As described in the comments, this is the only feasible way of really
checking CAP_NET_RAW properly. This is what Fuchsia
(test/util/fuchsia_capability_util.cc) uses as well.
This also allows us to more granularly check raw socket capabilities. For
example, it is possible to have caps for socket(AF_INET, SOCK_RAW, IPPROTO_RAW)
but *not* for socket(AF_INET, SOCK_RAW, IPPROTO_UDP).
Fixes test failures where the test was being run in a new userns but
the netns had the initial userns. So the test effectively could
open raw sockets.
Cleanup:
- Cleaned up some redundant SKIP_IF(Have[RawIP/Packet]SocketCapability())
from various TEST_P/TEST_F tests whose test class's SetUp() was already
calling GTEST_SKIP() when the capability was not available.
- Removed redundant EPERM checks after Have[RawIP/Packet]SocketCapability()
returned false. Now the implementation only returns false if socket creation
results in EPERM. So the EPERM check again was redundant.
PiperOrigin-RevId: 881067665
This behavior was fixed in 2dc334f1a63a8 ("splice, net: Use
sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage()"), Linux 6.5.
PiperOrigin-RevId: 762121005
Add a test that validates that when a UDP packet is received with an
unspecified source address, it is delivered to a listening socket.
PiperOrigin-RevId: 538240044
For packet sockets, don't expect that reading the buffer size set via
SO_RCVBUF or SO_SNDBUF returns exactly twice the value that was set
(assuming no min/max clipping) on Fuchsia. The doubling is a Linux-ism,
and is not required by POSIX.
PiperOrigin-RevId: 521816820
Before this change, this test fixture expected it to be enabled already
instead of updating the config.
The Teardown method also restore the initial configuration, so that
these tests do not permanently change the config of the machines that
run the tests.
PiperOrigin-RevId: 447814273
Code to get the loopback interface's index is scattered throughout the
syscall tests. Implement the code once and use that in tests (where
applicable).
While I am here, trim the dependencies/includes for network namespace
tests.
PiperOrigin-RevId: 396718124
...through the loopback interface, only.
This change only supports sending on packet sockets through the loopback
interface as the loopback interface is the only interface used in packet
socket syscall tests - the other link endpoints are not excercised with
the existing test infrastructure.
Support for sending on packet sockets through the other interfaces will
be added as needed.
BUG: https://fxbug.dev/81592
PiperOrigin-RevId: 394368899
+ Do not check for CAP_NET_RAW on Fuchsia
Fuchsia does not support capabilities the same way Linux does. Instead
emulate the check for CAP_NET_RAW by checking if a packet socket may
be created.
Bug: https://fxbug.dev/79016, https://fxbug.dev/81592
PiperOrigin-RevId: 390263666
tcpdump is largely supported. We've also chose not to implement writeable
AF_PACKET sockets, and there's a bug specifically for promiscuous mode (#3333).
Fixes#173.
PiperOrigin-RevId: 380733686
This CL moves {S,G}etsockopt of SO_SNDBUF from all endpoints to socketops. For
unix sockets, we do not support setting of this option.
PiperOrigin-RevId: 353871484
IPv4 previously accepts the packet, while IPv6 panics. Neither is the behavior
in Linux.
splice() in Linux has different behavior than in gVisor. This change documents
it in the SpliceTooLong test.
Reported-by: [email protected]
PiperOrigin-RevId: 352091286
The SO_ACCEPTCONN option is used only on getsockopt(). When this option is
specified, getsockopt() indicates whether socket listening is enabled for
the socket. A value of zero indicates that socket listening is disabled;
non-zero that it is enabled.
PiperOrigin-RevId: 338703206
SO_LINGER is a socket level option and should be stored on all endpoints even
though it is used to linger only for TCP endpoints.
PiperOrigin-RevId: 332369252
Packet sockets also seem to allow double binding and do not return an error on
linux. This was tested by running the syscall test in a linux namespace as root
and the current test DoubleBind fails@HEAD.
Passes after this change.
Updates #173
PiperOrigin-RevId: 321445137
Like (AF_INET, SOCK_RAW) sockets, AF_PACKET sockets require CAP_NET_RAW. With
runsc, you'll need to pass `--net-raw=true` to enable them.
Binding isn't supported yet.
PiperOrigin-RevId: 275909366
