Production SM-DP+ endpoints may use the GSMA RSP2 Root CI1, which is not present in the Alpine system CA bundle. Add the verified root to the ES9+ client's trust pool while preserving the existing public-destination and TLS validation rules.\n\nConstraint: ES9+ TLS must trust the GSMA RSP2 Root CI1 used by production SM-DP+ services.\nRejected: Disable certificate verification or trust the leaf certificate | both weaken server authentication and break rotation.\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep the additional root scoped to ES9+; update it only from a verified GSMA certificate source.\nTested: go test ./...\nNot-tested: Clean-container live download against every SM-DP+ provider.
Co-authored-by: Meng Meng <[email protected]>
Some ePDGs return zero-Responder-SPI COOKIE challenges, and multiple resolved gateways can respond differently. Accept valid COOKIE responses, retry with COOKIE as the first payload, and prefer a gateway that completes SA negotiation.\n\nConstraint: RFC 7296 requires the COOKIE notification to be the first payload on the retry.\nRejected: Treat COOKIE as an ordinary or fatal notification | either drops a valid challenge or prevents the required retry.\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep relaxed zero-Responder-SPI matching limited to IKE_SA_INIT COOKIE responses.\nTested: go test ./internal/vowifi/ike ./internal/vowifi/...\nNot-tested: Live carrier authorization after IKE_AUTH.
Co-authored-by: Meng Meng <[email protected]>
Normalize the DJI USB serial and QMI interface bindings without leaving a broad qmi_wwan dynamic ID, and expose only the live-discovered AT port to the terminal UI.
1. Vendor-neutral modem compatibility:
- Discovery switched from a vendor-ID whitelist to detecting the QMI
channel directly (an interface bound to the kernel qmi_wwan driver),
so SIMCom, Sierra, Telit and other Qualcomm-based modules are found
automatically while MBIM-only devices stay excluded
- AT port responses now distinguish an AT command error from firmware
incompatibility: ERROR / +CME ERROR is returned as a normal response
(200) instead of being folded into a 502, which only a real transport
failure produces
2. Fixed the 410 dongle's AT command timeouts:
- Default WWAN AT port switched from wwan0at0 to wwan0at1: ModemManager
marks the first AT port that answers its probe as primary (at1 on the
tested UFI dongles) and closes AT ports once initialization finishes,
so at1 is the responsive, idle channel for vocat while MM uses the
QMI port for control
- Drain the WWAN input buffer before each command write, discarding the
late bytes of a previous timed-out command so they cannot pollute the
next response's parsing
- AT+CGSN now uses an independent short timeout instead of inheriting
the refresh's 30s deadline (on MHI modems it returns the IMEI line
but never a final OK). Previously every refresh held the device lock
for the full 30s, queueing AT terminal commands behind it for 10-20s
- The QMI UIM ICCID fallback only runs when AT+CPIN? already proved a
READY card, so a SIM-less slot no longer blocks refresh waiting out
its long timeout
Tests: added WWAN drain cleanup, drain-before-write ordering, CGSN timeout
bound, skip-QMI-ICCID-without-SIM, CommandError-as-200, WWAN at1 port
selection and vendor-neutral discovery cases. go vet and go test ./... pass.
Co-authored-by: Test <[email protected]>
- Read ipsec-3gpp UDP server port even when REGISTER used TCP
- Advertise Allow MESSAGE and smsip Accept-Contact for all carriers
- Do not require P-CSCF port-c (50601) on inbound UE-server XFRM
- Log rejected inbound TCP/UDP sources
Verified on VOXI/Vodafone UK 23415 with Quectel EC25.
Closes#38
Co-authored-by: wl77vv <[email protected]>
The total/online/offline/last-refresh mini panels are superseded by the
new module online-rate card.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add four cards to the dashboard:
- Host hardware card (CPU / motherboard / memory / disk model) backed by
a new GET /api/dashboard/host endpoint that probes /proc and /sys once
and caches the identities. x86 hosts read cpuinfo model name, DMI board
data, dmidecode DIMM info, and block device models; ARM boards compose
the device-tree SoC with the Cortex part name and fall back to memory
capacity.
- Performance card with live CPU / memory / disk usage bars and real-time
network up/down rates. Rates derive from cumulative kernel counters
sampled on demand by dashboard polling (no background goroutine), with
bridge/tunnel/vocat virtual interfaces excluded to avoid double
counting.
- Upcoming scheduled tasks card listing the next three enabled automatic
tasks with their run times.
- Module online rate card aggregating all recognized modules into one
large percentage colored by four levels (red/orange/yellow/green).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
- Added support for reading SIM metadata (SPN, GID1, GID2) in EC20 and Native QMI adapters.
- Refactored ePDG resolver to utilize carrier profiles for DNS resolution.
- Introduced automatic legacy proposal fallback in IKE provider based on negotiation failures.
- Updated IMS provider to cache transport settings per SIM identity and implement transport fallback logic.
- Enhanced SMS center retrieval to fall back to carrier profiles when no explicit configuration is found.
- Updated state management to include carrier profile information.
- Improved integration tests to cover new transport caching and SMS center logic.
- Added UI components to display carrier profile and match source in the device overview.
- Updated internationalization files to include new labels for carrier profile and match source.
MengMengCode