網絡卡驅動學習之netlink
阿新 • • 發佈：2019-02-14
Netlink is a socket family that for IPC between the kernel and user space processes, as well as between user processes (like e.g., UNIX sockets) or a mixture of both types. However, unlike INET sockets, it cannot traverse host boundaries,
as it addresses processes by their (inherently local) PIDs.
Netlink was designed for and is used to transfer miscellaneous networking information between the Linux kernel space and user space processes. Networking utilities such as iproute2 use Netlink to communicate with the Linux kernel from user space. Netlink consists of a standard socket-based interface for user space processes and an internal kernel API for kernel modules. It is designed to be a more flexible successor to ioctl. Originally, Netlink used the AF_NETLINK socket family.
RFC 3549 describes this protocol in detail.
Contents [show]
[edit]History
Netlink was created as a more flexible alternative to the sophisticated and awkward ioctl communication method which was used for setting and getting external socket options. ioctl is still supported by the Linux kernel, for backward compatibility. It can be used as follows:
error = ioctl(ip_socket, ioctl_type, &value_result);
Netlink was first provided in Linux 2.0 as a character device. This interface is obsolete, but as an ioctl communication method, it can still be used. The Netlink socket interface appeared in the 2.2 Linux kernel.
[edit]Packet structure
Unlike the BSD socket access to Internet protocols such as TCP where the headers specifying flags and destination are autogenerated, the Netlink message header (available as struct nlmsghdr) must be prepared by the caller, as the socket generally works in a SOCK_RAW-like mode, even if SOCK_DGRAM was used to create it.
bit offset0–1516-31
0Message length
32Type Flags
64Sequence number
96PID
128+
Data
The data portion then contains a subsystem-specific message that may be further nested.
[edit]Netlink Socket Families
The AF_NETLINK family offers multiple protocol subsets. Each interfaces to a different kernel component and has a different messaging subset. The following protocol is referenced in the field below:
int socket(AF_NETLINK, SOCK_DGRAM or SOCK_RAW, protocol)
Lacking a standard, SOCK_DGRAM and SOCK_RAW are not guaranteed to be implemented in a given Linux (or other OS) release. Some sources state that both options are legitimate, and the reference below from Red Hat states that SOCK_RAW is always the parameter, however iproute2 uses both interchangeably.
[edit]Netlink Protocols
A non-exhaustive list of the supported protocol entries follows:
NETLINK_ROUTE
NETLINK_ROUTE provides routing and link information. This information is used primarily for user-space routing daemons. Linux implements a large subset of messages:
Link Layer: RTM_NEWLINK, RTM_DELLINK, RTM_GETLINK, RTM_SETLINK
Address Settings: RTM_NEWADDR, RTM_DELADDR, RTM_GETADDR
Routing Tables: RTM_NEWROUTE, RTM_DELROUTE, RTM_GETROUTE
Neighbor Cache: RTM_NEWNEIGH, RTM_DELNEIGH, RTM_GETNEIGH
Routing Rules: RTM_NEWRULE, RTM_DELRULE, RTM_GETRULE
Queuing Discipline Settings: RTM_NEWQDISC, RTM_DELQDISC, RTM_GETQDISC
Traffic Classes used with Queues: RTM_NEWTCLASS, RTM_DELTCLASS, RTM_GETTCLASS
Traffic filters: RTM_NEWTFILTER, RTM_DELTFILTER, RTM_GETTFILTER
Others: RTM_NEWACTION, RTM_DELACTION, RTM_GETACTION, RTM_NEWPREFIX, RTM_GETPREFIX, RTM_GETMULTICAST, RTM_GETANYCAST, RTM_NEWNEIGHTBL,RTM_GETNEIGHTBL, RTM_SETNEIGHTBL
NETLINK_FIREWALL
NETLINK_FIREWALL provides an interface for a user-space app to receive packets from the firewall.
NETLINK_NFLOG
NETLINK_NFLOG provides an interface used to communicate between used Netfilter and iptables.
NETLINK_ARPD
NETLINK_ARPD provides an interface to manage the ARP table from user space.
NETLINK_AUDIT
NETLINK_AUDIT provides an interface to the audit subsystem found in kernel versions 2.6.6 and later.
NETLINK_IPV6_FW
NETLINK_IPV6_FW provides an interface to transport packets from netfilter to userspace.
NETLINK_ROUTE6
NETLINK_TAPBASE
NETLINK_TCPDIAG
NETLINK_XFRM
NETLINK_XFRM provides an interface to manage the IPsec security association and security policy databases. It is mostly used by Key Manager daemons when they are used in Internet Key Exchange protocol.
[edit]User-defined Netlink protocol
The user can add a netlink handler in their own kernel routines. This allows additional Netlink protocols to be developed to address new kernel modules.[1]
Netlink was designed for and is used to transfer miscellaneous networking information between the Linux kernel space and user space processes. Networking utilities such as iproute2 use Netlink to communicate with the Linux kernel from user space. Netlink consists of a standard socket-based interface for user space processes and an internal kernel API for kernel modules. It is designed to be a more flexible successor to ioctl. Originally, Netlink used the AF_NETLINK socket family.
RFC 3549 describes this protocol in detail.
Contents [show]
[edit]History
Netlink was created as a more flexible alternative to the sophisticated and awkward ioctl communication method which was used for setting and getting external socket options. ioctl is still supported by the Linux kernel, for backward compatibility. It can be used as follows:
error = ioctl(ip_socket, ioctl_type, &value_result);
Netlink was first provided in Linux 2.0 as a character device. This interface is obsolete, but as an ioctl communication method, it can still be used. The Netlink socket interface appeared in the 2.2 Linux kernel.
[edit]Packet structure
Unlike the BSD socket access to Internet protocols such as TCP where the headers specifying flags and destination are autogenerated, the Netlink message header (available as struct nlmsghdr) must be prepared by the caller, as the socket generally works in a SOCK_RAW-like mode, even if SOCK_DGRAM was used to create it.
bit offset0–1516-31
0Message length
32Type Flags
64Sequence number
96PID
128+
Data
The data portion then contains a subsystem-specific message that may be further nested.
[edit]Netlink Socket Families
The AF_NETLINK family offers multiple protocol subsets. Each interfaces to a different kernel component and has a different messaging subset. The following protocol is referenced in the field below:
int socket(AF_NETLINK, SOCK_DGRAM or SOCK_RAW, protocol)
Lacking a standard, SOCK_DGRAM and SOCK_RAW are not guaranteed to be implemented in a given Linux (or other OS) release. Some sources state that both options are legitimate, and the reference below from Red Hat states that SOCK_RAW is always the parameter, however iproute2 uses both interchangeably.
[edit]Netlink Protocols
A non-exhaustive list of the supported protocol entries follows:
NETLINK_ROUTE
NETLINK_ROUTE provides routing and link information. This information is used primarily for user-space routing daemons. Linux implements a large subset of messages:
Link Layer: RTM_NEWLINK, RTM_DELLINK, RTM_GETLINK, RTM_SETLINK
Address Settings: RTM_NEWADDR, RTM_DELADDR, RTM_GETADDR
Routing Tables: RTM_NEWROUTE, RTM_DELROUTE, RTM_GETROUTE
Neighbor Cache: RTM_NEWNEIGH, RTM_DELNEIGH, RTM_GETNEIGH
Routing Rules: RTM_NEWRULE, RTM_DELRULE, RTM_GETRULE
Queuing Discipline Settings: RTM_NEWQDISC, RTM_DELQDISC, RTM_GETQDISC
Traffic Classes used with Queues: RTM_NEWTCLASS, RTM_DELTCLASS, RTM_GETTCLASS
Traffic filters: RTM_NEWTFILTER, RTM_DELTFILTER, RTM_GETTFILTER
Others: RTM_NEWACTION, RTM_DELACTION, RTM_GETACTION, RTM_NEWPREFIX, RTM_GETPREFIX, RTM_GETMULTICAST, RTM_GETANYCAST, RTM_NEWNEIGHTBL,RTM_GETNEIGHTBL, RTM_SETNEIGHTBL
NETLINK_FIREWALL
NETLINK_FIREWALL provides an interface for a user-space app to receive packets from the firewall.
NETLINK_NFLOG
NETLINK_NFLOG provides an interface used to communicate between used Netfilter and iptables.
NETLINK_ARPD
NETLINK_ARPD provides an interface to manage the ARP table from user space.
NETLINK_AUDIT
NETLINK_AUDIT provides an interface to the audit subsystem found in kernel versions 2.6.6 and later.
NETLINK_IPV6_FW
NETLINK_IPV6_FW provides an interface to transport packets from netfilter to userspace.
NETLINK_ROUTE6
NETLINK_TAPBASE
NETLINK_TCPDIAG
NETLINK_XFRM
NETLINK_XFRM provides an interface to manage the IPsec security association and security policy databases. It is mostly used by Key Manager daemons when they are used in Internet Key Exchange protocol.
[edit]User-defined Netlink protocol
The user can add a netlink handler in their own kernel routines. This allows additional Netlink protocols to be developed to address new kernel modules.[1]