From fe138e48909f6f708e35852a0af087747dbc47c0 Mon Sep 17 00:00:00 2001 From: VasilevNStas Date: Sun, 28 Jun 2026 19:51:09 +0300 Subject: [PATCH] fix!: rename timestamp fields to embed time unit in field name Three different time units were used across the protocol with no naming distinction: Auth.timestamp (minutes since project epoch), Ping/Pong.timestamp (ms since Unix epoch), and all lease/expiry fields (seconds since Unix epoch). A client computing e.g. Pong.cutoff - Pong.timestamp would get a result in mixed seconds-minus-milliseconds with no type-level guard. Rename: Auth.timestamp -> timestamp_min (minutes since 2024-01-01 UTC) Ping.timestamp -> timestamp_ms (ms since Unix epoch) Pong.timestamp -> timestamp_ms (echo of Ping.timestamp_ms) Field numbers are unchanged, so the wire format is compatible. Generated code symbols change (source break). --- auth.proto | 8 +++++--- ping.proto | 4 ++-- pong.proto | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/auth.proto b/auth.proto index d0acc93..a369b1c 100644 --- a/auth.proto +++ b/auth.proto @@ -16,10 +16,12 @@ message Auth { // Minutes since the project epoch (2024-01-01 UTC), used as a // replay-prevention nonce. The Node accepts the message only if - // this value is within one minute of its own clock. - uint32 timestamp = 2; + // this value is within one minute of its own clock. Unit is + // encoded in the field name to distinguish from ms/Unix-epoch + // timestamps elsewhere in the protocol. + uint32 timestamp_min = 2; - // Truncated HMAC-SHA256 (12 bytes) over (client_id || timestamp), + // Truncated HMAC-SHA256 (12 bytes) over (client_id || timestamp_min), // computed with the pre-shared key issued to this client. Proves // possession of the PSK without revealing it. bytes hmac = 3; diff --git a/ping.proto b/ping.proto index 421566a..c65ffaa 100644 --- a/ping.proto +++ b/ping.proto @@ -11,9 +11,9 @@ package proto; message Ping { // Client clock at the moment the Ping was prepared, in // milliseconds since the Unix epoch. The Node echoes it back in - // Pong.timestamp so that the client can compute round-trip time + // Pong.timestamp_ms so that the client can compute round-trip time // without keeping per-request state. - uint64 timestamp = 1; + uint64 timestamp_ms = 1; // Per-peer probe-failure counters accumulated since the previous // Ping. The key is the peer Node's IPv4 address in dotted form diff --git a/pong.proto b/pong.proto index 680aef3..7bcb8f5 100644 --- a/pong.proto +++ b/pong.proto @@ -95,8 +95,8 @@ message Peer { // properties, fleet) so the client UI can stay current without a // separate channel. message Pong { - // Echo of Ping.timestamp, used by the client to compute RTT. - uint64 timestamp = 1; + // Echo of Ping.timestamp_ms, used by the client to compute RTT. + uint64 timestamp_ms = 1; // Current lease snapshot for this client. Always present; an // empty Lease means free tier.