From 43a73a1caca0efa0f2e5079db7f979927e52a1b5 Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Fri, 11 Oct 2024 18:05:23 -0700 Subject: [PATCH] [ip6] simplify applying of TMF UDP filter in `Ip6::HandleDatagram()` (#10822) This commit simplifies the filter checks that drop TMF UDP messages from untrusted origins. The `mTmfOriginFilterEnabled` flag is checked first, and then the full UDP header is read from the message. --- src/core/net/ip6.cpp | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp index 82fda68a6..c6f028c0f 100644 --- a/src/core/net/ip6.cpp +++ b/src/core/net/ip6.cpp @@ -1219,22 +1219,21 @@ Error Ip6::HandleDatagram(OwnedPtr aMessagePtr, bool aIsReassembled) SuccessOrExit(error); } - if (aMessagePtr->IsOriginHostUntrusted() && (nextHeader == kProtoUdp)) - { - uint16_t destPort; - - SuccessOrExit( - error = aMessagePtr->Read(aMessagePtr->GetOffset() + Udp::Header::kDestPortFieldOffset, destPort)); - destPort = BigEndian::HostSwap16(destPort); - - if (destPort == Tmf::kUdpPort #if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE - && mTmfOriginFilterEnabled + if (mTmfOriginFilterEnabled) #endif - ) + { + if (aMessagePtr->IsOriginHostUntrusted() && (nextHeader == kProtoUdp)) { - LogNote("Dropping TMF message from untrusted origin"); - ExitNow(error = kErrorDrop); + Udp::Header udpHeader; + + SuccessOrExit(error = aMessagePtr->Read(aMessagePtr->GetOffset(), udpHeader)); + + if (udpHeader.GetDestinationPort() == Tmf::kUdpPort) + { + LogNote("Dropping TMF message from untrusted origin"); + ExitNow(error = kErrorDrop); + } } }