nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

net: the socket layer stops saying yes to things it did not do, and ping works

Browse source 
setsockopt was `return 0;` and getsockopt wrote a zero for whatever was asked.
The comment said it was so a server setting SO_REUSEADDR and treating failure as
fatal would not fail. That trade is the wrong way round: a caller told "no"
adapts, a caller told "yes" changes its behaviour on the strength of it -- sets
SO_RCVTIMEO and then blocks forever in a read it believes will time out, sets
TCP_NODELAY and reports latency numbers that measure Nagle. The failure is
silent, remote from the call, and indistinguishable from a bug in the stack.

Six options are honoured now and everything else is ENOPROTOOPT. SO_REUSEADDR,
SO_KEEPALIVE, SO_BROADCAST and TCP_NODELAY reach lwIP's pcb; SO_SNDBUF/SO_RCVBUF
are accepted and report the real size on read. SO_REUSEADDR is implemented rather
than refused precisely because of the original comment's concern -- it is the one
option a server really does set and really does check.

accept4 becomes its own table entry rather than an alias for accept. It has to
be: accept takes three arguments, so a shared handler reading a fourth register
reads whatever the caller last left there and invents a SOCK_NONBLOCK out of
stack litter. SOCK_CLOEXEC and SOCK_NONBLOCK are now honoured by socket(),
socketpair() and accept4() -- a dropped CLOEXEC leaks a listening socket across
every exec, and a dropped NONBLOCK has the caller block forever in what it
believes is a poll loop.

ICMP ping sockets: socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP), on lwIP's raw API,
with the callback stripping the variable-length IP header. Only echo replies are
eaten, and that restriction is load-bearing -- raw_input runs before lwIP's own
icmp_input, so consuming every ICMP message would swallow the echo *requests* and
this machine would silently stop answering pings from outside.

Loopback, so 127.0.0.1 is a real destination. LWIP_NETIF_LOOPBACK is the half
that is easy to miss: without it a packet addressed to an interface's own address
goes out of the wire and never comes back. With NO_SYS=1 nothing drains the
loopback queue, so the network thread calls netif_poll_all().

cmd/ping is first-party rather than toybox's, and the reason is a limitation not
a preference: toybox reads replies with recvmsg(2) and wants the TTL through an
IP_RECVTTL control message, and SchOS has neither. recvmsg is item 1 of
docs/plan/foundations.md, where it is wanted for SCM_RIGHTS anyway, and should
not be rushed to make one applet run.

Two bugs found on the way. Every AF_INET socket failed with ENFILE until DHCP
bound, because inet_new() demanded an *address* before handing out a socket and
reported it as "file table overflow"; net_is_ready() (lwIP up) is now distinct
from net_is_up() (DHCP bound). And that bug was hiding a bad test: socktest
asserted "AF_INET is refused, not faked", true when written, false since AF_INET
landed, and green the whole time because the suite runs before DHCP binds and the
ENFILE made the refusal look real. Fixing the kernel is what turned it red.

Verified: ping to 127.0.0.1, localhost, the gateway, 1.1.1.1 and 9.9.9.9, all
0% loss; socktest ALL CHECKS PASSED with ten new checks, including a setsockopt
round trip and an unknown option that must be refused -- a permissive stub cannot
pass both at once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-12 17:14:35 +02:00
commit c362e308d0
13 changed files with 903 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

186
kernel/net/inet.c
View file

@ -62,6 +62,9 @@
#include "lwip/opt.h"
#include "lwip/tcp.h"
#include "lwip/udp.h"
#include "lwip/raw.h"
#include "lwip/icmp.h"
#include "lwip/prot/ip4.h"
#include "lwip/ip_addr.h"
#include "lwip/pbuf.h"
@ -84,9 +87,11 @@ struct dgram {
struct inet_sock {
int inuse;
int type; // SOCK_STREAM or SOCK_DGRAM
int proto; // 0, or IPPROTO_ICMP for a ping socket
struct tcp_pcb *tpcb;
struct udp_pcb *upcb;
struct raw_pcb *rpcb; // SOCK_DGRAM + IPPROTO_ICMP
// Receive ring. lwIP hands over pbufs from the network thread; a reader
// drains bytes. Full means the sender is told to back off, which for TCP is
@ -399,6 +404,77 @@ inet_udp_recv_cb(void *arg, struct udp_pcb *pcb, struct pbuf *p,
net_wake();
}
// ICMP, for ping sockets.
//
// Linux calls these "ping sockets": SOCK_DGRAM with IPPROTO_ICMP, giving an
// unprivileged process the one thing raw sockets were used for. The contract is
// that the caller reads and writes the ICMP message alone, and the kernel deals
// with the IP header -- which is why this strips it on the way in, where
// lwIP's raw layer hands over a pbuf that starts at the IP header.
//
// **Only echo replies are eaten.** raw_input runs before lwIP's own
// icmp_input, so a callback that returned 1 for everything would swallow the
// echo *requests* too and this machine would silently stop answering pings
// from outside. Returning 0 leaves the packet for lwIP, which is exactly what
// should happen to every ICMP message we did not ask for.
//
// No matching against the echo id: a reply goes to every open ICMP socket.
// Linux rewrites the id per socket and filters on it, which matters when two
// processes ping at once; with one ping at a time the difference is invisible,
// and a socket that sees a reply to somebody else's request will read a
// sequence number it never sent and ignore it.
static u8_t
inet_icmp_recv_cb(void *arg, struct raw_pcb *pcb, struct pbuf *p,
const ip_addr_t *addr)
{
struct inet_sock *is = arg;
(void)pcb;
if (is == 0 || p == NULL)
return 0;
// The IP header is variable length: IHL counts 32-bit words.
if (p->tot_len < sizeof(struct ip_hdr))
return 0;
struct ip_hdr *ih = (struct ip_hdr *)p->payload;
u16_t hlen = (u16_t)(IPH_HL(ih) * 4);
if (hlen < sizeof(struct ip_hdr) || p->tot_len < hlen + 8)
return 0;
// Type 0 is ICMP Echo Reply. Everything else -- including the requests this
// host must keep answering -- is left for lwIP.
u8_t type;
if (pbuf_copy_partial(p, &type, 1, hlen) != 1 || type != 0)
return 0;
u16_t icmplen = (u16_t)(p->tot_len - hlen);
if (icmplen <= rx_space(is) && dq_used(is) < NDGRAM) {
struct dgram *d = &is->dq[is->dhead % NDGRAM];
d->addr = addr ? ip4_addr_get_u32(ip_2_ip4(addr)) : 0;
d->port = 0; // ICMP has no ports
d->len = icmplen;
is->dhead++;
// Copy the ICMP message out, skipping the IP header, across whatever pbuf
// chain it arrived in.
u16_t off = hlen;
while (off < p->tot_len) {
char tmp[64];
u16_t want = (u16_t)(p->tot_len - off);
if (want > sizeof(tmp)) want = sizeof(tmp);
if (pbuf_copy_partial(p, tmp, want, off) != want)
break;
rx_put(is, tmp, want);
off = (u16_t)(off + want);
}
}
pbuf_free(p);
net_wake();
return 1; // eaten
}
/* ------------------------------------------------------------------ */
/* Allocation */
/* ------------------------------------------------------------------ */
@ -422,11 +498,13 @@ inet_alloc(int type)
/* ------------------------------------------------------------------ */
void *
inet_new(int type)
inet_new(int type, int proto)
{
if (type != SOCK_STREAM && type != SOCK_DGRAM)
return 0;
if (!net_is_up())
// Ready, not *up*: see net_is_ready() in kernel/net/net.c. Requiring an
// address here made every socket() fail until DHCP answered.
if (!net_is_ready())
return 0;
lwip_sys_lock();
@ -435,8 +513,21 @@ inet_new(int type)
lwip_sys_unlock();
return 0;
}
is->proto = proto;
if (type == SOCK_STREAM) {
if (proto == IPPROTO_ICMP) {
// A ping socket. raw_new registers for one IP protocol number; the
// callback below filters to echo replies so lwIP keeps answering the
// requests this host receives. See inet_icmp_recv_cb.
is->rpcb = raw_new(IP_PROTO_ICMP);
if (is->rpcb == 0) {
is->inuse = 0;
lwip_sys_unlock();
return 0;
}
raw_recv(is->rpcb, inet_icmp_recv_cb, is);
raw_bind(is->rpcb, IP_ANY_TYPE);
} else if (type == SOCK_STREAM) {
is->tpcb = tcp_new();
if (is->tpcb == 0) {
is->inuse = 0;
@ -480,6 +571,58 @@ inet_bind(void *h, uint32 addr, uint16 port)
return e == ERR_OK ? 0 : -EINVAL;
}
// Apply a socket option to the lwIP pcb behind this handle.
//
// Only the four that lwIP can genuinely honour. Everything else is refused by
// the caller (kernel/sys/sys_net.c) before it reaches here, so this never has
// to pretend.
//
// Called with the option already recorded on the struct socket, so a flag set
// before bind() is not lost: lwIP's pcb exists from inet_new() onwards, which
// is early enough for all four, but recording it there as well means
// getsockopt has one answer and not two.
int
inet_setopt(void *h, int level, int name, int val)
{
struct inet_sock *is = h;
lwip_sys_lock();
if (level == SOL_SOCKET) {
struct ip_pcb *p = (is->type == SOCK_STREAM) ? (struct ip_pcb *)is->tpcb
: (struct ip_pcb *)is->upcb;
if (p == 0) { lwip_sys_unlock(); return -EINVAL; }
switch (name) {
case SO_REUSEADDR:
if (val) ip_set_option(p, SOF_REUSEADDR);
else ip_reset_option(p, SOF_REUSEADDR);
break;
case SO_KEEPALIVE:
if (val) ip_set_option(p, SOF_KEEPALIVE);
else ip_reset_option(p, SOF_KEEPALIVE);
break;
case SO_BROADCAST:
if (val) ip_set_option(p, SOF_BROADCAST);
else ip_reset_option(p, SOF_BROADCAST);
break;
default:
lwip_sys_unlock();
return -ENOPROTOOPT;
}
} else if (level == IPPROTO_TCP && name == TCP_NODELAY) {
if (is->type != SOCK_STREAM || is->tpcb == 0) {
lwip_sys_unlock();
return -EINVAL;
}
if (val) tcp_nagle_disable(is->tpcb);
else tcp_nagle_enable(is->tpcb);
} else {
lwip_sys_unlock();
return -ENOPROTOOPT;
}
lwip_sys_unlock();
return 0;
}
int
inet_listen(void *h, int backlog)
{
@ -653,6 +796,38 @@ inet_sendto(void *h, char *buf, int n, uint addr, ushort port)
if (n <= 0)
return 0;
// ICMP. The caller hands over the ICMP message alone -- header, checksum and
// payload -- and lwIP puts the IP header on the front, which is what makes
// this a ping socket rather than a raw one.
//
// PBUF_IP rather than PBUF_TRANSPORT for the headroom: the IP header is what
// goes in front here, and asking for transport headroom would have lwIP
// reallocate to make room for it.
if (is->proto == IPPROTO_ICMP) {
if (is->rpcb == 0)
return -ENOTCONN;
if (addr == 0)
return -EDESTADDRREQ;
lwip_sys_lock();
struct pbuf *p = pbuf_alloc(PBUF_IP, (u16_t)n, PBUF_RAM);
if (p == 0) {
lwip_sys_unlock();
return -ENOBUFS;
}
pbuf_take(p, buf, (u16_t)n);
ip_addr_t ip;
ip_addr_set_ip4_u32(&ip, addr);
err_t e = raw_sendto(is->rpcb, p, &ip);
pbuf_free(p);
lwip_sys_unlock();
if (e == ERR_OK)
return n;
return e == ERR_RTE ? -ENETUNREACH : -EIO;
}
if (is->type == SOCK_DGRAM) {
lwip_sys_lock();
struct pbuf *p = pbuf_alloc(PBUF_TRANSPORT, (u16_t)n, PBUF_RAM);
@ -793,6 +968,11 @@ inet_close(void *h)
udp_remove(is->upcb);
is->upcb = 0;
}
if (is->rpcb) {
raw_recv(is->rpcb, 0, 0);
raw_remove(is->rpcb);
is->rpcb = 0;
}
is->inuse = 0;
lwip_sys_unlock();
}