@@ -155,51 +155,57 @@ impl Cage {
155155 /// ## `socket_syscall`
156156 ///
157157 /// ### Description
158- /// This function creates a new socket, ensuring the requested domain, socket type,
159- /// and protocol are supported by SafePosix.
160- /// It validates the requested communication domain, socket type, and protocol, permitting only combinations that are known
161- /// to be safe and secure.
158+ /// This function creates a new socket, ensuring the requested domain,
159+ /// socket type, and protocol are supported by SafePosix.
160+ /// It validates the requested communication domain, socket type, and
161+ /// protocol, permitting only combinations that are known to be safe and
162+ /// secure.
162163 ///
163164 /// ### Function Arguments
164- /// * `domain`: The communication domain for the socket. Supported values are
165- /// `PF_INET` (Internet Protocol) and `PF_UNIX` (Unix domain sockets).
166- /// * `socktype`: The socket type. Supported values are `SOCK_STREAM` (stream sockets) and `SOCK_DGRAM` (datagram sockets).
167- /// * `protocol`: The protocol to use for communication. This defaults to TCP for stream sockets
168- /// (`SOCK_STREAM`) and UDP for datagram sockets (`SOCK_DGRAM`).
165+ /// * `domain`: The communication domain for the socket. Supported values
166+ /// are `PF_INET` (Internet Protocol) and `PF_UNIX` (Unix domain sockets).
167+ /// * `socktype`: The socket type. Supported values are `SOCK_STREAM`
168+ /// (stream sockets) and `SOCK_DGRAM` (datagram sockets).
169+ /// * `protocol`: The protocol to use for communication. This defaults to
170+ /// TCP for stream sockets (`SOCK_STREAM`) and UDP for datagram sockets
171+ /// (`SOCK_DGRAM`).
169172 ///
170173 /// ### Returns
171174 /// * The new file descriptor representing the socket on success.
172175 ///
173176 /// ### Errors
174- /// * `EOPNOTSUPP(95)`: If an unsupported combination of domain, socket type, or protocol is requested.
177+ /// * `EOPNOTSUPP(95)`: If an unsupported combination of domain, socket
178+ /// type, or protocol is requested.
175179 /// * `EINVAL(22)`: If an invalid combination of flags is provided.
176180 /// ### Panics
177181 /// There are no panics in this syscall.
178182 pub fn socket_syscall ( & self , domain : i32 , socktype : i32 , protocol : i32 ) -> i32 {
179183 let real_socktype = socktype & 0x7 ; //get the type without the extra flags, it's stored in the last 3 bits
180184 let nonblocking = ( socktype & SOCK_NONBLOCK ) != 0 ; // Checks if the socket should be non-blocking.
181- //Check blocking status for storage in the file descriptor, we'll need this for calls that don't access the kernel
182- //socket, unix sockets, and properly directing kernel calls for recv and accept
185+ //Check blocking status for storage in the file descriptor, we'll need this for
186+ // calls that don't access the kernel
187+ // socket, unix sockets, and properly directing kernel calls for recv and accept
183188 let cloexec = ( socktype & SOCK_CLOEXEC ) != 0 ;
184- // Checks if the 'close-on-exec' flag is set. This flag ensures the socket is automatically closed if the current
185- // process executes another program, preventing unintended inheritance of the socket by the new program.
186-
189+ // Checks if the 'close-on-exec' flag is set. This flag ensures the socket is
190+ // automatically closed if the current process executes another program,
191+ // preventing unintended inheritance of the socket by the new program.
192+
187193 // additional flags are not supported
188194 // filtering out any socktypes with unexpected flags set.
189- // This is important as we dont want to pass down any flags that are not supported by SafePOSIX.
190- // which may potentially cause issues with the underlying libc call. or the socket creation process.
191- // leading to unexpected behavior.
195+ // This is important as we dont want to pass down any flags that are not
196+ // supported by SafePOSIX. which may potentially cause issues with the
197+ // underlying libc call. or the socket creation process. leading to
198+ // unexpected behavior.
192199 if socktype & !( SOCK_NONBLOCK | SOCK_CLOEXEC | 0x7 ) != 0 {
193- return syscall_error (
194- Errno :: EOPNOTSUPP ,
195- "socket" ,
196- "Invalid combination of flags"
197- ) ;
198- }
199- //SafePOSIX intentionally supports only a restricted subset of socket types . This is to make sure that
200- // applications not creating other socket types which may lead to security issues.
201- //By using the match statement, SafePOSIX ensures that only these approved socket types are allowed.
202- match real_socktype { // Handles different socket types SOCK_STREAM or SOCK_DGRAM in this cases
200+ return syscall_error ( Errno :: EOPNOTSUPP , "socket" , "Invalid combination of flags" ) ;
201+ }
202+ //SafePOSIX intentionally supports only a restricted subset of socket types .
203+ // This is to make sure that applications not creating other socket
204+ // types which may lead to security issues. By using the match
205+ // statement, SafePOSIX ensures that only these approved socket types are
206+ // allowed.
207+ match real_socktype {
208+ // Handles different socket types SOCK_STREAM or SOCK_DGRAM in this cases
203209 SOCK_STREAM => {
204210 //SOCK_STREAM defaults to TCP for protocol, otherwise protocol is unsupported
205211 let newprotocol = if protocol == 0 { IPPROTO_TCP } else { protocol } ;
@@ -211,8 +217,10 @@ impl Cage {
211217 "The only SOCK_STREAM implemented is TCP. Unknown protocol input." ,
212218 ) ;
213219 }
214- match domain { // Handles different communication domains in this case PF_INET/PF_UNIX
215- PF_INET | PF_UNIX => { // Internet Protocol (PF_INET) and Unix Domain Sockets (PF_UNIX)
220+ match domain {
221+ // Handles different communication domains in this case PF_INET/PF_UNIX
222+ PF_INET | PF_UNIX => {
223+ // Internet Protocol (PF_INET) and Unix Domain Sockets (PF_UNIX)
216224 //PR_INET / AF_INET and PF_UNIX / AF_UNIX are the same
217225 //https://man7.org/linux/man-pages/man2/socket.2.html
218226 let sockfdobj = self . _socket_initializer (
@@ -223,18 +231,22 @@ impl Cage {
223231 cloexec,
224232 ConnState :: NOTCONNECTED ,
225233 ) ;
226- // Creates a SafePOSIX socket descriptor using '_socket_initializer', a helper function
227- // that encapsulates the internal details of socket creation and initialization.
234+ // Creates a SafePOSIX socket descriptor using '_socket_initializer', a
235+ // helper function that encapsulates the internal
236+ // details of socket creation and initialization.
228237 return self . _socket_inserter ( Socket ( sockfdobj) ) ;
229- // Inserts the newly created socket descriptor into the cage's file descriptor table,
230- // making it accessible to the application.Returns the file descriptor representing the socket.
238+ // Inserts the newly created socket descriptor into the
239+ // cage's file descriptor table,
240+ // making it accessible to the application.Returns the
241+ // file descriptor representing the socket.
231242 }
232243 _ => {
233244 return syscall_error (
234245 Errno :: EOPNOTSUPP ,
235246 "socket" ,
236247 "trying to use an unimplemented domain" ,
237- ) ; // Returns an error if an unsupported domain is requested.
248+ ) ; // Returns an error if an unsupported domain is
249+ // requested.
238250 }
239251 }
240252 }
@@ -250,12 +262,16 @@ impl Cage {
250262 "The only SOCK_DGRAM implemented is UDP. Unknown protocol input." ,
251263 ) ;
252264 }
253- // SafePOSIX intentionally supports only a restricted subset of socket types . This is to make sure
254- // that applications not creating other socket types which may lead to security issues.
255- //By using the match statement, SafePOSIX ensures that only these approved socket types are allowed.
256- match domain { // Handles different communication domains in this case PF_INET/PF_UNIX
257- PF_INET | PF_UNIX => { // Internet Protocol (PF_INET) and Unix Domain Sockets (PF_UNIX)
258- //PR_INET / AF_INET and PF_UNIX / AF_UNIX are the same
265+ // SafePOSIX intentionally supports only a restricted subset of socket types .
266+ // This is to make sure that applications not creating other
267+ // socket types which may lead to security issues. By using the
268+ // match statement, SafePOSIX ensures that only these approved socket types are
269+ // allowed.
270+ match domain {
271+ // Handles different communication domains in this case PF_INET/PF_UNIX
272+ PF_INET | PF_UNIX => {
273+ // Internet Protocol (PF_INET) and Unix Domain Sockets (PF_UNIX)
274+ //PR_INET / AF_INET and PF_UNIX / AF_UNIX are the same
259275 //https://man7.org/linux/man-pages/man2/socket.2.html
260276 let sockfdobj = self . _socket_initializer (
261277 domain,
@@ -265,11 +281,14 @@ impl Cage {
265281 cloexec,
266282 ConnState :: NOTCONNECTED ,
267283 ) ;
268- // Creates a SafePOSIX socket descriptor using '_socket_initializer', a helper
269- // function that encapsulates the internal details of socket creation and initialization.
284+ // Creates a SafePOSIX socket descriptor using '_socket_initializer', a
285+ // helper function that encapsulates the internal
286+ // details of socket creation and initialization.
270287 return self . _socket_inserter ( Socket ( sockfdobj) ) ;
271- // Inserts the newly created socket descriptor into the cage's file descriptor table,making it accessible to the application.
272- // Returns the file descriptor (an integer) representing the socket.
288+ // Inserts the newly created socket descriptor into the
289+ // cage's file descriptor table,making it accessible to
290+ // the application. Returns the
291+ // file descriptor (an integer) representing the socket.
273292 }
274293 _ => {
275294 return syscall_error (
@@ -286,7 +305,7 @@ impl Cage {
286305 Errno :: EOPNOTSUPP ,
287306 "socket" ,
288307 "trying to use an unimplemented socket type" ,
289- ) ; // Returns an error if an unsupported domain is requested.
308+ ) ; // Returns an error if an unsupported domain is requested.
290309 }
291310 }
292311 }
0 commit comments