[ncp] fix clearing unsecure ports (#3022)

include/openthread/ip6.h

@@ -455,6 +455,10 @@ otError otIp6AddUnsecurePort(otInstance *aInstance, uint16_t aPort);
 /**
  * This function removes a port from the allowed unsecure port list.
  *
+ * @note This function removes @p aPort by overwriting @p aPort with the element after @p aPort in the internal port
+ * list. Be careful when calling otIp6GetUnsecurePorts() followed by otIp6RemoveUnsecurePort() to remove unsecure
+ * ports.
+ *
  * @param[in]  aInstance A pointer to an OpenThread instance.
  * @param[in]  aPort     The port value.
  *
@@ -464,6 +468,14 @@ otError otIp6AddUnsecurePort(otInstance *aInstance, uint16_t aPort);
  */
 otError otIp6RemoveUnsecurePort(otInstance *aInstance, uint16_t aPort);
 
+/**
+ * This function removes all ports from the allowed unsecure port list.
+ *
+ * @param[in]  aInstance A pointer to an OpenThread instance.
+ *
+ */
+void otIp6RemoveAllUnsecurePorts(otInstance *aInstance);
+
 /**
  * This function returns a pointer to the unsecure port list.
  *

src/core/api/ip6_api.cpp

@@ -221,6 +221,13 @@ otError otIp6RemoveUnsecurePort(otInstance *aInstance, uint16_t aPort)
     return instance.GetThreadNetif().GetIp6Filter().RemoveUnsecurePort(aPort);
 }
 
+void otIp6RemoveAllUnsecurePorts(otInstance *aInstance)
+{
+    Instance &instance = *static_cast<Instance *>(aInstance);
+
+    instance.GetThreadNetif().GetIp6Filter().RemoveAllUnsecurePorts();
+}
+
 const uint16_t *otIp6GetUnsecurePorts(otInstance *aInstance, uint8_t *aNumEntries)
 {
     Instance &instance = *static_cast<Instance *>(aInstance);

src/core/net/ip6_filter.cpp

@@ -166,6 +166,11 @@ exit:
     return error;
 }
 
+void Filter::RemoveAllUnsecurePorts(void)
+{
+    memset(mUnsecurePorts, 0, sizeof(mUnsecurePorts));
+}
+
 const uint16_t *Filter::GetUnsecurePorts(uint8_t &aNumEntries) const
 {
     // Count the number of unsecure ports.

src/core/net/ip6_filter.hpp

@@ -97,6 +97,12 @@ public:
      */
     otError RemoveUnsecurePort(uint16_t aPort);
 
+    /**
+     * This method removes all ports from the allowed unsecure port list.
+     *
+     */
+    void RemoveAllUnsecurePorts(void);
+
     /**
      * This method returns a pointer to the unsecure port list.
      *

src/ncp/ncp_base_mtd.cpp

@@ -656,15 +656,10 @@ exit:
 
 template <> otError NcpBase::HandlePropertySet<SPINEL_PROP_THREAD_ASSISTING_PORTS>(void)
 {
-    uint8_t         numEntries = 0;
-    const uint16_t *ports      = otIp6GetUnsecurePorts(mInstance, &numEntries);
-    otError         error      = OT_ERROR_NONE;
+    otError error = OT_ERROR_NONE;
 
     // First, we need to remove all of the current assisting ports.
-    for (; numEntries != 0; ports++, numEntries--)
-    {
-        SuccessOrExit(error = otIp6RemoveUnsecurePort(mInstance, *ports));
-    }
+    otIp6RemoveAllUnsecurePorts(mInstance);
 
     while (mDecoder.GetRemainingLengthInStruct() >= sizeof(uint16_t))
     {