fix: add Drop for Capture, DGRAM SO_TYPE test, fix fd leak

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

host/src/lib.rs

@@ -2808,4 +2808,29 @@ mod tests {
         assert!(s.contains("\"error\""), "net_bind should be denied: {s}");
         assert!(s.contains("Permission denied"), "{s}");
     }
+
+    #[test]
+    fn net_getsockopt_returns_correct_type_for_dgram() {
+        let mut reg = ToolRegistry::new();
+        let policy = NetworkPolicy::AllowAll;
+        register_net_tools(&mut reg, &policy, None);
+
+        // Create a DGRAM socket (type=2).
+        let req = br#"{"name":"net_socket","args":{"family":2,"type":2}}"#;
+        let resp = std::str::from_utf8(&reg.dispatch(req)).unwrap().to_string();
+        let v: serde_json::Value = serde_json::from_str(&resp).unwrap();
+        let fd = v["result"]["fd"].as_u64().unwrap();
+
+        // Query SO_TYPE (level=1 SOL_SOCKET, optname=3 SO_TYPE).
+        let req =
+            format!(r#"{{"name":"net_getsockopt","args":{{"fd":{fd},"level":1,"optname":3}}}}"#);
+        let resp = std::str::from_utf8(&reg.dispatch(req.as_bytes()))
+            .unwrap()
+            .to_string();
+        let v: serde_json::Value = serde_json::from_str(&resp).unwrap();
+        assert_eq!(
+            v["result"]["value"], 2,
+            "SO_TYPE should return 2 (DGRAM), got: {resp}"
+        );
+    }
 }

host/src/stderr_capture.rs

@@ -8,7 +8,7 @@
 mod imp {
     use anyhow::Result;
     use nix::unistd;
-    use std::os::fd::{AsRawFd, FromRawFd, IntoRawFd, OwnedFd};
+    use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
     use std::path::Path;
     use std::sync::{Mutex, MutexGuard};
 
@@ -18,7 +18,7 @@ mod imp {
     static STDERR_LOCK: Mutex<()> = Mutex::new(());
 
     pub struct Capture {
-        original_stderr: OwnedFd,
+        original_stderr: Option<OwnedFd>,
         _guard: MutexGuard<'static, ()>,
     }
 
@@ -27,23 +27,34 @@ mod imp {
             let guard = STDERR_LOCK
                 .lock()
                 .unwrap_or_else(|poisoned| poisoned.into_inner());
-            let capture_fd = std::fs::File::create(path)?.into_raw_fd();
-            let original_stderr_raw = unistd::dup(2)?;
-            unistd::dup2(capture_fd, 2)?;
-            unistd::close(capture_fd)?;
-            let original_stderr = unsafe { OwnedFd::from_raw_fd(original_stderr_raw) };
+            let capture_file = std::fs::File::create(path)?;
+            let original_stderr =
+                OwnedFd::from(unistd::dup(2).map(|fd| unsafe { OwnedFd::from_raw_fd(fd) })?);
+            unistd::dup2(capture_file.as_raw_fd(), 2)?;
+            // capture_file dropped here — its OwnedFd closes the fd via RAII
             Ok(Self {
-                original_stderr,
+                original_stderr: Some(original_stderr),
                 _guard: guard,
             })
         }
 
         pub fn restore(self) -> Result<()> {
-            unistd::dup2(self.original_stderr.as_raw_fd(), 2)?;
-            // _guard is dropped here, releasing STDERR_LOCK
+            if let Some(ref fd) = self.original_stderr {
+                unistd::dup2(fd.as_raw_fd(), 2)?;
+            }
+            // Drop restores via Drop impl if restore() wasn't called,
+            // but explicit call lets caller handle errors.
             Ok(())
         }
     }
+
+    impl Drop for Capture {
+        fn drop(&mut self) {
+            if let Some(ref fd) = self.original_stderr.take() {
+                let _ = unistd::dup2(fd.as_raw_fd(), 2);
+            }
+        }
+    }
 }
 
 #[cfg(windows)]