Snap for 10515228 from 4329e4f74e2c69e27e2d1e0d484713443e2fa113 to mainline-art-release Change-Id: I529693813e7be4c50b606756e3b3ae1d9c6c5260
diff --git a/src/android/net/apf/ApfFilter.java b/src/android/net/apf/ApfFilter.java index 3c8a71e..1bc3b41 100644 --- a/src/android/net/apf/ApfFilter.java +++ b/src/android/net/apf/ApfFilter.java
@@ -322,6 +322,8 @@ private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN; + private static final int IPPROTO_HOPOPTS = 0; + // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2; private static final int UDP_HEADER_LEN = 8; @@ -1486,6 +1488,8 @@ private void generateIPv6FilterLocked(ApfGenerator gen) throws IllegalInstructionException { // Here's a basic summary of what the IPv6 filter program does: // + // if there is a hop-by-hop option present (e.g. MLD query) + // pass // if we're dropping multicast // if it's not IPCMv6 or it's ICMPv6 but we're in doze mode: // if it's multicast: @@ -1500,6 +1504,10 @@ gen.addLoad8(Register.R0, IPV6_NEXT_HEADER_OFFSET); + // MLD packets set the router-alert hop-by-hop option. + // TODO: be smarter about not blindly passing every packet with HBH options. + gen.addJumpIfR0Equals(IPPROTO_HOPOPTS, mCountAndPassLabel); + // Drop multicast if the multicast filter is enabled. if (mMulticastFilter) { final String skipIPv6MulticastFilterLabel = "skipIPv6MulticastFilter";
diff --git a/tests/unit/res/raw/apfPcap.pcap b/tests/unit/res/raw/apfPcap.pcap index 6f69c4a..0206d25 100644 --- a/tests/unit/res/raw/apfPcap.pcap +++ b/tests/unit/res/raw/apfPcap.pcap Binary files differ