Implement the I/O-safety traits for Socket and SockRef

[Thomasdezeeuw]

I've merged the commits from #324 into this one as is was missing the implementations for SockRef, the most important bit.

This implements:

• The AsFd and AsSocket traits for Socket.
• From and From for Socket.
• From for OwnedFd and OwnedSocket.

Replacing AsRawFd with AsFd and AsRawSocket with AsSocket for SockRef.

Closed #218.

[notgull]

Looks good to me! A more sound SockRef will be a boon to the ecosystem as a whole.

[Thomasdezeeuw]

Looks good to me! A more sound SockRef will be a boon to the ecosystem as a whole.

That (#218) certainly got me interested in the I/O safety traits.

[Darksonn]

You should be careful with this kind of blanket impl. This will prevent you from implementing From<&T> for any other type T even if T does not implement AsSocket. For example, the previous impl for S: AsRawSocket would prevent you from adding the S: AsSocket impl without the breaking change you're currently going through.

In particular, this prevents you from having From<&T> for any type that is AsRawSocket but isn't AsSocket.

The impl might still be a good idea — as long as you've thought about whether this is acceptable, then that sounds good to me.

[notgull]

Two justifications:

• The T: AsRawSocket bound is unsound. Replacing it with T: AsSocket makes it sound. It is okay to make breading changes if they are to fix unsoundness
• The bound mirrors the From<OwnedSocket> bound on Socket.

[Thomasdezeeuw]

You should be careful with this kind of blanket impl. This will prevent you from implementing From<&T> for any other type T even if T does not implement AsSocket. For example, the previous impl for S: AsRawSocket would prevent you from adding the S: AsSocket impl without the breaking change you're currently going through.

In particular, this prevents you from having From<&T> for any type that is AsRawSocket but isn't AsSocket.

I know, that's why I removed the original implementation.

The impl might still be a good idea — as long as you've thought about whether this is acceptable, then that sounds good to me.

The concern above is acceptable because this is the only sound way to create SockRef, AsRaw/AsSocket was exactly designed for this reason. SockRef is essentially a type BorrowedFd similar to what TcpStream is to a OwnedFd.

[Darksonn]

Currently your Socket::from_raw constructor does not guarantee this as it is still not marked unsafe.

[notgull]

Could this be ameliorated by adding an unsafe bound on from_raw?

[Thomasdezeeuw]

Currently your Socket::from_raw constructor does not guarantee this as it is still not marked unsafe.

As per the comment on the function:

socket2/src/socket.rs

Lines 80 to 85 in 057f6c2

	/// # Safety
	///
	/// The caller must ensure `raw` is a valid file descriptor/socket. NOTE:
	/// this should really be marked `unsafe`, but this being an internal
	/// function, often passed as mapping function, it's makes it very
	/// inconvenient to mark it as `unsafe`.

It should be marked as unsafe, but then it can be passed (easily) as a closure any more. So it should be an unsafe function, it's only not because it's an internal function.

But to be clear crate::Socket always holds a valid fd/socket, with the assumption that the OS will not return an invalid fd/socket (outside of errors of course). I also place to switch to std::os::unix::io::OwnedFd to take advantage of the layout optimisation.

[Darksonn]

Oh, I didn't actually notice that it was an internal function.

[Thomasdezeeuw]

@Darksonn you OK with the changes then?

[Darksonn]

Yes.