Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Sanity check ICMP6 router advertisement packets" into nyc-dev

Browse Source
This commit is contained in:
TreeHugger Robot
2016-08-30 05:20:10 +00:00
committed by Android (Google) Code Review
parent 689c92db9d a36213867a
commit b9d4f91630
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
services/net/java/android/net/apf/ApfFilter.java
View File

@@ -131,6 +131,7 @@ public class ApfFilter {
private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN; private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN;
private static final int ICMP6_NEIGHBOR_ANNOUNCEMENT = 136; private static final int ICMP6_NEIGHBOR_ANNOUNCEMENT = 136;
private static final int ICMP6_ROUTER_ADVERTISEMENT = 134;
// NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT
private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2; private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2;
@@ -306,7 +307,11 @@ public class ApfFilter {
} }
private long uint32(int s) { private long uint32(int s) {
return s & 0xffffffff; return s & 0xffffffffL;
}
private long getUint16(ByteBuffer buffer, int position) {
return uint16(buffer.getShort(position));
} }
private void prefixOptionToString(StringBuffer sb, int offset) { private void prefixOptionToString(StringBuffer sb, int offset) {
@@ -375,6 +380,15 @@ public class ApfFilter {
mPacket.clear(); mPacket.clear();
mLastSeen = curTime(); mLastSeen = curTime();
// Sanity check packet in case a packet arrives before we attach RA filter
// to our packet socket. b/29586253
if (getUint16(mPacket, ETH_ETHERTYPE_OFFSET) != ETH_P_IPV6 ||
uint8(mPacket.get(IPV6_NEXT_HEADER_OFFSET)) != IPPROTO_ICMPV6 ||
uint8(mPacket.get(ICMP6_TYPE_OFFSET)) != ICMP6_ROUTER_ADVERTISEMENT) {
throw new IllegalArgumentException("Not an ICMP6 router advertisement");
}
// Ignore the checksum. // Ignore the checksum.
int lastNonLifetimeStart = addNonLifetime(0, int lastNonLifetimeStart = addNonLifetime(0,
ICMP6_RA_CHECKSUM_OFFSET, ICMP6_RA_CHECKSUM_OFFSET,