@zwave-js/cc 10.10.0 → 10.11.1

package/build/cc/Security2CC.js

@@ -50,7 +50,7 @@ function assertSecurity(options) {
         throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
     }
     else if (!this.host.securityManager2) {
-        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the network keys for the applHost are set!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the network keys are configured!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
     }
 }
 const DECRYPT_ATTEMPTS = 5;
@@ -106,6 +106,78 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
         }
         return true;
     }
+    /** Notifies the target node that the MPAN state is out of sync */
+    async sendMOS() {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NonceReport);
+        this.assertPhysicalEndpoint(this.endpoint);
+        const cc = new Security2CCNonceReport(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            SOS: false,
+            MOS: true,
+        });
+        try {
+            await this.applHost.sendCommand(cc, {
+                ...this.commandOptions,
+                // Seems we need these options or some nodes won't accept the nonce
+                transmitOptions: core_1.TransmitOptions.ACK | core_1.TransmitOptions.AutoRoute,
+                // Only try sending a nonce once
+                maxSendAttempts: 1,
+                // Nonce requests must be handled immediately
+                priority: core_1.MessagePriority.Nonce,
+                // We don't want failures causing us to treat the node as asleep or dead
+                changeNodeStatusOnMissingACK: false,
+            });
+        }
+        catch (e) {
+            if ((0, core_1.isTransmissionError)(e)) {
+                return false;
+            }
+            else {
+                // Pass other errors through
+                throw e;
+            }
+        }
+        return true;
+    }
+    /** Sends the given MPAN to the node */
+    async sendMPAN(groupId, innerMPANState) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.MessageEncapsulation);
+        this.assertPhysicalEndpoint(this.endpoint);
+        const cc = new Security2CCMessageEncapsulation(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            extensions: [
+                new Extension_1.MPANExtension({
+                    groupId,
+                    innerMPANState,
+                }),
+            ],
+        });
+        try {
+            await this.applHost.sendCommand(cc, {
+                ...this.commandOptions,
+                // Seems we need these options or some nodes won't accept the nonce
+                transmitOptions: core_1.TransmitOptions.ACK | core_1.TransmitOptions.AutoRoute,
+                // Only try sending a nonce once
+                maxSendAttempts: 1,
+                // Nonce requests must be handled immediately
+                priority: core_1.MessagePriority.Nonce,
+                // We don't want failures causing us to treat the node as asleep or dead
+                changeNodeStatusOnMissingACK: false,
+            });
+        }
+        catch (e) {
+            if ((0, core_1.isTransmissionError)(e)) {
+                return false;
+            }
+            else {
+                // Pass other errors through
+                throw e;
+            }
+        }
+        return true;
+    }
     /**
      * Queries the securely supported commands for the current security class
      * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.
@@ -122,7 +194,7 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
         if (MultiChannelCC_1.MultiChannelCC.requiresEncapsulation(cc)) {
             cc = MultiChannelCC_1.MultiChannelCC.encapsulate(this.applHost, cc);
         }
-        cc = Security2CC.encapsulate(this.applHost, cc, securityClass);
+        cc = Security2CC.encapsulate(this.applHost, cc, { securityClass });
         const response = await this.applHost.sendCommand(cc, {
             ...this.commandOptions,
             autoEncapsulate: false,
@@ -422,11 +494,23 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
         return true;
     }
     /** Encapsulates a command that should be sent encrypted */
-    static encapsulate(host, cc, securityClass) {
+    static encapsulate(host, cc, options) {
+        // Determine which extensions must be used on the command
+        const extensions = [];
+        if (options?.multicastOutOfSync) {
+            extensions.push(new Extension_1.MOSExtension());
+        }
+        if (options?.multicastGroupId != undefined) {
+            extensions.push(new Extension_1.MGRPExtension({ groupId: options.multicastGroupId }));
+        }
+        // Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast
+        // are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.
+        const nodeId = cc.isMulticast() ? safe_1.NODE_ID_BROADCAST : cc.nodeId;
         const ret = new Security2CCMessageEncapsulation(host, {
-            nodeId: cc.nodeId,
+            nodeId,
             encapsulated: cc,
-            securityClass,
+            securityClass: options?.securityClass,
+            extensions,
         });
         // Copy the encapsulation flags from the encapsulated command
         // but omit Security, since we're doing that right now
@@ -457,6 +541,12 @@ function testCCResponseForMessageEncapsulation(sent, received) {
         return received.SOS && !!received.receiverEI;
     }
 }
+function failNoSPAN() {
+    throw core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
+}
+function failNoMPAN() {
+    throw core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoMPAN);
+}
 let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation extends Security2CC {
     constructor(host, options) {
         super(host, options);
@@ -465,14 +555,9 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
         if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 2);
             // Check the sequence number to avoid duplicates
-            // TODO: distinguish between multicast and singlecast
             this._sequenceNumber = this.payload[0];
             const sendingNodeId = this.nodeId;
-            // Don't accept duplicate commands
-            const prevSequenceNumber = validateSequenceNumber.call(this, this._sequenceNumber);
             // Ensure the node has a security class
-            // const node = this.getNode()!;
-            // validatePayload.withReason("The node is not included")(!!node);
             const securityClass = this.host.getHighestSecurityClass(sendingNodeId);
             core_1.validatePayload.withReason("No security class granted")(securityClass !== core_1.SecurityClass.None);
             const hasExtensions = !!(this.payload[1] & 0b1);
@@ -495,111 +580,66 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             };
             if (hasExtensions)
                 parseExtensions(this.payload);
+            const ctx = (() => {
+                const multicastGroupId = this.getMulticastGroupId();
+                if (options.frameType === "multicast" ||
+                    options.frameType === "broadcast") {
+                    if (multicastGroupId == undefined) {
+                        throw core_1.validatePayload.fail("Multicast frames without MGRP extension");
+                    }
+                    return {
+                        isMulticast: true,
+                        groupId: multicastGroupId,
+                    };
+                }
+                else {
+                    return { isMulticast: false, groupId: multicastGroupId };
+                }
+            })();
+            let prevSequenceNumber;
+            let mpanState;
+            if (ctx.isMulticast) {
+                mpanState = this.host.securityManager2.getPeerMPAN(sendingNodeId, ctx.groupId);
+            }
+            else {
+                // Don't accept duplicate Singlecast commands
+                prevSequenceNumber = validateSequenceNumber.call(this, this._sequenceNumber);
+                // When a node removes a singlecast message after a multicast group was marked out of sync,
+                // it must forget about the group.
+                if (ctx.groupId == undefined) {
+                    this.host.securityManager2.resetOutOfSyncMPANs(sendingNodeId);
+                }
+            }
             const unencryptedPayload = this.payload.slice(0, offset);
             const ciphertext = this.payload.slice(offset, -core_1.SECURITY_S2_AUTH_TAG_LENGTH);
             const authTag = this.payload.slice(-core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+            this.authTag = authTag;
             const messageLength = super.computeEncapsulationOverhead() + this.payload.length;
             const authData = getAuthenticationData(sendingNodeId, this.getDestinationIDRX(), this.host.homeId, messageLength, unencryptedPayload);
-            // Decrypt payload and verify integrity
-            const spanState = this.host.securityManager2.getSPANState(sendingNodeId);
-            const failNoSPAN = () => {
-                return core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
-            };
-            // If we are not able to establish an SPAN yet, fail the decryption
-            if (spanState.type === core_1.SPANState.None) {
-                return failNoSPAN();
-            }
-            else if (spanState.type === core_1.SPANState.RemoteEI) {
-                // TODO: The specs are not clear how to handle this case
-                // For now, do the same as if we didn't have any EI
-                return failNoSPAN();
+            let decrypt;
+            if (ctx.isMulticast) {
+                // For incoming multicast commands, make sure we have an MPAN
+                if (mpanState?.type !== core_1.MPANState.MPAN) {
+                    // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup
+                    this.host.securityManager2.storePeerMPAN(sendingNodeId, ctx.groupId, { type: core_1.MPANState.OutOfSync });
+                    throw failNoMPAN();
+                }
+                decrypt = () => this.decryptMulticast(sendingNodeId, ctx.groupId, ciphertext, authData, authTag);
             }
-            const decrypt = () => {
-                const decryptWithNonce = (nonce) => {
-                    const { keyCCM: key } = this.host.securityManager2.getKeysForNode(sendingNodeId);
-                    const iv = nonce;
-                    return {
-                        key,
-                        iv,
-                        ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
-                    };
-                };
-                const getNonceAndDecrypt = () => {
-                    const iv = this.host.securityManager2.nextNonce(sendingNodeId);
-                    return decryptWithNonce(iv);
-                };
-                if (spanState.type === core_1.SPANState.SPAN) {
-                    // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have
-                    // sent a command at roughly the same time, using the same SPAN for encryption.
-                    // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,
-                    // we accept commands encrypted with the previous SPAN under very specific circumstances:
-                    if (
-                    // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
-                    !!spanState.currentSPAN &&
-                        // it is still valid
-                        spanState.currentSPAN.expires > (0, core_1.highResTimestamp)() &&
-                        // The received command is exactly the next, expected one
-                        prevSequenceNumber != undefined &&
-                        this._sequenceNumber ===
-                            ((prevSequenceNumber + 1) & 0xff) &&
-                        // And in case of a mock-based test, do this only on the controller
-                        !this.host.__internalIsMockNode) {
-                        const nonce = spanState.currentSPAN.nonce;
-                        spanState.currentSPAN = undefined;
-                        return decryptWithNonce(nonce);
-                    }
-                    else {
-                        // forgetting the current SPAN shouldn't be necessary but better be safe than sorry
-                        spanState.currentSPAN = undefined;
-                    }
-                    // This can only happen if the security class is known
-                    return getNonceAndDecrypt();
+            else {
+                // Decrypt payload and verify integrity
+                const spanState = this.host.securityManager2.getSPANState(sendingNodeId);
+                // If we are not able to establish an SPAN yet, fail the decryption
+                if (spanState.type === core_1.SPANState.None) {
+                    throw failNoSPAN();
                 }
-                else if (spanState.type === core_1.SPANState.LocalEI) {
-                    // We've sent the other our receiver's EI and received its sender's EI,
-                    // meaning we can now establish an SPAN
-                    const senderEI = this.getSenderEI();
-                    if (!senderEI)
-                        return failNoSPAN();
-                    const receiverEI = spanState.receiverEI;
-                    // How we do this depends on whether we know the security class of the other node
-                    if (this.host.securityManager2.tempKeys.has(sendingNodeId)) {
-                        // We're currently bootstrapping the node, it might be using a temporary key
-                        this.host.securityManager2.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
-                        const ret = getNonceAndDecrypt();
-                        // Decryption with the temporary key worked
-                        if (ret.authOK)
-                            return ret;
-                        // Reset the SPAN state and try with the recently granted security class
-                        this.host.securityManager2.setSPANState(sendingNodeId, spanState);
-                    }
-                    if (securityClass != undefined) {
-                        this.host.securityManager2.initializeSPAN(sendingNodeId, securityClass, senderEI, receiverEI);
-                        return getNonceAndDecrypt();
-                    }
-                    else {
-                        // Not knowing it can happen if we just took over an existing network
-                        // Try multiple security classes
-                        const possibleSecurityClasses = core_1.securityClassOrder
-                            .filter((s) => (0, core_1.securityClassIsS2)(s))
-                            .filter((s) => this.host.hasSecurityClass(sendingNodeId, s) !== false);
-                        for (const secClass of possibleSecurityClasses) {
-                            // Initialize an SPAN with that security class
-                            this.host.securityManager2.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
-                            const ret = getNonceAndDecrypt();
-                            // It worked, return the result and remember the security class
-                            if (ret.authOK) {
-                                this.host.setSecurityClass(sendingNodeId, secClass, true);
-                                return ret;
-                            }
-                            // Reset the SPAN state and try with the next security class
-                            this.host.securityManager2.setSPANState(sendingNodeId, spanState);
-                        }
-                    }
+                else if (spanState.type === core_1.SPANState.RemoteEI) {
+                    // TODO: The specs are not clear how to handle this case
+                    // For now, do the same as if we didn't have any EI
+                    throw failNoSPAN();
                 }
-                // Nothing worked, fail the decryption
-                return { plaintext: Buffer.from([]), authOK: false };
-            };
+                decrypt = () => this.decryptSinglecast(sendingNodeId, prevSequenceNumber, ciphertext, authData, authTag, securityClass, spanState);
+            }
             let plaintext;
             let authOK = false;
             let key;
@@ -615,7 +655,18 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             // If authentication fails, do so with an error code that instructs the
             // applHost to tell the node we have no nonce
             if (!authOK || !plaintext) {
-                return core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecode);
+                if (ctx.isMulticast) {
+                    // Mark the MPAN as out of sync
+                    this.host.securityManager2.storePeerMPAN(sendingNodeId, ctx.groupId, { type: core_1.MPANState.OutOfSync });
+                    throw core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
+                }
+                else {
+                    throw core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecode);
+                }
+            }
+            else if (!ctx.isMulticast && ctx.groupId != undefined) {
+                // After reception of a singlecast followup, the MPAN state must be increased
+                this.host.securityManager2.tryIncrementPeerMPAN(sendingNodeId, ctx.groupId);
             }
             offset = 0;
             if (hasEncryptedExtensions)
@@ -630,15 +681,21 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                     data: decryptedCCBytes,
                     fromEncapsulation: true,
                     encapCC: this,
+                    frameType: options.frameType,
                 });
             }
             this.key = key;
             this.iv = iv;
         }
         else {
+            if (!options.encapsulated && !options.extensions?.length) {
+                throw new core_1.ZWaveError("Security S2 encapsulation requires an encapsulated CC and/or extensions", core_1.ZWaveErrorCodes.Argument_Invalid);
+            }
             this._securityClass = options.securityClass;
-            this.encapsulated = options.encapsulated;
-            options.encapsulated.encapsulatingCC = this;
+            if (options.encapsulated) {
+                this.encapsulated = options.encapsulated;
+                options.encapsulated.encapsulatingCC = this;
+            }
             this.extensions = options.extensions ?? [];
             if (typeof this.nodeId !== "number" &&
                 !this.extensions.some((e) => e instanceof Extension_1.MGRPExtension)) {
@@ -654,37 +711,51 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
      */
     get sequenceNumber() {
         if (this._sequenceNumber == undefined) {
-            this._sequenceNumber =
-                this.host.securityManager2.nextSequenceNumber(this.nodeId);
+            if (this.isSinglecast()) {
+                this._sequenceNumber =
+                    this.host.securityManager2.nextSequenceNumber(this.nodeId);
+            }
+            else {
+                const groupId = this.getDestinationIDTX();
+                return this.host.securityManager2.nextMulticastSequenceNumber(groupId);
+            }
         }
         return this._sequenceNumber;
     }
-    unsetSequenceNumber() {
+    prepareRetransmission() {
+        super.prepareRetransmission();
         this._sequenceNumber = undefined;
     }
     getDestinationIDTX() {
+        if (this.isSinglecast())
+            return this.nodeId;
         const mgrpExtension = this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
         if (mgrpExtension)
             return mgrpExtension.groupId;
-        else if (typeof this.nodeId === "number")
-            return this.nodeId;
         throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
     }
     getDestinationIDRX() {
-        const mgrpExtension = this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
-        if (mgrpExtension)
-            return mgrpExtension.groupId;
-        return this.host.ownNodeId;
+        return this.getMulticastGroupId() ?? this.host.ownNodeId;
+    }
+    getMGRPExtension() {
+        return this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
+    }
+    getMulticastGroupId() {
+        const mgrpExtension = this.getMGRPExtension();
+        return mgrpExtension?.groupId;
+    }
+    hasMOSExtension() {
+        return this.extensions.some((e) => e instanceof Extension_1.MOSExtension);
     }
     /** Returns the Sender's Entropy Input if this command contains an SPAN extension */
     getSenderEI() {
         const spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
         return spanExtension?.senderEI;
     }
-    serialize() {
-        // TODO: Support Multicast
-        // Include Sender EI in the command if we only have the receiver's EI
-        const receiverNodeId = this.getDestinationIDTX();
+    maybeAddSPANExtension() {
+        if (!this.isSinglecast())
+            return;
+        const receiverNodeId = this.nodeId;
         const spanState = this.host.securityManager2.getSPANState(receiverNodeId);
         if (spanState.type === core_1.SPANState.None ||
             spanState.type === core_1.SPANState.LocalEI) {
@@ -719,6 +790,10 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                 this.extensions.push(spanExtension);
             }
         }
+    }
+    serialize() {
+        // Include Sender EI in the command if we only have the receiver's EI
+        this.maybeAddSPANExtension();
         const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
         const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
         const unencryptedPayload = Buffer.concat([
@@ -735,20 +810,36 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             serializedCC,
         ]);
         // Generate the authentication data for CCM encryption
+        const destinationTag = this.getDestinationIDTX();
         const messageLength = this.computeEncapsulationOverhead() + serializedCC.length;
-        const authData = getAuthenticationData(this.host.ownNodeId, receiverNodeId, this.host.homeId, messageLength, unencryptedPayload);
-        // Generate a nonce for encryption, and remember it to attempt decryption
-        // of potential in-flight messages from the target node.
-        const iv = this.host.securityManager2.nextNonce(receiverNodeId, true);
-        const { keyCCM: key } = 
-        // Prefer the overridden security class if it was given
-        this._securityClass != undefined
-            ? this.host.securityManager2.getKeysForSecurityClass(this._securityClass)
-            : this.host.securityManager2.getKeysForNode(receiverNodeId);
+        const authData = getAuthenticationData(this.host.ownNodeId, destinationTag, this.host.homeId, messageLength, unencryptedPayload);
+        let key;
+        let iv;
+        if (this.isSinglecast()) {
+            // Singlecast:
+            // Generate a nonce for encryption, and remember it to attempt decryption
+            // of potential in-flight messages from the target node.
+            iv = this.host.securityManager2.nextNonce(this.nodeId, true);
+            const { keyCCM } = 
+            // Prefer the overridden security class if it was given
+            this._securityClass != undefined
+                ? this.host.securityManager2.getKeysForSecurityClass(this._securityClass)
+                : this.host.securityManager2.getKeysForNode(this.nodeId);
+            key = keyCCM;
+        }
+        else {
+            // Multicast:
+            const keyAndIV = this.host.securityManager2.getMulticastKeyAndIV(destinationTag);
+            key = keyAndIV.key;
+            iv = keyAndIV.iv;
+        }
         const { ciphertext: ciphertextPayload, authTag } = (0, core_1.encryptAES128CCM)(key, iv, plaintextPayload, authData, core_1.SECURITY_S2_AUTH_TAG_LENGTH);
         // Remember key and IV for debugging purposes
         this.key = key;
         this.iv = iv;
+        this.authData = authData;
+        this.authTag = authTag;
+        this.ciphertext = ciphertextPayload;
         this.payload = Buffer.concat([
             unencryptedPayload,
             ciphertextPayload,
@@ -780,19 +871,124 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                 .join("");
         }
         // Log the used keys in integration tests
-        if (process.env.NODE_ENV === "test") {
+        if (process.env.NODE_ENV === "test" ||
+            process.env.NODE_ENV === "development") {
             if (this.key) {
                 message.key = (0, safe_2.buffer2hex)(this.key);
             }
             if (this.iv) {
                 message.IV = (0, safe_2.buffer2hex)(this.iv);
             }
+            if (this.ciphertext) {
+                message.ciphertext = (0, safe_2.buffer2hex)(this.ciphertext);
+            }
+            if (this.authData) {
+                message["auth data"] = (0, safe_2.buffer2hex)(this.authData);
+            }
+            if (this.authTag) {
+                message["auth tag"] = (0, safe_2.buffer2hex)(this.authTag);
+            }
         }
         return {
             ...super.toLogEntry(applHost),
             message,
         };
     }
+    decryptSinglecast(sendingNodeId, prevSequenceNumber, ciphertext, authData, authTag, securityClass, spanState) {
+        const decryptWithNonce = (nonce) => {
+            const { keyCCM: key } = this.host.securityManager2.getKeysForNode(sendingNodeId);
+            const iv = nonce;
+            return {
+                key,
+                iv,
+                ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+            };
+        };
+        const getNonceAndDecrypt = () => {
+            const iv = this.host.securityManager2.nextNonce(sendingNodeId);
+            return decryptWithNonce(iv);
+        };
+        if (spanState.type === core_1.SPANState.SPAN) {
+            // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have
+            // sent a command at roughly the same time, using the same SPAN for encryption.
+            // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,
+            // we accept commands encrypted with the previous SPAN under very specific circumstances:
+            if (
+            // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
+            !!spanState.currentSPAN &&
+                // it is still valid
+                spanState.currentSPAN.expires > (0, core_1.highResTimestamp)() &&
+                // The received command is exactly the next, expected one
+                prevSequenceNumber != undefined &&
+                this["_sequenceNumber"] === ((prevSequenceNumber + 1) & 0xff) &&
+                // And in case of a mock-based test, do this only on the controller
+                !this.host.__internalIsMockNode) {
+                const nonce = spanState.currentSPAN.nonce;
+                spanState.currentSPAN = undefined;
+                return decryptWithNonce(nonce);
+            }
+            else {
+                // forgetting the current SPAN shouldn't be necessary but better be safe than sorry
+                spanState.currentSPAN = undefined;
+            }
+            // This can only happen if the security class is known
+            return getNonceAndDecrypt();
+        }
+        else if (spanState.type === core_1.SPANState.LocalEI) {
+            // We've sent the other our receiver's EI and received its sender's EI,
+            // meaning we can now establish an SPAN
+            const senderEI = this.getSenderEI();
+            if (!senderEI)
+                throw failNoSPAN();
+            const receiverEI = spanState.receiverEI;
+            // How we do this depends on whether we know the security class of the other node
+            if (this.host.securityManager2.tempKeys.has(sendingNodeId)) {
+                // We're currently bootstrapping the node, it might be using a temporary key
+                this.host.securityManager2.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
+                const ret = getNonceAndDecrypt();
+                // Decryption with the temporary key worked
+                if (ret.authOK)
+                    return ret;
+                // Reset the SPAN state and try with the recently granted security class
+                this.host.securityManager2.setSPANState(sendingNodeId, spanState);
+            }
+            if (securityClass != undefined) {
+                this.host.securityManager2.initializeSPAN(sendingNodeId, securityClass, senderEI, receiverEI);
+                return getNonceAndDecrypt();
+            }
+            else {
+                // Not knowing it can happen if we just took over an existing network
+                // Try multiple security classes
+                const possibleSecurityClasses = core_1.securityClassOrder
+                    .filter((s) => (0, core_1.securityClassIsS2)(s))
+                    .filter((s) => this.host.hasSecurityClass(sendingNodeId, s) !==
+                    false);
+                for (const secClass of possibleSecurityClasses) {
+                    // Initialize an SPAN with that security class
+                    this.host.securityManager2.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
+                    const ret = getNonceAndDecrypt();
+                    // It worked, return the result and remember the security class
+                    if (ret.authOK) {
+                        this.host.setSecurityClass(sendingNodeId, secClass, true);
+                        return ret;
+                    }
+                    // Reset the SPAN state and try with the next security class
+                    this.host.securityManager2.setSPANState(sendingNodeId, spanState);
+                }
+            }
+        }
+        // Nothing worked, fail the decryption
+        return { plaintext: Buffer.from([]), authOK: false };
+    }
+    decryptMulticast(sendingNodeId, groupId, ciphertext, authData, authTag) {
+        const iv = this.host.securityManager2.nextPeerMPAN(sendingNodeId, groupId);
+        const { keyCCM: key } = this.host.securityManager2.getKeysForNode(sendingNodeId);
+        return {
+            key,
+            iv,
+            ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+        };
+    }
 };
 Security2CCMessageEncapsulation = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.MessageEncapsulation),