From 20aee3fa706d7936594f6decaf3747fc9166a166 Mon Sep 17 00:00:00 2001
From: whd <7058128+superwhd@users.noreply.github.com>
Date: Thu, 18 Aug 2022 13:59:50 +0800
Subject: [PATCH] [multicast-routing] don't add MFC entries using mesh local as
 the source address (#8025)

According to Thread Spec, PBBR should not forward a multicast packet
from Thread interface to Backbone interface when the source address is
Mesh-Local.
---
 src/posix/platform/multicast_routing.cpp      |  1 +
 ...lr_multicast_routing_across_thread_pans.py | 23 +++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/posix/platform/multicast_routing.cpp b/src/posix/platform/multicast_routing.cpp
index 6580782ea..93a528f18 100644
--- a/src/posix/platform/multicast_routing.cpp
+++ b/src/posix/platform/multicast_routing.cpp
@@ -309,6 +309,7 @@ otError MulticastRoutingManager::AddMulticastForwardingCache(const Ip6::Address
     }
     else
     {
+        VerifyOrExit(aSrcAddr.GetPrefix() != AsCoreType(otThreadGetMeshLocalPrefix(gInstance)), error = OT_ERROR_NONE);
         // Forward multicast traffic from Thread to Backbone if multicast scope > kRealmLocalScope
         // TODO: (MLR) allow scope configuration of outbound multicast routing
         if (aGroupAddr.GetScope() > Ip6::Address::kRealmLocalScope)
diff --git a/tests/scripts/thread-cert/backbone/test_mlr_multicast_routing_across_thread_pans.py b/tests/scripts/thread-cert/backbone/test_mlr_multicast_routing_across_thread_pans.py
index 8da0c1c18..06deb4e72 100644
--- a/tests/scripts/thread-cert/backbone/test_mlr_multicast_routing_across_thread_pans.py
+++ b/tests/scripts/thread-cert/backbone/test_mlr_multicast_routing_across_thread_pans.py
@@ -143,14 +143,22 @@ class TestMlr(thread_cert.TestCase):
         self.collect_ipaddrs()
         self.collect_rloc16s()
 
-        # ping MA1 from Host could get replied from R1 and R2
+        # ping MA1 from Host could generate a reply from R1 and R2
         self.assertTrue(self.nodes[HOST].ping(MA1, backbone=True, ttl=5))
         self.simulator.go(WAIT_REDUNDANCE)
 
-        # ping MA2 from R1 could get replied from Host and R2
+        # ping MA2 from R1 could generate a reply from Host and R2
         self.assertTrue(self.nodes[ROUTER1].ping(MA2))
         self.simulator.go(WAIT_REDUNDANCE)
 
+        # ping MA2 from R1's MLE-ID shouldn't generate a reply from Host or R2
+        self.assertFalse(self.nodes[ROUTER1].ping(MA2, interface=self.nodes[ROUTER1].get_mleid()))
+        self.simulator.go(WAIT_REDUNDANCE)
+
+        # ping MA2 from R1's LLA shouldn't generate a reply from Host or R2
+        self.assertFalse(self.nodes[ROUTER1].ping(MA2, interface=self.nodes[ROUTER1].get_linklocal()))
+        self.simulator.go(WAIT_REDUNDANCE)
+
     def verify(self, pv: PacketVerifier):
         pkts = pv.pkts
         pv.add_common_vars()
@@ -211,6 +219,17 @@ class TestMlr(thread_cert.TestCase):
         pkts.filter_wpan_src64(ROUTER2).filter_ipv6_src_dst(
             ROUTER2_DUA, ROUTER1_DUA).filter_ping_reply(identifier=ping_ma2.icmpv6.echo.identifier).must_next()
 
+        #
+        # Verify pinging MA2 from R1's MLE-ID will not be forwarded to the Backbone link
+        #
+
+        # ROUTER1 should send the multicast ping request
+        ping_ma2_2 = pkts.filter_wpan_src64(ROUTER1).filter_AMPLFMA(mpl_seed_id=ROUTER1_RLOC16).filter_ping_request(
+            identifier=ping_ma2.icmpv6.echo.identifier + 1).must_next()
+
+        # PBBR1 shouldn't forward the multicast ping request to the Backbone link
+        pkts.filter_eth_src(PBBR1_ETH).filter_ping_request(ping_ma2_2.icmpv6.echo.identifier).must_not_next()
+
 
 if __name__ == '__main__':
     unittest.main()