Skip to content

fix: accept unimplemented socket options, bump 0.3.0 - #39

Merged
danbugs merged 2 commits into
mainfrom
fix/networking-dns
May 15, 2026
Merged

fix: accept unimplemented socket options, bump 0.3.0#39
danbugs merged 2 commits into
mainfrom
fix/networking-dns

Conversation

@danbugs

@danbugs danbugs commented May 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Root cause

The v0.2.0 setsockopt/getsockopt hardening changed silent no-ops
into errors for unrecognised socket options. This broke DNS resolution
because musl's resolver sets IP_RECVERR (IPPROTO_IP=0, optname=11)
on its UDP socket and aborts when the setsockopt call fails.

Traced via HL_DISPATCH_DEBUG=1 — the very first thing after
net_socket is net_setsockopt(level=0, optname=11, value=1), which
returned an error and caused the guest to close the socket immediately.

Fix

Revert setsockopt to accepting unknown options silently and
getsockopt to returning 0 for unknown options. For a socket-proxy
pattern, the guest OS manages its own socket semantics — unknown
options are harmless configuration hints, not security boundaries.
Known options (SO_REUSEADDR, SO_KEEPALIVE, TCP_NODELAY) are
still applied to the host socket.

Test plan

  • cargo test --lib passes on Linux (46/46) and Windows (38/38)
  • cargo clippy --all-targets -- -D warnings clean on both platforms
  • networking-py urllib_get passes locally with the fix (was failing with v0.2.0)
  • CI: all checks green including networking-py runtime tests

danbugs added 2 commits May 15, 2026 13:02
The 0.2.0 setsockopt/getsockopt hardening changed silent no-ops into
errors for unrecognised options. This broke DNS resolution because
musl's resolver sets IP_RECVERR (level=0, opt=11) on its UDP socket
and aborts when the setsockopt fails.

Revert to accepting unknown options silently — for a socket-proxy
pattern the guest OS manages its own socket semantics, so unknown
options are harmless configuration hints, not security boundaries.

Signed-off-by: danbugs <danilochiarlone@gmail.com>
Signed-off-by: danbugs <danilochiarlone@gmail.com>

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linux Benchmarks

Details
Benchmark suite Current: fe6972d Previous: cb048d7 Ratio
hello_world (median) 20 ms 20 ms 1
pandas (median) 100 ms 100 ms 1
density (per VM) 7 MB 7 MB 1
snapshot (disk) 385 MiB 385 MiB 1

This comment was automatically generated by workflow using github-action-benchmark.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Windows Benchmarks

Details
Benchmark suite Current: fe6972d Previous: cb048d7 Ratio
hello_world (median) 260 ms 218 ms 1.19
pandas (median) 840 ms 739 ms 1.14
density (per VM) 6 MB 6 MB 1
snapshot (disk) 393 MiB 393 MiB 1

This comment was automatically generated by workflow using github-action-benchmark.

@danbugs
danbugs merged commit 110b50d into main May 15, 2026
79 checks passed
@danbugs
danbugs deleted the fix/networking-dns branch May 15, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant