Is it allowed to register localhost (::1) as a unicast address on a Thread device?

[arnulfrupp]

Is it allowed to register the localhost address ::1 as a unicast address on a Thread device using otIp6AddUnicastAddress(...)?
This address should not be registered with a parent router. It is is just for internal communication.

If it is allowed:
Is it safe to assume that a UDP packet received at a socket with socket address ::1 (otMessageInfo mSockAddr = ::1) is always from internal (trusted source)?
a) Is there a risk that a UDP packet with mSockAddr = ::1 could be faked from the outside?
b) Is there a risk that a UDP packet with mPeerAddr = ::1 could be faked from the outside?

[jwhui]

OpenThread does not currently forbid adding loopback to the Thread interface.

However, OpenThread also does not currently filter loopback on address registration and received messages. I'll submit a couple PRs to address this.

[jwhui]

I just submitted a couple of PRs:

• [mle] exclude loopback from Address Registration TLV #10997
• [ip6] filter received packets with loopback addrs #10998

[arnulfrupp]

Thank you for your reply and PRs.

Looking at the second PR I realized that checking if otMessageGetOrigin(...) equals OT_MESSAGE_ORIGIN_HOST_TRUSTED may be a better way to verify if a message originates for the host than checking if mPeerAddr is localhost.