handleSocket handles the socket(2) syscall.
(n *seccomp.Notif, domain, typ, protocol int)
| 311 | |
| 312 | // handleSocket handles the socket(2) syscall. |
| 313 | func (p *Process) handleSocket(n *seccomp.Notif, domain, typ, protocol int) error { |
| 314 | // TODO(adtac): support connect(AF_UNSPEC) on tracked sockets as a way to |
| 315 | // dissolve connection state (see connect(2) manpage). |
| 316 | if domain != unix.AF_INET && domain != unix.AF_INET6 { |
| 317 | return n.Skip() |
| 318 | } |
| 319 | if typ&unix.SOCK_STREAM == 0 { |
| 320 | return n.Skip() |
| 321 | } |
| 322 | if protocol == unix.IPPROTO_IP { |
| 323 | protocol = unix.IPPROTO_TCP // see /usr/include/linux/in.h |
| 324 | } |
| 325 | |
| 326 | switch protocol { |
| 327 | case unix.IPPROTO_IP, unix.IPPROTO_TCP: |
| 328 | case unix.IPPROTO_MPTCP: |
| 329 | // We currently don't support MPTCP, so behave as the kernel does in this situation [1]. |
| 330 | // Most applications will fallback to regular TCP, so this is fine. If an application relies on |
| 331 | // MPTCP without a fallback to TCP, this *will* break them. |
| 332 | // |
| 333 | // [1] https://github.com/torvalds/linux/blob/a2cc6ff5ec8f91bc463fd3b0c26b61166a07eb11/Documentation/networking/mptcp.rst#creating-mptcp-sockets |
| 334 | return n.Return(0, unix.EPROTONOSUPPORT) |
| 335 | default: |
| 336 | return n.Skip() |
| 337 | } |
| 338 | |
| 339 | sock, err := socket.CreateSocket(p.global, p.getEventTemplate().Copy(), domain, typ) |
| 340 | if err != nil { |
| 341 | return fmt.Errorf("create new socket: %w", err) |
| 342 | } |
| 343 | if err := p.installSocket(n, sock, typ&unix.SOCK_CLOEXEC); err != nil { |
| 344 | return fmt.Errorf("install: %w", err) |
| 345 | } |
| 346 | return nil |
| 347 | } |
| 348 | |
| 349 | // handleConnect handles the bind(2) syscall. |
| 350 | func (p *Process) handleBind(n *seccomp.Notif, fd int, addrPtr uintptr, addrSize int) error { |
no test coverage detected