Verify that for UDP sockets, `send_to()` returns the correct errno when
asked to send to a remote IP in a different address family than the
socket's bound address.
PiperOrigin-RevId: 586074458
Verify that the connect call returns the proper errno when asked to
connect to a remote IP in a different address family than the local IP.
PiperOrigin-RevId: 581919473
* disable broken socket_inet_loopback test // Lucas Manning
* disable lseek tests on anon inodes. They have been broken by
commit e7478158e1378325907edfdd960eca98a1be405b
Date: Wed Jun 29 15:06:57 2022 +0200
fs: clear or set FMODE_LSEEK based on llseek function
* don't check memory.kmem.limit_in_bytes, it has been deprecated and dropped:
commit 86327e8eb94c52eca4f93cfece2e29d1bf52acbf
Date: Tue Jul 4 13:52:40 2023 +0200
memcg: drop kmem.limit_in_bytes
commit 58056f77502f3567b760c9a8fc8d2e9081515b2d
Date: Fri Nov 5 13:37:44 2021 -0700
memcg, kmem: further deprecate kmem.limit_in_bytes
commit 0158115f702b0ba208ab0b5adf44cae99b3ebcc7
Date: Mon Sep 23 15:37:22 2019 -0700
memcg, kmem: deprecate kmem.limit_in_bytes
PiperOrigin-RevId: 562915457
Fixes https://github.com/google/gvisor/issues/6015 | Added EventRdHUp to waiter events | Added POLLRDHUP delivery on half-closed connection detection | Added POLLRDHUP delivery on local read end shutdown
Use infinite timeout when polling on the connecting/connected socket
after the listening socket is closed/shutdown on Fuchsia, as this
particular poll has been observed to be very flaky in Fuchsia Infra.
PiperOrigin-RevId: 546006387
A few minor fixes. The biggest change is that the blocking implementation needs
to wait on POLLHUP and POLLERR events, in addition to readable/writable events.
We also need to track shutdown state in the socket.
PiperOrigin-RevId: 529816115
The blocking implementation needs to wait on POLLHUP and POLLERR events, in
addition to readable/writable events. That fixed at least one test.
There's still two unresolved issues in the tests, but we can enable the rest
of the suite while we figure out those two.
PiperOrigin-RevId: 525849045
Fuchsia runs these tests against an in-development stack (Netstack3) that
doesn't yet support the full space of TCP actions. This means we wait for the
full timeout when a test is expected to fail; since these timeouts are 10
seconds, the suite runs for ~20 minutes. Reduce these timeouts to ~2s in hope
that it will be long enough to catch the desired events while reducing runtime
in Fuchsia's CQ.
PiperOrigin-RevId: 498015652
SO_BINDTODEVICE required CAP_NET_RAW beofre the 5.7 kernel. This was
fixed in the kernel by c427bfec18f2 ("net: core: enable SO_BINDTODEVICE
for non-root users").
Check that when two sockets are bound to the same device and have SO_REUSEPORT
set, they can both be bound to the same address. This test provides missing
coverage for when the two socket options are set together.
Bug: https://fxbug.dev/97822
PiperOrigin-RevId: 450053747
test/syscalls/linux/futex.cc:
In member function 'virtual void gvisor::testing::
{anonymous}::PrivateAndSharedFutexTest_PIWaiters_Test::TestBody()':
test/syscalls/linux/futex.cc:697:19:
warning: comparison of integer expressions of different signedness:
'std::__atomic_base<int>::__int_type' {aka 'int'} and 'unsigned int'
[-Wsign-compare]
697 | while (a.load() != (FUTEX_WAITERS | gettid())) {
| ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
test/syscalls/linux/proc_pid_uid_gid_map.cc:207:64:
warning: comparison of integer expressions of different signedness: 'size_t'
{aka 'long unsigned int'} and 'int' [-Wsign-compare]
207 | TEST_PCHECK((n = write(fd, line.c_str(), line.size())) != -1);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~
test/syscalls/linux/socket_inet_loopback.cc:964:21:
warning: comparison of integer expressions of different signedness: 'int' and
'std::array<gvisor::testing::FileDescriptor, 1>::size_type' {aka 'long
unsigned int'} [-Wsign-compare]
964 | for (int i = 0; i < std::size(established_clients); i++) {
| ~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
test/syscalls/linux/socket_inet_loopback.cc:974:21:
warning: comparison of integer expressions of different signedness: 'int' and
'std::array<gvisor::testing::FileDescriptor, 1>::size_type' {aka 'long
unsigned int'} [-Wsign-compare]
974 | for (int i = 0; i < std::size(waiting_clients); i++) {
| ~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
test/syscalls/linux/udp_socket.cc:869:6:
warning: suggest explicit braces to avoid ambiguous 'else' [-Wdangling-else]
869 |if (!IsRunningWithHostinet() || GvisorPlatform() == Platform::kPtrace ||
| ^
test/syscalls/linux/socket_unix_unbound_abstract.cc:93:9:
warning: variable 'orig_opts' set but not used [-Wunused-but-set-variable]
93 | int orig_opts;
| ^~~~~~~~~
test/syscalls/linux/socket_unix_unbound_abstract.cc:107:9:
warning: variable 'orig_opts' set but not used [-Wunused-but-set-variable]
107 | int orig_opts;
| ^~~~~~~~~
PiperOrigin-RevId: 445545240
This test single handedly causes the syscalls:socket_inet_loopback_test test
variants to take more than an hour to run on some of our testing environments.
Reduce how aggressively this test tries to replicate a fixed flake. This is a
regression test.
PiperOrigin-RevId: 382849039
This allows these tests, which can cause flakiness when run in the same network
namespace as the other `socket_inet_loopback` tests, to run as separate tests
in their own environment. It also means that all of the shards of those tests
can be more isolated from each other as well.
PiperOrigin-RevId: 380930198
Address a race with non-blocking connect and socket close, causing the
FIN (because of socket close) to not be sent out, even after completing
the handshake.
The race occurs with this sequence:
(1) endpoint Connect starts handshake, sending out SYN
(2) handshake complete() releases endpoint lock, waiting on sleeper.Fetch()
(3) endpoint Close acquires endpoint lock, does not enqueue FIN (as the
endpoint is not yet connected) and asserts notifyClose
(4) SYNACK from peer gets enqueued asserting newSegmentWaker
(5) handshake complete() re-aqcuires lock, first processes newSegmentWaker
event, transitions to ESTABLISHED and proceeds to protocolMainLoop()
(6) protocolMainLoop() exits while processing notifyClose
When the execution follows the above sequence, no FIN is sent to the peer.
This causes the listener side to have a half-open connection sitting in
the accept queue.
Fix this by ensuring that the protocolMainLoop() performs clean shutdown
when the endpoint state is still ESTABLISHED.
This would not be a bug, if during handshake complete(), sleeper.Fetch()
prioritized notificationWaker over newSegmentWaker. In that case, the
handshake would not have completed in (5) above.
Fixes#6067
PiperOrigin-RevId: 376994395
Add missing protocol state to TCPINFO struct and update packetimpact.
This re-arranges the TCP state definitions to align with Linux.
Fixes#478
PiperOrigin-RevId: 374996751
This fixes a race that occurs while the endpoint is being unregistered
and the transport demuxer attempts to match the incoming packet to any
endpoint. The race specifically occurs when the unregistration (and
deletion of the endpoint) occurs, after a successful endpointsByNIC
lookup and before the endpoints map is further looked up with ingress
NICID of the packet.
The fix is to notify the caller of lookup-with-NICID failure, so that
the logic falls through to handling unknown destination packets.
For TCP this can mean replying back with RST.
The syscall test in this CL catches this race as the ACK completing the
handshake could get silently dropped on a listener close, causing no
RST sent to the peer and timing out the poll waiting for POLLHUP.
Fixes#5850
PiperOrigin-RevId: 369023779
Fix a race where the ACK completing the handshake can be dropped by
a closing listener without RST to the peer. The listener close would
reset the accepted queue and that causes the connecting endpoint
in SYNRCVD state to drop the ACK thinking the queue if filled up.
PiperOrigin-RevId: 368165509
It's a common pattern in test code to reinterpret_cast<sockaddr*> from
sockaddr_* structs. Make AsSockAddr() for them so code looks better.
Note: Why not a wrapper type for `sockaddr_storage` and etc?
It's also a common need to have a local in-out variable of socklen_t.
Creating a wrapper type may however lead to this wrong code:
Wrapper addr;
socklen_t addrlen = sizeof(addr);
where sizeof(Wrapper) may not equal to sizeof(sockaddr_storage).
PiperOrigin-RevId: 368126229
- Change the accept queue full condition for a listening endpoint
to only honor completed (and delivered) connections.
- Use syncookies if the number of incomplete connections is beyond
listen backlog. This also cleans up the SynThreshold option code
as that is no longer used with this change.
- Added a new stack option to unconditionally generate syncookies.
Similar to sysctl -w net.ipv4.tcp_syncookies=2 on Linux.
- Enable keeping of incomplete connections beyond listen backlog.
- Drop incoming SYNs only if the accept queue is filled up.
- Drop incoming ACKs that complete handshakes when accept queue is full
- Enable the stack to accept one more connection than programmed by
listen backlog.
- Handle backlog argument being zero, negative for listen, as Linux.
- Add syscall and packetimpact tests to reflect the changes above.
- Remove TCPConnectBacklog test which is polling for completed
connections on the client side which is not reflective of whether
the accept queue is filled up by the test. The modified syscall test
in this CL addresses testing of connecting sockets.
Fixes#3153
PiperOrigin-RevId: 366935921
There is a race in handling new incoming connections on a listening
endpoint that causes the endpoint to reply to more incoming SYNs than
what is permitted by the listen backlog.
The race occurs when there is a successful passive connection handshake
and the synRcvdCount counter is decremented, followed by the endpoint
delivered to the accept queue. In the window of time between
synRcvdCount decrementing and the endpoint being enqueued for accept,
new incoming SYNs can be handled without honoring the listen backlog
value, as the backlog could be perceived not full.
Fixes#5637
PiperOrigin-RevId: 363279372
Read now takes a destination io.Writer, count, options. Keeping the method name
Read, in contrast to the Write method.
This enables:
* direct transfer of views under VV
* zero copy
It also eliminates the need for sentry to keep a slice of view because
userspace had requested a read that is smaller than the view returned, removing
the complexity there.
Read/Peek/ReadPacket are now consolidated together and some duplicate code is
removed.
PiperOrigin-RevId: 350636322
Fixes the behaviour of SO_ERROR for tcp sockets where in linux it returns
sk->sk_err and if sk->sk_err is 0 then it returns sk->sk_soft_err. In gVisor TCP
we endpoint.HardError is the equivalent of sk->sk_err and endpoint.LastError
holds soft errors. This change brings this into alignment with Linux such that
both hard/soft errors are cleared when retrieved using getsockopt(.. SO_ERROR)
is called on a socket.
Fixes#3812
PiperOrigin-RevId: 342868552
The active_closefd has to be shutdown only for write,
otherwise the second poll will always return immediately.
The second poll should not be called from a separate thread.
PiperOrigin-RevId: 340319071
Earlier the count was dropped only after calling e.deliverAccepted. This lead to
an issue where there were no connections in SYN-RCVD state for the listening
endpoint but e.synRcvdCount would not be zero because it was being reduced only
when handleSynSegment returned after deliverAccepted returned.
This issue is seen when the Nth SYN for a listen backlog of size N which would
cause the listen backlog to be full gets dropped occasionally. This happens when
the new SYN comes at when the previous completed endpoint has been delivered to
the accept queue but the synRcvdCount hasn't yet been decremented because the
goroutine running handleSynSegment has not yet completed.
PiperOrigin-RevId: 338690646
Accept on gVisor will return an error if a socket in the accept queue was closed
before Accept() was called. Linux will return the new fd even if the returned
socket is already closed by the peer say due to a RST being sent by the peer.
This seems to be intentional in linux more details on the github issue.
Fixes#3780
PiperOrigin-RevId: 329828404
BadSocketPair test will return several errnos (EPREM, ESOCKTNOSUPPORT,
EAFNOSUPPORT) meaning the test is just too specific. Checking the syscall
fails is appropriate.
PiperOrigin-RevId: 328813071
