As described in the comments, this is the only feasible way of really
checking CAP_NET_RAW properly. This is what Fuchsia
(test/util/fuchsia_capability_util.cc) uses as well.
This also allows us to more granularly check raw socket capabilities. For
example, it is possible to have caps for socket(AF_INET, SOCK_RAW, IPPROTO_RAW)
but *not* for socket(AF_INET, SOCK_RAW, IPPROTO_UDP).
Fixes test failures where the test was being run in a new userns but
the netns had the initial userns. So the test effectively could
open raw sockets.
Cleanup:
- Cleaned up some redundant SKIP_IF(Have[RawIP/Packet]SocketCapability())
from various TEST_P/TEST_F tests whose test class's SetUp() was already
calling GTEST_SKIP() when the capability was not available.
- Removed redundant EPERM checks after Have[RawIP/Packet]SocketCapability()
returned false. Now the implementation only returns false if socket creation
results in EPERM. So the EPERM check again was redundant.
PiperOrigin-RevId: 881067665
When a TCP client socket uses the wildcard("any") address for binding, the port
is reserved across both the IPv4 and IPv6 protocol families. During close() or
abort() calls we were only releasing the port reservation corresponding to the
established IPv6 connection tuple, failing to release the IPv4 reservation and
thus blocking future IPv4 bindings to that port.
The fix implements a mechanism to track if a socket was bound to the "any"
address. This is used during socket connect to release IPv4 relevant port
reservations and will allow the IPv4 socket to bind in future. A syscall test
has been added to verify the behavior.
PiperOrigin-RevId: 752385613
This test case creates one connection, then it closes one end of it. After that
it waits for a linger timeout and tries to create the second connection with
the same client source port. The test is flaky if the second half of the fist
connection isn't closed before creating the second connection.
PiperOrigin-RevId: 715924851
This test was under specified in that it does not try to bind to same
local address before the second connect. This is problematic as we
may see unexpected passes because the second connect can just use any
other port to succeed, while the true intention for this test is to
reuse the exact same port as the first connect.
PiperOrigin-RevId: 612666475
There have been some timing issues with this test, bump up the margin
to decrease flake rate but also decrease the expected sleeping time
to not increase the overall test run time.
PiperOrigin-RevId: 605385820
When SO_REUSEADDR is enabled, it is possible to create two connections with the
same 4-tuple, the error is only reported when `connect` instead of `bind`, also
the reported errno is `EADDRNOTAVAIL` instead of `EADDRINUSE`.
PiperOrigin-RevId: 532593923
SO_BINDTODEVICE required CAP_NET_RAW beofre the 5.7 kernel. This was
fixed in the kernel by c427bfec18f2 ("net: core: enable SO_BINDTODEVICE
for non-root users").
This allows these tests, which can cause flakiness when run in the same network
namespace as the other `socket_inet_loopback` tests, to run as separate tests
in their own environment. It also means that all of the shards of those tests
can be more isolated from each other as well.
PiperOrigin-RevId: 380930198
