From 2a1e03c43043f4087df75e69f4e10c764fc6e28c Mon Sep 17 00:00:00 2001 From: Griffin Francis Date: Tue, 28 Jul 2026 00:16:10 -0400 Subject: [PATCH] [trel] limit direct peer sockaddr updates to mode 0/1 secured frames (#13414) The rx-based fallback that directly updates a TREL peer socket address after a successfully processed frame previously accepted any frame with link security enabled, including key ID mode 2 frames secured with the well-known key. Update the check in `Mac::HandleReceivedFrame()` to use `IsSecuredWith(kAllowKeyIdMode0 | kAllowKeyIdMode1)` so that only frames secured with the network key or the KEK authorize a direct update, matching the policy in `ThreadLinkInfo::SetFrom()`. Other frames still trigger the discrepancy signal to the platform layer. Co-authored-by: aussinfosec --- src/core/mac/mac.cpp | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/core/mac/mac.cpp b/src/core/mac/mac.cpp index cf757cb8e..acc910d37 100644 --- a/src/core/mac/mac.cpp +++ b/src/core/mac/mac.cpp @@ -2202,13 +2202,19 @@ exit: // saved in the corresponding TREL peer, and signal this to // the platform layer. // - // If the frame used link security and was successfully + // If the frame was secured with the network key (key ID + // mode 1) or the KEK (key ID mode 0) and was successfully // processed, we allow the `Peer` entry socket information - // to be updated directly. + // to be updated directly. Key ID mode 2 uses the + // well-known key and therefore does not identify a + // specific sender, so it is not accepted for a direct + // update (matching the policy in + // `ThreadLinkInfo::SetFrom()`). - Get().CheckPeerAddrOnRxSuccess(aFrame->GetSecurityEnabled() - ? Trel::Link::kAllowPeerSockAddrUpdate - : Trel::Link::kDisallowPeerSockAddrUpdate); + Get().CheckPeerAddrOnRxSuccess( + aFrame->IsSecuredWith(RxFrame::kAllowKeyIdMode0 | RxFrame::kAllowKeyIdMode1) + ? Trel::Link::kAllowPeerSockAddrUpdate + : Trel::Link::kDisallowPeerSockAddrUpdate); } } #endif // OPENTHREAD_CONFIG_RADIO_LINK_TREL_ENABLE