Pin admin responses to the stored peer key and request id#11092
Open
caveman99 wants to merge 3 commits into
Open
Pin admin responses to the stored peer key and request id#11092caveman99 wants to merge 3 commits into
caveman99 wants to merge 3 commits into
Conversation
noteOutgoingAdminRequest derived its PKC pin from p.public_key, which nothing populates on the outgoing path, so keyValid was false for every client request and the pin never engaged. The accepted-response predicate reduced to an unauthenticated from plus variant and subtype. Resolve the destination key from NodeDB the way perhapsEncode does, and pin it only when the request would actually be PKC-encrypted. Extract that condition from perhapsEncode as wouldEncryptWithPKC so both use one predicate. Also record the request's packet id and require the response to echo it.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughPKC eligibility is centralized in a Router helper. Admin requests now record packet IDs and destination keys, while responses require matching request IDs. Tests cover stored-key pinning, ham mode, unpinned requests, and mismatched responses. ChangesAdmin PKC correlation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant AdminModule
participant NodeDB
participant Router
participant AdminResponse
AdminModule->>NodeDB: retrieve destination public key
AdminModule->>Router: evaluate PKC eligibility
AdminModule->>AdminModule: store requestId and pinned key
AdminResponse->>AdminModule: return request_id and response
AdminModule-->>AdminResponse: accept matching validated response
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/modules/AdminModule.cpp`:
- Line 1934: Guard the request ID assignment in the request-slot setup around
slot->requestId and responseIsSolicited: treat p.id == 0 as having no valid
pinning token, and ensure zero can never satisfy the later decoded request_id
comparison. Preserve normal nonzero request IDs and the existing
solicited-response behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 3b80af4c-465e-4733-95b9-e129127e1e45
📒 Files selected for processing (5)
src/mesh/Router.cppsrc/mesh/Router.hsrc/modules/AdminModule.cppsrc/modules/AdminModule.htest/test_admin_session_repro/test_main.cpp
Contributor
⚡ Try this PR in the Web Flasher
Warning This is an automated, unreviewed CI test build. Back up your device configuration Supported boards built by this PR (30)
Build artifacts expire on 2026-08-19. Updated for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AdminModule::noteOutgoingAdminRequestcomputed its PKC pin asp.pki_encrypted && p.public_key.size == 32. Neither field is populated on the outgoing path: the only firmware write toMeshPacket.public_keyis inperhapsDecode(RX), andpki_encryptedis set inperhapsEncode, afterMeshService::handleToRadiohas already called this. SokeyValidwas false for every client request and the pin was dead code.The accepted-response predicate therefore reduced to
from== queried node, plus variant, subtype, window and consumption.fromis unauthenticated, so an attacker who knows an operator has an outstandingget_module_config_request(REMOTEHARDWARE)could inject a matching response over RF or MQTT downlink and overwritenode_remote_hardware_pins[].Changes:
nodeDB->copyPublicKey(whatperhapsEncodeencrypts to) and pin that.perhapsEncodeaswouldEncryptWithPKCand shared, rather than duplicated.decoded.request_id.setReplyToalready sets this on every reply.Tests: the previous pin test constructed
pki_encrypted/public_keyby hand, which the outgoing path never produces, so it passed against a synthetic input. It now uses a NodeDB-stored key. Added coverage for the stored-key pin, the request-id binding, and a ham-mode case asserting an unpinnable request is not rejected.Summary by CodeRabbit
Security
Bug Fixes
Tests