nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

net: recvfrom says who sent it, and a datagram is delivered whole

Browse source 
The second of the two things the stack owed. recvfrom accepted the
address arguments and ignored them, so every caller was told nothing
about where a datagram came from -- which for UDP is most of the point:
a server that cannot see the sender cannot reply to it.

Fixing it properly meant fixing something worse that was sitting
underneath. UDP payloads went into the same byte ring TCP uses, with no
record of where one datagram ended and the next began, so two datagrams
that arrived together came back from one read as one. That is a bug
whose appearance depends on timing and whose blame lands on the sender.

Datagrams now carry a header alongside the bytes: source address, source
port, length. Sixteen of them per socket, in a ring beside the existing
one. Whole buffers would have been 16 sockets x 16 datagrams x an MTU of
static memory for something almost always empty; only the boundaries need
keeping, and those are eight bytes each. A datagram too big for the
buffer it is read into is truncated and the remainder discarded, rather
than left in the ring to be delivered as the head of the next one. One
that arrives with the queue full is dropped whole -- that is UDP's own
contract, and half a datagram in the ring would corrupt every one after.

An empty queue and a zero-length datagram are kept apart, because a
sender really can send zero bytes and the right answer to that is 0
rather than "nothing has arrived yet".

sendto grew the mirror image: a destination address on a datagram
socket, which is what a server replying to whoever just wrote to it
needs. On TCP a destination is ignored rather than refused -- the
connection decides where the bytes go, and programs pass one out of
habit. For a stream, recvfrom's source is read from the pcb: it is the
peer, and it is the same answer for every byte.

Verified: bootcheck -Net now covers UDP too, 45 [ok] and no failures.
The address check is real rather than cosmetic -- nettest deliberately
leaves its sockaddr uninitialised, so a kernel that filled in nothing
would print stack rubbish instead of 10.0.2.2 and the port the responder
is actually on. The boundaries are checked by byte count: the responder
sends 20 bytes and then 16, and the guest reports reading 20 and then
16. Treated as a stream the first read would have taken all 36.

Left for later, and deliberately: accept() still does not report the
peer's address, and getsockname/getpeername do not exist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-08-15 16:23:06 +02:00
commit a9ff1166b5
6 changed files with 433 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

168
kernel/net/inet.c
View file

@ -67,6 +67,19 @@
#define NINET 16 // AF_INET sockets in the system
#define INET_RXBUF 8192 // per socket; one lwIP window plus slack
#define NDGRAM 16 // datagrams queued on a UDP socket
// Where one datagram ends and the next begins, and who sent it.
//
// The bytes themselves stay in the same ring TCP uses -- a datagram queue of
// whole buffers would be 16 sockets x 16 datagrams x an MTU of static memory
// for something that is nearly always empty. Only the boundaries and the
// source need to be kept alongside, and those are eight bytes each.
struct dgram {
uint addr; // source, network byte order
ushort port; // source, host byte order
ushort len;
};
struct inet_sock {
int inuse;
@ -81,6 +94,11 @@ struct inet_sock {
char rx[INET_RXBUF];
uint rhead, rtail; // rhead == rtail is empty
// UDP only: the boundaries within that ring. A stream socket has none --
// that is the whole difference between the two -- so these stay at zero.
struct dgram dq[NDGRAM];
uint dhead, dtail; // dhead == dtail is empty
int connecting; // connect() issued, no answer yet
int connected;
int conn_failed;
@ -179,6 +197,53 @@ rx_take(struct inet_sock *is, char *p, uint n)
return n;
}
// Throw bytes away without copying them. A datagram larger than the buffer it
// was read into is truncated, and the remainder is discarded rather than left
// to be delivered as if it were the next datagram.
static void
rx_drop(struct inet_sock *is, uint n)
{
uint have = rx_used(is);
is->rtail += n > have ? have : n;
}
/* ------------------------------------------------------------------ */
/* Datagram boundaries. UDP only; callers hold the lwIP lock. */
/* ------------------------------------------------------------------ */
static uint
dq_used(struct inet_sock *is)
{
return is->dhead - is->dtail;
}
// Take one datagram, whole. Returns the bytes copied, or -1 if none is queued.
//
// Whole is the point: read() on a UDP socket returns one datagram or nothing,
// never the tail of one followed by the head of the next. Before this queue
// existed the bytes went into the ring unmarked, so two datagrams that arrived
// together came back as one -- which is a bug that only appears when the
// timing is right, and is then blamed on the sender.
static int
dq_take(struct inet_sock *is, char *p, uint n, uint *addr, ushort *port)
{
if (dq_used(is) == 0)
return -1;
struct dgram *d = &is->dq[is->dtail % NDGRAM];
uint want = d->len;
uint got = want < n ? want : n;
rx_take(is, p, got);
rx_drop(is, want - got);
if (addr) *addr = d->addr;
if (port) *port = d->port;
is->dtail++;
return (int)got;
}
/* ------------------------------------------------------------------ */
/* lwIP callbacks. All of these run in the network thread, holding the */
/* lwIP lock. */
@ -299,23 +364,37 @@ inet_accept_cb(void *arg, struct tcp_pcb *newpcb, err_t err)
return ERR_OK;
}
// UDP delivers datagrams with no connection. The source is dropped on the
// floor for now: recvfrom is not wired, and inventing a per-datagram source
// queue that nothing reads would be storage with no reader.
// UDP delivers datagrams with no connection, so each one carries its own
// sender. Both the sender and the length are recorded next to the bytes, which
// is what lets recvfrom answer "who sent this" and read() return exactly one
// datagram.
static void
inet_udp_recv_cb(void *arg, struct udp_pcb *pcb, struct pbuf *p,
const ip_addr_t *addr, u16_t port)
{
struct inet_sock *is = arg;
(void)pcb; (void)addr; (void)port;
(void)pcb;
if (is == 0 || p == NULL) {
if (p) pbuf_free(p);
return;
}
if (p->tot_len <= rx_space(is))
// Two ways to be full, and both mean the same thing for UDP: the datagram is
// dropped. That is the protocol's own contract -- there is no window to
// close and nothing to retransmit -- but it must be dropped *whole*, because
// half a datagram in the ring would corrupt every one after it.
if (p->tot_len <= rx_space(is) && dq_used(is) < NDGRAM) {
struct dgram *d = &is->dq[is->dhead % NDGRAM];
d->addr = addr ? ip4_addr_get_u32(ip_2_ip4(addr)) : 0;
d->port = port;
d->len = p->tot_len;
is->dhead++;
for (struct pbuf *q = p; q != NULL; q = q->next)
rx_put(is, (const char *)q->payload, q->len);
}
pbuf_free(p);
net_wake();
}
@ -498,8 +577,15 @@ inet_connect(void *h, uint32 addr, uint16 port)
}
}
// Read, and say where it came from.
//
// `addr` and `port` may be null, which is what read() and recv() pass: the
// source is then simply not reported. For a stream socket the answer is the
// peer it is connected to and is the same for every byte; for a datagram
// socket it belongs to the individual datagram, which is why UDP needs the
// queue above and TCP does not.
int
inet_read(void *h, char *buf, int n)
inet_recvfrom(void *h, char *buf, int n, uint *addr, ushort *port)
{
struct inet_sock *is = h;
@ -507,14 +593,36 @@ inet_read(void *h, char *buf, int n)
return 0;
for (;;) {
int got = 0;
int have = 0; // something was delivered, even if it was zero bytes
int eof;
uint seen;
lwip_sys_lock();
uint got = rx_take(is, buf, (uint)n);
int eof = is->peer_closed;
uint seen = net_seq();
if (is->type == SOCK_DGRAM) {
// A zero-length datagram is a real thing a sender can send, and the
// right answer to it is 0 rather than "nothing arrived yet" -- which is
// why dq_take reports an empty queue as -1 and not as zero bytes.
int r = dq_take(is, buf, (uint)n, addr, port);
have = r >= 0;
got = r > 0 ? r : 0;
} else {
got = (int)rx_take(is, buf, (uint)n);
have = got > 0;
// A stream's source is the peer it is connected to: the same answer for
// every byte, which is why it is read from the pcb rather than stored.
if (have && addr && is->tpcb) {
*addr = ip4_addr_get_u32(ip_2_ip4(&is->tpcb->remote_ip));
if (port)
*port = is->tpcb->remote_port;
}
}
eof = is->peer_closed;
seen = net_seq();
lwip_sys_unlock();
if (got > 0)
return (int)got;
if (have)
return got;
if (eof)
return 0; // end of file, not an error
if (myproc()->killed)
@ -524,7 +632,20 @@ inet_read(void *h, char *buf, int n)
}
int
inet_write(void *h, char *buf, int n)
inet_read(void *h, char *buf, int n)
{
return inet_recvfrom(h, buf, n, 0, 0);
}
// Write, optionally to a named destination.
//
// `addr` of zero means "wherever this socket is already pointed", which is what
// write() and send() pass. For TCP that is the only possibility and a
// destination is ignored rather than refused: the connection decides where the
// bytes go, and a program that passes one anyway -- many do, out of habit -- is
// better served by having it work.
int
inet_sendto(void *h, char *buf, int n, uint addr, ushort port)
{
struct inet_sock *is = h;
int done = 0;
@ -540,10 +661,23 @@ inet_write(void *h, char *buf, int n)
return -ENOBUFS;
}
pbuf_take(p, buf, (u16_t)n);
err_t e = udp_send(is->upcb, p);
err_t e;
if (addr) {
ip_addr_t ip;
ip_addr_set_ip4_u32(&ip, addr);
e = udp_sendto(is->upcb, p, &ip, port);
} else {
// No destination and none remembered is a program error, not a network
// one: lwIP would send to 0.0.0.0 and the datagram would vanish.
e = udp_send(is->upcb, p);
}
pbuf_free(p);
lwip_sys_unlock();
return e == ERR_OK ? n : -EIO;
if (e == ERR_OK)
return n;
return e == ERR_RTE ? -EDESTADDRREQ : -EIO;
}
// TCP: the send buffer is finite, so a large write becomes several passes.
@ -592,6 +726,12 @@ inet_write(void *h, char *buf, int n)
return done;
}
int
inet_write(void *h, char *buf, int n)
{
return inet_sendto(h, buf, n, 0, 0);
}
int
inet_readable(void *h)
{