feat: firmware fingerprinting and Meshtastic 2.8/2.8.1 support

README.md

@@ -304,8 +304,9 @@ The following keys are recognised:
 | `mqtt_topic_prefix` | str | `"msh"`                                 | MQTT topic prefix for Meshtastic messages.    | `MALLA_MQTT_TOPIC_PREFIX` |
 | `mqtt_topic_suffix` | str | `"/+/+/+/#"`                           | MQTT topic suffix pattern.                     | `MALLA_MQTT_TOPIC_SUFFIX` |
 | `mqtt_client_id`    | str | `""`                                     | MQTT client ID. Leave empty for a randomly generated ID (recommended). | `MALLA_MQTT_CLIENT_ID` |
-| `default_channel_key` | str | `"1PG7OiApB1nwvP+rz05pAQ=="`         | Default channel key(s) for decryption (base64). Supports comma-separated list of keys - each will be tried in order until successful. | `MALLA_DEFAULT_CHANNEL_KEY` |
+| `default_channel_key` | str | `"1PG7OiApB1nwvP+rz05pAQ=="`         | Default channel key(s) for decryption (base64). Supports comma-separated list of keys - each will be tried in order until successful. . Both classic AES-CTR channels and the AES-CCM (`use_aead`) channels introduced in firmware 2.8.1 are handled| `MALLA_DEFAULT_CHANNEL_KEY` |
 | `data_retention_hours` | int | `0`                                     | Number of hours after which to delete old data (0 = never delete). Automatically cleans up packet_history and node_info records older than specified hours. | `MALLA_DATA_RETENTION_HOURS` |
+| `fingerprint_backfill_days` | int | `30`                                   | On the capture daemon's first start after upgrading, fingerprint this many days of stored packets in the background so every node gets a firmware estimate right away (0 = skip; `malla-fingerprint-backfill` runs it by hand). | `MALLA_FINGERPRINT_BACKFILL_DAYS` |
 | `trusted_proxy_ips` | str | `null`                              | Comma-separated IPs of trusted reverse proxies. Malla only trusts the configured client-IP header from these exact peers. When running via Gunicorn, these same IPs are passed to `forwarded_allow_ips` so only those peers can forward headers. | `MALLA_TRUSTED_PROXY_IPS` |
 | `trusted_proxy_client_ip_header` | str | `"X-Forwarded-For"`         | Header used to derive the real client IP from a trusted proxy. Recommended for Anubis: `X-Real-IP`. | `MALLA_TRUSTED_PROXY_CLIENT_IP_HEADER` |
 | `otlp_endpoint` | str    | `null`                              | OpenTelemetry endpoint for sending traces (e.g. `http://localhost:4317`). | `MALLA_OTLP_ENDPOINT` |

config.sample.yaml

@@ -79,6 +79,10 @@ debug: false
 # Number of hours after which to delete old data (0 = never delete)
 # data_retention_hours: 0
 
+# Days of stored history the capture daemon fingerprints for firmware
+# estimates on its first start after upgrading (0 = skip the automatic run)
+# fingerprint_backfill_days: 30
+
 # OpenTelemetry settings
 # Endpoint for sending traces (e.g. "http://localhost:4317")
 # otlp_endpoint: ""

pyproject.toml

@@ -63,6 +63,7 @@ Issues = "https://github.com/zenitraM/malla/issues"
 malla-web = "malla.web_ui:main"
 malla-web-gunicorn = "malla.wsgi:main"
 malla-capture = "malla.mqtt_capture:main"
+malla-fingerprint-backfill = "malla.fingerprint_backfill:main"
 
 [project.optional-dependencies]
 dev = [

src/malla/config.py

@@ -61,6 +61,14 @@ class AppConfig:
     # Number of hours after which to delete old data (0 = never delete)
     data_retention_hours: int = 0
 
+    # Firmware fingerprint backfill (capture daemon)
+    # On its first start after this feature is installed, the capture daemon
+    # computes firmware evidence for the packets already in the database, this
+    # many days back, in a background thread. 0 disables the automatic run;
+    # `malla-fingerprint-backfill` can always be run by hand.
+    # Corresponding env var: MALLA_FINGERPRINT_BACKFILL_DAYS
+    fingerprint_backfill_days: int = 30
+
     # Reverse proxy settings
     # Comma-separated IPs of trusted reverse proxies. When set, ProxyFix trusts
     # one trusted proto hop, and Gunicorn is configured to accept forwarded