commit 30020a513aeeb5eeb773ae39672acc0029ada41c
author Maciej Żenczykowski <maze@google.com> Fri Mar 21 12:36:45 2025 -0700
committer Maciej Żenczykowski <maze@google.com> Fri Mar 21 12:55:32 2025 -0700
tree e05b064b6d437a95360fcccb65e07bc9276797f0
parent b6d94ad6f34870cf045ae71da9c6cca727f1015a

clatd: fix endianness of multicast drop

This is a *critical* fix for http://go/aog/3514294
  'Drop egress multicast on clat interface'

Bug: 404457155
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If14ef730f78c7e991842a678260dd20df607b1ec

bpf/progs/clatd.c

diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c
index 2bb9d6f..f4e4f3b 100644
--- a/bpf/progs/clatd.c
+++ b/bpf/progs/clatd.c
@@ -289,7 +289,7 @@
     if (ip4->ihl != 5) return TC_ACT_PIPE;
 
     // Packet must not be multicast
-    if ((ip4->daddr & 0xf0000000) == 0xe0000000) return TC_ACT_PIPE;
+    if ((ip4->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) return TC_ACT_PIPE;
 
     // Calculate the IPv4 one's complement checksum of the IPv4 header.
     __wsum sum4 = 0;

clatd/ipv4.c

diff --git a/clatd/ipv4.c b/clatd/ipv4.c
index 81bf87b..d7ac0d1 100644
--- a/clatd/ipv4.c
+++ b/clatd/ipv4.c
@@ -85,8 +85,8 @@
     return 0;
   }
 
-  if ((header->daddr & 0xf0000000) == 0xe0000000) {
-    logmsg_dbg(ANDROID_LOG_INFO, "ip_packet/daddr is multicast: %x", header->daddr);
+  if ((header->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) {
+    logmsg_dbg(ANDROID_LOG_INFO, "ip_packet/daddr is multicast: %x", ntohl(header->daddr));
     return 0;
   }