View source for Netlink

Netlink sockets (PF_NETLINK) are a mechanism within Linux to retrieve and manage various aspects of the networking stacks -- they are a Linux-specific extension to the Berkeley Sockets model, and should not be used in portable programs. The information available via netlink sockets was previously available to userspace, if at all, via a collection of <tt>ioctl(2)</tt>s and a grabbag of <tt>get*(2)</tt> custom-purpose system calls; the majority of these are obsoleted by netlink sockets, but still implemented for backwards compatability. [http://www.faqs.org/rfcs/rfc3549.html RFC 3549] provides a snapshot current as of kernel 2.4.6; the netlink socket interface, however, is prone to change. That doesn't affect RFC 3549 as much as one might think, as it really has nothing to do with the netlink programming model; I suspect it to be a joke Andi Kleen perpetrated knowing that W. Richard Stevens wasn't around to call him out on it anymore.

The <tt>netlink(3)</tt> man page includes the following text:
<pre>NOTES
       It is often better to use netlink via libnetlink than via the low-level
       kernel interface.</pre>It has been this author's experience that this is untrue; the cold hard reality is that just about anything involving netlink sockets is bound to be unpleasant, usually in the extreme, and libnetlink won't improve things in the slightest. [[libdank]] has grown a capable netlink module over the years, and I would advise its use.

==Netlink Families==
As in the third argument to <tt>socket(2)</tt>; the full and current list of families can be had at your local <tt>netlink(7)</tt> man page. Here's the important ones:
* <tt>NETLINK_ROUTE</tt> — pretty much everything corresponding to <tt>ip(8)</tt>, also known as <tt>iproute</tt>, including:
** <tt>RTM_NEWLINK, RTM_DELLINK, RTM_GETLINK</tt> — device tables (ifinfomsg and rtattr structs) (see <tt>netdevice(7)</tt>)
** <tt>RTM_NEWADDR, RTM_DELADDR, RTM_GETADDR</tt> — address tables (ifaddrmsg and rtattr structs)
** <tt>RTM_NEWROUTE, RTM_DELROUTE, RTM_GETROUTE</tt> — routing tables (rtmsg and rtattr structs)
** <tt>RTM_NEWNEIGH, RTM_DELNEIGH, RTM_GETNEIGH</tt> — neighbor ([[ARP]], for [[IPv4]]) tables (ndmsg structs)
** <tt>RTM_NEWRULE, RTM_DELRULE, RTM_GETRULE</tt> — rule tables for advanced routing (rtmsg structs)
** See <tt>rtnetlink(7)</tt> for more info
* <tt>NETLINK_SOCK_DIAG</tt> — socket snapshots, as used by <tt>ss(8)</tt>
** Aliased as <tt>NETLINK_INET_DIAG</tt>
** This can only generate snapshots (it was originally added to assist checkpointing). It cannot be subscribed to for streaming events.
* <tt>NETLINK_NFLOG</tt> — [[iptables]] replacement for <tt>NETLINK_QUEUE</tt> since 2.6.14
** Userspace provided by <tt>libnetfilter</tt>
** <tt>ss(8)</tt> uses this when invoked with <tt>-E</tt> to print events continuously
* <tt>NETLINK_QUEUE</tt> — '''obsolete''' [[iptables]] packet interface for userspace
** Used the <tt>ip_queue</tt> kernel module and the QUEUE target
** Userspace was provided the [https://en.wikipedia.org/wiki/Libipq libipq] wrapper library.

==Netlink Stupidity==
Each time I come into contact with a new piece of netlink or the code that uses it, I'm flabbergasted by the utter lack of design elegance or even basic good taste. [[Alexey Kuznetsov]], the primary author, is almost famous for getting the bits from one end of the wire to another in the most efficient and ugliest way possible (but I wouldn't try to write a better networking stack). PF_NETLINK and all it touches feels like someone took all the untyped, unsafe <tt>ioctl(2)</tt> layers, wrapped them up with some message queues, stuck them in an Eastern European hellhole and waited for NATO air power to solve the design problem.

The "Big Tent" approach to <tt>socket(2)</tt> (from <tt>netlink(7)</tt>):<pre>Netlink is a datagram-oriented service. Both SOCK_RAW and SOCK_DGRAM are valid values for socket_type. However, the netlink protocol does not distinguish between datagram and raw sockets.</pre>
Things like this all over the place (taken from ''misc/ss.c'' in the iproute source package):<pre>req.nlh.nlmsg_seq = 123456;</pre>

==See Also==
* Paul Moore's [https://lwn.net/Articles/208755/ Generic Netlink] document