Fix multi-hop response routing by embedding path in request payload

DIRECT routing consumes the header path at each hop, so the target
node couldn't reverse it for the response. This fix:

- Embeds the forward path in the ADVERT_REQUEST payload
- Target extracts path, excludes itself (last element), and reverses
- For direct neighbors (path=[target]), response sent as zero-hop
- Works with stock firmware intermediate nodes (they only use header)

Example: path [0x23, 0x1F] → response path [0x23]

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: michielappelman

docs/payloads.md

@@ -284,11 +284,15 @@ Pull-based advert request. Sent to a specific node (via known path) to request i
 
 **Note on sub-type value:** Uses 0x20 (not 0xA0) to enable multi-hop forwarding. In `Mesh.cpp`, control packets with high-bit sub-types (0x80+) are restricted to zero-hop only, while sub-types 0x00-0x7F follow normal DIRECT routing through intermediate nodes.
 
-| Field         | Size (bytes)    | Description                                |
-|---------------|-----------------|--------------------------------------------|
-| sub_type      | 1               | 0x20                                       |
-| target_prefix | 1               | PATH_HASH_SIZE of target node's public key     |
-| tag           | 4               | randomly generated by sender for matching  |
+| Field         | Size (bytes)    | Description                                         |
+|---------------|-----------------|-----------------------------------------------------|
+| sub_type      | 1               | 0x20                                                |
+| target_prefix | 1               | PATH_HASH_SIZE of target node's public key          |
+| tag           | 4               | randomly generated by sender for matching           |
+| path_len      | 1               | length of return path                               |
+| path          | path_len        | forward path to target (target is last element)     |
+
+**Note on path:** The path is included in the payload (not just the header) so the target can reverse it for the response. With DIRECT routing, the header path is consumed at each hop, so embedding it in the payload preserves it for multi-hop response routing. The path includes the target as the last element (e.g., `[0x23, 0x1F]` to reach node `0x1F` via `0x23`). When building the response, the target excludes itself and reverses the remaining path (e.g., response path becomes `[0x23]`). For direct neighbors where the path is just `[target]`, the response is sent as zero-hop. Intermediate nodes (including stock firmware) forward normally based on the header path.
 
 ## ADVERT_RESPONSE (sub_type 0x30)
 

examples/companion_radio/MyMesh.cpp

@@ -1787,27 +1787,23 @@ void MyMesh::handleCmdFrame(size_t len) {
     uint32_t tag;
     getRNG()->random((uint8_t*)&tag, 4);
 
-    // Build request packet
-    uint8_t payload[1 + PATH_HASH_SIZE + 4];
+    // Build request packet - include path in payload for multi-hop response routing
+    // Format: sub_type(1) + target_prefix(1) + tag(4) + path_len(1) + path(N)
+    uint8_t payload[1 + PATH_HASH_SIZE + 4 + 1 + MAX_PATH_SIZE];
     int pos = 0;
     payload[pos++] = CTL_TYPE_ADVERT_REQUEST;
     memcpy(&payload[pos], target_prefix, PATH_HASH_SIZE); pos += PATH_HASH_SIZE;
     memcpy(&payload[pos], &tag, 4); pos += 4;
+    payload[pos++] = path_len;
+    memcpy(&payload[pos], path, path_len); pos += path_len;
 
     mesh::Packet* packet = createControlData(payload, pos);
     if (!packet) {
       writeErrFrame(ERR_CODE_BAD_STATE);
       return;
     }
 
-    // For CONTROL packets with high-bit set, Mesh.cpp only processes them
-    // if path_len == 0 (zero-hop). For direct neighbors (path_len == 1 and
-    // path matches target prefix), use sendZeroHop.
-    if (path_len == PATH_HASH_SIZE && memcmp(path, target_prefix, PATH_HASH_SIZE) == 0) {
-      sendZeroHop(packet);
-    } else {
-      sendDirect(packet, path, path_len, 0);
-    }
+    sendDirect(packet, path, path_len, 0);
 
     pending_advert_request = tag;
 

examples/simple_repeater/MyMesh.cpp

@@ -727,24 +727,33 @@ bool MyMesh::onPeerPathRecv(mesh::Packet *packet, int sender_idx, const uint8_t
 }
 
 void MyMesh::handleAdvertRequest(mesh::Packet* packet) {
-  // Validate packet length: sub_type(1) + prefix(PATH_HASH_SIZE) + tag(4)
-  if (packet->payload_len < 1 + PATH_HASH_SIZE + 4) {
+  // Validate packet length: sub_type(1) + prefix(PATH_HASH_SIZE) + tag(4) + path_len(1)
+  if (packet->payload_len < 1 + PATH_HASH_SIZE + 4 + 1) {
     MESH_DEBUG_PRINTLN("handleAdvertRequest: packet too short (%d bytes)", packet->payload_len);
     return;
   }
 
-  // Extract target prefix and tag
-  const uint8_t* target_prefix = &packet->payload[1];
+  // Extract target prefix, tag, and return path from payload
+  int offset = 1;
+  const uint8_t* target_prefix = &packet->payload[offset]; offset += PATH_HASH_SIZE;
   uint32_t tag;
-  memcpy(&tag, &packet->payload[1 + PATH_HASH_SIZE], 4);
+  memcpy(&tag, &packet->payload[offset], 4); offset += 4;
+  uint8_t return_path_len = packet->payload[offset++];
+  const uint8_t* return_path = &packet->payload[offset];
+
+  // Validate path length
+  if (packet->payload_len < offset + return_path_len) {
+    MESH_DEBUG_PRINTLN("handleAdvertRequest: invalid path_len (%d)", return_path_len);
+    return;
+  }
 
   // Check if request is for us
   if (memcmp(target_prefix, self_id.pub_key, PATH_HASH_SIZE) != 0) {
     MESH_DEBUG_PRINTLN("handleAdvertRequest: not for us (prefix mismatch)");
     return;
   }
 
-  MESH_DEBUG_PRINTLN("handleAdvertRequest: request for us, tag=%08X", tag);
+  MESH_DEBUG_PRINTLN("handleAdvertRequest: request for us, tag=%08X, return_path_len=%d", tag, return_path_len);
 
   // Build app_data (adv_type + node_name + flags + optional: lat, lon, desc)
   uint8_t app_data[1 + 32 + 1 + 4 + 4 + 32];
@@ -800,19 +809,29 @@ void MyMesh::handleAdvertRequest(mesh::Packet* packet) {
   memcpy(&response[pos], signature, SIGNATURE_SIZE); pos += SIGNATURE_SIZE;    // signature
   memcpy(&response[pos], app_data, app_data_len); pos += app_data_len;  // app_data
 
-  MESH_DEBUG_PRINTLN("handleAdvertRequest: sending response, %d bytes, flags=%02X", pos, flags);
-
-  // Create response packet and send
+  // Create response packet and send using reversed path from payload
   mesh::Packet* resp_packet = createControlData(response, pos);
   if (resp_packet) {
-    if (packet->path_len == 0) {
+    // Exclude ourselves (last element) from the path
+    uint8_t response_path_len = (return_path_len > PATH_HASH_SIZE) ? return_path_len - PATH_HASH_SIZE : 0;
+
+    MESH_DEBUG_PRINTLN("handleAdvertRequest: sending response, %d bytes, flags=%02X, response_path_len=%d", pos, flags, response_path_len);
+
+    if (response_path_len == 0) {
+      // Direct neighbor (or empty path) - send zero-hop
       sendZeroHop(resp_packet);
     } else {
+      // Reverse the path excluding ourselves
       uint8_t reversed_path[MAX_PATH_SIZE];
-      for (int i = 0; i < packet->path_len; i++) {
-        reversed_path[i] = packet->path[packet->path_len - 1 - i];
+      for (int i = 0; i < response_path_len; i++) {
+        reversed_path[i] = return_path[response_path_len - 1 - i];
       }
-      sendDirect(resp_packet, reversed_path, packet->path_len, SERVER_RESPONSE_DELAY);
+      MESH_DEBUG_PRINTLN("handleAdvertRequest: response path = [%02X%s%s%s]",
+        reversed_path[0],
+        response_path_len > 1 ? ", " : "",
+        response_path_len > 1 ? "" : "",
+        response_path_len > 1 ? "..." : "");
+      sendDirect(resp_packet, reversed_path, response_path_len, SERVER_RESPONSE_DELAY);
     }
   }
 }