From 96c35b3f903bc1bf0fa02fab4894383d4ee9a2bf Mon Sep 17 00:00:00 2001
From: rongli <rongli@nestlabs.com>
Date: Mon, 31 Jul 2017 12:04:09 +0800
Subject: [PATCH] [ncp] update pass through filter rules (#2036)

---
 src/core/net/ip6.cpp             | 38 ++++++++++++++++++++++++--------
 src/core/thread/thread_netif.cpp | 18 ++++++++++-----
 src/core/thread/thread_netif.hpp |  9 ++++++++
 3 files changed, 50 insertions(+), 15 deletions(-)

diff --git a/src/core/net/ip6.cpp b/src/core/net/ip6.cpp
index b0d07a01f..2554f5e4a 100644
--- a/src/core/net/ip6.cpp
+++ b/src/core/net/ip6.cpp
@@ -572,11 +572,9 @@ otError Ip6::ProcessReceiveCallback(const Message &aMessage, const MessageInfo &
 
     if (mIsReceiveIp6FilterEnabled)
     {
-        // do not pass messages sent to/from an RLOC
+        // do not pass messages sent to an RLOC/ALOC
         VerifyOrExit(!aMessageInfo.GetSockAddr().IsRoutingLocator() &&
-                     !aMessageInfo.GetPeerAddr().IsRoutingLocator() &&
-                     !aMessageInfo.GetSockAddr().IsAnycastRoutingLocator() &&
-                     !aMessageInfo.GetPeerAddr().IsAnycastRoutingLocator(),
+                     !aMessageInfo.GetSockAddr().IsAnycastRoutingLocator(),
                      error = OT_ERROR_NO_ROUTE);
 
         switch (aIpProto)
@@ -594,17 +592,39 @@ otError Ip6::ProcessReceiveCallback(const Message &aMessage, const MessageInfo &
             break;
 
         case kProtoUdp:
-            if (aMessageInfo.GetSockAddr().IsLinkLocal() ||
-                aMessageInfo.GetSockAddr().IsLinkLocalMulticast())
+        {
+            UdpHeader udp;
+            aMessage.Read(aMessage.GetOffset(), sizeof(udp), &udp);
+
+            switch (udp.GetDestinationPort())
             {
-                UdpHeader udp;
-                aMessage.Read(aMessage.GetOffset(), sizeof(udp), &udp);
+            case Mle::kUdpPort:
 
                 // do not pass MLE messages
-                VerifyOrExit(udp.GetDestinationPort() != Mle::kUdpPort, error = OT_ERROR_NO_ROUTE);
+                if (aMessageInfo.GetSockAddr().IsLinkLocal() ||
+                    aMessageInfo.GetSockAddr().IsLinkLocalMulticast())
+                {
+                    ExitNow(error = OT_ERROR_NO_ROUTE);
+                }
+
+                break;
+
+            case kCoapUdpPort:
+
+                // do not pass TMF messages
+                if (GetInstance().mThreadNetif.IsTmfMessage(aMessageInfo))
+                {
+                    ExitNow(error = OT_ERROR_NO_ROUTE);
+                }
+
+                break;
+
+            default:
+                break;
             }
 
             break;
+        }
 
         default:
             break;
diff --git a/src/core/thread/thread_netif.cpp b/src/core/thread/thread_netif.cpp
index 08c91aae9..841db1ad2 100644
--- a/src/core/thread/thread_netif.cpp
+++ b/src/core/thread/thread_netif.cpp
@@ -182,21 +182,27 @@ exit:
 
 otError ThreadNetif::TmfFilter(const Message &aMessage, const Ip6::MessageInfo &aMessageInfo, void *aContext)
 {
-    otError error = OT_ERROR_NONE;
+    OT_UNUSED_VARIABLE(aMessage);
+
+    return static_cast<ThreadNetif *>(aContext)->IsTmfMessage(aMessageInfo) ? OT_ERROR_NONE : OT_ERROR_NOT_TMF;
+}
+
+bool ThreadNetif::IsTmfMessage(const Ip6::MessageInfo &aMessageInfo)
+{
+    bool rval = true;
 
     // A TMF message must comply with following rules:
     // 1. The destination is a Mesh Local Address or a Link-Local Multicast Address or a Realm-Local Multicast Address,
     //    and the source is a Mesh Local Address.
     // 2. Both the destination and the source are Link-Local Addresses.
-    VerifyOrExit(((static_cast<ThreadNetif *>(aContext)->mMleRouter.IsMeshLocalAddress(aMessageInfo.GetSockAddr()) ||
+    VerifyOrExit(((mMleRouter.IsMeshLocalAddress(aMessageInfo.GetSockAddr()) ||
                    aMessageInfo.GetSockAddr().IsLinkLocalMulticast() ||
                    aMessageInfo.GetSockAddr().IsRealmLocalMulticast()) &&
-                  static_cast<ThreadNetif *>(aContext)->mMleRouter.IsMeshLocalAddress(aMessageInfo.GetPeerAddr())) ||
+                  mMleRouter.IsMeshLocalAddress(aMessageInfo.GetPeerAddr())) ||
                  (aMessageInfo.GetSockAddr().IsLinkLocal() && aMessageInfo.GetPeerAddr().IsLinkLocal()),
-                 error = OT_ERROR_NOT_TMF);
+                 rval = false);
 exit:
-    OT_UNUSED_VARIABLE(aMessage);
-    return error;
+    return rval;
 }
 
 }  // namespace ot
diff --git a/src/core/thread/thread_netif.hpp b/src/core/thread/thread_netif.hpp
index 87b6211c2..813b50a40 100644
--- a/src/core/thread/thread_netif.hpp
+++ b/src/core/thread/thread_netif.hpp
@@ -412,6 +412,15 @@ public:
       */
     PanIdQueryServer &GetPanIdQueryServer(void) { return mPanIdQuery; }
 
+    /**
+     * This method returns whether Thread Management Framework Addressing Rules are met.
+     *
+     * @retval TRUE   if Thread Management Framework Addressing Rules are met.
+     * @retval FALSE  if Thread Management Framework Addressing Rules are not met.
+     *
+     */
+    bool IsTmfMessage(const Ip6::MessageInfo &aMessageInfo);
+
 private:
     static otError TmfFilter(const Message &aMessage, const Ip6::MessageInfo &aMessageInfo, void *aContext);