diff --git a/Cronet/tests/cts/Android.bp b/Cronet/tests/cts/Android.bp
index d969b54..7b440cd 100644
--- a/Cronet/tests/cts/Android.bp
+++ b/Cronet/tests/cts/Android.bp
@@ -64,6 +64,7 @@
         "junit",
         "hamcrest-library",
         "kotlin-test",
+        "mockito-target",
     ],
     libs: [
         "android.test.base",
diff --git a/Cronet/tests/cts/src/android/net/http/cts/HttpEngineTest.java b/Cronet/tests/cts/src/android/net/http/cts/HttpEngineTest.java
index d247201..816596c 100644
--- a/Cronet/tests/cts/src/android/net/http/cts/HttpEngineTest.java
+++ b/Cronet/tests/cts/src/android/net/http/cts/HttpEngineTest.java
@@ -29,6 +29,7 @@
 import static org.junit.Assert.assertTrue;
 
 import android.content.Context;
+import android.net.Network;
 import android.net.http.HttpEngine;
 import android.net.http.UrlRequest;
 import android.net.http.UrlResponseInfo;
@@ -43,6 +44,7 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.Mockito;
 
 @RunWith(AndroidJUnit4.class)
 public class HttpEngineTest {
@@ -51,6 +53,7 @@
 
     private HttpEngine.Builder mEngineBuilder;
     private TestUrlRequestCallback mCallback;
+    private HttpCtsTestServer mTestServer;
     private UrlRequest mRequest;
     private HttpEngine mEngine;
     private Context mContext;
@@ -61,6 +64,7 @@
         skipIfNoInternetConnection(mContext);
         mEngineBuilder = new HttpEngine.Builder(mContext);
         mCallback = new TestUrlRequestCallback();
+        mTestServer = new HttpCtsTestServer(mContext);
     }
 
     @After
@@ -72,6 +76,9 @@
         if (mEngine != null) {
             mEngine.shutdown();
         }
+        if (mTestServer != null) {
+            mTestServer.shutdown();
+        }
     }
 
     private boolean isQuic(String negotiatedProtocol) {
@@ -253,4 +260,45 @@
                 .replaceFirst(".*<title>", "")
                 .replaceFirst("</title>.*", "");
     }
-}
+
+    @Test
+    public void testHttpEngine_bindToNetwork() throws Exception {
+        // Create a fake Android.net.Network. Since that network doesn't exist, binding to
+        // that should end up in a failed request.
+        Network mockNetwork = Mockito.mock(Network.class);
+        Mockito.when(mockNetwork.getNetworkHandle()).thenReturn(123L);
+        String url = mTestServer.getSuccessUrl();
+
+        mEngine = mEngineBuilder.build();
+        mEngine.bindToNetwork(mockNetwork);
+        UrlRequest.Builder builder =
+                mEngine.newUrlRequestBuilder(url, mCallback.getExecutor(), mCallback);
+        mRequest = builder.build();
+        mRequest.start();
+
+        mCallback.expectCallback(ResponseStep.ON_FAILED);
+    }
+
+    @Test
+    public void testHttpEngine_unbindFromNetwork() throws Exception {
+        // Create a fake Android.net.Network. Since that network doesn't exist, binding to
+        // that should end up in a failed request.
+        Network mockNetwork = Mockito.mock(Network.class);
+        Mockito.when(mockNetwork.getNetworkHandle()).thenReturn(123L);
+        String url = mTestServer.getSuccessUrl();
+
+        mEngine = mEngineBuilder.build();
+        // Bind to the fake network but then unbind. This should result in a successful
+        // request.
+        mEngine.bindToNetwork(mockNetwork);
+        mEngine.bindToNetwork(null);
+        UrlRequest.Builder builder =
+                mEngine.newUrlRequestBuilder(url, mCallback.getExecutor(), mCallback);
+        mRequest = builder.build();
+        mRequest.start();
+
+        mCallback.expectCallback(ResponseStep.ON_SUCCEEDED);
+        UrlResponseInfo info = mCallback.mResponseInfo;
+        assertOKStatusCode(info);
+    }
+}
\ No newline at end of file
diff --git a/Cronet/tests/cts/src/android/net/http/cts/UrlRequestTest.java b/Cronet/tests/cts/src/android/net/http/cts/UrlRequestTest.java
index a364e29..2ec035b 100644
--- a/Cronet/tests/cts/src/android/net/http/cts/UrlRequestTest.java
+++ b/Cronet/tests/cts/src/android/net/http/cts/UrlRequestTest.java
@@ -44,6 +44,8 @@
 import android.net.http.cts.util.TestUrlRequestCallback.ResponseStep;
 import android.net.http.cts.util.UploadDataProviders;
 
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
 import androidx.test.core.app.ApplicationProvider;
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 
@@ -310,7 +312,7 @@
         assertThat(mCallback.mResponseAsString).isEqualTo(body);
     }
 
-    private static class StubUrlRequestCallback extends UrlRequest.Callback {
+    private static class StubUrlRequestCallback implements UrlRequest.Callback {
 
         @Override
         public void onRedirectReceived(
@@ -338,6 +340,11 @@
         public void onFailed(UrlRequest request, UrlResponseInfo info, HttpException error) {
             throw new UnsupportedOperationException(error);
         }
+
+        @Override
+        public void onCanceled(@NonNull UrlRequest request, @Nullable UrlResponseInfo info) {
+            throw new UnsupportedOperationException();
+        }
     }
 
     private static class InMemoryUploadDataProvider extends UploadDataProvider {
diff --git a/Cronet/tests/cts/src/android/net/http/cts/util/TestUrlRequestCallback.java b/Cronet/tests/cts/src/android/net/http/cts/util/TestUrlRequestCallback.java
index efbcff6..28443b7 100644
--- a/Cronet/tests/cts/src/android/net/http/cts/util/TestUrlRequestCallback.java
+++ b/Cronet/tests/cts/src/android/net/http/cts/util/TestUrlRequestCallback.java
@@ -50,7 +50,7 @@
  * method to block thread until the request completes on another thread.
  * Allows us to cancel, block request or throw an exception from an arbitrary step.
  */
-public class TestUrlRequestCallback extends UrlRequest.Callback {
+public class TestUrlRequestCallback implements UrlRequest.Callback {
     private static final int TIMEOUT_MS = 12_000;
     public ArrayList<UrlResponseInfo> mRedirectResponseInfoList = new ArrayList<>();
     public ArrayList<String> mRedirectUrlList = new ArrayList<>();
diff --git a/Cronet/tests/mts/Android.bp b/Cronet/tests/mts/Android.bp
index 03d163c..ac71653 100644
--- a/Cronet/tests/mts/Android.bp
+++ b/Cronet/tests/mts/Android.bp
@@ -19,7 +19,7 @@
 
 android_library {
     name: "NetHttpTestsLibPreJarJar",
-    srcs: [":cronet_aml_javatests_sources"],
+    srcs: ["//external/cronet:cronet_aml_javatests_sources"],
     sdk_version: "test_current",
     min_sdk_version: "30",
     static_libs: [
diff --git a/Tethering/apex/Android.bp b/Tethering/apex/Android.bp
index 67206cd..ff5acf5 100644
--- a/Tethering/apex/Android.bp
+++ b/Tethering/apex/Android.bp
@@ -66,11 +66,19 @@
 
 apex_defaults {
     name: "CronetInTetheringApexDefaultsEnabled",
-    jni_libs: ["cronet_aml_components_cronet_android_cronet"],
+    jni_libs: [
+        "//external/cronet:cronet_aml_components_cronet_android_cronet",
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
+    ],
     arch: {
         riscv64: {
             // TODO: remove this when there is a riscv64 libcronet
-            exclude_jni_libs: ["cronet_aml_components_cronet_android_cronet"],
+            exclude_jni_libs: [
+                "//external/cronet:cronet_aml_components_cronet_android_cronet",
+                "//external/cronet/third_party/boringssl:libcrypto",
+                "//external/cronet/third_party/boringssl:libssl",
+            ],
         },
     },
 }
diff --git a/Tethering/common/TetheringLib/Android.bp b/Tethering/common/TetheringLib/Android.bp
index 4080029..b99c9e4 100644
--- a/Tethering/common/TetheringLib/Android.bp
+++ b/Tethering/common/TetheringLib/Android.bp
@@ -75,12 +75,12 @@
 
 java_defaults {
     name: "CronetJavaDefaultsEnabled",
-    srcs: [":cronet_aml_api_sources"],
+    srcs: ["//external/cronet:cronet_aml_api_sources"],
     libs: [
         "androidx.annotation_annotation",
     ],
     impl_only_static_libs: [
-        "cronet_aml_java",
+        "//external/cronet:cronet_aml_java",
     ],
     api_dir: "cronet_enabled/api",
 }
@@ -101,8 +101,8 @@
 java_defaults {
   name: "CronetJavaPrejarjarDefaultsEnabled",
   static_libs: [
-    "cronet_aml_api_java",
-    "cronet_aml_java"
+    "//external/cronet:cronet_aml_api_java",
+    "//external/cronet:cronet_aml_java"
   ],
 }
 
diff --git a/Tethering/common/TetheringLib/cronet_enabled/api/current.txt b/Tethering/common/TetheringLib/cronet_enabled/api/current.txt
index cf441ce..66a0295 100644
--- a/Tethering/common/TetheringLib/cronet_enabled/api/current.txt
+++ b/Tethering/common/TetheringLib/cronet_enabled/api/current.txt
@@ -241,14 +241,13 @@
     method @NonNull public abstract android.net.http.UrlRequest.Builder setUploadDataProvider(@NonNull android.net.http.UploadDataProvider, @NonNull java.util.concurrent.Executor);
   }
 
-  public abstract static class UrlRequest.Callback {
-    ctor public UrlRequest.Callback();
+  public static interface UrlRequest.Callback {
     method public void onCanceled(@NonNull android.net.http.UrlRequest, @Nullable android.net.http.UrlResponseInfo);
-    method public abstract void onFailed(@NonNull android.net.http.UrlRequest, @Nullable android.net.http.UrlResponseInfo, @NonNull android.net.http.HttpException);
-    method public abstract void onReadCompleted(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo, @NonNull java.nio.ByteBuffer) throws java.lang.Exception;
-    method public abstract void onRedirectReceived(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo, @NonNull String) throws java.lang.Exception;
-    method public abstract void onResponseStarted(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo) throws java.lang.Exception;
-    method public abstract void onSucceeded(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo);
+    method public void onFailed(@NonNull android.net.http.UrlRequest, @Nullable android.net.http.UrlResponseInfo, @NonNull android.net.http.HttpException);
+    method public void onReadCompleted(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo, @NonNull java.nio.ByteBuffer) throws java.lang.Exception;
+    method public void onRedirectReceived(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo, @NonNull String) throws java.lang.Exception;
+    method public void onResponseStarted(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo) throws java.lang.Exception;
+    method public void onSucceeded(@NonNull android.net.http.UrlRequest, @NonNull android.net.http.UrlResponseInfo);
   }
 
   public static class UrlRequest.Status {
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/metrics/TetheringMetricsTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/metrics/TetheringMetricsTest.java
index 7fdde97..95afa56 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/metrics/TetheringMetricsTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/metrics/TetheringMetricsTest.java
@@ -99,86 +99,87 @@
         mTetheringMetrics.sendReport(downstream);
     }
 
-    private void runDownstreamTypesTest(final Pair<Integer, DownstreamType>... testPairs)
+    private void runDownstreamTypesTest(final Pair<Integer, DownstreamType> testPair)
             throws Exception {
-        for (Pair<Integer, DownstreamType> testPair : testPairs) {
-            final int type = testPair.first;
-            final DownstreamType expectedResult = testPair.second;
+        final int type = testPair.first;
+        final DownstreamType expectedResult = testPair.second;
 
-            mTetheringMetrics.createBuilder(type, TEST_CALLER_PKG);
-            updateErrorAndSendReport(type, TETHER_ERROR_NO_ERROR);
-            verifyReport(expectedResult, ErrorCode.EC_NO_ERROR, UserType.USER_UNKNOWN);
-            reset(mTetheringMetrics);
-        }
+        mTetheringMetrics.createBuilder(type, TEST_CALLER_PKG);
+        updateErrorAndSendReport(type, TETHER_ERROR_NO_ERROR);
+        verifyReport(expectedResult, ErrorCode.EC_NO_ERROR, UserType.USER_UNKNOWN);
+        reset(mTetheringMetrics);
     }
 
     @Test
     public void testDownstreamTypes() throws Exception {
-        runDownstreamTypesTest(new Pair<>(TETHERING_WIFI, DownstreamType.DS_TETHERING_WIFI),
-                new Pair<>(TETHERING_WIFI_P2P, DownstreamType.DS_TETHERING_WIFI_P2P),
-                new Pair<>(TETHERING_BLUETOOTH, DownstreamType.DS_TETHERING_BLUETOOTH),
-                new Pair<>(TETHERING_USB, DownstreamType.DS_TETHERING_USB),
-                new Pair<>(TETHERING_NCM, DownstreamType.DS_TETHERING_NCM),
-                new Pair<>(TETHERING_ETHERNET, DownstreamType.DS_TETHERING_ETHERNET));
+        runDownstreamTypesTest(new Pair<>(TETHERING_WIFI, DownstreamType.DS_TETHERING_WIFI));
+        runDownstreamTypesTest(new Pair<>(TETHERING_WIFI_P2P,
+                DownstreamType.DS_TETHERING_WIFI_P2P));
+        runDownstreamTypesTest(new Pair<>(TETHERING_BLUETOOTH,
+                DownstreamType.DS_TETHERING_BLUETOOTH));
+        runDownstreamTypesTest(new Pair<>(TETHERING_USB, DownstreamType.DS_TETHERING_USB));
+        runDownstreamTypesTest(new Pair<>(TETHERING_NCM, DownstreamType.DS_TETHERING_NCM));
+        runDownstreamTypesTest(new Pair<>(TETHERING_ETHERNET,
+                DownstreamType.DS_TETHERING_ETHERNET));
     }
 
-    private void runErrorCodesTest(final Pair<Integer, ErrorCode>... testPairs)
+    private void runErrorCodesTest(final Pair<Integer, ErrorCode> testPair)
             throws Exception {
-        for (Pair<Integer, ErrorCode> testPair : testPairs) {
-            final int errorCode = testPair.first;
-            final ErrorCode expectedResult = testPair.second;
+        final int errorCode = testPair.first;
+        final ErrorCode expectedResult = testPair.second;
 
-            mTetheringMetrics.createBuilder(TETHERING_WIFI, TEST_CALLER_PKG);
-            updateErrorAndSendReport(TETHERING_WIFI, errorCode);
-            verifyReport(DownstreamType.DS_TETHERING_WIFI, expectedResult, UserType.USER_UNKNOWN);
-            reset(mTetheringMetrics);
-        }
+        mTetheringMetrics.createBuilder(TETHERING_WIFI, TEST_CALLER_PKG);
+        updateErrorAndSendReport(TETHERING_WIFI, errorCode);
+        verifyReport(DownstreamType.DS_TETHERING_WIFI, expectedResult, UserType.USER_UNKNOWN);
     }
 
     @Test
     public void testErrorCodes() throws Exception {
-        runErrorCodesTest(new Pair<>(TETHER_ERROR_NO_ERROR, ErrorCode.EC_NO_ERROR),
-                new Pair<>(TETHER_ERROR_UNKNOWN_IFACE, ErrorCode.EC_UNKNOWN_IFACE),
-                new Pair<>(TETHER_ERROR_SERVICE_UNAVAIL, ErrorCode.EC_SERVICE_UNAVAIL),
-                new Pair<>(TETHER_ERROR_UNSUPPORTED, ErrorCode.EC_UNSUPPORTED),
-                new Pair<>(TETHER_ERROR_UNAVAIL_IFACE, ErrorCode.EC_UNAVAIL_IFACE),
-                new Pair<>(TETHER_ERROR_INTERNAL_ERROR, ErrorCode.EC_INTERNAL_ERROR),
-                new Pair<>(TETHER_ERROR_TETHER_IFACE_ERROR, ErrorCode.EC_TETHER_IFACE_ERROR),
-                new Pair<>(TETHER_ERROR_UNTETHER_IFACE_ERROR, ErrorCode.EC_UNTETHER_IFACE_ERROR),
-                new Pair<>(TETHER_ERROR_ENABLE_FORWARDING_ERROR,
-                ErrorCode.EC_ENABLE_FORWARDING_ERROR),
-                new Pair<>(TETHER_ERROR_DISABLE_FORWARDING_ERROR,
-                ErrorCode.EC_DISABLE_FORWARDING_ERROR),
-                new Pair<>(TETHER_ERROR_IFACE_CFG_ERROR, ErrorCode.EC_IFACE_CFG_ERROR),
-                new Pair<>(TETHER_ERROR_PROVISIONING_FAILED, ErrorCode.EC_PROVISIONING_FAILED),
-                new Pair<>(TETHER_ERROR_DHCPSERVER_ERROR, ErrorCode.EC_DHCPSERVER_ERROR),
-                new Pair<>(TETHER_ERROR_ENTITLEMENT_UNKNOWN, ErrorCode.EC_ENTITLEMENT_UNKNOWN),
-                new Pair<>(TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION,
-                ErrorCode.EC_NO_CHANGE_TETHERING_PERMISSION),
-                new Pair<>(TETHER_ERROR_NO_ACCESS_TETHERING_PERMISSION,
-                ErrorCode.EC_NO_ACCESS_TETHERING_PERMISSION),
-                new Pair<>(TETHER_ERROR_UNKNOWN_TYPE, ErrorCode.EC_UNKNOWN_TYPE));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_NO_ERROR, ErrorCode.EC_NO_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_UNKNOWN_IFACE, ErrorCode.EC_UNKNOWN_IFACE));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_SERVICE_UNAVAIL, ErrorCode.EC_SERVICE_UNAVAIL));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_UNSUPPORTED, ErrorCode.EC_UNSUPPORTED));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_UNAVAIL_IFACE, ErrorCode.EC_UNAVAIL_IFACE));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_INTERNAL_ERROR, ErrorCode.EC_INTERNAL_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_TETHER_IFACE_ERROR,
+                ErrorCode.EC_TETHER_IFACE_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_UNTETHER_IFACE_ERROR,
+                ErrorCode.EC_UNTETHER_IFACE_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_ENABLE_FORWARDING_ERROR,
+                ErrorCode.EC_ENABLE_FORWARDING_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_DISABLE_FORWARDING_ERROR,
+                ErrorCode.EC_DISABLE_FORWARDING_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_IFACE_CFG_ERROR, ErrorCode.EC_IFACE_CFG_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_PROVISIONING_FAILED,
+                ErrorCode.EC_PROVISIONING_FAILED));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_DHCPSERVER_ERROR,
+                ErrorCode.EC_DHCPSERVER_ERROR));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_ENTITLEMENT_UNKNOWN,
+                ErrorCode.EC_ENTITLEMENT_UNKNOWN));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION,
+                ErrorCode.EC_NO_CHANGE_TETHERING_PERMISSION));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_NO_ACCESS_TETHERING_PERMISSION,
+                ErrorCode.EC_NO_ACCESS_TETHERING_PERMISSION));
+        runErrorCodesTest(new Pair<>(TETHER_ERROR_UNKNOWN_TYPE, ErrorCode.EC_UNKNOWN_TYPE));
     }
 
-    private void runUserTypesTest(final Pair<String, UserType>... testPairs)
+    private void runUserTypesTest(final Pair<String, UserType> testPair)
             throws Exception {
-        for (Pair<String, UserType> testPair : testPairs) {
-            final String callerPkg = testPair.first;
-            final UserType expectedResult = testPair.second;
+        final String callerPkg = testPair.first;
+        final UserType expectedResult = testPair.second;
 
-            mTetheringMetrics.createBuilder(TETHERING_WIFI, callerPkg);
-            updateErrorAndSendReport(TETHERING_WIFI, TETHER_ERROR_NO_ERROR);
-            verifyReport(DownstreamType.DS_TETHERING_WIFI, ErrorCode.EC_NO_ERROR, expectedResult);
-            reset(mTetheringMetrics);
-        }
+        mTetheringMetrics.createBuilder(TETHERING_WIFI, callerPkg);
+        updateErrorAndSendReport(TETHERING_WIFI, TETHER_ERROR_NO_ERROR);
+        verifyReport(DownstreamType.DS_TETHERING_WIFI, ErrorCode.EC_NO_ERROR, expectedResult);
+        reset(mTetheringMetrics);
     }
 
     @Test
     public void testUserTypes() throws Exception {
-        runUserTypesTest(new Pair<>(TEST_CALLER_PKG, UserType.USER_UNKNOWN),
-                new Pair<>(SETTINGS_PKG, UserType.USER_SETTINGS),
-                new Pair<>(SYSTEMUI_PKG, UserType.USER_SYSTEMUI),
-                new Pair<>(GMS_PKG, UserType.USER_GMS));
+        runUserTypesTest(new Pair<>(TEST_CALLER_PKG, UserType.USER_UNKNOWN));
+        runUserTypesTest(new Pair<>(SETTINGS_PKG, UserType.USER_SETTINGS));
+        runUserTypesTest(new Pair<>(SYSTEMUI_PKG, UserType.USER_SYSTEMUI));
+        runUserTypesTest(new Pair<>(GMS_PKG, UserType.USER_GMS));
     }
 
     @Test
diff --git a/framework/api/system-current.txt b/framework/api/system-current.txt
index 196e023..4a2ed8a 100644
--- a/framework/api/system-current.txt
+++ b/framework/api/system-current.txt
@@ -470,7 +470,7 @@
   }
 
   public abstract class SocketKeepalive implements java.lang.AutoCloseable {
-    method public final void start(@IntRange(from=0xa, to=0xe10) int, int, @NonNull android.net.Network);
+    method public final void start(@IntRange(from=0xa, to=0xe10) int, int, @Nullable android.net.Network);
     field public static final int ERROR_NO_SUCH_SLOT = -33; // 0xffffffdf
     field public static final int FLAG_AUTOMATIC_ON_OFF = 1; // 0x1
     field public static final int SUCCESS = 0; // 0x0
diff --git a/framework/src/android/net/SocketKeepalive.java b/framework/src/android/net/SocketKeepalive.java
index 311126e..10daf17 100644
--- a/framework/src/android/net/SocketKeepalive.java
+++ b/framework/src/android/net/SocketKeepalive.java
@@ -21,6 +21,7 @@
 import android.annotation.IntDef;
 import android.annotation.IntRange;
 import android.annotation.NonNull;
+import android.annotation.Nullable;
 import android.annotation.SystemApi;
 import android.os.Binder;
 import android.os.ParcelFileDescriptor;
@@ -374,12 +375,14 @@
      *                    the supplied {@link Callback} will see a call to
      *                    {@link Callback#onError(int)} with {@link #ERROR_INVALID_INTERVAL}.
      * @param flags Flags to enable/disable available options on this keepalive.
-     * @param underpinnedNetwork The underpinned network of this keepalive.
+     * @param underpinnedNetwork an optional network running over mNetwork that this
+     *                           keepalive is intended to keep up, e.g. an IPSec
+     *                           tunnel running over mNetwork.
      * @hide
      */
     @SystemApi(client = PRIVILEGED_APPS)
     public final void start(@IntRange(from = MIN_INTERVAL_SEC, to = MAX_INTERVAL_SEC)
-            int intervalSec, @StartFlags int flags, @NonNull Network underpinnedNetwork) {
+            int intervalSec, @StartFlags int flags, @Nullable Network underpinnedNetwork) {
         startImpl(intervalSec, flags, underpinnedNetwork);
     }
 
diff --git a/framework/src/android/net/TcpSocketKeepalive.java b/framework/src/android/net/TcpSocketKeepalive.java
index b548f6d..696889f 100644
--- a/framework/src/android/net/TcpSocketKeepalive.java
+++ b/framework/src/android/net/TcpSocketKeepalive.java
@@ -55,6 +55,12 @@
             throw new IllegalArgumentException("Illegal flag value for "
                     + this.getClass().getSimpleName() + " : " + flags);
         }
+
+        if (underpinnedNetwork != null) {
+            throw new IllegalArgumentException("Illegal underpinned network for "
+                    + this.getClass().getSimpleName() + " : " + underpinnedNetwork);
+        }
+
         mExecutor.execute(() -> {
             try {
                 mService.startTcpKeepalive(mNetwork, mPfd, intervalSec, mCallback);
diff --git a/service/jni/com_android_server_connectivity_ClatCoordinator.cpp b/service/jni/com_android_server_connectivity_ClatCoordinator.cpp
index 5b42659..dae45f3 100644
--- a/service/jni/com_android_server_connectivity_ClatCoordinator.cpp
+++ b/service/jni/com_android_server_connectivity_ClatCoordinator.cpp
@@ -177,7 +177,7 @@
                                                                               jobject clazz) {
     // Will eventually be bound to htons(ETH_P_IPV6) protocol,
     // but only after appropriate bpf filter is attached.
-    int sock = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+    const int sock = socket(AF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0);
     if (sock < 0) {
         throwIOException(env, "packet socket failed", errno);
         return -1;
diff --git a/service/native/libs/libclat/Android.bp b/service/native/libs/libclat/Android.bp
index 54d40ac..996706e 100644
--- a/service/native/libs/libclat/Android.bp
+++ b/service/native/libs/libclat/Android.bp
@@ -23,6 +23,9 @@
         "clatutils.cpp",
     ],
     stl: "libc++_static",
+    header_libs: [
+        "bpf_headers",
+    ],
     static_libs: [
         "libip_checksum",
     ],
diff --git a/service/native/libs/libclat/clatutils.cpp b/service/native/libs/libclat/clatutils.cpp
index c6a9781..6c5c9e3 100644
--- a/service/native/libs/libclat/clatutils.cpp
+++ b/service/native/libs/libclat/clatutils.cpp
@@ -25,6 +25,8 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <bpf/BpfClassic.h>
+
 extern "C" {
 #include "checksum.h"
 }
@@ -33,11 +35,9 @@
 namespace net {
 namespace clat {
 
-bool isIpv4AddressFree(in_addr_t addr) {
-    int s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
-    if (s == -1) {
-        return 0;
-    }
+bool isIpv4AddressFree(const in_addr_t addr) {
+    const int s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+    if (s == -1) return 0;
 
     // Attempt to connect to the address. If the connection succeeds and getsockname returns the
     // same then the address is already assigned to the system and we can't use it.
@@ -47,9 +47,10 @@
             .sin_addr = {addr},
     };
     socklen_t len = sizeof(sin);
-    bool inuse = connect(s, (struct sockaddr*)&sin, sizeof(sin)) == 0 &&
-                 getsockname(s, (struct sockaddr*)&sin, &len) == 0 && (size_t)len >= sizeof(sin) &&
-                 sin.sin_addr.s_addr == addr;
+    const bool inuse = !connect(s, (struct sockaddr*)&sin, sizeof(sin)) &&
+                       !getsockname(s, (struct sockaddr*)&sin, &len) &&
+                       len == (socklen_t)sizeof(sin) &&
+                       sin.sin_addr.s_addr == addr;
 
     close(s);
     return !inuse;
@@ -59,36 +60,30 @@
 //   ip        - the IP address from the configuration file
 //   prefixlen - the length of the prefix from which addresses may be selected.
 //   returns: the IPv4 address, or INADDR_NONE if no addresses were available
-in_addr_t selectIpv4Address(const in_addr ip, int16_t prefixlen) {
+in_addr_t selectIpv4Address(const in_addr ip, const int16_t prefixlen) {
     return selectIpv4AddressInternal(ip, prefixlen, isIpv4AddressFree);
 }
 
 // Only allow testing to use this function directly. Otherwise call selectIpv4Address(ip, pfxlen)
 // which has applied valid isIpv4AddressFree function pointer.
-in_addr_t selectIpv4AddressInternal(const in_addr ip, int16_t prefixlen,
-                                    isIpv4AddrFreeFn isIpv4AddressFreeFunc) {
+in_addr_t selectIpv4AddressInternal(const in_addr ip, const int16_t prefixlen,
+                                    const isIpv4AddrFreeFn isIpv4AddressFreeFunc) {
     // Impossible! Only test allows to apply fn.
-    if (isIpv4AddressFreeFunc == nullptr) {
-        return INADDR_NONE;
-    }
+    if (isIpv4AddressFreeFunc == nullptr) return INADDR_NONE;
 
     // Don't accept prefixes that are too large because we scan addresses one by one.
-    if (prefixlen < 16 || prefixlen > 32) {
-        return INADDR_NONE;
-    }
+    if (prefixlen < 16 || prefixlen > 32) return INADDR_NONE;
 
     // All these are in host byte order.
-    in_addr_t mask = 0xffffffff >> (32 - prefixlen) << (32 - prefixlen);
-    in_addr_t ipv4 = ntohl(ip.s_addr);
-    in_addr_t first_ipv4 = ipv4;
-    in_addr_t prefix = ipv4 & mask;
+    const uint32_t mask = 0xffffffff >> (32 - prefixlen) << (32 - prefixlen);
+    uint32_t ipv4 = ntohl(ip.s_addr);
+    const uint32_t first_ipv4 = ipv4;
+    const uint32_t prefix = ipv4 & mask;
 
     // Pick the first IPv4 address in the pool, wrapping around if necessary.
     // So, for example, 192.0.0.4 -> 192.0.0.5 -> 192.0.0.6 -> 192.0.0.7 -> 192.0.0.0.
     do {
-        if (isIpv4AddressFreeFunc(htonl(ipv4))) {
-            return htonl(ipv4);
-        }
+        if (isIpv4AddressFreeFunc(htonl(ipv4))) return htonl(ipv4);
         ipv4 = prefix | ((ipv4 + 1) & ~mask);
     } while (ipv4 != first_ipv4);
 
@@ -96,7 +91,7 @@
 }
 
 // Alters the bits in the IPv6 address to make them checksum neutral with v4 and nat64Prefix.
-void makeChecksumNeutral(in6_addr* v6, const in_addr v4, const in6_addr& nat64Prefix) {
+void makeChecksumNeutral(in6_addr* const v6, const in_addr v4, const in6_addr& nat64Prefix) {
     // Fill last 8 bytes of IPv6 address with random bits.
     arc4random_buf(&v6->s6_addr[8], 8);
 
@@ -118,33 +113,35 @@
 }
 
 // Picks a random interface ID that is checksum neutral with the IPv4 address and the NAT64 prefix.
-int generateIpv6Address(const char* iface, const in_addr v4, const in6_addr& nat64Prefix,
-                        in6_addr* v6, uint32_t mark) {
-    int s = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+int generateIpv6Address(const char* const iface, const in_addr v4, const in6_addr& nat64Prefix,
+                        in6_addr* const v6, const uint32_t mark) {
+    const int s = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
     if (s == -1) return -errno;
 
     // Socket's mark affects routing decisions (network selection)
     // An fwmark is necessary for clat to bypass the VPN during initialization.
     if (setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) {
-        int ret = errno;
-        ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(errno));
+        const int err = errno;
+        ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(err));
         close(s);
-        return -ret;
+        return -err;
     }
 
-    if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1) == -1) {
+    if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, iface, strlen(iface) + 1)) {
+        const int err = errno;
+        ALOGE("setsockopt(SOL_SOCKET, SO_BINDTODEVICE, '%s') failed: %s", iface, strerror(err));
         close(s);
-        return -errno;
+        return -err;
     }
 
     sockaddr_in6 sin6 = {.sin6_family = AF_INET6, .sin6_addr = nat64Prefix};
-    if (connect(s, reinterpret_cast<struct sockaddr*>(&sin6), sizeof(sin6)) == -1) {
+    if (connect(s, reinterpret_cast<struct sockaddr*>(&sin6), sizeof(sin6))) {
         close(s);
         return -errno;
     }
 
     socklen_t len = sizeof(sin6);
-    if (getsockname(s, reinterpret_cast<struct sockaddr*>(&sin6), &len) == -1) {
+    if (getsockname(s, reinterpret_cast<struct sockaddr*>(&sin6), &len)) {
         close(s);
         return -errno;
     }
@@ -163,21 +160,22 @@
     return 0;
 }
 
-int detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix, uint32_t mark) {
+int detect_mtu(const struct in6_addr* const plat_subnet, const uint32_t plat_suffix,
+               const uint32_t mark) {
     // Create an IPv6 UDP socket.
-    int s = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+    const int s = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0);
     if (s < 0) {
-        int ret = errno;
-        ALOGE("socket(AF_INET6, SOCK_DGRAM, 0) failed: %s", strerror(errno));
-        return -ret;
+        const int err = errno;
+        ALOGE("socket(AF_INET6, SOCK_DGRAM, 0) failed: %s", strerror(err));
+        return -err;
     }
 
     // Socket's mark affects routing decisions (network selection)
     if (setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) {
-        int ret = errno;
-        ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(errno));
+        const int err = errno;
+        ALOGE("setsockopt(SOL_SOCKET, SO_MARK) failed: %s", strerror(err));
         close(s);
-        return -ret;
+        return -err;
     }
 
     // Try to connect udp socket to plat_subnet(96 bits):plat_suffix(32 bits)
@@ -187,20 +185,20 @@
     };
     dst.sin6_addr.s6_addr32[3] = plat_suffix;
     if (connect(s, (struct sockaddr*)&dst, sizeof(dst))) {
-        int ret = errno;
-        ALOGE("connect() failed: %s", strerror(errno));
+        const int err = errno;
+        ALOGE("connect() failed: %s", strerror(err));
         close(s);
-        return -ret;
+        return -err;
     }
 
     // Fetch the socket's IPv6 mtu - this is effectively fetching mtu from routing table
     int mtu;
     socklen_t sz_mtu = sizeof(mtu);
     if (getsockopt(s, SOL_IPV6, IPV6_MTU, &mtu, &sz_mtu)) {
-        int ret = errno;
-        ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) failed: %s", strerror(errno));
+        const int err = errno;
+        ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) failed: %s", strerror(err));
         close(s);
-        return -ret;
+        return -err;
     }
     if (sz_mtu != sizeof(mtu)) {
         ALOGE("getsockopt(SOL_IPV6, IPV6_MTU) returned unexpected size: %d", sz_mtu);
@@ -219,34 +217,26 @@
  *   ifindex - index of interface to add the filter to
  * returns: 0 on success, -errno on failure
  */
-int configure_packet_socket(int sock, in6_addr* addr, int ifindex) {
-    uint32_t* ipv6 = addr->s6_addr32;
-
+int configure_packet_socket(const int sock, const in6_addr* const addr, const int ifindex) {
     // clang-format off
     struct sock_filter filter_code[] = {
-    // Load the first four bytes of the IPv6 destination address (starts 24 bytes in).
-    // Compare it against the first four bytes of our IPv6 address, in host byte order (BPF loads
-    // are always in host byte order). If it matches, continue with next instruction (JMP 0). If it
-    // doesn't match, jump ahead to statement that returns 0 (ignore packet). Repeat for the other
-    // three words of the IPv6 address, and if they all match, return full packet (accept packet).
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  24),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[0]), 0, 7),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  28),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[1]), 0, 5),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  32),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[2]), 0, 3),
-        BPF_STMT(BPF_LD  | BPF_W   | BPF_ABS,  36),
-        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,    htonl(ipv6[3]), 0, 1),
-        BPF_STMT(BPF_RET | BPF_K,              0xFFFFFFFF),
-        BPF_STMT(BPF_RET | BPF_K,              0),
+        BPF_LOAD_IPV6_BE32(daddr.s6_addr32[0]),
+        BPF2_REJECT_IF_NOT_EQUAL(ntohl(addr->s6_addr32[0])),
+        BPF_LOAD_IPV6_BE32(daddr.s6_addr32[1]),
+        BPF2_REJECT_IF_NOT_EQUAL(ntohl(addr->s6_addr32[1])),
+        BPF_LOAD_IPV6_BE32(daddr.s6_addr32[2]),
+        BPF2_REJECT_IF_NOT_EQUAL(ntohl(addr->s6_addr32[2])),
+        BPF_LOAD_IPV6_BE32(daddr.s6_addr32[3]),
+        BPF2_REJECT_IF_NOT_EQUAL(ntohl(addr->s6_addr32[3])),
+        BPF_ACCEPT,
     };
     // clang-format on
     struct sock_fprog filter = {sizeof(filter_code) / sizeof(filter_code[0]), filter_code};
 
     if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter))) {
-        int res = errno;
-        ALOGE("attach packet filter failed: %s", strerror(errno));
-        return -res;
+        const int err = errno;
+        ALOGE("attach packet filter failed: %s", strerror(err));
+        return -err;
     }
 
     struct sockaddr_ll sll = {
@@ -257,9 +247,9 @@
                     PACKET_OTHERHOST,  // The 464xlat IPv6 address is not assigned to the kernel.
     };
     if (bind(sock, (struct sockaddr*)&sll, sizeof(sll))) {
-        int res = errno;
-        ALOGE("binding packet socket: %s", strerror(errno));
-        return -res;
+        const int err = errno;
+        ALOGE("binding packet socket: %s", strerror(err));
+        return -err;
     }
 
     return 0;
diff --git a/service/native/libs/libclat/clatutils_test.cpp b/service/native/libs/libclat/clatutils_test.cpp
index abd4e81..f4f97db 100644
--- a/service/native/libs/libclat/clatutils_test.cpp
+++ b/service/native/libs/libclat/clatutils_test.cpp
@@ -165,7 +165,7 @@
     TunInterface v6Iface;
     ASSERT_EQ(0, v6Iface.init());
 
-    int s = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, htons(ETH_P_IPV6));
+    const int s = socket(AF_PACKET, SOCK_RAW | SOCK_CLOEXEC, htons(ETH_P_IPV6));
     EXPECT_LE(0, s);
     struct in6_addr addr6;
     EXPECT_EQ(1, inet_pton(AF_INET6, "2001:db8::f00", &addr6));
diff --git a/service/native/libs/libclat/include/libclat/clatutils.h b/service/native/libs/libclat/include/libclat/clatutils.h
index 991b193..6e17e67 100644
--- a/service/native/libs/libclat/include/libclat/clatutils.h
+++ b/service/native/libs/libclat/include/libclat/clatutils.h
@@ -20,17 +20,19 @@
 namespace net {
 namespace clat {
 
-bool isIpv4AddressFree(in_addr_t addr);
-in_addr_t selectIpv4Address(const in_addr ip, int16_t prefixlen);
-void makeChecksumNeutral(in6_addr* v6, const in_addr v4, const in6_addr& nat64Prefix);
-int generateIpv6Address(const char* iface, const in_addr v4, const in6_addr& nat64Prefix,
-                        in6_addr* v6, uint32_t mark);
-int detect_mtu(const struct in6_addr* plat_subnet, uint32_t plat_suffix, uint32_t mark);
-int configure_packet_socket(int sock, in6_addr* addr, int ifindex);
+bool isIpv4AddressFree(const in_addr_t addr);
+in_addr_t selectIpv4Address(const in_addr ip, const int16_t prefixlen);
+void makeChecksumNeutral(in6_addr* const v6, const in_addr v4, const in6_addr& nat64Prefix);
+int generateIpv6Address(const char* const iface, const in_addr v4, const in6_addr& nat64Prefix,
+                        in6_addr* const v6, const uint32_t mark);
+int detect_mtu(const struct in6_addr* const plat_subnet, const uint32_t plat_suffix,
+               const uint32_t mark);
+int configure_packet_socket(const int sock, const in6_addr* const addr, const int ifindex);
 
 // For testing
-typedef bool (*isIpv4AddrFreeFn)(in_addr_t);
-in_addr_t selectIpv4AddressInternal(const in_addr ip, int16_t prefixlen, isIpv4AddrFreeFn fn);
+typedef bool (*isIpv4AddrFreeFn)(const in_addr_t);
+in_addr_t selectIpv4AddressInternal(const in_addr ip, const int16_t prefixlen,
+                                    const isIpv4AddrFreeFn fn);
 
 }  // namespace clat
 }  // namespace net
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 5f51971..e969cd6 100755
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -911,7 +911,7 @@
 
     // This is the cache for the packageName -> ApplicationSelfCertifiedNetworkCapabilities. This
     // value can be accessed from both handler thread and any random binder thread. Therefore,
-    // accessing this value requires holding a lock.
+    // accessing this value requires holding a lock. The cache is the same across all the users.
     @GuardedBy("mSelfCertifiedCapabilityCache")
     private final Map<String, ApplicationSelfCertifiedNetworkCapabilities>
             mSelfCertifiedCapabilityCache = new HashMap<>();
@@ -7001,6 +7001,7 @@
             return;
         }
         ApplicationSelfCertifiedNetworkCapabilities applicationNetworkCapabilities;
+        final long ident = Binder.clearCallingIdentity();
         try {
             synchronized (mSelfCertifiedCapabilityCache) {
                 applicationNetworkCapabilities = mSelfCertifiedCapabilityCache.get(
@@ -7027,6 +7028,8 @@
                             + " property");
         } catch (XmlPullParserException | IOException | InvalidTagException e) {
             throw new SecurityException(e.getMessage());
+        } finally {
+            Binder.restoreCallingIdentity(ident);
         }
 
         applicationNetworkCapabilities.enforceSelfCertifiedNetworkCapabilitiesDeclared(
@@ -8467,6 +8470,7 @@
         exemptUids[1] = nai.networkCapabilities.getOwnerUid();
         UidRangeParcel[] ranges = toUidRangeStableParcels(uidRanges);
 
+        // Close sockets before modifying uid ranges so that RST packets can reach to the server.
         maybeCloseSockets(nai, ranges, exemptUids);
         try {
             if (add) {
@@ -8480,6 +8484,7 @@
             loge("Exception while " + (add ? "adding" : "removing") + " uid ranges " + uidRanges +
                     " on netId " + nai.network.netId + ". " + e);
         }
+        // Close sockets that established connection while requesting netd.
         maybeCloseSockets(nai, ranges, exemptUids);
     }
 
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 0bb6000..774176f 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -2708,6 +2708,7 @@
         // Cannot use @IgnoreUpTo(Build.VERSION_CODES.R) because this test also requires API 31
         // shims, and @IgnoreUpTo does not check that.
         assumeTrue(TestUtils.shouldTestSApis());
+        assumeTrue(mPackageManager.hasSystemFeature(FEATURE_WIFI));
 
         final TestNetworkTracker tnt = callWithShellPermissionIdentity(
                 () -> initTestNetwork(mContext, TEST_LINKADDR, NETWORK_CALLBACK_TIMEOUT_MS));
@@ -2721,7 +2722,8 @@
                     OemNetworkPreferences.OEM_NETWORK_PREFERENCE_TEST_ONLY);
             registerTestOemNetworkPreferenceCallbacks(defaultCallback, systemDefaultCallback);
             waitForAvailable(defaultCallback, tnt.getNetwork());
-            waitForAvailable(systemDefaultCallback, wifiNetwork);
+            systemDefaultCallback.eventuallyExpect(CallbackEntry.AVAILABLE,
+                    NETWORK_CALLBACK_TIMEOUT_MS, cb -> wifiNetwork.equals(cb.getNetwork()));
         }, /* cleanup */ () -> {
                 runWithShellPermissionIdentity(tnt::teardown);
                 defaultCallback.expect(CallbackEntry.LOST, tnt, NETWORK_CALLBACK_TIMEOUT_MS);
@@ -3406,6 +3408,9 @@
 
     private static final boolean EXPECT_PASS = false;
     private static final boolean EXPECT_BLOCK = true;
+
+    // ALLOWLIST means the firewall denies all by default, uids must be explicitly allowed
+    // DENYLIST means the firewall allows all by default, uids must be explicitly denyed
     private static final boolean ALLOWLIST = true;
     private static final boolean DENYLIST = false;
 
@@ -3471,17 +3476,49 @@
 
     @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
-    public void testFirewallBlocking() {
-        // ALLOWLIST means the firewall denies all by default, uids must be explicitly allowed
+    public void testFirewallBlockingDozable() {
         doTestFirewallBlocking(FIREWALL_CHAIN_DOZABLE, ALLOWLIST);
-        doTestFirewallBlocking(FIREWALL_CHAIN_POWERSAVE, ALLOWLIST);
-        doTestFirewallBlocking(FIREWALL_CHAIN_RESTRICTED, ALLOWLIST);
-        doTestFirewallBlocking(FIREWALL_CHAIN_LOW_POWER_STANDBY, ALLOWLIST);
+    }
 
-        // DENYLIST means the firewall allows all by default, uids must be explicitly denyed
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingPowersave() {
+        doTestFirewallBlocking(FIREWALL_CHAIN_POWERSAVE, ALLOWLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingRestricted() {
+        doTestFirewallBlocking(FIREWALL_CHAIN_RESTRICTED, ALLOWLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingLowPowerStandby() {
+        doTestFirewallBlocking(FIREWALL_CHAIN_LOW_POWER_STANDBY, ALLOWLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingStandby() {
         doTestFirewallBlocking(FIREWALL_CHAIN_STANDBY, DENYLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingOemDeny1() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_1, DENYLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingOemDeny2() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_2, DENYLIST);
+    }
+
+    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @AppModeFull(reason = "Socket cannot bind in instant app mode")
+    public void testFirewallBlockingOemDeny3() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_3, DENYLIST);
     }
 
diff --git a/tests/cts/net/src/android/net/cts/NsdManagerTest.kt b/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
index 3f197c4..6fd2321 100644
--- a/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
@@ -68,6 +68,7 @@
 import android.system.ErrnoException
 import android.system.Os
 import android.system.OsConstants.AF_INET6
+import android.system.OsConstants.EADDRNOTAVAIL
 import android.system.OsConstants.ENETUNREACH
 import android.system.OsConstants.IPPROTO_UDP
 import android.system.OsConstants.SOCK_DGRAM
@@ -404,7 +405,7 @@
                 Os.connect(sock, parseNumericAddress("ff02::fb%$ifaceName"), 12345)
                 true
             }.catch<ErrnoException> {
-                if (it.errno != ENETUNREACH) {
+                if (it.errno != ENETUNREACH && it.errno != EADDRNOTAVAIL) {
                     throw it
                 }
                 false
diff --git a/tools/gn2bp/Android.bp.swp b/tools/gn2bp/Android.bp.swp
index d22a576..ccc931b 100644
--- a/tools/gn2bp/Android.bp.swp
+++ b/tools/gn2bp/Android.bp.swp
@@ -16,7 +16,7 @@
 
 build = ["Android.extras.bp"]
 
-// GN: PACKAGE
+// The actual license can be found in Android.extras.bp
 package {
     default_applicable_licenses: [
         "external_cronet_license",
@@ -36,6 +36,7 @@
         "components/cronet/android/api/src/android/net/http/ExperimentalBidirectionalStream.java",
         "components/cronet/android/api/src/android/net/http/ExperimentalHttpEngine.java",
         "components/cronet/android/api/src/android/net/http/ExperimentalUrlRequest.java",
+        "components/cronet/android/api/src/android/net/http/HeaderBlock.java",
         "components/cronet/android/api/src/android/net/http/HttpEngine.java",
         "components/cronet/android/api/src/android/net/http/HttpException.java",
         "components/cronet/android/api/src/android/net/http/IHttpEngineBuilder.java",
@@ -1378,6 +1379,8 @@
         "base/vlog.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -1436,8 +1439,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -3396,7 +3397,7 @@
 cc_genrule {
     name: "cronet_aml_base_build_date",
     cmd: "$(location build/write_build_date_header.py) $(out) " +
-         "1674644139",
+         "1676008584",
     out: [
         "base/generated_build_date.h",
     ],
@@ -3412,7 +3413,7 @@
 cc_genrule {
     name: "cronet_aml_base_build_date__testing",
     cmd: "$(location build/write_build_date_header.py) $(out) " +
-         "1674644139",
+         "1676008584",
     host_supported: true,
     out: [
         "base/generated_build_date.h",
@@ -6561,6 +6562,8 @@
         "components/cronet/android/cronet_jni.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -6640,8 +6643,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -7033,6 +7034,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -7286,6 +7288,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -7535,6 +7538,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -7782,6 +7786,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -7873,6 +7878,8 @@
         "components/cronet/android/url_request_error.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -7949,8 +7956,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -8824,6 +8829,8 @@
         "components/cronet/url_request_context_config.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -8898,8 +8905,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -9648,6 +9653,8 @@
         "components/cronet/metrics_util.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -9707,8 +9714,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -9968,6 +9973,8 @@
         "components/metrics/library_support/histogram_manager.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libprotobuf-cpp-lite",
@@ -10028,8 +10035,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -10400,6 +10405,8 @@
         "components/prefs/writeable_pref_store.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -10459,8 +10466,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -11023,6 +11028,8 @@
         "crypto/unexportable_key_metrics.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -11082,8 +11089,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -11700,6 +11705,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -11977,6 +11983,7 @@
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUploadDataStream.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequest.java",
         "components/cronet/android/java/src/org/chromium/net/impl/CronetUrlRequestContext.java",
+        "components/cronet/android/java/src/org/chromium/net/impl/HeaderBlockImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NativeCronetEngineBuilderImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NetworkExceptionImpl.java",
         "components/cronet/android/java/src/org/chromium/net/impl/NoOpLogger.java",
@@ -12426,6 +12433,8 @@
         "net/dns/test_dns_config_service.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -12494,8 +12503,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -12835,6 +12842,8 @@
         "net/dns/public/util.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -12902,8 +12911,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -13634,6 +13641,8 @@
         "net/http/transport_security_state.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -13703,8 +13712,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -14648,6 +14655,8 @@
         "net/url_request/websocket_handshake_userdata_key.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libz",
@@ -14718,8 +14727,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -15543,6 +15550,8 @@
         ":cronet_aml_net_isolation_info_proto_gen",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libprotobuf-cpp-lite",
@@ -15605,8 +15614,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_brotli_common",
         "cronet_aml_third_party_brotli_dec",
         "cronet_aml_third_party_icu_icui18n",
@@ -16218,6 +16225,8 @@
         ":cronet_aml_net_third_party_quiche_net_quic_test_tools_proto_gen",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libprotobuf-cpp-lite",
@@ -16283,8 +16292,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -16589,6 +16596,8 @@
         "net/extras/preload_data/decoder.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -16648,8 +16657,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -17629,6 +17636,10 @@
         "net/third_party/quiche/src/quiche/quic/core/proto/crypto_server_config.proto",
         "net/third_party/quiche/src/quiche/quic/core/proto/source_address_token.proto",
     ],
+    shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
+    ],
     tools: [
         "cronet_aml_third_party_protobuf_protoc",
     ],
@@ -18039,6 +18050,8 @@
         "net/third_party/quiche/src/quiche/spdy/core/spdy_simple_arena.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
         "libprotobuf-cpp-lite",
@@ -18101,8 +18114,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -19419,6 +19430,8 @@
         "net/traffic_annotation/network_traffic_annotation_android.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -19478,8 +19491,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -19749,6 +19760,8 @@
         "net/third_party/uri_template/uri_template.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -19808,8 +19821,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -30095,350 +30106,6 @@
     },
 }
 
-// GN: //third_party/boringssl:boringssl
-cc_library_static {
-    name: "cronet_aml_third_party_boringssl_boringssl",
-    srcs: [
-        "third_party/boringssl/err_data.c",
-        "third_party/boringssl/src/crypto/asn1/a_bitstr.c",
-        "third_party/boringssl/src/crypto/asn1/a_bool.c",
-        "third_party/boringssl/src/crypto/asn1/a_d2i_fp.c",
-        "third_party/boringssl/src/crypto/asn1/a_dup.c",
-        "third_party/boringssl/src/crypto/asn1/a_gentm.c",
-        "third_party/boringssl/src/crypto/asn1/a_i2d_fp.c",
-        "third_party/boringssl/src/crypto/asn1/a_int.c",
-        "third_party/boringssl/src/crypto/asn1/a_mbstr.c",
-        "third_party/boringssl/src/crypto/asn1/a_object.c",
-        "third_party/boringssl/src/crypto/asn1/a_octet.c",
-        "third_party/boringssl/src/crypto/asn1/a_print.c",
-        "third_party/boringssl/src/crypto/asn1/a_strex.c",
-        "third_party/boringssl/src/crypto/asn1/a_strnid.c",
-        "third_party/boringssl/src/crypto/asn1/a_time.c",
-        "third_party/boringssl/src/crypto/asn1/a_type.c",
-        "third_party/boringssl/src/crypto/asn1/a_utctm.c",
-        "third_party/boringssl/src/crypto/asn1/a_utf8.c",
-        "third_party/boringssl/src/crypto/asn1/asn1_lib.c",
-        "third_party/boringssl/src/crypto/asn1/asn1_par.c",
-        "third_party/boringssl/src/crypto/asn1/asn_pack.c",
-        "third_party/boringssl/src/crypto/asn1/f_int.c",
-        "third_party/boringssl/src/crypto/asn1/f_string.c",
-        "third_party/boringssl/src/crypto/asn1/posix_time.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_dec.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_enc.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_fre.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_new.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_typ.c",
-        "third_party/boringssl/src/crypto/asn1/tasn_utl.c",
-        "third_party/boringssl/src/crypto/base64/base64.c",
-        "third_party/boringssl/src/crypto/bio/bio.c",
-        "third_party/boringssl/src/crypto/bio/bio_mem.c",
-        "third_party/boringssl/src/crypto/bio/connect.c",
-        "third_party/boringssl/src/crypto/bio/fd.c",
-        "third_party/boringssl/src/crypto/bio/file.c",
-        "third_party/boringssl/src/crypto/bio/hexdump.c",
-        "third_party/boringssl/src/crypto/bio/pair.c",
-        "third_party/boringssl/src/crypto/bio/printf.c",
-        "third_party/boringssl/src/crypto/bio/socket.c",
-        "third_party/boringssl/src/crypto/bio/socket_helper.c",
-        "third_party/boringssl/src/crypto/blake2/blake2.c",
-        "third_party/boringssl/src/crypto/bn_extra/bn_asn1.c",
-        "third_party/boringssl/src/crypto/bn_extra/convert.c",
-        "third_party/boringssl/src/crypto/buf/buf.c",
-        "third_party/boringssl/src/crypto/bytestring/asn1_compat.c",
-        "third_party/boringssl/src/crypto/bytestring/ber.c",
-        "third_party/boringssl/src/crypto/bytestring/cbb.c",
-        "third_party/boringssl/src/crypto/bytestring/cbs.c",
-        "third_party/boringssl/src/crypto/bytestring/unicode.c",
-        "third_party/boringssl/src/crypto/chacha/chacha.c",
-        "third_party/boringssl/src/crypto/cipher_extra/cipher_extra.c",
-        "third_party/boringssl/src/crypto/cipher_extra/derive_key.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_aesctrhmac.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_aesgcmsiv.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_chacha20poly1305.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_des.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_null.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_rc2.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_rc4.c",
-        "third_party/boringssl/src/crypto/cipher_extra/e_tls.c",
-        "third_party/boringssl/src/crypto/cipher_extra/tls_cbc.c",
-        "third_party/boringssl/src/crypto/conf/conf.c",
-        "third_party/boringssl/src/crypto/cpu_aarch64_apple.c",
-        "third_party/boringssl/src/crypto/cpu_aarch64_fuchsia.c",
-        "third_party/boringssl/src/crypto/cpu_aarch64_linux.c",
-        "third_party/boringssl/src/crypto/cpu_aarch64_win.c",
-        "third_party/boringssl/src/crypto/cpu_arm.c",
-        "third_party/boringssl/src/crypto/cpu_arm_linux.c",
-        "third_party/boringssl/src/crypto/cpu_intel.c",
-        "third_party/boringssl/src/crypto/cpu_ppc64le.c",
-        "third_party/boringssl/src/crypto/crypto.c",
-        "third_party/boringssl/src/crypto/curve25519/curve25519.c",
-        "third_party/boringssl/src/crypto/curve25519/spake25519.c",
-        "third_party/boringssl/src/crypto/des/des.c",
-        "third_party/boringssl/src/crypto/dh_extra/dh_asn1.c",
-        "third_party/boringssl/src/crypto/dh_extra/params.c",
-        "third_party/boringssl/src/crypto/digest_extra/digest_extra.c",
-        "third_party/boringssl/src/crypto/dsa/dsa.c",
-        "third_party/boringssl/src/crypto/dsa/dsa_asn1.c",
-        "third_party/boringssl/src/crypto/ec_extra/ec_asn1.c",
-        "third_party/boringssl/src/crypto/ec_extra/ec_derive.c",
-        "third_party/boringssl/src/crypto/ec_extra/hash_to_curve.c",
-        "third_party/boringssl/src/crypto/ecdh_extra/ecdh_extra.c",
-        "third_party/boringssl/src/crypto/ecdsa_extra/ecdsa_asn1.c",
-        "third_party/boringssl/src/crypto/engine/engine.c",
-        "third_party/boringssl/src/crypto/err/err.c",
-        "third_party/boringssl/src/crypto/evp/evp.c",
-        "third_party/boringssl/src/crypto/evp/evp_asn1.c",
-        "third_party/boringssl/src/crypto/evp/evp_ctx.c",
-        "third_party/boringssl/src/crypto/evp/p_dsa_asn1.c",
-        "third_party/boringssl/src/crypto/evp/p_ec.c",
-        "third_party/boringssl/src/crypto/evp/p_ec_asn1.c",
-        "third_party/boringssl/src/crypto/evp/p_ed25519.c",
-        "third_party/boringssl/src/crypto/evp/p_ed25519_asn1.c",
-        "third_party/boringssl/src/crypto/evp/p_hkdf.c",
-        "third_party/boringssl/src/crypto/evp/p_rsa.c",
-        "third_party/boringssl/src/crypto/evp/p_rsa_asn1.c",
-        "third_party/boringssl/src/crypto/evp/p_x25519.c",
-        "third_party/boringssl/src/crypto/evp/p_x25519_asn1.c",
-        "third_party/boringssl/src/crypto/evp/pbkdf.c",
-        "third_party/boringssl/src/crypto/evp/print.c",
-        "third_party/boringssl/src/crypto/evp/scrypt.c",
-        "third_party/boringssl/src/crypto/evp/sign.c",
-        "third_party/boringssl/src/crypto/ex_data.c",
-        "third_party/boringssl/src/crypto/fipsmodule/bcm.c",
-        "third_party/boringssl/src/crypto/fipsmodule/fips_shared_support.c",
-        "third_party/boringssl/src/crypto/hkdf/hkdf.c",
-        "third_party/boringssl/src/crypto/hpke/hpke.c",
-        "third_party/boringssl/src/crypto/hrss/hrss.c",
-        "third_party/boringssl/src/crypto/lhash/lhash.c",
-        "third_party/boringssl/src/crypto/mem.c",
-        "third_party/boringssl/src/crypto/obj/obj.c",
-        "third_party/boringssl/src/crypto/obj/obj_xref.c",
-        "third_party/boringssl/src/crypto/pem/pem_all.c",
-        "third_party/boringssl/src/crypto/pem/pem_info.c",
-        "third_party/boringssl/src/crypto/pem/pem_lib.c",
-        "third_party/boringssl/src/crypto/pem/pem_oth.c",
-        "third_party/boringssl/src/crypto/pem/pem_pk8.c",
-        "third_party/boringssl/src/crypto/pem/pem_pkey.c",
-        "third_party/boringssl/src/crypto/pem/pem_x509.c",
-        "third_party/boringssl/src/crypto/pem/pem_xaux.c",
-        "third_party/boringssl/src/crypto/pkcs7/pkcs7.c",
-        "third_party/boringssl/src/crypto/pkcs7/pkcs7_x509.c",
-        "third_party/boringssl/src/crypto/pkcs8/p5_pbev2.c",
-        "third_party/boringssl/src/crypto/pkcs8/pkcs8.c",
-        "third_party/boringssl/src/crypto/pkcs8/pkcs8_x509.c",
-        "third_party/boringssl/src/crypto/poly1305/poly1305.c",
-        "third_party/boringssl/src/crypto/poly1305/poly1305_arm.c",
-        "third_party/boringssl/src/crypto/poly1305/poly1305_vec.c",
-        "third_party/boringssl/src/crypto/pool/pool.c",
-        "third_party/boringssl/src/crypto/rand_extra/deterministic.c",
-        "third_party/boringssl/src/crypto/rand_extra/forkunsafe.c",
-        "third_party/boringssl/src/crypto/rand_extra/fuchsia.c",
-        "third_party/boringssl/src/crypto/rand_extra/passive.c",
-        "third_party/boringssl/src/crypto/rand_extra/rand_extra.c",
-        "third_party/boringssl/src/crypto/rand_extra/windows.c",
-        "third_party/boringssl/src/crypto/rc4/rc4.c",
-        "third_party/boringssl/src/crypto/refcount_c11.c",
-        "third_party/boringssl/src/crypto/refcount_lock.c",
-        "third_party/boringssl/src/crypto/rsa_extra/rsa_asn1.c",
-        "third_party/boringssl/src/crypto/rsa_extra/rsa_print.c",
-        "third_party/boringssl/src/crypto/siphash/siphash.c",
-        "third_party/boringssl/src/crypto/stack/stack.c",
-        "third_party/boringssl/src/crypto/thread.c",
-        "third_party/boringssl/src/crypto/thread_none.c",
-        "third_party/boringssl/src/crypto/thread_pthread.c",
-        "third_party/boringssl/src/crypto/thread_win.c",
-        "third_party/boringssl/src/crypto/trust_token/pmbtoken.c",
-        "third_party/boringssl/src/crypto/trust_token/trust_token.c",
-        "third_party/boringssl/src/crypto/trust_token/voprf.c",
-        "third_party/boringssl/src/crypto/x509/a_digest.c",
-        "third_party/boringssl/src/crypto/x509/a_sign.c",
-        "third_party/boringssl/src/crypto/x509/a_verify.c",
-        "third_party/boringssl/src/crypto/x509/algorithm.c",
-        "third_party/boringssl/src/crypto/x509/asn1_gen.c",
-        "third_party/boringssl/src/crypto/x509/by_dir.c",
-        "third_party/boringssl/src/crypto/x509/by_file.c",
-        "third_party/boringssl/src/crypto/x509/i2d_pr.c",
-        "third_party/boringssl/src/crypto/x509/name_print.c",
-        "third_party/boringssl/src/crypto/x509/rsa_pss.c",
-        "third_party/boringssl/src/crypto/x509/t_crl.c",
-        "third_party/boringssl/src/crypto/x509/t_req.c",
-        "third_party/boringssl/src/crypto/x509/t_x509.c",
-        "third_party/boringssl/src/crypto/x509/t_x509a.c",
-        "third_party/boringssl/src/crypto/x509/x509.c",
-        "third_party/boringssl/src/crypto/x509/x509_att.c",
-        "third_party/boringssl/src/crypto/x509/x509_cmp.c",
-        "third_party/boringssl/src/crypto/x509/x509_d2.c",
-        "third_party/boringssl/src/crypto/x509/x509_def.c",
-        "third_party/boringssl/src/crypto/x509/x509_ext.c",
-        "third_party/boringssl/src/crypto/x509/x509_lu.c",
-        "third_party/boringssl/src/crypto/x509/x509_obj.c",
-        "third_party/boringssl/src/crypto/x509/x509_req.c",
-        "third_party/boringssl/src/crypto/x509/x509_set.c",
-        "third_party/boringssl/src/crypto/x509/x509_trs.c",
-        "third_party/boringssl/src/crypto/x509/x509_txt.c",
-        "third_party/boringssl/src/crypto/x509/x509_v3.c",
-        "third_party/boringssl/src/crypto/x509/x509_vfy.c",
-        "third_party/boringssl/src/crypto/x509/x509_vpm.c",
-        "third_party/boringssl/src/crypto/x509/x509cset.c",
-        "third_party/boringssl/src/crypto/x509/x509name.c",
-        "third_party/boringssl/src/crypto/x509/x509rset.c",
-        "third_party/boringssl/src/crypto/x509/x509spki.c",
-        "third_party/boringssl/src/crypto/x509/x_algor.c",
-        "third_party/boringssl/src/crypto/x509/x_all.c",
-        "third_party/boringssl/src/crypto/x509/x_attrib.c",
-        "third_party/boringssl/src/crypto/x509/x_crl.c",
-        "third_party/boringssl/src/crypto/x509/x_exten.c",
-        "third_party/boringssl/src/crypto/x509/x_info.c",
-        "third_party/boringssl/src/crypto/x509/x_name.c",
-        "third_party/boringssl/src/crypto/x509/x_pkey.c",
-        "third_party/boringssl/src/crypto/x509/x_pubkey.c",
-        "third_party/boringssl/src/crypto/x509/x_req.c",
-        "third_party/boringssl/src/crypto/x509/x_sig.c",
-        "third_party/boringssl/src/crypto/x509/x_spki.c",
-        "third_party/boringssl/src/crypto/x509/x_val.c",
-        "third_party/boringssl/src/crypto/x509/x_x509.c",
-        "third_party/boringssl/src/crypto/x509/x_x509a.c",
-        "third_party/boringssl/src/crypto/x509v3/pcy_cache.c",
-        "third_party/boringssl/src/crypto/x509v3/pcy_data.c",
-        "third_party/boringssl/src/crypto/x509v3/pcy_map.c",
-        "third_party/boringssl/src/crypto/x509v3/pcy_node.c",
-        "third_party/boringssl/src/crypto/x509v3/pcy_tree.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_akey.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_akeya.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_alt.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_bcons.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_bitst.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_conf.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_cpols.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_crld.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_enum.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_extku.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_genn.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_ia5.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_info.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_int.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_lib.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_ncons.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_ocsp.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_pci.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_pcia.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_pcons.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_pmaps.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_prn.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_purp.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_skey.c",
-        "third_party/boringssl/src/crypto/x509v3/v3_utl.c",
-        "third_party/boringssl/src/ssl/bio_ssl.cc",
-        "third_party/boringssl/src/ssl/d1_both.cc",
-        "third_party/boringssl/src/ssl/d1_lib.cc",
-        "third_party/boringssl/src/ssl/d1_pkt.cc",
-        "third_party/boringssl/src/ssl/d1_srtp.cc",
-        "third_party/boringssl/src/ssl/dtls_method.cc",
-        "third_party/boringssl/src/ssl/dtls_record.cc",
-        "third_party/boringssl/src/ssl/encrypted_client_hello.cc",
-        "third_party/boringssl/src/ssl/extensions.cc",
-        "third_party/boringssl/src/ssl/handoff.cc",
-        "third_party/boringssl/src/ssl/handshake.cc",
-        "third_party/boringssl/src/ssl/handshake_client.cc",
-        "third_party/boringssl/src/ssl/handshake_server.cc",
-        "third_party/boringssl/src/ssl/s3_both.cc",
-        "third_party/boringssl/src/ssl/s3_lib.cc",
-        "third_party/boringssl/src/ssl/s3_pkt.cc",
-        "third_party/boringssl/src/ssl/ssl_aead_ctx.cc",
-        "third_party/boringssl/src/ssl/ssl_asn1.cc",
-        "third_party/boringssl/src/ssl/ssl_buffer.cc",
-        "third_party/boringssl/src/ssl/ssl_cert.cc",
-        "third_party/boringssl/src/ssl/ssl_cipher.cc",
-        "third_party/boringssl/src/ssl/ssl_file.cc",
-        "third_party/boringssl/src/ssl/ssl_key_share.cc",
-        "third_party/boringssl/src/ssl/ssl_lib.cc",
-        "third_party/boringssl/src/ssl/ssl_privkey.cc",
-        "third_party/boringssl/src/ssl/ssl_session.cc",
-        "third_party/boringssl/src/ssl/ssl_stat.cc",
-        "third_party/boringssl/src/ssl/ssl_transcript.cc",
-        "third_party/boringssl/src/ssl/ssl_versions.cc",
-        "third_party/boringssl/src/ssl/ssl_x509.cc",
-        "third_party/boringssl/src/ssl/t1_enc.cc",
-        "third_party/boringssl/src/ssl/tls13_both.cc",
-        "third_party/boringssl/src/ssl/tls13_client.cc",
-        "third_party/boringssl/src/ssl/tls13_enc.cc",
-        "third_party/boringssl/src/ssl/tls13_server.cc",
-        "third_party/boringssl/src/ssl/tls_method.cc",
-        "third_party/boringssl/src/ssl/tls_record.cc",
-    ],
-    static_libs: [
-        "cronet_aml_third_party_boringssl_boringssl_asm",
-    ],
-    defaults: [
-        "cronet_aml_defaults",
-    ],
-    cflags: [
-        "-DANDROID",
-        "-DANDROID_NDK_VERSION_ROLL=r23_1",
-        "-DBORINGSSL_ALLOW_CXX_RUNTIME",
-        "-DBORINGSSL_IMPLEMENTATION",
-        "-DBORINGSSL_NO_STATIC_INITIALIZER",
-        "-DCR_CLANG_REVISION=\"llvmorg-16-init-6578-g0d30e92f-2\"",
-        "-DCR_LIBCXX_REVISION=64d36e572d3f9719c5d75011a718f33f11126851",
-        "-DDYNAMIC_ANNOTATIONS_ENABLED=0",
-        "-DHAVE_SYS_UIO_H",
-        "-DNDEBUG",
-        "-DNO_UNWIND_TABLES",
-        "-DNVALGRIND",
-        "-DOFFICIAL_BUILD",
-        "-DOPENSSL_SMALL",
-        "-D_GNU_SOURCE",
-        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
-        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
-        "-Oz",
-        "-fdata-sections",
-        "-ffunction-sections",
-        "-fno-asynchronous-unwind-tables",
-        "-fno-unwind-tables",
-        "-fvisibility-inlines-hidden",
-        "-fvisibility=hidden",
-        "-g1",
-    ],
-    local_include_dirs: [
-        "./",
-        "buildtools/third_party/libc++/",
-        "buildtools/third_party/libc++/trunk/include",
-        "buildtools/third_party/libc++abi/trunk/include",
-        "third_party/boringssl/src/include/",
-    ],
-    cpp_std: "c++17",
-    ldflags: [
-        "-Wl,--as-needed",
-        "-Wl,--gc-sections",
-        "-Wl,--icf=all",
-    ],
-    target: {
-        android_arm: {
-            cflags: [
-                "-fstack-protector",
-            ],
-        },
-        android_arm64: {
-            cflags: [
-                "-fstack-protector",
-                "-mno-outline",
-                "-mno-outline-atomics",
-            ],
-        },
-        android_x86: {
-            cflags: [
-                "-msse3",
-            ],
-        },
-        android_x86_64: {
-            cflags: [
-                "-fstack-protector",
-                "-msse3",
-            ],
-        },
-    },
-}
-
 // GN: //third_party/boringssl:boringssl__testing
 cc_library_static {
     name: "cronet_aml_third_party_boringssl_boringssl__testing",
@@ -30810,145 +30477,6 @@
     },
 }
 
-// GN: //third_party/boringssl:boringssl_asm
-cc_library_static {
-    name: "cronet_aml_third_party_boringssl_boringssl_asm",
-    defaults: [
-        "cronet_aml_defaults",
-    ],
-    cflags: [
-        "-DANDROID",
-        "-DANDROID_NDK_VERSION_ROLL=r23_1",
-        "-DCR_CLANG_REVISION=\"llvmorg-16-init-6578-g0d30e92f-2\"",
-        "-DCR_LIBCXX_REVISION=64d36e572d3f9719c5d75011a718f33f11126851",
-        "-DDYNAMIC_ANNOTATIONS_ENABLED=0",
-        "-DHAVE_SYS_UIO_H",
-        "-DNDEBUG",
-        "-DNO_UNWIND_TABLES",
-        "-DNVALGRIND",
-        "-DOFFICIAL_BUILD",
-        "-D_FORTIFY_SOURCE=2",
-        "-D_GNU_SOURCE",
-        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
-        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
-        "-D__STDC_CONSTANT_MACROS",
-        "-D__STDC_FORMAT_MACROS",
-        "-Oz",
-        "-fdata-sections",
-        "-ffunction-sections",
-        "-fno-asynchronous-unwind-tables",
-        "-fno-unwind-tables",
-        "-fvisibility-inlines-hidden",
-        "-fvisibility=hidden",
-        "-g1",
-    ],
-    local_include_dirs: [
-        "./",
-        "buildtools/third_party/libc++/",
-        "buildtools/third_party/libc++/trunk/include",
-        "buildtools/third_party/libc++abi/trunk/include",
-        "third_party/boringssl/src/include/",
-    ],
-    cpp_std: "c++17",
-    ldflags: [
-        "-Wl,--as-needed",
-        "-Wl,--gc-sections",
-        "-Wl,--icf=all",
-    ],
-    target: {
-        android_arm: {
-            srcs: [
-                "third_party/boringssl/linux-arm/crypto/chacha/chacha-armv4.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/aesv8-armx32.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/armv4-mont.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/bsaes-armv7.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/ghash-armv4.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/ghashv8-armx32.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/sha1-armv4-large.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/sha256-armv4.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/sha512-armv4.S",
-                "third_party/boringssl/linux-arm/crypto/fipsmodule/vpaes-armv7.S",
-                "third_party/boringssl/linux-arm/crypto/test/trampoline-armv4.S",
-                "third_party/boringssl/src/crypto/curve25519/asm/x25519-asm-arm.S",
-                "third_party/boringssl/src/crypto/poly1305/poly1305_arm_asm.S",
-            ],
-            cflags: [
-                "-fstack-protector",
-            ],
-        },
-        android_arm64: {
-            srcs: [
-                "third_party/boringssl/linux-aarch64/crypto/chacha/chacha-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/aesv8-armx64.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/armv8-mont.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha1-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha256-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha512-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/fipsmodule/vpaes-armv8.S",
-                "third_party/boringssl/linux-aarch64/crypto/test/trampoline-armv8.S",
-            ],
-            cflags: [
-                "-fstack-protector",
-                "-mno-outline",
-                "-mno-outline-atomics",
-            ],
-        },
-        android_x86: {
-            srcs: [
-                "third_party/boringssl/linux-x86/crypto/chacha/chacha-x86.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/aesni-x86.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/bn-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/co-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/ghash-ssse3-x86.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/ghash-x86.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/md5-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/sha1-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/sha256-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/sha512-586.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/vpaes-x86.S",
-                "third_party/boringssl/linux-x86/crypto/fipsmodule/x86-mont.S",
-                "third_party/boringssl/linux-x86/crypto/test/trampoline-x86.S",
-            ],
-            cflags: [
-                "-msse3",
-            ],
-        },
-        android_x86_64: {
-            srcs: [
-                "third_party/boringssl/linux-x86_64/crypto/chacha/chacha-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/aesni-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/ghash-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/md5-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/rdrand-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/rsaz-avx2.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/sha1-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/sha256-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/sha512-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/vpaes-x86_64.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/x86_64-mont.S",
-                "third_party/boringssl/linux-x86_64/crypto/fipsmodule/x86_64-mont5.S",
-                "third_party/boringssl/linux-x86_64/crypto/test/trampoline-x86_64.S",
-                "third_party/boringssl/src/crypto/hrss/asm/poly_rq_mul.S",
-            ],
-            cflags: [
-                "-fstack-protector",
-                "-msse3",
-            ],
-        },
-    },
-}
-
 // GN: //third_party/boringssl:boringssl_asm__testing
 cc_library_static {
     name: "cronet_aml_third_party_boringssl_boringssl_asm__testing",
@@ -34787,6 +34315,8 @@
         "url/url_util.cc",
     ],
     shared_libs: [
+        "//external/cronet/third_party/boringssl:libcrypto",
+        "//external/cronet/third_party/boringssl:libssl",
         "libandroid",
         "liblog",
     ],
@@ -34846,8 +34376,6 @@
         "cronet_aml_third_party_abseil_cpp_absl_types_bad_variant_access",
         "cronet_aml_third_party_android_ndk_cpu_features",
         "cronet_aml_third_party_ashmem_ashmem",
-        "cronet_aml_third_party_boringssl_boringssl",
-        "cronet_aml_third_party_boringssl_boringssl_asm",
         "cronet_aml_third_party_icu_icui18n",
         "cronet_aml_third_party_icu_icuuc_private",
         "cronet_aml_third_party_libevent_libevent",
@@ -35227,51 +34755,3 @@
     ],
 }
 
-// GN: LICENSE
-license {
-    name: "external_cronet_license",
-    license_kinds: [
-        "SPDX-license-identifier-AFL-2.0",
-        "SPDX-license-identifier-Apache-2.0",
-        "SPDX-license-identifier-BSD",
-        "SPDX-license-identifier-BSL-1.0",
-        "SPDX-license-identifier-ICU",
-        "SPDX-license-identifier-ISC",
-        "SPDX-license-identifier-MIT",
-        "SPDX-license-identifier-MPL",
-        "SPDX-license-identifier-MPL-1.1",
-        "SPDX-license-identifier-MPL-2.0",
-        "SPDX-license-identifier-NCSA",
-        "SPDX-license-identifier-OpenSSL",
-        "SPDX-license-identifier-Unicode-DFS",
-        "legacy_unencumbered",
-    ],
-    license_text: [
-        "LICENSE",
-        "base/third_party/double_conversion/LICENSE",
-        "base/third_party/dynamic_annotations/LICENSE",
-        "base/third_party/icu/LICENSE",
-        "base/third_party/nspr/LICENSE",
-        "base/third_party/superfasthash/LICENSE",
-        "base/third_party/symbolize/LICENSE",
-        "base/third_party/valgrind/LICENSE",
-        "base/third_party/xdg_user_dirs/LICENSE",
-        "net/third_party/quiche/src/LICENSE",
-        "net/third_party/uri_template/LICENSE",
-        "third_party/abseil-cpp/LICENSE",
-        "third_party/ashmem/LICENSE",
-        "third_party/boringssl/src/LICENSE",
-        "third_party/boringssl/src/third_party/fiat/LICENSE",
-        "third_party/boringssl/src/third_party/googletest/LICENSE",
-        "third_party/boringssl/src/third_party/wycheproof_testvectors/LICENSE",
-        "third_party/brotli/LICENSE",
-        "third_party/icu/LICENSE",
-        "third_party/icu/scripts/LICENSE",
-        "third_party/libevent/LICENSE",
-        "third_party/metrics_proto/LICENSE",
-        "third_party/modp_b64/LICENSE",
-        "third_party/protobuf/LICENSE",
-        "third_party/protobuf/third_party/utf8_range/LICENSE",
-    ],
-}
-
diff --git a/tools/gn2bp/desc_arm.json b/tools/gn2bp/desc_arm.json
index 87b86e3..6b581a7 100644
--- a/tools/gn2bp/desc_arm.json
+++ b/tools/gn2bp/desc_arm.json
Binary files differ
diff --git a/tools/gn2bp/desc_arm64.json b/tools/gn2bp/desc_arm64.json
index 7b8bfe3..84f7609 100644
--- a/tools/gn2bp/desc_arm64.json
+++ b/tools/gn2bp/desc_arm64.json
Binary files differ
diff --git a/tools/gn2bp/desc_x64.json b/tools/gn2bp/desc_x64.json
index df8635a..fee670a 100644
--- a/tools/gn2bp/desc_x64.json
+++ b/tools/gn2bp/desc_x64.json
Binary files differ
diff --git a/tools/gn2bp/desc_x86.json b/tools/gn2bp/desc_x86.json
index 707b9c7..35c1ca3 100644
--- a/tools/gn2bp/desc_x86.json
+++ b/tools/gn2bp/desc_x86.json
Binary files differ
diff --git a/tools/gn2bp/gen_android_bp b/tools/gn2bp/gen_android_bp
index d714a90..b48a05b 100755
--- a/tools/gn2bp/gen_android_bp
+++ b/tools/gn2bp/gen_android_bp
@@ -39,6 +39,8 @@
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
+CRONET_LICENSE_NAME = "external_cronet_license"
+
 # Default targets to translate to the blueprint file.
 DEFAULT_TARGETS = [
     '//components/cronet/android:cronet',
@@ -188,6 +190,9 @@
     ],
 }
 
+def always_disable(module, arch):
+  return None
+
 def enable_brotli(module, arch):
   # Requires crrev/c/4111690
   if arch is None:
@@ -213,25 +218,40 @@
   else:
     module.arch[arch].shared_libs.add('libz')
 
+def enable_boringssl(module, arch):
+  if arch is None:
+    shared_libs = module.shared_libs
+  else:
+    shared_libs = module.arch[arch].shared_libs
+  shared_libs.add('//external/cronet/third_party/boringssl:libcrypto')
+  shared_libs.add('//external/cronet/third_party/boringssl:libssl')
+
 # Android equivalents for third-party libraries that the upstream project
 # depends on.
 builtin_deps = {
     '//buildtools/third_party/libunwind:libunwind':
-        lambda m, a: None, # disable libunwind
+        always_disable,
     '//buildtools/third_party/libunwind:libunwind__testing':
-        lambda m, a: None, # disable libunwind
+        always_disable,
     '//net/data/ssl/chrome_root_store:gen_root_store_inc':
-        lambda m, a: None,
+        always_disable,
     '//net/data/ssl/chrome_root_store:gen_root_store_inc__testing':
-        lambda m, a: None,
+        always_disable,
     '//net/tools/root_store_tool:root_store_tool':
-        lambda m, a: None,
+        always_disable,
     '//net/tools/root_store_tool:root_store_tool__testing':
-        lambda m, a: None,
+        always_disable,
     '//third_party/zlib:zlib':
         enable_zlib,
     '//third_party/zlib:zlib__testing':
         enable_zlib,
+    '//third_party/boringssl:boringssl':
+        enable_boringssl,
+    '//third_party/boringssl:boringssl_asm':
+        # Due to FIPS requirements, downstream BoringSSL has a different "shape" than upstream's.
+        # We're guaranteed that if X depends on :boringssl it will also depend on :boringssl_asm.
+        # Hence, always drop :boringssl_asm and handle the translation entirely in :boringssl.
+        always_disable,
 }
 
 experimental_android_deps = {
@@ -1764,54 +1784,10 @@
 
   return blueprint
 
-def create_license_module(blueprint):
-  module = Module("license", "external_cronet_license", "LICENSE")
-  module.license_kinds.update({
-      'SPDX-license-identifier-MPL',
-      'SPDX-license-identifier-MPL-1.1',
-      'SPDX-license-identifier-ISC',
-      'SPDX-license-identifier-AFL-2.0',
-      'SPDX-license-identifier-MPL-2.0',
-      'SPDX-license-identifier-BSD',
-      'SPDX-license-identifier-Apache-2.0',
-      'SPDX-license-identifier-BSL-1.0',
-      'SPDX-license-identifier-Unicode-DFS',
-      'SPDX-license-identifier-NCSA',
-      'SPDX-license-identifier-OpenSSL',
-      'SPDX-license-identifier-MIT',
-      "SPDX-license-identifier-ICU",
-      'legacy_unencumbered',
-  })
-  module.license_text.update({
-      "LICENSE",
-      "net/third_party/uri_template/LICENSE",
-      "net/third_party/quiche/src/LICENSE",
-      "base/third_party/symbolize/LICENSE",
-      "base/third_party/superfasthash/LICENSE",
-      "base/third_party/xdg_user_dirs/LICENSE",
-      "base/third_party/double_conversion/LICENSE",
-      "base/third_party/nspr/LICENSE",
-      "base/third_party/dynamic_annotations/LICENSE",
-      "base/third_party/icu/LICENSE",
-      "base/third_party/valgrind/LICENSE",
-      "third_party/brotli/LICENSE",
-      "third_party/protobuf/LICENSE",
-      "third_party/protobuf/third_party/utf8_range/LICENSE",
-      "third_party/metrics_proto/LICENSE",
-      "third_party/boringssl/src/LICENSE",
-      "third_party/boringssl/src/third_party/googletest/LICENSE",
-      "third_party/boringssl/src/third_party/wycheproof_testvectors/LICENSE",
-      "third_party/boringssl/src/third_party/fiat/LICENSE",
-      "third_party/libevent/LICENSE",
-      "third_party/ashmem/LICENSE",
-      "third_party/icu/LICENSE",
-      "third_party/icu/scripts/LICENSE",
-      "third_party/abseil-cpp/LICENSE",
-      "third_party/modp_b64/LICENSE",
-  })
+def create_default_license_module(blueprint):
   default_license = Module("package", "", "PACKAGE")
-  default_license.default_applicable_licenses.add(module.name)
-  blueprint.add_module(module)
+  default_license.comment = "The actual license can be found in Android.extras.bp"
+  default_license.default_applicable_licenses.add(CRONET_LICENSE_NAME)
   blueprint.add_module(default_license)
 
 def main():
@@ -1866,7 +1842,7 @@
   # Add any proto groups to the blueprint.
   for l_name, t_names in proto_groups.items():
     create_proto_group_modules(blueprint, gn, l_name, t_names)
-  create_license_module(blueprint)
+  create_default_license_module(blueprint)
   output = [
       """// Copyright (C) 2022 The Android Open Source Project
 //