From 41e498a71c1109db1f7ae36df9ba3fe82b4f8117 Mon Sep 17 00:00:00 2001
From: jciupis <30890354+jciupis@users.noreply.github.com>
Date: Tue, 10 Oct 2017 10:42:45 -0500
Subject: [PATCH] [mle] add Status TLV check in Child Update Request and
 Response (#2243)

---
 src/core/thread/mle.cpp        | 18 ++++++++++++++++++
 src/core/thread/mle_router.cpp | 14 ++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/core/thread/mle.cpp b/src/core/thread/mle.cpp
index 483d7206c..259e1c845 100644
--- a/src/core/thread/mle.cpp
+++ b/src/core/thread/mle.cpp
@@ -2846,10 +2846,12 @@ otError Mle::HandleChildUpdateRequest(const Message &aMessage, const Ip6::Messag
     static const uint8_t kMaxResponseTlvs = 5;
 
     otError error = OT_ERROR_NONE;
+    Mac::ExtAddress srcAddr;
     SourceAddressTlv sourceAddress;
     LeaderDataTlv leaderData;
     NetworkDataTlv networkData;
     ChallengeTlv challenge;
+    StatusTlv status;
     TlvRequestTlv tlvRequest;
     uint8_t tlvs[kMaxResponseTlvs] = {};
     uint8_t numTlvs = 0;
@@ -2865,6 +2867,22 @@ otError Mle::HandleChildUpdateRequest(const Message &aMessage, const Ip6::Messag
     // Leader Data, Network Data, Active Timestamp, Pending Timestamp
     SuccessOrExit(error = HandleLeaderData(aMessage, aMessageInfo));
 
+    // Status
+    if (Tlv::GetTlv(aMessage, Tlv::kStatus, sizeof(status), status) == OT_ERROR_NONE)
+    {
+        VerifyOrExit(status.IsValid(), error = OT_ERROR_PARSE);
+
+        aMessageInfo.GetPeerAddr().ToExtAddress(srcAddr);
+        VerifyOrExit((memcmp(&mParent.GetExtAddress(), &srcAddr, sizeof(srcAddr)) == 0),
+                     error = OT_ERROR_DROP);
+
+        if (status.GetStatus() == StatusTlv::kError)
+        {
+            BecomeDetached();
+            ExitNow();
+        }
+    }
+
     // TLV Request
     if (Tlv::GetTlv(aMessage, Tlv::kTlvRequest, sizeof(tlvRequest), tlvRequest) == OT_ERROR_NONE)
     {
diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp
index 50cace62e..82040bf1e 100644
--- a/src/core/thread/mle_router.cpp
+++ b/src/core/thread/mle_router.cpp
@@ -2417,6 +2417,7 @@ otError MleRouter::HandleChildUpdateResponse(const Message &aMessage, const Ip6:
     TimeoutTlv timeout;
     AddressRegistrationTlv address;
     ResponseTlv response;
+    StatusTlv status;
     LinkFrameCounterTlv linkFrameCounter;
     MleFrameCounterTlv mleFrameCounter;
     LeaderDataTlv leaderData;
@@ -2456,6 +2457,19 @@ otError MleRouter::HandleChildUpdateResponse(const Message &aMessage, const Ip6:
                      error = OT_ERROR_SECURITY);
     }
 
+    // Status
+    if (Tlv::GetTlv(aMessage, Tlv::kStatus, sizeof(status), status) == OT_ERROR_NONE)
+    {
+        VerifyOrExit(status.IsValid(), error = OT_ERROR_PARSE);
+
+        if (status.GetStatus() == StatusTlv::kError)
+        {
+            RemoveStoredChild(child->GetRloc16());
+            child->SetState(Neighbor::kStateInvalid);
+            ExitNow();
+        }
+    }
+
     // Link-Layer Frame Counter
     if (Tlv::GetTlv(aMessage, Tlv::kLinkFrameCounter, sizeof(linkFrameCounter), linkFrameCounter) == OT_ERROR_NONE)
     {