From 5ac9ccfaed96775e52e8a4b85c7d776c977d8ab0 Mon Sep 17 00:00:00 2001
From: Abtin Keshavarzian <abtink@google.com>
Date: Thu, 4 Sep 2025 10:53:44 -0700
Subject: [PATCH] [nat64] ensure translator is active before translation
 (#11894)

This change adds an explicit check for `mState == kStateActive` at the
beginning of the translation functions.

This single check replaces individual validations for a valid IPv4
CIDR and NAT64 prefix. This simplifies the entry logic and fixes a
bug where the `Translator` could continue performing translations
even after it was explicitly disabled via `SetEnabled(false)`.

Additionally, this change fixes a bug in `TranslateToIp6()` where an
IPv4 message would be incorrectly marked as `kForward` when no IPv4
CIDR was configured (`mIp4Cidr.mLength == 0`). The correct behavior
is to drop the packet, so the result is now set to `kDrop`.
---
 src/core/net/nat64_translator.cpp | 18 ++----------------
 tests/unit/test_nat64.cpp         |  1 +
 2 files changed, 3 insertions(+), 16 deletions(-)

diff --git a/src/core/net/nat64_translator.cpp b/src/core/net/nat64_translator.cpp
index 651e96626..d582266ec 100644
--- a/src/core/net/nat64_translator.cpp
+++ b/src/core/net/nat64_translator.cpp
@@ -121,10 +121,7 @@ Translator::Result Translator::TranslateFromIp6(Message &aMessage)
     uint16_t     srcPortOrId = 0;
     Mapping     *mapping     = nullptr;
 
-    if (mIp4Cidr.mLength == 0 || !mNat64Prefix.IsValidNat64())
-    {
-        ExitNow(result = kNotTranslated);
-    }
+    VerifyOrExit(mState == kStateActive, result = kNotTranslated);
 
     // `ParseFrom()` will do basic checks for the message, including
     // the message length and IP protocol version.
@@ -241,21 +238,10 @@ Translator::Result Translator::TranslateToIp6(Message &aMessage)
     // datagram, forward it directly.
     VerifyOrExit(ip6Header.ParseFrom(aMessage) != kErrorNone, result = kNotTranslated);
 
-    if (mIp4Cidr.mLength == 0)
-    {
-        LogWarn("Incoming message is an IPv4 datagram but no IPv4 CIDR for NAT64 configured, drop");
-        ExitNow(result = kForward);
-    }
-
-    if (!mNat64Prefix.IsValidNat64())
-    {
-        LogWarn("Incoming message is an IPv4 datagram but no NAT64 prefix configured, drop");
-        ExitNow(result = kDrop);
-    }
+    VerifyOrExit(mState == kStateActive, result = kDrop);
 
     if (ip4Headers.ParseFrom(aMessage) != kErrorNone)
     {
-        LogWarn("Incoming message is neither IPv4 nor an IPv6 datagram, drop");
         dropReason = kReasonIllegalPacket;
         ExitNow(result = kDrop);
     }
diff --git a/tests/unit/test_nat64.cpp b/tests/unit/test_nat64.cpp
index c0272d3e7..4f4a9df03 100644
--- a/tests/unit/test_nat64.cpp
+++ b/tests/unit/test_nat64.cpp
@@ -236,6 +236,7 @@ void TestNat64Translation(void)
 
     SuccessOrQuit(sInstance->Get<Translator>().SetIp4Cidr(cidr));
     sInstance->Get<Translator>().SetNat64Prefix(prefix);
+    sInstance->Get<Translator>().SetEnabled(true);
 
     {
         // fd02::1               fd01::ac10:f3c5       UDP      52     43981 → 4660 Len=4