LGTM, but maybe you can directly add filtering for zero addresses ("unspecified" addresses) too, to fix #4558?

Reviewed 2 of 2 files at r1, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @jiceatscion and @JordiSubira)

router/dataplane.go line 1858 at r1 (raw file):

		return pForward
	}
	// TODO(jiceatscion): That is the second time we parse the src address

Nit: Is it? I only see this in the "slow path" related to creating SCMPs.

Btw, in prepareSCMP parsing the source address only to set the destination address is unnecessary and constrains the supported address types to what this implementation understands (could even be considered a bug). It could just set DstAddrType, RawDstAddr = SrcAddrType, RawSrcAddr without parsing instead.

router/dataplane.go line 2107 at r1 (raw file):

			return unsupportedV4MappedV6Address
		}
		return d.addEndhostPort(resolvedDst, lastLayer, dst.IP())

Nit: usedstIP?

router/dataplane_internal_test.go line 728 at r1 (raw file):

		},
	}
	dpath.HopFields[2].Mac = computeMAC(t, testKey, dpath.InfoFields[0], dpath.HopFields[2])

Nit: this is not the current hop field (current is 0). This would fail in MAC validation (which comes after validating the src address, so the tests are passing).

Suggestion:

	dpath.HopFields[0].Mac = computeMAC(t, testKey, dpath.InfoFields[0], dpath.HopFields[0])

Good idea. 1 stone, 2 bugs.

Reviewable status: 0 of 3 files reviewed, all discussions resolved (waiting on @JordiSubira and @matzf)

router/dataplane.go line 1858 at r1 (raw file):

Done

router/dataplane.go line 2107 at r1 (raw file):

done

router/dataplane_internal_test.go line 728 at r1 (raw file):

done oops.

Reviewed 3 of 3 files at r2, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @JordiSubira)

Just one minor think, in #4558 we also mention loopback/localhost address which are not taken care of in this PR. So, either we create a new issue only with this case, or I wouldn't state that this PR completely fixes #4558 .

Besides, should we also filter unspecified src addresses?

Reviewable status: all files reviewed, 1 unresolved discussion

router/dataplane.go line 2135 at r2 (raw file):

			return unsupportedV4MappedV6Address
		}
		if dstIP.IsUnspecified() { // IsInvalid() not possible, we initialized it from wire bits.

Is this a function of netip.Addr. I do not completely understand the comment otherwise.

Code quote:

IsInvalid()