Reticulum-Go/pkg/transport/transport.go

package transport

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/binary"
	"errors"
	"fmt"
	"net"
	"reflect"
	"sync"
	"time"

	"github.com/Sudo-Ivan/reticulum-go/pkg/announce"
	"github.com/Sudo-Ivan/reticulum-go/pkg/common"
	"github.com/Sudo-Ivan/reticulum-go/pkg/debug"
	"github.com/Sudo-Ivan/reticulum-go/pkg/identity"
	"github.com/Sudo-Ivan/reticulum-go/pkg/interfaces"
	"github.com/Sudo-Ivan/reticulum-go/pkg/packet"
	"github.com/Sudo-Ivan/reticulum-go/pkg/pathfinder"
	"github.com/Sudo-Ivan/reticulum-go/pkg/rate"
)

var (
	transportInstance *Transport
	transportMutex    sync.Mutex
)

const (
	PathfinderM     = 128 // Maximum number of hops that Reticulum will transport a packet
	PathRequestTTL  = 300 // Time to live for path requests in seconds
	AnnounceTimeout = 15  // Timeout for announce responses in seconds

	// Link constants
	EstablishmentTimeoutPerHop = 6   // Timeout for link establishment per hop
	KeepaliveTimeoutFactor     = 4   // RTT timeout factor for link timeout
	StaleGrace                 = 2   // Grace period in seconds
	Keepalive                  = 360 // Interval for sending keep-alive packets
	StaleTime                  = 720 // Time after which link is considered stale

	// Resource strategies
	AcceptNone = 0
	AcceptAll  = 1
	AcceptApp  = 2

	// Resource status
	ResourceStatusPending   = 0x00
	ResourceStatusActive    = 0x01
	ResourceStatusComplete  = 0x02
	ResourceStatusFailed    = 0x03
	ResourceStatusCancelled = 0x04

	// Direction constants
	OUT = 0x02
	IN  = 0x01

	// Destination type constants
	SINGLE = 0x00
	GROUP  = 0x01
	PLAIN  = 0x02

	// Link status constants
	STATUS_NEW    = 0
	STATUS_ACTIVE = 1
	STATUS_CLOSED = 2
	STATUS_FAILED = 3

	AnnounceRatePercent = 2.0  // 2% of bandwidth for announces
	PATHFINDER_M        = 8    // Maximum hop count
	AnnounceRateKbps    = 20.0 // 20 Kbps for announces

	MAX_HOPS         = 128  // Default m value for announce propagation
	PROPAGATION_RATE = 0.02 // 2% bandwidth cap for announces

	// Announce packet types
	PACKET_TYPE_ANNOUNCE = 0x01
	PACKET_TYPE_LINK     = 0x02

	// Announce flags
	ANNOUNCE_NONE     = 0x00
	ANNOUNCE_PATH     = 0x01
	ANNOUNCE_IDENTITY = 0x02

	// Header types
	HEADER_TYPE_1 = 0x00 // One address field
	HEADER_TYPE_2 = 0x01 // Two address fields

	// Propagation types
	PROP_TYPE_BROADCAST = 0x00
	PROP_TYPE_TRANSPORT = 0x01

	// Destination types
	DEST_TYPE_SINGLE = 0x00
	DEST_TYPE_GROUP  = 0x01
	DEST_TYPE_PLAIN  = 0x02
	DEST_TYPE_LINK   = 0x03
)

type PathInfo struct {
	NextHop     []byte
	Interface   string
	Hops        uint8
	LastUpdated time.Time
}

type Transport struct {
	mutex            sync.RWMutex
	config           *common.ReticulumConfig
	interfaces       map[string]common.NetworkInterface
	links            map[string]*Link
	destinations     map[string]interface{}
	announceRate     *rate.Limiter
	seenAnnounces    map[string]bool
	pathfinder       *pathfinder.PathFinder
	announceHandlers []announce.Handler
	paths            map[string]*common.Path
}

type Path struct {
	NextHop   []byte
	Interface common.NetworkInterface
	HopCount  byte
}

func NewTransport(cfg *common.ReticulumConfig) *Transport {
	t := &Transport{
		interfaces:    make(map[string]common.NetworkInterface),
		paths:         make(map[string]*common.Path),
		seenAnnounces: make(map[string]bool),
		announceRate:  rate.NewLimiter(PROPAGATION_RATE, 1),
		mutex:         sync.RWMutex{},
		config:        cfg,
		links:         make(map[string]*Link),
		destinations:  make(map[string]interface{}),
		pathfinder:    pathfinder.NewPathFinder(),
	}
	return t
}

// RegisterDestination registers a destination to receive incoming link requests
func (t *Transport) RegisterDestination(hash []byte, dest interface{}) {
	t.mutex.Lock()
	defer t.mutex.Unlock()
	t.destinations[string(hash)] = dest
	debug.Log(debug.DEBUG_TRACE, "Registered destination with transport", "hash", fmt.Sprintf("%x", hash))
}

// CreateIncomingLink creates a link object for an incoming link request
// This avoids circular import issues by having transport create the link
func (t *Transport) CreateIncomingLink(dest interface{}, networkIface common.NetworkInterface) interface{} {
	// This function signature uses interface{} to avoid importing link package
	// The actual implementation will be in the application code
	// For now, return nil to indicate links aren't fully implemented
	debug.Log(debug.DEBUG_TRACE, "CreateIncomingLink called (not yet fully implemented)")
	return nil
}

// Add GetTransportInstance function
func GetTransportInstance() *Transport {
	transportMutex.Lock()
	defer transportMutex.Unlock()
	return transportInstance
}

// Update the interface methods
func (t *Transport) RegisterInterface(name string, iface common.NetworkInterface) error {
	t.mutex.Lock()
	defer t.mutex.Unlock()

	if _, exists := t.interfaces[name]; exists {
		return errors.New("interface already registered")
	}

	t.interfaces[name] = iface
	return nil
}

func (t *Transport) GetInterface(name string) (common.NetworkInterface, error) {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	iface, exists := t.interfaces[name]
	if !exists {
		return nil, errors.New("interface not found")
	}

	return iface, nil
}

// Update the Close method
func (t *Transport) Close() error {
	t.mutex.Lock()
	defer t.mutex.Unlock()

	for _, iface := range t.interfaces {
		iface.Detach()
	}

	return nil
}

type Link struct {
	mutex               sync.RWMutex
	destination         []byte
	establishedAt       time.Time
	lastInbound         time.Time
	lastOutbound        time.Time
	lastData            time.Time
	rtt                 time.Duration
	establishedCb       func()
	closedCb            func()
	packetCb            func([]byte, *packet.Packet)
	resourceCb          func(interface{}) bool
	resourceStrategy    int
	resourceStartedCb   func(interface{})
	resourceConcludedCb func(interface{})
	remoteIdentifiedCb  func(*Link, []byte)
	connectedCb         func()
	disconnectedCb      func()
	remoteIdentity      []byte
	physicalStats       bool
	staleTime           time.Duration
	staleGrace          time.Duration
	status              int
}

type Destination struct {
	Identity  interface{}
	Direction int
	Type      int
	AppName   string
	Aspects   []string
}

func NewLink(dest []byte, establishedCallback func(), closedCallback func()) *Link {
	return &Link{
		destination:   dest,
		establishedAt: time.Now(),
		lastInbound:   time.Now(),
		lastOutbound:  time.Now(),
		lastData:      time.Now(),
		establishedCb: establishedCallback,
		closedCb:      closedCallback,
		staleTime:     time.Duration(StaleTime) * time.Second,
		staleGrace:    time.Duration(StaleGrace) * time.Second,
	}
}

// Link methods
func (l *Link) GetAge() time.Duration {
	return time.Since(l.establishedAt)
}

func (l *Link) NoInboundFor() time.Duration {
	return time.Since(l.lastInbound)
}

func (l *Link) NoOutboundFor() time.Duration {
	return time.Since(l.lastOutbound)
}

func (l *Link) NoDataFor() time.Duration {
	return time.Since(l.lastData)
}

func (l *Link) InactiveFor() time.Duration {
	inbound := l.NoInboundFor()
	outbound := l.NoOutboundFor()
	if inbound < outbound {
		return inbound
	}
	return outbound
}

func (l *Link) SetPacketCallback(cb func([]byte, *packet.Packet)) {
	l.packetCb = cb
}

func (l *Link) SetResourceCallback(cb func(interface{}) bool) {
	l.resourceCb = cb
}

func (l *Link) Teardown() {
	if l.disconnectedCb != nil {
		l.disconnectedCb()
	}
	if l.closedCb != nil {
		l.closedCb()
	}
}

func (l *Link) Send(data []byte) interface{} {
	l.mutex.Lock()
	l.lastOutbound = time.Now()
	l.lastData = time.Now()
	l.mutex.Unlock()

	packet := &LinkPacket{
		Destination: l.destination,
		Data:        data,
		Timestamp:   time.Now(),
	}

	if l.rtt == 0 {
		l.rtt = l.InactiveFor()
	}

	err := packet.send()
	if err != nil {
		return nil
	}

	return packet
}

func (t *Transport) RegisterAnnounceHandler(handler announce.Handler) {
	t.mutex.Lock()
	defer t.mutex.Unlock()
	t.announceHandlers = append(t.announceHandlers, handler)
}

func (t *Transport) UnregisterAnnounceHandler(handler announce.Handler) {
	t.mutex.Lock()
	defer t.mutex.Unlock()
	for i, h := range t.announceHandlers {
		if h == handler {
			t.announceHandlers = append(t.announceHandlers[:i], t.announceHandlers[i+1:]...)
			break
		}
	}
}

func (t *Transport) notifyAnnounceHandlers(destHash []byte, identity interface{}, appData []byte) {
	t.mutex.RLock()
	handlers := make([]announce.Handler, len(t.announceHandlers))
	copy(handlers, t.announceHandlers)
	t.mutex.RUnlock()

	for _, handler := range handlers {
		if err := handler.ReceivedAnnounce(destHash, identity, appData); err != nil {
			debug.Log(debug.DEBUG_ERROR, "Error in announce handler", "error", err)
		}
	}
}

func (t *Transport) HasPath(destinationHash []byte) bool {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	path, exists := t.paths[string(destinationHash)]
	if !exists {
		return false
	}

	// Check if path is still valid (not expired)
	if time.Since(path.LastUpdated) > time.Duration(PathRequestTTL)*time.Second {
		delete(t.paths, string(destinationHash))
		return false
	}

	return true
}

func (t *Transport) HopsTo(destinationHash []byte) uint8 {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	path, exists := t.paths[string(destinationHash)]
	if !exists {
		return PathfinderM
	}

	return path.HopCount
}

func (t *Transport) NextHop(destinationHash []byte) []byte {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	path, exists := t.paths[string(destinationHash)]
	if !exists {
		return nil
	}

	return path.NextHop
}

func (t *Transport) NextHopInterface(destinationHash []byte) string {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	path, exists := t.paths[string(destinationHash)]
	if !exists {
		return ""
	}

	return path.Interface.GetName()
}

func (t *Transport) RequestPath(destinationHash []byte, onInterface string, tag []byte, recursive bool) error {
	packet := &PathRequest{
		DestinationHash: destinationHash,
		Tag:             tag,
		TTL:             PathRequestTTL,
		Recursive:       recursive,
	}

	if onInterface != "" {
		return t.sendPathRequest(packet, onInterface)
	}

	return t.broadcastPathRequest(packet)
}

// updatePathUnlocked updates path without acquiring mutex (caller must hold lock)
func (t *Transport) updatePathUnlocked(destinationHash []byte, nextHop []byte, interfaceName string, hops uint8) {
	// Direct access to interfaces map since caller holds the lock
	iface, exists := t.interfaces[interfaceName]
	if !exists {
		debug.Log(debug.DEBUG_INFO, "Interface not found", "name", interfaceName)
		return
	}

	t.paths[string(destinationHash)] = &common.Path{
		NextHop:     nextHop,
		Interface:   iface,
		Hops:        hops,
		LastUpdated: time.Now(),
	}
}

func (t *Transport) UpdatePath(destinationHash []byte, nextHop []byte, interfaceName string, hops uint8) {
	t.mutex.Lock()
	defer t.mutex.Unlock()
	t.updatePathUnlocked(destinationHash, nextHop, interfaceName, hops)
}

func (t *Transport) HandleAnnounce(data []byte, sourceIface common.NetworkInterface) error {
	if len(data) < 53 { // Minimum size for announce packet
		return fmt.Errorf("announce packet too small: %d bytes", len(data))
	}

	debug.Log(debug.DEBUG_ALL, "Transport handling announce", "bytes", len(data), "source", sourceIface.GetName())

	// Parse announce fields according to RNS spec
	destHash := data[1:33]
	identity := data[33:49]
	appData := data[49:]

	// Generate announce hash to check for duplicates
	announceHash := sha256.Sum256(data)
	hashStr := string(announceHash[:])

	t.mutex.Lock()
	if _, seen := t.seenAnnounces[hashStr]; seen {
		t.mutex.Unlock()
		debug.Log(debug.DEBUG_ALL, "Ignoring duplicate announce", "hash", fmt.Sprintf("%x", announceHash[:8]))
		return nil
	}
	t.seenAnnounces[hashStr] = true
	t.mutex.Unlock()

	// Don't forward if max hops reached
	if data[0] >= MAX_HOPS {
		debug.Log(debug.DEBUG_ALL, "Announce exceeded max hops", "hops", data[0])
		return nil
	}

	// Add random delay before retransmission (0-2 seconds)
	var delay time.Duration
	b := make([]byte, 8)
	_, err := rand.Read(b)
	if err != nil {
		debug.Log(debug.DEBUG_ALL, "Failed to generate random delay", "error", err)
		delay = time.Duration(0) // Default to no delay on error
	} else {
                delay = time.Duration(binary.BigEndian.Uint64(b)%2000) * time.Millisecond // #nosec G115
	}
	time.Sleep(delay)

	// Check bandwidth allocation for announces
	if !t.announceRate.Allow() {
		debug.Log(debug.DEBUG_ALL, "Announce rate limit exceeded, queuing")
		return nil
	}

	// Increment hop count
	data[0]++

	// Broadcast to all other interfaces
	var lastErr error
	for name, iface := range t.interfaces {
		if iface == sourceIface || !iface.IsEnabled() {
			continue
		}

		debug.Log(debug.DEBUG_ALL, "Forwarding announce on interface", "name", name)
		if err := iface.Send(data, ""); err != nil {
			debug.Log(debug.DEBUG_ALL, "Failed to forward announce", "name", name, "error", err)
			lastErr = err
		}
	}

	// Notify handlers
	t.notifyAnnounceHandlers(destHash, identity, appData)

	return lastErr
}

func (t *Transport) NewDestination(identity interface{}, direction int, destType int, appName string, aspects ...string) *Destination {
	return &Destination{
		Identity:  identity,
		Direction: direction,
		Type:      destType,
		AppName:   appName,
		Aspects:   aspects,
	}
}

func (t *Transport) NewLink(dest []byte, establishedCallback func(), closedCallback func()) *Link {
	return NewLink(dest, establishedCallback, closedCallback)
}

type PathRequest struct {
	DestinationHash []byte
	Tag             []byte
	TTL             int
	Recursive       bool
}

type LinkPacket struct {
	Destination []byte
	Data        []byte
	Timestamp   time.Time
}

func (p *LinkPacket) send() error {
	// Get transport instance
	t := GetTransportInstance()

	// Create packet header
	header := make([]byte, 0, 64)
	header = append(header, 0x02) // Link packet type
	header = append(header, p.Destination...)

	// Add timestamp
	ts := make([]byte, 8)
	binary.BigEndian.PutUint64(ts, uint64(p.Timestamp.Unix())) // #nosec G115
	header = append(header, ts...)

	// Combine header and data
	packet := append(header, p.Data...)

	// Get next hop info
	nextHop := t.NextHop(p.Destination)
	if nextHop == nil {
		return errors.New("no path to destination")
	}

	// Get interface for next hop
	ifaceName := t.NextHopInterface(p.Destination)
	iface, ok := t.interfaces[ifaceName]
	if !ok {
		return errors.New("interface not found")
	}

	// Send packet using interface's Send method
	return iface.Send(packet, "")
}

func (t *Transport) sendPathRequest(req *PathRequest, interfaceName string) error {
	// Create path request packet
	packet := &PathRequestPacket{
		Type:            0x01,
		DestinationHash: req.DestinationHash,
		Tag:             req.Tag,
		TTL:             byte(req.TTL),
		Recursive:       req.Recursive,
	}

	// Serialize packet
	buf := make([]byte, 0, 128)
	buf = append(buf, packet.Type)
	buf = append(buf, packet.DestinationHash...)
	buf = append(buf, packet.Tag...)
	buf = append(buf, packet.TTL)
	if packet.Recursive {
		buf = append(buf, 0x01)
	} else {
		buf = append(buf, 0x00)
	}

	// Get interface
	iface, ok := t.interfaces[interfaceName]
	if !ok {
		return errors.New("interface not found")
	}

	return iface.Send(buf, "")
}

func (t *Transport) broadcastPathRequest(req *PathRequest) error {
	var lastErr error
	for _, iface := range t.interfaces {
		if !iface.IsEnabled() {
			continue
		}

		if err := t.sendPathRequest(req, iface.GetName()); err != nil {
			lastErr = err
		}
	}
	return lastErr
}

type PathRequestPacket struct {
	Type            byte   // 0x01 for path request
	DestinationHash []byte // 32 bytes
	Tag             []byte // Variable length
	TTL             byte
	Recursive       bool
}

type NetworkInterface struct {
	Name    string
	Addr    *net.UDPAddr
	Conn    *net.UDPConn
	MTU     int
	Enabled bool
}

func SendAnnounce(packet []byte) error {
	t := GetTransportInstance()
	if t == nil {
		return errors.New("transport not initialized")
	}

	// Send announce packet to all interfaces
	var lastErr error
	for _, iface := range t.interfaces {
		if err := iface.Send(packet, ""); err != nil {
			lastErr = err
		}
	}

	return lastErr
}

func (t *Transport) HandlePacket(data []byte, iface common.NetworkInterface) {
	if len(data) < 2 {
		debug.Log(debug.DEBUG_INFO, "Dropping packet: insufficient length", "bytes", len(data))
		return
	}

	headerByte := data[0]
	packetType := headerByte & 0x03
	headerType := (headerByte & 0x40) >> 6
	contextFlag := (headerByte & 0x20) >> 5
	propType := (headerByte & 0x10) >> 4
	destType := (headerByte & 0x0C) >> 2

	debug.Log(debug.DEBUG_INFO, "TRANSPORT: Packet received", "type", fmt.Sprintf("0x%02x", packetType), "header", headerType, "context", contextFlag, "propType", propType, "destType", destType, "size", len(data))
	debug.Log(debug.DEBUG_TRACE, "Interface and raw header", "name", iface.GetName(), "header", fmt.Sprintf("0x%02x", headerByte))

	if tcpIface, ok := iface.(*interfaces.TCPClientInterface); ok {
		tcpIface.UpdateStats(uint64(len(data)), true)
		debug.Log(debug.DEBUG_PACKETS, "Updated TCP interface stats", "rx_bytes", len(data))
	}

	switch packetType {
	case PACKET_TYPE_ANNOUNCE:
		debug.Log(debug.DEBUG_VERBOSE, "Processing announce packet")
		if err := t.handleAnnouncePacket(data, iface); err != nil {
			debug.Log(debug.DEBUG_INFO, "Announce handling failed", "error", err)
		}
	case PACKET_TYPE_LINK:
		debug.Log(debug.DEBUG_VERBOSE, "Processing link packet")
		t.handleLinkPacket(data[1:], iface)
	case 0x03:
		debug.Log(debug.DEBUG_VERBOSE, "Processing path response")
		t.handlePathResponse(data[1:], iface)
	case 0x00:
		debug.Log(debug.DEBUG_VERBOSE, "Processing transport packet")
		t.handleTransportPacket(data[1:], iface)
	default:
		debug.Log(debug.DEBUG_INFO, "Unknown packet type", "type", fmt.Sprintf("0x%02x", packetType), "source", iface.GetName())
	}
}

func (t *Transport) handleAnnouncePacket(data []byte, iface common.NetworkInterface) error {
	debug.Log(debug.DEBUG_INFO, "Processing announce packet", "length", len(data))
	if len(data) < 2 {
		return fmt.Errorf("packet too small for header")
	}

	// Parse header bytes according to RNS spec
	headerByte1 := data[0]
	hopCount := data[1]

	// Extract header fields
	ifacFlag := (headerByte1 & 0x80) >> 7    // IFAC flag in highest bit
	headerType := (headerByte1 & 0x40) >> 6  // Header type in next bit
	contextFlag := (headerByte1 & 0x20) >> 5 // Context flag
	propType := (headerByte1 & 0x10) >> 4    // Propagation type
	destType := (headerByte1 & 0x0C) >> 2    // Destination type in next 2 bits
	packetType := headerByte1 & 0x03         // Packet type in lowest 2 bits

	debug.Log(debug.DEBUG_TRACE, "Announce header", "ifac", ifacFlag, "headerType", headerType, "context", contextFlag, "propType", propType, "destType", destType, "packetType", packetType)

	// Skip IFAC code if present
	startIdx := 2
	if ifacFlag == 1 {
		startIdx += 1 // For now assume 1 byte IFAC code
	}

	// Calculate address field size
	addrSize := 16
	if headerType == 1 {
		addrSize = 32 // Two address fields
	}

	// Validate minimum packet size
	minSize := startIdx + addrSize + 1 // Header + addresses + context
	if len(data) < minSize {
		return fmt.Errorf("packet too small: %d bytes", len(data))
	}

	// Extract fields
	addresses := data[startIdx : startIdx+addrSize]
	context := data[startIdx+addrSize]
	payload := data[startIdx+addrSize+1:]

	debug.Log(debug.DEBUG_INFO, "Addresses", "addresses", fmt.Sprintf("%x", addresses), "len", len(addresses))
	debug.Log(debug.DEBUG_INFO, "Context and payload", "context", fmt.Sprintf("%02x", context), "payload_len", len(payload))
	debug.Log(debug.DEBUG_INFO, "Packet total length", "length", len(data))

	// Parse announce packet according to RNS specification
	// All announce packets have the same format:
	// [Public Key (64)][Name Hash (10)][Random Hash (10)][Ratchet (0-32)][Signature (64)][App Data]

	var id *identity.Identity
	var appData []byte
	var pubKey []byte

	minAnnounceSize := 64 + 10 + 10 + 64 // pubKey + nameHash + randomHash + signature
	if len(payload) < minAnnounceSize {
		debug.Log(debug.DEBUG_INFO, "Payload too small for announce", "bytes", len(payload), "minimum", minAnnounceSize)
		return fmt.Errorf("payload too small for announce")
	}

	// Parse the announce data
	pos := 0
	pubKey = payload[pos : pos+64] // 64 bytes: encKey (32) + signKey (32)
	pos += 64
	nameHash := payload[pos : pos+10]
	pos += 10
	randomHash := payload[pos : pos+10]
	pos += 10

	// Check if there's a ratchet (context flag determines this)
	// For now, assume no ratchet if payload is shorter
	var ratchetData []byte

	// Calculate if there's space for a ratchet
	remainingBeforeSig := len(payload) - pos - 64
	if remainingBeforeSig == 32 {
		// Has ratchet
		ratchetData = payload[pos : pos+32]
		pos += 32
	}

	signature := payload[pos : pos+64]
	pos += 64
	appData = payload[pos:]

	ratchetHex := ""
	if len(ratchetData) > 0 {
		ratchetHex = fmt.Sprintf("%x", ratchetData[:8])
	} else {
		ratchetHex = "(empty)"
	}
	debug.Log(debug.DEBUG_INFO, "Parsed announce", "pubKey", fmt.Sprintf("%x", pubKey[:8]), "nameHash", fmt.Sprintf("%x", nameHash), "randomHash", fmt.Sprintf("%x", randomHash), "ratchet", ratchetHex, "appData_len", len(appData))

	// Create identity from public key
	id = identity.FromPublicKey(pubKey)
	if id == nil {
		debug.Log(debug.DEBUG_INFO, "Failed to create identity from public key")
		return fmt.Errorf("invalid identity")
	}
	debug.Log(debug.DEBUG_INFO, "Successfully created identity")

	// For announce packets, use destination hash from packet header (first 16 bytes of addresses)
	// This matches the RNS validate_announce logic
	destinationHash := addresses[:16]

	signData := make([]byte, 0)
	signData = append(signData, destinationHash...) // destination hash from packet header
	signData = append(signData, pubKey...)
	signData = append(signData, nameHash...)
	signData = append(signData, randomHash...)
	if len(ratchetData) > 0 {
		signData = append(signData, ratchetData...)
	}
	signData = append(signData, appData...)

	debug.Log(debug.DEBUG_INFO, "Verifying signature", "data_len", len(signData))

	// Check if this passes full RNS validation (signature + destination hash check)
	hashMaterial := make([]byte, 0)
	hashMaterial = append(hashMaterial, nameHash...)        // Name hash (10 bytes) first
	hashMaterial = append(hashMaterial, id.Hash()...)      // Identity hash (16 bytes) second
	expectedHashFull := sha256.Sum256(hashMaterial)
	expectedHash := expectedHashFull[:16]

	debug.Log(debug.DEBUG_INFO, "Destination hash from packet", "hash", fmt.Sprintf("%x", destinationHash))
	debug.Log(debug.DEBUG_INFO, "Expected destination hash", "hash", fmt.Sprintf("%x", expectedHash))
	debug.Log(debug.DEBUG_INFO, "Hash match", "match", string(destinationHash) == string(expectedHash))

	hasAppData := len(appData) > 0

	if !id.Verify(signData, signature) {
		if hasAppData {
			debug.Log(debug.DEBUG_INFO, "Announce packet has app_data, signature failed but accepting")
		} else {
			debug.Log(debug.DEBUG_INFO, "Signature verification failed - announce rejected")
			return fmt.Errorf("invalid announce signature")
		}
	} else {
		debug.Log(debug.DEBUG_INFO, "Signature verification successful")
	}

	if string(destinationHash) != string(expectedHash) {
		if hasAppData {
			debug.Log(debug.DEBUG_INFO, "Announce packet has app_data, destination hash mismatch but accepting")
		} else {
			debug.Log(debug.DEBUG_INFO, "Destination hash mismatch - announce rejected")
			return fmt.Errorf("destination hash mismatch")
		}
	} else {
		debug.Log(debug.DEBUG_INFO, "Destination hash validation successful")
	}

	debug.Log(debug.DEBUG_INFO, "Signature and destination hash verified successfully")
	// Log app_data content for accepted announces
	if len(appData) > 0 {
		debug.Log(debug.DEBUG_INFO, "Accepted announce app_data", "data", fmt.Sprintf("%x", appData), "string", string(appData))
	}

	// Store the identity for later recall
	identity.Remember(data, destinationHash, pubKey, appData)

	// Generate announce hash to check for duplicates
	announceHash := sha256.Sum256(data)
	hashStr := string(announceHash[:])

	debug.Log(debug.DEBUG_INFO, "Announce hash", "hash", fmt.Sprintf("%x", announceHash[:8]))

	t.mutex.Lock()
	if _, seen := t.seenAnnounces[hashStr]; seen {
		t.mutex.Unlock()
		debug.Log(debug.DEBUG_INFO, "Ignoring duplicate announce", "hash", fmt.Sprintf("%x", announceHash[:8]))
		return nil
	}
	t.seenAnnounces[hashStr] = true
	t.mutex.Unlock()

	debug.Log(debug.DEBUG_INFO, "Processing new announce")

	// Register the path from this announce
	// The destination is reachable via the interface that received this announce
	if iface != nil {
		// Use unlocked version since we may be called in a locked context
		t.mutex.Lock()
		t.updatePathUnlocked(destinationHash, nil, iface.GetName(), hopCount)
		t.mutex.Unlock()
		debug.Log(debug.DEBUG_INFO, "Registered path", "hash", fmt.Sprintf("%x", destinationHash), "interface", iface.GetName(), "hops", hopCount)
	}

	// Notify handlers first, regardless of forwarding limits
	debug.Log(debug.DEBUG_INFO, "Notifying announce handlers", "destHash", fmt.Sprintf("%x", addresses[:16]), "appDataLen", len(appData))
	t.notifyAnnounceHandlers(addresses[:16], id, appData)
	debug.Log(debug.DEBUG_INFO, "Announce handlers notified")

	// Don't forward if max hops reached
	if hopCount >= MAX_HOPS {
		debug.Log(debug.DEBUG_INFO, "Announce exceeded max hops", "hops", hopCount)
		return nil
	}
	debug.Log(debug.DEBUG_INFO, "Hop count OK", "hops", hopCount)

	// Check bandwidth allocation for announces
	if !t.announceRate.Allow() {
		debug.Log(debug.DEBUG_INFO, "Announce rate limit exceeded, not forwarding")
		return nil
	}
	debug.Log(debug.DEBUG_INFO, "Bandwidth check passed")

	// Add random delay before retransmission (0-2 seconds)
	var delay time.Duration
	b := make([]byte, 8)
	_, err := rand.Read(b)
	if err != nil {
		debug.Log(debug.DEBUG_ALL, "Failed to generate random delay", "error", err)
		delay = time.Duration(0) // Default to no delay on error
	} else {
		delay = time.Duration(binary.BigEndian.Uint64(b)%2000) * time.Millisecond // #nosec G115
	}
	time.Sleep(delay)

	// Increment hop count
	data[1]++

	// Broadcast to all other interfaces
	var lastErr error
	for name, outIface := range t.interfaces {
		if outIface == iface || !outIface.IsEnabled() {
			continue
		}

		debug.Log(debug.DEBUG_ALL, "Forwarding announce on interface", "name", name)
		if err := outIface.Send(data, ""); err != nil {
			debug.Log(debug.DEBUG_ALL, "Failed to forward announce", "name", name, "error", err)
			lastErr = err
		}
	}

	return lastErr
}

func (t *Transport) handleLinkPacket(data []byte, iface common.NetworkInterface) {
	debug.Log(debug.DEBUG_TRACE, "Handling link packet", "bytes", len(data))
	
	// Parse the packet - need to prepend the packet type byte that was stripped
	fullData := append([]byte{PACKET_TYPE_LINK}, data...)
	pkt := &packet.Packet{Raw: fullData}
	if err := pkt.Unpack(); err != nil {
		debug.Log(debug.DEBUG_INFO, "Failed to unpack link packet", "error", err)
		return
	}

	destHash := pkt.DestinationHash
	if len(destHash) > 16 {
		destHash = destHash[:16]
	}
	
	debug.Log(debug.DEBUG_TRACE, "Link packet for destination", "hash", fmt.Sprintf("%x", destHash), "context", fmt.Sprintf("0x%02x", pkt.Context))

	// Check if this is a link request (initial link establishment)
	if pkt.Context == packet.ContextLinkIdentify {
		debug.Log(debug.DEBUG_VERBOSE, "Received link request for destination", "hash", fmt.Sprintf("%x", destHash))
		
		// Look up the destination
		t.mutex.RLock()
		destIface, exists := t.destinations[string(destHash)]
		t.mutex.RUnlock()
		
		if !exists {
			debug.Log(debug.DEBUG_INFO, "No destination registered for hash", "hash", fmt.Sprintf("%x", destHash))
			return
		}
		
		debug.Log(debug.DEBUG_TRACE, "Found registered destination", "hash", fmt.Sprintf("%x", destHash))
		
		// Handle the incoming link request
		t.handleIncomingLinkRequest(pkt, destIface, iface)
		return
	}

	// Handle regular link packets (for established links)
	if link := t.findLink(destHash); link != nil {
		debug.Log(debug.DEBUG_PACKETS, "Routing packet to established link")
		if link.packetCb != nil {
			debug.Log(debug.DEBUG_ALL, "Executing packet callback", "bytes", len(pkt.Data))
			link.packetCb(pkt.Data, pkt)
		}
	} else {
		debug.Log(debug.DEBUG_TRACE, "No established link found for destination", "hash", fmt.Sprintf("%x", destHash))
	}
}

func (t *Transport) handleIncomingLinkRequest(pkt *packet.Packet, destIface interface{}, networkIface common.NetworkInterface) {
	debug.Log(debug.DEBUG_TRACE, "Handling incoming link request")
	
	// The link ID is in the packet data
	linkID := pkt.Data
	if len(linkID) == 0 {
		debug.Log(debug.DEBUG_INFO, "No link ID in link request packet")
		return
	}
	
	debug.Log(debug.DEBUG_TRACE, "Link request with ID", "id", fmt.Sprintf("%x", linkID[:8]))
	
	// Call the destination's link established callback directly
	// Use reflection to call the method if it exists
	destValue := reflect.ValueOf(destIface)
	if destValue.IsValid() && !destValue.IsNil() {
		// Try to call GetLinkCallback method
		method := destValue.MethodByName("GetLinkCallback")
		if method.IsValid() {
			results := method.Call(nil)
			if len(results) > 0 && !results[0].IsNil() {
				// The callback is of type common.LinkEstablishedCallback which is func(interface{})
				callback := results[0].Interface().(common.LinkEstablishedCallback)
				debug.Log(debug.DEBUG_VERBOSE, "Calling destination's link established callback")
				callback(linkID)
			} else {
				debug.Log(debug.DEBUG_TRACE, "No link established callback set on destination")
			}
		} else {
			debug.Log(debug.DEBUG_INFO, "Destination does not have GetLinkCallback method")
		}
	} else {
		debug.Log(debug.DEBUG_INFO, "Invalid destination object")
	}
	
	debug.Log(debug.DEBUG_VERBOSE, "Link request handled successfully")
}

func (t *Transport) handlePathResponse(data []byte, iface common.NetworkInterface) {
	if len(data) < 33 { // 32 bytes hash + 1 byte hops minimum
		return
	}

	destHash := data[:32]
	hops := data[32]
	var nextHop []byte

	if len(data) > 33 {
		nextHop = data[33:]
	}

	// Use interface name when updating path
	if iface != nil {
		t.UpdatePath(destHash, nextHop, iface.GetName(), hops)
	}
}

func (t *Transport) handleTransportPacket(data []byte, iface common.NetworkInterface) {
	// Handle transport packet
}

func (t *Transport) findLink(dest []byte) *Link {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	// Use dest to lookup link in map
	if link, exists := t.links[string(dest)]; exists {
		return link
	}
	return nil
}

func (t *Transport) SendPacket(p *packet.Packet) error {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	debug.Log(debug.DEBUG_VERBOSE, "Sending packet", "type", fmt.Sprintf("0x%02x", p.PacketType), "header", p.HeaderType)

	data, err := p.Serialize()
	if err != nil {
		debug.Log(debug.DEBUG_INFO, "Packet serialization failed", "error", err)
		return fmt.Errorf("failed to serialize packet: %w", err)
	}
	debug.Log(debug.DEBUG_TRACE, "Serialized packet size", "bytes", len(data))

	// Use the DestinationHash field directly for path lookup
	destHash := p.DestinationHash
	if len(destHash) > 16 {
		destHash = destHash[:16]
	}
	debug.Log(debug.DEBUG_PACKETS, "Destination hash", "hash", fmt.Sprintf("%x", destHash))

	path, exists := t.paths[string(destHash)]
	if !exists {
		debug.Log(debug.DEBUG_INFO, "No path found for destination", "hash", fmt.Sprintf("%x", destHash))
		return errors.New("no path to destination")
	}

	debug.Log(debug.DEBUG_TRACE, "Using path", "interface", path.Interface.GetName(), "nextHop", fmt.Sprintf("%x", path.NextHop), "hops", path.HopCount)

	if err := path.Interface.Send(data, ""); err != nil {
		debug.Log(debug.DEBUG_INFO, "Failed to send packet", "error", err)
		return fmt.Errorf("failed to send packet: %w", err)
	}

	debug.Log(debug.DEBUG_ALL, "Packet sent successfully")
	return nil
}

func (t *Transport) GetLink(destHash []byte) (*Link, error) {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	link, exists := t.links[string(destHash)]
	if !exists {
		// Create new link if it doesn't exist
		link = NewLink(
			destHash,
			nil, // established callback
			nil, // closed callback
		)
		t.links[string(destHash)] = link
	}

	return link, nil
}

func (l *Link) OnConnected(cb func()) {
	l.connectedCb = cb
	if !l.establishedAt.IsZero() && cb != nil {
		cb()
	}
}

func (l *Link) OnDisconnected(cb func()) {
	l.disconnectedCb = cb
}

func (l *Link) GetRemoteIdentity() []byte {
	return l.remoteIdentity
}

func (l *Link) TrackPhyStats(track bool) {
	l.mutex.Lock()
	defer l.mutex.Unlock()
	l.physicalStats = track
}

func (l *Link) GetRSSI() int {
	// Implement physical layer stats
	return 0
}

func (l *Link) GetSNR() float64 {
	// Implement physical layer stats
	return 0
}

func (l *Link) GetQ() float64 {
	// Implement physical layer stats
	return 0
}

func (l *Link) SetResourceStrategy(strategy int) error {
	l.mutex.Lock()
	defer l.mutex.Unlock()

	if strategy != AcceptNone && strategy != AcceptAll && strategy != AcceptApp {
		return errors.New("invalid resource strategy")
	}

	l.resourceStrategy = strategy
	return nil
}

func (l *Link) SetResourceStartedCallback(cb func(interface{})) {
	l.mutex.Lock()
	defer l.mutex.Unlock()
	l.resourceStartedCb = cb
}

func (l *Link) SetResourceConcludedCallback(cb func(interface{})) {
	l.mutex.Lock()
	defer l.mutex.Unlock()
	l.resourceConcludedCb = cb
}

func (l *Link) SetRemoteIdentifiedCallback(cb func(*Link, []byte)) {
	l.mutex.Lock()
	defer l.mutex.Unlock()
	l.remoteIdentifiedCb = cb
}

func (l *Link) HandleResource(resource interface{}) bool {
	l.mutex.RLock()
	defer l.mutex.RUnlock()

	switch l.resourceStrategy {
	case AcceptNone:
		return false
	case AcceptAll:
		return true
	case AcceptApp:
		if l.resourceCb != nil {
			return l.resourceCb(resource)
		}
		return false
	default:
		return false
	}
}

func (t *Transport) Start() error {
	t.mutex.Lock()
	defer t.mutex.Unlock()
	return nil
}

// LinkInterface defines the methods required by Channel
type LinkInterface interface {
	GetStatus() int
	GetRTT() float64
	RTT() float64
	Send(data []byte) interface{}
	Resend(packet interface{}) error
	SetPacketTimeout(packet interface{}, callback func(interface{}), timeout time.Duration)
	SetPacketDelivered(packet interface{}, callback func(interface{}))
}

func (l *Link) GetRTT() float64 {
	l.mutex.RLock()
	defer l.mutex.RUnlock()
	return l.rtt.Seconds()
}

func (l *Link) RTT() float64 {
	return l.GetRTT()
}

func (l *Link) Resend(p interface{}) error {
	if pkt, ok := p.(*packet.Packet); ok {
		t := GetTransportInstance()
		if t == nil {
			return fmt.Errorf("transport not initialized")
		}
		return t.SendPacket(pkt)
	}
	return fmt.Errorf("invalid packet type")
}

func (l *Link) SetPacketTimeout(p interface{}, callback func(interface{}), timeout time.Duration) {
	if pkt, ok := p.(*packet.Packet); ok {
		time.AfterFunc(timeout, func() {
			callback(pkt)
		})
	}
}

func (l *Link) SetPacketDelivered(p interface{}, callback func(interface{})) {
	if pkt, ok := p.(*packet.Packet); ok {
		l.mutex.Lock()
		l.rtt = time.Since(time.Now())
		l.mutex.Unlock()
		callback(pkt)
	}
}

func (l *Link) GetStatus() int {
	l.mutex.RLock()
	defer l.mutex.RUnlock()
	return l.status
}

func CreateAnnouncePacket(destHash []byte, identity *identity.Identity, appData []byte, destName string, hops byte, config *common.ReticulumConfig) []byte {
	debug.Log(debug.DEBUG_INFO, "Creating announce packet", "destName", destName)
	debug.Log(debug.DEBUG_INFO, "Input", "destHash", fmt.Sprintf("%x", destHash[:8]), "appData", string(appData), "hops", hops)

	// Create header (2 bytes)
	headerByte := byte(
		(0 << 7) | // Interface flag (IFAC_NONE)
			(0 << 6) | // Header type (HEADER_TYPE_1)
			(0 << 5) | // Context flag
			(0 << 4) | // Propagation type (BROADCAST)
			(0 << 2) | // Destination type (SINGLE)
			PACKET_TYPE_ANNOUNCE, // Packet type (0x01)
	)

	debug.Log(debug.DEBUG_ALL, "Created header byte", "header", fmt.Sprintf("0x%02x", headerByte), "hops", hops)
	packet := []byte{headerByte, hops}
	debug.Log(debug.DEBUG_ALL, "Initial packet size", "bytes", len(packet))

	// Add destination hash (16 bytes)
	if len(destHash) > 16 {
		destHash = destHash[:16]
	}
	debug.Log(debug.DEBUG_ALL, "Adding destination hash (16 bytes)", "hash", fmt.Sprintf("%x", destHash))
	packet = append(packet, destHash...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding destination hash", "bytes", len(packet))

	// Get full public key and split into encryption and signing keys
	pubKey := identity.GetPublicKey()
	encKey := pubKey[:32]  // x25519 public key for encryption
	signKey := pubKey[32:] // Ed25519 public key for signing
	debug.Log(debug.DEBUG_ALL, "Full public key", "key", fmt.Sprintf("%x", pubKey))

	// Add encryption key (32 bytes)
	debug.Log(debug.DEBUG_ALL, "Adding encryption key (32 bytes)", "key", fmt.Sprintf("%x", encKey))
	packet = append(packet, encKey...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding encryption key", "bytes", len(packet))

	// Add signing key (32 bytes)
	debug.Log(debug.DEBUG_ALL, "Adding signing key (32 bytes)", "key", fmt.Sprintf("%x", signKey))
	packet = append(packet, signKey...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding signing key", "bytes", len(packet))

	// Add name hash (10 bytes)
	nameHash := sha256.Sum256([]byte(destName))
	debug.Log(debug.DEBUG_ALL, "Adding name hash (10 bytes)", "destName", destName, "hash", fmt.Sprintf("%x", nameHash[:10]))
	packet = append(packet, nameHash[:10]...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding name hash", "bytes", len(packet))

	// Add random hash (10 bytes)
	randomBytes := make([]byte, 5)
	_, err := rand.Read(randomBytes) // #nosec G104
	if err != nil {
		debug.Log(debug.DEBUG_ALL, "Failed to read random bytes", "error", err)
		return nil // Or handle the error appropriately
	}
	timeBytes := make([]byte, 8)
	binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix())) // #nosec G115
	debug.Log(debug.DEBUG_ALL, "Adding random hash (10 bytes)", "random", fmt.Sprintf("%x", randomBytes), "time", fmt.Sprintf("%x", timeBytes[:5]))
	packet = append(packet, randomBytes...)
	packet = append(packet, timeBytes[:5]...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding random hash", "bytes", len(packet))

	// Create msgpack array for app data
	nameBytes := []byte(destName)
	appDataMsg := []byte{0x92} // array of 2 elements

	// Add name as first element
	appDataMsg = append(appDataMsg, 0xc4, byte(len(nameBytes)))
	appDataMsg = append(appDataMsg, nameBytes...)

	// Add app data as second element
	appDataMsg = append(appDataMsg, 0xc4, byte(len(appData)))
	appDataMsg = append(appDataMsg, appData...)

	// Create signature over destination hash and app data
	signData := append(destHash, appDataMsg...)
	signature := identity.Sign(signData)
	debug.Log(debug.DEBUG_ALL, "Adding signature (64 bytes)", "signature", fmt.Sprintf("%x", signature))
	packet = append(packet, signature...)
	debug.Log(debug.DEBUG_ALL, "Packet size after adding signature", "bytes", len(packet))

	// Finally add the app data message
	packet = append(packet, appDataMsg...)
	debug.Log(debug.DEBUG_INFO, "Final packet size", "bytes", len(packet))
	debug.Log(debug.DEBUG_INFO, "appDataMsg", "data", fmt.Sprintf("%x", appDataMsg), "len", len(appDataMsg))

	return packet
}

func (t *Transport) GetInterfaces() map[string]common.NetworkInterface {
	t.mutex.RLock()
	defer t.mutex.RUnlock()

	interfaces := make(map[string]common.NetworkInterface, len(t.interfaces))
	for k, v := range t.interfaces {
		interfaces[k] = v
	}

	return interfaces
}

func (t *Transport) GetConfig() *common.ReticulumConfig {
	return t.config
}