Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e40413c authored by Paul Jensen's avatar Paul Jensen Committed by Android (Google) Code Review
Browse files

Merge "Sanity check ICMP6 router advertisement packets" into nyc-mr1-dev

parents c78bd7f0 4b545b04

services/net/java/android/net/apf/ApfFilter.java

+11 −0
Original line number Diff line number Diff line
@@ -192,6 +192,7 @@ public class ApfFilter { 


    private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN;

    private static final int ICMP6_NEIGHBOR_ANNOUNCEMENT = 136;

    private static final int ICMP6_ROUTER_ADVERTISEMENT = 134;



    // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT

    private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2;
@@ -452,6 +453,16 @@ public class ApfFilter { 
        Ra(byte[] packet, int length) {

            mPacket = ByteBuffer.wrap(Arrays.copyOf(packet, length));

            mLastSeen = curTime();



            // Sanity check packet in case a packet arrives before we attach RA filter

            // to our packet socket. b/29586253

            if (getUint16(mPacket, ETH_ETHERTYPE_OFFSET) != ETH_P_IPV6 ||

                    uint8(mPacket.get(IPV6_NEXT_HEADER_OFFSET)) != IPPROTO_ICMPV6 ||

                    uint8(mPacket.get(ICMP6_TYPE_OFFSET)) != ICMP6_ROUTER_ADVERTISEMENT) {

                throw new IllegalArgumentException("Not an ICMP6 router advertisement");

            }





            RaEvent.Builder builder = new RaEvent.Builder();



            // Ignore the checksum.