[ip6] use encapsulated destination while processing MPL tunneled packets

When `Ip6::HandleDatagram()` method checks if a multicast destination
address is subscribed it ignores a packet that should be handled when
it is tunneled as it looks for MPL forwarders' address (ff03::fc). This
commit resolves this issue by searching the subscription list using the
original destination address.

src/core/net/ip6.cpp

@@ -1160,8 +1160,7 @@ Error Ip6::HandleDatagram(Message &aMessage, const void *aLinkMessageInfo, bool
 
         forwardHost = header.GetDestination().IsMulticastLargerThanRealmLocal();
 
-        if ((aMessage.IsOriginThreadNetif() || aMessage.GetMulticastLoop()) &&
-            Get<ThreadNetif>().IsMulticastSubscribed(header.GetDestination()))
+        if (ShouldReceiveMulticastMessage(aMessage, header))
         {
             receive = true;
         }
@@ -1504,6 +1503,31 @@ Error Ip6::RouteLookup(const Address &aSource, const Address &aDestination) cons
     return error;
 }
 
+bool Ip6::ShouldReceiveMulticastMessage(const Message &aMessage, const Header &aHeader) const
+{
+    constexpr uint16_t tunneledHeaderOffset = sizeof(Header) + sizeof(HopByHopHeader) + sizeof(MplOption);
+
+    const Address &destination = aHeader.GetDestination();
+    bool           tunneled    = false;
+    bool           result      = false;
+    Header         tunneledHeader;
+
+    if (destination.IsRealmLocalAllMplForwarders() && aHeader.GetNextHeader() == kProtoHopOpts)
+    {
+        SuccessOrExit(tunneledHeader.ParseFrom(aMessage, tunneledHeaderOffset));
+        tunneled = true;
+    }
+
+    if ((aMessage.IsOriginThreadNetif() || aMessage.GetMulticastLoop()) &&
+        Get<ThreadNetif>().IsMulticastSubscribed(tunneled ? tunneledHeader.GetDestination() : aHeader.GetDestination()))
+    {
+        result = true;
+    }
+
+exit:
+    return result;
+}
+
 #if OPENTHREAD_CONFIG_IP6_BR_COUNTERS_ENABLE
 void Ip6::UpdateBorderRoutingCounters(const Header &aHeader, uint16_t aMessageLength, bool aIsInbound)
 {

src/core/net/ip6.hpp

@@ -398,6 +398,7 @@ class Ip6 : public InstanceLocator, private NonCopyable
                         Message::Ownership aMessageOwnership);
     bool  IsOnLink(const Address &aAddress) const;
     Error RouteLookup(const Address &aSource, const Address &aDestination) const;
+    bool  ShouldReceiveMulticastMessage(const Message &aMessage, const Header &aHeader) const;
 #if OPENTHREAD_CONFIG_IP6_BR_COUNTERS_ENABLE
     void UpdateBorderRoutingCounters(const Header &aHeader, uint16_t aMessageLength, bool aIsInbound);
 #endif

src/core/net/ip6_headers.cpp

@@ -41,13 +41,13 @@ namespace Ip6 {
 //---------------------------------------------------------------------------------------------------------------------
 // Header
 
-Error Header::ParseFrom(const Message &aMessage)
+Error Header::ParseFrom(const Message &aMessage, uint16_t aOffset)
 {
     Error error = kErrorParse;
 
-    SuccessOrExit(aMessage.Read(0, *this));
+    SuccessOrExit(aMessage.Read(aOffset, *this));
     VerifyOrExit(IsValid());
-    VerifyOrExit(sizeof(Header) + GetPayloadLength() == aMessage.GetLength());
+    VerifyOrExit((aOffset + sizeof(Header) + GetPayloadLength()) == (aMessage.GetLength()));
 
     error = kErrorNone;
 

src/core/net/ip6_headers.hpp

@@ -331,7 +331,7 @@ class Header : public Clearable<Header>
      * @retval kErrorParse  Malformed IPv6 header or message (e.g., message does not contained expected payload length).
      *
      */
-    Error ParseFrom(const Message &aMessage);
+    Error ParseFrom(const Message &aMessage, uint16_t aOffset = 0);
 
 private:
     // IPv6 header `mVerTcFlow` field: