Stream: git-wasmtime

Topic: wasmtime / PR #13936 Disallow TCP/UDP socket creation by ...

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:05):

alexcrichton opened PR #13936 from alexcrichton:disallow-sockets to bytecodealliance:main:

Historically the wasmtime-wasi crate has allowed creation of TCP/UDP sockets by default, but disallowed addresses by default. This in theory denies all sockets by default but this is a bit of a brittle check and it feels more robust to me to just deny TCP/UDP entirely by default. Historical behavior is preserved in the CLI where -Sinherit-network auto-enables TCP/UDP to then get optionally shadowed by explicit -Stcp=n flags if specified.

<!--
Please make sure you include the following information:

• If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

• Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:05):

alexcrichton requested pchickey for a review on PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:05):

alexcrichton requested wasmtime-core-reviewers for a review on PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:05):

alexcrichton requested wasmtime-wasi-reviewers for a review on PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:05):

alexcrichton commented on PR #13936:

cc @badeend

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:07):

:thumbs_up: pchickey submitted PR review.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:07):

alexcrichton has enabled auto merge for PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:18):

alexcrichton updated PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:29):

alexcrichton added PR #13936 Disallow TCP/UDP socket creation by default to the merge queue.

Wasmtime GitHub notifications bot (Jul 22 2026 at 18:54):

github-merge-queue[bot] removed PR #13936 Disallow TCP/UDP socket creation by default from the merge queue.

Wasmtime GitHub notifications bot (Jul 22 2026 at 19:07):

alexcrichton updated PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 19:07):

alexcrichton has enabled auto merge for PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 19:17):

alexcrichton added PR #13936 Disallow TCP/UDP socket creation by default to the merge queue.

Wasmtime GitHub notifications bot (Jul 22 2026 at 19:42):

github-merge-queue[bot] removed PR #13936 Disallow TCP/UDP socket creation by default from the merge queue.

Wasmtime GitHub notifications bot (Jul 22 2026 at 20:10):

alexcrichton added PR #13936 Disallow TCP/UDP socket creation by default to the merge queue.

Wasmtime GitHub notifications bot (Jul 22 2026 at 20:14):

:thumbs_up: badeend submitted PR review:

Much less surprising default behavior :+1:

Wasmtime GitHub notifications bot (Jul 22 2026 at 20:14):

:speech_balloon: badeend created PR review comment:

Even though it is implicitly already there thanks to the default value of booleans, do you think it makes sense to throw in a quick test here to explicitly verify the desired behavior? Given the security aspect of it, and the fact that it already was "wrong" once before?

#[cfg(test)]
mod tests {
    #[test]
    fn no_access_by_default() {
        let d = AllowedNetworkUses::default();
        assert_eq!(d.ip_name_lookup, false);
        assert_eq!(d.udp, false);
        assert_eq!(d.tcp, false);
    }
}

Wasmtime GitHub notifications bot (Jul 22 2026 at 20:59):

:check: alexcrichton merged PR #13936.

Wasmtime GitHub notifications bot (Jul 22 2026 at 20:59):

alexcrichton removed PR #13936 Disallow TCP/UDP socket creation by default from the merge queue.

Last updated: Jul 29 2026 at 05:03 UTC