Good evening. I am trying to understand the autopilot behavior when message signing is active. It appears that signed messages broadcast by peripherals stop being passed to the ground control station when the autopilot signing is active.
My system includes mission planner (1.3.79) attached to a Pixhawk 4 running Arducopter 4.3.4 attached to a custom onboard computer using compid 192. With no signing messages emitted by the obc2 show in the gcs at the other end. When obc2 activates signing though mission planner, both continue to function correctly, albeit the obc appropriately rejects all messages from the autopilot. However when signing is enabled for the autopilot (same secret key), the autopilot and gcs talk. The autopilot and obc2 talk. But the gcs and obc2 stop receiving each other’s messages.
It does not appear to be a signature or checksum issue b/c if the autopilot signing is turned off, or if the params are set to pass the obc2 traffic directly to the gcs, they understand each other.
There is a section in the Mavlink signing specs that says that a controller should pass broadcast messages unadulterated messages to other components in the system when signing is active on that component. In fact, it specifically says don’t resign them. So, this seems to not behave correctly, but I might not understand something.
On further testing, it seems possible that mission planner is applying the timestamp rule to the autopilot link rather than the (sysid, compid, linkid) tuple. I am not sure, but when I synchronized the autopilot and obc2 timestamps in the signature, it started working as expected. But wouldn’t that be out of spec behavior? My understanding is that as long as timestamps get larger for each tuple, it shouldn’t be a problem.
Advice appreciated. Thank you.