CCSDS File Delivery Protocol - CfdpManager#5138
Conversation
This reverts commit f48314f.
… NAK processed logic
...because another more general variant is also in expect.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
| break; | ||
| } | ||
| } | ||
| while (args.cont); |
| } // namespace Ccsds | ||
| } // namespace Svc | ||
|
|
||
| #endif // CFDP_CHANNEL_HPP No newline at end of file |
| } | ||
| node = node_next; | ||
| } | ||
| while (!last); |
| } | ||
| node = node_next; | ||
| } | ||
| while (!last); |
| } | ||
| node = node_next; | ||
| } | ||
| while (!last); |
| //! @param buffer The buffer to serialize to | ||
| //! @param mode The endianness mode (default: BIG) | ||
| //! @return Serialization status | ||
| virtual Fw::SerializeStatus serializeTo(Fw::SerialBufferBase& buffer, |
| //! @param buffer The buffer to deserialize from | ||
| //! @param mode The endianness mode (default: BIG) | ||
| //! @return Deserialization status | ||
| virtual Fw::SerializeStatus deserializeFrom(Fw::SerialBufferBase& buffer, |
| int main(int argc, char** argv) { | ||
| ::testing::InitGoogleTest(&argc, argv); | ||
| return RUN_ALL_TESTS(); | ||
| } No newline at end of file |
|
|
||
| } // namespace Cfdp | ||
| } // namespace Ccsds | ||
| } // namespace Svc No newline at end of file |
|
|
||
| } // namespace Cfdp | ||
| } // namespace Ccsds | ||
| } // namespace Svc No newline at end of file |
thomas-bc
left a comment
thomas-bc
left a comment
There was a problem hiding this comment.
A few AI finds that seemed relevant, and one big question about how to handle file paths.
|
|
||
| void Engine::setChannelFlowState(U8 channelId, Flow::T flowState) | ||
| { | ||
| FW_ASSERT(channelId <= Cfdp::NumChannels, channelId, Cfdp::NumChannels); |
There was a problem hiding this comment.
AI finding: Should this be channelId < Cfdp::NumChannels instead of <= ?
| U32 directiveCodeOffset = 4 + (2 * eidSize) + tsnSize; | ||
|
|
||
| // Read directive code | ||
| U8 directiveCode = data[directiveCodeOffset]; |
There was a problem hiding this comment.
AI finding: This reads at an offset based of header bytes (potentially untrusted) - we should check that there is enough length in the data before trying to access.
|
|
||
| /* store the filenames in transaction - validation already done during deserialization */ | ||
| txn->m_history->fnames.src_filename = md.getSourceFilename(); | ||
| txn->m_history->fnames.dst_filename = md.getDestFilename(); |
There was a problem hiding this comment.
One security issue that we've had reported a lot on the F Prime Svc.FileUplink component is that it allows to write files at any location on the filesystem, potentially overwriting critical system files etc.
This is risky for in case of operator oversight (shrug) but also if you receive unauthenticated (potentially malicious) commands.
My understanding is this CfdpManager has the same capability.
Did you find that CFDP makes recommendation on how to deal with that? If not, we should agree on a rationale so that we stop the spam of "hey you have a critical vulnerability here". Maybe the answer is "encrypt/authenticate your comms". But we should agree on something.
cc @bitWarrior , if you have recommendations.
4 participants
Change Description
This PR adds the CfdpManager component, an F´ implementation of the CCSDS File Delivery Protocol (CFDP) standard ported from NASA's Core Flight System (cFS) CFDP Application v3.0.0. CfdpManager provides both Class 1 (unacknowledged) and Class 2 (acknowledged) file transfer capabilities, designed to replace the standard FileUplink and FileDownlink components with guaranteed file delivery support.
Attribution and License:
Ported components (retain original NASA copyright):
Engine.cpp,Transaction.hpp,TransactionTx.cpp,TransactionRx.cpp)Utils.cpp,Channel.cpp)Chunk.cpp,Clist.cpp)New F´-specific implementations:
SerializableinterfaceSee ATTRIBUTION.md for complete file-by-file attribution breakdown.
Summary of changes:
Rationale
Current F´ file transfer components (FileUplink/FileDownlink) lack reliable delivery guarantees over lossy or intermittent links, automatic retransmission and gap detection, and industry-standard CFDP protocol compliance required for interoperability with ground systems and other spacecraft.
CfdpManager addresses these gaps by implementing the CCSDS CFDP standard, which is specifically designed for space missions with long propagation delays, high error rates, and disruption-tolerant requirements. By porting NASA's proven CF application from cFS, this implementation leverages flight-proven CFDP logic while adapting it to F´'s architecture and component model.
Testing/Review Recommendations
Unit Test Coverage:
Areas to focus on:
dataOut/dataReturnInandbufferAllocate/bufferDeallocate)Future Work
fileInportAI Usage (see policy)
Generative AI (Claude Code) was used for:
Important note: AI was NOT used to generate the core CFDP protocol logic. The core engine, transaction state machines, and protocol logic were ported directly from NASA's CF application v3.0.0 (human-written, flight-proven code). AI assistance was limited to F´-specific integration code, documentation, and port quality improvements.