Method Socket

pkg/sentry/socket/hostinet/socket.go:240–296

Socket implements socket.Provider.Socket.

(t *kernel.Task, stypeflags linux.SockType, protocol int)

// Socket implements socket.Provider.Socket.
func (p *socketProvider) Socket(t *kernel.Task, stypeflags linux.SockType, protocol int) (*vfs.FileDescription, *syserr.Error) {
	// Check that we are using the host network stack.
	netCtx := t.NetworkContext()
	if netCtx == nil {
		return nil, nil
	}
	stack, ok := netCtx.(*Stack)
	if !ok {
		return nil, nil
	}

	stype := stypeflags & linux.SOCK_TYPE_MASK

	// Raw and packet sockets require CAP_NET_RAW.
	if stype == linux.SOCK_RAW || p.family == linux.AF_PACKET {
		if !t.HasCapabilityIn(linux.CAP_NET_RAW, t.NetworkNamespace().UserNamespace()) {
			return nil, syserr.ErrNotPermitted
		}
	}

	// Convert generic IPPROTO_IP protocol to the actual protocol depending
	// on family and type.
	if protocol == linux.IPPROTO_IP && (p.family == linux.AF_INET || p.family == linux.AF_INET6) {
		switch stype {
		case linux.SOCK_STREAM:
			protocol = linux.IPPROTO_TCP
		case linux.SOCK_DGRAM:
			protocol = linux.IPPROTO_UDP
		}
	}

	// Validate the socket based on family, type, and protocol.
	var supported bool
	for _, allowed := range stack.allowedSocketTypes {
		isAllowedFamily := p.family == allowed.Family
		isAllowedType := int(stype) == allowed.Type
		isAllowedProtocol := protocol == allowed.Protocol || allowed.Protocol == AllowAllProtocols
		if isAllowedFamily && isAllowedType && isAllowedProtocol {
			supported = true
			break
		}
	}
	if !supported {
		// Return nil error here to give other socket providers a
		// chance to create this socket.
		return nil, nil
	}

	// Conservatively ignore all flags specified by the application and add
	// SOCK_NONBLOCK since socketOperations requires it.
	st := int(stype) | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC
	fd, err := unix.Socket(p.family, st, protocol)
	if err != nil {
		return nil, syserr.FromError(err)
	}
	return newSocket(t, p.family, stype, protocol, fd, uint32(stypeflags&unix.SOCK_NONBLOCK))
}