nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

net: the socket layer stops saying yes to things it did not do, and ping works

Browse source 
setsockopt was `return 0;` and getsockopt wrote a zero for whatever was asked.
The comment said it was so a server setting SO_REUSEADDR and treating failure as
fatal would not fail. That trade is the wrong way round: a caller told "no"
adapts, a caller told "yes" changes its behaviour on the strength of it -- sets
SO_RCVTIMEO and then blocks forever in a read it believes will time out, sets
TCP_NODELAY and reports latency numbers that measure Nagle. The failure is
silent, remote from the call, and indistinguishable from a bug in the stack.

Six options are honoured now and everything else is ENOPROTOOPT. SO_REUSEADDR,
SO_KEEPALIVE, SO_BROADCAST and TCP_NODELAY reach lwIP's pcb; SO_SNDBUF/SO_RCVBUF
are accepted and report the real size on read. SO_REUSEADDR is implemented rather
than refused precisely because of the original comment's concern -- it is the one
option a server really does set and really does check.

accept4 becomes its own table entry rather than an alias for accept. It has to
be: accept takes three arguments, so a shared handler reading a fourth register
reads whatever the caller last left there and invents a SOCK_NONBLOCK out of
stack litter. SOCK_CLOEXEC and SOCK_NONBLOCK are now honoured by socket(),
socketpair() and accept4() -- a dropped CLOEXEC leaks a listening socket across
every exec, and a dropped NONBLOCK has the caller block forever in what it
believes is a poll loop.

ICMP ping sockets: socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP), on lwIP's raw API,
with the callback stripping the variable-length IP header. Only echo replies are
eaten, and that restriction is load-bearing -- raw_input runs before lwIP's own
icmp_input, so consuming every ICMP message would swallow the echo *requests* and
this machine would silently stop answering pings from outside.

Loopback, so 127.0.0.1 is a real destination. LWIP_NETIF_LOOPBACK is the half
that is easy to miss: without it a packet addressed to an interface's own address
goes out of the wire and never comes back. With NO_SYS=1 nothing drains the
loopback queue, so the network thread calls netif_poll_all().

cmd/ping is first-party rather than toybox's, and the reason is a limitation not
a preference: toybox reads replies with recvmsg(2) and wants the TTL through an
IP_RECVTTL control message, and SchOS has neither. recvmsg is item 1 of
docs/plan/foundations.md, where it is wanted for SCM_RIGHTS anyway, and should
not be rushed to make one applet run.

Two bugs found on the way. Every AF_INET socket failed with ENFILE until DHCP
bound, because inet_new() demanded an *address* before handing out a socket and
reported it as "file table overflow"; net_is_ready() (lwIP up) is now distinct
from net_is_up() (DHCP bound). And that bug was hiding a bad test: socktest
asserted "AF_INET is refused, not faked", true when written, false since AF_INET
landed, and green the whole time because the suite runs before DHCP binds and the
ENFILE made the refusal look real. Fixing the kernel is what turned it red.

Verified: ping to 127.0.0.1, localhost, the gateway, 1.1.1.1 and 9.9.9.9, all
0% loss; socktest ALL CHECKS PASSED with ten new checks, including a setsockopt
round trip and an unknown option that must be refused -- a permissive stub cannot
pass both at once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-12 17:14:35 +02:00
commit c362e308d0
13 changed files with 903 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

177
kernel/sys/sys_net.c
View file

@ -67,8 +67,22 @@ fetch_sun_path(addr_t uaddr, int ulen, char *out)
// Wrap an established socket in a file and a descriptor. Consumes the
// socket's reference on success; on failure the caller still owns it.
//
// `sflags` carries SOCK_CLOEXEC and SOCK_NONBLOCK, which socket(), socketpair()
// and accept4() all take and all used to discard.
//
// Discarding them is not harmless in either direction. A dropped SOCK_CLOEXEC
// leaks the descriptor across every exec the process makes -- so a server that
// forks a child holds its listening socket open in it, and the port stays bound
// after the server dies. A dropped SOCK_NONBLOCK is worse: the caller believes
// it has a non-blocking socket, does not select() first, and blocks forever in
// what it thinks is a poll loop.
//
// Both are one line each, and they were masked off with a comment saying they
// were not honoured -- which is exactly the class of quiet lie the rest of this
// file has just been cleaned of.
static int
sock_to_fd(struct socket *s)
sock_to_fd(struct socket *s, int sflags)
{
struct file *f;
int fd;
@ -84,6 +98,9 @@ sock_to_fd(struct socket *s)
f->readable = 1;
f->writable = 1;
f->off = 0;
f->nonblock = (sflags & SOCK_NONBLOCK) != 0;
if (sflags & SOCK_CLOEXEC)
myproc()->ofile_flags[fd] |= FD_CLOEXEC;
return fd;
}
@ -117,21 +134,40 @@ SYSCALL_DEFINE(socket)
if (domain != AF_UNIX && domain != AF_INET)
return -EAFNOSUPPORT;
// SOCK_CLOEXEC / SOCK_NONBLOCK ride in the high bits of `type`. Neither
// is honoured yet, but masking them off means a musl program that always
// sets SOCK_CLOEXEC still gets a socket instead of EINVAL.
// SOCK_CLOEXEC / SOCK_NONBLOCK ride in the high bits of `type`. Split them
// off rather than discarding them: the type check below wants the low byte,
// and sock_to_fd wants the flags.
int sflags = type & (SOCK_CLOEXEC | SOCK_NONBLOCK);
if (type & ~(0xFF | SOCK_CLOEXEC | SOCK_NONBLOCK))
return -EINVAL;
type &= 0xFF;
if (domain == AF_UNIX && type != SOCK_STREAM)
return -EPROTOTYPE;
if (domain == AF_INET && type != SOCK_STREAM && type != SOCK_DGRAM)
return -EPROTOTYPE;
if (protocol != 0)
return -EPROTONOSUPPORT;
if ((s = socknew(domain, type)) == 0)
// Protocol 0 means "the default for this type". The one non-default we
// support is a ping socket -- SOCK_DGRAM with IPPROTO_ICMP, Linux's way of
// letting an unprivileged process do the one thing raw sockets were used
// for. Anything else is still refused rather than quietly given a socket
// that speaks a different protocol than the caller asked for.
if (protocol != 0) {
if (!(domain == AF_INET && type == SOCK_DGRAM &&
protocol == IPPROTO_ICMP))
return -EPROTONOSUPPORT;
}
// ENETDOWN rather than ENFILE when the stack itself is not running: the
// old blanket ENFILE said "file table overflow" for a machine with no
// network, which is a long way from the truth and a longer way from the
// fix.
if (domain == AF_INET && !net_is_ready())
return -ENETDOWN;
if ((s = socknew(domain, type, protocol)) == 0)
return -ENFILE;
if ((fd = sock_to_fd(s)) < 0) {
if ((fd = sock_to_fd(s, sflags)) < 0) {
sockclose(s);
return fd;
}
@ -229,7 +265,16 @@ SYSCALL_DEFINE(connect)
return sockconnect(s, path);
}
SYSCALL_DEFINE(accept)
// accept(2) and accept4(2) share everything but the flags word.
//
// They are two table entries rather than one with an alias, and the reason is
// the argument count: accept takes three, so a handler that read a fourth
// register would be reading whatever the caller happened to leave there and
// would invent a SOCK_NONBLOCK out of stack litter. That is precisely the bug
// the old `SYSCALL_ALIAS(288, accept)` would have grown the moment the flags
// started being honoured.
static addr_t
do_accept(int sflags)
{
struct socket *s, *c;
addr_t uaddr, ulenp;
@ -243,7 +288,7 @@ SYSCALL_DEFINE(accept)
if ((c = sockaccept(s)) == 0)
return -EINVAL;
if ((fd = sock_to_fd(c)) < 0) {
if ((fd = sock_to_fd(c, sflags)) < 0) {
sockclose(c);
return fd;
}
@ -273,6 +318,18 @@ SYSCALL_DEFINE(accept)
return fd;
}
SYSCALL_DEFINE(accept) { return do_accept(0); }
SYSCALL_DEFINE(accept4)
{
int flags = 0;
argint(3, &flags);
if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
return -EINVAL;
return do_accept(flags);
}
SYSCALL_DEFINE(socketpair)
{
int domain, type, protocol;
@ -287,6 +344,7 @@ SYSCALL_DEFINE(socketpair)
if (domain != AF_UNIX)
return -EAFNOSUPPORT;
int sflags = type & (SOCK_CLOEXEC | SOCK_NONBLOCK);
type &= 0xFF;
if (type != SOCK_STREAM)
return -EPROTOTYPE;
@ -294,12 +352,12 @@ SYSCALL_DEFINE(socketpair)
if ((r = sockpair(&a, &b)) < 0)
return r;
if ((fd0 = sock_to_fd(a)) < 0) {
if ((fd0 = sock_to_fd(a, sflags)) < 0) {
sockclose(a);
sockclose(b);
return fd0;
}
if ((fd1 = sock_to_fd(b)) < 0) {
if ((fd1 = sock_to_fd(b, sflags)) < 0) {
myproc()->ofile[fd0] = 0;
sockclose(a);
sockclose(b);
@ -431,23 +489,90 @@ SYSCALL_DEFINE(sockshutdown)
return sock_shutdown(s, how);
}
// getsockopt/setsockopt: accepted and ignored. A server that sets SO_REUSEADDR
// and treats failure as fatal is common enough to be worth not failing.
SYSCALL_DEFINE(setsockopt) { return 0; }
// setsockopt / getsockopt.
//
// These both used to succeed unconditionally -- setsockopt was `return 0;` and
// getsockopt wrote a zero for every option asked about. The comment said it was
// so that a server setting SO_REUSEADDR and treating failure as fatal would not
// fail.
//
// That trade is the wrong way round, and it is worth being precise about why,
// because "accept and ignore" looks like the kind thing to do. A caller that
// gets ENOPROTOOPT knows the option did not take effect and can decide what to
// do. A caller that gets success *changes its behaviour on the strength of it*:
// it sets SO_RCVTIMEO and then blocks forever in a read it believes will time
// out; it sets TCP_NODELAY and reports latency numbers that measure Nagle. The
// failure is silent, remote from the call, and indistinguishable from a bug in
// the protocol stack.
//
// So the rule here is the one the rest of this kernel already follows: do it,
// or say you did not. The four options below are genuinely applied to lwIP's
// pcb; the readable ones report the truth; everything else is ENOPROTOOPT.
//
// SO_REUSEADDR is honoured rather than refused precisely because of the
// original comment's concern -- it is the one option a server really does set
// and really does check.
// Fetch the int a setsockopt call is passing. Every option handled here is an
// int; anything wanting a struct (SO_RCVTIMEO and friends) is refused above.
static int
opt_in(addr_t uval, int ulen, int *out)
{
if (!uval || ulen < (int)sizeof(int))
return -EINVAL;
return get_user(*out, uval) < 0 ? -EFAULT : 0;
}
// Hand one int back, and report how many bytes that was.
static int
opt_out(addr_t uval, addr_t ulenp, int val)
{
int want = 0;
if (!uval || !ulenp)
return -EFAULT;
if (get_user(want, ulenp) < 0)
return -EFAULT;
if (want < (int)sizeof(int))
return -EINVAL;
if (put_user(val, uval) < 0)
return -EFAULT;
want = sizeof(int);
return put_user(want, ulenp) < 0 ? -EFAULT : 0;
}
SYSCALL_DEFINE(setsockopt)
{
struct socket *s;
addr_t uval;
int level, name, ulen, val, r;
if ((r = argsock(0, &s)) < 0)
return r;
argint(1, &level);
argint(2, &name);
argaddr(3, &uval);
argint(4, &ulen);
if ((r = opt_in(uval, ulen, &val)) < 0)
return r;
return sockopt_set(s, level, name, val);
}
SYSCALL_DEFINE(getsockopt)
{
addr_t uval, ulen;
int zero = 0, len = 0;
struct socket *s;
addr_t uval, ulenp;
int level, name, val = 0, r;
if ((r = argsock(0, &s)) < 0)
return r;
argint(1, &level);
argint(2, &name);
argaddr(3, &uval);
argaddr(4, &ulen);
if (uval && ulen) {
if (get_user(len, ulen) == 0 && len >= (int)sizeof(int)) {
put_user(zero, uval);
len = sizeof(int);
put_user(len, ulen);
}
}
return 0;
argaddr(4, &ulenp);
if ((r = sockopt_get(s, level, name, &val)) < 0)
return r;
return opt_out(uval, ulenp, val);
}

9
kernel/sys/table.inc
View file

@ -134,6 +134,12 @@ SYSCALL(189, 48, sockshutdown)
SYSCALL(190, 53, socketpair)
SYSCALL(191, 54, setsockopt)
SYSCALL(192, 55, getsockopt)
// accept4() differs from accept() only by a flags argument carrying
// SOCK_CLOEXEC/SOCK_NONBLOCK. It was an alias for accept, which silently
// dropped both -- and it cannot be an alias now that they are honoured: accept
// takes three arguments, so reading a fourth register from an accept() caller
// reads whatever it last left there and invents a flag out of stack litter.
SYSCALL(198, 288, accept4)
// --- time ---
SYSCALL( 28, 37, alarm)
@ -288,6 +294,3 @@ SYSCALL_ALIAS( 289, signalfd4)
SYSCALL_ALIAS( 290, eventfd2)
SYSCALL_ALIAS( 295, readv)
SYSCALL_ALIAS( 296, writev)
// accept4() differs from accept() only in a flags argument naming
// SOCK_CLOEXEC/SOCK_NONBLOCK, neither of which is honoured yet.
SYSCALL_ALIAS( 288, accept)