||This article possibly contains original research. (January 2012)|
|Stable release||3.19 (8 February 2015[±])|
|Preview release||4.0-rc2 (3 March 2015[±])|
|Type||Application programming interface|
|License||GNU General Public License|
Netlink socket family is a Linux kernel interface used for inter-process communication (IPC) between the kernel and userspace processes, as well as between user processes in a way similar to the Unix domain sockets. However, unlike INET sockets, Netlink communication cannot traverse host boundaries because Netlink processes addresses by process identifiers (PIDs), which are inherently local.
Netlink is designed and used for transferring miscellaneous networking information between the kernel space and userspace processes. Networking utilities, such as the iproute2 family and the utilities used for configuring mac80211-based wireless drivers, use Netlink to communicate with the Linux kernel from userspace. Netlink provides a standard socket-based interface for userspace processes, and a kernel-side API for internal use by kernel modules. Originally, Netlink used the AF_NETLINK socket family.
Netlink was created by Alexey Kuznetsov as a more flexible alternative to the sophisticated but awkward
ioctl communication method which software used for setting and getting external socket options. The Linux kernel continues to support
ioctl for backward compatibility. It can be used as follows:
error = ioctl(ip_socket, ioctl_type, &value_result);
Netlink was first provided in the 2.0 series of the Linux kernel, implemented as a character device. By 2013, this interface is obsolete, but still forms an ioctl communication method; compare the use of
rtnetlink. The Netlink socket interface appeared in 2.2 series of the Linux kernel.
Unlike the BSD socket access to Internet protocols such as TCP where the headers specifying flags and destination are autogenerated, the Netlink message header (available as struct nlmsghdr) must be prepared by the caller, because the socket generally works in a SOCK_RAW-like mode, even if SOCK_DGRAM was used to create it.
The data portion then contains a subsystem-specific message that may be further nested.
The AF_NETLINK family offers multiple protocol subsets. Each interfaces to a different kernel component and has a different messaging subset. The following protocol is referenced in the field below:
int socket(AF_NETLINK, SOCK_DGRAM or SOCK_RAW, protocol)
Lacking a standard, SOCK_DGRAM and SOCK_RAW are not guaranteed to be implemented in a given Linux (or other OS) release. Some sources state that both options are legitimate, and the reference below from Red Hat states that SOCK_RAW is always the parameter, however iproute2 uses both interchangeably.
A non-exhaustive list of the supported protocol entries follows:
NETLINK_ROUTE provides routing and link information. This information is used primarily for user-space routing daemons. Linux implements a large subset of messages:
- Link layer: RTM_NEWLINK, RTM_DELLINK, RTM_GETLINK, RTM_SETLINK
- Address settings: RTM_NEWADDR, RTM_DELADDR, RTM_GETADDR
- Routing tables: RTM_NEWROUTE, RTM_DELROUTE, RTM_GETROUTE
- Neighbor cache: RTM_NEWNEIGH, RTM_DELNEIGH, RTM_GETNEIGH
- Routing rules: RTM_NEWRULE, RTM_DELRULE, RTM_GETRULE
- Queuing discipline settings: RTM_NEWQDISC, RTM_DELQDISC, RTM_GETQDISC
- Traffic classes used with queues: RTM_NEWTCLASS, RTM_DELTCLASS, RTM_GETTCLASS
- Traffic filters: RTM_NEWTFILTER, RTM_DELTFILTER, RTM_GETTFILTER
- Others: RTM_NEWACTION, RTM_DELACTION, RTM_GETACTION, RTM_NEWPREFIX, RTM_GETPREFIX, RTM_GETMULTICAST, RTM_GETANYCAST, RTM_NEWNEIGHTBL, RTM_GETNEIGHTBL, RTM_SETNEIGHTBL
NETLINK_FIREWALL provides an interface for a user-space app to receive packets from the firewall.
NETLINK_ARPD provides an interface to manage the ARP table from user-space.
NETLINK_AUDIT provides an interface to the audit subsystem found in Linux kernel versions 2.6.6 and later.
NETLINK_IPV6_FW provides an interface to transport packets from netfilter to user-space.
Users can add a Netlink handler in their own kernel routines. This allows the development of additional Netlink protocols to address new kernel modules.
- Comparison of open-source wireless drivers – mac80211-based drivers rely on netlink as the API to user space
- Torvalds, Linus (8 February 2015). "Linux 3.19 - and merge window now open". Linux kernel (Mailing list). Retrieved 10 February 2015.
- Torvalds, Linus (3 March 2015). "Linux 4.0-rc2". Linux kernel (Mailing list). Retrieved 3 March 2015.
- "kernel/git/torvalds/linux.git: root/net/core/rtnetlink.c". Linux kernel source tree. kernel.org. Retrieved 2014-05-27.
- Crowcroft, Jon; Phillips, Iain, eds. (2002). TCP/IP and Linux protocol implementation: systems code for the Linux Internet. Wiley Networking Council series. Wiley. p. 624. ISBN 9780471408826. Retrieved 2013-05-21.
All rtnetlink messages consist of a netlink message header and appended attributes.
- Why and How to Use Netlink Sockets
- Pablo Neira Ayuso, Rafael M. Gasca, Laurent Lefèvre. Communicating between the kernel and user-space in Linux using Netlink sockets. Software: Practice and Experience, 40(9):797-810, August 2010
- Why and How to Use Netlink Sockets
- RFC 3549
- http://netfilter.org/projects/libmnl — “Minimalist Library for Netlink” — userspace library for construction and parsing of Netlink messages
- http://www.infradead.org/~tgr/libnl = "Netlink Protocol Library Suite" - full functional library covering almost all aspects of working with netlink sockets
- Manipulating the Networking Environment Using RTNETLINK
- Netlink Sockets – An Overview
- Netlink Protocol Library Suite
- Communicating between the kernel and user-space in Linux using Netlink sockets
- "Linux Kernel Networking" by Rami Rosen, Apress 2013: Chapter 2, Netlink Sockets