nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

net: the socket layer stops saying yes to things it did not do, and ping works

Browse source 
setsockopt was `return 0;` and getsockopt wrote a zero for whatever was asked.
The comment said it was so a server setting SO_REUSEADDR and treating failure as
fatal would not fail. That trade is the wrong way round: a caller told "no"
adapts, a caller told "yes" changes its behaviour on the strength of it -- sets
SO_RCVTIMEO and then blocks forever in a read it believes will time out, sets
TCP_NODELAY and reports latency numbers that measure Nagle. The failure is
silent, remote from the call, and indistinguishable from a bug in the stack.

Six options are honoured now and everything else is ENOPROTOOPT. SO_REUSEADDR,
SO_KEEPALIVE, SO_BROADCAST and TCP_NODELAY reach lwIP's pcb; SO_SNDBUF/SO_RCVBUF
are accepted and report the real size on read. SO_REUSEADDR is implemented rather
than refused precisely because of the original comment's concern -- it is the one
option a server really does set and really does check.

accept4 becomes its own table entry rather than an alias for accept. It has to
be: accept takes three arguments, so a shared handler reading a fourth register
reads whatever the caller last left there and invents a SOCK_NONBLOCK out of
stack litter. SOCK_CLOEXEC and SOCK_NONBLOCK are now honoured by socket(),
socketpair() and accept4() -- a dropped CLOEXEC leaks a listening socket across
every exec, and a dropped NONBLOCK has the caller block forever in what it
believes is a poll loop.

ICMP ping sockets: socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP), on lwIP's raw API,
with the callback stripping the variable-length IP header. Only echo replies are
eaten, and that restriction is load-bearing -- raw_input runs before lwIP's own
icmp_input, so consuming every ICMP message would swallow the echo *requests* and
this machine would silently stop answering pings from outside.

Loopback, so 127.0.0.1 is a real destination. LWIP_NETIF_LOOPBACK is the half
that is easy to miss: without it a packet addressed to an interface's own address
goes out of the wire and never comes back. With NO_SYS=1 nothing drains the
loopback queue, so the network thread calls netif_poll_all().

cmd/ping is first-party rather than toybox's, and the reason is a limitation not
a preference: toybox reads replies with recvmsg(2) and wants the TTL through an
IP_RECVTTL control message, and SchOS has neither. recvmsg is item 1 of
docs/plan/foundations.md, where it is wanted for SCM_RIGHTS anyway, and should
not be rushed to make one applet run.

Two bugs found on the way. Every AF_INET socket failed with ENFILE until DHCP
bound, because inet_new() demanded an *address* before handing out a socket and
reported it as "file table overflow"; net_is_ready() (lwIP up) is now distinct
from net_is_up() (DHCP bound). And that bug was hiding a bad test: socktest
asserted "AF_INET is refused, not faked", true when written, false since AF_INET
landed, and green the whole time because the suite runs before DHCP binds and the
ENFILE made the refusal look real. Fixing the kernel is what turned it red.

Verified: ping to 127.0.0.1, localhost, the gateway, 1.1.1.1 and 9.9.9.9, all
0% loss; socktest ALL CHECKS PASSED with ten new checks, including a setsockopt
round trip and an unknown option that must be refused -- a permissive stub cannot
pass both at once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-12 17:14:35 +02:00
commit c362e308d0
13 changed files with 903 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

270
cmd/ping/main.c Normal file
View file

@ -0,0 +1,270 @@
// SPDX-License-Identifier: Apache-2.0
//
// ping -- ICMP echo, over a SchOS ping socket.
//
// This is a first-party program rather than toybox's ping, and the reason is
// worth recording because it is not "ours is better". toybox's ping reads its
// replies with recvmsg(2) and asks for the TTL through an IP_RECVTTL control
// message, and SchOS has neither: no recvmsg, no ancillary data. Both are owed
// -- recvmsg is item 1 of docs/plan/foundations.md, where it is wanted for
// SCM_RIGHTS -- and neither should be rushed to make one applet run.
//
// So this uses sendto/recvfrom, which the kernel does have, and proves the ICMP
// socket end to end in the meantime. When recvmsg lands, toybox's ping will
// work and this can go.
//
// A "ping socket" is socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP): the kernel owns
// the IP header and the caller reads and writes the ICMP message alone. See
// inet_icmp_recv_cb in kernel/net/inet.c.
#include "types.h"
#include "user.h"
#include "socket.h"
#define ICMP_ECHO 8
#define ICMP_ECHOREPLY 0
#define DEFAULT_COUNT 4
#define PAYLOAD 56 // what every other ping sends
struct icmphdr {
uchar type;
uchar code;
ushort checksum;
ushort id;
ushort seq;
};
// lib/ is raw syscall stubs -- no libc, so not even memset. Everything here is
// hand-rolled for the same reason cmd/schinit is.
static void
zero(void *p, int n)
{
char *b = p;
while (n-- > 0) *b++ = 0;
}
static void
puts_(const char *s)
{
int n = 0;
while (s[n]) n++;
write(1, (void *)s, n);
}
static void
putn_(int v)
{
char buf[12];
int i = 0, neg = 0;
if (v < 0) { neg = 1; v = -v; }
if (v == 0) buf[i++] = '0';
while (v) { buf[i++] = (char)('0' + v % 10); v /= 10; }
if (neg) buf[i++] = '-';
while (i--) write(1, &buf[i], 1);
}
// The Internet checksum: one's complement of the one's complement sum of every
// 16-bit word. Computed over the ICMP message with the checksum field zeroed,
// which is why it is filled in last.
static ushort
cksum(const void *p, int n)
{
const uchar *b = p;
uint sum = 0;
int i;
for (i = 0; i + 1 < n; i += 2)
sum += (uint)((b[i] << 8) | b[i + 1]);
if (i < n)
sum += (uint)(b[i] << 8);
while (sum >> 16)
sum = (sum & 0xFFFF) + (sum >> 16);
return (ushort)(~sum & 0xFFFF);
}
static ushort
hton16(ushort v)
{
return (ushort)((v >> 8) | (v << 8));
}
// Dotted quad to a network-byte-order address. Returns 0 on a malformed one,
// which is indistinguishable from 0.0.0.0 and is fine: nobody pings that.
static uint
parse_ip(const char *s, int *ok)
{
uint out = 0;
int part, i, digits;
*ok = 0;
for (i = 0; i < 4; i++) {
part = 0; digits = 0;
while (*s >= '0' && *s <= '9') {
part = part * 10 + (*s - '0');
if (part > 255) return 0;
s++; digits++;
}
if (digits == 0) return 0;
out |= (uint)part << (8 * i); // little-endian host, so LSB first
if (i < 3) {
if (*s != '.') return 0;
s++;
}
}
if (*s != '\0') return 0;
*ok = 1;
return out;
}
static void
print_ip(uint addr)
{
for (int i = 0; i < 4; i++) {
putn_((int)((addr >> (8 * i)) & 0xFF));
if (i < 3) puts_(".");
}
}
int
main(int argc, char *argv[])
{
char target[64];
int count = DEFAULT_COUNT;
int ok, sent = 0, recvd = 0;
if (argc < 2) {
puts_("usage: ping <host> [count]\n");
exit();
}
// "localhost" without a resolver. The kernel has no DNS client reachable
// from userland, and the one name worth special-casing is the one that
// always means the same thing.
const char *host = argv[1];
if (host[0] == 'l' && host[1] == 'o' && host[2] == 'c' &&
host[3] == 'a' && host[4] == 'l' && host[5] == 'h' &&
host[6] == 'o' && host[7] == 's' && host[8] == 't' && host[9] == 0)
host = "127.0.0.1";
{ int i = 0; while (host[i] && i < 63) { target[i] = host[i]; i++; } target[i] = 0; }
uint addr = parse_ip(target, &ok);
if (!ok) {
puts_("ping: not a dotted-quad address: ");
puts_(argv[1]);
puts_("\nping: there is no resolver yet; use an address\n");
exit();
}
if (argc > 2) {
count = 0;
for (const char *p = argv[2]; *p >= '0' && *p <= '9'; p++)
count = count * 10 + (*p - '0');
if (count <= 0) count = DEFAULT_COUNT;
}
int fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
if (fd < 0) {
puts_("ping: socket: ");
putn_(fd);
puts_("\n");
exit();
}
puts_("PING ");
print_ip(addr);
puts_(" ");
putn_(PAYLOAD);
puts_(" bytes of data.\n");
ushort id = (ushort)getpid();
for (int seq = 1; seq <= count; seq++) {
char out[sizeof(struct icmphdr) + PAYLOAD];
struct icmphdr *ih = (struct icmphdr *)out;
zero(out, (int)sizeof(out));
ih->type = ICMP_ECHO;
ih->code = 0;
ih->id = hton16(id);
ih->seq = hton16((ushort)seq);
for (int i = 0; i < PAYLOAD; i++)
out[sizeof(*ih) + i] = (char)('a' + (i % 26));
ih->checksum = 0;
// The checksum is stored as it is computed: cksum() already works in
// network order, so byte-swapping it here would send a wrong one.
ih->checksum = hton16(cksum(out, (int)sizeof(out)));
struct sockaddr_in sa;
zero(&sa, (int)sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_port = 0;
sa.sin_addr = addr;
int t0 = uptime();
int n = sendto(fd, out, (int)sizeof(out), 0,
(struct sockaddr *)&sa, sizeof(sa));
if (n < 0) {
puts_("ping: sendto: ");
putn_(n);
puts_("\n");
break;
}
sent++;
// Wait for a reply, but not forever. uptime() counts 10 ms ticks, so
// 100 of them is one second -- the same timeout every ping uses.
char in[256];
int got = -1, waited = 0;
struct sockaddr_in from;
int fromlen = sizeof(from);
while (waited < 100) {
got = recvfrom(fd, in, (int)sizeof(in), 0,
(struct sockaddr *)&from, &fromlen);
if (got > 0) break;
sleep(1);
waited = uptime() - t0;
}
if (got <= 0) {
puts_("Request timeout for icmp_seq ");
putn_(seq);
puts_("\n");
continue;
}
struct icmphdr *rh = (struct icmphdr *)in;
if (rh->type != ICMP_ECHOREPLY || hton16(rh->id) != id) {
puts_("ping: reply for somebody else, ignored\n");
continue;
}
recvd++;
putn_(got);
puts_(" bytes from ");
print_ip(from.sin_addr);
puts_(": icmp_seq=");
putn_((int)hton16(rh->seq));
puts_(" time=");
putn_((uptime() - t0) * 10);
puts_(" ms\n");
if (seq < count)
sleep(100); // one second between packets
}
close(fd);
puts_("--- ");
print_ip(addr);
puts_(" ping statistics ---\n");
putn_(sent);
puts_(" packets transmitted, ");
putn_(recvd);
puts_(" received, ");
putn_(sent ? (sent - recvd) * 100 / sent : 0);
puts_("% packet loss\n");
exit();
}

123
cmd/socktest/main.c
View file

@ -150,7 +150,23 @@ test_errors(void)
"connect() to a name nobody bound fails");
close(s);
check(socket(AF_INET, SOCK_STREAM, 0) < 0, "AF_INET is refused, not faked");
// This used to assert that AF_INET was *refused*, which was true when this
// file was written and stopped being true the day AF_INET landed. It kept
// passing anyway, and the reason is worth keeping: socktest runs seconds
// after boot, DHCP had not bound yet, and inet_new() refused every socket
// until it did -- reported as ENFILE. So the check saw "< 0" and called it
// a pass for a reason that had nothing to do with what it was testing.
//
// Two lessons, both already written down elsewhere in this tree and both
// learned again here: a test that asserts a *failure* has to say which
// failure, and a green suite is not evidence until something has checked
// that it can go red.
//
// What is left are the refusals that are unconditionally true, whatever the
// link is doing.
check(socket(99, SOCK_STREAM, 0) < 0, "an unknown address family is refused");
check(socket(AF_INET, SOCK_STREAM, 99) < 0,
"AF_INET with a nonsense protocol is refused");
check(socket(AF_UNIX, SOCK_DGRAM, 0) < 0, "SOCK_DGRAM is refused, not faked");
// read/write on a plain file descriptor must not be mistaken for a socket,
@ -283,6 +299,109 @@ test_big(void)
check(ok, "and in the right order");
}
// ---------------------------------------------------------------------------
// Socket options.
//
// Both calls used to succeed unconditionally: setsockopt was `return 0;` and
// getsockopt wrote a zero for whatever was asked. So the only check that proves
// anything is a *round trip* -- set a value, read it back, and see the value
// rather than a zero -- plus one option that must be refused. A stub passes
// "does setsockopt return 0"; it cannot pass both of these at once.
// ---------------------------------------------------------------------------
#define T_SOL_SOCKET 1
#define T_SO_REUSEADDR 2
#define T_SO_TYPE 3
#define T_SO_RCVBUF 8
#define T_SO_NOSUCH 0x7ffe // not an option Linux defines either
static void
test_sockopt(void)
{
int fd = socket(AF_UNIX, SOCK_STREAM, 0);
int val, len;
puts_("-- socket options\n");
if (fd < 0) { check(0, "socket()"); return; }
// SO_TYPE must report what this socket actually is, not zero.
val = -1; len = sizeof(val);
check(getsockopt(fd, T_SOL_SOCKET, T_SO_TYPE, &val, &len) == 0 &&
val == SOCK_STREAM, "getsockopt SO_TYPE says SOCK_STREAM");
// The round trip. A stub that ignores the set and zeroes the get fails here.
val = 1;
check(setsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, sizeof(val)) == 0,
"setsockopt SO_REUSEADDR accepted");
val = -1; len = sizeof(val);
check(getsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, &len) == 0 &&
val == 1, "getsockopt SO_REUSEADDR reads back 1");
// And back off again, so the answer is not just "always non-zero".
val = 0;
setsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, sizeof(val));
val = -1; len = sizeof(val);
check(getsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, &len) == 0 &&
val == 0, "and reads back 0 once cleared");
// A real buffer size, not zero.
val = -1; len = sizeof(val);
check(getsockopt(fd, T_SOL_SOCKET, T_SO_RCVBUF, &val, &len) == 0 && val > 0,
"getsockopt SO_RCVBUF is a real size");
// The refusal. This is the half that a permissive stub cannot fake.
val = 1;
check(setsockopt(fd, T_SOL_SOCKET, T_SO_NOSUCH, &val, sizeof(val)) < 0,
"setsockopt of an unknown option is refused");
len = sizeof(val);
check(getsockopt(fd, T_SOL_SOCKET, T_SO_NOSUCH, &val, &len) < 0,
"getsockopt of an unknown option is refused");
close(fd);
}
// ---------------------------------------------------------------------------
// SOCK_NONBLOCK, end to end.
//
// Checking that socket() accepts the flag proves nothing -- it was accepted
// before, and discarded. What proves it is a read that *returns* on a socket
// with nothing in it, where a blocking socket would sleep forever.
// ---------------------------------------------------------------------------
#define T_SOCK_NONBLOCK 0x800
#define T_F_GETFL 3
#define T_O_NONBLOCK 04000
static void
test_nonblock(void)
{
int sv[2];
char c;
puts_("-- SOCK_NONBLOCK\n");
if (socketpair(AF_UNIX, SOCK_STREAM | T_SOCK_NONBLOCK, 0, sv) < 0) {
check(0, "socketpair(SOCK_NONBLOCK)");
return;
}
check((fcntl(sv[0], T_F_GETFL, 0) & T_O_NONBLOCK) != 0,
"fcntl(F_GETFL) reports O_NONBLOCK");
// Nothing has been written, so a blocking read would never return. If this
// test hangs, the flag was dropped -- which is exactly what it used to be.
check(read(sv[0], &c, 1) < 0, "read on an empty non-blocking socket returns");
// And it still carries data, so the flag did not break the socket.
write(sv[1], "x", 1);
c = 0;
check(read(sv[0], &c, 1) == 1 && c == 'x', "and still delivers a byte");
close(sv[0]);
close(sv[1]);
}
int
main(void)
{
@ -293,6 +412,8 @@ main(void)
test_eof();
test_socketpair();
test_big();
test_sockopt();
test_nonblock();
if (failures == 0)
puts_("socktest: ALL CHECKS PASSED\n");

35
include/socket.h
View file

@ -22,6 +22,32 @@
#define SOCK_STREAM 1
#define SOCK_DGRAM 2
// Flags ORed into socket()'s and accept4()'s `type`/`flags` argument. Linux's
// values, because a musl program passes Linux's constants.
#define SOCK_NONBLOCK 0x800 // O_NONBLOCK
#define SOCK_CLOEXEC 0x80000 // O_CLOEXEC
// setsockopt/getsockopt levels and names, Linux's numbering.
//
// Only what is listed here is accepted; anything else is answered with
// ENOPROTOOPT rather than a success it did not earn. See the comment above
// sys_setsockopt for why that is worth the risk of failing a caller that never
// checked before.
#define SOL_SOCKET 1
#define IPPROTO_ICMP 1
#define IPPROTO_TCP 6
#define SO_REUSEADDR 2
#define SO_TYPE 3
#define SO_ERROR 4
#define SO_BROADCAST 6
#define SO_SNDBUF 7
#define SO_RCVBUF 8
#define SO_KEEPALIVE 9
#define SO_ACCEPTCONN 30
#define TCP_NODELAY 1
#define UNIX_PATH_MAX 108
#define SHUT_RD 0
@ -93,6 +119,15 @@ struct socket {
// Connections waiting to be accepted, on a listener.
struct socket *queue[NBACKLOG];
int nqueue;
// Socket options that are genuinely honoured. Kept here rather than only in
// lwIP's pcb because getsockopt has to answer for an AF_UNIX socket too, and
// because a flag set before bind() has to survive until there is a pcb to
// apply it to.
int o_reuseaddr;
int o_keepalive;
int o_broadcast;
int o_nodelay;
};
#endif

1
include/user.h
View file

@ -134,6 +134,7 @@ int socket(int domain, int type, int protocol);
int bind(int fd, const struct sockaddr *addr, int addrlen);
int listen(int fd, int backlog);
int accept(int fd, struct sockaddr *addr, int *addrlen);
int accept4(int fd, struct sockaddr *addr, int *addrlen, int flags);
int connect(int fd, const struct sockaddr *addr, int addrlen);
int socketpair(int domain, int type, int protocol, int sv[2]);
int sendto(int fd, const void *buf, int len, int flags, const struct sockaddr*, int);

12
kernel/core/string.c
View file

@ -70,6 +70,18 @@ strncmp(const char *p, const char *q, uint n)
return (uchar)*p - (uchar)*q;
}
// Added when lwIP's DNS resolver started needing it: with LWIP_HAVE_LOOPIF on,
// dns.c short-circuits the name "localhost" with a strcmp. The kernel had only
// strncmp until then, deliberately -- see the note in kernel/net/lwip/shim/
// string.h about not growing that shim into a libc.
int
strcmp(const char *p, const char *q)
{
while(*p && *p == *q)
p++, q++;
return (uchar)*p - (uchar)*q;
}
char*
strncpy(char *s, const char *t, int n)
{

186
kernel/net/inet.c
View file

@ -62,6 +62,9 @@
#include "lwip/opt.h"
#include "lwip/tcp.h"
#include "lwip/udp.h"
#include "lwip/raw.h"
#include "lwip/icmp.h"
#include "lwip/prot/ip4.h"
#include "lwip/ip_addr.h"
#include "lwip/pbuf.h"
@ -84,9 +87,11 @@ struct dgram {
struct inet_sock {
int inuse;
int type; // SOCK_STREAM or SOCK_DGRAM
int proto; // 0, or IPPROTO_ICMP for a ping socket
struct tcp_pcb *tpcb;
struct udp_pcb *upcb;
struct raw_pcb *rpcb; // SOCK_DGRAM + IPPROTO_ICMP
// Receive ring. lwIP hands over pbufs from the network thread; a reader
// drains bytes. Full means the sender is told to back off, which for TCP is
@ -399,6 +404,77 @@ inet_udp_recv_cb(void *arg, struct udp_pcb *pcb, struct pbuf *p,
net_wake();
}
// ICMP, for ping sockets.
//
// Linux calls these "ping sockets": SOCK_DGRAM with IPPROTO_ICMP, giving an
// unprivileged process the one thing raw sockets were used for. The contract is
// that the caller reads and writes the ICMP message alone, and the kernel deals
// with the IP header -- which is why this strips it on the way in, where
// lwIP's raw layer hands over a pbuf that starts at the IP header.
//
// **Only echo replies are eaten.** raw_input runs before lwIP's own
// icmp_input, so a callback that returned 1 for everything would swallow the
// echo *requests* too and this machine would silently stop answering pings
// from outside. Returning 0 leaves the packet for lwIP, which is exactly what
// should happen to every ICMP message we did not ask for.
//
// No matching against the echo id: a reply goes to every open ICMP socket.
// Linux rewrites the id per socket and filters on it, which matters when two
// processes ping at once; with one ping at a time the difference is invisible,
// and a socket that sees a reply to somebody else's request will read a
// sequence number it never sent and ignore it.
static u8_t
inet_icmp_recv_cb(void *arg, struct raw_pcb *pcb, struct pbuf *p,
const ip_addr_t *addr)
{
struct inet_sock *is = arg;
(void)pcb;
if (is == 0 || p == NULL)
return 0;
// The IP header is variable length: IHL counts 32-bit words.
if (p->tot_len < sizeof(struct ip_hdr))
return 0;
struct ip_hdr *ih = (struct ip_hdr *)p->payload;
u16_t hlen = (u16_t)(IPH_HL(ih) * 4);
if (hlen < sizeof(struct ip_hdr) || p->tot_len < hlen + 8)
return 0;
// Type 0 is ICMP Echo Reply. Everything else -- including the requests this
// host must keep answering -- is left for lwIP.
u8_t type;
if (pbuf_copy_partial(p, &type, 1, hlen) != 1 || type != 0)
return 0;
u16_t icmplen = (u16_t)(p->tot_len - hlen);
if (icmplen <= rx_space(is) && dq_used(is) < NDGRAM) {
struct dgram *d = &is->dq[is->dhead % NDGRAM];
d->addr = addr ? ip4_addr_get_u32(ip_2_ip4(addr)) : 0;
d->port = 0; // ICMP has no ports
d->len = icmplen;
is->dhead++;
// Copy the ICMP message out, skipping the IP header, across whatever pbuf
// chain it arrived in.
u16_t off = hlen;
while (off < p->tot_len) {
char tmp[64];
u16_t want = (u16_t)(p->tot_len - off);
if (want > sizeof(tmp)) want = sizeof(tmp);
if (pbuf_copy_partial(p, tmp, want, off) != want)
break;
rx_put(is, tmp, want);
off = (u16_t)(off + want);
}
}
pbuf_free(p);
net_wake();
return 1; // eaten
}
/* ------------------------------------------------------------------ */
/* Allocation */
/* ------------------------------------------------------------------ */
@ -422,11 +498,13 @@ inet_alloc(int type)
/* ------------------------------------------------------------------ */
void *
inet_new(int type)
inet_new(int type, int proto)
{
if (type != SOCK_STREAM && type != SOCK_DGRAM)
return 0;
if (!net_is_up())
// Ready, not *up*: see net_is_ready() in kernel/net/net.c. Requiring an
// address here made every socket() fail until DHCP answered.
if (!net_is_ready())
return 0;
lwip_sys_lock();
@ -435,8 +513,21 @@ inet_new(int type)
lwip_sys_unlock();
return 0;
}
is->proto = proto;
if (type == SOCK_STREAM) {
if (proto == IPPROTO_ICMP) {
// A ping socket. raw_new registers for one IP protocol number; the
// callback below filters to echo replies so lwIP keeps answering the
// requests this host receives. See inet_icmp_recv_cb.
is->rpcb = raw_new(IP_PROTO_ICMP);
if (is->rpcb == 0) {
is->inuse = 0;
lwip_sys_unlock();
return 0;
}
raw_recv(is->rpcb, inet_icmp_recv_cb, is);
raw_bind(is->rpcb, IP_ANY_TYPE);
} else if (type == SOCK_STREAM) {
is->tpcb = tcp_new();
if (is->tpcb == 0) {
is->inuse = 0;
@ -480,6 +571,58 @@ inet_bind(void *h, uint32 addr, uint16 port)
return e == ERR_OK ? 0 : -EINVAL;
}
// Apply a socket option to the lwIP pcb behind this handle.
//
// Only the four that lwIP can genuinely honour. Everything else is refused by
// the caller (kernel/sys/sys_net.c) before it reaches here, so this never has
// to pretend.
//
// Called with the option already recorded on the struct socket, so a flag set
// before bind() is not lost: lwIP's pcb exists from inet_new() onwards, which
// is early enough for all four, but recording it there as well means
// getsockopt has one answer and not two.
int
inet_setopt(void *h, int level, int name, int val)
{
struct inet_sock *is = h;
lwip_sys_lock();
if (level == SOL_SOCKET) {
struct ip_pcb *p = (is->type == SOCK_STREAM) ? (struct ip_pcb *)is->tpcb
: (struct ip_pcb *)is->upcb;
if (p == 0) { lwip_sys_unlock(); return -EINVAL; }
switch (name) {
case SO_REUSEADDR:
if (val) ip_set_option(p, SOF_REUSEADDR);
else ip_reset_option(p, SOF_REUSEADDR);
break;
case SO_KEEPALIVE:
if (val) ip_set_option(p, SOF_KEEPALIVE);
else ip_reset_option(p, SOF_KEEPALIVE);
break;
case SO_BROADCAST:
if (val) ip_set_option(p, SOF_BROADCAST);
else ip_reset_option(p, SOF_BROADCAST);
break;
default:
lwip_sys_unlock();
return -ENOPROTOOPT;
}
} else if (level == IPPROTO_TCP && name == TCP_NODELAY) {
if (is->type != SOCK_STREAM || is->tpcb == 0) {
lwip_sys_unlock();
return -EINVAL;
}
if (val) tcp_nagle_disable(is->tpcb);
else tcp_nagle_enable(is->tpcb);
} else {
lwip_sys_unlock();
return -ENOPROTOOPT;
}
lwip_sys_unlock();
return 0;
}
int
inet_listen(void *h, int backlog)
{
@ -653,6 +796,38 @@ inet_sendto(void *h, char *buf, int n, uint addr, ushort port)
if (n <= 0)
return 0;
// ICMP. The caller hands over the ICMP message alone -- header, checksum and
// payload -- and lwIP puts the IP header on the front, which is what makes
// this a ping socket rather than a raw one.
//
// PBUF_IP rather than PBUF_TRANSPORT for the headroom: the IP header is what
// goes in front here, and asking for transport headroom would have lwIP
// reallocate to make room for it.
if (is->proto == IPPROTO_ICMP) {
if (is->rpcb == 0)
return -ENOTCONN;
if (addr == 0)
return -EDESTADDRREQ;
lwip_sys_lock();
struct pbuf *p = pbuf_alloc(PBUF_IP, (u16_t)n, PBUF_RAM);
if (p == 0) {
lwip_sys_unlock();
return -ENOBUFS;
}
pbuf_take(p, buf, (u16_t)n);
ip_addr_t ip;
ip_addr_set_ip4_u32(&ip, addr);
err_t e = raw_sendto(is->rpcb, p, &ip);
pbuf_free(p);
lwip_sys_unlock();
if (e == ERR_OK)
return n;
return e == ERR_RTE ? -ENETUNREACH : -EIO;
}
if (is->type == SOCK_DGRAM) {
lwip_sys_lock();
struct pbuf *p = pbuf_alloc(PBUF_TRANSPORT, (u16_t)n, PBUF_RAM);
@ -793,6 +968,11 @@ inet_close(void *h)
udp_remove(is->upcb);
is->upcb = 0;
}
if (is->rpcb) {
raw_recv(is->rpcb, 0, 0);
raw_remove(is->rpcb);
is->rpcb = 0;
}
is->inuse = 0;
lwip_sys_unlock();
}

12
kernel/net/lwip/lwipopts.h
View file

@ -49,6 +49,18 @@
#define LWIP_ETHERNET 1
#define LWIP_ICMP 1
#define LWIP_RAW 1
// A loopback interface, so 127.0.0.1 is a real destination rather than an
// address with no route. lwip_init() creates it; nothing else has to.
//
// LWIP_NETIF_LOOPBACK is the other half and is easy to miss: without it a
// packet addressed to an interface's *own* address goes out of the wire and
// never comes back. With NO_SYS=1 there is no thread to drain the loopback
// queue either, so netif_poll_all() is called from the network thread -- see
// kernel/net/net.c.
#define LWIP_HAVE_LOOPIF 1
#define LWIP_NETIF_LOOPBACK 1
#define LWIP_LOOPBACK_MAX_PBUFS 8
#define LWIP_UDP 1
#define LWIP_TCP 1
#define LWIP_DHCP 1

1
kernel/net/lwip/shim/string.h
View file

@ -25,6 +25,7 @@ int memcmp(const void *, const void *, unsigned long);
void *memmove(void *, const void *, unsigned long);
void *memset(void *, int, unsigned long);
int strlen(const char *);
int strcmp(const char *, const char *);
int strncmp(const char *, const char *, unsigned long);
char *strncpy(char *, const char *, int);

24
kernel/net/net.c
View file

@ -55,12 +55,29 @@ static int net_started;
// something true to say rather than reporting 0.0.0.0 forever.
static int net_bound;
// Set once lwIP is initialised and this thread is running its timers. Distinct
// from net_bound, and the distinction is not academic: inet_new() used to
// require an *address* before it would hand out a socket, so every AF_INET
// socket() failed until DHCP answered -- reported as ENFILE, which sends you to
// look at the file table. It is also simply wrong for 127.0.0.1, which needs no
// lease and no NIC.
//
// Creating a socket is not the same as having somewhere to send: a bind or a
// connect with no route fails on its own, with an error that says so.
static int net_ready;
int
net_is_up(void)
{
return net_bound;
}
int
net_is_ready(void)
{
return net_ready;
}
static void
net_thread(void)
{
@ -69,6 +86,9 @@ net_thread(void)
// before there is a process context means doing it somewhere that cannot
// sleep if the allocator ever needs to.
lwip_sys_init();
// From here a socket can be created: the pools exist and the timers are
// about to run. An address may still be minutes away, or never arrive.
net_ready = 1;
lwip_sys_lock();
lwip_init();
@ -111,6 +131,10 @@ net_thread(void)
lwip_sys_lock();
moved = net_eth_poll();
sys_check_timeouts();
// Loopback has no driver and no interrupt: a packet sent to 127.0.0.1
// sits on the loopif's queue until something drains it. With NO_SYS=1
// that something is this thread.
netif_poll_all();
// Report each address once, when it first arrives. Anyone who has spent
// an evening wondering whether the guest has an address at all wants

86
kernel/net/unix.c
View file

@ -159,6 +159,88 @@ sockdup(struct socket *s)
release(&stab.lock);
}
// ---------------------------------------------------------------------------
// Socket options
//
// Only the options that are genuinely honoured appear here; everything else is
// answered ENOPROTOOPT by the switch's default. That is deliberate and it is a
// change of policy: both calls used to succeed unconditionally, which is the
// worst of the three possible answers. A caller told "no" adapts; a caller told
// "yes" falsely proceeds on the strength of it -- setting SO_RCVTIMEO and then
// blocking forever in a read it believes will time out.
//
// The flags are recorded here as well as pushed into lwIP so that getsockopt
// has one answer rather than two, and so that an AF_UNIX socket -- which has no
// pcb and for which none of these mean anything -- can still give back what was
// set, as POSIX requires.
int
sockopt_set(struct socket *s, int level, int name, int val)
{
int r = 0;
acquire(&stab.lock);
if (level == SOL_SOCKET) {
switch (name) {
case SO_REUSEADDR: s->o_reuseaddr = !!val; break;
case SO_KEEPALIVE: s->o_keepalive = !!val; break;
case SO_BROADCAST: s->o_broadcast = !!val; break;
// Accepted and left at the size we have. Not the same lie as before:
// Linux is explicitly free to clamp these, and sockopt_get below reports
// the real figure rather than the requested one.
case SO_SNDBUF:
case SO_RCVBUF: release(&stab.lock); return 0;
default: release(&stab.lock); return -ENOPROTOOPT;
}
} else if (level == IPPROTO_TCP && name == TCP_NODELAY) {
if (s->type != SOCK_STREAM) { release(&stab.lock); return -EINVAL; }
s->o_nodelay = !!val;
} else {
release(&stab.lock);
return -ENOPROTOOPT;
}
int inet = (s->domain == AF_INET);
void *h = s->inet;
release(&stab.lock);
// Outside the table lock: inet_setopt takes the lwIP lock, which is a
// sleeplock, and the same ordering rule the rest of this file follows.
if (inet && h)
r = inet_setopt(h, level, name, val);
return r;
}
int
sockopt_get(struct socket *s, int level, int name, int *out)
{
int r = 0;
acquire(&stab.lock);
if (level == IPPROTO_TCP && name == TCP_NODELAY) {
*out = s->o_nodelay;
} else if (level != SOL_SOCKET) {
r = -ENOPROTOOPT;
} else {
switch (name) {
case SO_TYPE: *out = s->type; break;
case SO_ACCEPTCONN: *out = (s->state == SS_LISTENING); break;
case SO_REUSEADDR: *out = s->o_reuseaddr; break;
case SO_KEEPALIVE: *out = s->o_keepalive; break;
case SO_BROADCAST: *out = s->o_broadcast; break;
// The real buffer, not a number somebody asked for.
case SO_SNDBUF:
case SO_RCVBUF: *out = SOCKBUF; break;
// An honest zero rather than the blanket one it replaces: connect() here
// is blocking and reports failure as its own return value, so there is no
// deferred error for SO_ERROR to carry. It becomes a real field the day a
// non-blocking connect exists.
case SO_ERROR: *out = 0; break;
default: r = -ENOPROTOOPT; break;
}
}
release(&stab.lock);
return r;
}
const char *
sockname(struct socket *s)
{
@ -254,7 +336,7 @@ sockwrite(struct socket *s, char *addr, int n)
// ---------------------------------------------------------------------------
struct socket *
socknew(int domain, int type)
socknew(int domain, int type, int proto)
{
struct socket *s;
@ -276,7 +358,7 @@ socknew(int domain, int type)
if(domain == AF_INET){
// Outside the table lock: inet_new takes the lwIP lock, which is a
// sleeplock, and sleeping while holding a spinlock is a panic.
s->inet = inet_new(type);
s->inet = inet_new(type, proto);
if(s->inet == 0){
sockclose(s);
return 0;

177
kernel/sys/sys_net.c
View file

@ -67,8 +67,22 @@ fetch_sun_path(addr_t uaddr, int ulen, char *out)
// Wrap an established socket in a file and a descriptor. Consumes the
// socket's reference on success; on failure the caller still owns it.
//
// `sflags` carries SOCK_CLOEXEC and SOCK_NONBLOCK, which socket(), socketpair()
// and accept4() all take and all used to discard.
//
// Discarding them is not harmless in either direction. A dropped SOCK_CLOEXEC
// leaks the descriptor across every exec the process makes -- so a server that
// forks a child holds its listening socket open in it, and the port stays bound
// after the server dies. A dropped SOCK_NONBLOCK is worse: the caller believes
// it has a non-blocking socket, does not select() first, and blocks forever in
// what it thinks is a poll loop.
//
// Both are one line each, and they were masked off with a comment saying they
// were not honoured -- which is exactly the class of quiet lie the rest of this
// file has just been cleaned of.
static int
sock_to_fd(struct socket *s)
sock_to_fd(struct socket *s, int sflags)
{
struct file *f;
int fd;
@ -84,6 +98,9 @@ sock_to_fd(struct socket *s)
f->readable = 1;
f->writable = 1;
f->off = 0;
f->nonblock = (sflags & SOCK_NONBLOCK) != 0;
if (sflags & SOCK_CLOEXEC)
myproc()->ofile_flags[fd] |= FD_CLOEXEC;
return fd;
}
@ -117,21 +134,40 @@ SYSCALL_DEFINE(socket)
if (domain != AF_UNIX && domain != AF_INET)
return -EAFNOSUPPORT;
// SOCK_CLOEXEC / SOCK_NONBLOCK ride in the high bits of `type`. Neither
// is honoured yet, but masking them off means a musl program that always
// sets SOCK_CLOEXEC still gets a socket instead of EINVAL.
// SOCK_CLOEXEC / SOCK_NONBLOCK ride in the high bits of `type`. Split them
// off rather than discarding them: the type check below wants the low byte,
// and sock_to_fd wants the flags.
int sflags = type & (SOCK_CLOEXEC | SOCK_NONBLOCK);
if (type & ~(0xFF | SOCK_CLOEXEC | SOCK_NONBLOCK))
return -EINVAL;
type &= 0xFF;
if (domain == AF_UNIX && type != SOCK_STREAM)
return -EPROTOTYPE;
if (domain == AF_INET && type != SOCK_STREAM && type != SOCK_DGRAM)
return -EPROTOTYPE;
if (protocol != 0)
return -EPROTONOSUPPORT;
if ((s = socknew(domain, type)) == 0)
// Protocol 0 means "the default for this type". The one non-default we
// support is a ping socket -- SOCK_DGRAM with IPPROTO_ICMP, Linux's way of
// letting an unprivileged process do the one thing raw sockets were used
// for. Anything else is still refused rather than quietly given a socket
// that speaks a different protocol than the caller asked for.
if (protocol != 0) {
if (!(domain == AF_INET && type == SOCK_DGRAM &&
protocol == IPPROTO_ICMP))
return -EPROTONOSUPPORT;
}
// ENETDOWN rather than ENFILE when the stack itself is not running: the
// old blanket ENFILE said "file table overflow" for a machine with no
// network, which is a long way from the truth and a longer way from the
// fix.
if (domain == AF_INET && !net_is_ready())
return -ENETDOWN;
if ((s = socknew(domain, type, protocol)) == 0)
return -ENFILE;
if ((fd = sock_to_fd(s)) < 0) {
if ((fd = sock_to_fd(s, sflags)) < 0) {
sockclose(s);
return fd;
}
@ -229,7 +265,16 @@ SYSCALL_DEFINE(connect)
return sockconnect(s, path);
}
SYSCALL_DEFINE(accept)
// accept(2) and accept4(2) share everything but the flags word.
//
// They are two table entries rather than one with an alias, and the reason is
// the argument count: accept takes three, so a handler that read a fourth
// register would be reading whatever the caller happened to leave there and
// would invent a SOCK_NONBLOCK out of stack litter. That is precisely the bug
// the old `SYSCALL_ALIAS(288, accept)` would have grown the moment the flags
// started being honoured.
static addr_t
do_accept(int sflags)
{
struct socket *s, *c;
addr_t uaddr, ulenp;
@ -243,7 +288,7 @@ SYSCALL_DEFINE(accept)
if ((c = sockaccept(s)) == 0)
return -EINVAL;
if ((fd = sock_to_fd(c)) < 0) {
if ((fd = sock_to_fd(c, sflags)) < 0) {
sockclose(c);
return fd;
}
@ -273,6 +318,18 @@ SYSCALL_DEFINE(accept)
return fd;
}
SYSCALL_DEFINE(accept) { return do_accept(0); }
SYSCALL_DEFINE(accept4)
{
int flags = 0;
argint(3, &flags);
if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
return -EINVAL;
return do_accept(flags);
}
SYSCALL_DEFINE(socketpair)
{
int domain, type, protocol;
@ -287,6 +344,7 @@ SYSCALL_DEFINE(socketpair)
if (domain != AF_UNIX)
return -EAFNOSUPPORT;
int sflags = type & (SOCK_CLOEXEC | SOCK_NONBLOCK);
type &= 0xFF;
if (type != SOCK_STREAM)
return -EPROTOTYPE;
@ -294,12 +352,12 @@ SYSCALL_DEFINE(socketpair)
if ((r = sockpair(&a, &b)) < 0)
return r;
if ((fd0 = sock_to_fd(a)) < 0) {
if ((fd0 = sock_to_fd(a, sflags)) < 0) {
sockclose(a);
sockclose(b);
return fd0;
}
if ((fd1 = sock_to_fd(b)) < 0) {
if ((fd1 = sock_to_fd(b, sflags)) < 0) {
myproc()->ofile[fd0] = 0;
sockclose(a);
sockclose(b);
@ -431,23 +489,90 @@ SYSCALL_DEFINE(sockshutdown)
return sock_shutdown(s, how);
}
// getsockopt/setsockopt: accepted and ignored. A server that sets SO_REUSEADDR
// and treats failure as fatal is common enough to be worth not failing.
SYSCALL_DEFINE(setsockopt) { return 0; }
// setsockopt / getsockopt.
//
// These both used to succeed unconditionally -- setsockopt was `return 0;` and
// getsockopt wrote a zero for every option asked about. The comment said it was
// so that a server setting SO_REUSEADDR and treating failure as fatal would not
// fail.
//
// That trade is the wrong way round, and it is worth being precise about why,
// because "accept and ignore" looks like the kind thing to do. A caller that
// gets ENOPROTOOPT knows the option did not take effect and can decide what to
// do. A caller that gets success *changes its behaviour on the strength of it*:
// it sets SO_RCVTIMEO and then blocks forever in a read it believes will time
// out; it sets TCP_NODELAY and reports latency numbers that measure Nagle. The
// failure is silent, remote from the call, and indistinguishable from a bug in
// the protocol stack.
//
// So the rule here is the one the rest of this kernel already follows: do it,
// or say you did not. The four options below are genuinely applied to lwIP's
// pcb; the readable ones report the truth; everything else is ENOPROTOOPT.
//
// SO_REUSEADDR is honoured rather than refused precisely because of the
// original comment's concern -- it is the one option a server really does set
// and really does check.
// Fetch the int a setsockopt call is passing. Every option handled here is an
// int; anything wanting a struct (SO_RCVTIMEO and friends) is refused above.
static int
opt_in(addr_t uval, int ulen, int *out)
{
if (!uval || ulen < (int)sizeof(int))
return -EINVAL;
return get_user(*out, uval) < 0 ? -EFAULT : 0;
}
// Hand one int back, and report how many bytes that was.
static int
opt_out(addr_t uval, addr_t ulenp, int val)
{
int want = 0;
if (!uval || !ulenp)
return -EFAULT;
if (get_user(want, ulenp) < 0)
return -EFAULT;
if (want < (int)sizeof(int))
return -EINVAL;
if (put_user(val, uval) < 0)
return -EFAULT;
want = sizeof(int);
return put_user(want, ulenp) < 0 ? -EFAULT : 0;
}
SYSCALL_DEFINE(setsockopt)
{
struct socket *s;
addr_t uval;
int level, name, ulen, val, r;
if ((r = argsock(0, &s)) < 0)
return r;
argint(1, &level);
argint(2, &name);
argaddr(3, &uval);
argint(4, &ulen);
if ((r = opt_in(uval, ulen, &val)) < 0)
return r;
return sockopt_set(s, level, name, val);
}
SYSCALL_DEFINE(getsockopt)
{
addr_t uval, ulen;
int zero = 0, len = 0;
struct socket *s;
addr_t uval, ulenp;
int level, name, val = 0, r;
if ((r = argsock(0, &s)) < 0)
return r;
argint(1, &level);
argint(2, &name);
argaddr(3, &uval);
argaddr(4, &ulen);
if (uval && ulen) {
if (get_user(len, ulen) == 0 && len >= (int)sizeof(int)) {
put_user(zero, uval);
len = sizeof(int);
put_user(len, ulen);
}
}
return 0;
argaddr(4, &ulenp);
if ((r = sockopt_get(s, level, name, &val)) < 0)
return r;
return opt_out(uval, ulenp, val);
}

9
kernel/sys/table.inc
View file

@ -134,6 +134,12 @@ SYSCALL(189, 48, sockshutdown)
SYSCALL(190, 53, socketpair)
SYSCALL(191, 54, setsockopt)
SYSCALL(192, 55, getsockopt)
// accept4() differs from accept() only by a flags argument carrying
// SOCK_CLOEXEC/SOCK_NONBLOCK. It was an alias for accept, which silently
// dropped both -- and it cannot be an alias now that they are honoured: accept
// takes three arguments, so reading a fourth register from an accept() caller
// reads whatever it last left there and invents a flag out of stack litter.
SYSCALL(198, 288, accept4)
// --- time ---
SYSCALL( 28, 37, alarm)
@ -288,6 +294,3 @@ SYSCALL_ALIAS( 289, signalfd4)
SYSCALL_ALIAS( 290, eventfd2)
SYSCALL_ALIAS( 295, readv)
SYSCALL_ALIAS( 296, writev)
// accept4() differs from accept() only in a flags argument naming
// SOCK_CLOEXEC/SOCK_NONBLOCK, neither of which is honoured yet.
SYSCALL_ALIAS( 288, accept)

1
lib/usys.S
View file

@ -100,6 +100,7 @@ SYSCALL(socket)
SYSCALL(bind)
SYSCALL(listen)
SYSCALL(accept)
SYSCALL(accept4)
SYSCALL(connect)
SYSCALL(sendto)
SYSCALL(recvfrom)