Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
tetsuo-pulse — Tetsuo Biblioteca de Sockets | Kitploit
Herramientas/GitHubGitHub/7etsuo/tetsuo-pulse
Sniffing y Análisis de PaquetesHerramientas de Cifrado/DescifradoSeguridad WebFuzzingSeguridad de RedesCriptografíaUtilidades y FrameworksSeguridad de APIsAnálisis de DNS
GitHub7etsuo/tetsuo-pulse

tetsuo-pulse

Tetsuo Biblioteca de Sockets

729hace 6 mesesRevisado por Kitploit

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir
Ver Repositorio

Logotipo de Socket Library

License: MIT Cobertura

Socket Library

Aviso de Madurez: Esta biblioteca es funcional y está bien probada, pero recién publicada. Es apropiada para desarrollo, herramientas internas y entornos controlados. El despliegue en producción con entrada de red no confiable debe esperar hasta que la base de código haya acumulado varios meses de endurecimiento en el mundo real.

Herramienta de sockets de alto rendimiento y controlada por excepciones para sistemas POSIX. Proporciona una API en C limpia y moderna para TCP, UDP, sockets de dominio Unix, HTTP/1.1, HTTP/2, QUIC, WebSocket y TLS/DTLS con manejo integral de errores, E/S de copia cero y sondeo de eventos multiplataforma.

Características

Redes Principales

  • Sockets de flujo TCP - Cliente/servidor TCP con todas las funciones con E/S scatter/gather
  • Sockets de datagramas UDP - Modos sin conexión y con conexión con multidifusión/difusión
  • Sockets de dominio Unix - Sockets IPC con soporte de credenciales de pares y paso de descriptores de archivo
  • Soporte TLS 1.3 - TLS moderno con SNI, ALPN, reanudación de sesión, CRL/OCSP, fijación de certificados, Transparencia de Certificados (CT), descarga kTLS, datos tempranos 0-RTT, KeyUpdate
  • Soporte DTLS 1.2+ - UDP seguro con intercambio de cookies para protección DoS, almacenamiento en caché de sesión, ALPN

Pila de Protocolo HTTP

  • HTTP/1.1 - Analizador DFA controlado por tabla (RFC 9112), codificación fragmentada, prevención de contrabando de solicitudes
  • HTTP/2 - Enmarque binario, multiplexación de flujos, control de flujo, push del servidor (RFC 9113)
  • HPACK - Compresión de encabezados con tablas estáticas/dinámicas, codificación Huffman (RFC 7541)
  • QPACK - Compresión de encabezados HTTP/3 (RFC 9204), arquitectura de dos flujos, gestión de flujos bloqueados
  • Cliente HTTP - Agrupación de conexiones, autenticación (Basic/Digest/Bearer), cookies (RFC 6265)
  • Servidor HTTP - Manejo de solicitudes basado en eventos, keep-alive, apagado gradual

Transporte QUIC

  • Cumplimiento con RFC 9000 - Implementación completa del protocolo de transporte QUIC v1
  • Gestión de Conexiones - Rotación de ID de conexión, restablecimiento sin estado, validación de dirección
  • Multiplexación de Flujos - Flujos bidireccionales y unidireccionales con control de flujo
  • Detección de Pérdidas - Control de congestión y recuperación de pérdidas según RFC 9002
  • Migración de Ruta - Migración transparente de conexión a través de cambios de red
  • Reanudación 0-RTT - Reconexión rápida con soporte de datos tempranos

QUIC-TLS (RFC 9001)

  • Protección de Paquetes - Cifrado AEAD (AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305)
  • Protección de Encabezados - Generación de máscara AES-ECB/ChaCha20 para cifrado de números de paquete
  • Derivación de Claves - Secretos iniciales basados en HKDF a partir del DCID del cliente, claves de handshake/tráfico
  • Actualización de Claves - Rotación del bit de fase de clave con límites de confidencialidad AEAD (RFC 9001 §6)
  • Integridad de Reintentos - Verificación de etiqueta AEAD para paquetes Retry (RFC 9001 §5.8)
  • Parámetros de Transporte - Extensión TLS (tipo 0x39) para intercambio de configuración QUIC

QPACK (RFC 9204)

  • Compresión de Encabezados - Compresión de encabezados HTTP/3 evitando el bloqueo de cabeza de línea
  • Arquitectura de Dos Flujos - Flujos separados de codificador (0x02) y decodificador (0x03)
  • Tabla Dinámica - Indexación absoluta con esquemas relativos al codificador y relativos al campo
  • Tabla Estática - 99 entradas predefinidas (Apéndice A de RFC 9204)
  • Sincronización de Estado - Reconocimiento de sección, Cancelación de flujo, Incremento de recuento de inserción
  • Gestión de Flujos Bloqueados - Límites configurables de flujos bloqueados con negociación SETTINGS

WebSocket

  • Cumplimiento con RFC 6455 - Implementación completa del protocolo WebSocket
  • permessage-deflate - Extensión de compresión (RFC 7692) mediante zlib
  • UTF-8 Incremental - Validación de tramas de texto basada en DFA
  • Auto-Ping/Pong - Latido configurable con integración de temporizador

Túneles Proxy

  • HTTP CONNECT - Túnel proxy con autenticación Basic
  • SOCKS4/4a - Soporte SOCKS heredado
  • SOCKS5 - RFC 1928/1929 con autenticación de nombre de usuario/contraseña
  • API Asíncrona - Conexión proxy no bloqueante con máquina de estados

Sistema de Eventos

  • Sondeo Multiplataforma - epoll (Linux), kqueue (BSD/macOS), respaldo poll
  • Modo Disparado por Borde - Notificación de eventos de alto rendimiento
  • E/S Asíncrona - io_uring (Linux 5.1+), kqueue AIO (BSD/macOS)
  • Temporizadores - Disparo único y repetitivo con montículo mínimo O(log n)

Gestión de Conexiones

  • Agrupación de Conexiones - Búsqueda O(1) con tablas hash, búferes de E/S por conexión
  • Happy Eyeballs - Carrera de conexión IPv4/IPv6 de doble pila según RFC 8305
  • Reconexión Automática - Retroceso exponencial con patrón de interruptor de circuito
  • Apagado Gradual - Máquina de estados de drenaje del pool con garantía de tiempo de espera

Endurecimiento de Seguridad

  • Protección contra Inundaciones SYN - Puntuación de reputación, limitación, integración con el núcleo
  • Seguimiento por IP - Límites de conexión y limitación de tasa por cliente
  • Limitación de Tasa - Algoritmo de cubeta de tokens para conexiones y ancho de banda
  • Prevención de Contrabando de Solicitudes - Análisis HTTP estricto con cumplimiento de RFC

Resolución DNS

  • Resolvedor Asíncrono - Resolución no bloqueante con pool de hilos y multiplexación de consultas
  • DNS sobre TLS (DoT) - DNS cifrado con modos oportunista/estricto según RFC 7858/8310
  • DNS sobre HTTPS (DoH) - Consultas DNS sobre HTTPS (métodos POST/GET) según RFC 8484
  • Validación DNSSEC - Cadena de confianza RFC 4033-4035, denegación autenticada NSEC/NSEC3
  • Cookies DNS - Protección contra suplantación mediante EDNS0 según RFC 7873
  • Caché Negativo - Manejo adecuado de NXDOMAIN/NODATA según RFC 2308
  • Errores DNS Extendidos - Códigos de error detallados según RFC 8914

Infraestructura

  • Errores Basados en Excepciones - Propagación limpia de errores con TRY/EXCEPT/FINALLY
  • API Simple - Capa de conveniencia basada en códigos de retorno para operaciones comunes (no se necesita TRY/EXCEPT)
  • Gestión de Memoria Arena - Asignación eficiente con protección contra desbordamiento
  • E/S con Búfer Circular - Búfer de copia cero para operaciones de red
  • E/S Asíncrona - Operaciones asíncronas optimizadas para la plataforma (io_uring/kqueue)
  • Validación UTF-8 - Procesamiento UTF-8 centrado en la seguridad para tramas de texto WebSocket
  • Marco de Reintentos Genérico - Retroceso exponencial con variación para operaciones resilientes
  • Seguimiento de Conexiones por IP - Límites de conexión y limitación de tasa por IP de cliente
  • E/S de Copia Cero - sendfile() optimizado para la plataforma y E/S scatter/gather
  • Observabilidad - Registro conectable, exportación de métricas Prometheus/StatsD/JSON, despacho de eventos
  • Utilidades Criptográficas - SHA-1/256, HMAC, Base64, aleatorio seguro

Requisitos de Plataforma

  • Sistema compatible con POSIX (Linux, BSD, macOS)
  • Compilador C11 con extensiones GNU
  • Hilos POSIX (pthread) para operaciones seguras en hilos
  • Soporte IPv6 en el núcleo (para sockets de doble pila)
  • NO portable a Windows sin una capa de adaptación Winsock

Características Específicas de la Plataforma

Requisitos TLS/DTLS

  • OpenSSL 1.1.1+ o LibreSSL con soporte TLS 1.3
  • Solo TLS 1.3 por defecto (configurable)
  • DTLS 1.2 mínimo para UDP seguro

Inicio Rápido

Compilación```bash

Basic build

cmake -S . -B build cmake --build build -j

Run tests

cd build && ctest --output-on-failure

Build with TLS support (auto-detects OpenSSL/LibreSSL)

cmake -S . -B build -DENABLE_TLS=ON

Build with sanitizers for debugging

cmake -S . -B build -DENABLE_SANITIZERS=ON

Build with fuzzing support (requires Clang)

cmake -S . -B build -DENABLE_FUZZING=ON -DCMAKE_C_COMPILER=clang

root@kitploit:~
### Servidor TCP básico```c
#include "socket/Socket.h"
#include "core/Except.h"
#include <stdio.h>

int main(void)
{
    Socket_T server = Socket_new(AF_INET, SOCK_STREAM, 0);
    
    TRY
        Socket_setreuseaddr(server);
        Socket_bind(server, NULL, 8080);
        Socket_listen(server, 128);
        printf("Server listening on port 8080...\n");
        
        while (1) {
            Socket_T client = Socket_accept(server);
            if (client) {
                char buf[1024];
                ssize_t n = Socket_recv(client, buf, sizeof(buf) - 1);
                if (n > 0) {
                    buf[n] = '\0';
                    Socket_sendall(client, buf, n);
                }
                Socket_free(&client);
            }
        }
    EXCEPT(Socket_Failed)
        fprintf(stderr, "Error: %s\n", Socket_GetLastError());
    END_TRY;
    
    Socket_free(&server);
    return 0;
}

Cliente TCP Básico```c

#include "socket/Socket.h" #include "core/Except.h" #include <stdio.h> #include <string.h>

int main(void) { Socket_T client = Socket_new(AF_INET, SOCK_STREAM, 0);

root@kitploit:~
TRY
    Socket_connect(client, "127.0.0.1", 8080);
    printf("Connected to server\n");
    
    const char *msg = "Hello, Server!";
    Socket_sendall(client, msg, strlen(msg));
    
    char buf[1024];
    ssize_t n = Socket_recvall(client, buf, strlen(msg));
    buf[n] = '\0';
    printf("Received: %s\n", buf);
EXCEPT(Socket_Failed)
    fprintf(stderr, "Error: %s\n", Socket_GetLastError());
EXCEPT(Socket_Closed)
    fprintf(stderr, "Connection closed\n");
END_TRY;

Socket_free(&client);
return 0;

}

root@kitploit:~
### Funciones de conveniencia (Configuración de una sola llamada)

Para casos de uso comunes, las funciones de conveniencia simplifican la configuración del socket:```c
#include "socket/Socket.h"
#include "socket/SocketDgram.h"

/* TCP Server - one call creates listening socket */
Socket_T server = Socket_listen_tcp("0.0.0.0", 8080, 128);
while (running) {
    Socket_T client = Socket_accept_timeout(server, 1000);  // 1s timeout
    if (client) handle_client(client);
}
Socket_free(&server);

/* TCP Client with timeout - one call connects */
Socket_T client = Socket_connect_tcp("api.example.com", 443, 5000);  // 5s timeout
Socket_sendall(client, request, len);
Socket_free(&client);

/* UDP Server - one call binds */
SocketDgram_T udp = SocketDgram_bind_udp("0.0.0.0", 5353);
SocketDgram_recvfrom(udp, buf, sizeof(buf), sender_ip, sizeof(sender_ip), &sender_port);
SocketDgram_free(&udp);

/* Unix Domain Server */
Socket_T unix_srv = Socket_listen_unix("/var/run/app.sock", 128);
Socket_free(&unix_srv);

/* Unix Domain Client with timeout */
Socket_T unix_cli = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_connect_unix_timeout(unix_cli, "/var/run/app.sock", 5000);
Socket_free(&unix_cli);

/* Non-blocking connect (for event loops) */
Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
int status = Socket_connect_nonblocking(sock, "192.168.1.1", 8080);
if (status == 1) {
    /* In progress - poll for POLL_WRITE then check Socket_isconnected() */
}

API Simple (No requiere TRY/EXCEPT)

Para usuarios que prefieren el manejo de errores basado en códigos de retorno, la API Simple proporciona una capa de conveniencia que envuelve los internos basados en excepciones:```c #include "simple/SocketSimple.h"

/* TCP Client - returns NULL on error */ SocketSimple_Socket_T sock = Socket_simple_connect("example.com", 80); if (!sock) { fprintf(stderr, "Error: %s\n", Socket_simple_error()); return 1; } Socket_simple_send(sock, "GET / HTTP/1.0\r\n\r\n", 18); char buf[4096]; ssize_t n = Socket_simple_recv(sock, buf, sizeof(buf)); Socket_simple_close(&sock);

/* TLS Client - one-liner with cert verification */ SocketSimple_Socket_T tls = Socket_simple_connect_tls("api.example.com", 443); if (tls) { Socket_simple_send(tls, request, len); Socket_simple_close(&tls); }

/* HTTP GET - returns 0 on success */ SocketSimple_HTTPResponse resp; if (Socket_simple_http_get("https://api.example.com/data", &resp) == 0) { printf("Status: %d, Body: %.*s\n", resp.status_code, (int)resp.body_len, resp.body); Socket_simple_http_response_free(&resp); }

/* WebSocket - handles ws:// and wss:// */ SocketSimple_WS_T ws = Socket_simple_ws_connect("wss://echo.example.com/ws"); if (ws) { Socket_simple_ws_send_text(ws, "Hello!", 6); SocketSimple_WSMessage msg; if (Socket_simple_ws_recv(ws, &msg) == 0) { printf("Received: %.*s\n", (int)msg.len, (char *)msg.data); Socket_simple_ws_message_free(&msg); } Socket_simple_ws_close(ws, 1000, "Bye"); Socket_simple_ws_free(&ws); }

root@kitploit:~
Consulte [docs/simple.md](https://github.com/7etsuo/tetsuo-pulse/blob/HEAD/docs/simple.md) para la documentación completa de la API.

## Patrones de Uso

### Manejo de Errores

Todas las operaciones de socket utilizan manejo de errores basado en excepciones:```c
TRY
    Socket_connect(socket, "example.com", 80);
    Socket_sendall(socket, data, len);
EXCEPT(Socket_Failed)
    if (Socket_error_is_retryable(Socket_geterrno()))
        /* Schedule retry with backoff */
    else
        fprintf(stderr, "Fatal error: %s\n", Socket_Failed.reason);
EXCEPT(Socket_Closed)
    fprintf(stderr, "Connection closed\n");
FINALLY
    Socket_free(&socket);
END_TRY;

I/O no bloqueante con sondeo de eventos```c

#include "socket/Socket.h" #include "poll/SocketPoll.h"

Socket_T server = Socket_new(AF_INET, SOCK_STREAM, 0); Socket_setreuseaddr(server); Socket_bind(server, NULL, 8080); Socket_listen(server, 128); Socket_setnonblocking(server);

SocketPoll_T poll = SocketPoll_new(1000); SocketPoll_add(poll, server, POLL_READ, NULL);

while (1) { SocketEvent_T *events; int n = SocketPoll_wait(poll, &events, 1000);

root@kitploit:~
for (int i = 0; i < n; i++) {
    if (events[i].socket == server) {
        Socket_T client = Socket_accept(server);
        if (client) {
            Socket_setnonblocking(client);
            SocketPoll_add(poll, client, POLL_READ, client);
        }
    } else {
        Socket_T client = events[i].socket;
        char buf[1024];
        ssize_t bytes = Socket_recv(client, buf, sizeof(buf));
        if (bytes > 0) {
            Socket_sendall(client, buf, bytes);
        } else {
            SocketPoll_del(poll, client);
            Socket_free(&client);
        }
    }
}

}

SocketPoll_free(&poll); Socket_free(&server);

root@kitploit:~
### Cliente HTTP```c
#include "http/SocketHTTPClient.h"

/* Simple GET request */
SocketHTTPClient_T client = SocketHTTPClient_new(NULL);
SocketHTTPClient_Response response = {0};

if (SocketHTTPClient_get(client, "https://example.com/api", &response) == 0) {
    printf("Status: %d\n", response.status_code);
    printf("Body: %.*s\n", (int)response.body_len, (char *)response.body);
}
SocketHTTPClient_Response_free(&response);

/* Request builder pattern */
SocketHTTPClient_Request_T req = SocketHTTPClient_Request_new(
    client, HTTP_METHOD_POST, "https://api.example.com/data");
SocketHTTPClient_Request_header(req, "Content-Type", "application/json");
SocketHTTPClient_Request_body(req, "{\"key\": \"value\"}", 16);
SocketHTTPClient_Request_timeout(req, 30000);

if (SocketHTTPClient_Request_execute(req, &response) == 0) {
    printf("POST Status: %d\n", response.status_code);
}
SocketHTTPClient_Request_free(&req);
SocketHTTPClient_Response_free(&response);

/* Cookie jar */
SocketHTTPClient_CookieJar_T jar = SocketHTTPClient_CookieJar_new();
SocketHTTPClient_set_cookie_jar(client, jar);

SocketHTTPClient_free(&client);

Funciones de conveniencia del cliente HTTP```c

#include "http/SocketHTTPClient.h"

SocketHTTPClient_T client = SocketHTTPClient_new(NULL);

/* Download file from URL */ int ret = SocketHTTPClient_download(client, "https://example.com/file.zip", "/tmp/file.zip"); if (ret == 0) { printf("Download complete\n"); } else if (ret == -1) { printf("HTTP error\n"); } else { printf("File error: %s\n", strerror(errno)); }

/* Upload file to URL */ int status = SocketHTTPClient_upload(client, "https://storage.example.com/files/upload.dat", "/path/to/local/file.dat"); if (status >= 200 && status < 300) { printf("Upload successful (HTTP %d)\n", status); }

/* JSON API calls */ char *json_response = NULL; size_t json_len;

/* GET JSON */ status = SocketHTTPClient_json_get(client, "https://api.example.com/users/123", &json_response, &json_len); if (status == 200 && json_response) { printf("User data: %s\n", json_response); free(json_response); }

/* POST JSON */ const char *request_body = "{"name": "John", "email": "[email protected]"}"; status = SocketHTTPClient_json_post(client, "https://api.example.com/users", request_body, &json_response, &json_len); if (status == 201 && json_response) { printf("Created: %s\n", json_response); free(json_response); }

SocketHTTPClient_free(&client);

root@kitploit:~
### Servidor HTTP

Para obtener detalles sobre la negociación HTTP/2 (ALPN vs h2c vs prior-knowledge), ciclo de vida de flujo, trailers, GOAWAY/drain y estado de RFC 8441, consulte `docs/HTTP2-SERVER.md`.```c
#include "http/SocketHTTPServer.h"
#include "http/SocketHTTP.h"
#include <string.h>

static void
handle_request (SocketHTTPServer_Request_T req, void *userdata)
{
    (void)userdata;

    if (SocketHTTPServer_Request_method (req) == HTTP_METHOD_GET
        && strcmp (SocketHTTPServer_Request_path (req), "/") == 0)
      {
        SocketHTTPServer_Request_status (req, 200);
        SocketHTTPServer_Request_header (req, "content-type", "text/html");
        SocketHTTPServer_Request_body_string (req, "<h1>Hello World</h1>");
        SocketHTTPServer_Request_finish (req);
        return;
      }

    SocketHTTPServer_Request_status (req, 404);
    SocketHTTPServer_Request_body_string (req, "Not Found");
    SocketHTTPServer_Request_finish (req);
}

int
main (void)
{
    SocketHTTPServer_Config config;
    SocketHTTPServer_T server;

    SocketHTTPServer_config_defaults (&config);
    config.port = 8080;
    config.max_version = HTTP_VERSION_2;   /* Allow HTTP/2 (default) */
    config.enable_h2c_upgrade = 0;         /* h2c is opt-in */

    server = SocketHTTPServer_new (&config);
    SocketHTTPServer_set_handler (server, handle_request, NULL);
    SocketHTTPServer_start (server);

    /* Event loop */
    for (;;)
      SocketHTTPServer_process (server, 1000);
}

Gestión de flujos HTTP/2```c

#include "http/SocketHTTP2.h"

/* Check connection health with PING */ int rtt = SocketHTTP2_Conn_ping_wait(conn, 5000); if (rtt >= 0) { printf("Connection alive, RTT: %d ms\n", rtt); } else { printf("Connection dead or timeout\n"); }

/* Monitor concurrent streams */ uint32_t active = SocketHTTP2_Conn_get_concurrent_streams(conn); printf("Active streams: %u\n", active);

/* Limit concurrent streams (sends SETTINGS frame) */ SocketHTTP2_Conn_set_max_concurrent(conn, 50);

/* Check peer's stream limit */ uint32_t peer_max = SocketHTTP2_Conn_get_peer_setting(conn, SETTINGS_IDX_MAX_CONCURRENT_STREAMS); printf("Peer allows %u concurrent streams\n", peer_max);

root@kitploit:~
### Cliente WebSocket```c
#include "socket/SocketWS.h"

/* One-liner WebSocket connection (new convenience API) */
SocketWS_T ws = SocketWS_connect("wss://echo.websocket.org", NULL);
if (ws) {
    /* Send and receive JSON messages */
    SocketWS_send_json(ws, "{\"type\": \"hello\", \"data\": \"world\"}");
    
    char *json = NULL;
    size_t len;
    if (SocketWS_recv_json(ws, &json, &len) == WS_OK) {
        printf("Received: %s\n", json);
        free(json);
    }
    
    /* Check ping latency */
    SocketWS_ping(ws, "test", 4);
    SocketWS_process(ws, POLLIN);  /* Wait for pong */
    int64_t rtt = SocketWS_get_ping_latency(ws);
    printf("Latency: %lld ms\n", (long long)rtt);
    
    SocketWS_close(ws, WS_CLOSE_NORMAL, "Goodbye", 7);
    SocketWS_free(&ws);
}

/* Traditional multi-step connection */
Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "echo.websocket.org", 80);

SocketWS_Config ws_config = SOCKETWS_CONFIG_DEFAULTS;
SocketWS_T ws2 = SocketWS_client_new(sock, "echo.websocket.org", "/", &ws_config);

/* Enable compression before handshake */
SocketWS_CompressionOptions comp_opts;
SocketWS_compression_options_defaults(&comp_opts);
comp_opts.level = 9;  /* Maximum compression */
SocketWS_enable_compression(ws2, &comp_opts);

/* Perform handshake */
TRY
    SocketWS_handshake(ws2);
    
    /* Send text message */
    SocketWS_send_text(ws2, "Hello, WebSocket!", 17);
    
    /* Graceful close */
    SocketWS_close(ws2, WS_CLOSE_NORMAL, "Goodbye", 7);
EXCEPT(SocketWS_Failed)
    fprintf(stderr, "WebSocket error: %s\n", SocketWS_Failed.reason);
END_TRY;

SocketWS_free(&ws2);
Socket_free(&sock);

Cliente QUIC```c

#include "quic/SocketQUICConnection.h" #include "quic/SocketQUICStream.h" #include "quic/SocketQUICHandshake.h"

/* Create QUIC connection */ Arena_T arena = Arena_new(); SocketQUICConnection_T conn = SocketQUICConnection_new(arena, QUIC_CONN_ROLE_CLIENT);

/* Configure connection parameters */ SocketQUICConnection_set_initial_dcid(conn, dcid, dcid_len); SocketQUICConnection_set_local_addr(conn, local_addr, local_port); SocketQUICConnection_set_peer_addr(conn, peer_addr, peer_port);

/* Create bidirectional stream */ SocketQUICStream_T stream = SocketQUICStream_new(arena, 0, QUIC_STREAM_BIDI); SocketQUICStream_write(stream, data, len);

/* Process handshake */ SocketQUICHandshake_T hs = SocketQUICHandshake_new(arena, QUIC_HANDSHAKE_CLIENT); while (SocketQUICHandshake_state(hs) != QUIC_HS_STATE_COMPLETE) { SocketQUICHandshake_process(hs); }

/* Read stream data */ uint8_t buf[4096]; size_t bytes_read = SocketQUICStream_read(stream, buf, sizeof(buf));

/* Clean up */ SocketQUICStream_free(&stream); SocketQUICConnection_free(&conn); Arena_dispose(&arena);

root@kitploit:~
### Proxy Tunneling```c
#include "socket/SocketProxy.h"

/* SOCKS5 proxy configuration */
SocketProxy_Config proxy = {0};
proxy.type = SOCKET_PROXY_SOCKS5;
proxy.host = "proxy.example.com";
proxy.port = 1080;
proxy.username = "user";
proxy.password = "secret";

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);

/* Connect through proxy (synchronous) */
SocketProxy_Result result = SocketProxy_connect(sock, &proxy, "target.example.com", 443);
if (result == PROXY_OK) {
    /* Socket is now tunneled - proceed with TLS handshake if needed */
    SocketTLS_enable(sock, tls_ctx);
    SocketTLS_handshake_loop(sock, 10000);
}

/* HTTP CONNECT proxy */
SocketProxy_Config http_proxy = {0};
http_proxy.type = SOCKET_PROXY_HTTP;
http_proxy.host = "httpproxy.example.com";
http_proxy.port = 8080;
http_proxy.username = "user";
http_proxy.password = "pass";

/* Asynchronous proxy connection */
SocketProxy_Conn_T conn = SocketProxy_Conn_new(sock, &http_proxy, "target.com", 443);
while (!SocketProxy_Conn_poll(conn)) {
    int timeout = SocketProxy_Conn_next_timeout_ms(conn);
    SocketPoll_wait(poll, &events, timeout);
    SocketProxy_Conn_process(conn);
}
result = SocketProxy_Conn_result(conn);
SocketProxy_Conn_free(&conn);

DTLS (UDP seguro)```c

#include "tls/SocketDTLS.h" #include "tls/SocketDTLSContext.h" #include "socket/SocketDgram.h"

/* DTLS Client */ SocketDgram_T sock = SocketDgram_new(AF_INET, 0); SocketDgram_connect(sock, "server.example.com", 5684);

SocketDTLSContext_T ctx = SocketDTLSContext_new_client("ca-bundle.crt"); SocketDTLS_enable(sock, ctx); SocketDTLS_set_hostname(sock, "server.example.com");

DTLSHandshakeState state = SocketDTLS_handshake_loop(sock, 5000); if (state == DTLS_HANDSHAKE_COMPLETE) { /* Send encrypted datagram */ SocketDTLS_send(sock, "Hello DTLS", 10);

root@kitploit:~
char buf[1024];
ssize_t n = SocketDTLS_recv(sock, buf, sizeof(buf));

}

SocketDTLS_shutdown(sock); SocketDgram_free(&sock); SocketDTLSContext_free(&ctx);

/* DTLS Server with cookie exchange */ SocketDgram_T server = SocketDgram_new(AF_INET, 0); SocketDgram_bind(server, "0.0.0.0", 5684);

SocketDTLSContext_T srv_ctx = SocketDTLSContext_new_server("cert.pem", "key.pem", NULL); SocketDTLSContext_enable_cookie_exchange(srv_ctx); /* DoS protection */ SocketDTLS_enable(server, srv_ctx);

/* Handle incoming connections with SocketDTLS_listen() */

root@kitploit:~
### Servidor UDP```c
#include "socket/SocketDgram.h"

SocketDgram_T server = SocketDgram_new(AF_INET, 0);
SocketDgram_bind(server, NULL, 5000);

char buffer[65536];
char sender_host[46];
int sender_port;

while (1) {
    ssize_t n = SocketDgram_recvfrom(server, buffer, sizeof(buffer),
                                     sender_host, sizeof(sender_host),
                                     &sender_port);
    if (n > 0) {
        /* Echo back to sender */
        SocketDgram_sendto(server, buffer, n, sender_host, sender_port);
    }
}

SocketDgram_free(&server);

Agrupación de conexiones con limitación de velocidad```c

#include "pool/SocketPool.h" #include "core/Arena.h"

Arena_T arena = Arena_new(); SocketPool_T pool = SocketPool_new(arena, 10000, 8192);

/* Enable rate limiting: 100 connections/sec, burst of 50 */ SocketPool_setconnrate(pool, 100, 50);

/* Limit per-IP connections */ SocketPool_setmaxperip(pool, 10);

/* Rate-limited accept with error handling / Socket_T client = SocketPool_accept_limited(pool, server); if (client) { Connection_T conn = SocketPool_add(pool, client); if (conn) { SocketBuf_T input = Connection_inbuf(conn); SocketBuf_T output = Connection_outbuf(conn); / ... use connection ... / } else { / Pool full or other error - cleanup to avoid leaks */ const char *ip = Socket_getpeeraddr(client); SocketPool_release_ip(pool, ip); Socket_free(&client); } }

/* Batch accept for high-throughput servers */ Socket_T accepted[32]; int count = SocketPool_accept_batch(pool, server, 32, accepted);

/* Clean up idle connections / SocketPool_cleanup(pool, 300); / Remove idle > 300 seconds */

SocketPool_free(&pool); Arena_dispose(&arena);

root@kitploit:~
### Estadísticas y Filtrado del Pool de Conexiones```c
#include "pool/SocketPool.h"

/* Get pool statistics */
SocketPool_Stats stats;
SocketPool_get_stats(pool, &stats);
printf("Active: %zu, Idle: %zu, Reuse rate: %.1f%%\n",
       stats.current_active, stats.current_idle, stats.reuse_rate * 100.0);

/* Convenience stat functions */
size_t active = SocketPool_get_active_count(pool);
size_t idle = SocketPool_get_idle_count(pool);
double hit_rate = SocketPool_get_hit_rate(pool);

/* Find connections matching criteria */
int is_from_subnet(Connection_T conn, void *data) {
    const char *subnet = (const char *)data;
    return strncmp(Socket_getpeeraddr(Connection_socket(conn)), subnet, 7) == 0;
}

/* Find first matching connection */
Connection_T conn = SocketPool_find(pool, is_from_subnet, "192.168");

/* Get all matching connections */
Connection_T matches[100];
size_t count = SocketPool_filter(pool, is_from_subnet, "192.168", matches, 100);
for (size_t i = 0; i < count; i++) {
    /* Process matching connections */
}

/* Register idle callback */
void on_idle(Connection_T conn, void *data) {
    printf("Connection went idle: %s\n",
           Socket_getpeeraddr(Connection_socket(conn)));
}
SocketPool_set_idle_callback(pool, on_idle, NULL);

/* Shrink pool to release unused memory */
size_t released = SocketPool_shrink(pool);
printf("Released %zu unused slots\n", released);

/* Reset statistics for new measurement window */
SocketPool_reset_stats(pool);

Operaciones de Búfer Circular```c

#include "socket/SocketBuf.h"

Arena_T arena = Arena_new(); SocketBuf_T buf = SocketBuf_new(arena, 4096);

/* Basic read/write */ SocketBuf_write(buf, "Hello, World!\n", 14); printf("Available: %zu bytes\n", SocketBuf_available(buf));

/* Search for patterns (useful for protocol parsing) / ssize_t pos = SocketBuf_find(buf, "\n", 1); / Find newline */ if (pos >= 0) { printf("Newline at offset %zd\n", pos); }

/* Read line-by-line / char line[256]; ssize_t len; while ((len = SocketBuf_readline(buf, line, sizeof(line))) > 0) { printf("Line: %s", line); / Includes '\n' */ }

/* Ensure space for large write / if (SocketBuf_ensure(buf, 8192)) { / Guaranteed 8KB write space */ SocketBuf_write(buf, large_data, 8192); }

/* Compact buffer for maximum contiguous space */ SocketBuf_compact(buf); size_t contiguous; void ptr = SocketBuf_writeptr(buf, &contiguous); / contiguous now equals SocketBuf_space(buf) */

/* Scatter-gather I/O / struct header hdr = {...}; char body[1024] = "..."; struct iovec iov[2] = { {.iov_base = &hdr, .iov_len = sizeof(hdr)}, {.iov_base = body, .iov_len = strlen(body)} }; SocketBuf_writev(buf, iov, 2); / Gather write */

struct header recv_hdr; char recv_body[1024]; struct iovec recv_iov[2] = { {.iov_base = &recv_hdr, .iov_len = sizeof(recv_hdr)}, {.iov_base = recv_body, .iov_len = sizeof(recv_body)} }; SocketBuf_readv(buf, recv_iov, 2); /* Scatter read */

/* Secure clear for sensitive data */ SocketBuf_secureclear(buf);

SocketBuf_release(&buf); Arena_dispose(&arena);

root@kitploit:~
### Protección contra inundación SYN```c
#include "core/SocketSYNProtect.h"

SocketSYNProtect_Config config = SYNPROTECT_CONFIG_DEFAULTS;
config.max_connections_per_ip = 10;
config.connection_rate_limit = 100;
config.challenge_threshold = 0.5;  /* Reputation score threshold */
config.block_threshold = 0.2;

SocketSYNProtect_T protect = SocketSYNProtect_new(NULL, &config);

/* On each incoming connection */
struct sockaddr_in client_addr;
socklen_t addr_len = sizeof(client_addr);
int client_fd = accept(server_fd, (struct sockaddr *)&client_addr, &addr_len);

SYNAction action = SocketSYNProtect_check(protect, &client_addr, addr_len);

switch (action) {
case SYN_ACTION_ALLOW:
    /* Accept connection normally */
    break;
case SYN_ACTION_THROTTLE:
    /* Accept but add delay */
    usleep(100000);
    break;
case SYN_ACTION_CHALLENGE:
    /* Send SYN cookie / challenge */
    break;
case SYN_ACTION_BLOCK:
    /* Reject connection */
    close(client_fd);
    break;
}

/* Report connection result for reputation update */
SocketSYNProtect_report(protect, &client_addr, addr_len, success);

/* Get statistics */
SocketSYNProtect_Stats stats;
SocketSYNProtect_stats(protect, &stats);

SocketSYNProtect_free(&protect);

Apagado ordenado```c

#include "pool/SocketPool.h"

/* Non-blocking drain for event loops / SocketPool_drain(pool, 30000); / Start 30s drain / while (SocketPool_drain_poll(pool) > 0) { SocketPoll_wait(poll, &events, SocketPool_drain_remaining_ms(pool)); / Process remaining events, connections closing naturally */ } SocketPool_free(&pool);

/* Blocking drain (convenience) / int result = SocketPool_drain_wait(pool, 30000); if (result < 0) { / Timeout - connections were force-closed */ }

/* Health check for load balancers / SocketPool_Health health = SocketPool_health(pool); if (health == POOL_HEALTH_DRAINING) { / Return 503 to load balancer */ }

root@kitploit:~
### Happy Eyeballs Connection (RFC 8305)```c
#include "socket/SocketHappyEyeballs.h"

/* Synchronous - races IPv6 and IPv4 for fastest connection */
Socket_T sock = SocketHappyEyeballs_connect("example.com", 443, NULL);
Socket_sendall(sock, "GET / HTTP/1.1\r\n\r\n", 18);
Socket_free(&sock);

/* Asynchronous - for event-driven applications */
SocketHE_Config_T config;
SocketHappyEyeballs_config_defaults(&config);
config.first_attempt_delay_ms = 250;  /* RFC 8305 default */
config.total_timeout_ms = 30000;

SocketHE_T he = SocketHappyEyeballs_start(dns, poll, "example.com", 443, &config);
while (!SocketHappyEyeballs_poll(he)) {
    int timeout = SocketHappyEyeballs_next_timeout_ms(he);
    SocketPoll_wait(poll, &events, timeout);
    SocketHappyEyeballs_process(he);
}
Socket_T result = SocketHappyEyeballs_result(he);
SocketHappyEyeballs_free(&he);

Reconexión automática con Circuit Breaker```c

#include "socket/SocketReconnect.h"

/* Configure reconnection policy */ SocketReconnect_Policy_T policy; SocketReconnect_policy_defaults(&policy); policy.initial_delay_ms = 100; policy.max_delay_ms = 30000; policy.multiplier = 2.0; policy.jitter = 0.25; policy.max_attempts = 10; policy.circuit_failure_threshold = 5; policy.circuit_reset_timeout_ms = 60000;

void on_state_change(SocketReconnect_T conn, SocketReconnect_State old, SocketReconnect_State new, void *data) { printf("State: %s -> %s\n", SocketReconnect_state_name(old), SocketReconnect_state_name(new)); }

SocketReconnect_T conn = SocketReconnect_new("example.com", 443, &policy, on_state_change, NULL); SocketReconnect_connect(conn);

/* Event loop */ while (running) { int timeout = SocketReconnect_next_timeout_ms(conn); poll(&pfd, 1, timeout); SocketReconnect_process(conn); SocketReconnect_tick(conn);

root@kitploit:~
if (SocketReconnect_isconnected(conn)) {
    /* I/O with auto-reconnect on error */
    ssize_t n = SocketReconnect_send(conn, data, len);
}

}

SocketReconnect_free(&conn);

root@kitploit:~
### Marco de Reintento Genérico```c
#include "core/SocketRetry.h"

/* Configure retry policy */
SocketRetry_Policy policy;
SocketRetry_policy_defaults(&policy);
policy.max_attempts = 5;
policy.initial_delay_ms = 100;
policy.max_delay_ms = 30000;
policy.multiplier = 2.0;
policy.jitter = 0.25;

/* Define operation to retry */
int connect_op(void *ctx, int attempt) {
    ConnectionCtx *c = ctx;
    return connect(c->fd, c->addr, c->addrlen) < 0 ? errno : 0;
}

/* Define retry decision callback */
int should_retry(int err, int attempt, void *ctx) {
    return SocketError_is_retryable_errno(err);
}

/* Execute with retries */
SocketRetry_T retry = SocketRetry_new(&policy);
int result = SocketRetry_execute(retry, connect_op, should_retry, &ctx);

/* Get statistics */
SocketRetry_Stats stats;
SocketRetry_get_stats(retry, &stats);
printf("Attempts: %d, Total delay: %lld ms\n", stats.attempts, stats.total_delay_ms);

SocketRetry_free(&retry);

Resolución Asíncrona de DNS```c

#include "dns/SocketDNS.h" #include "poll/SocketPoll.h"

SocketDNS_T dns = SocketDNS_new(); SocketPoll_T poll = SocketPoll_new(100);

/* Configure DNS timeouts / SocketDNS_settimeout(dns, 5000); / 5 second default timeout */

/* Configure DNS cache / SocketDNS_cache_set_ttl(dns, 300); / 5 minute TTL / SocketDNS_cache_set_max_entries(dns, 1000); / Max 1000 entries / SocketDNS_prefer_ipv6(dns, 1); / Prefer IPv6 */

/* Start async resolution */ SocketDNS_Request_T req = SocketDNS_resolve(dns, "example.com", 80, NULL, NULL);

/* Per-request timeout override */ SocketDNS_request_settimeout(dns, req, 10000);

/* In event loop, check for completions */ SocketDNS_check(dns);

/* Get result */ struct addrinfo *result = SocketDNS_getresult(dns, req); if (result) { Socket_connect_with_addrinfo(socket, result); freeaddrinfo(result); } else { int error = SocketDNS_geterror(dns, req); fprintf(stderr, "DNS failed: %s\n", gai_strerror(error)); }

/* Monitor cache performance */ SocketDNS_CacheStats stats; SocketDNS_cache_stats(dns, &stats); printf("DNS cache hit rate: %.1f%% (%zu entries)\n", stats.hit_rate * 100.0, stats.current_size);

/* Clear cache when DNS records change */ SocketDNS_cache_clear(dns);

/* Remove specific entry */ SocketDNS_cache_remove(dns, "example.com");

SocketDNS_free(&dns); SocketPoll_free(&poll);

root@kitploit:~
### E/S asíncrona (io_uring/kqueue)```c
#include "socket/SocketAsync.h"
#include "poll/SocketPoll.h"

/* Check what backend is available */
if (SocketAsync_backend_available(ASYNC_BACKEND_IO_URING)) {
    printf("io_uring available - optimal async I/O\n");
} else if (SocketAsync_backend_available(ASYNC_BACKEND_KQUEUE)) {
    printf("kqueue available - good async I/O\n");
} else {
    printf("Using poll-based fallback\n");
}

/* Set preferred backend (optional) */
SocketAsync_set_backend(ASYNC_BACKEND_IO_URING);

/* Get async context from poll */
SocketPoll_T poll = SocketPoll_new(1024);
SocketAsync_T async = SocketPoll_get_async(poll);

/* Completion callback */
void io_complete(Socket_T socket, ssize_t bytes, int err, void *ud) {
    if (err) {
        printf("Error: %s\n", strerror(err));
        return;
    }
    printf("Transferred %zd bytes\n", bytes);
}

/* Submit async send */
unsigned req_id = SocketAsync_send(async, socket, buf, len,
                                   io_complete, userdata, ASYNC_FLAG_NONE);

/* Submit async recv */
req_id = SocketAsync_recv(async, socket, recv_buf, sizeof(recv_buf),
                          io_complete, userdata, ASYNC_FLAG_ZERO_COPY);

/* Batch submission for efficiency */
SocketAsync_Op ops[3] = {
    {sock1, 1, send_buf, NULL, len1, io_complete, ud1, ASYNC_FLAG_NONE, 0},
    {sock2, 0, NULL, recv_buf, len2, io_complete, ud2, ASYNC_FLAG_NONE, 0},
    {sock3, 1, send_buf2, NULL, len3, io_complete, ud3, ASYNC_FLAG_URGENT, 0}
};
int submitted = SocketAsync_submit_batch(async, ops, 3);
printf("Submitted %d operations\n", submitted);

/* Cancel specific operation */
SocketAsync_cancel(async, req_id);

/* Cancel all pending (during shutdown) */
int cancelled = SocketAsync_cancel_all(async);
printf("Cancelled %d pending ops\n", cancelled);

/* Check backend in use */
printf("Backend: %s, available: %s\n",
       SocketAsync_backend_name(async),
       SocketAsync_is_available(async) ? "yes" : "fallback");

/* Completions auto-processed in SocketPoll_wait() */
SocketEvent_T *events;
int n = SocketPoll_wait(poll, &events, 100);

SocketPoll_free(&poll);

Limitación de ancho de banda```c

#include "socket/Socket.h"

Socket_T socket = Socket_new(AF_INET, SOCK_STREAM, 0); Socket_connect(socket, "example.com", 80);

/* Enable bandwidth limiting: 1 MB/sec */ Socket_setbandwidth(socket, 1024 * 1024);

/* Rate-limited send / ssize_t n = Socket_send_limited(socket, data, len); if (n == 0) { / Rate limited - wait before retry / int64_t wait_ms = Socket_bandwidth_wait_ms(socket, len); / Use wait_ms as poll timeout */ }

/* Query current limit */ size_t limit = Socket_getbandwidth(socket);

Socket_free(&socket);

root@kitploit:~
### Salud de la conexión y sondeo```c
#include "socket/Socket.h"

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "example.com", 80);

/* Quick health check (non-blocking) */
if (!Socket_probe(sock, 0)) {
    printf("Connection appears dead\n");
}

/* Health check with timeout (waits up to 100ms for response) */
if (!Socket_probe(sock, 100)) {
    printf("Connection lost, reconnecting...\n");
}

/* Check for pending socket errors (after non-blocking connect) */
int error = Socket_get_error(sock);
if (error != 0) {
    printf("Socket error: %s\n", strerror(error));
}

/* Check read/write readiness without blocking */
if (Socket_is_readable(sock) > 0) {
    char buf[1024];
    ssize_t n = Socket_recv(sock, buf, sizeof(buf));
}

if (Socket_is_writable(sock) > 0) {
    Socket_send(sock, "GET / HTTP/1.1\r\n\r\n", 18);
}

#ifdef __linux__
/* Get TCP stack statistics (Linux only) */
SocketTCPInfo info;
if (Socket_get_tcp_info(sock, &info) == 0) {
    printf("RTT: %.2f ms\n", info.rtt_us / 1000.0);
    printf("Congestion window: %u segments\n", info.snd_cwnd);
    printf("Retransmissions: %u\n", info.total_retrans);
    if (info.delivery_rate > 0) {
        printf("Delivery rate: %.2f Mbps\n", info.delivery_rate * 8.0 / 1e6);
    }
}
#endif

/* Simple RTT query (cross-platform, returns -1 if unavailable) */
int32_t rtt = Socket_get_rtt(sock);
if (rtt >= 0) {
    printf("RTT: %.2f ms\n", rtt / 1000.0);
}

/* Congestion window query (Linux only) */
int32_t cwnd = Socket_get_cwnd(sock);
if (cwnd >= 0) {
    printf("CWND: %d segments\n", cwnd);
}

Socket_free(&sock);

E/S con tiempos de espera```c

#include "socket/Socket.h"

Socket_T sock = Socket_connect_tcp("example.com", 80, 5000);

/* Send all data with timeout (returns bytes actually sent) */ ssize_t sent = Socket_sendall_timeout(sock, request, len, 10000); if (sent < (ssize_t)len) { printf("Only sent %zd bytes before timeout\n", sent); }

/* Receive with timeout (returns bytes received) */ char response[4096]; ssize_t n = Socket_recvall_timeout(sock, response, sizeof(response), 5000); if (n > 0) { printf("Received %zd bytes\n", n); }

/* Scatter/gather I/O with timeout */ struct iovec iov[2] = { {.iov_base = header, .iov_len = header_len}, {.iov_base = body, .iov_len = body_len} }; ssize_t sent_v = Socket_sendv_timeout(sock, iov, 2, 5000);

Socket_free(&sock);

root@kitploit:~
### Operaciones Avanzadas de E/S```c
#include "socket/Socket.h"

/* Peek at data without consuming */
char peek_buf[16];
ssize_t peeked = Socket_peek(sock, peek_buf, sizeof(peek_buf));
if (peeked > 0) {
    printf("Peeked %zd bytes: protocol=%d\n", peeked, peek_buf[0]);
}

/* TCP cork for efficient message assembly */
Socket_cork(sock, 1);  /* Enable corking */
Socket_send(sock, headers, header_len);
Socket_send(sock, body, body_len);
Socket_cork(sock, 0);  /* Disable cork, flush all data */

#ifdef __linux__
/* Zero-copy socket-to-socket transfer (Linux only) */
ssize_t spliced = Socket_splice(client, upstream, 65536);
if (spliced > 0) {
    printf("Spliced %zd bytes\n", spliced);
} else if (spliced == 0) {
    /* Would block - poll for readiness */
} else {
    /* Not supported on this platform */
    char buf[4096];
    while ((n = Socket_recv(client, buf, sizeof(buf))) > 0) {
        Socket_sendall(upstream, buf, n);
    }
}
#endif

Duplicación de sockets```c

#include "socket/Socket.h"

Socket_T socket = Socket_connect_tcp("example.com", 80, 5000);

/* Duplicate socket for separate reader/writer threads */ Socket_T reader = socket; Socket_T writer = Socket_dup(socket);

/* Now can be used in separate threads safely / / reader thread: Socket_recv(reader, ...) / / writer thread: Socket_send(writer, ...) */

/* Duplicate to specific fd (useful for exec) / Socket_T sock_fd3 = Socket_dup2(socket, 3); if (fork() == 0) { / Child process can access socket on fd 3 */ execl("/usr/bin/handler", "handler", NULL); }

Socket_free(&writer); Socket_free(&reader); Socket_free(&sock_fd3);

root@kitploit:~
### Temporizadores```c
#include "poll/SocketPoll.h"
#include "core/SocketTimer.h"

SocketPoll_T poll = SocketPoll_new(100);

/* Check which backend is in use */
printf("Backend: %s\n", SocketPoll_get_backend_name(poll));
// Output: "epoll" (Linux), "kqueue" (macOS/BSD), or "poll" (fallback)

void timer_callback(void *userdata) {
    printf("Timer fired!\n");
}

/* One-shot timer (fires once after 5 seconds) */
SocketTimer_T timer = SocketTimer_add(poll, 5000, timer_callback, NULL);

/* Repeating timer (fires every 1 second) */
SocketTimer_T heartbeat = SocketTimer_add_repeating(poll, 1000, timer_callback, NULL);

/* Check remaining time */
int64_t remaining = SocketTimer_remaining(poll, timer);

/* Reschedule timer with new delay (extends/shortens timeout) */
SocketTimer_reschedule(poll, timer, 10000);  /* Now fires in 10 seconds */

/* Pause and resume timers */
SocketTimer_pause(poll, heartbeat);   /* Stops firing, preserves remaining time */
/* ... do something ... */
SocketTimer_resume(poll, heartbeat);  /* Continues from where it paused */

/* Cancel timer */
SocketTimer_cancel(poll, heartbeat);

/* Modify events for registered sockets */
Socket_T sock = /* ... */;
SocketPoll_add(poll, sock, POLL_READ, NULL);
SocketPoll_modify_events(poll, sock, POLL_WRITE, 0);  /* Add write monitoring */
SocketPoll_modify_events(poll, sock, 0, POLL_WRITE);  /* Remove write monitoring */

/* List registered sockets */
Socket_T sockets[100];
int count = SocketPoll_get_registered_sockets(poll, sockets, 100);
printf("Monitoring %d sockets\n", count);

/* Timers fire automatically during SocketPoll_wait() */
SocketEvent_T *events;
int n = SocketPoll_wait(poll, &events, -1);

SocketPoll_free(&poll);

Limitación de Tasa con Cubo de Tokens```c

#include "core/SocketRateLimit.h"

/* Create rate limiter: 100 tokens/sec, burst capacity of 50 */ SocketRateLimit_T limiter = SocketRateLimit_new(NULL, 100, 50);

/* Try to acquire tokens (non-blocking) / if (SocketRateLimit_try_acquire(limiter, 1)) { / Allowed - proceed / handle_request(); } else { / Rate limited - calculate wait time / int64_t wait_ms = SocketRateLimit_wait_time_ms(limiter, 1); if (wait_ms > 0) { / Wait or reject */ } }

/* Query state */ size_t available = SocketRateLimit_available(limiter); size_t rate = SocketRateLimit_get_rate(limiter);

/* Reconfigure at runtime */ SocketRateLimit_configure(limiter, 200, 100);

SocketRateLimit_free(&limiter);

root@kitploit:~
### TLS/SSL Comunicación Segura```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* Create client TLS context */
SocketTLSContext_T ctx = SocketTLSContext_new_client("/etc/ssl/certs/ca-certificates.crt");

/* Configure ALPN protocols */
const char *protos[] = {"h2", "http/1.1"};
SocketTLSContext_set_alpn_protos(ctx, protos, 2);

/* Enable session caching for performance */
SocketTLSContext_enable_session_cache(ctx, 1000, 300);

/* Create and connect socket */
Socket_T socket = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(socket, "example.com", 443);

/* Enable TLS */
SocketTLS_enable(socket, ctx);
SocketTLS_set_hostname(socket, "example.com");  /* SNI + verification */

/* Perform handshake (with timeout) */
TLSHandshakeState state = SocketTLS_handshake_loop(socket, 10000);
if (state != TLS_HANDSHAKE_COMPLETE) {
    fprintf(stderr, "Handshake failed\n");
}

/* Check negotiated protocol */
const char *alpn = SocketTLS_get_alpn_selected(socket);
printf("ALPN: %s\n", alpn ? alpn : "none");
printf("Cipher: %s\n", SocketTLS_get_cipher(socket));
printf("Version: %s\n", SocketTLS_get_version(socket));

/* Encrypted I/O */
SocketTLS_send(socket, "GET / HTTP/1.1\r\n\r\n", 18);
char buf[4096];
ssize_t n = SocketTLS_recv(socket, buf, sizeof(buf));

/* Graceful shutdown */
SocketTLS_shutdown(socket);
Socket_free(&socket);
SocketTLSContext_free(&ctx);

Reanudación de Sesión TLS```c

#include "tls/SocketTLS.h"

/* Save session for later resumption */ size_t session_len = 4096; unsigned char session_data[4096];

if (SocketTLS_session_save(sock, session_data, &session_len) == 1) { /* Store session_data[:session_len] to disk/cache */ write_session_to_cache(hostname, session_data, session_len); }

/* Later: restore session for faster reconnect */ Socket_T sock2 = Socket_connect_tcp(hostname, port, 5000); SocketTLS_enable(sock2, ctx); SocketTLS_set_hostname(sock2, hostname);

/* Restore previously saved session */ unsigned char *cached_session = read_session_from_cache(hostname, &cached_len); if (cached_session) { SocketTLS_session_restore(sock2, cached_session, cached_len); free(cached_session); }

SocketTLS_handshake_auto(sock2);

/* Check if session was resumed (0-RTT or abbreviated handshake) */ if (SocketTLS_is_session_reused(sock2)) { printf("Session resumed - faster handshake!\n"); }

root@kitploit:~
### Información del certificado TLS```c
#include "tls/SocketTLS.h"

/* Get full certificate details */
SocketTLS_CertInfo info;
if (SocketTLS_get_peer_cert_info(sock, &info) == 1) {
    printf("Subject: %s\n", info.subject);
    printf("Issuer: %s\n", info.issuer);
    printf("Version: X.509v%d\n", info.version);
    printf("Serial: %s\n", info.serial);
    printf("Fingerprint: %s\n", info.fingerprint);
    printf("Valid from: %s", ctime(&info.not_before));
    printf("Valid until: %s", ctime(&info.not_after));
}

/* Quick certificate expiry check */
time_t expiry = SocketTLS_get_cert_expiry(sock);
if (expiry != (time_t)-1) {
    time_t now = time(NULL);
    int days_left = (expiry - now) / 86400;
    if (days_left < 30) {
        printf("Warning: Certificate expires in %d days!\n", days_left);
    }
}

/* Just get subject for logging */
char subject[256];
if (SocketTLS_get_cert_subject(sock, subject, sizeof(subject)) > 0) {
    printf("Connected to: %s\n", subject);
}

TLS OCSP y Renegociación```c

#include "tls/SocketTLS.h"

/* Check OCSP stapling status */ int ocsp_status = SocketTLS_get_ocsp_response_status(sock); switch (ocsp_status) { case 1: printf("Certificate verified via OCSP\n"); break; case 0: printf("WARNING: Certificate REVOKED!\n"); Socket_free(&sock); return; case -1: printf("No OCSP response (server doesn't support stapling)\n"); break; case -2: printf("OCSP response verification failed\n"); break; }

/* Disable renegotiation for security (prevents DoS attacks) */ SocketTLS_disable_renegotiation(sock);

/* Or check for pending renegotiation requests */ int reneg = SocketTLS_check_renegotiation(sock); if (reneg == 1) { printf("Renegotiation completed\n"); } else if (reneg == -1) { printf("Renegotiation rejected (disabled or TLS 1.3)\n"); }

root@kitploit:~
### Servidor TLS con SNI y Fijación de Certificados```c
#include "tls/SocketTLSContext.h"

/* Create server context with primary certificate */
SocketTLSContext_T ctx = SocketTLSContext_new_server(
    "server.crt", "server.key", "ca-bundle.crt");

/* Add SNI certificates for virtual hosting */
SocketTLSContext_add_certificate(ctx, "www.example.com", 
                                  "www.crt", "www.key");
SocketTLSContext_add_certificate(ctx, "api.example.com",
                                  "api.crt", "api.key");

/* Enable client certificate verification */
SocketTLSContext_set_verify_mode(ctx, TLS_VERIFY_PEER);

/* Load CRL for revocation checking */
SocketTLSContext_load_crl(ctx, "/path/to/crl.pem");

/* Enable OCSP stapling */
unsigned char ocsp_response[4096];
size_t ocsp_len = load_ocsp_response(ocsp_response, sizeof(ocsp_response));
SocketTLSContext_set_ocsp_response(ctx, ocsp_response, ocsp_len);

/* Enable session tickets */
unsigned char ticket_key[80];
generate_ticket_key(ticket_key, sizeof(ticket_key));
SocketTLSContext_enable_session_tickets(ctx, ticket_key, sizeof(ticket_key));

/* Certificate pinning (client context) */
SocketTLSContext_T client_ctx = SocketTLSContext_new_client("ca-bundle.pem");
SocketTLSContext_add_pin_hex(client_ctx, 
    "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c");
SocketTLSContext_set_pin_enforcement(client_ctx, 1);  /* Strict mode */

Transparencia de Certificados (CT)```c

#include "tls/SocketTLSContext.h"

/* Enable Certificate Transparency validation (RFC 6962) */ SocketTLSContext_T ctx = SocketTLSContext_new_client("ca-bundle.pem");

/* Strict mode - fail if no valid SCTs */ SocketTLSContext_enable_ct(ctx, CT_VALIDATION_STRICT);

/* Or permissive mode - log but continue */ SocketTLSContext_enable_ct(ctx, CT_VALIDATION_PERMISSIVE);

/* Custom CT log list (optional) */ SocketTLSContext_set_ctlog_list_file(ctx, "/path/to/ctlogs.txt");

/* Query CT status */ if (SocketTLSContext_ct_enabled(ctx)) { CTValidationMode mode = SocketTLSContext_get_ct_mode(ctx); printf("CT validation: %s\n", mode == CT_VALIDATION_STRICT ? "strict" : "permissive"); }

root@kitploit:~
### OCSP Must-Staple (RFC 7633)```c
#include "tls/SocketTLSContext.h"

/* Create client context with must-staple enforcement */
SocketTLSContext_T ctx = SocketTLSContext_new_client("ca-bundle.pem");

/* Auto-detection: respect certificate's must-staple extension */
SocketTLSContext_set_ocsp_must_staple(ctx, OCSP_MUST_STAPLE_AUTO);

/* Or always require OCSP stapling for strict security policies */
SocketTLSContext_set_ocsp_must_staple(ctx, OCSP_MUST_STAPLE_ALWAYS);

/* Query current mode */
OCSPMustStapleMode mode = SocketTLSContext_get_ocsp_must_staple(ctx);

/* Connect and handshake - fails if must-staple cert has no OCSP response */
SocketTLS_enable(sock, ctx);
SocketTLS_handshake_auto(sock);

kTLS (TLS del kernel) Descarga

kTLS descarga el cifrado/descifrado TLS al kernel de Linux para mejorar el rendimiento.```c #include "tls/SocketTLS.h"

/* Check if kTLS is available on this system */ if (SocketTLS_ktls_available()) { printf("kTLS available - optimal async I/O\n"); }

/* Enable kTLS before handshake / SocketTLS_enable(sock, ctx); SocketTLS_enable_ktls(sock); / Request kTLS offload */ SocketTLS_handshake_auto(sock);

/* Check if offload is active after handshake */ if (SocketTLS_is_ktls_tx_active(sock)) { printf("TX offload active\n"); } if (SocketTLS_is_ktls_rx_active(sock)) { printf("RX offload active\n"); }

/* Zero-copy file transfer with kTLS (uses SSL_sendfile internally) */ int file_fd = open("largefile.bin", O_RDONLY); off_t offset = 0; ssize_t sent = SocketTLS_sendfile(sock, file_fd, offset, file_size); close(file_fd);

root@kitploit:~
**Requisitos de kTLS:**
| Característica | Requisito |
|---------|-------------|
| TX offload | Linux 4.13+, OpenSSL 3.0+ con enable-ktls |
| RX offload | Linux 4.17+ |
| ChaCha20 | Linux 5.11+ |
| Cifrados | AES-GCM-128/256, ChaCha20-Poly1305 |

### TLS 1.3 0-RTT Datos Tempranos```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* Server: Enable 0-RTT early data reception */
SocketTLSContext_T srv_ctx = SocketTLSContext_new_server("cert.pem", "key.pem", NULL);
SocketTLSContext_enable_early_data(srv_ctx, 16384);  /* Max 16KB early data */

/* Client: Send early data during handshake */
SocketTLS_enable(sock, ctx);
SocketTLS_set_hostname(sock, "example.com");

/* Write early data (before handshake completes) */
size_t written = 0;
int ret = SocketTLS_write_early_data(sock, "GET / HTTP/1.1\r\n\r\n", 18, &written);
if (ret == 1) {
    printf("Sent %zu bytes as early data\n", written);
}

/* Complete handshake */
SocketTLS_handshake_auto(sock);

/* Check if early data was accepted */
SocketTLS_EarlyDataStatus status = SocketTLS_get_early_data_status(sock);
if (status == SOCKET_EARLY_DATA_REJECTED) {
    /* Server rejected - resend via normal I/O */
    SocketTLS_send(sock, "GET / HTTP/1.1\r\n\r\n", 18);
}

/* Server: Read early data during handshake */
unsigned char early_buf[4096];
size_t readbytes = 0;
ret = SocketTLS_read_early_data(srv_sock, early_buf, sizeof(early_buf), &readbytes);

Advertencia de seguridad: 0-RTT NO está protegido contra repeticiones. Úselo solo para operaciones idempotentes.

TLS 1.3 KeyUpdate (Rotación de claves)```c

#include "tls/SocketTLS.h"

/* For long-lived connections, rotate keys periodically for forward secrecy */

/* Request key update (local only) */ int ret = SocketTLS_request_key_update(sock, 0);

/* Request key update and ask peer to also rotate */ ret = SocketTLS_request_key_update(sock, 1);

/* Monitor key rotations performed */ int count = SocketTLS_get_key_update_count(sock); printf("Key rotations: %d\n", count);

root@kitploit:~
**Uso recomendado:**
- Conexiones de base de datos abiertas por horas/días
- Túneles VPN
- Conexiones WebSocket persistentes
- Rotar cada hora o cada 1GB de datos transferidos

### Optimizaciones de rendimiento TLS```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* TCP handshake optimization - apply before TLS handshake */
SocketTLS_optimize_handshake(sock);  /* Sets TCP_NODELAY + TCP_QUICKACK */

/* After bulk transfer, optionally restore defaults */
SocketTLS_restore_tcp_defaults(sock);  /* Re-enables Nagle */

/* Session cache sharding for multi-threaded servers */
SocketTLSContext_create_sharded_cache(ctx, 
    8,      /* Number of shards (match thread count) */
    1000,   /* Sessions per shard */
    300);   /* Timeout in seconds */

/* Get aggregate statistics from sharded cache */
size_t total_hits, total_misses, total_stores;
SocketTLSContext_get_sharded_stats(ctx, &total_hits, &total_misses, &total_stores);

/* TLS buffer pool for high-connection scenarios */
Arena_T arena = Arena_new();
TLSBufferPool_T pool = TLSBufferPool_new(16384, 100, arena);  /* 16KB buffers, 100 count */

/* Acquire buffer for connection */
void *buf = TLSBufferPool_acquire(pool);
/* ... use buffer for TLS I/O ... */
TLSBufferPool_release(pool, buf);

/* Check pool statistics */
size_t total, in_use, available;
TLSBufferPool_stats(pool, &total, &in_use, &available);

TLSBufferPool_free(&pool);
Arena_dispose(&arena);

CRL Actualización automática```c

#include "tls/SocketTLSContext.h"

/* Callback for refresh notifications */ void crl_refresh_callback(SocketTLSContext_T ctx, const char *path, int success, void *data) { if (!success) { fprintf(stderr, "CRL refresh failed for %s\n", path); } }

/* Configure automatic CRL refresh (minimum 60 seconds) / SocketTLSContext_set_crl_auto_refresh(ctx, "/path/to/crl.pem", 3600, / Refresh every hour */ crl_refresh_callback, NULL);

/* In event loop: check if refresh is due / while (running) { / ... process events ... */ SocketTLSContext_crl_check_refresh(ctx);

root@kitploit:~
/* Get time until next refresh for poll timeout optimization */
int64_t next_ms = SocketTLSContext_crl_next_refresh_ms(ctx);

}

/* Cancel auto-refresh (retains currently loaded CRL) */ SocketTLSContext_cancel_crl_auto_refresh(ctx);

root@kitploit:~
### Transferencia de Archivos con Copia Cero```c
int file_fd = open("largefile.bin", O_RDONLY);
struct stat st;
fstat(file_fd, &st);

off_t offset = 0;
ssize_t sent = Socket_sendfileall(socket, file_fd, &offset, st.st_size);
close(file_fd);

Scatter/Gather I/O```c

struct iovec iov[3]; iov[0].iov_base = header; iov[0].iov_len = header_len; iov[1].iov_base = body; iov[1].iov_len = body_len; iov[2].iov_base = footer; iov[2].iov_len = footer_len;

/* Send all data atomically */ ssize_t sent = Socket_sendvall(socket, iov, 3);

root@kitploit:~
### Sockets de dominio Unix con Paso de FD```c
#include "socket/Socket.h"

/* Stream socket pair for IPC */
Socket_T sock1, sock2;
SocketPair_new(SOCK_STREAM, &sock1, &sock2);

/* Server socket */
Socket_T server = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_bind_unix(server, "/tmp/my.sock");
Socket_listen(server, 10);

/* Client connection */
Socket_T client = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_connect_unix(client, "/tmp/my.sock");

/* Get peer credentials (Linux only) */
int peer_pid = Socket_getpeerpid(accepted);
int peer_uid = Socket_getpeeruid(accepted);
int peer_gid = Socket_getpeergid(accepted);

/* Abstract namespace (Linux only - prefix with @) */
Socket_bind_unix(server, "@abstract-socket");

/* File descriptor passing (SCM_RIGHTS) */
int fd_to_pass = open("/etc/passwd", O_RDONLY);
Socket_sendfd(sock1, fd_to_pass);
close(fd_to_pass);

/* Receive passed FD */
int received_fd;
Socket_recvfd(sock2, &received_fd);
/* received_fd is now a valid FD in this process */
close(received_fd);

/* Multiple FD passing */
int fds[3] = {fd1, fd2, fd3};
Socket_sendfds(sock1, fds, 3);

int received_fds[3];
size_t num_fds;
Socket_recvfds(sock2, received_fds, 3, &num_fds);

Utilidades Criptográficas```c

#include "core/SocketCrypto.h"

/* SHA-256 hash */ unsigned char hash[SOCKET_CRYPTO_SHA256_SIZE]; SocketCrypto_sha256(data, data_len, hash);

/* HMAC-SHA256 */ unsigned char mac[SOCKET_CRYPTO_SHA256_SIZE]; SocketCrypto_hmac_sha256(key, key_len, data, data_len, mac);

/* Base64 encoding */ size_t encoded_len = SocketCrypto_base64_encoded_size(data_len); char *encoded = malloc(encoded_len); SocketCrypto_base64_encode(data, data_len, encoded, encoded_len);

/* Cryptographically secure random */ unsigned char random_bytes[32]; SocketCrypto_random_bytes(random_bytes, sizeof(random_bytes));

/* Constant-time comparison (prevents timing attacks) / if (SocketCrypto_secure_compare(expected, actual, len)) { / Match */ }

/* Secure memory clearing */ SocketCrypto_secure_clear(password, password_len);

root@kitploit:~
### Observabilidad - Registros```c
#include "core/SocketUtil.h"

/* Custom logging callback */
void my_logger(void *userdata, SocketLogLevel level,
               const char *component, const char *message) {
    printf("[%s] %s: %s\n", SocketLog_levelname(level), component, message);
}
SocketLog_setcallback(my_logger, NULL);

/* Set minimum log level */
SocketLog_setlevel(SOCKET_LOG_DEBUG);

/* Use convenience macros */
#define SOCKET_LOG_COMPONENT "MyApp"
SOCKET_LOG_INFO_MSG("Server started on port %d", port);
SOCKET_LOG_ERROR_MSG("Connection failed: %s", strerror(errno));

/* Correlation IDs for distributed tracing */
SocketLogContext ctx = {0};
strncpy(ctx.request_id, "req-12345", sizeof(ctx.request_id) - 1);
strncpy(ctx.trace_id, "trace-abcde", sizeof(ctx.trace_id) - 1);
SocketLog_setcontext(&ctx);
SOCKET_LOG_INFO_MSG("Processing request");  /* Includes correlation IDs */
SocketLog_clearcontext();

Observabilidad - Métricas```c

#include "core/SocketMetrics.h"

/* Record metrics */ SocketMetrics_counter_inc(SOCKET_CTR_SOCKET_CREATED); SocketMetrics_gauge_set(SOCKET_GAU_POOL_ACTIVE_CONNECTIONS, 42); SocketMetrics_histogram_observe(SOCKET_HIST_HTTP_CLIENT_REQUEST_LATENCY_MS, 125.0);

/* Get percentiles */ double p99 = SocketMetrics_histogram_percentile(SOCKET_HIST_HTTP_CLIENT_REQUEST_LATENCY_MS, 99.0);

/* Export to Prometheus */ char buffer[65536]; size_t len = SocketMetrics_export_prometheus(buffer, sizeof(buffer));

/* Export to StatsD */ SocketMetrics_export_statsd(buffer, sizeof(buffer), "myapp.socket");

/* Export to JSON */ SocketMetrics_export_json(buffer, sizeof(buffer));

/* Get complete snapshot */ SocketMetrics_Snapshot snapshot; SocketMetrics_get(&snapshot);

/* Reset metrics */ SocketMetrics_reset();

/* Socket count and peak tracking / int current = SocketMetrics_get_socket_count(); int peak = SocketMetrics_get_peak_connections(); SocketMetrics_reset_peaks(); / Reset high watermark */

root@kitploit:~
### Estadísticas por Socket

Rastrea estadísticas de E/S para sockets individuales:```c
#include "socket/Socket.h"

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "example.com", 80);

/* ... send/recv operations ... */

/* Get per-socket statistics */
SocketStats_T stats;
Socket_getstats(sock, &stats);

printf("Bytes: %zu sent, %zu received\n",
       (size_t)stats.bytes_sent, (size_t)stats.bytes_received);
printf("Packets: %zu sent, %zu received\n",
       (size_t)stats.packets_sent, (size_t)stats.packets_received);
printf("Errors: %zu send, %zu recv\n",
       (size_t)stats.send_errors, (size_t)stats.recv_errors);
printf("Last activity: send=%lld ms, recv=%lld ms ago\n",
       (long long)(Socket_get_monotonic_ms() - stats.last_send_time_ms),
       (long long)(Socket_get_monotonic_ms() - stats.last_recv_time_ms));

/* RTT estimation (Linux only via TCP_INFO) */
if (stats.rtt_us >= 0) {
    printf("RTT: %.2f ms (var: %.2f ms)\n",
           stats.rtt_us / 1000.0, stats.rtt_var_us / 1000.0);
}

/* Reset statistics for next interval */
Socket_resetstats(sock);

Socket_free(&sock);

Opciones Avanzadas de TCP```c

/* Congestion control algorithm (Linux only) */ Socket_setcongestion(socket, "bbr"); char algo[16]; Socket_getcongestion(socket, algo, sizeof(algo));

/* TCP Fast Open (Linux 3.7+, FreeBSD 10.0+, macOS 10.11+) */ Socket_setfastopen(socket, 1);

/* TCP user timeout (Linux 2.6.37+) / Socket_setusertimeout(socket, 30000); / 30 seconds */

/* TCP keepalive / Socket_setkeepalive(socket, 60, 10, 5); / idle=60s, interval=10s, count=5 */

/* Disable Nagle's algorithm */ Socket_setnodelay(socket, 1);

/* Buffer sizes */ Socket_setrcvbuf(socket, 262144); Socket_setsndbuf(socket, 262144);

/* SYN flood protection / Socket_setdeferaccept(socket, 10); / Wait 10s for data before accept() */

root@kitploit:~
## Arquitectura

### Organización de Módulos```
include/
├── core/          # Foundation layer
│   ├── Arena.h          # Arena memory management
│   ├── Except.h         # Exception handling
│   ├── SocketConfig.h   # Configuration constants
│   ├── SocketCrypto.h   # Cryptographic utilities
│   ├── SocketIPTracker.h # Per-IP connection tracking
│   ├── SocketMetrics.h  # Production metrics (counters, gauges, histograms)
│   ├── SocketRateLimit.h # Token bucket rate limiting
│   ├── SocketRetry.h    # Generic retry with exponential backoff
│   ├── SocketSecurity.h # Security utilities
│   ├── SocketSYNProtect.h # SYN flood protection
│   ├── SocketTimer.h    # Timer management
│   ├── SocketUTF8.h     # UTF-8 validation
│   └── SocketUtil.h     # Logging, error handling, utilities
├── socket/        # Core I/O layer
│   ├── Socket.h         # TCP/Unix domain sockets
│   ├── SocketAsync.h    # Async I/O (io_uring/kqueue)
│   ├── SocketBuf.h      # Circular buffer
│   ├── SocketCommon.h   # Shared socket base
│   ├── SocketDgram.h    # UDP sockets
│   ├── SocketHappyEyeballs.h # RFC 8305 connection racing
│   ├── SocketIO.h       # I/O helpers
│   ├── SocketProxy.h    # HTTP CONNECT/SOCKS proxy
│   ├── SocketReconnect.h # Auto-reconnection
│   └── SocketWS.h       # WebSocket (RFC 6455)
├── dns/           # DNS layer
│   ├── SocketDNS.h      # Async DNS resolution
│   ├── SocketDNSoverTLS.h # DNS-over-TLS (RFC 7858)
│   ├── SocketDNSoverHTTPS.h # DNS-over-HTTPS (RFC 8484)
│   ├── SocketDNSSEC.h   # DNSSEC validation (RFC 4033-4035)
│   ├── SocketDNSCookie.h # DNS cookies (RFC 7873)
│   ├── SocketDNSResolver.h # High-level resolver API
│   ├── SocketDNSWire.h  # Wire format encoding/decoding
│   ├── SocketDNSTransport.h # UDP/TCP transport layer
│   ├── SocketDNSNegCache.h # Negative response caching
│   └── SocketDNSError.h # Extended DNS errors (RFC 8914)
├── poll/          # Event system
│   └── SocketPoll.h     # Cross-platform polling
├── pool/          # Connection management
│   └── SocketPool.h     # Connection pooling
├── tls/           # Security layer
│   ├── SocketTLS.h      # TLS operations
│   ├── SocketTLSContext.h # TLS context management
│   ├── SocketTLSConfig.h # TLS configuration constants
│   ├── SocketDTLS.h     # DTLS operations
│   ├── SocketDTLSContext.h # DTLS context management
│   └── SocketDTLSConfig.h # DTLS configuration constants
├── http/          # HTTP protocol stack
│   ├── SocketHTTP.h     # HTTP core (RFC 9110)
│   ├── SocketHTTP1.h    # HTTP/1.1 (RFC 9112)
│   ├── SocketHPACK.h    # HPACK (RFC 7541)
│   ├── SocketHTTP2.h    # HTTP/2 (RFC 9113)
│   ├── SocketHTTPClient.h # HTTP client API
│   └── SocketHTTPServer.h # HTTP server API
├── quic/          # QUIC transport layer
│   ├── SocketQUICConnection.h # Connection management (RFC 9000)
│   ├── SocketQUICStream.h   # Stream multiplexing
│   ├── SocketQUICPacket.h   # Packet parsing/serialization
│   ├── SocketQUICFrame.h    # Frame encoding/decoding
│   ├── SocketQUICHandshake.h # TLS 1.3 handshake integration
│   ├── SocketQUICFlow.h     # Flow control
│   ├── SocketQUICLoss.h     # Loss detection (RFC 9002)
│   ├── SocketQUICMigration.h # Path migration
│   └── SocketQUICVersion.h  # Version negotiation
└── simple/        # Return-code based convenience API
    ├── SocketSimple.h       # Core simple socket API
    ├── SocketSimple-http.h  # Simple HTTP client
    ├── SocketSimple-tls.h   # Simple TLS connections
    ├── SocketSimple-ws.h    # Simple WebSocket
    └── SocketSimple-dns.h   # Simple DNS resolution

Arquitectura en Capas

  1. Fundación: Arena (Memoria), Except (Errores), SocketCrypto (Primitivas criptográficas)
  2. Utilidades: SocketUtil (Registro, Métricas, Eventos, Manejo de Errores), SocketTimer, SocketRateLimit, SocketUTF8, SocketRetry
  3. Abstracción Base: SocketCommon (Base compartida SocketBase_T para Socket/SocketDgram)
  4. E/S Principal: Socket (TCP/Unix), SocketDgram (UDP), SocketBuf (Búferes), SocketIO (Ayudantes de E/S)

Seguridad en Hilos

Manejo de Señales

SIGPIPE (Automático)

No se requiere acción de la aplicación. La biblioteca maneja SIGPIPE internamente:

PlataformaMecanismoCuándo se aplica
Linux/FreeBSDBandera MSG_NOSIGNALCada operación de envío
BSD/macOSOpción SO_NOSIGPIPEEn el momento de creación del socket

Las aplicaciones NO necesitan llamar a signal(SIGPIPE, SIG_IGN).

Para código heredado o defensa en profundidad, se proporciona una función de conveniencia opcional:```c // Optional - not required Socket_ignore_sigpipe();

root@kitploit:~
### Apagado Ordenado

La biblioteca **NO** instala manejadores de señales. Las aplicaciones deben manejar las señales de apagado por sí mismas. Patrón recomendado usando el truco de la tubería autocontenida:```c
#include <signal.h>
#include <unistd.h>

static int signal_pipe[2];

/* Async-signal-safe handler - only writes to pipe */
static void shutdown_handler(int signo) {
    (void)signo;
    char byte = 1;
    (void)write(signal_pipe[1], &byte, 1);  /* write() is async-signal-safe */
}

int main(void) {
    pipe(signal_pipe);
    fcntl(signal_pipe[0], F_SETFL, O_NONBLOCK);
    fcntl(signal_pipe[1], F_SETFL, O_NONBLOCK);
    
    struct sigaction sa = {0};
    sa.sa_handler = shutdown_handler;
    sigemptyset(&sa.sa_mask);
    sigaction(SIGINT, &sa, NULL);
    sigaction(SIGTERM, &sa, NULL);
    
    /* Add signal pipe to poll set */
    SocketPoll_add_fd(poll, signal_pipe[0], POLL_READ, NULL);
    
    /* In event loop, check for signal pipe readability */
    /* Then use SocketPool_drain() for graceful connection draining */
}

Compilación

Requisitos

  • CMake 3.10+
  • Compilador C11 con extensiones GNU y soporte pthread
  • Sistema compatible con POSIX
  • OpenSSL 1.1.1+ o LibreSSL (opcional, para soporte TLS/DTLS)
  • zlib (opcional, para compresión HTTP y WebSocket permessage-deflate)

Comandos de compilación```bash

Configure

cmake -S . -B build

Build

cmake --build build -j

Run tests

cd build && ctest --output-on-failure

Generate API documentation (requires Doxygen)

cmake --build build --target doc

Install (optional)

cmake --install build --prefix /usr/local

root@kitploit:~
### Opciones de compilación

| Opción | Descripción | Predeterminado |
|--------|-------------|---------|
| `CMAKE_BUILD_TYPE` | Debug o Release | Debug |
| `ENABLE_TLS` | Habilitar soporte TLS/DTLS | ON (detección automática) |
| `ENABLE_HTTP_COMPRESSION` | Habilitar gzip/deflate/brotli | OFF |
| `ENABLE_SANITIZERS` | Habilitar ASan + UBSan | OFF |
| `ENABLE_ASAN` | Habilitar solo AddressSanitizer | OFF |
| `ENABLE_UBSAN` | Habilitar solo UndefinedBehaviorSanitizer | OFF |
| `ENABLE_COVERAGE` | Habilitar cobertura gcov | OFF |
| `ENABLE_FUZZING` | Habilitar pruebas de fuzzing (requiere Clang) | OFF |

### Selección del backend de Poll

El backend de poll se selecciona automáticamente según la plataforma:
- **Linux** - epoll (más rápido para Linux)
- **BSD/macOS** - kqueue
- **Otros POSIX** - fallback a poll(2)

### Selección del backend de E/S asíncrona

- **Linux 5.1+** - io_uring (asíncrono real)
- **BSD/macOS** - kqueue AIO
- **Fallback** - Polling activado por borde

## Pruebas y Calidad

### Conjunto de Pruebas

La biblioteca incluye pruebas exhaustivas en `src/test/`:

| Categoría | Archivos de Prueba |
|----------|------------|
| Núcleo | `test_arena.c`, `test_except.c`, `test_crypto.c`, `test_utf8.c`, `test_ratelimit.c` |
| Socket | `test_socket.c`, `test_socketdgram.c`, `test_socketbuf.c` |
| Redes | `test_socketpoll.c`, `test_socketpool.c`, `test_socketdns.c`, `test_socketerror.c` |
| Conexión | `test_happy_eyeballs.c`, `test_reconnect.c`, `test_proxy.c`, `test_proxy_integration.c` |
| HTTP | `test_http_core.c`, `test_http1_parser.c`, `test_hpack.c`, `test_http2.c`, `test_http_client.c`, `test_http_integration.c`, `test_http2_integration.c` |
| WebSocket | `test_websocket.c`, `test_ws_integration.c` |
| TLS/DTLS | `test_tls_integration.c`, `test_tls_phase4.c`, `test_tls_pinning.c`, `test_tls_crl.c`, `test_tls_ct.c`, `test_dtls_integration.c`, `test_dtls_cookie.c` |
| Seguridad | `test_synprotect.c`, `test_security.c`, `test_signals.c` |
| Integración | `test_integration.c`, `test_async.c`, `test_threadsafety.c`, `test_coverage.c` |

### Pruebas de Fuzzing

Más de 130 harnesses de fuzzing en `src/fuzz/` que cubren:
- Analizador HTTP/1.1 y prevención de contrabando de solicitudes
- Análisis de tramas HTTP/2 y codificación HPACK
- Enmarcado WebSocket y permessage-deflate
- Análisis y validación de URI
- Validación UTF-8
- Handshake TLS/DTLS y operaciones de E/S
- Tickets de sesión TLS, ALPN, SNI, gestión de CRL
- Generación y verificación de cookies DTLS
- Fijación y análisis de certificados
- Validación de ruta y comprobaciones de seguridad```bash
# Build with fuzzing
cmake -S . -B build -DENABLE_FUZZING=ON -DCMAKE_C_COMPILER=clang
cmake --build build

Cobertura de Pruebas

La biblioteca incluye una cobertura de pruebas completa:

  • Más de 140 pruebas unitarias que cubren toda la funcionalidad principal
  • Herramientas de fuzzing para análisis de protocolos y operaciones de buffers
  • Pruebas de integración para funcionalidad de extremo a extremo
  • Pruebas de estrés para pools de conexiones y escenarios de alta carga

Las nuevas características añadidas en mejoras recientes incluyen:

  • Funciones de conveniencia de alto nivel para configuración de sockets TCP/Unix
  • Estadísticas de sockets y recopilación de métricas
  • Gestión de pools de conexiones y monitoreo de salud
  • Caché y configuración de DNS
  • Variantes de tiempo de espera de E/S y operaciones avanzadas
  • Gestión de sesiones TLS e inspección de certificados
  • Optimizaciones de rendimiento TLS (kTLS, 0-RTT, KeyUpdate, sharding de sesiones)
  • Engrapado OCSP con soporte Must-Staple (RFC 7633)
  • Validación de Transparencia de Certificados (RFC 6962)
  • Actualización automática de CRL con intervalos configurables
  • Fijación de certificados con verificación en tiempo constante
  • Intercambio de cookies DTLS para protección contra DoS
  • Cliente/servidor HTTP con soporte JSON y actualizaciones WebSocket
  • Compactación de buffers, E/S scatter-gather y lectura de líneas
  • Operaciones por lotes de E/S asíncrona y selección de backend
  • Introspección del sistema de eventos y control de temporizadores

Sanitizadores

Todas las pruebas pasan con:

  • AddressSanitizer (ASan)
  • UndefinedBehaviorSanitizer (UBSan)
  • Verificación de memoria con Valgrind```bash

Build with sanitizers

cmake -S . -B build -DENABLE_SANITIZERS=ON cmake --build build cd build && ctest --output-on-failure

Valgrind

valgrind --leak-check=full --track-fds=yes
--suppressions=../valgrind.supp ./test_socket

root@kitploit:~
### Integración Continua

Pipeline de GitHub Actions (`.github/workflows/ci.yml`):

| Trabajo | Plataforma | Descripción |
|---------|------------|-------------|
| `build` | Ubuntu | Compilaciones Debug y Release |
| `sanitizers` | Ubuntu | ASan, UBSan, combinados |
| `valgrind` | Ubuntu | Verificación de fugas de memoria |
| `macos` | macOS | Pruebas del backend kqueue |
| `macos-sanitizers` | macOS | Sanitizadores multiplataforma |
| `coverage` | Ubuntu | Cobertura de código con lcov |
| `static-analysis` | Ubuntu | cppcheck + clang-tidy |

## Tipos de Excepción

### Excepciones Principales
- `Socket_Failed` - Fallo general de operación de socket
- `Socket_Closed` - Conexión cerrada por el par
- `SocketUnix_Failed` - Fallo de operación de socket Unix
- `SocketDgram_Failed` - Fallo de operación de socket UDP
- `SocketPoll_Failed` - Fallo de polling de eventos
- `SocketPool_Failed` - Fallo de operación del grupo de conexiones
- `SocketDNS_Failed` - Fallo de resolución DNS
- `SocketTimer_Failed` - Fallo de operación del temporizador
- `SocketRateLimit_Failed` - Fallo del limitador de velocidad
- `SocketRetry_Failed` - Fallo de operación de reintento
- `SocketAsync_Failed` - Fallo de E/S asíncrona
- `SocketCrypto_Failed` - Fallo de operación criptográfica

### Excepciones de Conexión
- `SocketHE_Failed` - Fallo de conexión Happy Eyeballs
- `SocketReconnect_Failed` - Fallo de operación de reconexión
- `SocketProxy_Failed` - Fallo de conexión proxy

### Excepciones TLS/DTLS
- `SocketTLS_Failed` - Fallo general de operación TLS
- `SocketTLS_HandshakeFailed` - Fallo de handshake TLS
- `SocketTLS_VerifyFailed` - Fallo de verificación de certificado
- `SocketTLS_ProtocolError` - Error de protocolo TLS
- `SocketTLS_ShutdownFailed` - Fallo de cierre TLS
- `SocketTLS_PinVerifyFailed` - Fallo de fijación de certificado
- `SocketDTLS_Failed` - Fallo general de operación DTLS
- `SocketDTLS_HandshakeFailed` - Fallo de handshake DTLS
- `SocketDTLS_VerifyFailed` - Fallo de verificación de certificado DTLS
- `SocketDTLS_CookieFailed` - Fallo de intercambio de cookies DTLS
- `SocketDTLS_TimeoutExpired` - Tiempo de espera de handshake DTLS agotado
- `SocketDTLS_ShutdownFailed` - Fallo de cierre DTLS

### Excepciones HTTP
- `SocketHTTP_ParseError` - Error de análisis HTTP
- `SocketHTTP_InvalidURI` - URI inválido
- `SocketHTTP_InvalidHeader` - Cabecera inválida
- `SocketHTTP1_ParseError` - Error de análisis HTTP/1.1
- `SocketHPACK_Failed` - Error de compresión HPACK
- `SocketHTTP2_ProtocolError` - Error de protocolo HTTP/2
- `SocketHTTP2_StreamError` - Error de flujo HTTP/2
- `SocketHTTP2_FlowControlError` - Error de control de flujo HTTP/2
- `SocketHTTPClient_Failed` - Fallo del cliente HTTP
- `SocketHTTPClient_Timeout` - Tiempo de espera del cliente HTTP
- `SocketHTTPClient_TLSFailed` - Error TLS del cliente HTTP
- `SocketHTTPClient_DNSFailed` - Fallo DNS del cliente HTTP
- `SocketHTTPClient_ConnectFailed` - Fallo de conexión del cliente HTTP
- `SocketHTTPClient_ProtocolError` - Error de protocolo del cliente HTTP
- `SocketHTTPClient_TooManyRedirects` - Demasiadas redirecciones
- `SocketHTTPClient_ResponseTooLarge` - Límite de tamaño de respuesta excedido
- `SocketHTTPServer_Failed` - Fallo del servidor HTTP

### Excepciones WebSocket
- `SocketWS_Failed` - Fallo de operación WebSocket
- `SocketWS_ProtocolError` - Error de protocolo WebSocket
- `SocketWS_Closed` - Conexión WebSocket cerrada

### Excepciones de Seguridad
- `SocketSYNProtect_Failed` - Fallo de protección SYN

## Licencia

Consulte `LICENSE` para obtener detalles de uso.
Descargar herramienta
CaracterísticaLinuxBSD/macOSAlternativa
Sondeo de eventosepollkqueuepoll(2)
E/S asíncronaio_uring (5.1+)kqueue AIOedge-triggered
TCP Fast Open3.7+10.0+/10.11+deshabilitado
Control de congestiónconfigurable--
Credenciales de paresSO_PEERCREDLOCAL_PEERCRED-
Protección SYNTCP_DEFER_ACCEPTSO_ACCEPTFILTERespacio de usuario
  • DNS: SocketDNS (DNS asíncrono con hilos de trabajo), SocketDNSoverTLS, SocketDNSoverHTTPS, SocketDNSSEC
  • Sistema de Eventos: SocketPoll (abstracción epoll/kqueue/poll), SocketAsync (Integración de E/S asíncrona)
  • Ayudantes de Conexión: SocketHappyEyeballs (RFC 8305), SocketReconnect (Reconexión automática), SocketProxy (HTTP CONNECT, SOCKS4/5)
  • Seguridad: SocketSYNProtect (Protección contra inundaciones SYN), SocketIPTracker (Límites por IP)
  • Aplicación: SocketPool (Gestión de conexiones)
  • TLS: SocketTLS (E/S TLS), SocketTLSContext (Gestión de contexto), SocketDTLS, SocketDTLSContext
  • HTTP: SocketHTTP, SocketHTTP1, SocketHPACK, SocketHTTP2, SocketHTTPClient, SocketHTTPServer
  • WebSocket: SocketWS (RFC 6455 con permessage-deflate)
  • QUIC: SocketQUICConnection, SocketQUICStream, SocketQUICPacket, SocketQUICHandshake, SocketQUICLoss
  • API Simple: SocketSimple (Envoltorios basados en código de retorno para todos los módulos - sin necesidad de TRY/EXCEPT)
  • ComponenteSeguridad en HilosNotas
    Operaciones de socketPor socketSe recomienda un hilo por socket
    Reporte de erroresLocal al hiloSeguro para uso concurrente
    SocketPollSeguro para hilosProtegido por mutex
    SocketPoolSeguro para hilosProtegido por mutex
    SocketDNSSeguro para hilosUsa grupo de hilos
    SocketTimerSeguro para hilosIntegrado con poll
    SocketRateLimitSeguro para hilosMutex interno
    SocketRetryNO seguro para hilosUna instancia por hilo
    Métricas/RegistroSeguro para hilosOperaciones atómicas
    SocketCryptoSeguro para hilosSin estado global
    SocketUTF8Seguro para hilosSin estado global
    SocketHappyEyeballsNO seguro para hilosUna instancia por hilo
    SocketReconnectNO seguro para hilosUna instancia por hilo
    SocketProxyNO seguro para hilosUna instancia por hilo
    SocketWSNO seguro para hilosUna instancia por hilo
    SocketSYNProtectSeguro para hilosMutex interno para cambios de estado
    Conexiones HTTP/2NO seguro para hilosUna instancia por hilo
    Cliente HTTPSeguro para hilosLas instancias de solicitud NO lo son
    Servidor HTTPNO seguro para hilosUna instancia por hilo
    Contextos TLS/DTLSSeguro para hilosSolo lectura después de la configuración; caché de sesión protegida por mutex
    Sockets TLS/DTLSPor socketUn hilo por socket TLS
    TLSBufferPoolSeguro para hilosMutex interno