net: the socket layer stops saying yes to things it did not do, and ping works

setsockopt was `return 0;` and getsockopt wrote a zero for whatever was asked.
The comment said it was so a server setting SO_REUSEADDR and treating failure as
fatal would not fail. That trade is the wrong way round: a caller told "no"
adapts, a caller told "yes" changes its behaviour on the strength of it -- sets
SO_RCVTIMEO and then blocks forever in a read it believes will time out, sets
TCP_NODELAY and reports latency numbers that measure Nagle. The failure is
silent, remote from the call, and indistinguishable from a bug in the stack.

Six options are honoured now and everything else is ENOPROTOOPT. SO_REUSEADDR,
SO_KEEPALIVE, SO_BROADCAST and TCP_NODELAY reach lwIP's pcb; SO_SNDBUF/SO_RCVBUF
are accepted and report the real size on read. SO_REUSEADDR is implemented rather
than refused precisely because of the original comment's concern -- it is the one
option a server really does set and really does check.

accept4 becomes its own table entry rather than an alias for accept. It has to
be: accept takes three arguments, so a shared handler reading a fourth register
reads whatever the caller last left there and invents a SOCK_NONBLOCK out of
stack litter. SOCK_CLOEXEC and SOCK_NONBLOCK are now honoured by socket(),
socketpair() and accept4() -- a dropped CLOEXEC leaks a listening socket across
every exec, and a dropped NONBLOCK has the caller block forever in what it
believes is a poll loop.

ICMP ping sockets: socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP), on lwIP's raw API,
with the callback stripping the variable-length IP header. Only echo replies are
eaten, and that restriction is load-bearing -- raw_input runs before lwIP's own
icmp_input, so consuming every ICMP message would swallow the echo *requests* and
this machine would silently stop answering pings from outside.

Loopback, so 127.0.0.1 is a real destination. LWIP_NETIF_LOOPBACK is the half
that is easy to miss: without it a packet addressed to an interface's own address
goes out of the wire and never comes back. With NO_SYS=1 nothing drains the
loopback queue, so the network thread calls netif_poll_all().

cmd/ping is first-party rather than toybox's, and the reason is a limitation not
a preference: toybox reads replies with recvmsg(2) and wants the TTL through an
IP_RECVTTL control message, and SchOS has neither. recvmsg is item 1 of
docs/plan/foundations.md, where it is wanted for SCM_RIGHTS anyway, and should
not be rushed to make one applet run.

Two bugs found on the way. Every AF_INET socket failed with ENFILE until DHCP
bound, because inet_new() demanded an *address* before handing out a socket and
reported it as "file table overflow"; net_is_ready() (lwIP up) is now distinct
from net_is_up() (DHCP bound). And that bug was hiding a bad test: socktest
asserted "AF_INET is refused, not faked", true when written, false since AF_INET
landed, and green the whole time because the suite runs before DHCP binds and the
ENFILE made the refusal look real. Fixing the kernel is what turned it red.

Verified: ping to 127.0.0.1, localhost, the gateway, 1.1.1.1 and 9.9.9.9, all
0% loss; socktest ALL CHECKS PASSED with ten new checks, including a setsockopt
round trip and an unknown option that must be refused -- a permissive stub cannot
pass both at once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

cmd/socktest/main.c

@@ -150,7 +150,23 @@ test_errors(void)
           "connect() to a name nobody bound fails");
     close(s);
 
-    check(socket(AF_INET, SOCK_STREAM, 0) < 0, "AF_INET is refused, not faked");
+    // This used to assert that AF_INET was *refused*, which was true when this
+    // file was written and stopped being true the day AF_INET landed. It kept
+    // passing anyway, and the reason is worth keeping: socktest runs seconds
+    // after boot, DHCP had not bound yet, and inet_new() refused every socket
+    // until it did -- reported as ENFILE. So the check saw "< 0" and called it
+    // a pass for a reason that had nothing to do with what it was testing.
+    //
+    // Two lessons, both already written down elsewhere in this tree and both
+    // learned again here: a test that asserts a *failure* has to say which
+    // failure, and a green suite is not evidence until something has checked
+    // that it can go red.
+    //
+    // What is left are the refusals that are unconditionally true, whatever the
+    // link is doing.
+    check(socket(99, SOCK_STREAM, 0) < 0, "an unknown address family is refused");
+    check(socket(AF_INET, SOCK_STREAM, 99) < 0,
+          "AF_INET with a nonsense protocol is refused");
     check(socket(AF_UNIX, SOCK_DGRAM, 0) < 0, "SOCK_DGRAM is refused, not faked");
 
     // read/write on a plain file descriptor must not be mistaken for a socket,
@@ -283,6 +299,109 @@ test_big(void)
     check(ok, "and in the right order");
 }
 
+
+// ---------------------------------------------------------------------------
+// Socket options.
+//
+// Both calls used to succeed unconditionally: setsockopt was `return 0;` and
+// getsockopt wrote a zero for whatever was asked. So the only check that proves
+// anything is a *round trip* -- set a value, read it back, and see the value
+// rather than a zero -- plus one option that must be refused. A stub passes
+// "does setsockopt return 0"; it cannot pass both of these at once.
+// ---------------------------------------------------------------------------
+
+#define T_SOL_SOCKET   1
+#define T_SO_REUSEADDR 2
+#define T_SO_TYPE      3
+#define T_SO_RCVBUF    8
+#define T_SO_NOSUCH    0x7ffe        // not an option Linux defines either
+
+static void
+test_sockopt(void)
+{
+    int fd = socket(AF_UNIX, SOCK_STREAM, 0);
+    int val, len;
+
+    puts_("-- socket options\n");
+    if (fd < 0) { check(0, "socket()"); return; }
+
+    // SO_TYPE must report what this socket actually is, not zero.
+    val = -1; len = sizeof(val);
+    check(getsockopt(fd, T_SOL_SOCKET, T_SO_TYPE, &val, &len) == 0 &&
+          val == SOCK_STREAM, "getsockopt SO_TYPE says SOCK_STREAM");
+
+    // The round trip. A stub that ignores the set and zeroes the get fails here.
+    val = 1;
+    check(setsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, sizeof(val)) == 0,
+          "setsockopt SO_REUSEADDR accepted");
+    val = -1; len = sizeof(val);
+    check(getsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, &len) == 0 &&
+          val == 1, "getsockopt SO_REUSEADDR reads back 1");
+
+    // And back off again, so the answer is not just "always non-zero".
+    val = 0;
+    setsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, sizeof(val));
+    val = -1; len = sizeof(val);
+    check(getsockopt(fd, T_SOL_SOCKET, T_SO_REUSEADDR, &val, &len) == 0 &&
+          val == 0, "and reads back 0 once cleared");
+
+    // A real buffer size, not zero.
+    val = -1; len = sizeof(val);
+    check(getsockopt(fd, T_SOL_SOCKET, T_SO_RCVBUF, &val, &len) == 0 && val > 0,
+          "getsockopt SO_RCVBUF is a real size");
+
+    // The refusal. This is the half that a permissive stub cannot fake.
+    val = 1;
+    check(setsockopt(fd, T_SOL_SOCKET, T_SO_NOSUCH, &val, sizeof(val)) < 0,
+          "setsockopt of an unknown option is refused");
+    len = sizeof(val);
+    check(getsockopt(fd, T_SOL_SOCKET, T_SO_NOSUCH, &val, &len) < 0,
+          "getsockopt of an unknown option is refused");
+
+    close(fd);
+}
+
+// ---------------------------------------------------------------------------
+// SOCK_NONBLOCK, end to end.
+//
+// Checking that socket() accepts the flag proves nothing -- it was accepted
+// before, and discarded. What proves it is a read that *returns* on a socket
+// with nothing in it, where a blocking socket would sleep forever.
+// ---------------------------------------------------------------------------
+
+#define T_SOCK_NONBLOCK 0x800
+#define T_F_GETFL       3
+#define T_O_NONBLOCK    04000
+
+static void
+test_nonblock(void)
+{
+    int sv[2];
+    char c;
+
+    puts_("-- SOCK_NONBLOCK\n");
+
+    if (socketpair(AF_UNIX, SOCK_STREAM | T_SOCK_NONBLOCK, 0, sv) < 0) {
+        check(0, "socketpair(SOCK_NONBLOCK)");
+        return;
+    }
+
+    check((fcntl(sv[0], T_F_GETFL, 0) & T_O_NONBLOCK) != 0,
+          "fcntl(F_GETFL) reports O_NONBLOCK");
+
+    // Nothing has been written, so a blocking read would never return. If this
+    // test hangs, the flag was dropped -- which is exactly what it used to be.
+    check(read(sv[0], &c, 1) < 0, "read on an empty non-blocking socket returns");
+
+    // And it still carries data, so the flag did not break the socket.
+    write(sv[1], "x", 1);
+    c = 0;
+    check(read(sv[0], &c, 1) == 1 && c == 'x', "and still delivers a byte");
+
+    close(sv[0]);
+    close(sv[1]);
+}
+
 int
 main(void)
 {
@@ -293,6 +412,8 @@ main(void)
     test_eof();
     test_socketpair();
     test_big();
+    test_sockopt();
+    test_nonblock();
 
     if (failures == 0)
         puts_("socktest: ALL CHECKS PASSED\n");