[ip6] refactor Filter::Accept to Filter::Apply and return Error (#11714)

This commit refactors the IPv6 filter by renaming `Filter::Accept()`
to `Filter::Apply()` and changing its return type from `bool` to
`Error`.

The new method now returns `kErrorNone` for an accepted message and
`kErrorDrop` for a message that should be dropped. This change
improves clarity and aligns the filter's logic with the common
`SuccessOrExit` error handling pattern used throughout the codebase.

src/core/net/ip6_filter.cpp

@@ -40,16 +40,16 @@ namespace Ip6 {
 
 RegisterLogModule("Ip6Filter");
 
-bool Filter::Accept(Message &aMessage) const
+Error Filter::Apply(const Message &aMessage) const
 {
-    bool     rval = false;
+    Error    error = kErrorDrop;
     Headers  headers;
     uint16_t dstPort;
 
     // Allow all received IPv6 datagrams with link security enabled
     if (aMessage.IsLinkSecurityEnabled())
     {
-        ExitNow(rval = true);
+        ExitNow(error = kErrorNone);
     }
 
     SuccessOrExit(headers.ParseFrom(aMessage));
@@ -59,7 +59,7 @@ bool Filter::Accept(Message &aMessage) const
     // Allow all link-local IPv6 datagrams when Thread is not enabled
     if (Get<Mle::Mle>().GetRole() == Mle::kRoleDisabled)
     {
-        ExitNow(rval = true);
+        ExitNow(error = kErrorNone);
     }
 
     dstPort = headers.GetDestinationPort();
@@ -70,7 +70,7 @@ bool Filter::Accept(Message &aMessage) const
         // Allow MLE traffic
         if (dstPort == Mle::kUdpPort)
         {
-            ExitNow(rval = true);
+            ExitNow(error = kErrorNone);
         }
 
 #if OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE
@@ -78,7 +78,7 @@ bool Filter::Accept(Message &aMessage) const
         if (Get<KeyManager>().GetSecurityPolicy().mNativeCommissioningEnabled &&
             dstPort == Get<MeshCoP::BorderAgent>().GetUdpPort())
         {
-            ExitNow(rval = true);
+            ExitNow(error = kErrorNone);
         }
 #endif
         break;
@@ -92,10 +92,13 @@ bool Filter::Accept(Message &aMessage) const
     }
 
     // Check against allowed unsecure port list
-    rval = mUnsecurePorts.Contains(dstPort);
+    if (mUnsecurePorts.Contains(dstPort))
+    {
+        error = kErrorNone;
+    }
 
 exit:
-    return rval;
+    return error;
 }
 
 Error Filter::UpdateUnsecurePorts(Action aAction, uint16_t aPort)

src/core/net/ip6_filter.hpp

@@ -70,14 +70,14 @@ public:
     }
 
     /**
-     * Indicates whether or not the IPv6 datagram passes the filter.
+     * Applies the filter to an IPv6 datagram to determine if it should be dropped.
      *
      * @param[in]  aMessage  The IPv6 datagram to process.
      *
-     * @retval TRUE   Accept the IPv6 datagram.
-     * @retval FALSE  Reject the IPv6 datagram.
+     * @retval kErrorNone  The message is not filtered and should be accepted.
+     * @retval kErrorDrop  The message matches the filter criteria and should be dropped.
      */
-    bool Accept(Message &aMessage) const;
+    Error Apply(const Message &aMessage) const;
 
     /**
      * Adds a port to the allowed unsecured port list.

src/core/thread/mesh_forwarder.cpp

@@ -1455,7 +1455,7 @@ void MeshForwarder::HandleFragment(RxInfo &aRxInfo)
         message->SetTimestampToNow();
         message->UpdateLinkInfoFrom(aRxInfo.mLinkInfo);
 
-        VerifyOrExit(Get<Ip6::Filter>().Accept(*message), error = kErrorDrop);
+        SuccessOrExit(error = Get<Ip6::Filter>().Apply(*message));
 
 #if OPENTHREAD_FTD
         CheckReachabilityToSendIcmpError(*message, aRxInfo.mMacAddrs);
@@ -1603,7 +1603,7 @@ void MeshForwarder::HandleLowpanHc(RxInfo &aRxInfo)
 
     message->UpdateLinkInfoFrom(aRxInfo.mLinkInfo);
 
-    VerifyOrExit(Get<Ip6::Filter>().Accept(*message), error = kErrorDrop);
+    SuccessOrExit(error = Get<Ip6::Filter>().Apply(*message));
 
 #if OPENTHREAD_FTD
     CheckReachabilityToSendIcmpError(*message, aRxInfo.mMacAddrs);