Skip to content
KitploitKITPLOIT
OutilsBlog
Soumettre
OutilsBlog
Soumettre

Outils de Hacking, PenTest et Cybersécurité pour votre Arsenal de Sécurité !

Kitploit est un répertoire d'outils de hacking, de cybersécurité et de pentesting. Découvrez les dernières mises à jour des projets pour trouver des vulnérabilités, analyser des systèmes, automatiser les tests et renforcer votre sécurité.

··Flux·Contact·Confidentialité·© 2026 Kitploit

Répertoire d'outils

Catégories

Voir toutes les catégories
Loading categories
tetsuo-pulse — Tetsuo Socket Library | Kitploit
Outils/GitHubGitHub/7etsuo/tetsuo-pulse
Sniffing et Analyse de PaquetsOutils de Chiffrement/DéchiffrementSécurité WebFuzzingSécurité RéseauCryptographieUtilitaires et FrameworksSécurité des APIAnalyse DNS
GitHub7etsuo/tetsuo-pulse

tetsuo-pulse

Tetsuo Socket Library

729il y a 6 moisVérifié par Kitploit

Populaires

Voir tout →

Découvrez les outils les plus utilisés par notre communauté.

Explorer tous les outils

Parcourez notre collection d'outils

Voir tous les outils →
Partager
Voir le dépôt

Logo de Socket Library

License: MIT Coverage

Socket Library

Avis de maturité : Cette bibliothèque est fonctionnelle et bien testée, mais récemment publiée. Elle convient au développement, aux outils internes et aux environnements contrôlés. Un déploiement en production avec des entrées réseau non fiables devrait attendre que le code ait accumulé plusieurs mois de durcissement en conditions réelles.

Boîte à outils de sockets haute performance orientée exceptions pour les systèmes POSIX. Fournit une API C moderne et propre pour TCP, UDP, sockets Unix domain, HTTP/1.1, HTTP/2, QUIC, WebSocket et TLS/DTLS avec une gestion complète des erreurs, des E/S sans copie et un polling d'événements multiplateforme.

Fonctionnalités

Réseau principal

  • Sockets de flux TCP - Client/serveur TCP complet avec E/S scatter/gather
  • Sockets de datagramme UDP - Modes sans connexion et connecté avec support multicast/broadcast
  • Sockets Unix Domain - Sockets IPC avec support des identifiants de pair et passage de descripteurs de fichier
  • Support TLS 1.3 - TLS moderne avec SNI, ALPN, reprise de session, CRL/OCSP, épinglage de certificat, Certificate Transparency (CT), déchargement kTLS, données précoces 0-RTT, KeyUpdate
  • Support DTLS 1.2+ - UDP sécurisé avec échange de cookies pour la protection DoS, mise en cache de session, ALPN

Pile de protocole HTTP

  • HTTP/1.1 - Analyseur DFA piloté par table (RFC 9112), encodage par blocs, prévention de contrebande de requêtes
  • HTTP/2 - Tramage binaire, multiplexage de flux, contrôle de flux, push serveur (RFC 9113)
  • HPACK - Compression d'en-têtes avec tables statiques/dynamiques, codage Huffman (RFC 7541)
  • QPACK - Compression d'en-têtes HTTP/3 (RFC 9204), architecture à deux flux, gestion des flux bloqués
  • Client HTTP - Pool de connexions, authentification (Basic/Digest/Bearer), cookies (RFC 6265)
  • Serveur HTTP - Traitement des requêtes piloté par événements, keep-alive, arrêt gracieux

Transport QUIC

  • Conforme RFC 9000 - Implémentation complète du protocole de transport QUIC v1
  • Gestion des connexions - Rotation d'ID de connexion, réinitialisation sans état, validation d'adresse
  • Multiplexage de flux - Flux bidirectionnels et unidirectionnels avec contrôle de flux
  • Détection de pertes - Contrôle de congestion et récupération de pertes RFC 9002
  • Migration de chemin - Migration de connexion transparente lors de changements de réseau
  • Reprise 0-RTT - Reconnexion rapide avec support des données précoces

QUIC-TLS (RFC 9001)

  • Protection de paquets - Cryptage AEAD (AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305)
  • Protection d'en-tête - Génération de masque AES-ECB/ChaCha20 pour le chiffrement du numéro de paquet
  • Dérivation de clés - Secrets initiaux basés sur HKDF à partir du DCID client, clés de négociation/trafic
  • Mise à jour de clé - Rotation du bit de phase de clé avec limites de confidentialité AEAD (RFC 9001 §6)
  • Intégrité de relance - Vérification de l'étiquette AEAD pour les paquets Retry (RFC 9001 §5.8)
  • Paramètres de transport - Extension TLS (type 0x39) pour l'échange de configuration QUIC

QPACK (RFC 9204)

  • Compression d'en-têtes - Compression d'en-têtes HTTP/3 évitant le blocage de tête de ligne
  • Architecture à deux flux - Flux séparés pour l'encodeur (0x02) et le décodeur (0x03)
  • Table dynamique - Indexation absolue avec schémas relatifs à l'encodeur et au champ
  • Table statique - 99 entrées prédéfinies (RFC 9204 Annexe A)
  • Synchronisation d'état - Accusé de réception de section, annulation de flux, incrément du compteur d'insertion
  • Gestion des flux bloqués - Limites de flux bloqués configurables avec négociation SETTINGS

WebSocket

  • Conforme RFC 6455 - Implémentation complète du protocole WebSocket
  • permessage-deflate - Extension de compression (RFC 7692) via zlib
  • UTF-8 incrémental - Validation de trames de texte basée sur un DFA
  • Auto-Ping/Pong - Battement de cœur configurable avec intégration de temporisateurs

Tunnel de proxy

  • HTTP CONNECT - Tunnel de proxy avec authentification Basic
  • SOCKS4/4a - Support SOCKS hérité
  • SOCKS5 - RFC 1928/1929 avec authentification par nom d'utilisateur/mot de passe
  • API asynchrone - Connexion proxy non bloquante avec machine d'état

Système d'événements

  • Polling multiplateforme - epoll (Linux), kqueue (BSD/macOS), repli poll
  • Mode déclenché par front - Notification d'événements haute performance
  • E/S asynchrones - io_uring (Linux 5.1+), kqueue AIO (BSD/macOS)
  • Temporisateurs - Ponctuel et répété avec tas min O(log n)

Gestion des connexions

  • Pool de connexions - Recherche O(1) avec tables de hachage, tampons d'E/S par connexion
  • Happy Eyeballs - Concurrence de connexion double pile IPv4/IPv6 RFC 8305
  • Reconnexion automatique - Backoff exponentiel avec motif de disjoncteur
  • Arrêt gracieux - Machine d'état de vidage de pool avec garantie de délai

Durcissement de la sécurité

  • Protection contre les inondations SYN - Score de réputation, limitation, intégration noyau
  • Suivi par IP - Limites de connexion et limitation de débit par client
  • Limitation de débit - Algorithme du seau à jetons pour les connexions et la bande passante
  • Prévention de contrebande de requêtes - Analyse HTTP stricte avec conformité RFC

Résolution DNS

  • Résolveur asynchrone - Résolution non bloquante avec pool de threads et multiplexage de requêtes
  • DNS-over-TLS (DoT) - DNS crypté RFC 7858/8310 avec modes opportuniste/strict
  • DNS-over-HTTPS (DoH) - Requêtes DNS RFC 8484 sur HTTPS (méthodes POST/GET)
  • Validation DNSSEC - Chaîne de confiance RFC 4033-4035, rejet authentifié NSEC/NSEC3
  • Cookies DNS - Protection contre l'usurpation RFC 7873 via EDNS0
  • Mise en cache négative - Gestion correcte NXDOMAIN/NODATA RFC 2308
  • Erreurs DNS étendues - Codes d'erreur détaillés RFC 8914

Infrastructure

  • Erreurs basées sur exceptions - Propagation propre des erreurs avec TRY/EXCEPT/FINALLY
  • API simple - Couche de commodité basée sur les codes de retour pour les opérations courantes (pas besoin de TRY/EXCEPT)
  • Gestion de la mémoire Arena - Allocation efficace avec protection contre les débordements
  • E/S de tampon circulaire - Tamponnage sans copie pour les opérations réseau
  • E/S asynchrones - Opérations asynchrones optimisées pour la plateforme (io_uring/kqueue)
  • Validation UTF-8 - Traitement UTF-8 axé sur la sécurité pour les trames de texte WebSocket
  • Cadre de nouvelle tentative générique - Backoff exponentiel avec gigue pour des opérations résilientes
  • Suivi de connexion par IP - Limites de connexion et limitation de débit par IP client
  • E/S sans copie - sendfile() optimisé pour la plateforme et E/S scatter/gather
  • Observabilité - Journalisation enfichable, export de métriques Prometheus/StatsD/JSON, dispatching d'événements
  • Utilitaires cryptographiques - SHA-1/256, HMAC, Base64, aléatoire sécurisé

Prérequis de plateforme

  • Système compatible POSIX (Linux, BSD, macOS)
  • Compilateur C11 avec extensions GNU
  • Threads POSIX (pthread) pour les opérations thread-safe
  • Support IPv6 dans le noyau (pour les sockets double pile)
  • NON portable vers Windows sans couche d'adaptation Winsock

Fonctionnalités spécifiques à la plateforme

Prérequis TLS/DTLS

  • OpenSSL 1.1.1+ ou LibreSSL avec support TLS 1.3
  • TLS 1.3 uniquement par défaut (configurable)
  • DTLS 1.2 minimum pour UDP sécurisé

Démarrage rapide

Compilation```bash

Basic build

cmake -S . -B build cmake --build build -j

Run tests

cd build && ctest --output-on-failure

Build with TLS support (auto-detects OpenSSL/LibreSSL)

cmake -S . -B build -DENABLE_TLS=ON

Build with sanitizers for debugging

cmake -S . -B build -DENABLE_SANITIZERS=ON

Build with fuzzing support (requires Clang)

cmake -S . -B build -DENABLE_FUZZING=ON -DCMAKE_C_COMPILER=clang

root@kitploit:~
### Serveur TCP de base```c
#include "socket/Socket.h"
#include "core/Except.h"
#include <stdio.h>

int main(void)
{
    Socket_T server = Socket_new(AF_INET, SOCK_STREAM, 0);
    
    TRY
        Socket_setreuseaddr(server);
        Socket_bind(server, NULL, 8080);
        Socket_listen(server, 128);
        printf("Server listening on port 8080...\n");
        
        while (1) {
            Socket_T client = Socket_accept(server);
            if (client) {
                char buf[1024];
                ssize_t n = Socket_recv(client, buf, sizeof(buf) - 1);
                if (n > 0) {
                    buf[n] = '\0';
                    Socket_sendall(client, buf, n);
                }
                Socket_free(&client);
            }
        }
    EXCEPT(Socket_Failed)
        fprintf(stderr, "Error: %s\n", Socket_GetLastError());
    END_TRY;
    
    Socket_free(&server);
    return 0;
}

Client TCP de base```c

#include "socket/Socket.h" #include "core/Except.h" #include <stdio.h> #include <string.h>

int main(void) { Socket_T client = Socket_new(AF_INET, SOCK_STREAM, 0);

root@kitploit:~
TRY
    Socket_connect(client, "127.0.0.1", 8080);
    printf("Connected to server\n");
    
    const char *msg = "Hello, Server!";
    Socket_sendall(client, msg, strlen(msg));
    
    char buf[1024];
    ssize_t n = Socket_recvall(client, buf, strlen(msg));
    buf[n] = '\0';
    printf("Received: %s\n", buf);
EXCEPT(Socket_Failed)
    fprintf(stderr, "Error: %s\n", Socket_GetLastError());
EXCEPT(Socket_Closed)
    fprintf(stderr, "Connection closed\n");
END_TRY;

Socket_free(&client);
return 0;

}

root@kitploit:~
### Fonctions de commodité (Configuration en un appel)

Pour les cas d'utilisation courants, les fonctions de commodité simplifient la configuration du socket :```c
#include "socket/Socket.h"
#include "socket/SocketDgram.h"

/* TCP Server - one call creates listening socket */
Socket_T server = Socket_listen_tcp("0.0.0.0", 8080, 128);
while (running) {
    Socket_T client = Socket_accept_timeout(server, 1000);  // 1s timeout
    if (client) handle_client(client);
}
Socket_free(&server);

/* TCP Client with timeout - one call connects */
Socket_T client = Socket_connect_tcp("api.example.com", 443, 5000);  // 5s timeout
Socket_sendall(client, request, len);
Socket_free(&client);

/* UDP Server - one call binds */
SocketDgram_T udp = SocketDgram_bind_udp("0.0.0.0", 5353);
SocketDgram_recvfrom(udp, buf, sizeof(buf), sender_ip, sizeof(sender_ip), &sender_port);
SocketDgram_free(&udp);

/* Unix Domain Server */
Socket_T unix_srv = Socket_listen_unix("/var/run/app.sock", 128);
Socket_free(&unix_srv);

/* Unix Domain Client with timeout */
Socket_T unix_cli = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_connect_unix_timeout(unix_cli, "/var/run/app.sock", 5000);
Socket_free(&unix_cli);

/* Non-blocking connect (for event loops) */
Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
int status = Socket_connect_nonblocking(sock, "192.168.1.1", 8080);
if (status == 1) {
    /* In progress - poll for POLL_WRITE then check Socket_isconnected() */
}

Simple API (No TRY/EXCEPT Required)

Pour les utilisateurs qui préfèrent une gestion des erreurs basée sur les codes de retour, l'API simple fournit une couche de commodité qui enveloppe les mécanismes internes basés sur les exceptions :```c #include "simple/SocketSimple.h"

/* TCP Client - returns NULL on error */ SocketSimple_Socket_T sock = Socket_simple_connect("example.com", 80); if (!sock) { fprintf(stderr, "Error: %s\n", Socket_simple_error()); return 1; } Socket_simple_send(sock, "GET / HTTP/1.0\r\n\r\n", 18); char buf[4096]; ssize_t n = Socket_simple_recv(sock, buf, sizeof(buf)); Socket_simple_close(&sock);

/* TLS Client - one-liner with cert verification */ SocketSimple_Socket_T tls = Socket_simple_connect_tls("api.example.com", 443); if (tls) { Socket_simple_send(tls, request, len); Socket_simple_close(&tls); }

/* HTTP GET - returns 0 on success */ SocketSimple_HTTPResponse resp; if (Socket_simple_http_get("https://api.example.com/data", &resp) == 0) { printf("Status: %d, Body: %.*s\n", resp.status_code, (int)resp.body_len, resp.body); Socket_simple_http_response_free(&resp); }

/* WebSocket - handles ws:// and wss:// */ SocketSimple_WS_T ws = Socket_simple_ws_connect("wss://echo.example.com/ws"); if (ws) { Socket_simple_ws_send_text(ws, "Hello!", 6); SocketSimple_WSMessage msg; if (Socket_simple_ws_recv(ws, &msg) == 0) { printf("Received: %.*s\n", (int)msg.len, (char *)msg.data); Socket_simple_ws_message_free(&msg); } Socket_simple_ws_close(ws, 1000, "Bye"); Socket_simple_ws_free(&ws); }

root@kitploit:~
Voir [docs/simple.md](https://github.com/7etsuo/tetsuo-pulse/blob/HEAD/docs/simple.md) pour la documentation complète de l'API.

## Modèles d'utilisation

### Gestion des erreurs

Toutes les opérations de socket utilisent une gestion des erreurs basée sur les exceptions :```c
TRY
    Socket_connect(socket, "example.com", 80);
    Socket_sendall(socket, data, len);
EXCEPT(Socket_Failed)
    if (Socket_error_is_retryable(Socket_geterrno()))
        /* Schedule retry with backoff */
    else
        fprintf(stderr, "Fatal error: %s\n", Socket_Failed.reason);
EXCEPT(Socket_Closed)
    fprintf(stderr, "Connection closed\n");
FINALLY
    Socket_free(&socket);
END_TRY;

I/O non bloquantes avec Event Polling```c

#include "socket/Socket.h" #include "poll/SocketPoll.h"

Socket_T server = Socket_new(AF_INET, SOCK_STREAM, 0); Socket_setreuseaddr(server); Socket_bind(server, NULL, 8080); Socket_listen(server, 128); Socket_setnonblocking(server);

SocketPoll_T poll = SocketPoll_new(1000); SocketPoll_add(poll, server, POLL_READ, NULL);

while (1) { SocketEvent_T *events; int n = SocketPoll_wait(poll, &events, 1000);

root@kitploit:~
for (int i = 0; i < n; i++) {
    if (events[i].socket == server) {
        Socket_T client = Socket_accept(server);
        if (client) {
            Socket_setnonblocking(client);
            SocketPoll_add(poll, client, POLL_READ, client);
        }
    } else {
        Socket_T client = events[i].socket;
        char buf[1024];
        ssize_t bytes = Socket_recv(client, buf, sizeof(buf));
        if (bytes > 0) {
            Socket_sendall(client, buf, bytes);
        } else {
            SocketPoll_del(poll, client);
            Socket_free(&client);
        }
    }
}

}

SocketPoll_free(&poll); Socket_free(&server);

root@kitploit:~
### Client HTTP```c
#include "http/SocketHTTPClient.h"

/* Simple GET request */
SocketHTTPClient_T client = SocketHTTPClient_new(NULL);
SocketHTTPClient_Response response = {0};

if (SocketHTTPClient_get(client, "https://example.com/api", &response) == 0) {
    printf("Status: %d\n", response.status_code);
    printf("Body: %.*s\n", (int)response.body_len, (char *)response.body);
}
SocketHTTPClient_Response_free(&response);

/* Request builder pattern */
SocketHTTPClient_Request_T req = SocketHTTPClient_Request_new(
    client, HTTP_METHOD_POST, "https://api.example.com/data");
SocketHTTPClient_Request_header(req, "Content-Type", "application/json");
SocketHTTPClient_Request_body(req, "{\"key\": \"value\"}", 16);
SocketHTTPClient_Request_timeout(req, 30000);

if (SocketHTTPClient_Request_execute(req, &response) == 0) {
    printf("POST Status: %d\n", response.status_code);
}
SocketHTTPClient_Request_free(&req);
SocketHTTPClient_Response_free(&response);

/* Cookie jar */
SocketHTTPClient_CookieJar_T jar = SocketHTTPClient_CookieJar_new();
SocketHTTPClient_set_cookie_jar(client, jar);

SocketHTTPClient_free(&client);

Fonctions pratiques du client HTTP```c

#include "http/SocketHTTPClient.h"

SocketHTTPClient_T client = SocketHTTPClient_new(NULL);

/* Download file from URL */ int ret = SocketHTTPClient_download(client, "https://example.com/file.zip", "/tmp/file.zip"); if (ret == 0) { printf("Download complete\n"); } else if (ret == -1) { printf("HTTP error\n"); } else { printf("File error: %s\n", strerror(errno)); }

/* Upload file to URL */ int status = SocketHTTPClient_upload(client, "https://storage.example.com/files/upload.dat", "/path/to/local/file.dat"); if (status >= 200 && status < 300) { printf("Upload successful (HTTP %d)\n", status); }

/* JSON API calls */ char *json_response = NULL; size_t json_len;

/* GET JSON */ status = SocketHTTPClient_json_get(client, "https://api.example.com/users/123", &json_response, &json_len); if (status == 200 && json_response) { printf("User data: %s\n", json_response); free(json_response); }

/* POST JSON */ const char *request_body = "{"name": "John", "email": "[email protected]"}"; status = SocketHTTPClient_json_post(client, "https://api.example.com/users", request_body, &json_response, &json_len); if (status == 201 && json_response) { printf("Created: %s\n", json_response); free(json_response); }

SocketHTTPClient_free(&client);

root@kitploit:~
### Serveur HTTP

Pour plus de détails sur la négociation HTTP/2 (ALPN vs h2c vs prior-knowledge), le cycle de vie des flux, les trailers, l'état GOAWAY/drain et le statut RFC 8441, voir `docs/HTTP2-SERVER.md`.```c
#include "http/SocketHTTPServer.h"
#include "http/SocketHTTP.h"
#include <string.h>

static void
handle_request (SocketHTTPServer_Request_T req, void *userdata)
{
    (void)userdata;

    if (SocketHTTPServer_Request_method (req) == HTTP_METHOD_GET
        && strcmp (SocketHTTPServer_Request_path (req), "/") == 0)
      {
        SocketHTTPServer_Request_status (req, 200);
        SocketHTTPServer_Request_header (req, "content-type", "text/html");
        SocketHTTPServer_Request_body_string (req, "<h1>Hello World</h1>");
        SocketHTTPServer_Request_finish (req);
        return;
      }

    SocketHTTPServer_Request_status (req, 404);
    SocketHTTPServer_Request_body_string (req, "Not Found");
    SocketHTTPServer_Request_finish (req);
}

int
main (void)
{
    SocketHTTPServer_Config config;
    SocketHTTPServer_T server;

    SocketHTTPServer_config_defaults (&config);
    config.port = 8080;
    config.max_version = HTTP_VERSION_2;   /* Allow HTTP/2 (default) */
    config.enable_h2c_upgrade = 0;         /* h2c is opt-in */

    server = SocketHTTPServer_new (&config);
    SocketHTTPServer_set_handler (server, handle_request, NULL);
    SocketHTTPServer_start (server);

    /* Event loop */
    for (;;)
      SocketHTTPServer_process (server, 1000);
}

HTTP/2 Gestion des flux```c

#include "http/SocketHTTP2.h"

/* Check connection health with PING */ int rtt = SocketHTTP2_Conn_ping_wait(conn, 5000); if (rtt >= 0) { printf("Connection alive, RTT: %d ms\n", rtt); } else { printf("Connection dead or timeout\n"); }

/* Monitor concurrent streams */ uint32_t active = SocketHTTP2_Conn_get_concurrent_streams(conn); printf("Active streams: %u\n", active);

/* Limit concurrent streams (sends SETTINGS frame) */ SocketHTTP2_Conn_set_max_concurrent(conn, 50);

/* Check peer's stream limit */ uint32_t peer_max = SocketHTTP2_Conn_get_peer_setting(conn, SETTINGS_IDX_MAX_CONCURRENT_STREAMS); printf("Peer allows %u concurrent streams\n", peer_max);

root@kitploit:~
### WebSocket Client```c
#include "socket/SocketWS.h"

/* One-liner WebSocket connection (new convenience API) */
SocketWS_T ws = SocketWS_connect("wss://echo.websocket.org", NULL);
if (ws) {
    /* Send and receive JSON messages */
    SocketWS_send_json(ws, "{\"type\": \"hello\", \"data\": \"world\"}");
    
    char *json = NULL;
    size_t len;
    if (SocketWS_recv_json(ws, &json, &len) == WS_OK) {
        printf("Received: %s\n", json);
        free(json);
    }
    
    /* Check ping latency */
    SocketWS_ping(ws, "test", 4);
    SocketWS_process(ws, POLLIN);  /* Wait for pong */
    int64_t rtt = SocketWS_get_ping_latency(ws);
    printf("Latency: %lld ms\n", (long long)rtt);
    
    SocketWS_close(ws, WS_CLOSE_NORMAL, "Goodbye", 7);
    SocketWS_free(&ws);
}

/* Traditional multi-step connection */
Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "echo.websocket.org", 80);

SocketWS_Config ws_config = SOCKETWS_CONFIG_DEFAULTS;
SocketWS_T ws2 = SocketWS_client_new(sock, "echo.websocket.org", "/", &ws_config);

/* Enable compression before handshake */
SocketWS_CompressionOptions comp_opts;
SocketWS_compression_options_defaults(&comp_opts);
comp_opts.level = 9;  /* Maximum compression */
SocketWS_enable_compression(ws2, &comp_opts);

/* Perform handshake */
TRY
    SocketWS_handshake(ws2);
    
    /* Send text message */
    SocketWS_send_text(ws2, "Hello, WebSocket!", 17);
    
    /* Graceful close */
    SocketWS_close(ws2, WS_CLOSE_NORMAL, "Goodbye", 7);
EXCEPT(SocketWS_Failed)
    fprintf(stderr, "WebSocket error: %s\n", SocketWS_Failed.reason);
END_TRY;

SocketWS_free(&ws2);
Socket_free(&sock);

Client QUIC```c

#include "quic/SocketQUICConnection.h" #include "quic/SocketQUICStream.h" #include "quic/SocketQUICHandshake.h"

/* Create QUIC connection */ Arena_T arena = Arena_new(); SocketQUICConnection_T conn = SocketQUICConnection_new(arena, QUIC_CONN_ROLE_CLIENT);

/* Configure connection parameters */ SocketQUICConnection_set_initial_dcid(conn, dcid, dcid_len); SocketQUICConnection_set_local_addr(conn, local_addr, local_port); SocketQUICConnection_set_peer_addr(conn, peer_addr, peer_port);

/* Create bidirectional stream */ SocketQUICStream_T stream = SocketQUICStream_new(arena, 0, QUIC_STREAM_BIDI); SocketQUICStream_write(stream, data, len);

/* Process handshake */ SocketQUICHandshake_T hs = SocketQUICHandshake_new(arena, QUIC_HANDSHAKE_CLIENT); while (SocketQUICHandshake_state(hs) != QUIC_HS_STATE_COMPLETE) { SocketQUICHandshake_process(hs); }

/* Read stream data */ uint8_t buf[4096]; size_t bytes_read = SocketQUICStream_read(stream, buf, sizeof(buf));

/* Clean up */ SocketQUICStream_free(&stream); SocketQUICConnection_free(&conn); Arena_dispose(&arena);

root@kitploit:~
### Tunnel proxy```c
#include "socket/SocketProxy.h"

/* SOCKS5 proxy configuration */
SocketProxy_Config proxy = {0};
proxy.type = SOCKET_PROXY_SOCKS5;
proxy.host = "proxy.example.com";
proxy.port = 1080;
proxy.username = "user";
proxy.password = "secret";

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);

/* Connect through proxy (synchronous) */
SocketProxy_Result result = SocketProxy_connect(sock, &proxy, "target.example.com", 443);
if (result == PROXY_OK) {
    /* Socket is now tunneled - proceed with TLS handshake if needed */
    SocketTLS_enable(sock, tls_ctx);
    SocketTLS_handshake_loop(sock, 10000);
}

/* HTTP CONNECT proxy */
SocketProxy_Config http_proxy = {0};
http_proxy.type = SOCKET_PROXY_HTTP;
http_proxy.host = "httpproxy.example.com";
http_proxy.port = 8080;
http_proxy.username = "user";
http_proxy.password = "pass";

/* Asynchronous proxy connection */
SocketProxy_Conn_T conn = SocketProxy_Conn_new(sock, &http_proxy, "target.com", 443);
while (!SocketProxy_Conn_poll(conn)) {
    int timeout = SocketProxy_Conn_next_timeout_ms(conn);
    SocketPoll_wait(poll, &events, timeout);
    SocketProxy_Conn_process(conn);
}
result = SocketProxy_Conn_result(conn);
SocketProxy_Conn_free(&conn);

DTLS (UDP sécurisé)```c

#include "tls/SocketDTLS.h" #include "tls/SocketDTLSContext.h" #include "socket/SocketDgram.h"

/* DTLS Client */ SocketDgram_T sock = SocketDgram_new(AF_INET, 0); SocketDgram_connect(sock, "server.example.com", 5684);

SocketDTLSContext_T ctx = SocketDTLSContext_new_client("ca-bundle.crt"); SocketDTLS_enable(sock, ctx); SocketDTLS_set_hostname(sock, "server.example.com");

DTLSHandshakeState state = SocketDTLS_handshake_loop(sock, 5000); if (state == DTLS_HANDSHAKE_COMPLETE) { /* Send encrypted datagram */ SocketDTLS_send(sock, "Hello DTLS", 10);

root@kitploit:~
char buf[1024];
ssize_t n = SocketDTLS_recv(sock, buf, sizeof(buf));

}

SocketDTLS_shutdown(sock); SocketDgram_free(&sock); SocketDTLSContext_free(&ctx);

/* DTLS Server with cookie exchange */ SocketDgram_T server = SocketDgram_new(AF_INET, 0); SocketDgram_bind(server, "0.0.0.0", 5684);

SocketDTLSContext_T srv_ctx = SocketDTLSContext_new_server("cert.pem", "key.pem", NULL); SocketDTLSContext_enable_cookie_exchange(srv_ctx); /* DoS protection */ SocketDTLS_enable(server, srv_ctx);

/* Handle incoming connections with SocketDTLS_listen() */

root@kitploit:~
### Serveur UDP```c
#include "socket/SocketDgram.h"

SocketDgram_T server = SocketDgram_new(AF_INET, 0);
SocketDgram_bind(server, NULL, 5000);

char buffer[65536];
char sender_host[46];
int sender_port;

while (1) {
    ssize_t n = SocketDgram_recvfrom(server, buffer, sizeof(buffer),
                                     sender_host, sizeof(sender_host),
                                     &sender_port);
    if (n > 0) {
        /* Echo back to sender */
        SocketDgram_sendto(server, buffer, n, sender_host, sender_port);
    }
}

SocketDgram_free(&server);

Pool de connexions avec limitation de débit```c

#include "pool/SocketPool.h" #include "core/Arena.h"

Arena_T arena = Arena_new(); SocketPool_T pool = SocketPool_new(arena, 10000, 8192);

/* Enable rate limiting: 100 connections/sec, burst of 50 */ SocketPool_setconnrate(pool, 100, 50);

/* Limit per-IP connections */ SocketPool_setmaxperip(pool, 10);

/* Rate-limited accept with error handling / Socket_T client = SocketPool_accept_limited(pool, server); if (client) { Connection_T conn = SocketPool_add(pool, client); if (conn) { SocketBuf_T input = Connection_inbuf(conn); SocketBuf_T output = Connection_outbuf(conn); / ... use connection ... / } else { / Pool full or other error - cleanup to avoid leaks */ const char *ip = Socket_getpeeraddr(client); SocketPool_release_ip(pool, ip); Socket_free(&client); } }

/* Batch accept for high-throughput servers */ Socket_T accepted[32]; int count = SocketPool_accept_batch(pool, server, 32, accepted);

/* Clean up idle connections / SocketPool_cleanup(pool, 300); / Remove idle > 300 seconds */

SocketPool_free(&pool); Arena_dispose(&arena);

root@kitploit:~
### Statistiques et Filtrage du Pool de Connexions```c
#include "pool/SocketPool.h"

/* Get pool statistics */
SocketPool_Stats stats;
SocketPool_get_stats(pool, &stats);
printf("Active: %zu, Idle: %zu, Reuse rate: %.1f%%\n",
       stats.current_active, stats.current_idle, stats.reuse_rate * 100.0);

/* Convenience stat functions */
size_t active = SocketPool_get_active_count(pool);
size_t idle = SocketPool_get_idle_count(pool);
double hit_rate = SocketPool_get_hit_rate(pool);

/* Find connections matching criteria */
int is_from_subnet(Connection_T conn, void *data) {
    const char *subnet = (const char *)data;
    return strncmp(Socket_getpeeraddr(Connection_socket(conn)), subnet, 7) == 0;
}

/* Find first matching connection */
Connection_T conn = SocketPool_find(pool, is_from_subnet, "192.168");

/* Get all matching connections */
Connection_T matches[100];
size_t count = SocketPool_filter(pool, is_from_subnet, "192.168", matches, 100);
for (size_t i = 0; i < count; i++) {
    /* Process matching connections */
}

/* Register idle callback */
void on_idle(Connection_T conn, void *data) {
    printf("Connection went idle: %s\n",
           Socket_getpeeraddr(Connection_socket(conn)));
}
SocketPool_set_idle_callback(pool, on_idle, NULL);

/* Shrink pool to release unused memory */
size_t released = SocketPool_shrink(pool);
printf("Released %zu unused slots\n", released);

/* Reset statistics for new measurement window */
SocketPool_reset_stats(pool);

Opérations sur le tampon circulaire```c

#include "socket/SocketBuf.h"

Arena_T arena = Arena_new(); SocketBuf_T buf = SocketBuf_new(arena, 4096);

/* Basic read/write */ SocketBuf_write(buf, "Hello, World!\n", 14); printf("Available: %zu bytes\n", SocketBuf_available(buf));

/* Search for patterns (useful for protocol parsing) / ssize_t pos = SocketBuf_find(buf, "\n", 1); / Find newline */ if (pos >= 0) { printf("Newline at offset %zd\n", pos); }

/* Read line-by-line / char line[256]; ssize_t len; while ((len = SocketBuf_readline(buf, line, sizeof(line))) > 0) { printf("Line: %s", line); / Includes '\n' */ }

/* Ensure space for large write / if (SocketBuf_ensure(buf, 8192)) { / Guaranteed 8KB write space */ SocketBuf_write(buf, large_data, 8192); }

/* Compact buffer for maximum contiguous space */ SocketBuf_compact(buf); size_t contiguous; void ptr = SocketBuf_writeptr(buf, &contiguous); / contiguous now equals SocketBuf_space(buf) */

/* Scatter-gather I/O / struct header hdr = {...}; char body[1024] = "..."; struct iovec iov[2] = { {.iov_base = &hdr, .iov_len = sizeof(hdr)}, {.iov_base = body, .iov_len = strlen(body)} }; SocketBuf_writev(buf, iov, 2); / Gather write */

struct header recv_hdr; char recv_body[1024]; struct iovec recv_iov[2] = { {.iov_base = &recv_hdr, .iov_len = sizeof(recv_hdr)}, {.iov_base = recv_body, .iov_len = sizeof(recv_body)} }; SocketBuf_readv(buf, recv_iov, 2); /* Scatter read */

/* Secure clear for sensitive data */ SocketBuf_secureclear(buf);

SocketBuf_release(&buf); Arena_dispose(&arena);

root@kitploit:~
### Protection contre les attaques SYN Flood```c
#include "core/SocketSYNProtect.h"

SocketSYNProtect_Config config = SYNPROTECT_CONFIG_DEFAULTS;
config.max_connections_per_ip = 10;
config.connection_rate_limit = 100;
config.challenge_threshold = 0.5;  /* Reputation score threshold */
config.block_threshold = 0.2;

SocketSYNProtect_T protect = SocketSYNProtect_new(NULL, &config);

/* On each incoming connection */
struct sockaddr_in client_addr;
socklen_t addr_len = sizeof(client_addr);
int client_fd = accept(server_fd, (struct sockaddr *)&client_addr, &addr_len);

SYNAction action = SocketSYNProtect_check(protect, &client_addr, addr_len);

switch (action) {
case SYN_ACTION_ALLOW:
    /* Accept connection normally */
    break;
case SYN_ACTION_THROTTLE:
    /* Accept but add delay */
    usleep(100000);
    break;
case SYN_ACTION_CHALLENGE:
    /* Send SYN cookie / challenge */
    break;
case SYN_ACTION_BLOCK:
    /* Reject connection */
    close(client_fd);
    break;
}

/* Report connection result for reputation update */
SocketSYNProtect_report(protect, &client_addr, addr_len, success);

/* Get statistics */
SocketSYNProtect_Stats stats;
SocketSYNProtect_stats(protect, &stats);

SocketSYNProtect_free(&protect);

Arrêt élégant```c

#include "pool/SocketPool.h"

/* Non-blocking drain for event loops / SocketPool_drain(pool, 30000); / Start 30s drain / while (SocketPool_drain_poll(pool) > 0) { SocketPoll_wait(poll, &events, SocketPool_drain_remaining_ms(pool)); / Process remaining events, connections closing naturally */ } SocketPool_free(&pool);

/* Blocking drain (convenience) / int result = SocketPool_drain_wait(pool, 30000); if (result < 0) { / Timeout - connections were force-closed */ }

/* Health check for load balancers / SocketPool_Health health = SocketPool_health(pool); if (health == POOL_HEALTH_DRAINING) { / Return 503 to load balancer */ }

root@kitploit:~
### Connexion Happy Eyeballs (RFC 8305)```c
#include "socket/SocketHappyEyeballs.h"

/* Synchronous - races IPv6 and IPv4 for fastest connection */
Socket_T sock = SocketHappyEyeballs_connect("example.com", 443, NULL);
Socket_sendall(sock, "GET / HTTP/1.1\r\n\r\n", 18);
Socket_free(&sock);

/* Asynchronous - for event-driven applications */
SocketHE_Config_T config;
SocketHappyEyeballs_config_defaults(&config);
config.first_attempt_delay_ms = 250;  /* RFC 8305 default */
config.total_timeout_ms = 30000;

SocketHE_T he = SocketHappyEyeballs_start(dns, poll, "example.com", 443, &config);
while (!SocketHappyEyeballs_poll(he)) {
    int timeout = SocketHappyEyeballs_next_timeout_ms(he);
    SocketPoll_wait(poll, &events, timeout);
    SocketHappyEyeballs_process(he);
}
Socket_T result = SocketHappyEyeballs_result(he);
SocketHappyEyeballs_free(&he);

Reconnexion automatique avec disjoncteur```c

#include "socket/SocketReconnect.h"

/* Configure reconnection policy */ SocketReconnect_Policy_T policy; SocketReconnect_policy_defaults(&policy); policy.initial_delay_ms = 100; policy.max_delay_ms = 30000; policy.multiplier = 2.0; policy.jitter = 0.25; policy.max_attempts = 10; policy.circuit_failure_threshold = 5; policy.circuit_reset_timeout_ms = 60000;

void on_state_change(SocketReconnect_T conn, SocketReconnect_State old, SocketReconnect_State new, void *data) { printf("State: %s -> %s\n", SocketReconnect_state_name(old), SocketReconnect_state_name(new)); }

SocketReconnect_T conn = SocketReconnect_new("example.com", 443, &policy, on_state_change, NULL); SocketReconnect_connect(conn);

/* Event loop */ while (running) { int timeout = SocketReconnect_next_timeout_ms(conn); poll(&pfd, 1, timeout); SocketReconnect_process(conn); SocketReconnect_tick(conn);

root@kitploit:~
if (SocketReconnect_isconnected(conn)) {
    /* I/O with auto-reconnect on error */
    ssize_t n = SocketReconnect_send(conn, data, len);
}

}

SocketReconnect_free(&conn);

root@kitploit:~
### Framework de réessai générique```c
#include "core/SocketRetry.h"

/* Configure retry policy */
SocketRetry_Policy policy;
SocketRetry_policy_defaults(&policy);
policy.max_attempts = 5;
policy.initial_delay_ms = 100;
policy.max_delay_ms = 30000;
policy.multiplier = 2.0;
policy.jitter = 0.25;

/* Define operation to retry */
int connect_op(void *ctx, int attempt) {
    ConnectionCtx *c = ctx;
    return connect(c->fd, c->addr, c->addrlen) < 0 ? errno : 0;
}

/* Define retry decision callback */
int should_retry(int err, int attempt, void *ctx) {
    return SocketError_is_retryable_errno(err);
}

/* Execute with retries */
SocketRetry_T retry = SocketRetry_new(&policy);
int result = SocketRetry_execute(retry, connect_op, should_retry, &ctx);

/* Get statistics */
SocketRetry_Stats stats;
SocketRetry_get_stats(retry, &stats);
printf("Attempts: %d, Total delay: %lld ms\n", stats.attempts, stats.total_delay_ms);

SocketRetry_free(&retry);

Résolution DNS asynchrone```c

#include "dns/SocketDNS.h" #include "poll/SocketPoll.h"

SocketDNS_T dns = SocketDNS_new(); SocketPoll_T poll = SocketPoll_new(100);

/* Configure DNS timeouts / SocketDNS_settimeout(dns, 5000); / 5 second default timeout */

/* Configure DNS cache / SocketDNS_cache_set_ttl(dns, 300); / 5 minute TTL / SocketDNS_cache_set_max_entries(dns, 1000); / Max 1000 entries / SocketDNS_prefer_ipv6(dns, 1); / Prefer IPv6 */

/* Start async resolution */ SocketDNS_Request_T req = SocketDNS_resolve(dns, "example.com", 80, NULL, NULL);

/* Per-request timeout override */ SocketDNS_request_settimeout(dns, req, 10000);

/* In event loop, check for completions */ SocketDNS_check(dns);

/* Get result */ struct addrinfo *result = SocketDNS_getresult(dns, req); if (result) { Socket_connect_with_addrinfo(socket, result); freeaddrinfo(result); } else { int error = SocketDNS_geterror(dns, req); fprintf(stderr, "DNS failed: %s\n", gai_strerror(error)); }

/* Monitor cache performance */ SocketDNS_CacheStats stats; SocketDNS_cache_stats(dns, &stats); printf("DNS cache hit rate: %.1f%% (%zu entries)\n", stats.hit_rate * 100.0, stats.current_size);

/* Clear cache when DNS records change */ SocketDNS_cache_clear(dns);

/* Remove specific entry */ SocketDNS_cache_remove(dns, "example.com");

SocketDNS_free(&dns); SocketPoll_free(&poll);

root@kitploit:~
### E/S asynchrones (io_uring/kqueue)```c
#include "socket/SocketAsync.h"
#include "poll/SocketPoll.h"

/* Check what backend is available */
if (SocketAsync_backend_available(ASYNC_BACKEND_IO_URING)) {
    printf("io_uring available - optimal async I/O\n");
} else if (SocketAsync_backend_available(ASYNC_BACKEND_KQUEUE)) {
    printf("kqueue available - good async I/O\n");
} else {
    printf("Using poll-based fallback\n");
}

/* Set preferred backend (optional) */
SocketAsync_set_backend(ASYNC_BACKEND_IO_URING);

/* Get async context from poll */
SocketPoll_T poll = SocketPoll_new(1024);
SocketAsync_T async = SocketPoll_get_async(poll);

/* Completion callback */
void io_complete(Socket_T socket, ssize_t bytes, int err, void *ud) {
    if (err) {
        printf("Error: %s\n", strerror(err));
        return;
    }
    printf("Transferred %zd bytes\n", bytes);
}

/* Submit async send */
unsigned req_id = SocketAsync_send(async, socket, buf, len,
                                   io_complete, userdata, ASYNC_FLAG_NONE);

/* Submit async recv */
req_id = SocketAsync_recv(async, socket, recv_buf, sizeof(recv_buf),
                          io_complete, userdata, ASYNC_FLAG_ZERO_COPY);

/* Batch submission for efficiency */
SocketAsync_Op ops[3] = {
    {sock1, 1, send_buf, NULL, len1, io_complete, ud1, ASYNC_FLAG_NONE, 0},
    {sock2, 0, NULL, recv_buf, len2, io_complete, ud2, ASYNC_FLAG_NONE, 0},
    {sock3, 1, send_buf2, NULL, len3, io_complete, ud3, ASYNC_FLAG_URGENT, 0}
};
int submitted = SocketAsync_submit_batch(async, ops, 3);
printf("Submitted %d operations\n", submitted);

/* Cancel specific operation */
SocketAsync_cancel(async, req_id);

/* Cancel all pending (during shutdown) */
int cancelled = SocketAsync_cancel_all(async);
printf("Cancelled %d pending ops\n", cancelled);

/* Check backend in use */
printf("Backend: %s, available: %s\n",
       SocketAsync_backend_name(async),
       SocketAsync_is_available(async) ? "yes" : "fallback");

/* Completions auto-processed in SocketPoll_wait() */
SocketEvent_T *events;
int n = SocketPoll_wait(poll, &events, 100);

SocketPoll_free(&poll);

Limitation de la bande passante```c

#include "socket/Socket.h"

Socket_T socket = Socket_new(AF_INET, SOCK_STREAM, 0); Socket_connect(socket, "example.com", 80);

/* Enable bandwidth limiting: 1 MB/sec */ Socket_setbandwidth(socket, 1024 * 1024);

/* Rate-limited send / ssize_t n = Socket_send_limited(socket, data, len); if (n == 0) { / Rate limited - wait before retry / int64_t wait_ms = Socket_bandwidth_wait_ms(socket, len); / Use wait_ms as poll timeout */ }

/* Query current limit */ size_t limit = Socket_getbandwidth(socket);

Socket_free(&socket);

root@kitploit:~
### Santé de la connexion et sondage```c
#include "socket/Socket.h"

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "example.com", 80);

/* Quick health check (non-blocking) */
if (!Socket_probe(sock, 0)) {
    printf("Connection appears dead\n");
}

/* Health check with timeout (waits up to 100ms for response) */
if (!Socket_probe(sock, 100)) {
    printf("Connection lost, reconnecting...\n");
}

/* Check for pending socket errors (after non-blocking connect) */
int error = Socket_get_error(sock);
if (error != 0) {
    printf("Socket error: %s\n", strerror(error));
}

/* Check read/write readiness without blocking */
if (Socket_is_readable(sock) > 0) {
    char buf[1024];
    ssize_t n = Socket_recv(sock, buf, sizeof(buf));
}

if (Socket_is_writable(sock) > 0) {
    Socket_send(sock, "GET / HTTP/1.1\r\n\r\n", 18);
}

#ifdef __linux__
/* Get TCP stack statistics (Linux only) */
SocketTCPInfo info;
if (Socket_get_tcp_info(sock, &info) == 0) {
    printf("RTT: %.2f ms\n", info.rtt_us / 1000.0);
    printf("Congestion window: %u segments\n", info.snd_cwnd);
    printf("Retransmissions: %u\n", info.total_retrans);
    if (info.delivery_rate > 0) {
        printf("Delivery rate: %.2f Mbps\n", info.delivery_rate * 8.0 / 1e6);
    }
}
#endif

/* Simple RTT query (cross-platform, returns -1 if unavailable) */
int32_t rtt = Socket_get_rtt(sock);
if (rtt >= 0) {
    printf("RTT: %.2f ms\n", rtt / 1000.0);
}

/* Congestion window query (Linux only) */
int32_t cwnd = Socket_get_cwnd(sock);
if (cwnd >= 0) {
    printf("CWND: %d segments\n", cwnd);
}

Socket_free(&sock);

Entrées/Sorties avec délais d'attente```c

#include "socket/Socket.h"

Socket_T sock = Socket_connect_tcp("example.com", 80, 5000);

/* Send all data with timeout (returns bytes actually sent) */ ssize_t sent = Socket_sendall_timeout(sock, request, len, 10000); if (sent < (ssize_t)len) { printf("Only sent %zd bytes before timeout\n", sent); }

/* Receive with timeout (returns bytes received) */ char response[4096]; ssize_t n = Socket_recvall_timeout(sock, response, sizeof(response), 5000); if (n > 0) { printf("Received %zd bytes\n", n); }

/* Scatter/gather I/O with timeout */ struct iovec iov[2] = { {.iov_base = header, .iov_len = header_len}, {.iov_base = body, .iov_len = body_len} }; ssize_t sent_v = Socket_sendv_timeout(sock, iov, 2, 5000);

Socket_free(&sock);

root@kitploit:~
### Opérations avancées I/O```c
#include "socket/Socket.h"

/* Peek at data without consuming */
char peek_buf[16];
ssize_t peeked = Socket_peek(sock, peek_buf, sizeof(peek_buf));
if (peeked > 0) {
    printf("Peeked %zd bytes: protocol=%d\n", peeked, peek_buf[0]);
}

/* TCP cork for efficient message assembly */
Socket_cork(sock, 1);  /* Enable corking */
Socket_send(sock, headers, header_len);
Socket_send(sock, body, body_len);
Socket_cork(sock, 0);  /* Disable cork, flush all data */

#ifdef __linux__
/* Zero-copy socket-to-socket transfer (Linux only) */
ssize_t spliced = Socket_splice(client, upstream, 65536);
if (spliced > 0) {
    printf("Spliced %zd bytes\n", spliced);
} else if (spliced == 0) {
    /* Would block - poll for readiness */
} else {
    /* Not supported on this platform */
    char buf[4096];
    while ((n = Socket_recv(client, buf, sizeof(buf))) > 0) {
        Socket_sendall(upstream, buf, n);
    }
}
#endif

Duplication de socket```c

#include "socket/Socket.h"

Socket_T socket = Socket_connect_tcp("example.com", 80, 5000);

/* Duplicate socket for separate reader/writer threads */ Socket_T reader = socket; Socket_T writer = Socket_dup(socket);

/* Now can be used in separate threads safely / / reader thread: Socket_recv(reader, ...) / / writer thread: Socket_send(writer, ...) */

/* Duplicate to specific fd (useful for exec) / Socket_T sock_fd3 = Socket_dup2(socket, 3); if (fork() == 0) { / Child process can access socket on fd 3 */ execl("/usr/bin/handler", "handler", NULL); }

Socket_free(&writer); Socket_free(&reader); Socket_free(&sock_fd3);

root@kitploit:~
### Minuteries```c
#include "poll/SocketPoll.h"
#include "core/SocketTimer.h"

SocketPoll_T poll = SocketPoll_new(100);

/* Check which backend is in use */
printf("Backend: %s\n", SocketPoll_get_backend_name(poll));
// Output: "epoll" (Linux), "kqueue" (macOS/BSD), or "poll" (fallback)

void timer_callback(void *userdata) {
    printf("Timer fired!\n");
}

/* One-shot timer (fires once after 5 seconds) */
SocketTimer_T timer = SocketTimer_add(poll, 5000, timer_callback, NULL);

/* Repeating timer (fires every 1 second) */
SocketTimer_T heartbeat = SocketTimer_add_repeating(poll, 1000, timer_callback, NULL);

/* Check remaining time */
int64_t remaining = SocketTimer_remaining(poll, timer);

/* Reschedule timer with new delay (extends/shortens timeout) */
SocketTimer_reschedule(poll, timer, 10000);  /* Now fires in 10 seconds */

/* Pause and resume timers */
SocketTimer_pause(poll, heartbeat);   /* Stops firing, preserves remaining time */
/* ... do something ... */
SocketTimer_resume(poll, heartbeat);  /* Continues from where it paused */

/* Cancel timer */
SocketTimer_cancel(poll, heartbeat);

/* Modify events for registered sockets */
Socket_T sock = /* ... */;
SocketPoll_add(poll, sock, POLL_READ, NULL);
SocketPoll_modify_events(poll, sock, POLL_WRITE, 0);  /* Add write monitoring */
SocketPoll_modify_events(poll, sock, 0, POLL_WRITE);  /* Remove write monitoring */

/* List registered sockets */
Socket_T sockets[100];
int count = SocketPoll_get_registered_sockets(poll, sockets, 100);
printf("Monitoring %d sockets\n", count);

/* Timers fire automatically during SocketPoll_wait() */
SocketEvent_T *events;
int n = SocketPoll_wait(poll, &events, -1);

SocketPoll_free(&poll);

Limitation de débit par seau à jetons```c

#include "core/SocketRateLimit.h"

/* Create rate limiter: 100 tokens/sec, burst capacity of 50 */ SocketRateLimit_T limiter = SocketRateLimit_new(NULL, 100, 50);

/* Try to acquire tokens (non-blocking) / if (SocketRateLimit_try_acquire(limiter, 1)) { / Allowed - proceed / handle_request(); } else { / Rate limited - calculate wait time / int64_t wait_ms = SocketRateLimit_wait_time_ms(limiter, 1); if (wait_ms > 0) { / Wait or reject */ } }

/* Query state */ size_t available = SocketRateLimit_available(limiter); size_t rate = SocketRateLimit_get_rate(limiter);

/* Reconfigure at runtime */ SocketRateLimit_configure(limiter, 200, 100);

SocketRateLimit_free(&limiter);

root@kitploit:~
### TLS/SSL Communication Sécurisée```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* Create client TLS context */
SocketTLSContext_T ctx = SocketTLSContext_new_client("/etc/ssl/certs/ca-certificates.crt");

/* Configure ALPN protocols */
const char *protos[] = {"h2", "http/1.1"};
SocketTLSContext_set_alpn_protos(ctx, protos, 2);

/* Enable session caching for performance */
SocketTLSContext_enable_session_cache(ctx, 1000, 300);

/* Create and connect socket */
Socket_T socket = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(socket, "example.com", 443);

/* Enable TLS */
SocketTLS_enable(socket, ctx);
SocketTLS_set_hostname(socket, "example.com");  /* SNI + verification */

/* Perform handshake (with timeout) */
TLSHandshakeState state = SocketTLS_handshake_loop(socket, 10000);
if (state != TLS_HANDSHAKE_COMPLETE) {
    fprintf(stderr, "Handshake failed\n");
}

/* Check negotiated protocol */
const char *alpn = SocketTLS_get_alpn_selected(socket);
printf("ALPN: %s\n", alpn ? alpn : "none");
printf("Cipher: %s\n", SocketTLS_get_cipher(socket));
printf("Version: %s\n", SocketTLS_get_version(socket));

/* Encrypted I/O */
SocketTLS_send(socket, "GET / HTTP/1.1\r\n\r\n", 18);
char buf[4096];
ssize_t n = SocketTLS_recv(socket, buf, sizeof(buf));

/* Graceful shutdown */
SocketTLS_shutdown(socket);
Socket_free(&socket);
SocketTLSContext_free(&ctx);

Reprise de session TLS```c

#include "tls/SocketTLS.h"

/* Save session for later resumption */ size_t session_len = 4096; unsigned char session_data[4096];

if (SocketTLS_session_save(sock, session_data, &session_len) == 1) { /* Store session_data[:session_len] to disk/cache */ write_session_to_cache(hostname, session_data, session_len); }

/* Later: restore session for faster reconnect */ Socket_T sock2 = Socket_connect_tcp(hostname, port, 5000); SocketTLS_enable(sock2, ctx); SocketTLS_set_hostname(sock2, hostname);

/* Restore previously saved session */ unsigned char *cached_session = read_session_from_cache(hostname, &cached_len); if (cached_session) { SocketTLS_session_restore(sock2, cached_session, cached_len); free(cached_session); }

SocketTLS_handshake_auto(sock2);

/* Check if session was resumed (0-RTT or abbreviated handshake) */ if (SocketTLS_is_session_reused(sock2)) { printf("Session resumed - faster handshake!\n"); }

root@kitploit:~
### Informations sur le certificat TLS```c
#include "tls/SocketTLS.h"

/* Get full certificate details */
SocketTLS_CertInfo info;
if (SocketTLS_get_peer_cert_info(sock, &info) == 1) {
    printf("Subject: %s\n", info.subject);
    printf("Issuer: %s\n", info.issuer);
    printf("Version: X.509v%d\n", info.version);
    printf("Serial: %s\n", info.serial);
    printf("Fingerprint: %s\n", info.fingerprint);
    printf("Valid from: %s", ctime(&info.not_before));
    printf("Valid until: %s", ctime(&info.not_after));
}

/* Quick certificate expiry check */
time_t expiry = SocketTLS_get_cert_expiry(sock);
if (expiry != (time_t)-1) {
    time_t now = time(NULL);
    int days_left = (expiry - now) / 86400;
    if (days_left < 30) {
        printf("Warning: Certificate expires in %d days!\n", days_left);
    }
}

/* Just get subject for logging */
char subject[256];
if (SocketTLS_get_cert_subject(sock, subject, sizeof(subject)) > 0) {
    printf("Connected to: %s\n", subject);
}

TLS OCSP et Renégociation```c

#include "tls/SocketTLS.h"

/* Check OCSP stapling status */ int ocsp_status = SocketTLS_get_ocsp_response_status(sock); switch (ocsp_status) { case 1: printf("Certificate verified via OCSP\n"); break; case 0: printf("WARNING: Certificate REVOKED!\n"); Socket_free(&sock); return; case -1: printf("No OCSP response (server doesn't support stapling)\n"); break; case -2: printf("OCSP response verification failed\n"); break; }

/* Disable renegotiation for security (prevents DoS attacks) */ SocketTLS_disable_renegotiation(sock);

/* Or check for pending renegotiation requests */ int reneg = SocketTLS_check_renegotiation(sock); if (reneg == 1) { printf("Renegotiation completed\n"); } else if (reneg == -1) { printf("Renegotiation rejected (disabled or TLS 1.3)\n"); }

root@kitploit:~
### Serveur TLS avec SNI et épinglage de certificat```c
#include "tls/SocketTLSContext.h"

/* Create server context with primary certificate */
SocketTLSContext_T ctx = SocketTLSContext_new_server(
    "server.crt", "server.key", "ca-bundle.crt");

/* Add SNI certificates for virtual hosting */
SocketTLSContext_add_certificate(ctx, "www.example.com", 
                                  "www.crt", "www.key");
SocketTLSContext_add_certificate(ctx, "api.example.com",
                                  "api.crt", "api.key");

/* Enable client certificate verification */
SocketTLSContext_set_verify_mode(ctx, TLS_VERIFY_PEER);

/* Load CRL for revocation checking */
SocketTLSContext_load_crl(ctx, "/path/to/crl.pem");

/* Enable OCSP stapling */
unsigned char ocsp_response[4096];
size_t ocsp_len = load_ocsp_response(ocsp_response, sizeof(ocsp_response));
SocketTLSContext_set_ocsp_response(ctx, ocsp_response, ocsp_len);

/* Enable session tickets */
unsigned char ticket_key[80];
generate_ticket_key(ticket_key, sizeof(ticket_key));
SocketTLSContext_enable_session_tickets(ctx, ticket_key, sizeof(ticket_key));

/* Certificate pinning (client context) */
SocketTLSContext_T client_ctx = SocketTLSContext_new_client("ca-bundle.pem");
SocketTLSContext_add_pin_hex(client_ctx, 
    "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c");
SocketTLSContext_set_pin_enforcement(client_ctx, 1);  /* Strict mode */

Transparence des certificats (CT)```c

#include "tls/SocketTLSContext.h"

/* Enable Certificate Transparency validation (RFC 6962) */ SocketTLSContext_T ctx = SocketTLSContext_new_client("ca-bundle.pem");

/* Strict mode - fail if no valid SCTs */ SocketTLSContext_enable_ct(ctx, CT_VALIDATION_STRICT);

/* Or permissive mode - log but continue */ SocketTLSContext_enable_ct(ctx, CT_VALIDATION_PERMISSIVE);

/* Custom CT log list (optional) */ SocketTLSContext_set_ctlog_list_file(ctx, "/path/to/ctlogs.txt");

/* Query CT status */ if (SocketTLSContext_ct_enabled(ctx)) { CTValidationMode mode = SocketTLSContext_get_ct_mode(ctx); printf("CT validation: %s\n", mode == CT_VALIDATION_STRICT ? "strict" : "permissive"); }

root@kitploit:~
### OCSP Must-Staple (RFC 7633)```c
#include "tls/SocketTLSContext.h"

/* Create client context with must-staple enforcement */
SocketTLSContext_T ctx = SocketTLSContext_new_client("ca-bundle.pem");

/* Auto-detection: respect certificate's must-staple extension */
SocketTLSContext_set_ocsp_must_staple(ctx, OCSP_MUST_STAPLE_AUTO);

/* Or always require OCSP stapling for strict security policies */
SocketTLSContext_set_ocsp_must_staple(ctx, OCSP_MUST_STAPLE_ALWAYS);

/* Query current mode */
OCSPMustStapleMode mode = SocketTLSContext_get_ocsp_must_staple(ctx);

/* Connect and handshake - fails if must-staple cert has no OCSP response */
SocketTLS_enable(sock, ctx);
SocketTLS_handshake_auto(sock);

kTLS (Kernel TLS) Offload

kTLS décharge le chiffrement/déchiffrement TLS vers le noyau Linux pour des performances améliorées.```c #include "tls/SocketTLS.h"

/* Check if kTLS is available on this system */ if (SocketTLS_ktls_available()) { printf("kTLS available - optimal async I/O\n"); }

/* Enable kTLS before handshake / SocketTLS_enable(sock, ctx); SocketTLS_enable_ktls(sock); / Request kTLS offload */ SocketTLS_handshake_auto(sock);

/* Check if offload is active after handshake */ if (SocketTLS_is_ktls_tx_active(sock)) { printf("TX offload active\n"); } if (SocketTLS_is_ktls_rx_active(sock)) { printf("RX offload active\n"); }

/* Zero-copy file transfer with kTLS (uses SSL_sendfile internally) */ int file_fd = open("largefile.bin", O_RDONLY); off_t offset = 0; ssize_t sent = SocketTLS_sendfile(sock, file_fd, offset, file_size); close(file_fd);

root@kitploit:~
**Configuration requise kTLS :**
| Fonctionnalité | Configuration requise |
|---------|-------------|
| TX offload | Linux 4.13+, OpenSSL 3.0+ avec enable-ktls |
| RX offload | Linux 4.17+ |
| ChaCha20 | Linux 5.11+ |
| Chiffrements | AES-GCM-128/256, ChaCha20-Poly1305 |

### TLS 1.3 0-RTT Données précoces```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* Server: Enable 0-RTT early data reception */
SocketTLSContext_T srv_ctx = SocketTLSContext_new_server("cert.pem", "key.pem", NULL);
SocketTLSContext_enable_early_data(srv_ctx, 16384);  /* Max 16KB early data */

/* Client: Send early data during handshake */
SocketTLS_enable(sock, ctx);
SocketTLS_set_hostname(sock, "example.com");

/* Write early data (before handshake completes) */
size_t written = 0;
int ret = SocketTLS_write_early_data(sock, "GET / HTTP/1.1\r\n\r\n", 18, &written);
if (ret == 1) {
    printf("Sent %zu bytes as early data\n", written);
}

/* Complete handshake */
SocketTLS_handshake_auto(sock);

/* Check if early data was accepted */
SocketTLS_EarlyDataStatus status = SocketTLS_get_early_data_status(sock);
if (status == SOCKET_EARLY_DATA_REJECTED) {
    /* Server rejected - resend via normal I/O */
    SocketTLS_send(sock, "GET / HTTP/1.1\r\n\r\n", 18);
}

/* Server: Read early data during handshake */
unsigned char early_buf[4096];
size_t readbytes = 0;
ret = SocketTLS_read_early_data(srv_sock, early_buf, sizeof(early_buf), &readbytes);

Avertissement de sécurité : 0-RTT n'est PAS protégé contre la relecture. À utiliser uniquement pour des opérations idempotentes.

TLS 1.3 KeyUpdate (Key Rotation)```c

#include "tls/SocketTLS.h"

/* For long-lived connections, rotate keys periodically for forward secrecy */

/* Request key update (local only) */ int ret = SocketTLS_request_key_update(sock, 0);

/* Request key update and ask peer to also rotate */ ret = SocketTLS_request_key_update(sock, 1);

/* Monitor key rotations performed */ int count = SocketTLS_get_key_update_count(sock); printf("Key rotations: %d\n", count);

root@kitploit:~
**Utilisation recommandée :**
- Connexions de base de données ouvertes pendant des heures/jours
- Tunnels VPN
- Connexions WebSocket persistantes
- Rotation toutes les heures ou tous les 1 Go de données transférées

### Optimisations des performances TLS```c
#include "tls/SocketTLS.h"
#include "tls/SocketTLSContext.h"

/* TCP handshake optimization - apply before TLS handshake */
SocketTLS_optimize_handshake(sock);  /* Sets TCP_NODELAY + TCP_QUICKACK */

/* After bulk transfer, optionally restore defaults */
SocketTLS_restore_tcp_defaults(sock);  /* Re-enables Nagle */

/* Session cache sharding for multi-threaded servers */
SocketTLSContext_create_sharded_cache(ctx, 
    8,      /* Number of shards (match thread count) */
    1000,   /* Sessions per shard */
    300);   /* Timeout in seconds */

/* Get aggregate statistics from sharded cache */
size_t total_hits, total_misses, total_stores;
SocketTLSContext_get_sharded_stats(ctx, &total_hits, &total_misses, &total_stores);

/* TLS buffer pool for high-connection scenarios */
Arena_T arena = Arena_new();
TLSBufferPool_T pool = TLSBufferPool_new(16384, 100, arena);  /* 16KB buffers, 100 count */

/* Acquire buffer for connection */
void *buf = TLSBufferPool_acquire(pool);
/* ... use buffer for TLS I/O ... */
TLSBufferPool_release(pool, buf);

/* Check pool statistics */
size_t total, in_use, available;
TLSBufferPool_stats(pool, &total, &in_use, &available);

TLSBufferPool_free(&pool);
Arena_dispose(&arena);

CRL Auto-Refresh```c

#include "tls/SocketTLSContext.h"

/* Callback for refresh notifications */ void crl_refresh_callback(SocketTLSContext_T ctx, const char *path, int success, void *data) { if (!success) { fprintf(stderr, "CRL refresh failed for %s\n", path); } }

/* Configure automatic CRL refresh (minimum 60 seconds) / SocketTLSContext_set_crl_auto_refresh(ctx, "/path/to/crl.pem", 3600, / Refresh every hour */ crl_refresh_callback, NULL);

/* In event loop: check if refresh is due / while (running) { / ... process events ... */ SocketTLSContext_crl_check_refresh(ctx);

root@kitploit:~
/* Get time until next refresh for poll timeout optimization */
int64_t next_ms = SocketTLSContext_crl_next_refresh_ms(ctx);

}

/* Cancel auto-refresh (retains currently loaded CRL) */ SocketTLSContext_cancel_crl_auto_refresh(ctx);

root@kitploit:~
### Transfert de fichiers Zero-Copy```c
int file_fd = open("largefile.bin", O_RDONLY);
struct stat st;
fstat(file_fd, &st);

off_t offset = 0;
ssize_t sent = Socket_sendfileall(socket, file_fd, &offset, st.st_size);
close(file_fd);

Scatter/Gather I/O```c

struct iovec iov[3]; iov[0].iov_base = header; iov[0].iov_len = header_len; iov[1].iov_base = body; iov[1].iov_len = body_len; iov[2].iov_base = footer; iov[2].iov_len = footer_len;

/* Send all data atomically */ ssize_t sent = Socket_sendvall(socket, iov, 3);

root@kitploit:~
### Unix Domain Sockets avec FD Passing```c
#include "socket/Socket.h"

/* Stream socket pair for IPC */
Socket_T sock1, sock2;
SocketPair_new(SOCK_STREAM, &sock1, &sock2);

/* Server socket */
Socket_T server = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_bind_unix(server, "/tmp/my.sock");
Socket_listen(server, 10);

/* Client connection */
Socket_T client = Socket_new(AF_UNIX, SOCK_STREAM, 0);
Socket_connect_unix(client, "/tmp/my.sock");

/* Get peer credentials (Linux only) */
int peer_pid = Socket_getpeerpid(accepted);
int peer_uid = Socket_getpeeruid(accepted);
int peer_gid = Socket_getpeergid(accepted);

/* Abstract namespace (Linux only - prefix with @) */
Socket_bind_unix(server, "@abstract-socket");

/* File descriptor passing (SCM_RIGHTS) */
int fd_to_pass = open("/etc/passwd", O_RDONLY);
Socket_sendfd(sock1, fd_to_pass);
close(fd_to_pass);

/* Receive passed FD */
int received_fd;
Socket_recvfd(sock2, &received_fd);
/* received_fd is now a valid FD in this process */
close(received_fd);

/* Multiple FD passing */
int fds[3] = {fd1, fd2, fd3};
Socket_sendfds(sock1, fds, 3);

int received_fds[3];
size_t num_fds;
Socket_recvfds(sock2, received_fds, 3, &num_fds);

Utilitaires cryptographiques```c

#include "core/SocketCrypto.h"

/* SHA-256 hash */ unsigned char hash[SOCKET_CRYPTO_SHA256_SIZE]; SocketCrypto_sha256(data, data_len, hash);

/* HMAC-SHA256 */ unsigned char mac[SOCKET_CRYPTO_SHA256_SIZE]; SocketCrypto_hmac_sha256(key, key_len, data, data_len, mac);

/* Base64 encoding */ size_t encoded_len = SocketCrypto_base64_encoded_size(data_len); char *encoded = malloc(encoded_len); SocketCrypto_base64_encode(data, data_len, encoded, encoded_len);

/* Cryptographically secure random */ unsigned char random_bytes[32]; SocketCrypto_random_bytes(random_bytes, sizeof(random_bytes));

/* Constant-time comparison (prevents timing attacks) / if (SocketCrypto_secure_compare(expected, actual, len)) { / Match */ }

/* Secure memory clearing */ SocketCrypto_secure_clear(password, password_len);

root@kitploit:~
### Observabilité - Journalisation```c
#include "core/SocketUtil.h"

/* Custom logging callback */
void my_logger(void *userdata, SocketLogLevel level,
               const char *component, const char *message) {
    printf("[%s] %s: %s\n", SocketLog_levelname(level), component, message);
}
SocketLog_setcallback(my_logger, NULL);

/* Set minimum log level */
SocketLog_setlevel(SOCKET_LOG_DEBUG);

/* Use convenience macros */
#define SOCKET_LOG_COMPONENT "MyApp"
SOCKET_LOG_INFO_MSG("Server started on port %d", port);
SOCKET_LOG_ERROR_MSG("Connection failed: %s", strerror(errno));

/* Correlation IDs for distributed tracing */
SocketLogContext ctx = {0};
strncpy(ctx.request_id, "req-12345", sizeof(ctx.request_id) - 1);
strncpy(ctx.trace_id, "trace-abcde", sizeof(ctx.trace_id) - 1);
SocketLog_setcontext(&ctx);
SOCKET_LOG_INFO_MSG("Processing request");  /* Includes correlation IDs */
SocketLog_clearcontext();

Observabilité - Métriques```c

#include "core/SocketMetrics.h"

/* Record metrics */ SocketMetrics_counter_inc(SOCKET_CTR_SOCKET_CREATED); SocketMetrics_gauge_set(SOCKET_GAU_POOL_ACTIVE_CONNECTIONS, 42); SocketMetrics_histogram_observe(SOCKET_HIST_HTTP_CLIENT_REQUEST_LATENCY_MS, 125.0);

/* Get percentiles */ double p99 = SocketMetrics_histogram_percentile(SOCKET_HIST_HTTP_CLIENT_REQUEST_LATENCY_MS, 99.0);

/* Export to Prometheus */ char buffer[65536]; size_t len = SocketMetrics_export_prometheus(buffer, sizeof(buffer));

/* Export to StatsD */ SocketMetrics_export_statsd(buffer, sizeof(buffer), "myapp.socket");

/* Export to JSON */ SocketMetrics_export_json(buffer, sizeof(buffer));

/* Get complete snapshot */ SocketMetrics_Snapshot snapshot; SocketMetrics_get(&snapshot);

/* Reset metrics */ SocketMetrics_reset();

/* Socket count and peak tracking / int current = SocketMetrics_get_socket_count(); int peak = SocketMetrics_get_peak_connections(); SocketMetrics_reset_peaks(); / Reset high watermark */

root@kitploit:~
### Statistiques par socket

Suivez les statistiques d'E/S pour chaque socket :```c
#include "socket/Socket.h"

Socket_T sock = Socket_new(AF_INET, SOCK_STREAM, 0);
Socket_connect(sock, "example.com", 80);

/* ... send/recv operations ... */

/* Get per-socket statistics */
SocketStats_T stats;
Socket_getstats(sock, &stats);

printf("Bytes: %zu sent, %zu received\n",
       (size_t)stats.bytes_sent, (size_t)stats.bytes_received);
printf("Packets: %zu sent, %zu received\n",
       (size_t)stats.packets_sent, (size_t)stats.packets_received);
printf("Errors: %zu send, %zu recv\n",
       (size_t)stats.send_errors, (size_t)stats.recv_errors);
printf("Last activity: send=%lld ms, recv=%lld ms ago\n",
       (long long)(Socket_get_monotonic_ms() - stats.last_send_time_ms),
       (long long)(Socket_get_monotonic_ms() - stats.last_recv_time_ms));

/* RTT estimation (Linux only via TCP_INFO) */
if (stats.rtt_us >= 0) {
    printf("RTT: %.2f ms (var: %.2f ms)\n",
           stats.rtt_us / 1000.0, stats.rtt_var_us / 1000.0);
}

/* Reset statistics for next interval */
Socket_resetstats(sock);

Socket_free(&sock);

Options TCP avancées```c

/* Congestion control algorithm (Linux only) */ Socket_setcongestion(socket, "bbr"); char algo[16]; Socket_getcongestion(socket, algo, sizeof(algo));

/* TCP Fast Open (Linux 3.7+, FreeBSD 10.0+, macOS 10.11+) */ Socket_setfastopen(socket, 1);

/* TCP user timeout (Linux 2.6.37+) / Socket_setusertimeout(socket, 30000); / 30 seconds */

/* TCP keepalive / Socket_setkeepalive(socket, 60, 10, 5); / idle=60s, interval=10s, count=5 */

/* Disable Nagle's algorithm */ Socket_setnodelay(socket, 1);

/* Buffer sizes */ Socket_setrcvbuf(socket, 262144); Socket_setsndbuf(socket, 262144);

/* SYN flood protection / Socket_setdeferaccept(socket, 10); / Wait 10s for data before accept() */

root@kitploit:~
## Architecture

### Organisation des modules```
include/
├── core/          # Foundation layer
│   ├── Arena.h          # Arena memory management
│   ├── Except.h         # Exception handling
│   ├── SocketConfig.h   # Configuration constants
│   ├── SocketCrypto.h   # Cryptographic utilities
│   ├── SocketIPTracker.h # Per-IP connection tracking
│   ├── SocketMetrics.h  # Production metrics (counters, gauges, histograms)
│   ├── SocketRateLimit.h # Token bucket rate limiting
│   ├── SocketRetry.h    # Generic retry with exponential backoff
│   ├── SocketSecurity.h # Security utilities
│   ├── SocketSYNProtect.h # SYN flood protection
│   ├── SocketTimer.h    # Timer management
│   ├── SocketUTF8.h     # UTF-8 validation
│   └── SocketUtil.h     # Logging, error handling, utilities
├── socket/        # Core I/O layer
│   ├── Socket.h         # TCP/Unix domain sockets
│   ├── SocketAsync.h    # Async I/O (io_uring/kqueue)
│   ├── SocketBuf.h      # Circular buffer
│   ├── SocketCommon.h   # Shared socket base
│   ├── SocketDgram.h    # UDP sockets
│   ├── SocketHappyEyeballs.h # RFC 8305 connection racing
│   ├── SocketIO.h       # I/O helpers
│   ├── SocketProxy.h    # HTTP CONNECT/SOCKS proxy
│   ├── SocketReconnect.h # Auto-reconnection
│   └── SocketWS.h       # WebSocket (RFC 6455)
├── dns/           # DNS layer
│   ├── SocketDNS.h      # Async DNS resolution
│   ├── SocketDNSoverTLS.h # DNS-over-TLS (RFC 7858)
│   ├── SocketDNSoverHTTPS.h # DNS-over-HTTPS (RFC 8484)
│   ├── SocketDNSSEC.h   # DNSSEC validation (RFC 4033-4035)
│   ├── SocketDNSCookie.h # DNS cookies (RFC 7873)
│   ├── SocketDNSResolver.h # High-level resolver API
│   ├── SocketDNSWire.h  # Wire format encoding/decoding
│   ├── SocketDNSTransport.h # UDP/TCP transport layer
│   ├── SocketDNSNegCache.h # Negative response caching
│   └── SocketDNSError.h # Extended DNS errors (RFC 8914)
├── poll/          # Event system
│   └── SocketPoll.h     # Cross-platform polling
├── pool/          # Connection management
│   └── SocketPool.h     # Connection pooling
├── tls/           # Security layer
│   ├── SocketTLS.h      # TLS operations
│   ├── SocketTLSContext.h # TLS context management
│   ├── SocketTLSConfig.h # TLS configuration constants
│   ├── SocketDTLS.h     # DTLS operations
│   ├── SocketDTLSContext.h # DTLS context management
│   └── SocketDTLSConfig.h # DTLS configuration constants
├── http/          # HTTP protocol stack
│   ├── SocketHTTP.h     # HTTP core (RFC 9110)
│   ├── SocketHTTP1.h    # HTTP/1.1 (RFC 9112)
│   ├── SocketHPACK.h    # HPACK (RFC 7541)
│   ├── SocketHTTP2.h    # HTTP/2 (RFC 9113)
│   ├── SocketHTTPClient.h # HTTP client API
│   └── SocketHTTPServer.h # HTTP server API
├── quic/          # QUIC transport layer
│   ├── SocketQUICConnection.h # Connection management (RFC 9000)
│   ├── SocketQUICStream.h   # Stream multiplexing
│   ├── SocketQUICPacket.h   # Packet parsing/serialization
│   ├── SocketQUICFrame.h    # Frame encoding/decoding
│   ├── SocketQUICHandshake.h # TLS 1.3 handshake integration
│   ├── SocketQUICFlow.h     # Flow control
│   ├── SocketQUICLoss.h     # Loss detection (RFC 9002)
│   ├── SocketQUICMigration.h # Path migration
│   └── SocketQUICVersion.h  # Version negotiation
└── simple/        # Return-code based convenience API
    ├── SocketSimple.h       # Core simple socket API
    ├── SocketSimple-http.h  # Simple HTTP client
    ├── SocketSimple-tls.h   # Simple TLS connections
    ├── SocketSimple-ws.h    # Simple WebSocket
    └── SocketSimple-dns.h   # Simple DNS resolution

Architecture en couches

  1. Fondation : Arena (Mémoire), Except (Erreurs), SocketCrypto (Primitives cryptographiques)
  2. Utilitaires : SocketUtil (Journalisation, Métriques, Événements, Gestion des erreurs), SocketTimer, SocketRateLimit, SocketUTF8, SocketRetry
  3. Abstraction de base : SocketCommon (Base partagée SocketBase_T pour Socket/SocketDgram)
  4. E/S principales : Socket (TCP/Unix), SocketDgram (UDP), SocketBuf (Tampons), SocketIO (Assistants E/S)

Sécurité des threads

Gestion des signaux

SIGPIPE (Automatique)

Aucune action de l'application n'est requise. La bibliothèque gère SIGPIPE en interne :

PlateformeMécanismeQuand appliqué
Linux/FreeBSDOption MSG_NOSIGNALChaque opération d'envoi
BSD/macOSOption SO_NOSIGPIPEÀ la création de la socket

Les applications n'ont PAS besoin d'appeler signal(SIGPIPE, SIG_IGN).

Pour le code hérité ou la défense en profondeur, une fonction de commodité optionnelle est fournie :```c // Optional - not required Socket_ignore_sigpipe();

root@kitploit:~
### Arrêt élégant

La bibliothèque n'installe **PAS** de gestionnaires de signaux. Les applications doivent gérer elles-mêmes les signaux d'arrêt. Motif recommandé utilisant l'astuce du self-pipe trick :```c
#include <signal.h>
#include <unistd.h>

static int signal_pipe[2];

/* Async-signal-safe handler - only writes to pipe */
static void shutdown_handler(int signo) {
    (void)signo;
    char byte = 1;
    (void)write(signal_pipe[1], &byte, 1);  /* write() is async-signal-safe */
}

int main(void) {
    pipe(signal_pipe);
    fcntl(signal_pipe[0], F_SETFL, O_NONBLOCK);
    fcntl(signal_pipe[1], F_SETFL, O_NONBLOCK);
    
    struct sigaction sa = {0};
    sa.sa_handler = shutdown_handler;
    sigemptyset(&sa.sa_mask);
    sigaction(SIGINT, &sa, NULL);
    sigaction(SIGTERM, &sa, NULL);
    
    /* Add signal pipe to poll set */
    SocketPoll_add_fd(poll, signal_pipe[0], POLL_READ, NULL);
    
    /* In event loop, check for signal pipe readability */
    /* Then use SocketPool_drain() for graceful connection draining */
}

Construction

Prérequis

  • CMake 3.10+
  • Compilateur C11 avec extensions GNU et support pthread
  • Système compatible POSIX
  • OpenSSL 1.1.1+ ou LibreSSL (optionnel, pour le support TLS/DTLS)
  • zlib (optionnel, pour la compression HTTP et le permessage-deflate WebSocket)

Commandes de construction```bash

Configure

cmake -S . -B build

Build

cmake --build build -j

Run tests

cd build && ctest --output-on-failure

Generate API documentation (requires Doxygen)

cmake --build build --target doc

Install (optional)

cmake --install build --prefix /usr/local

root@kitploit:~
### Options de compilation

| Option | Description | Par défaut |
|--------|-------------|---------|
| `CMAKE_BUILD_TYPE` | Debug ou Release | Debug |
| `ENABLE_TLS` | Activer le support TLS/DTLS | ON (auto-détection) |
| `ENABLE_HTTP_COMPRESSION` | Activer gzip/deflate/brotli | OFF |
| `ENABLE_SANITIZERS` | Activer ASan + UBSan | OFF |
| `ENABLE_ASAN` | Activer AddressSanitizer uniquement | OFF |
| `ENABLE_UBSAN` | Activer UndefinedBehaviorSanitizer uniquement | OFF |
| `ENABLE_COVERAGE` | Activer la couverture gcov | OFF |
| `ENABLE_FUZZING` | Activer les tests de fuzz (nécessite Clang) | OFF |

### Sélection du backend Poll

Le backend poll est sélectionné automatiquement en fonction de la plateforme :
- **Linux** - epoll (le plus rapide pour Linux)
- **BSD/macOS** - kqueue
- **Autres POSIX** - solution de repli poll(2)

### Sélection du backend I/O asynchrone

- **Linux 5.1+** - io_uring (asynchrone véritable)
- **BSD/macOS** - kqueue AIO
- **Repli** - Polling déclenché par front (edge-triggered)

## Tests et Qualité

### Suite de tests

La bibliothèque comprend des tests complets dans `src/test/` :

| Catégorie | Fichiers de test |
|----------|------------|
| Cœur | `test_arena.c`, `test_except.c`, `test_crypto.c`, `test_utf8.c`, `test_ratelimit.c` |
| Socket | `test_socket.c`, `test_socketdgram.c`, `test_socketbuf.c` |
| Réseau | `test_socketpoll.c`, `test_socketpool.c`, `test_socketdns.c`, `test_socketerror.c` |
| Connexion | `test_happy_eyeballs.c`, `test_reconnect.c`, `test_proxy.c`, `test_proxy_integration.c` |
| HTTP | `test_http_core.c`, `test_http1_parser.c`, `test_hpack.c`, `test_http2.c`, `test_http_client.c`, `test_http_integration.c`, `test_http2_integration.c` |
| WebSocket | `test_websocket.c`, `test_ws_integration.c` |
| TLS/DTLS | `test_tls_integration.c`, `test_tls_phase4.c`, `test_tls_pinning.c`, `test_tls_crl.c`, `test_tls_ct.c`, `test_dtls_integration.c`, `test_dtls_cookie.c` |
| Sécurité | `test_synprotect.c`, `test_security.c`, `test_signals.c` |
| Intégration | `test_integration.c`, `test_async.c`, `test_threadsafety.c`, `test_coverage.c` |

### Tests de fuzz

Plus de 130 harnais de fuzz dans `src/fuzz/` couvrant :
- Analyseur HTTP/1.1 et prévention du smuggling de requêtes
- Analyse des trames HTTP/2 et encodage HPACK
- Cadrage WebSocket et permessage-deflate
- Analyse et validation d'URI
- Validation UTF-8
- Handshake TLS/DTLS et opérations E/S
- Tickets de session TLS, ALPN, SNI, gestion CRL
- Génération et vérification de cookies DTLS
- Épinglage de certificats et analyse
- Validation de chemin et vérifications de sécurité```bash
# Build with fuzzing
cmake -S . -B build -DENABLE_FUZZING=ON -DCMAKE_C_COMPILER=clang
cmake --build build

Couverture de test

La bibliothèque comprend une couverture de test complète :

  • 140+ tests unitaires couvrant toutes les fonctionnalités principales
  • Harnesses de fuzzing pour l'analyse de protocoles et les opérations sur les tampons
  • Tests d'intégration pour une fonctionnalité de bout en bout
  • Tests de stress pour les pools de connexions et les scénarios de charge élevée

Les nouvelles fonctionnalités ajoutées dans les améliorations récentes incluent :

  • Fonctions de commodité de haut niveau pour la configuration de sockets TCP/Unix
  • Collecte de statistiques et métriques de sockets
  • Gestion du pool de connexions et surveillance de la santé
  • Mise en cache et configuration DNS
  • Variantes de délais d'attente E/S et opérations avancées
  • Gestion des sessions TLS et inspection des certificats
  • Optimisations de performances TLS (kTLS, 0-RTT, KeyUpdate, session sharding)
  • Agrégation OCSP avec support Must-Staple (RFC 7633)
  • Validation de la transparence des certificats (RFC 6962)
  • Actualisation automatique des LRC avec intervalles configurables
  • Épinglage de certificat avec vérification en temps constant
  • Échange de cookies DTLS pour la protection contre les dénis de service
  • Client/serveur HTTP avec support JSON et mises à niveau WebSocket
  • Compactage de tampons, E/S dispersion-collecte, et lecture de lignes
  • Opérations par lots E/S asynchrones et sélection du backend
  • Introspection du système d'événements et contrôle des temporisateurs

Sanitizers

Tous les tests passent avec :

  • AddressSanitizer (ASan)
  • UndefinedBehaviorSanitizer (UBSan)
  • Vérification de mémoire Valgrind```bash

Build with sanitizers

cmake -S . -B build -DENABLE_SANITIZERS=ON cmake --build build cd build && ctest --output-on-failure

Valgrind

valgrind --leak-check=full --track-fds=yes
--suppressions=../valgrind.supp ./test_socket

root@kitploit:~
### Intégration continue

Pipeline GitHub Actions (`.github/workflows/ci.yml`) :

| Tâche | Plateforme | Description |
|-------|------------|-------------|
| `build` | Ubuntu | Constructions Debug et Release |
| `sanitizers` | Ubuntu | ASan, UBSan, combiné |
| `valgrind` | Ubuntu | Vérification des fuites mémoire |
| `macos` | macOS | Test du backend kqueue |
| `macos-sanitizers` | macOS | Sanitizers multiplateformes |
| `coverage` | Ubuntu | Couverture de code avec lcov |
| `static-analysis` | Ubuntu | cppcheck + clang-tidy |

## Types d'exceptions

### Exceptions de base
- `Socket_Failed` - Échec général d'opération socket
- `Socket_Closed` - Connexion fermée par le pair
- `SocketUnix_Failed` - Échec d'opération socket Unix
- `SocketDgram_Failed` - Échec d'opération socket UDP
- `SocketPoll_Failed` - Échec de scrutation d'événements
- `SocketPool_Failed` - Échec d'opération du pool de connexions
- `SocketDNS_Failed` - Échec de résolution DNS
- `SocketTimer_Failed` - Échec d'opération de minuterie
- `SocketRateLimit_Failed` - Échec du limiteur de débit
- `SocketRetry_Failed` - Échec de l'opération de nouvelle tentative
- `SocketAsync_Failed` - Échec d'E/S asynchrone
- `SocketCrypto_Failed` - Échec d'opération cryptographique

### Exceptions de connexion
- `SocketHE_Failed` - Échec de connexion Happy Eyeballs
- `SocketReconnect_Failed` - Échec de l'opération de reconnexion
- `SocketProxy_Failed` - Échec de connexion proxy

### Exceptions TLS/DTLS
- `SocketTLS_Failed` - Échec général d'opération TLS
- `SocketTLS_HandshakeFailed` - Échec de la poignée de main TLS
- `SocketTLS_VerifyFailed` - Échec de vérification du certificat
- `SocketTLS_ProtocolError` - Erreur de protocole TLS
- `SocketTLS_ShutdownFailed` - Échec de l'arrêt TLS
- `SocketTLS_PinVerifyFailed` - Échec de l'épinglage de certificat
- `SocketDTLS_Failed` - Échec général d'opération DTLS
- `SocketDTLS_HandshakeFailed` - Échec de la poignée de main DTLS
- `SocketDTLS_VerifyFailed` - Échec de vérification du certificat DTLS
- `SocketDTLS_CookieFailed` - Échec de l'échange de cookie DTLS
- `SocketDTLS_TimeoutExpired` - Délai d'attente de la poignée de main DTLS
- `SocketDTLS_ShutdownFailed` - Échec de l'arrêt DTLS

### Exceptions HTTP
- `SocketHTTP_ParseError` - Erreur d'analyse HTTP
- `SocketHTTP_InvalidURI` - URI invalide
- `SocketHTTP_InvalidHeader` - En-tête invalide
- `SocketHTTP1_ParseError` - Erreur d'analyse HTTP/1.1
- `SocketHPACK_Failed` - Erreur de compression HPACK
- `SocketHTTP2_ProtocolError` - Erreur de protocole HTTP/2
- `SocketHTTP2_StreamError` - Erreur de flux HTTP/2
- `SocketHTTP2_FlowControlError` - Erreur de contrôle de flux HTTP/2
- `SocketHTTPClient_Failed` - Échec du client HTTP
- `SocketHTTPClient_Timeout` - Délai d'attente du client HTTP
- `SocketHTTPClient_TLSFailed` - Erreur TLS du client HTTP
- `SocketHTTPClient_DNSFailed` - Échec DNS du client HTTP
- `SocketHTTPClient_ConnectFailed` - Échec de connexion du client HTTP
- `SocketHTTPClient_ProtocolError` - Erreur de protocole du client HTTP
- `SocketHTTPClient_TooManyRedirects` - Trop de redirections
- `SocketHTTPClient_ResponseTooLarge` - Taille de réponse maximale dépassée
- `SocketHTTPServer_Failed` - Échec du serveur HTTP

### Exceptions WebSocket
- `SocketWS_Failed` - Échec d'opération WebSocket
- `SocketWS_ProtocolError` - Erreur de protocole WebSocket
- `SocketWS_Closed` - Connexion WebSocket fermée

### Exceptions de sécurité
- `SocketSYNProtect_Failed` - Échec de la protection SYN

## Licence

Voir `LICENSE` pour les détails d'utilisation.
Télécharger l’outil
FonctionnalitéLinuxBSD/macOSRepli
Interrogation d'événementsepollkqueuepoll(2)
E/S asynchronesio_uring (5.1+)kqueue AIOdéclenché par front
TCP Fast Open3.7+10.0+/10.11+désactivé
Contrôle de congestionconfigurable--
Identifiants de pairSO_PEERCREDLOCAL_PEERCRED-
Protection SYNTCP_DEFER_ACCEPTSO_ACCEPTFILTERespace utilisateur
  • DNS : SocketDNS (DNS asynchrone avec threads de travail), SocketDNSoverTLS, SocketDNSoverHTTPS, SocketDNSSEC
  • Système d'événements : SocketPoll (abstraction epoll/kqueue/poll), SocketAsync (Intégration E/S asynchrone)
  • Assistants de connexion : SocketHappyEyeballs (RFC 8305), SocketReconnect (Reconnexion automatique), SocketProxy (HTTP CONNECT, SOCKS4/5)
  • Sécurité : SocketSYNProtect (Protection contre les inondations SYN), SocketIPTracker (Limites par IP)
  • Application : SocketPool (Gestion des connexions)
  • TLS : SocketTLS (E/S TLS), SocketTLSContext (Gestion du contexte), SocketDTLS, SocketDTLSContext
  • HTTP : SocketHTTP, SocketHTTP1, SocketHPACK, SocketHTTP2, SocketHTTPClient, SocketHTTPServer
  • WebSocket : SocketWS (RFC 6455 avec permessage-deflate)
  • QUIC : SocketQUICConnection, SocketQUICStream, SocketQUICPacket, SocketQUICHandshake, SocketQUICLoss
  • API simple : SocketSimple (Wrappers basés sur les codes retour pour tous les modules - pas besoin de TRY/EXCEPT)
  • ComposantSécurité des threadsRemarques
    Opérations SocketPar socketUn thread par socket recommandé
    Rapport d'erreursThread-localSûr pour une utilisation concurrente
    SocketPollThread-safeProtégé par des mutex
    SocketPoolThread-safeProtégé par des mutex
    SocketDNSThread-safeUtilise un pool de threads
    SocketTimerThread-safeIntégré avec poll
    SocketRateLimitThread-safeMutex interne
    SocketRetryNon thread-safeUne instance par thread
    Métriques/JournalisationThread-safeOpérations atomiques
    SocketCryptoThread-safePas d'état global
    SocketUTF8Thread-safePas d'état global
    SocketHappyEyeballsNon thread-safeUne instance par thread
    SocketReconnectNon thread-safeUne instance par thread
    SocketProxyNon thread-safeUne instance par thread
    SocketWSNon thread-safeUne instance par thread
    SocketSYNProtectThread-safeMutex interne pour les changements d'état
    Connexions HTTP/2Non thread-safeUne instance par thread
    Client HTTPThread-safeLes instances de requête ne le sont pas
    Serveur HTTPNon thread-safeUne instance par thread
    Contextes TLS/DTLSThread-safeLecture seule après configuration ; cache de session protégé par mutex
    Sockets TLS/DTLSPar socketUn thread par socket TLS
    TLSBufferPoolThread-safeMutex interne