Support add/remove IPv6 multicast group sock opt

IPv4 was always supported but UDP never supported joining/leaving IPv6
multicast groups via socket options.

Add: IPPROTO_IPV6, IPV6_JOIN_GROUP/IPV6_ADD_MEMBERSHIP
Remove: IPPROTO_IPV6, IPV6_LEAVE_GROUP/IPV6_DROP_MEMBERSHIP

Test: integration_test.TestUDPAddRemoveMembershipSocketOption
PiperOrigin-RevId: 350396072

15 files changed, 708 insertions, 232 deletions

diff --git a/pkg/abi/linux/socket.go b/pkg/abi/linux/socket.go
index 556892dc3..8591acbf2 100644
--- a/pkg/abi/linux/socket.go
+++ b/pkg/abi/linux/socket.go
@@ -250,6 +250,12 @@ type SockAddrInet struct {
 	_      [8]uint8 // pad to sizeof(struct sockaddr).
 }
 
+// Inet6MulticastRequest is struct ipv6_mreq, from uapi/linux/in6.h.
+type Inet6MulticastRequest struct {
+	MulticastAddr  Inet6Addr
+	InterfaceIndex int32
+}
+
 // InetMulticastRequest is struct ip_mreq, from uapi/linux/in.h.
 type InetMulticastRequest struct {
 	MulticastAddr InetAddr
diff --git a/pkg/sentry/socket/netstack/netstack.go b/pkg/sentry/socket/netstack/netstack.go
index 3f587638f..fe11fca9c 100644
--- a/pkg/sentry/socket/netstack/netstack.go
+++ b/pkg/sentry/socket/netstack/netstack.go
@@ -2091,9 +2091,29 @@ func setSockOptIPv6(t *kernel.Task, s socket.SocketOps, ep commonEndpoint, name
 		ep.SocketOptions().SetV6Only(v != 0)
 		return nil
 
-	case linux.IPV6_ADD_MEMBERSHIP,
-		linux.IPV6_DROP_MEMBERSHIP,
-		linux.IPV6_IPSEC_POLICY,
+	case linux.IPV6_ADD_MEMBERSHIP:
+		req, err := copyInMulticastV6Request(optVal)
+		if err != nil {
+			return err
+		}
+
+		return syserr.TranslateNetstackError(ep.SetSockOpt(&tcpip.AddMembershipOption{
+			NIC:           tcpip.NICID(req.InterfaceIndex),
+			MulticastAddr: tcpip.Address(req.MulticastAddr[:]),
+		}))
+
+	case linux.IPV6_DROP_MEMBERSHIP:
+		req, err := copyInMulticastV6Request(optVal)
+		if err != nil {
+			return err
+		}
+
+		return syserr.TranslateNetstackError(ep.SetSockOpt(&tcpip.RemoveMembershipOption{
+			NIC:           tcpip.NICID(req.InterfaceIndex),
+			MulticastAddr: tcpip.Address(req.MulticastAddr[:]),
+		}))
+
+	case linux.IPV6_IPSEC_POLICY,
 		linux.IPV6_JOIN_ANYCAST,
 		linux.IPV6_LEAVE_ANYCAST,
 		// TODO(b/148887420): Add support for IPV6_PKTINFO.
@@ -2181,6 +2201,7 @@ func setSockOptIPv6(t *kernel.Task, s socket.SocketOps, ep commonEndpoint, name
 var (
 	inetMulticastRequestSize        = int(binary.Size(linux.InetMulticastRequest{}))
 	inetMulticastRequestWithNICSize = int(binary.Size(linux.InetMulticastRequestWithNIC{}))
+	inet6MulticastRequestSize       = int(binary.Size(linux.Inet6MulticastRequest{}))
 )
 
 // copyInMulticastRequest copies in a variable-size multicast request. The
@@ -2214,6 +2235,16 @@ func copyInMulticastRequest(optVal []byte, allowAddr bool) (linux.InetMulticastR
 	return req, nil
 }
 
+func copyInMulticastV6Request(optVal []byte) (linux.Inet6MulticastRequest, *syserr.Error) {
+	if len(optVal) < inet6MulticastRequestSize {
+		return linux.Inet6MulticastRequest{}, syserr.ErrInvalidArgument
+	}
+
+	var req linux.Inet6MulticastRequest
+	binary.Unmarshal(optVal[:inet6MulticastRequestSize], usermem.ByteOrder, &req)
+	return req, nil
+}
+
 // parseIntOrChar copies either a 32-bit int or an 8-bit uint out of buf.
 //
 // net/ipv4/ip_sockglue.c:do_ip_setsockopt does this for its socket options.
diff --git a/pkg/tcpip/tests/integration/multicast_broadcast_test.go b/pkg/tcpip/tests/integration/multicast_broadcast_test.go
index 2e59f6a42..20f8a7e6c 100644
--- a/pkg/tcpip/tests/integration/multicast_broadcast_test.go
+++ b/pkg/tcpip/tests/integration/multicast_broadcast_test.go
@@ -35,6 +35,9 @@ import (
 const (
 	defaultMTU = 1280
 	ttl        = 255
+
+	remotePort = 5555
+	localPort  = 80
 )
 
 var (
@@ -151,11 +154,11 @@ func TestPingMulticastBroadcast(t *testing.T) {
 			}
 			ipv4ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv4ProtocolNumber, AddressWithPrefix: ipv4Addr}
 			if err := s.AddProtocolAddress(nicID, ipv4ProtoAddr); err != nil {
-				t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv4ProtoAddr, err)
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", nicID, ipv4ProtoAddr, err)
 			}
 			ipv6ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv6ProtocolNumber, AddressWithPrefix: ipv6Addr}
 			if err := s.AddProtocolAddress(nicID, ipv6ProtoAddr); err != nil {
-				t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv6ProtoAddr, err)
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", nicID, ipv6ProtoAddr, err)
 			}
 
 			// Default routes for IPv4 and IPv6 so ICMP can find a route to the remote
@@ -215,163 +218,219 @@ func TestPingMulticastBroadcast(t *testing.T) {
 
 }
 
+func rxIPv4UDP(e *channel.Endpoint, src, dst tcpip.Address, data []byte) {
+	payloadLen := header.UDPMinimumSize + len(data)
+	totalLen := header.IPv4MinimumSize + payloadLen
+	hdr := buffer.NewPrependable(totalLen)
+	u := header.UDP(hdr.Prepend(payloadLen))
+	u.Encode(&header.UDPFields{
+		SrcPort: remotePort,
+		DstPort: localPort,
+		Length:  uint16(payloadLen),
+	})
+	copy(u.Payload(), data)
+	sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, src, dst, uint16(payloadLen))
+	sum = header.Checksum(data, sum)
+	u.SetChecksum(^u.CalculateChecksum(sum))
+
+	ip := header.IPv4(hdr.Prepend(header.IPv4MinimumSize))
+	ip.Encode(&header.IPv4Fields{
+		TotalLength: uint16(totalLen),
+		Protocol:    uint8(udp.ProtocolNumber),
+		TTL:         ttl,
+		SrcAddr:     src,
+		DstAddr:     dst,
+	})
+	ip.SetChecksum(^ip.CalculateChecksum())
+
+	e.InjectInbound(header.IPv4ProtocolNumber, stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Data: hdr.View().ToVectorisedView(),
+	}))
+}
+
+func rxIPv6UDP(e *channel.Endpoint, src, dst tcpip.Address, data []byte) {
+	payloadLen := header.UDPMinimumSize + len(data)
+	hdr := buffer.NewPrependable(header.IPv6MinimumSize + payloadLen)
+	u := header.UDP(hdr.Prepend(payloadLen))
+	u.Encode(&header.UDPFields{
+		SrcPort: remotePort,
+		DstPort: localPort,
+		Length:  uint16(payloadLen),
+	})
+	copy(u.Payload(), data)
+	sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, src, dst, uint16(payloadLen))
+	sum = header.Checksum(data, sum)
+	u.SetChecksum(^u.CalculateChecksum(sum))
+
+	ip := header.IPv6(hdr.Prepend(header.IPv6MinimumSize))
+	ip.Encode(&header.IPv6Fields{
+		PayloadLength:     uint16(payloadLen),
+		TransportProtocol: udp.ProtocolNumber,
+		HopLimit:          ttl,
+		SrcAddr:           src,
+		DstAddr:           dst,
+	})
+
+	e.InjectInbound(header.IPv6ProtocolNumber, stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Data: hdr.View().ToVectorisedView(),
+	}))
+}
+
 // TestIncomingMulticastAndBroadcast tests receiving a packet destined to some
 // multicast or broadcast address.
 func TestIncomingMulticastAndBroadcast(t *testing.T) {
-	const (
-		nicID      = 1
-		remotePort = 5555
-		localPort  = 80
-	)
+	const nicID = 1
 
 	data := []byte{1, 2, 3, 4}
 
-	rxIPv4UDP := func(e *channel.Endpoint, dst tcpip.Address) {
-		payloadLen := header.UDPMinimumSize + len(data)
-		totalLen := header.IPv4MinimumSize + payloadLen
-		hdr := buffer.NewPrependable(totalLen)
-		u := header.UDP(hdr.Prepend(payloadLen))
-		u.Encode(&header.UDPFields{
-			SrcPort: remotePort,
-			DstPort: localPort,
-			Length:  uint16(payloadLen),
-		})
-		copy(u.Payload(), data)
-		sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, remoteIPv4Addr, dst, uint16(payloadLen))
-		sum = header.Checksum(data, sum)
-		u.SetChecksum(^u.CalculateChecksum(sum))
-
-		ip := header.IPv4(hdr.Prepend(header.IPv4MinimumSize))
-		ip.Encode(&header.IPv4Fields{
-			TotalLength: uint16(totalLen),
-			Protocol:    uint8(udp.ProtocolNumber),
-			TTL:         ttl,
-			SrcAddr:     remoteIPv4Addr,
-			DstAddr:     dst,
-		})
-		ip.SetChecksum(^ip.CalculateChecksum())
-
-		e.InjectInbound(header.IPv4ProtocolNumber, stack.NewPacketBuffer(stack.PacketBufferOptions{
-			Data: hdr.View().ToVectorisedView(),
-		}))
-	}
-
-	rxIPv6UDP := func(e *channel.Endpoint, dst tcpip.Address) {
-		payloadLen := header.UDPMinimumSize + len(data)
-		hdr := buffer.NewPrependable(header.IPv6MinimumSize + payloadLen)
-		u := header.UDP(hdr.Prepend(payloadLen))
-		u.Encode(&header.UDPFields{
-			SrcPort: remotePort,
-			DstPort: localPort,
-			Length:  uint16(payloadLen),
-		})
-		copy(u.Payload(), data)
-		sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, remoteIPv6Addr, dst, uint16(payloadLen))
-		sum = header.Checksum(data, sum)
-		u.SetChecksum(^u.CalculateChecksum(sum))
-
-		ip := header.IPv6(hdr.Prepend(header.IPv6MinimumSize))
-		ip.Encode(&header.IPv6Fields{
-			PayloadLength:     uint16(payloadLen),
-			TransportProtocol: udp.ProtocolNumber,
-			HopLimit:          ttl,
-			SrcAddr:           remoteIPv6Addr,
-			DstAddr:           dst,
-		})
-
-		e.InjectInbound(header.IPv6ProtocolNumber, stack.NewPacketBuffer(stack.PacketBufferOptions{
-			Data: hdr.View().ToVectorisedView(),
-		}))
-	}
-
 	tests := []struct {
-		name     string
-		bindAddr tcpip.Address
-		dstAddr  tcpip.Address
-		expectRx bool
+		name       string
+		proto      tcpip.NetworkProtocolNumber
+		remoteAddr tcpip.Address
+		localAddr  tcpip.AddressWithPrefix
+		rxUDP      func(*channel.Endpoint, tcpip.Address, tcpip.Address, []byte)
+		bindAddr   tcpip.Address
+		dstAddr    tcpip.Address
+		expectRx   bool
 	}{
 		{
-			name:     "IPv4 unicast binding to unicast",
-			bindAddr: ipv4Addr.Address,
-			dstAddr:  ipv4Addr.Address,
-			expectRx: true,
+			name:       "IPv4 unicast binding to unicast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   ipv4Addr.Address,
+			dstAddr:    ipv4Addr.Address,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv4 unicast binding to broadcast",
-			bindAddr: header.IPv4Broadcast,
-			dstAddr:  ipv4Addr.Address,
-			expectRx: false,
+			name:       "IPv4 unicast binding to broadcast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   header.IPv4Broadcast,
+			dstAddr:    ipv4Addr.Address,
+			expectRx:   false,
 		},
 		{
-			name:     "IPv4 unicast binding to wildcard",
-			dstAddr:  ipv4Addr.Address,
-			expectRx: true,
+			name:       "IPv4 unicast binding to wildcard",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			dstAddr:    ipv4Addr.Address,
+			expectRx:   true,
 		},
 
 		{
-			name:     "IPv4 directed broadcast binding to subnet broadcast",
-			bindAddr: ipv4SubnetBcast,
-			dstAddr:  ipv4SubnetBcast,
-			expectRx: true,
+			name:       "IPv4 directed broadcast binding to subnet broadcast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   ipv4SubnetBcast,
+			dstAddr:    ipv4SubnetBcast,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv4 directed broadcast binding to broadcast",
-			bindAddr: header.IPv4Broadcast,
-			dstAddr:  ipv4SubnetBcast,
-			expectRx: false,
+			name:       "IPv4 directed broadcast binding to broadcast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   header.IPv4Broadcast,
+			dstAddr:    ipv4SubnetBcast,
+			expectRx:   false,
 		},
 		{
-			name:     "IPv4 directed broadcast binding to wildcard",
-			dstAddr:  ipv4SubnetBcast,
-			expectRx: true,
+			name:       "IPv4 directed broadcast binding to wildcard",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			dstAddr:    ipv4SubnetBcast,
+			expectRx:   true,
 		},
 
 		{
-			name:     "IPv4 broadcast binding to broadcast",
-			bindAddr: header.IPv4Broadcast,
-			dstAddr:  header.IPv4Broadcast,
-			expectRx: true,
+			name:       "IPv4 broadcast binding to broadcast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   header.IPv4Broadcast,
+			dstAddr:    header.IPv4Broadcast,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv4 broadcast binding to subnet broadcast",
-			bindAddr: ipv4SubnetBcast,
-			dstAddr:  header.IPv4Broadcast,
-			expectRx: false,
+			name:       "IPv4 broadcast binding to subnet broadcast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   ipv4SubnetBcast,
+			dstAddr:    header.IPv4Broadcast,
+			expectRx:   false,
 		},
 		{
-			name:     "IPv4 broadcast binding to wildcard",
-			dstAddr:  ipv4SubnetBcast,
-			expectRx: true,
+			name:       "IPv4 broadcast binding to wildcard",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			dstAddr:    ipv4SubnetBcast,
+			expectRx:   true,
 		},
 
 		{
-			name:     "IPv4 all-systems multicast binding to all-systems multicast",
-			bindAddr: header.IPv4AllSystems,
-			dstAddr:  header.IPv4AllSystems,
-			expectRx: true,
+			name:       "IPv4 all-systems multicast binding to all-systems multicast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   header.IPv4AllSystems,
+			dstAddr:    header.IPv4AllSystems,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv4 all-systems multicast binding to wildcard",
-			dstAddr:  header.IPv4AllSystems,
-			expectRx: true,
+			name:       "IPv4 all-systems multicast binding to wildcard",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			dstAddr:    header.IPv4AllSystems,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv4 all-systems multicast binding to unicast",
-			bindAddr: ipv4Addr.Address,
-			dstAddr:  header.IPv4AllSystems,
-			expectRx: false,
+			name:       "IPv4 all-systems multicast binding to unicast",
+			proto:      header.IPv4ProtocolNumber,
+			remoteAddr: remoteIPv4Addr,
+			localAddr:  ipv4Addr,
+			rxUDP:      rxIPv4UDP,
+			bindAddr:   ipv4Addr.Address,
+			dstAddr:    header.IPv4AllSystems,
+			expectRx:   false,
 		},
 
 		// IPv6 has no notion of a broadcast.
 		{
-			name:     "IPv6 unicast binding to wildcard",
-			dstAddr:  ipv6Addr.Address,
-			expectRx: true,
+			name:       "IPv6 unicast binding to wildcard",
+			dstAddr:    ipv6Addr.Address,
+			proto:      header.IPv6ProtocolNumber,
+			remoteAddr: remoteIPv6Addr,
+			localAddr:  ipv6Addr,
+			rxUDP:      rxIPv6UDP,
+			expectRx:   true,
 		},
 		{
-			name:     "IPv6 broadcast-like address binding to wildcard",
-			dstAddr:  ipv6SubnetBcast,
-			expectRx: false,
+			name:       "IPv6 broadcast-like address binding to wildcard",
+			dstAddr:    ipv6SubnetBcast,
+			proto:      header.IPv6ProtocolNumber,
+			remoteAddr: remoteIPv6Addr,
+			localAddr:  ipv6Addr,
+			rxUDP:      rxIPv6UDP,
+			expectRx:   false,
 		},
 	}
 
@@ -385,41 +444,24 @@ func TestIncomingMulticastAndBroadcast(t *testing.T) {
 			if err := s.CreateNIC(nicID, e); err != nil {
 				t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
 			}
-			ipv4ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv4ProtocolNumber, AddressWithPrefix: ipv4Addr}
-			if err := s.AddProtocolAddress(nicID, ipv4ProtoAddr); err != nil {
-				t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv4ProtoAddr, err)
-			}
-			ipv6ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv6ProtocolNumber, AddressWithPrefix: ipv6Addr}
-			if err := s.AddProtocolAddress(nicID, ipv6ProtoAddr); err != nil {
-				t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv6ProtoAddr, err)
-			}
-
-			var netproto tcpip.NetworkProtocolNumber
-			var rxUDP func(*channel.Endpoint, tcpip.Address)
-			switch l := len(test.dstAddr); l {
-			case header.IPv4AddressSize:
-				netproto = header.IPv4ProtocolNumber
-				rxUDP = rxIPv4UDP
-			case header.IPv6AddressSize:
-				netproto = header.IPv6ProtocolNumber
-				rxUDP = rxIPv6UDP
-			default:
-				t.Fatalf("got unexpected address length = %d bytes", l)
+			protoAddr := tcpip.ProtocolAddress{Protocol: test.proto, AddressWithPrefix: test.localAddr}
+			if err := s.AddProtocolAddress(nicID, protoAddr); err != nil {
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", nicID, protoAddr, err)
 			}
 
 			var wq waiter.Queue
-			ep, err := s.NewEndpoint(udp.ProtocolNumber, netproto, &wq)
+			ep, err := s.NewEndpoint(udp.ProtocolNumber, test.proto, &wq)
 			if err != nil {
-				t.Fatalf("NewEndpoint(%d, %d, _): %s", udp.ProtocolNumber, netproto, err)
+				t.Fatalf("NewEndpoint(%d, %d, _): %s", udp.ProtocolNumber, test.proto, err)
 			}
 			defer ep.Close()
 
 			bindAddr := tcpip.FullAddress{Addr: test.bindAddr, Port: localPort}
 			if err := ep.Bind(bindAddr); err != nil {
-				t.Fatalf("ep.Bind(%+v): %s", bindAddr, err)
+				t.Fatalf("ep.Bind(%#v): %s", bindAddr, err)
 			}
 
-			rxUDP(e, test.dstAddr)
+			test.rxUDP(e, test.remoteAddr, test.dstAddr, data)
 			if gotPayload, _, err := ep.Read(nil); test.expectRx {
 				if err != nil {
 					t.Fatalf("Read(nil): %s", err)
@@ -476,7 +518,7 @@ func TestReuseAddrAndBroadcast(t *testing.T) {
 				},
 			}
 			if err := s.AddProtocolAddress(nicID, protoAddr); err != nil {
-				t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, protoAddr, err)
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", nicID, protoAddr, err)
 			}
 
 			s.SetRouteTable([]tcpip.Route{
@@ -516,12 +558,12 @@ func TestReuseAddrAndBroadcast(t *testing.T) {
 					bindAddr := tcpip.FullAddress{Port: localPort}
 					if bindWildcard {
 						if err := ep.Bind(bindAddr); err != nil {
-							t.Fatalf("eps[%d].Bind(%+v): %s", len(eps), bindAddr, err)
+							t.Fatalf("eps[%d].Bind(%#v): %s", len(eps), bindAddr, err)
 						}
 					} else {
 						bindAddr.Addr = test.broadcastAddr
 						if err := ep.Bind(bindAddr); err != nil {
-							t.Fatalf("eps[%d].Bind(%+v): %s", len(eps), bindAddr, err)
+							t.Fatalf("eps[%d].Bind(%#v): %s", len(eps), bindAddr, err)
 						}
 					}
 
@@ -557,3 +599,143 @@ func TestReuseAddrAndBroadcast(t *testing.T) {
 		})
 	}
 }
+
+func TestUDPAddRemoveMembershipSocketOption(t *testing.T) {
+	const (
+		nicID = 1
+	)
+
+	data := []byte{1, 2, 3, 4}
+
+	tests := []struct {
+		name          string
+		proto         tcpip.NetworkProtocolNumber
+		remoteAddr    tcpip.Address
+		localAddr     tcpip.AddressWithPrefix
+		rxUDP         func(*channel.Endpoint, tcpip.Address, tcpip.Address, []byte)
+		multicastAddr tcpip.Address
+	}{
+		{
+			name:          "IPv4 unicast binding to unicast",
+			multicastAddr: "\xe0\x01\x02\x03",
+			proto:         header.IPv4ProtocolNumber,
+			remoteAddr:    remoteIPv4Addr,
+			localAddr:     ipv4Addr,
+			rxUDP:         rxIPv4UDP,
+		},
+		{
+			name:          "IPv6 broadcast-like address binding to wildcard",
+			multicastAddr: "\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04",
+			proto:         header.IPv6ProtocolNumber,
+			remoteAddr:    remoteIPv6Addr,
+			localAddr:     ipv6Addr,
+			rxUDP:         rxIPv6UDP,
+		},
+	}
+
+	subTests := []struct {
+		name           string
+		specifyNICID   bool
+		specifyNICAddr bool
+	}{
+		{
+			name:           "Specify NIC ID and NIC address",
+			specifyNICID:   true,
+			specifyNICAddr: true,
+		},
+		{
+			name:           "Don't specify NIC ID or NIC address",
+			specifyNICID:   false,
+			specifyNICAddr: false,
+		},
+		{
+			name:           "Specify NIC ID but don't specify NIC address",
+			specifyNICID:   true,
+			specifyNICAddr: false,
+		},
+		{
+			name:           "Don't specify NIC ID but specify NIC address",
+			specifyNICID:   false,
+			specifyNICAddr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			for _, subTest := range subTests {
+				t.Run(subTest.name, func(t *testing.T) {
+					s := stack.New(stack.Options{
+						NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
+						TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
+					})
+					e := channel.New(0, defaultMTU, "")
+					if err := s.CreateNIC(nicID, e); err != nil {
+						t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
+					}
+					protoAddr := tcpip.ProtocolAddress{Protocol: test.proto, AddressWithPrefix: test.localAddr}
+					if err := s.AddProtocolAddress(nicID, protoAddr); err != nil {
+						t.Fatalf("AddProtocolAddress(%d, %#v): %s", nicID, protoAddr, err)
+					}
+
+					// Set the route table so that UDP can find a NIC that is
+					// routable to the multicast address when the NIC isn't specified.
+					if !subTest.specifyNICID && !subTest.specifyNICAddr {
+						s.SetRouteTable([]tcpip.Route{
+							tcpip.Route{
+								Destination: header.IPv6EmptySubnet,
+								NIC:         nicID,
+							},
+							tcpip.Route{
+								Destination: header.IPv4EmptySubnet,
+								NIC:         nicID,
+							},
+						})
+					}
+
+					var wq waiter.Queue
+					ep, err := s.NewEndpoint(udp.ProtocolNumber, test.proto, &wq)
+					if err != nil {
+						t.Fatalf("NewEndpoint(%d, %d, _): %s", udp.ProtocolNumber, test.proto, err)
+					}
+					defer ep.Close()
+
+					bindAddr := tcpip.FullAddress{Port: localPort}
+					if err := ep.Bind(bindAddr); err != nil {
+						t.Fatalf("ep.Bind(%#v): %s", bindAddr, err)
+					}
+
+					memOpt := tcpip.MembershipOption{MulticastAddr: test.multicastAddr}
+					if subTest.specifyNICID {
+						memOpt.NIC = nicID
+					}
+					if subTest.specifyNICAddr {
+						memOpt.InterfaceAddr = test.localAddr.Address
+					}
+
+					// We should receive UDP packets to the group once we join the
+					// multicast group.
+					addOpt := tcpip.AddMembershipOption(memOpt)
+					if err := ep.SetSockOpt(&addOpt); err != nil {
+						t.Fatalf("ep.SetSockOpt(&%#v): %s", addOpt, err)
+					}
+					test.rxUDP(e, test.remoteAddr, test.multicastAddr, data)
+					if gotPayload, _, err := ep.Read(nil); err != nil {
+						t.Fatalf("ep.Read(nil): %s", err)
+					} else if diff := cmp.Diff(buffer.View(data), gotPayload); diff != "" {
+						t.Errorf("got UDP payload mismatch (-want +got):\n%s", diff)
+					}
+
+					// We should not receive UDP packets to the group once we leave
+					// the multicast group.
+					removeOpt := tcpip.RemoveMembershipOption(memOpt)
+					if err := ep.SetSockOpt(&removeOpt); err != nil {
+						t.Fatalf("ep.SetSockOpt(&%#v): %s", removeOpt, err)
+					}
+					if gotPayload, _, err := ep.Read(nil); err != tcpip.ErrWouldBlock {
+						t.Fatalf("got ep.Read(nil) = (%x, _, %s), want = (nil, _, %s)", gotPayload, err, tcpip.ErrWouldBlock)
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 9b9e4deb0..4e8bd8b04 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -708,14 +708,9 @@ func (e *endpoint) SetSockOpt(opt tcpip.SettableSocketOption) *tcpip.Error {
 
 		nicID := v.NIC
 
-		// The interface address is considered not-set if it is empty or contains
-		// all-zeros. The former represent the zero-value in golang, the latter the
-		// same in a setsockopt(IP_ADD_MEMBERSHIP, &ip_mreqn) syscall.
-		allZeros := header.IPv4Any
-		if len(v.InterfaceAddr) == 0 || v.InterfaceAddr == allZeros {
+		if v.InterfaceAddr.Unspecified() {
 			if nicID == 0 {
-				r, err := e.stack.FindRoute(0, "", v.MulticastAddr, header.IPv4ProtocolNumber, false /* multicastLoop */)
-				if err == nil {
+				if r, err := e.stack.FindRoute(0, "", v.MulticastAddr, e.NetProto, false /* multicastLoop */); err == nil {
 					nicID = r.NICID()
 					r.Release()
 				}
@@ -748,10 +743,9 @@ func (e *endpoint) SetSockOpt(opt tcpip.SettableSocketOption) *tcpip.Error {
 		}
 
 		nicID := v.NIC
-		if v.InterfaceAddr == header.IPv4Any {
+		if v.InterfaceAddr.Unspecified() {
 			if nicID == 0 {
-				r, err := e.stack.FindRoute(0, "", v.MulticastAddr, header.IPv4ProtocolNumber, false /* multicastLoop */)
-				if err == nil {
+				if r, err := e.stack.FindRoute(0, "", v.MulticastAddr, e.NetProto, false /* multicastLoop */); err == nil {
 					nicID = r.NICID()
 					r.Release()
 				}
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index a5b9233f7..7fe7db5cb 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -683,6 +683,11 @@ syscall_test(
 
 syscall_test(
     size = "medium",
+    test = "//test/syscalls/linux:socket_ipv6_udp_unbound_loopback_test",
+)
+
+syscall_test(
+    size = "medium",
     add_hostinet = True,
     shard_count = more_shards,
     # Takes too long under gotsan to run.
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index 4e0c8a574..017f997de 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -20,6 +20,7 @@ exports_files(
         "socket_ip_udp_loopback_nonblock.cc",
         "socket_ip_unbound.cc",
         "socket_ipv4_udp_unbound_external_networking_test.cc",
+        "socket_ipv6_udp_unbound_external_networking_test.cc",
         "socket_ipv4_udp_unbound_loopback.cc",
         "socket_ipv6_udp_unbound_loopback.cc",
         "socket_ipv4_udp_unbound_loopback_nogotsan.cc",
@@ -2511,6 +2512,23 @@ cc_library(
 )
 
 cc_library(
+    name = "socket_ip_udp_unbound_external_networking",
+    testonly = 1,
+    srcs = [
+        "socket_ip_udp_unbound_external_networking.cc",
+    ],
+    hdrs = [
+        "socket_ip_udp_unbound_external_networking.h",
+    ],
+    deps = [
+        ":ip_socket_test_util",
+        ":socket_test_util",
+        "//test/util:test_util",
+    ],
+    alwayslink = 1,
+)
+
+cc_library(
     name = "socket_ipv4_udp_unbound_external_networking_test_cases",
     testonly = 1,
     srcs = [
@@ -2520,10 +2538,24 @@ cc_library(
         "socket_ipv4_udp_unbound_external_networking.h",
     ],
     deps = [
-        ":ip_socket_test_util",
-        ":socket_test_util",
+        ":socket_ip_udp_unbound_external_networking",
+        gtest,
+    ],
+    alwayslink = 1,
+)
+
+cc_library(
+    name = "socket_ipv6_udp_unbound_external_networking_test_cases",
+    testonly = 1,
+    srcs = [
+        "socket_ipv6_udp_unbound_external_networking.cc",
+    ],
+    hdrs = [
+        "socket_ipv6_udp_unbound_external_networking.h",
+    ],
+    deps = [
+        ":socket_ip_udp_unbound_external_networking",
         gtest,
-        "//test/util:test_util",
     ],
     alwayslink = 1,
 )
@@ -2723,6 +2755,22 @@ cc_binary(
 )
 
 cc_binary(
+    name = "socket_ipv6_udp_unbound_external_networking_test",
+    testonly = 1,
+    srcs = [
+        "socket_ipv6_udp_unbound_external_networking_test.cc",
+    ],
+    linkstatic = 1,
+    deps = [
+        ":ip_socket_test_util",
+        ":socket_ipv6_udp_unbound_external_networking_test_cases",
+        ":socket_test_util",
+        "//test/util:test_main",
+        "//test/util:test_util",
+    ],
+)
+
+cc_binary(
     name = "socket_bind_to_device_test",
     testonly = 1,
     srcs = [
diff --git a/test/syscalls/linux/socket_ip_udp_unbound_external_networking.cc b/test/syscalls/linux/socket_ip_udp_unbound_external_networking.cc
new file mode 100644
index 000000000..fdbb2216b
--- /dev/null
+++ b/test/syscalls/linux/socket_ip_udp_unbound_external_networking.cc
@@ -0,0 +1,59 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "test/syscalls/linux/socket_ip_udp_unbound_external_networking.h"
+
+#include "test/syscalls/linux/socket_test_util.h"
+#include "test/util/test_util.h"
+
+namespace gvisor {
+namespace testing {
+
+void IPUDPUnboundExternalNetworkingSocketTest::SetUp() {
+  // FIXME(b/137899561): Linux instance for syscall tests sometimes misses its
+  // IPv4 address on eth0.
+  found_net_interfaces_ = false;
+
+  // Get interface list.
+  ASSERT_NO_ERRNO(if_helper_.Load());
+  std::vector<std::string> if_names = if_helper_.InterfaceList(AF_INET);
+  if (if_names.size() != 2) {
+    return;
+  }
+
+  // Figure out which interface is where.
+  std::string lo = if_names[0];
+  std::string eth = if_names[1];
+  if (lo != "lo") std::swap(lo, eth);
+  if (lo != "lo") return;
+
+  lo_if_idx_ = ASSERT_NO_ERRNO_AND_VALUE(if_helper_.GetIndex(lo));
+  auto lo_if_addr = if_helper_.GetAddr(AF_INET, lo);
+  if (lo_if_addr == nullptr) {
+    return;
+  }
+  lo_if_addr_ = *reinterpret_cast<const sockaddr_in*>(lo_if_addr);
+
+  eth_if_idx_ = ASSERT_NO_ERRNO_AND_VALUE(if_helper_.GetIndex(eth));
+  auto eth_if_addr = if_helper_.GetAddr(AF_INET, eth);
+  if (eth_if_addr == nullptr) {
+    return;
+  }
+  eth_if_addr_ = *reinterpret_cast<const sockaddr_in*>(eth_if_addr);
+
+  found_net_interfaces_ = true;
+}
+
+}  // namespace testing
+}  // namespace gvisor
diff --git a/test/syscalls/linux/socket_ip_udp_unbound_external_networking.h b/test/syscalls/linux/socket_ip_udp_unbound_external_networking.h
new file mode 100644
index 000000000..e5287addb
--- /dev/null
+++ b/test/syscalls/linux/socket_ip_udp_unbound_external_networking.h
@@ -0,0 +1,46 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IP_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
+#define GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IP_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
+
+#include "test/syscalls/linux/ip_socket_test_util.h"
+#include "test/syscalls/linux/socket_test_util.h"
+
+namespace gvisor {
+namespace testing {
+
+// Test fixture for tests that apply to unbound IP UDP sockets in a sandbox
+// with external networking support.
+class IPUDPUnboundExternalNetworkingSocketTest : public SimpleSocketTest {
+ protected:
+  void SetUp() override;
+
+  IfAddrHelper if_helper_;
+
+  // found_net_interfaces_ is set to false if SetUp() could not obtain
+  // all interface infos that we need.
+  bool found_net_interfaces_;
+
+  // Interface infos.
+  int lo_if_idx_;
+  int eth_if_idx_;
+  sockaddr_in lo_if_addr_;
+  sockaddr_in eth_if_addr_;
+};
+
+}  // namespace testing
+}  // namespace gvisor
+
+#endif  // GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IP_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
index 2eecb0866..940289d15 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
@@ -14,23 +14,6 @@
 
 #include "test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h"
 
-#include <arpa/inet.h>
-#include <ifaddrs.h>
-#include <netinet/in.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <sys/un.h>
-
-#include <cstdint>
-#include <cstdio>
-#include <cstring>
-
-#include "gmock/gmock.h"
-#include "gtest/gtest.h"
-#include "test/syscalls/linux/ip_socket_test_util.h"
-#include "test/syscalls/linux/socket_test_util.h"
-#include "test/util/test_util.h"
-
 namespace gvisor {
 namespace testing {
 
@@ -41,41 +24,6 @@ TestAddress V4EmptyAddress() {
   return t;
 }
 
-void IPv4UDPUnboundExternalNetworkingSocketTest::SetUp() {
-  // FIXME(b/137899561): Linux instance for syscall tests sometimes misses its
-  // IPv4 address on eth0.
-  found_net_interfaces_ = false;
-
-  // Get interface list.
-  ASSERT_NO_ERRNO(if_helper_.Load());
-  std::vector<std::string> if_names = if_helper_.InterfaceList(AF_INET);
-  if (if_names.size() != 2) {
-    return;
-  }
-
-  // Figure out which interface is where.
-  std::string lo = if_names[0];
-  std::string eth = if_names[1];
-  if (lo != "lo") std::swap(lo, eth);
-  if (lo != "lo") return;
-
-  lo_if_idx_ = ASSERT_NO_ERRNO_AND_VALUE(if_helper_.GetIndex(lo));
-  auto lo_if_addr = if_helper_.GetAddr(AF_INET, lo);
-  if (lo_if_addr == nullptr) {
-    return;
-  }
-  lo_if_addr_ = *reinterpret_cast<const sockaddr_in*>(lo_if_addr);
-
-  eth_if_idx_ = ASSERT_NO_ERRNO_AND_VALUE(if_helper_.GetIndex(eth));
-  auto eth_if_addr = if_helper_.GetAddr(AF_INET, eth);
-  if (eth_if_addr == nullptr) {
-    return;
-  }
-  eth_if_addr_ = *reinterpret_cast<const sockaddr_in*>(eth_if_addr);
-
-  found_net_interfaces_ = true;
-}
-
 // Verifies that a broadcast UDP packet will arrive at all UDP sockets with
 // the destination port number.
 TEST_P(IPv4UDPUnboundExternalNetworkingSocketTest,
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
index 0e9e70e8e..20922ac1f 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
@@ -15,30 +15,15 @@
 #ifndef GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IPV4_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
 #define GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IPV4_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
 
-#include "test/syscalls/linux/ip_socket_test_util.h"
-#include "test/syscalls/linux/socket_test_util.h"
+#include "test/syscalls/linux/socket_ip_udp_unbound_external_networking.h"
 
 namespace gvisor {
 namespace testing {
 
 // Test fixture for tests that apply to unbound IPv4 UDP sockets in a sandbox
 // with external networking support.
-class IPv4UDPUnboundExternalNetworkingSocketTest : public SimpleSocketTest {
- protected:
-  void SetUp();
-
-  IfAddrHelper if_helper_;
-
-  // found_net_interfaces_ is set to false if SetUp() could not obtain
-  // all interface infos that we need.
-  bool found_net_interfaces_;
-
-  // Interface infos.
-  int lo_if_idx_;
-  int eth_if_idx_;
-  sockaddr_in lo_if_addr_;
-  sockaddr_in eth_if_addr_;
-};
+using IPv4UDPUnboundExternalNetworkingSocketTest =
+    IPUDPUnboundExternalNetworkingSocketTest;
 
 }  // namespace testing
 }  // namespace gvisor
diff --git a/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.cc b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.cc
new file mode 100644
index 000000000..7364a1ea5
--- /dev/null
+++ b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.cc
@@ -0,0 +1,90 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.h"
+
+namespace gvisor {
+namespace testing {
+
+TEST_P(IPv6UDPUnboundExternalNetworkingSocketTest, TestJoinLeaveMulticast) {
+  SKIP_IF(!found_net_interfaces_);
+
+  auto sender = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
+  auto receiver = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
+
+  auto receiver_addr = V6Any();
+  ASSERT_THAT(
+      bind(receiver->get(), reinterpret_cast<sockaddr*>(&receiver_addr.addr),
+           receiver_addr.addr_len),
+      SyscallSucceeds());
+  socklen_t receiver_addr_len = receiver_addr.addr_len;
+  ASSERT_THAT(getsockname(receiver->get(),
+                          reinterpret_cast<sockaddr*>(&receiver_addr.addr),
+                          &receiver_addr_len),
+              SyscallSucceeds());
+  EXPECT_EQ(receiver_addr_len, receiver_addr.addr_len);
+
+  // Register to receive multicast packets.
+  auto multicast_addr = V6Multicast();
+  ipv6_mreq group_req = {
+      .ipv6mr_multiaddr =
+          reinterpret_cast<sockaddr_in6*>(&multicast_addr.addr)->sin6_addr,
+      .ipv6mr_interface =
+          (unsigned int)ASSERT_NO_ERRNO_AND_VALUE(InterfaceIndex("lo")),
+  };
+  ASSERT_THAT(setsockopt(receiver->get(), IPPROTO_IPV6, IPV6_ADD_MEMBERSHIP,
+                         &group_req, sizeof(group_req)),
+              SyscallSucceeds());
+
+  // Set the sender to the loopback interface.
+  auto sender_addr = V6Loopback();
+  ASSERT_THAT(
+      bind(sender->get(), reinterpret_cast<sockaddr*>(&sender_addr.addr),
+           sender_addr.addr_len),
+      SyscallSucceeds());
+
+  // Send a multicast packet.
+  auto send_addr = multicast_addr;
+  reinterpret_cast<sockaddr_in6*>(&send_addr.addr)->sin6_port =
+      reinterpret_cast<sockaddr_in6*>(&receiver_addr.addr)->sin6_port;
+  char send_buf[200];
+  RandomizeBuffer(send_buf, sizeof(send_buf));
+  ASSERT_THAT(RetryEINTR(sendto)(sender->get(), send_buf, sizeof(send_buf), 0,
+                                 reinterpret_cast<sockaddr*>(&send_addr.addr),
+                                 send_addr.addr_len),
+              SyscallSucceedsWithValue(sizeof(send_buf)));
+
+  // Check that we received the multicast packet.
+  char recv_buf[sizeof(send_buf)] = {};
+  ASSERT_THAT(RetryEINTR(recv)(receiver->get(), recv_buf, sizeof(recv_buf), 0),
+              SyscallSucceedsWithValue(sizeof(recv_buf)));
+
+  EXPECT_EQ(0, memcmp(send_buf, recv_buf, sizeof(send_buf)));
+
+  // Leave the group and make sure we don't receive its multicast traffic.
+  ASSERT_THAT(setsockopt(receiver->get(), IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP,
+                         &group_req, sizeof(group_req)),
+              SyscallSucceeds());
+  RandomizeBuffer(send_buf, sizeof(send_buf));
+  ASSERT_THAT(RetryEINTR(sendto)(sender->get(), send_buf, sizeof(send_buf), 0,
+                                 reinterpret_cast<sockaddr*>(&send_addr.addr),
+                                 send_addr.addr_len),
+              SyscallSucceedsWithValue(sizeof(send_buf)));
+  ASSERT_THAT(RetryEINTR(recv)(receiver->get(), recv_buf, sizeof(recv_buf),
+                               MSG_DONTWAIT),
+              SyscallFailsWithErrno(EAGAIN));
+}
+
+}  // namespace testing
+}  // namespace gvisor
diff --git a/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.h b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.h
new file mode 100644
index 000000000..731ae0a1f
--- /dev/null
+++ b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.h
@@ -0,0 +1,31 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IPV6_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
+#define GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IPV6_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
+
+#include "test/syscalls/linux/socket_ip_udp_unbound_external_networking.h"
+
+namespace gvisor {
+namespace testing {
+
+// Test fixture for tests that apply to unbound IPv6 UDP sockets in a sandbox
+// with external networking support.
+using IPv6UDPUnboundExternalNetworkingSocketTest =
+    IPUDPUnboundExternalNetworkingSocketTest;
+
+}  // namespace testing
+}  // namespace gvisor
+
+#endif  // GVISOR_TEST_SYSCALLS_LINUX_SOCKET_IPV6yy_UDP_UNBOUND_EXTERNAL_NETWORKING_H_
diff --git a/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking_test.cc b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking_test.cc
new file mode 100644
index 000000000..5c764b8fd
--- /dev/null
+++ b/test/syscalls/linux/socket_ipv6_udp_unbound_external_networking_test.cc
@@ -0,0 +1,39 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.h"
+
+#include <vector>
+
+#include "test/syscalls/linux/ip_socket_test_util.h"
+#include "test/syscalls/linux/socket_test_util.h"
+#include "test/util/test_util.h"
+
+namespace gvisor {
+namespace testing {
+namespace {
+
+std::vector<SocketKind> GetSockets() {
+  return ApplyVec<SocketKind>(
+      IPv6UDPUnboundSocket,
+      AllBitwiseCombinations(List<int>{0, SOCK_NONBLOCK}));
+}
+
+INSTANTIATE_TEST_SUITE_P(IPv6UDPUnboundSockets,
+                         IPv6UDPUnboundExternalNetworkingSocketTest,
+                         ::testing::ValuesIn(GetSockets()));
+
+}  // namespace
+}  // namespace testing
+}  // namespace gvisor
diff --git a/test/syscalls/linux/socket_test_util.cc b/test/syscalls/linux/socket_test_util.cc
index a760581b5..26dacc95e 100644
--- a/test/syscalls/linux/socket_test_util.cc
+++ b/test/syscalls/linux/socket_test_util.cc
@@ -860,6 +860,17 @@ TestAddress V6Loopback() {
   return t;
 }
 
+TestAddress V6Multicast() {
+  TestAddress t("V6Multicast");
+  t.addr.ss_family = AF_INET6;
+  t.addr_len = sizeof(sockaddr_in6);
+  EXPECT_EQ(
+      1,
+      inet_pton(AF_INET6, "ff05::1234",
+                reinterpret_cast<sockaddr_in6*>(&t.addr)->sin6_addr.s6_addr));
+  return t;
+}
+
 // Checksum computes the internet checksum of a buffer.
 uint16_t Checksum(uint16_t* buf, ssize_t buf_size) {
   // Add up the 16-bit values in the buffer.
diff --git a/test/syscalls/linux/socket_test_util.h b/test/syscalls/linux/socket_test_util.h
index 5e205339f..75c0d4735 100644
--- a/test/syscalls/linux/socket_test_util.h
+++ b/test/syscalls/linux/socket_test_util.h
@@ -502,6 +502,7 @@ TestAddress V4MappedLoopback();
 TestAddress V4Multicast();
 TestAddress V6Any();
 TestAddress V6Loopback();
+TestAddress V6Multicast();
 
 // Compute the internet checksum of an IP header.
 uint16_t IPChecksum(struct iphdr ip);