[tests] make sure BRs not sending disallowed ICMPv6 in Thread traffic (#7357)

tests/scripts/thread-cert/pktverify/consts.py

@@ -391,6 +391,20 @@ THREAD_VERSION_1_2 = 3
 
 # ICMPv6 Types
 ICMPV6_TYPE_DESTINATION_UNREACHABLE = 1
+ICMPV6_TYPE_PACKET_TO_BIG = 2
+ICMPV6_TYPE_TIME_EXCEEDED = 3
+ICMPV6_TYPE_PARAMETER_PROBLEM = 4
+ICMPV6_TYPE_ECHO_REQUEST = 128
+ICMPV6_TYPE_ECHO_REPLY = 129
+
+THREAD_ALLOWED_ICMPV6_TYPES = [
+    ICMPV6_TYPE_DESTINATION_UNREACHABLE,
+    ICMPV6_TYPE_PACKET_TO_BIG,
+    ICMPV6_TYPE_TIME_EXCEEDED,
+    ICMPV6_TYPE_PARAMETER_PROBLEM,
+    ICMPV6_TYPE_ECHO_REQUEST,
+    ICMPV6_TYPE_ECHO_REPLY,
+]
 
 # Link Metrics
 LINK_METRICS_STATUS_SUCCESS = 0

tests/scripts/thread-cert/pktverify/packet_filter.py

@@ -34,6 +34,7 @@ from typing import Optional, Callable, Tuple, Union
 from pktverify import consts, errors
 from pktverify.addrs import EthAddr, ExtAddr, Ipv6Addr
 from pktverify.bytes import Bytes
+from pktverify.consts import THREAD_ALLOWED_ICMPV6_TYPES
 from pktverify.packet import Packet
 from pktverify.utils import make_filter_func
 
@@ -618,6 +619,10 @@ class PacketFilter(object):
     def filter_icmpv6_nd_ra(self):
         return self.filter(lambda p: p.icmpv6.is_router_advertisement)
 
+    def filter_thread_unallowed_icmpv6(self):
+        return self.filter('wpan and icmpv6 and icmpv6.type not in {THREAD_ALLOWED_ICMPV6_TYPES}',
+                           THREAD_ALLOWED_ICMPV6_TYPES=THREAD_ALLOWED_ICMPV6_TYPES)
+
     def filter_has_bbr_dataset(self):
         return self.filter("""
                 thread_nwd.tlv.server.has('16')

tests/scripts/thread-cert/thread_cert.py

@@ -327,6 +327,7 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
     def _verify_packets(self, test_info_path: str):
         pv = PacketVerifier(test_info_path, self.CASE_WIRESHARK_PREFS)
         pv.add_common_vars()
+        pv.pkts.filter_thread_unallowed_icmpv6().must_not_next()
         self.verify(pv)
         print("Packet verification passed: %s" % test_info_path, file=sys.stderr)