From 2feb5c45ca7be9e6ce00ab46451819b873ee437e Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Mon, 21 Feb 2022 17:42:39 -0800 Subject: [PATCH] [mle] drop Child ID Response if Router IDs do not match (#7430) The Child ID Response message contains the RLOC16 that the Parent assigns to the Child. Add a check to ensure that Parent's and Child's Router IDs match. If the Router IDs do not match, drop the Child ID Response message. --- src/core/thread/mle.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp index 0fa5a201c..e9b01fc73 100644 --- a/src/core/thread/mle.cpp +++ b/src/core/thread/mle.cpp @@ -3650,11 +3650,12 @@ void Mle::HandleChildIdResponse(const Message & aMessage, VerifyOrExit(mAttachState == kAttachStateChildIdRequest); - // Leader Data - SuccessOrExit(error = ReadLeaderData(aMessage, leaderData)); - // ShortAddress SuccessOrExit(error = Tlv::Find(aMessage, shortAddress)); + VerifyOrExit(RouterIdMatch(sourceAddress, shortAddress), error = kErrorRejected); + + // Leader Data + SuccessOrExit(error = ReadLeaderData(aMessage, leaderData)); // Network Data error = Tlv::FindTlvOffset(aMessage, Tlv::kNetworkData, networkDataOffset);