Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 67de87a3 authored by Paul Jensen's avatar Paul Jensen Committed by android-build-merger
Browse files

Sanity check ICMP6 router advertisement packets am: 4b545b04 

am: ea4f3222

Change-Id: I998bfb1855e02088f44fbf0826dbadc21773c446
parents f34eba73 ea4f3222

services/net/java/android/net/apf/ApfFilter.java

+11 −0
Original line number Diff line number Diff line
@@ -192,6 +192,7 @@ public class ApfFilter { 


    private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN;

    private static final int ICMP6_NEIGHBOR_ANNOUNCEMENT = 136;

    private static final int ICMP6_ROUTER_ADVERTISEMENT = 134;



    // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT

    private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2;
@@ -452,6 +453,16 @@ public class ApfFilter { 
        Ra(byte[] packet, int length) {

            mPacket = ByteBuffer.wrap(Arrays.copyOf(packet, length));

            mLastSeen = curTime();



            // Sanity check packet in case a packet arrives before we attach RA filter

            // to our packet socket. b/29586253

            if (getUint16(mPacket, ETH_ETHERTYPE_OFFSET) != ETH_P_IPV6 ||

                    uint8(mPacket.get(IPV6_NEXT_HEADER_OFFSET)) != IPPROTO_ICMPV6 ||

                    uint8(mPacket.get(ICMP6_TYPE_OFFSET)) != ICMP6_ROUTER_ADVERTISEMENT) {

                throw new IllegalArgumentException("Not an ICMP6 router advertisement");

            }





            RaEvent.Builder builder = new RaEvent.Builder();



            // Ignore the checksum.