Skip to content

Signature key resolution and a send-path leak - #11283

Merged
thebentern merged 2 commits into
developfrom
security-block-b
Jul 29, 2026
Merged

Signature key resolution and a send-path leak#11283
thebentern merged 2 commits into
developfrom
security-block-b

Conversation

@caveman99

@caveman99 caveman99 commented Jul 29, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Two follow-ups from the post-release backlog, one commit each. Independent of #11282; both branch from develop and merge cleanly in either order.

  • checkXeddsaReceivePolicy resolved the sender key with copyPublicKey, which falls through to the opportunistic TrafficManagement cache. A key planted there could verify a signature and so mark its own node a signer, the trust loop Gate the PKI-decrypt key on signer-proven, not the opportunistic cache #11116 closed on the decrypt path. Now uses copyPublicKeyAuthoritative.
  • Router::send returned BAD_REQUEST for a packet with no payload_variant without releasing it, unlike the position-precision path a few lines below. Reachable from a ToRadio MeshPacket with the variant unset.

Summary by CodeRabbit

  • Bug Fixes
    • Improved handling of unsupported packet payloads to ensure they are properly released when rejected.
    • Strengthened XEdDSA signature verification by requiring an authoritative public key, helping prevent verification with untrusted or opportunistically cached keys.

@coderabbitai

coderabbitai Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4db3a68c-fbe7-43ce-8bd2-94a6aaee1f84

📥 Commits

Reviewing files that changed from the base of the PR and between 50a37b3 and d96e823.

📒 Files selected for processing (1)
  • src/mesh/Router.cpp
📝 Walkthrough

Walkthrough

Router::send now releases packets on an invalid payload-variant error path. XEdDSA receive-policy verification now uses authoritative NodeDB public keys instead of non-authoritative keys.

Changes

Router packet handling and verification

Layer / File(s) Summary
Invalid packet cleanup
src/mesh/Router.cpp		 Router::send releases unsupported payload variants before returning BAD_REQUEST.
Authoritative XEdDSA verification
src/mesh/Router.cpp		 checkXeddsaReceivePolicy uses copyPublicKeyAuthoritative for signature verification and documents the key-trust constraint.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested labels: bugfix

Suggested reviewers: jp-bennett, thebentern, nomdetom

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description summarizes the two fixes, but it doesn't follow the repo template or include the required attestations/testing details. Rewrite it using the template, include the attestations checklist, and note any testing performed or missing device coverage.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title matches both main changes: authoritative signature key resolution and releasing an unreleased send-path packet.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch security-block-b

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚡ Try this PR in the Web Flasher

Flash this PR in the Web Flasher

firmware commit boards expires

Warning

This is an automated, unreviewed CI test build. Back up your device configuration
before flashing, and only flash devices you are able to recover.

Supported boards built by this PR (31)
Device Board Platform
Crowpanel Adv 3.5 TFT elecrow-adv-35-tft esp32-s3
Heltec HT62 heltec-ht62-esp32c3-sx1262 esp32-c3
Heltec Mesh Node 096 heltec-mesh-node-t096 nrf52840
Heltec Mesh Node T1 heltec-mesh-node-t1 nrf52840
Heltec Mesh Node T114 heltec-mesh-node-t114 nrf52840
Heltec V3 heltec-v3 esp32-s3
Heltec V4 heltec-v4 esp32-s3
Meshnology W10 meshnology_w10 esp32-s3
Meshnology W12 meshnology_w12 esp32-s3
Raspberry Pi Pico pico rp2040
Raspberry Pi Pico W picow rp2040
RAK WisMesh Pocket V3 rak_wismesh_pocket nrf52840
RAK WisMesh Pod rak_wismesh_pod nrf52840
RAK WisMesh Repeater Mini V2 rak_wismesh_repeater_mini nrf52840
RAK WisMesh Tag rak_wismeshtag nrf52840
RAK WisBlock 11200 rak11200 esp32
RAK WisBlock 11310 rak11310 rp2040
RAK3312 rak3312 esp32-s3
RAK WisBlock 4631 rak4631 nrf52840
Seeed SenseCAP Mesh-Tracker-X1 seeed_mesh_tracker_X1 nrf52840
Seeed Wio Tracker L1 seeed_wio_tracker_L1 nrf52840
Seeed Xiao NRF52840 Kit seeed_xiao_nrf52840_kit nrf52840
Seeed Xiao ESP32-S3 seeed-xiao-s3 esp32-s3
Station G2 station-g2 esp32-s3
Station G3 station-g3 esp32-s3
LILYGO T-Deck t-deck-tft esp32-s3
LILYGO T-Echo t-echo nrf52840
LILYGO T-Echo Plus t-echo-plus nrf52840
LILYGO T-Impulse Plus t-impulse-plus nrf52840
LilyGo T3-C6 tlora-c6 esp32-c6
Seeed SenseCAP T1000-E tracker-t1000-e nrf52840

Build artifacts expire on 2026-08-28. Updated for d96e823.

@caveman99 caveman99 mentioned this pull request Jul 29, 2026
Merged
@vidplace7 vidplace7 added the bugfix Pull request that fixes bugs label Jul 29, 2026
This was referenced Jul 29, 2026
Merged
Merged
@thebentern
thebentern added this pull request to the merge queue Jul 29, 2026
Merged via the queue into develop with commit 9c260ad Jul 29, 2026
112 of 192 checks passed
@caveman99
caveman99 deleted the security-block-b branch July 30, 2026 06:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bugfix Pull request that fixes bugs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@caveman99 @vidplace7 @thebentern