icmp ping broken on osx under su account with PingOptions

[ispysoftware]

icmp ping broken on osx under su account

General

in a dotnet core app calling ping works if not running under the super user account. If you run it as root it fails with operation not supported errors.

using dotnet core v3.1.201 on OSX Mojave

sample app provided. Output:

seans-Mac-mini:Agent sean$ dotnet testping.dll
found 192.168.15.1
found 192.168.15.7
found 192.168.15.0
found 192.168.15.17
found 192.168.15.10
found 192.168.15.19
found 192.168.15.9
found 192.168.15.24
found 192.168.15.12
found 192.168.15.20
found 192.168.15.6
found 192.168.15.5
found 192.168.15.18
Found 13 addresses

seans-Mac-mini:Agent sean$ sudo dotnet testping.dll

ping: 192.168.15.3 :System.AggregateException: One or more errors occurred. (An exception occurred during a Ping request.)
---> System.Net.NetworkInformation.PingException: An exception occurred during a Ping request.
---> System.Net.Sockets.SocketException (45): Operation not supported
at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, String callerName)
at System.Net.Sockets.Socket.SetSocketOption(SocketOptionLevel optionLevel, SocketOptionName optionName, Int32 optionValue, Boolean silent)
at System.Net.Sockets.Socket.SetSocketOption(SocketOptionLevel optionLevel, SocketOptionName optionName, Int32 optionValue)
at System.Net.Sockets.Socket.set_DontFragment(Boolean value)
at System.Net.NetworkInformation.Ping.GetRawSocket(SocketConfig socketConfig)
at System.Net.NetworkInformation.Ping.SendIcmpEchoRequestOverRawSocketAsync(IPAddress address, Byte[] buffer, Int32 timeout, PingOptions options)
at System.Net.NetworkInformation.Ping.SendPingAsyncCore(IPAddress address, Byte[] buffer, Int32 timeout, PingOptions options)
at System.Net.NetworkInformation.Ping.SendPingAsyncInternal(IPAddress address, Int32 timeout, Byte[] buffer, PingOptions options)
--- End of inner exception stack trace ---
...
testping.zip

Tagging @dotnet/ncl as an area owner. If you would like to be tagged for a label, please notify danmosemsft.

[scalablecory]

@wfurt

[wfurt]

at System.Net.Sockets.Socket.set_DontFragment(Boolean value) this is not supported for IP AFAIK on OSX. We may need to skip it if it is set for RAW socket as well.

[ispysoftware]

@wfurt it only fails when run under super user account on OSX. Works fine on linux and windows.

[wfurt]

yes, I understand that. https://stackoverflow.com/questions/4415725/ip-dont-fragment-bit-on-mac-os (and others) Unlike other systems, macOS does not support IP_DONTFRAG. It would be bug if we try to use it. I'm not sure if we can make it work so this may throw PNSP or be silently ignored at the end. This will need some research.

[ispysoftware]

i'm not sure how it's working fine when run under the user account though.

The code I have is passing in false for don't fragment. If I don't pass in anything at all and exclude it from the SendAsync call it still fails with the same exception.

PingOptions pingOption = new PingOptions(128, false);

[wfurt]

When executed as regular user, process does not have access to raw sockets so the Ping will spawn new process for every request using system ping utility.

The code will try to set DontFragment as long as options are provided:

runtime/src/libraries/System.Net.Ping/src/System/Net/NetworkInformation/Ping.Unix.cs

Lines 82 to 85 in 21a7f5e

	if (socketConfig.Options != null && addrFamily == AddressFamily.InterNetwork)
	{
	socket.DontFragment = socketConfig.Options.DontFragment;
	}

You can avoid it by not specifying custom patterns. But than it fails for me with System.Net.Sockets.SocketException (56): Socket is already connected.

That seems like regression caused by dotnet/corefx#34084 and essentially dup of #33430