From 58fee80b300534b1ca87957d87760590bf853dc5 Mon Sep 17 00:00:00 2001
From: Tom <116762865+NomDeTom@users.noreply.github.com>
Date: Sun, 15 Mar 2026 00:34:19 +0000
Subject: [PATCH] Add spoof detection for UDP packets in UdpMulticastHandler
 (#9905)

* Add spoof detection for UDP packets in UdpMulticastHandler

* Implement isFromUs function for packet origin validation

* ampersand
---
 src/mesh/udp/UdpMulticastHandler.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/mesh/udp/UdpMulticastHandler.h b/src/mesh/udp/UdpMulticastHandler.h
index f88b48d62..a5b0ef360 100644
--- a/src/mesh/udp/UdpMulticastHandler.h
+++ b/src/mesh/udp/UdpMulticastHandler.h
@@ -73,6 +73,11 @@ class UdpMulticastHandler final
         LOG_DEBUG("Decoding MeshPacket from UDP len=%u", packetLength);
         bool isPacketDecoded = pb_decode_from_bytes(packet.data(), packetLength, &meshtastic_MeshPacket_msg, &mp);
         if (isPacketDecoded && router && mp.which_payload_variant == meshtastic_MeshPacket_encrypted_tag) {
+            // Drop packets with spoofed local origin — no legitimate LAN node should send from=0 or our own nodeNum
+            if (isFromUs(&mp)) {
+                LOG_WARN("UDP packet with spoofed local from=0x%x, dropping", mp.from);
+                return;
+            }
             mp.transport_mechanism = meshtastic_MeshPacket_TransportMechanism_TRANSPORT_MULTICAST_UDP;
             mp.pki_encrypted = false;
             mp.public_key.size = 0;
@@ -113,4 +118,4 @@ class UdpMulticastHandler final
     AsyncUDP udp;
     bool isRunning;
 };
-#endif // HAS_UDP_MULTICAST
\ No newline at end of file
+#endif // HAS_UDP_MULTICAST