From 881f55762938fe2eee79aa6262e1d098b010dbd8 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Thu, 5 Dec 2024 12:41:12 -0800
Subject: [PATCH] [ip6] filter received packets with loopback addrs (#10998)

---
 src/core/net/ip6.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index ca3cd124c..1c635a7d7 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -1086,6 +1086,11 @@ Error Ip6::HandleDatagram(OwnedPtr<Message> aMessagePtr, bool aIsReassembled)
 
     SuccessOrExit(error = header.ParseFrom(*aMessagePtr));
 
+    if (!aMessagePtr->IsOriginHostTrusted())
+    {
+        VerifyOrExit(!header.GetSource().IsLoopback() && !header.GetDestination().IsLoopback(), error = kErrorDrop);
+    }
+
     // Determine `forwardThread`, `forwardHost` and `receive`
     // based on the destination address.