fix(cmux-wg-tun): a socketpair is never read as a utun (the name query is LOCAL_PEERPID on a local socket)

LA
2d ago
+55-0

Summary

cmux-wg-tun's test engine::tests::a_socketpair_is_not_mistaken_for_utun failed in a full run and passed alone (fleet step f74200465feb95b217cf67d8). The cause is not test order and not shared state.

Cause: utun::interface_name asks getsockopt(fd, 2, 2) (SYSPROTO_CONTROL, UTUN_OPT_IFNAME). On a local (AF_UNIX) socket, macOS reads the same level and option as LOCAL_PEERPID; its handler ignores the level. So a socketpair answers the query with this process's pid as 4 bytes, and those bytes read as a "name" whenever they are ASCII. nextest runs each test in its own process, so the pid, and the result, changed from run to run.

Fix: a utun is found by its peer address family. is_kernel_control accepts only an AF_SYSTEM peer (getpeername), which is what WireGuard's Apple client checks. Only then does interface_name ask for the name.

The crate came in lawrencecchen's direct push ad2c76731f28..cc33e089376e and stays on the tip after the revert #34198, so this is a tip defect. This PR does not depend on #34220 (they change different lines of utun.rs).

Testing

Red first: e61e5a7a04e3 adds the tests, and is_kernel_control keeps the old rule (the fd answers the name query).

  • the_utun_name_query_answers_a_local_socket_with_its_peer_pid (macOS) pins the cause: the query succeeds on a socketpair, and the 4 reply bytes are this process's pid.
  • a_socketpair_is_not_a_kernel_control_socket is red on macOS at the red commit in every process, whatever the pid.
  • Fleet, macOS, cmux-tui-rust-check.sh test engine::tests::: red commit, step 140d2532959adadca832e04c; fix 792a09aec9e3, step 6b8d0dc2737388103d413953. Linux panic ratchet at the fix: step 307697ab0db2034d5f06fccc. Results in a comment.

Observed / Not run

  • Observed: the prepush gate; the fleet results in the comment.
  • Not run: find_utun_fd inside a real NetworkExtension provider (needs a signed system extension). getpeername with an AF_SYSTEM check is the method WireGuard's Apple client uses on the same fd.

Changelog

none

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes a macOS test flake in cmux-wg-tun where a socketpair could be mistaken for a utun interface. The utun name query (level SYSPROTO_CONTROL, option UTUN_OPT_IFNAME) is also LOCAL_PEERPID on a local socket, so a socketpair answered it with this process's pid as 4 bytes, which read as an ASCII "name" roughly half the time — making the result pid-dependent and flaky between runs.

Now a kernel control socket is identified by its peer address family (AF_SYSTEM via getpeername), the same check WireGuard's Apple client uses, before the interface name is queried. Adds regression tests pinning the root cause and the corrected rule.