espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-16 07:37:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[trel] limit direct peer sockaddr updates to mode 0/1 secured frames (#13414)

Browse Source 
The rx-based fallback that directly updates a TREL peer socket address
after a successfully processed frame previously accepted any frame with
link security enabled, including key ID mode 2 frames secured with the
well-known key. Update the check in `Mac::HandleReceivedFrame()` to use
`IsSecuredWith(kAllowKeyIdMode0 | kAllowKeyIdMode1)` so that only
frames secured with the network key or the KEK authorize a direct
update, matching the policy in `ThreadLinkInfo::SetFrom()`. Other
frames still trigger the discrepancy signal to the platform layer.

Co-authored-by: aussinfosec <[email protected]>
This commit is contained in:
Griffin Francis
2026-07-27 21:16:10 -07:00
committed by GitHub
co-authored by aussinfosec
parent 64634b5090
commit 2a1e03c430
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/mac/mac.cpp
+11 -5
View File
@@ -2202,13 +2202,19 @@ exit:
// saved in the corresponding TREL peer, and signal this to
// the platform layer.
//
// If the frame used link security and was successfully
// If the frame was secured with the network key (key ID
// mode 1) or the KEK (key ID mode 0) and was successfully
// processed, we allow the `Peer` entry socket information
// to be updated directly.
// to be updated directly. Key ID mode 2 uses the
// well-known key and therefore does not identify a
// specific sender, so it is not accepted for a direct
// update (matching the policy in
// `ThreadLinkInfo::SetFrom()`).
Get<Trel::Link>().CheckPeerAddrOnRxSuccess(aFrame->GetSecurityEnabled()
? Trel::Link::kAllowPeerSockAddrUpdate
: Trel::Link::kDisallowPeerSockAddrUpdate);
Get<Trel::Link>().CheckPeerAddrOnRxSuccess(
aFrame->IsSecuredWith(RxFrame::kAllowKeyIdMode0 | RxFrame::kAllowKeyIdMode1)
? Trel::Link::kAllowPeerSockAddrUpdate
: Trel::Link::kDisallowPeerSockAddrUpdate);
}
}
#endif // OPENTHREAD_CONFIG_RADIO_LINK_TREL_ENABLE