Merge changes I66641da0,I84e7d877 into main am: 922536fbb3 Original change: https://android-review.googlesource.com/c/platform/packages/modules/NetworkStack/+/2657757 Change-Id: I6ff2c604dc21cff977336cf4fcda1a197a64aaf1 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/src/android/net/apf/ApfFilter.java b/src/android/net/apf/ApfFilter.java index 3c8a71e..1bc3b41 100644 --- a/src/android/net/apf/ApfFilter.java +++ b/src/android/net/apf/ApfFilter.java
@@ -322,6 +322,8 @@ private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN; + private static final int IPPROTO_HOPOPTS = 0; + // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2; private static final int UDP_HEADER_LEN = 8; @@ -1486,6 +1488,8 @@ private void generateIPv6FilterLocked(ApfGenerator gen) throws IllegalInstructionException { // Here's a basic summary of what the IPv6 filter program does: // + // if there is a hop-by-hop option present (e.g. MLD query) + // pass // if we're dropping multicast // if it's not IPCMv6 or it's ICMPv6 but we're in doze mode: // if it's multicast: @@ -1500,6 +1504,10 @@ gen.addLoad8(Register.R0, IPV6_NEXT_HEADER_OFFSET); + // MLD packets set the router-alert hop-by-hop option. + // TODO: be smarter about not blindly passing every packet with HBH options. + gen.addJumpIfR0Equals(IPPROTO_HOPOPTS, mCountAndPassLabel); + // Drop multicast if the multicast filter is enabled. if (mMulticastFilter) { final String skipIPv6MulticastFilterLabel = "skipIPv6MulticastFilter";
diff --git a/tests/unit/res/raw/apfPcap.pcap b/tests/unit/res/raw/apfPcap.pcap index 6f69c4a..0206d25 100644 --- a/tests/unit/res/raw/apfPcap.pcap +++ b/tests/unit/res/raw/apfPcap.pcap Binary files differ