From 626f33a15ecae2c79c542fba534342aca614119a Mon Sep 17 00:00:00 2001
From: YuanHongbin <975559679@qq.com>
Date: Tue, 8 Sep 2026 10:06:32 +0800
Subject: [PATCH] =?UTF-8?q?fix(register):=20=E6=B3=A8=E5=86=8Cpayload?=
 =?UTF-8?q?=E5=90=88=E6=B3=95=E6=80=A7=E6=A0=A1=E9=AA=8C,=E6=8B=A6?=
 =?UTF-8?q?=E6=88=AA=E4=B8=B2=E5=8F=B0=E4=B9=B1=E7=A0=81=E6=B3=A8=E5=86=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 新增RegPayloadValid校验: SensorN非0/PayloadLen与条目数匹配/传感器类型白名单(SensorTypeDataLen表内且非保留)/MAC非全0全FF且非网关MAC/注册帧GWMac非空时必须与本网关匹配
- 频偏串台误解调的乱码帧几乎必然被拦截(随机类型命中合法类型概率约0.03%), 不再占用注册表槽位
- GWMac为全0/全FF视为未填放行, 兼容老固件; 已注册设备重注册路径不受影响
---
 Project/GateWay/source/User/Src/Public.c | 63 ++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/Project/GateWay/source/User/Src/Public.c b/Project/GateWay/source/User/Src/Public.c
index d214dc7..672074f 100644
--- a/Project/GateWay/source/User/Src/Public.c
+++ b/Project/GateWay/source/User/Src/Public.c
@@ -244,6 +244,63 @@ int CheckCommUnitExcl(GateWayPara GateWay, uint8_t *CommUnitMac)
 	}
 	return -1;
 }
+/*****************************************************************************************
+* 函数名称: RegPayloadValid
+* 功能描述: 注册请求payload合法性校验,拦截频偏串台误解调的乱码帧,避免乱码设备占用注册表
+* 参    数: GateWay, 网关句柄
+			CUHeader, 注册帧头
+			PayLoad, 注册负载数据
+* 返 回 值: 合法返回true, 非法返回false
+*****************************************************************************************/
+static bool RegPayloadValid(GateWayPara GateWay, CommUnitFrameHeader CUHeader, uint8_t *PayLoad)
+{
+	uint8_t SensorN = PayLoad[0];
+	int i, j;
+	bool MacEmpty;
+
+	/*空注册无意义*/
+	if(SensorN == 0) {
+		return false;
+	}
+	/*payload长度必须容纳N个传感器条目(每条目6字节)*/
+	if(CUHeader->PayloadLen < (uint16_t)(SensorN * 6 + 1)) {
+		return false;
+	}
+	/*通讯单元自身MAC不能为全0/全FF*/
+	MacEmpty = true;
+	for(i = 0; i < 6; i++) {
+		if(CUHeader->DevMac[i] != 0x00 && CUHeader->DevMac[i] != 0xFF) { MacEmpty = false; break; }
+	}
+	if(MacEmpty) {
+		return false;
+	}
+	/*注册帧GWMac若非空(全0/全FF视为未填)则必须与本网关匹配*/
+	MacEmpty = true;
+	for(i = 0; i < 6; i++) {
+		if(CUHeader->GWMac[i] != 0x00 && CUHeader->GWMac[i] != 0xFF) { MacEmpty = false; break; }
+	}
+	if(!MacEmpty && memcmp(CUHeader->GWMac, GateWay->ConfigPara.GwMac, 6) != 0) {
+		return false;
+	}
+	/*逐传感器: 类型必须在已知类型表内且非保留(数据长度>0), MAC非全0/全FF且不等于网关MAC*/
+	for(j = 0; j < SensorN; j++) {
+		uint16_t RegType = PayLoad[(j*6)+1] | (PayLoad[(j*6)+2] << 8);
+		if(RegType == 0x0000 || RegType >= sizeof(SensorTypeDataLen)/sizeof(SensorTypeDataLen[0])
+			|| SensorTypeDataLen[RegType] == 0) {
+			return false;
+		}
+		MacEmpty = true;
+		for(i = 0; i < 6; i++) {
+			uint8_t mac = PayLoad[(j*6)+1+i];
+			if(mac != 0x00 && mac != 0xFF) { MacEmpty = false; break; }
+		}
+		if(MacEmpty || memcmp(&PayLoad[(j*6)+1], GateWay->ConfigPara.GwMac, 6) == 0) {
+			return false;
+		}
+	}
+	return true;
+}
+
 /*****************************************************************************************
 * 函数名称: CommUnitSendCmd
 * 功能描述: 网关下发通讯单元指令函数
@@ -611,6 +668,12 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 			if(PayLoad[0] > SENSOR_NUM_MAX) {
 				return -1;
 			}
+			/*串台防护: 校验注册payload合法性, 拦截频偏误解调的乱码帧*/
+			if(!RegPayloadValid(GateWay, CUHeader, PayLoad)) {
+				MAIN_DBG_LOG("\r\nReg rejected: invalid payload (cross-band interference?) Mac:%02X-%02X-%02X-%02X-%02X-%02X\r\n",
+									CUHeader->DevMac[0], CUHeader->DevMac[1], CUHeader->DevMac[2], CUHeader->DevMac[3], CUHeader->DevMac[4], CUHeader->DevMac[5]);
+				return -1;
+			}
 			
 //			if(CUHeader->PayloadLen < 2)
 //				return -1;