RTOS/CC2652R: Why coordinator send a NWK Key secured Leave command to End-Device when it Unsecured-Rejoin?

The Zigbee HA 1.2 End Device will need to recognize a failed unsecure rejoin, timeout, and perform an unsecure join.  Please refer to Section 4.7.3 of the 2017 (R22) Zigbee Spec.

Note that backwards compatibility is still intact, with the exception of corner cases including options for joining a new network formed by the original Coordinator acting as the Trust Center.  As YK mentioned this presents a security risk.  http://dev.ti.com/tirex/content/simplelink_cc13x2_26x2_sdk_3_10_00_53/docs/zigbee/html/zigbee/z-stack-overview.html#security 

Regards,
Ryan

As I know, you cannot do this in Zigbee 3.0 Coordinator acting as trust center.

Part Number: CC2652R

Tool/software: TI-RTOS

In zigbee 3.0 network, a joined Node could get a new Link-Key that is called "verified link key" from trust center. So when the end-device try to rejoin the network by unsecured-rejoin mode, if trust-center had stored its unique Link-key( generated by trust-center). This end device should be accepted by this network.

1, set "zgAllowRejoins" into "TRUE" on router and coordinator, the parent node will not send NLME_Leave command to a unsecured-rejoin end-device.

2, function "ZDSecMgrDeviceJoinDirect" in "zd_sec_mgr.c", there is some issue in it, fix it like this.

ZStatus_t ZDSecMgrDeviceJoinDirect( ZDSecMgrDevice_t* device )
{
  ZStatus_t status;
  
  if(device->secure == FALSE)
  {  
     //........
  }

  status = ZDSecMgrDeviceJoin( device );

  if ( status == ZSuccess )
  {
   //.....
    
  #if (ZG_BUILD_COORDINATOR_TYPE)    
    //Add the device as joining device, if it did join unsecured
    if( (device->secure == FALSE) && !(device->devStatus & DEV_SEC_AUTH_TC_REJOIN_STATUS) )//fixed by luoyiming 2019-07-11
    {
      bdb_TCAddJoiningDevice(NLME_GetShortAddr(),device->extAddr);//don't waiting verify link key for unsecured-rejoin
    }
  #endif
  }

  //.....
}