#84: prevent valid Nonce Reports being dropped after an end node restart

[Peter Balogh (silabs-peterb)]

Issue

• Nonce Report from power cycled end node might be dropped due to duplicate detection #84
• JIRA: ZWAVE_SDK-2067

Closes: #84

Change

Description

Fix S2 duplicate detection incorrectly dropping valid Nonce Reports after an end node restarts.

An end node selects a random sequence number at startup. This sequence may be one below the last value stored by ZPC. Previously, the duplicate window treated both the current and preceding sequence numbers as duplicates, preventing SPAN re-establishment.

The fix rejects only an exact (peer, sequence number) match and stores any different sequence number as the new value.

Specification alignment

This follows the S2 duplicate-detection requirements CC:009F.01.00.11.02D–CC:009F.01.00.11.030, which define duplicate detection using the source peer and sequence number.

It also supports CC:009F.01.00.11.0AD, which requires a random sequence number at startup.

Checklist

• Pull request template has been filled out correctly
• ./ci/scripts/clang-tidy.sh check has been run locally (see CONTRIBUTING.md)
• Documentation has been updated if necessary
• A Contribution License Agreement has been established between Silicon Labs (@SiliconLabs) and author's company (matching email domain)

[cursor]

PR Summary

High Risk
Changes Z-Wave S2 security duplicate-detection behavior across all sequenced frames; incorrect logic could weaken replay protection or break resync after node restart.

Overview
Fixes S2 duplicate detection so valid Nonce Reports are not dropped when an end node restarts and picks a new random sequence number (often one below the value still stored in the controller’s SPAN table).

S2_verify_seq no longer uses a configurable duplicate window (S2_SEQ_DUPL_WINDOW_SIZE / S2_SEQ_DUPL_WINDOW_SIZE_NONCE_GET, removed from s2_protocol.h). It now treats a frame as a duplicate only on an exact match of the peer’s last stored rx_seq; any different sequence is accepted and stored. The same rule applies to Nonce Get, Nonce Report registration, message encapsulation, and FSM handling.

Adds test_nonce_report_accepts_new_random_sequence_after_peer_restart to verify a post-restart sequence one below the previous value is accepted while an immediate replay with the same sequence is ignored.

^{Reviewed by Cursor Bugbot for commit a35c3cd. Configure here.}

[Peter Balogh (silabs-peterb)]

PR Summary

High Risk Changes Z-Wave S2 security duplicate-detection behavior across all sequenced frames; incorrect logic could weaken replay protection or break resync after node restart.

Overview Fixes S2 duplicate detection so valid Nonce Reports are not dropped when an end node restarts and picks a new random sequence number (often one below the value still stored in the controller’s SPAN table).

S2_verify_seq no longer uses a configurable duplicate window (S2_SEQ_DUPL_WINDOW_SIZE / S2_SEQ_DUPL_WINDOW_SIZE_NONCE_GET, removed from s2_protocol.h). It now treats a frame as a duplicate only on an exact match of the peer’s last stored rx_seq; any different sequence is accepted and stored. The same rule applies to Nonce Get, Nonce Report registration, message encapsulation, and FSM handling.

Adds test_nonce_report_accepts_new_random_sequence_after_peer_restart to verify a post-restart sequence one below the previous value is accepted while an immediate replay with the same sequence is ignored.

Reviewed by Cursor Bugbot for commit a35c3cd. Configure here.

The risk classification is understandable because S2_verify_seq() is shared
by multiple S2 frame types.

The change is intentional and aligned with the S2 duplicate-detection
requirements. A frame is considered a duplicate when its peer and sequence
number match the stored entry. Any different sequence number replaces the
stored value. This also allows a node to select a new random sequence number
after restart, as required by CC:009F.01.00.11.0AD.

Replay protection for an immediate duplicate remains intact: the regression
test verifies that the first Nonce Report with the new sequence is accepted
and an immediate replay with the same sequence is rejected.

[siliconlabsdevops-svc-devops]

CTT Jenkins job: $zpc_ctt_jenkins_url/job/zw-ctt-automation-multibranch/job/main/3712/

[siliconlabsdevops-svc-devops]

CTT Jenkins job: $zpc_ctt_jenkins_url/job/zw-ctt-automation-multibranch/job/main/3718/