Repository navigation
fix(zigbee): admit reset sensor counter after authenticated departure (HEAR-261) - #1
Open
danielstena wants to merge 1 commit into
Conversation
Keep the previous NWK replay floor through departure and association. Reset only the departing peer after its newly admitted association extracts the network key, once per authenticated non-rejoin departure. Preserve ordinary rejoins, other peers, failed deliveries and stale completions. Add encrypted-leave/association regression tests and retain strict replay checks. Adapt existing codec expressions to the current Rust 1.98 Clippy gate without changing frame or cryptographic behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A reset sensor can announce an authenticated direct NWK leave (
rejoin=false), associate again during permit-join, extract the network key, and restart its NWK counter at zero. The prior replay floor remains at 58, so ZDP interview responses are dropped and commissioning times out.Keep that replay floor through departure and admission. Capture a departure generation at admission, then retire only that peer's old counter after its fresh association successfully extracts the network key, once per departure. Ordinary rejoins, relayed/invalid leave messages, failed delivery, duplicate association and stale completions preserve replay protection. Other peers and coordinator outgoing counters are unchanged.
This branch starts at Hearth's existing immutable
f90480329c4ad895914a73ec24e94168557d0717pin. The small codec/const expression changes address existing Rust 1.98 Clippy failures without changing encoded frames or cryptographic behavior.The source CI now runs the host workspace regression tests after linting.
Validation: two regression assertions fail against the exact previous pin; all 57 host-workspace tests pass with the repair. Strict all-target/all-feature Clippy (including nursery), formatting, and the actual Ziggurat server build pass. The encrypted receive path accepts the first reset-counter packet and rejects its duplicate. Hearth's complete
pre-pr-fullpassed with this exact revision against frozen base4df95f157b703fc1b49d79b3729d1c94a537c1b5, including Cargo/npm security, the full selected backend/script suites and Wake Up fullstack.HEAR-261: physical model/firmware, both sensors' independent motion/timing and persistence acceptance remain unverified and must be repeated after reviewed delivery. The model was unknown at the recorded failed attempt; E1745 identity was not established. This PR does not activate production.
The PR targets the existing fork integration branch
fix/hear13-node-descriptor-diagnosticsat the previous pin; it does not change that branch or merge/deploy itself. Hearth consumes the immutable reviewed source revision.