _meshtastic_Config_DisplayConfig_DisplayMode_MAX meshtastic_Config_DisplayConfig_DisplayMode_COLOR

src/mesh/generated/meshtastic/mesh.pb.cpp

@@ -57,6 +57,9 @@ PB_BIND(meshtastic_QueueStatus, meshtastic_QueueStatus, AUTO)
 PB_BIND(meshtastic_FromRadio, meshtastic_FromRadio, 2)
 
 
+PB_BIND(meshtastic_LockdownStatus, meshtastic_LockdownStatus, AUTO)
+
+
 PB_BIND(meshtastic_ClientNotification, meshtastic_ClientNotification, 2)
 
 
@@ -134,6 +137,8 @@ PB_BIND(meshtastic_ChunkedPayloadResponse, meshtastic_ChunkedPayloadResponse, AU
 
 
 
+
+