starnix_core/vfs/socket/
socket_netlink.rs

1// Copyright 2022 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::security::{self, AuditLogger, AuditMessage, AuditRequest};
6use crate::vfs::socket::{SockOptValue, SocketDomain};
7use futures::channel::mpsc::{
8    UnboundedReceiver, UnboundedSender, {self},
9};
10use linux_uapi::{AUDIT_GET, NETLINK_GET_STRICT_CHK, audit_status};
11use netlink::messaging::{
12    AccessControl, MessageWithPermission, NetlinkContext, NetlinkMessageWithCreds, Permission,
13    Sender, UnparsedNetlinkMessage,
14};
15use netlink::multicast_groups::{
16    InvalidLegacyGroupsError, InvalidModernGroupError, LegacyGroups, ModernGroup,
17    NoMappingFromModernToLegacyGroupError, SingleLegacyGroup,
18};
19use netlink::protocol_family::NetlinkClient;
20use netlink::protocol_family::route::NetlinkRouteClient;
21use netlink::protocol_family::sock_diag::NetlinkSockDiagClient;
22use netlink::{NETLINK_LOG_TAG, NewClientError};
23use netlink_packet_core::{
24    ErrorMessage, NETLINK_HEADER_LEN, NLMSG_ERROR, NetlinkBuffer, NetlinkDeserializable,
25    NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
26};
27use netlink_packet_generic::message::EmptyDeserializeOptions as EmptyDeserializeGenlOptions;
28use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
29use netlink_packet_sock_diag::SockDiagRequest;
30use netlink_packet_sock_diag::message::EmptyDeserializeOptions as EmptyDeserializeSockDiagOptions;
31use netlink_packet_utils::{DecodeError, Emitable as _};
32use starnix_sync::{
33    AuditNetlinkClientAuditResponseLock, LockDepGuard, LockDepMutex, NetlinkSocketInnerLock,
34    UEventNetlinkSocketDeviceListenerKeyLock,
35};
36use std::io::Write;
37use std::marker::PhantomData;
38use std::num::{NonZeroI32, NonZeroU32};
39use std::sync::Arc;
40use zerocopy::{FromBytes, IntoBytes};
41
42use crate::device::kobject::{Device, UEventAction, UEventContext, flatten_uevent_properties};
43use crate::device::{DeviceListener, DeviceListenerKey};
44use crate::task::{CurrentTask, EventHandler, Kernel, WaitCanceler, WaitQueue, Waiter};
45use crate::vfs::buffers::{
46    AncillaryData, InputBuffer, Message, MessageQueue, MessageReadInfo, OutputBuffer,
47    UnixControlData, VecInputBuffer,
48};
49use crate::vfs::socket::{
50    GenericMessage, GenericNetlinkClientHandle, Socket, SocketAddress, SocketHandle,
51    SocketMessageFlags, SocketOps, SocketPeer, SocketShutdownFlags, SocketType,
52};
53use starnix_logging::{log_debug, log_error, log_warn, track_stub};
54use starnix_uapi::auth::{CAP_AUDIT_CONTROL, CAP_AUDIT_WRITE, CAP_NET_ADMIN, Credentials};
55use starnix_uapi::errors::Errno;
56use starnix_uapi::vfs::FdEvents;
57use starnix_uapi::{
58    AF_NETLINK, NETLINK_ADD_MEMBERSHIP, NETLINK_AUDIT, NETLINK_CONNECTOR, NETLINK_CRYPTO,
59    NETLINK_DNRTMSG, NETLINK_DROP_MEMBERSHIP, NETLINK_ECRYPTFS, NETLINK_FIB_LOOKUP,
60    NETLINK_FIREWALL, NETLINK_GENERIC, NETLINK_IP6_FW, NETLINK_ISCSI, NETLINK_KOBJECT_UEVENT,
61    NETLINK_NETFILTER, NETLINK_NFLOG, NETLINK_RDMA, NETLINK_ROUTE, NETLINK_SCSITRANSPORT,
62    NETLINK_SELINUX, NETLINK_SMC, NETLINK_SOCK_DIAG, NETLINK_USERSOCK, NETLINK_XFRM, NLM_F_MULTI,
63    NLMSG_DONE, SO_PASSCRED, SO_PROTOCOL, SO_RCVBUF, SO_RCVBUFFORCE, SO_SNDBUF, SO_SNDBUFFORCE,
64    SO_TIMESTAMP, SOL_SOCKET, errno, error, nlmsghdr, sockaddr_nl, socklen_t, ucred,
65};
66
67// From netlink/socket.go in gVisor.
68pub const SOCKET_MIN_SIZE: usize = 4 << 10;
69pub const SOCKET_DEFAULT_SIZE: usize = 16 * 1024;
70pub const SOCKET_MAX_SIZE: usize = 4 << 20;
71
72// From linux/socket.go in gVisor.
73const SOL_NETLINK: u32 = 270;
74
75pub fn new_netlink_socket(
76    kernel: &Arc<Kernel>,
77    socket_type: SocketType,
78    family: NetlinkFamily,
79) -> Result<Box<dyn SocketOps>, Errno> {
80    log_debug!(tag = NETLINK_LOG_TAG; "Creating {:?} Netlink Socket", family);
81    if socket_type != SocketType::Datagram && socket_type != SocketType::Raw {
82        return error!(ESOCKTNOSUPPORT);
83    }
84
85    let ops: Box<dyn SocketOps> = match family {
86        NetlinkFamily::KobjectUevent => Box::new(UEventNetlinkSocket::default()),
87        NetlinkFamily::Route => Box::new(new_route_socket(kernel)?),
88        NetlinkFamily::Generic => Box::new(GenericNetlinkSocket::new(kernel)?),
89        NetlinkFamily::SockDiag => Box::new(new_sock_diag_socket(kernel)?),
90        NetlinkFamily::Audit => Box::new(AuditNetlinkSocket::new(kernel)?),
91        NetlinkFamily::Nflog => {
92            let inner = Arc::new(NetlinkSocketInner::new(NetlinkFamily::Nflog).into());
93            Box::new(NflogNetlinkSocket::new(inner))
94        }
95        NetlinkFamily::Usersock
96        | NetlinkFamily::Firewall
97        | NetlinkFamily::Xfrm
98        | NetlinkFamily::Selinux
99        | NetlinkFamily::Iscsi
100        | NetlinkFamily::FibLookup
101        | NetlinkFamily::Connector
102        | NetlinkFamily::Netfilter
103        | NetlinkFamily::Ip6Fw
104        | NetlinkFamily::Dnrtmsg
105        | NetlinkFamily::Scsitransport
106        | NetlinkFamily::Ecryptfs
107        | NetlinkFamily::Rdma
108        | NetlinkFamily::Crypto
109        | NetlinkFamily::Smc => Box::new(StubbedNetlinkSocket::new(family)),
110        NetlinkFamily::Invalid => return error!(EINVAL),
111    };
112    Ok(ops)
113}
114
115#[derive(Default, Debug, Clone, PartialEq, Eq)]
116#[repr(C)]
117pub struct NetlinkAddress {
118    pid: u32,
119    groups: u32,
120}
121
122impl NetlinkAddress {
123    pub fn new(pid: u32, groups: u32) -> Self {
124        NetlinkAddress { pid, groups }
125    }
126
127    pub fn set_pid_if_zero(&mut self, pid: i32) {
128        if self.pid == 0 {
129            self.pid = pid as u32;
130        }
131    }
132
133    pub fn to_bytes(&self) -> Vec<u8> {
134        sockaddr_nl { nl_family: AF_NETLINK, nl_pid: self.pid, nl_pad: 0, nl_groups: self.groups }
135            .as_bytes()
136            .to_vec()
137    }
138}
139
140#[derive(Debug, Hash, Eq, PartialEq, Clone)]
141pub enum NetlinkFamily {
142    Invalid,
143    Route,
144    Usersock,
145    Firewall,
146    SockDiag,
147    Nflog,
148    Xfrm,
149    Selinux,
150    Iscsi,
151    Audit,
152    FibLookup,
153    Connector,
154    Netfilter,
155    Ip6Fw,
156    Dnrtmsg,
157    KobjectUevent,
158    Generic,
159    Scsitransport,
160    Ecryptfs,
161    Rdma,
162    Crypto,
163    Smc,
164}
165
166impl NetlinkFamily {
167    pub fn from_raw(family: u32) -> Self {
168        match family {
169            NETLINK_ROUTE => NetlinkFamily::Route,
170            NETLINK_USERSOCK => NetlinkFamily::Usersock,
171            NETLINK_FIREWALL => NetlinkFamily::Firewall,
172            NETLINK_SOCK_DIAG => NetlinkFamily::SockDiag,
173            NETLINK_NFLOG => NetlinkFamily::Nflog,
174            NETLINK_XFRM => NetlinkFamily::Xfrm,
175            NETLINK_SELINUX => NetlinkFamily::Selinux,
176            NETLINK_ISCSI => NetlinkFamily::Iscsi,
177            NETLINK_AUDIT => NetlinkFamily::Audit,
178            NETLINK_FIB_LOOKUP => NetlinkFamily::FibLookup,
179            NETLINK_CONNECTOR => NetlinkFamily::Connector,
180            NETLINK_NETFILTER => NetlinkFamily::Netfilter,
181            NETLINK_IP6_FW => NetlinkFamily::Ip6Fw,
182            NETLINK_DNRTMSG => NetlinkFamily::Dnrtmsg,
183            NETLINK_KOBJECT_UEVENT => NetlinkFamily::KobjectUevent,
184            NETLINK_GENERIC => NetlinkFamily::Generic,
185            NETLINK_SCSITRANSPORT => NetlinkFamily::Scsitransport,
186            NETLINK_ECRYPTFS => NetlinkFamily::Ecryptfs,
187            NETLINK_RDMA => NetlinkFamily::Rdma,
188            NETLINK_CRYPTO => NetlinkFamily::Crypto,
189            NETLINK_SMC => NetlinkFamily::Smc,
190            _ => NetlinkFamily::Invalid,
191        }
192    }
193
194    pub fn as_raw(&self) -> u32 {
195        match self {
196            NetlinkFamily::Route => NETLINK_ROUTE,
197            NetlinkFamily::KobjectUevent => NETLINK_KOBJECT_UEVENT,
198            NetlinkFamily::Audit => NETLINK_AUDIT,
199            _ => 0,
200        }
201    }
202}
203
204struct NetlinkSocketInner {
205    /// The specific type of netlink socket.
206    family: NetlinkFamily,
207
208    /// The [`MessageQueue`] that contains messages from netlink to the client.
209    receive_buffer: MessageQueue,
210
211    /// The socket's send buffer size. Note, This value is only used
212    /// to serve getsockopt calls for `SO_SNDBUF`. It does not yet enforce a
213    /// limit on the number of messages netlink will buffer from the client.
214    /// TODO(https://fxbug.dev/285880057): Limit the size of the send buffer.
215    send_buf_size: usize,
216
217    /// This queue will be notified on reads, writes, disconnects etc.
218    waiters: WaitQueue,
219
220    /// The address of this socket.
221    address: Option<NetlinkAddress>,
222
223    /// See SO_PASSCRED.
224    pub passcred: bool,
225
226    /// See SO_TIMESTAMP.
227    pub timestamp: bool,
228
229    /// See NETLINK_GET_STRICT_CHK.
230    pub strict_chk: bool,
231}
232
233impl NetlinkSocketInner {
234    fn new(family: NetlinkFamily) -> Self {
235        Self {
236            family,
237            receive_buffer: MessageQueue::new(SOCKET_DEFAULT_SIZE),
238            send_buf_size: SOCKET_DEFAULT_SIZE,
239            waiters: WaitQueue::default(),
240            address: None,
241            passcred: false,
242            timestamp: false,
243            strict_chk: false,
244        }
245    }
246
247    fn bind(
248        &mut self,
249        current_task: &CurrentTask,
250        socket_address: SocketAddress,
251    ) -> Result<(), Errno> {
252        if self.address.is_some() {
253            return error!(EINVAL);
254        }
255
256        let netlink_address = match socket_address {
257            SocketAddress::Netlink(mut netlink_address) => {
258                // TODO: Support distinct IDs for processes with multiple netlink sockets.
259                netlink_address.set_pid_if_zero(current_task.get_pid());
260                netlink_address
261            }
262            _ => return error!(EINVAL),
263        };
264
265        self.address = Some(netlink_address);
266        Ok(())
267    }
268
269    fn connect(&mut self, current_task: &CurrentTask, peer: SocketPeer) -> Result<(), Errno> {
270        let address = match peer {
271            SocketPeer::Address(address) => address,
272            _ => return error!(EINVAL),
273        };
274        // Connect is equivalent to bind, but error are ignored.
275        let _ = self.bind(current_task, address);
276        Ok(())
277    }
278
279    fn read_message(&mut self) -> Option<Message> {
280        let message = self.receive_buffer.read_message();
281        if message.is_some() {
282            self.waiters.notify_fd_events(FdEvents::POLLOUT);
283        }
284        message
285    }
286
287    fn read_datagram(
288        &mut self,
289        data: &mut dyn OutputBuffer,
290        flags: SocketMessageFlags,
291    ) -> Result<MessageReadInfo, Errno> {
292        let (mut info, has_message) = if flags.contains(SocketMessageFlags::PEEK) {
293            self.receive_buffer.peek_datagram(data)
294        } else {
295            self.receive_buffer.read_datagram(data)
296        }?;
297        if !has_message {
298            return error!(EAGAIN);
299        }
300
301        if self.passcred {
302            track_stub!(TODO("https://fxbug.dev/297373991"), "SCM_CREDENTIALS/SO_PASSCRED");
303            info.ancillary_data.push(AncillaryData::Unix(UnixControlData::unknown_creds()));
304        }
305
306        Ok(info)
307    }
308
309    fn write_to_queue(
310        &mut self,
311        data: &mut dyn InputBuffer,
312        address: Option<NetlinkAddress>,
313        ancillary_data: &mut Vec<AncillaryData>,
314    ) -> Result<usize, Errno> {
315        let socket_address = match address {
316            Some(addr) => Some(SocketAddress::Netlink(addr)),
317            None => self.address.as_ref().map(|addr| SocketAddress::Netlink(addr.clone())),
318        };
319        let bytes_written =
320            self.receive_buffer.write_datagram(data, socket_address, ancillary_data)?;
321        if bytes_written > 0 {
322            self.waiters.notify_fd_events(FdEvents::POLLIN);
323        }
324        Ok(bytes_written)
325    }
326
327    fn wait_async(
328        &mut self,
329        waiter: &Waiter,
330        events: FdEvents,
331        handler: EventHandler,
332    ) -> WaitCanceler {
333        self.waiters.wait_async_fd_events(waiter, events, handler)
334    }
335
336    fn query_events(&self) -> FdEvents {
337        self.receive_buffer.query_events()
338    }
339
340    fn getsockname(&self) -> Result<SocketAddress, Errno> {
341        match &self.address {
342            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
343            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
344        }
345    }
346
347    fn getpeername(&self) -> Result<SocketAddress, Errno> {
348        match &self.address {
349            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
350            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
351        }
352    }
353
354    fn getsockopt(&self, level: u32, optname: u32) -> Result<Vec<u8>, Errno> {
355        let opt_value = match level {
356            SOL_SOCKET => match optname {
357                SO_PASSCRED => (self.passcred as u32).as_bytes().to_vec(),
358                SO_TIMESTAMP => (self.timestamp as u32).as_bytes().to_vec(),
359                SO_SNDBUF => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
360                SO_RCVBUF => (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec(),
361                SO_SNDBUFFORCE => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
362                SO_RCVBUFFORCE => {
363                    (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec()
364                }
365                SO_PROTOCOL => self.family.as_raw().as_bytes().to_vec(),
366                _ => return error!(ENOSYS),
367            },
368            SOL_NETLINK => match optname {
369                NETLINK_GET_STRICT_CHK => (self.strict_chk as u32).as_bytes().to_vec(),
370                _ => return error!(ENOSYS),
371            },
372            _ => vec![],
373        };
374
375        Ok(opt_value)
376    }
377
378    fn setsockopt(
379        &mut self,
380        current_task: &CurrentTask,
381        level: u32,
382        optname: u32,
383        optval: SockOptValue,
384    ) -> Result<(), Errno> {
385        match level {
386            SOL_SOCKET => match optname {
387                SO_SNDBUF => {
388                    let requested_capacity: socklen_t = optval.read(current_task)?;
389                    // SO_SNDBUF doubles the requested capacity to leave space for bookkeeping.
390                    // See https://man7.org/linux/man-pages/man7/socket.7.html
391                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
392                    // TODO(https://fxbug.dev/322907334): Clamp to `wmem_max`.
393                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
394                    self.send_buf_size = capacity;
395                }
396                SO_SNDBUFFORCE => {
397                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
398                    let requested_capacity: socklen_t = optval.read(current_task)?;
399                    // SO_SNDBUFFORE doubles the requested capacity to leave space for bookkeeping.
400                    // See https://man7.org/linux/man-pages/man7/socket.7.html
401                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
402                    self.send_buf_size = capacity;
403                }
404                SO_RCVBUF => {
405                    let requested_capacity: socklen_t = optval.read(current_task)?;
406                    // SO_RCVBUF doubles the requested capacity to leave space for bookkeeping.
407                    // See https://man7.org/linux/man-pages/man7/socket.7.html
408                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
409                    // TODO(https://fxbug.dev/322906968): Clamp to `rmem_max`.
410                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
411                    self.receive_buffer.set_capacity(capacity)?;
412                }
413                SO_RCVBUFFORCE => {
414                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
415                    let requested_capacity: socklen_t = optval.read(current_task)?;
416                    // SO_RCVBUFFORE doubles the requested capacity to leave space for bookkeeping.
417                    // See https://man7.org/linux/man-pages/man7/socket.7.html
418                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
419                    self.receive_buffer.set_capacity(capacity)?;
420                }
421                SO_PASSCRED => {
422                    let passcred: u32 = optval.read(current_task)?;
423                    self.passcred = passcred != 0;
424                }
425                SO_TIMESTAMP => {
426                    let timestamp: u32 = optval.read(current_task)?;
427                    self.timestamp = timestamp != 0;
428                }
429                _ => return error!(ENOSYS),
430            },
431            SOL_NETLINK => match optname {
432                NETLINK_GET_STRICT_CHK => {
433                    let strict_chk: u32 = optval.read(current_task)?;
434                    self.strict_chk = strict_chk != 0;
435                }
436                _ => return error!(ENOSYS),
437            },
438            _ => return error!(ENOSYS),
439        }
440
441        Ok(())
442    }
443}
444
445struct NflogListener {
446    inner: std::sync::Weak<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
447}
448
449static NFLOG_LISTENERS: std::sync::LazyLock<std::sync::Mutex<Vec<NflogListener>>> =
450    std::sync::LazyLock::new(|| std::sync::Mutex::new(Vec::new()));
451
452struct NflogNetlinkSocket {
453    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
454}
455
456impl NflogNetlinkSocket {
457    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
458        NFLOG_LISTENERS.lock().unwrap().push(NflogListener { inner: Arc::downgrade(&inner) });
459        Self { inner }
460    }
461
462    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
463        self.inner.lock()
464    }
465}
466
467impl Drop for NflogNetlinkSocket {
468    fn drop(&mut self) {
469        let mut listeners = NFLOG_LISTENERS.lock().unwrap();
470        listeners.retain(|l| {
471            if let Some(arc) = l.inner.upgrade() { !Arc::ptr_eq(&arc, &self.inner) } else { false }
472        });
473    }
474}
475
476impl SocketOps for NflogNetlinkSocket {
477    fn connect(
478        &self,
479        _socket: &SocketHandle,
480        current_task: &CurrentTask,
481        peer: SocketPeer,
482    ) -> Result<(), Errno> {
483        self.lock().connect(current_task, peer)
484    }
485
486    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
487        error!(EOPNOTSUPP)
488    }
489
490    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
491        error!(EOPNOTSUPP)
492    }
493
494    fn bind(
495        &self,
496        _socket: &Socket,
497        current_task: &CurrentTask,
498        socket_address: SocketAddress,
499    ) -> Result<(), Errno> {
500        self.lock().bind(current_task, socket_address)
501    }
502
503    fn read(
504        &self,
505        _socket: &Socket,
506        _current_task: &CurrentTask,
507        data: &mut dyn OutputBuffer,
508        flags: SocketMessageFlags,
509    ) -> Result<MessageReadInfo, Errno> {
510        self.lock().read_datagram(data, flags)
511    }
512
513    fn write(
514        &self,
515        _socket: &Socket,
516        _current_task: &CurrentTask,
517        _data: &mut dyn InputBuffer,
518        _dest_address: &mut Option<SocketAddress>,
519        _ancillary_data: &mut Vec<AncillaryData>,
520    ) -> Result<usize, Errno> {
521        error!(EOPNOTSUPP)
522    }
523
524    fn wait_async(
525        &self,
526        _socket: &Socket,
527        _current_task: &CurrentTask,
528        waiter: &Waiter,
529        events: FdEvents,
530        handler: EventHandler,
531    ) -> WaitCanceler {
532        self.lock().wait_async(waiter, events, handler)
533    }
534
535    fn query_events(
536        &self,
537        _socket: &Socket,
538        _current_task: &CurrentTask,
539    ) -> Result<FdEvents, Errno> {
540        Ok(self.lock().query_events() & FdEvents::POLLIN)
541    }
542
543    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
544        Ok(())
545    }
546
547    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
548
549    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
550        self.lock().getsockname()
551    }
552
553    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
554        self.lock().getpeername()
555    }
556
557    fn getsockopt(
558        &self,
559        _socket: &Socket,
560        _current_task: &CurrentTask,
561        level: u32,
562        optname: u32,
563        _optlen: u32,
564    ) -> Result<Vec<u8>, Errno> {
565        self.lock().getsockopt(level, optname)
566    }
567
568    fn setsockopt(
569        &self,
570        _socket: &Socket,
571        current_task: &CurrentTask,
572        level: u32,
573        optname: u32,
574        optval: SockOptValue,
575    ) -> Result<(), Errno> {
576        self.lock().setsockopt(current_task, level, optname, optval)
577    }
578}
579
580fn write_attr(buf: &mut Vec<u8>, attr_type: u16, data: &[u8]) {
581    let len = 4 + data.len();
582    buf.extend_from_slice(&(len as u16).to_ne_bytes());
583    buf.extend_from_slice(&attr_type.to_ne_bytes());
584    buf.extend_from_slice(data);
585    let pad = (4 - (data.len() % 4)) % 4;
586    for _ in 0..pad {
587        buf.push(0);
588    }
589}
590
591pub fn send_fake_nflog_message(uid: u32) {
592    const NFNL_SUBSYS_ULOG: u16 = 4;
593    const NFULNL_MSG_PACKET: u8 = 0;
594    const LOCAL_NFLOG_PACKET: u16 = (NFNL_SUBSYS_ULOG << 8) | (NFULNL_MSG_PACKET as u16);
595    const NFULA_PAYLOAD: u16 = 9;
596    const NFULA_UID: u16 = 11;
597
598    let mut msg_body = vec![0u8; 4]; // 4 bytes of nfgenmsg header
599
600    // Write UID attribute
601    let uid_bytes = uid.to_be_bytes();
602    write_attr(&mut msg_body, NFULA_UID, &uid_bytes);
603
604    // Write PAYLOAD attribute (placeholder IPv4 header)
605    let mut ip_hdr = vec![0u8; 20];
606    ip_hdr[0] = 0x45; // Version 4, IHL 5
607    ip_hdr[12..16].copy_from_slice(&[127, 0, 0, 1]);
608    ip_hdr[16..20].copy_from_slice(&[8, 8, 8, 8]);
609    write_attr(&mut msg_body, NFULA_PAYLOAD, &ip_hdr);
610
611    // Construct nlmsghdr
612    let total_len = 16 + msg_body.len();
613    let mut packet = vec![];
614    packet.extend_from_slice(&(total_len as u32).to_ne_bytes());
615    packet.extend_from_slice(&LOCAL_NFLOG_PACKET.to_ne_bytes());
616    packet.extend_from_slice(&0u16.to_ne_bytes()); // flags
617    packet.extend_from_slice(&0u32.to_ne_bytes()); // seq
618    packet.extend_from_slice(&0u32.to_ne_bytes()); // pid
619    packet.extend_from_slice(&msg_body);
620
621    // Broadcast to all listeners
622    let listeners = NFLOG_LISTENERS.lock().unwrap();
623    let ancillary_data = AncillaryData::Unix(UnixControlData::Credentials(Default::default()));
624    let mut ancillary_data = vec![ancillary_data];
625
626    for listener in listeners.iter() {
627        if let Some(socket) = listener.inner.upgrade() {
628            let _ = socket.lock().write_to_queue(
629                &mut VecInputBuffer::new(&packet),
630                Some(NetlinkAddress { pid: 0, groups: 1 }),
631                &mut ancillary_data,
632            );
633        }
634    }
635}
636
637/// A fake Netlink socket that loops messages back to the client.
638///
639/// Used as a placeholder implementation for protocol families that lack a real
640/// implementation.
641struct StubbedNetlinkSocket {
642    inner: LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>,
643}
644
645impl StubbedNetlinkSocket {
646    pub fn new(family: NetlinkFamily) -> Self {
647        track_stub!(
648            TODO("https://fxbug.dev/278565021"),
649            format!("Creating StubbedNetlinkSocket: {:?}", family).as_str()
650        );
651        StubbedNetlinkSocket { inner: NetlinkSocketInner::new(family).into() }
652    }
653
654    /// Locks and returns the inner state of the Socket.
655    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
656        self.inner.lock()
657    }
658}
659
660impl SocketOps for StubbedNetlinkSocket {
661    fn connect(
662        &self,
663        _socket: &SocketHandle,
664        current_task: &CurrentTask,
665        peer: SocketPeer,
666    ) -> Result<(), Errno> {
667        self.lock().connect(current_task, peer)
668    }
669
670    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
671        error!(EOPNOTSUPP)
672    }
673
674    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
675        error!(EOPNOTSUPP)
676    }
677
678    fn bind(
679        &self,
680        _socket: &Socket,
681        current_task: &CurrentTask,
682        socket_address: SocketAddress,
683    ) -> Result<(), Errno> {
684        self.lock().bind(current_task, socket_address)
685    }
686
687    fn read(
688        &self,
689        _socket: &Socket,
690        _current_task: &CurrentTask,
691        data: &mut dyn OutputBuffer,
692        _flags: SocketMessageFlags,
693    ) -> Result<MessageReadInfo, Errno> {
694        let msg = self.lock().read_message();
695        match msg {
696            Some(message) => {
697                // Mark the message as complete and return it.
698                let (mut nl_msg, _) =
699                    nlmsghdr::read_from_prefix(&message.data).map_err(|_| errno!(EINVAL))?;
700                nl_msg.nlmsg_type = NLMSG_DONE as u16;
701                nl_msg.nlmsg_flags &= NLM_F_MULTI as u16;
702                let msg_bytes = nl_msg.as_bytes();
703                let bytes_read = data.write(msg_bytes)?;
704
705                let info = MessageReadInfo {
706                    bytes_read,
707                    message_length: msg_bytes.len(),
708                    address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
709                    ancillary_data: vec![],
710                };
711                Ok(info)
712            }
713            None => Ok(MessageReadInfo::default()),
714        }
715    }
716
717    fn write(
718        &self,
719        socket: &Socket,
720        current_task: &CurrentTask,
721        data: &mut dyn InputBuffer,
722        dest_address: &mut Option<SocketAddress>,
723        ancillary_data: &mut Vec<AncillaryData>,
724    ) -> Result<usize, Errno> {
725        let bytes = data.peek_all()?;
726        if let Ok((nl_msg, _)) = nlmsghdr::read_from_prefix(&bytes) {
727            security::check_netlink_send_access(current_task, socket, nl_msg.nlmsg_type)?;
728        }
729
730        let mut local_address = self.lock().address.clone();
731
732        let destination = match dest_address {
733            Some(SocketAddress::Netlink(addr)) => addr,
734            _ => match &mut local_address {
735                Some(addr) => addr,
736                _ => return Ok(data.drain()),
737            },
738        };
739
740        if destination.groups != 0 {
741            track_stub!(TODO("https://fxbug.dev/322874956"), "StubbedNetlinkSockets multicasting");
742            return Ok(data.drain());
743        }
744
745        self.lock().write_to_queue(data, Some(NetlinkAddress::default()), ancillary_data)
746    }
747
748    fn wait_async(
749        &self,
750        _socket: &Socket,
751        _current_task: &CurrentTask,
752        waiter: &Waiter,
753        events: FdEvents,
754        handler: EventHandler,
755    ) -> WaitCanceler {
756        self.lock().wait_async(waiter, events, handler)
757    }
758
759    fn query_events(
760        &self,
761        _socket: &Socket,
762        _current_task: &CurrentTask,
763    ) -> Result<FdEvents, Errno> {
764        Ok(self.lock().query_events() & FdEvents::POLLIN)
765    }
766
767    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
768        track_stub!(TODO("https://fxbug.dev/322875507"), "StubbedNetlinkSocket::shutdown");
769        Ok(())
770    }
771
772    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
773
774    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
775        self.lock().getsockname()
776    }
777
778    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
779        self.lock().getpeername()
780    }
781
782    fn getsockopt(
783        &self,
784        _socket: &Socket,
785        _current_task: &CurrentTask,
786        level: u32,
787        optname: u32,
788        _optlen: u32,
789    ) -> Result<Vec<u8>, Errno> {
790        self.lock().getsockopt(level, optname)
791    }
792
793    fn setsockopt(
794        &self,
795        _socket: &Socket,
796        current_task: &CurrentTask,
797        level: u32,
798        optname: u32,
799        optval: SockOptValue,
800    ) -> Result<(), Errno> {
801        self.lock().setsockopt(current_task, level, optname, optval)
802    }
803}
804
805/// Socket implementation for the NETLINK_KOBJECT_UEVENT family of netlink sockets.
806struct UEventNetlinkSocket {
807    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
808    device_listener_key:
809        LockDepMutex<Option<DeviceListenerKey>, UEventNetlinkSocketDeviceListenerKeyLock>,
810}
811
812impl Default for UEventNetlinkSocket {
813    #[allow(clippy::let_and_return)]
814    fn default() -> Self {
815        let result = Self {
816            inner: Arc::new(NetlinkSocketInner::new(NetlinkFamily::KobjectUevent).into()),
817            device_listener_key: Default::default(),
818        };
819        #[cfg(any(test, debug_assertions))]
820        {
821            let _l1 = result.device_listener_key.lock();
822            let _l2 = result.lock();
823        }
824        result
825    }
826}
827
828impl UEventNetlinkSocket {
829    /// Locks and returns the inner state of the Socket.
830    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
831        self.inner.lock()
832    }
833
834    fn register_listener(
835        &self,
836        current_task: &CurrentTask,
837        state: LockDepGuard<'_, NetlinkSocketInner>,
838    ) {
839        if state.address.is_none() {
840            return;
841        }
842        std::mem::drop(state);
843        let mut key_state = self.device_listener_key.lock();
844        if key_state.is_none() {
845            *key_state =
846                Some(current_task.kernel().device_registry.register_listener(self.inner.clone()));
847        }
848    }
849}
850
851impl SocketOps for UEventNetlinkSocket {
852    fn connect(
853        &self,
854        _socket: &SocketHandle,
855        current_task: &CurrentTask,
856        peer: SocketPeer,
857    ) -> Result<(), Errno> {
858        let mut state = self.lock();
859        state.connect(current_task, peer)?;
860        self.register_listener(current_task, state);
861        Ok(())
862    }
863
864    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
865        error!(EOPNOTSUPP)
866    }
867
868    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
869        error!(EOPNOTSUPP)
870    }
871
872    fn bind(
873        &self,
874        _socket: &Socket,
875        current_task: &CurrentTask,
876        socket_address: SocketAddress,
877    ) -> Result<(), Errno> {
878        let mut state = self.lock();
879        state.bind(current_task, socket_address)?;
880        self.register_listener(current_task, state);
881        Ok(())
882    }
883
884    fn read(
885        &self,
886        _socket: &Socket,
887        _current_task: &CurrentTask,
888        data: &mut dyn OutputBuffer,
889        flags: SocketMessageFlags,
890    ) -> Result<MessageReadInfo, Errno> {
891        self.lock().read_datagram(data, flags)
892    }
893
894    fn write(
895        &self,
896        _socket: &Socket,
897        _current_task: &CurrentTask,
898        _data: &mut dyn InputBuffer,
899        _dest_address: &mut Option<SocketAddress>,
900        _ancillary_data: &mut Vec<AncillaryData>,
901    ) -> Result<usize, Errno> {
902        error!(EOPNOTSUPP)
903    }
904
905    fn wait_async(
906        &self,
907        _socket: &Socket,
908        _current_task: &CurrentTask,
909        waiter: &Waiter,
910        events: FdEvents,
911        handler: EventHandler,
912    ) -> WaitCanceler {
913        self.lock().wait_async(waiter, events, handler)
914    }
915
916    fn query_events(
917        &self,
918        _socket: &Socket,
919        _current_task: &CurrentTask,
920    ) -> Result<FdEvents, Errno> {
921        Ok(self.lock().query_events() & FdEvents::POLLIN)
922    }
923
924    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
925        track_stub!(TODO("https://fxbug.dev/322875507"), "UEventNetlinkSocket::shutdown");
926        Ok(())
927    }
928
929    fn close(&self, current_task: &CurrentTask, _socket: &Socket) {
930        let id = self.device_listener_key.lock().take();
931        if let Some(id) = id {
932            current_task.kernel().device_registry.unregister_listener(&id);
933        }
934    }
935
936    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
937        self.lock().getsockname()
938    }
939
940    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
941        self.lock().getpeername()
942    }
943
944    fn getsockopt(
945        &self,
946        _socket: &Socket,
947        _current_task: &CurrentTask,
948        level: u32,
949        optname: u32,
950        _optlen: u32,
951    ) -> Result<Vec<u8>, Errno> {
952        self.lock().getsockopt(level, optname)
953    }
954
955    fn setsockopt(
956        &self,
957        _socket: &Socket,
958        current_task: &CurrentTask,
959        level: u32,
960        optname: u32,
961        optval: SockOptValue,
962    ) -> Result<(), Errno> {
963        self.lock().setsockopt(current_task, level, optname, optval)
964    }
965}
966
967impl DeviceListener for Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>> {
968    fn on_device_event(&self, action: UEventAction, device: Device, context: UEventContext) {
969        let path = device.path_from_depth(0);
970
971        let mut props = device.get_uevent_properties_list();
972
973        // Prepend ACTION and SEQNUM to maintain existing order
974        props.insert(0, (b"ACTION".into(), action.to_string().into()));
975        props.insert(1, (b"SEQNUM".into(), context.seqnum.to_string().into()));
976
977        let flattened = flatten_uevent_properties(props, '\0');
978
979        let mut message = vec![];
980        write!(&mut message, "{action}@/{path}\0", action = action, path = path).unwrap();
981        message.extend_from_slice(flattened.as_ref());
982
983        let ancillary_data = AncillaryData::Unix(UnixControlData::Credentials(Default::default()));
984        let mut ancillary_data = vec![ancillary_data];
985        // Ignore write errors
986        let _ = self.lock().write_to_queue(
987            &mut VecInputBuffer::new(&message),
988            Some(NetlinkAddress { pid: 0, groups: 1 }),
989            &mut ancillary_data,
990        );
991    }
992}
993
994/// Type for sending messages from [`netlink::Netlink`] to an individual socket.
995#[derive(Clone)]
996pub struct NetlinkToClientSender<M> {
997    /// The inner socket implementation, which holds a message queue.
998    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
999
1000    /// `PhantomData<fn(M) -> M>` is used instead of `PhantomData<M>` in order
1001    /// to ensure that the type is invariant over `M` and that it implements
1002    /// `Sync` even if `M` is not `Sync`.
1003    _message_type: PhantomData<fn(M) -> M>,
1004}
1005
1006impl<M> NetlinkToClientSender<M> {
1007    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
1008        NetlinkToClientSender { _message_type: Default::default(), inner }
1009    }
1010}
1011
1012impl<M: Clone + NetlinkSerializable + Send> Sender<M> for NetlinkToClientSender<M> {
1013    fn send(&mut self, message: NetlinkMessage<M>, group: Option<ModernGroup>) {
1014        // Serialize the message
1015        let mut buf = vec![0; message.buffer_len()];
1016        message.emit(&mut buf);
1017        let mut buf: VecInputBuffer = buf.into();
1018        // Write the message into the inner socket buffer.
1019        let NetlinkToClientSender { _message_type: _, inner } = self;
1020        let mut guard = inner.lock();
1021
1022        // To avoid dropping messages when the receive buffer is
1023        // full, grow the buffer on behalf of the client.
1024        // This is a stop gap measure to avoid dropping messages
1025        // when netlink produces a large response to a
1026        // NLM_F_DUMP request.
1027        //
1028        // TODO(https://fxbug.dev/459883760): The memory
1029        // implications of this may be problematic. It should be
1030        // replaced with a proper mechanism to handle a backlog
1031        // of NLM_F_DUMP responses.
1032        let available = guard.receive_buffer.available_capacity();
1033        let required = buf.available();
1034        if available < required {
1035            let delta = required - available;
1036            let current_capacity = guard.receive_buffer.capacity();
1037            let new_capacity = (current_capacity + delta).min(SOCKET_MAX_SIZE);
1038            match guard.receive_buffer.set_capacity(new_capacity) {
1039                Ok(()) => {}
1040                Err(e) => {
1041                    log_error!(
1042                        tag = NETLINK_LOG_TAG;
1043                        "Failed to increase receive buffer size: {:?}",
1044                        e
1045                    );
1046                }
1047            }
1048        }
1049
1050        let _bytes_written: usize = guard
1051            .write_to_queue(
1052                &mut buf,
1053                Some(NetlinkAddress {
1054                    // All messages come from the "kernel" which has PID of 0.
1055                    pid: 0,
1056                    // If this is a multicast message, set the group the multicast
1057                    // message is from.
1058                    groups: group
1059                        .map(SingleLegacyGroup::try_from)
1060                        .and_then(Result::<_, NoMappingFromModernToLegacyGroupError>::ok)
1061                        .map_or(0, |g| g.inner()),
1062                }),
1063                &mut Vec::new(),
1064            )
1065            .unwrap_or_else(|e| {
1066                log_error!(
1067                    tag = NETLINK_LOG_TAG;
1068                    "Failed to write message into buffer for socket. Errno: {:?}",
1069                    e
1070                );
1071                0
1072            });
1073    }
1074}
1075
1076#[derive(Clone)]
1077pub struct NetlinkAccessControl<'a> {
1078    current_task: &'a CurrentTask,
1079}
1080
1081impl<'a> NetlinkAccessControl<'a> {
1082    pub fn new(current_task: &'a CurrentTask) -> Self {
1083        Self { current_task }
1084    }
1085}
1086
1087impl<'a> AccessControl<Arc<Credentials>> for NetlinkAccessControl<'a> {
1088    fn grant_assess(
1089        &self,
1090        creds: &Arc<Credentials>,
1091        permission: Permission,
1092    ) -> Result<(), netlink::Errno> {
1093        let need_cap_net_admin = match permission {
1094            Permission::NetlinkRouteRead => false,
1095            Permission::NetlinkRouteWrite => true,
1096            Permission::NetlinkSockDiagRead => false,
1097            Permission::NetlinkSockDiagDestroy => true,
1098        };
1099        if !need_cap_net_admin {
1100            return Ok(());
1101        }
1102
1103        self.current_task.override_creds(creds.clone(), || {
1104            security::check_task_capable(self.current_task, CAP_NET_ADMIN).map_err(|error| {
1105                netlink::Errno::new(error.code.error_code() as i32)
1106                    .expect("Errno::error_code() is expected to be in range [1..max_i32]")
1107            })
1108        })
1109    }
1110}
1111pub struct NetlinkContextImpl;
1112
1113impl NetlinkContext for NetlinkContextImpl {
1114    type Creds = Arc<Credentials>;
1115    type Sender<M: Clone + NetlinkSerializable + Send> = NetlinkToClientSender<M>;
1116    type Receiver<
1117        M: Send + MessageWithPermission + NetlinkDeserializable<Error: Into<DecodeError>>,
1118    > = UnboundedReceiver<NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, M>, Self::Creds>>;
1119    type AccessControl<'a> = NetlinkAccessControl<'a>;
1120}
1121
1122fn new_route_socket(kernel: &Arc<Kernel>) -> Result<NetlinkSocket<NetlinkRouteClient>, Errno> {
1123    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Route)));
1124    let (message_sender, message_receiver) = mpsc::unbounded();
1125    let client = match kernel
1126        .network_netlink()
1127        .new_route_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1128    {
1129        Ok(client) => client,
1130        Err(NewClientError::Disconnected) => {
1131            log_error!(
1132                tag = NETLINK_LOG_TAG;
1133                "Netlink async worker is unexpectedly disconnected"
1134            );
1135            return error!(EPIPE);
1136        }
1137    };
1138    Ok(NetlinkSocket { inner, client, message_sender })
1139}
1140
1141fn new_sock_diag_socket(
1142    kernel: &Arc<Kernel>,
1143) -> Result<NetlinkSocket<NetlinkSockDiagClient>, Errno> {
1144    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::SockDiag)));
1145    let (message_sender, message_receiver) = mpsc::unbounded();
1146    let client = match kernel
1147        .network_netlink()
1148        .new_sock_diag_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1149    {
1150        Ok(client) => client,
1151        Err(NewClientError::Disconnected) => {
1152            log_error!(
1153                tag = NETLINK_LOG_TAG;
1154                "Netlink async worker is unexpectedly disconnected"
1155            );
1156            return error!(EPIPE);
1157        }
1158    };
1159    Ok(NetlinkSocket { inner, client, message_sender })
1160}
1161
1162/// An abstraction over common networking-specific netlink sockets.
1163struct NetlinkSocket<C: NetlinkClient> {
1164    /// The inner Netlink socket implementation
1165    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1166    /// The implementation of a client (socket connection) to a netlink protocol
1167    /// family.
1168    client: C,
1169    /// The sender of messages from this socket to Netlink.
1170    // TODO(https://issuetracker.google.com/285880057): Bound the capacity of
1171    // the "send buffer".
1172    message_sender: UnboundedSender<
1173        NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, C::Request>, Arc<Credentials>>,
1174    >,
1175}
1176
1177/// A type that provides Netlink message deserialization options.
1178trait DeserializeOptionsProvider {
1179    /// The type of the message to deserialize.
1180    type Message: NetlinkDeserializable;
1181    /// The options to use when deserializing a `Message`.
1182    fn options(&self) -> <Self::Message as NetlinkDeserializable>::DeserializeOptions;
1183}
1184
1185impl DeserializeOptionsProvider for NetlinkSocket<NetlinkRouteClient> {
1186    type Message = RouteNetlinkMessage;
1187    fn options(&self) -> RouteNetlinkMessageParseMode {
1188        let strict = self.inner.lock().strict_chk;
1189        if strict {
1190            RouteNetlinkMessageParseMode::Strict
1191        } else {
1192            RouteNetlinkMessageParseMode::Relaxed
1193        }
1194    }
1195}
1196
1197impl DeserializeOptionsProvider for NetlinkSocket<NetlinkSockDiagClient> {
1198    type Message = SockDiagRequest;
1199    fn options(&self) -> EmptyDeserializeSockDiagOptions {
1200        EmptyDeserializeSockDiagOptions
1201    }
1202}
1203
1204impl<C: NetlinkClient + 'static> SocketOps for NetlinkSocket<C>
1205where
1206    Self: DeserializeOptionsProvider<Message = C::Request>,
1207{
1208    fn connect(
1209        &self,
1210        _socket: &SocketHandle,
1211        current_task: &CurrentTask,
1212        peer: SocketPeer,
1213    ) -> Result<(), Errno> {
1214        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1215        inner.lock().connect(current_task, peer)
1216    }
1217
1218    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1219        error!(EOPNOTSUPP)
1220    }
1221
1222    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1223        error!(EOPNOTSUPP)
1224    }
1225
1226    fn bind(
1227        &self,
1228        _socket: &Socket,
1229        current_task: &CurrentTask,
1230        socket_address: SocketAddress,
1231    ) -> Result<(), Errno> {
1232        let NetlinkSocket { inner, client, message_sender: _ } = self;
1233
1234        let multicast_groups = match &socket_address {
1235            SocketAddress::Netlink(NetlinkAddress { pid: _, groups }) => *groups,
1236            _ => return error!(EINVAL),
1237        };
1238        let pid = {
1239            let mut inner = inner.lock();
1240            inner.bind(current_task, socket_address)?;
1241            inner
1242                .address
1243                .as_ref()
1244                .and_then(|NetlinkAddress { pid, groups: _ }| NonZeroU32::new(*pid))
1245        };
1246        if let Some(pid) = pid {
1247            client.set_pid(pid);
1248        }
1249        // This "blocks" in order to synchronize with the internal
1250        // state of the netlink worker, but we're not blocking on
1251        // the completion of any i/o or any expensive computation,
1252        // so there's no need to support interrupts here.
1253        client
1254            .set_legacy_memberships(LegacyGroups(multicast_groups))
1255            .map_err(|InvalidLegacyGroupsError {}| errno!(EPERM))?
1256            .wait_until_complete();
1257        Ok(())
1258    }
1259
1260    fn read(
1261        &self,
1262        _socket: &Socket,
1263        _current_task: &CurrentTask,
1264        data: &mut dyn OutputBuffer,
1265        flags: SocketMessageFlags,
1266    ) -> Result<MessageReadInfo, Errno> {
1267        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1268        inner.lock().read_datagram(data, flags)
1269    }
1270
1271    fn write(
1272        &self,
1273        socket: &Socket,
1274        current_task: &CurrentTask,
1275        data: &mut dyn InputBuffer,
1276        _dest_address: &mut Option<SocketAddress>,
1277        _ancillary_data: &mut Vec<AncillaryData>,
1278    ) -> Result<usize, Errno> {
1279        let NetlinkSocket { inner: _, client: _, message_sender } = self;
1280
1281        let bytes = data.peek_all()?;
1282        let bytes_len = bytes.len();
1283
1284        // Parse only the netlink header to send it through security check.
1285        match NetlinkBuffer::new(&bytes) {
1286            Ok(buffer) => {
1287                security::check_netlink_send_access(current_task, socket, buffer.message_type())?;
1288            }
1289            Err(e) => {
1290                // If we can't even decode the header of the netlink message,
1291                // then return early here as a stronger statement that we're not
1292                // going to accidentally operate on it and violate the security
1293                // check. The netlink crate would end up dropping this with no
1294                // response as well.
1295                log_warn!(tag = NETLINK_LOG_TAG;
1296                    "Failed to parse netlink header {e:?}"
1297                );
1298                data.drain();
1299                return Ok(bytes_len);
1300            }
1301        }
1302
1303        let msg = NetlinkMessageWithCreds::new(
1304            UnparsedNetlinkMessage::new(bytes, self.options()),
1305            current_task.current_creds().clone(),
1306        );
1307        message_sender.unbounded_send(msg).map_err(|e| {
1308            log_warn!(
1309                tag = NETLINK_LOG_TAG;
1310                "Netlink receiver unexpectedly disconnected for socket: {:?}",
1311                e
1312            );
1313            errno!(EPIPE)
1314        })?;
1315        data.drain();
1316        Ok(bytes_len)
1317    }
1318
1319    fn wait_async(
1320        &self,
1321        _socket: &Socket,
1322        _current_task: &CurrentTask,
1323        waiter: &Waiter,
1324        events: FdEvents,
1325        handler: EventHandler,
1326    ) -> WaitCanceler {
1327        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1328        inner.lock().wait_async(waiter, events, handler)
1329    }
1330
1331    fn query_events(
1332        &self,
1333        _socket: &Socket,
1334        _current_task: &CurrentTask,
1335    ) -> Result<FdEvents, Errno> {
1336        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1337        Ok(inner.lock().query_events() & FdEvents::POLLIN)
1338    }
1339
1340    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1341        error!(EOPNOTSUPP)
1342    }
1343
1344    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1345        // Close the underlying channel to the Netlink worker.
1346        self.message_sender.close_channel();
1347    }
1348
1349    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1350        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1351        inner.lock().getsockname()
1352    }
1353
1354    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1355        self.inner.lock().getpeername()
1356    }
1357
1358    fn getsockopt(
1359        &self,
1360        _socket: &Socket,
1361        _current_task: &CurrentTask,
1362        level: u32,
1363        optname: u32,
1364        _optlen: u32,
1365    ) -> Result<Vec<u8>, Errno> {
1366        self.inner.lock().getsockopt(level, optname)
1367    }
1368
1369    fn setsockopt(
1370        &self,
1371        _socket: &Socket,
1372        current_task: &CurrentTask,
1373        level: u32,
1374        optname: u32,
1375        optval: SockOptValue,
1376    ) -> Result<(), Errno> {
1377        match (level, optname) {
1378            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1379                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1380                let group: u32 = optval.read(current_task)?;
1381                let async_work = client
1382                    .add_membership(ModernGroup(group))
1383                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1384                // This "blocks" in order to synchronize with the internal
1385                // state of the rtnetlink worker, but we're not blocking on
1386                // the completion of any i/o or any expensive computation,
1387                // so there's no need to support interrupts here.
1388                async_work.wait_until_complete();
1389                Ok(())
1390            }
1391            (SOL_NETLINK, NETLINK_DROP_MEMBERSHIP) => {
1392                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1393                let group: u32 = optval.read(current_task)?;
1394                client
1395                    .del_membership(ModernGroup(group))
1396                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1397                Ok(())
1398            }
1399            _ => self.inner.lock().setsockopt(current_task, level, optname, optval),
1400        }
1401    }
1402}
1403
1404/// Socket implementation for the NETLINK_GENERIC family of netlink sockets.
1405struct GenericNetlinkSocket {
1406    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1407    client: GenericNetlinkClientHandle<NetlinkToClientSender<GenericMessage>>,
1408    message_sender: mpsc::UnboundedSender<NetlinkMessage<GenericMessage>>,
1409}
1410
1411impl GenericNetlinkSocket {
1412    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1413        let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Generic)));
1414        let (message_sender, message_receiver) = mpsc::unbounded();
1415        match kernel
1416            .generic_netlink()
1417            .new_generic_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1418        {
1419            Ok(client) => Ok(Self { inner, client, message_sender }),
1420            Err(e) => {
1421                log_warn!(
1422                    tag = NETLINK_LOG_TAG;
1423                    "Failed to connect to generic netlink server. Errno: {:?}",
1424                    e
1425                );
1426                error!(EPIPE)
1427            }
1428        }
1429    }
1430
1431    /// Locks and returns the inner state of the Socket.
1432    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
1433        self.inner.lock()
1434    }
1435}
1436
1437impl SocketOps for GenericNetlinkSocket {
1438    fn connect(
1439        &self,
1440        _socket: &SocketHandle,
1441        current_task: &CurrentTask,
1442        peer: SocketPeer,
1443    ) -> Result<(), Errno> {
1444        let mut state = self.lock();
1445        state.connect(current_task, peer)
1446    }
1447
1448    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1449        error!(EOPNOTSUPP)
1450    }
1451
1452    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1453        error!(EOPNOTSUPP)
1454    }
1455
1456    fn bind(
1457        &self,
1458        _socket: &Socket,
1459        current_task: &CurrentTask,
1460        socket_address: SocketAddress,
1461    ) -> Result<(), Errno> {
1462        let mut state = self.lock();
1463        state.bind(current_task, socket_address)
1464    }
1465
1466    fn read(
1467        &self,
1468        _socket: &Socket,
1469        _current_task: &CurrentTask,
1470        data: &mut dyn OutputBuffer,
1471        flags: SocketMessageFlags,
1472    ) -> Result<MessageReadInfo, Errno> {
1473        self.lock().read_datagram(data, flags)
1474    }
1475
1476    fn write(
1477        &self,
1478        socket: &Socket,
1479        current_task: &CurrentTask,
1480        data: &mut dyn InputBuffer,
1481        _dest_address: &mut Option<SocketAddress>,
1482        _ancillary_data: &mut Vec<AncillaryData>,
1483    ) -> Result<usize, Errno> {
1484        let bytes = data.read_all()?;
1485        match NetlinkMessage::<GenericMessage>::deserialize(&bytes, EmptyDeserializeGenlOptions) {
1486            Err(e) => {
1487                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1488                error!(EINVAL)
1489            }
1490            Ok(msg) => {
1491                security::check_netlink_send_access(current_task, socket, msg.header.message_type)?;
1492                match self.message_sender.unbounded_send(msg) {
1493                    Ok(()) => Ok(bytes.len()),
1494                    Err(e) => {
1495                        log_warn!("Netlink receiver unexpectedly disconnected for socket: {:?}", e);
1496                        error!(EPIPE)
1497                    }
1498                }
1499            }
1500        }
1501    }
1502
1503    fn wait_async(
1504        &self,
1505        _socket: &Socket,
1506        _current_task: &CurrentTask,
1507        waiter: &Waiter,
1508        events: FdEvents,
1509        handler: EventHandler,
1510    ) -> WaitCanceler {
1511        self.lock().wait_async(waiter, events, handler)
1512    }
1513
1514    fn query_events(
1515        &self,
1516        _socket: &Socket,
1517        _current_task: &CurrentTask,
1518    ) -> Result<FdEvents, Errno> {
1519        Ok(self.lock().query_events() & FdEvents::POLLIN)
1520    }
1521
1522    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1523        track_stub!(TODO("https://fxbug.dev/322875507"), "GenericNetlinkSocket::shutdown");
1524        Ok(())
1525    }
1526
1527    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
1528
1529    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1530        self.lock().getsockname()
1531    }
1532
1533    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1534        self.lock().getpeername()
1535    }
1536
1537    fn getsockopt(
1538        &self,
1539        _socket: &Socket,
1540        _current_task: &CurrentTask,
1541        level: u32,
1542        optname: u32,
1543        _optlen: u32,
1544    ) -> Result<Vec<u8>, Errno> {
1545        self.lock().getsockopt(level, optname)
1546    }
1547
1548    fn setsockopt(
1549        &self,
1550        _socket: &Socket,
1551        current_task: &CurrentTask,
1552        level: u32,
1553        optname: u32,
1554        optval: SockOptValue,
1555    ) -> Result<(), Errno> {
1556        match (level, optname) {
1557            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1558                let group_id: u32 = optval.read(current_task)?;
1559                self.client.add_membership(ModernGroup(group_id))
1560            }
1561            _ => self.lock().setsockopt(current_task, level, optname, optval),
1562        }
1563    }
1564}
1565
1566/// Audit client that can be attached to the `AuditLogger`.
1567pub struct AuditNetlinkClient {
1568    /// Reference to the `AuditLogger`.
1569    audit_logger: Arc<AuditLogger>,
1570    /// The waiters queue present in `AuditNetlinkSocket`.
1571    waiters: WaitQueue,
1572    /// Optional response from the `AuditLogger`.
1573    audit_response:
1574        LockDepMutex<Option<NetlinkMessage<GenericMessage>>, AuditNetlinkClientAuditResponseLock>,
1575}
1576
1577impl AuditNetlinkClient {
1578    fn new(audit_logger: Arc<AuditLogger>) -> Self {
1579        Self { audit_logger, waiters: Default::default(), audit_response: Default::default() }
1580    }
1581
1582    pub fn notify(&self) {
1583        self.waiters.notify_fd_events(FdEvents::POLLIN);
1584    }
1585
1586    /// Function to check the capabilities of the current task against CAP_AUDIT_*
1587    fn check_audit_access(
1588        &self,
1589        current_task: &CurrentTask,
1590        request_type: &AuditRequest,
1591    ) -> Result<(), Errno> {
1592        match request_type {
1593            AuditRequest::AuditGet | AuditRequest::AuditSet => {
1594                security::check_task_capable(current_task, CAP_AUDIT_CONTROL)
1595            }
1596            AuditRequest::AuditUser => security::check_task_capable(current_task, CAP_AUDIT_WRITE),
1597        }
1598    }
1599
1600    /// Function to process request coming from userspace, it returns the response after processing
1601    fn process_request(
1602        self: &Arc<Self>,
1603        current_task: &CurrentTask,
1604        nl_message: NetlinkMessage<GenericMessage>,
1605    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1606        let (nl_header, nl_payload) = nl_message.into_parts();
1607        let audit_request_type = AuditRequest::try_from(nl_header.message_type as u32)?;
1608        self.check_audit_access(current_task, &audit_request_type)?;
1609
1610        // If there is no GenericMessage, return an ErrorMessage.
1611        let NetlinkPayload::InnerMessage(GenericMessage::Other { payload, .. }) = nl_payload else {
1612            return error!(EINVAL);
1613        };
1614        match audit_request_type {
1615            AuditRequest::AuditGet => self.process_get_status(nl_header.sequence_number),
1616            AuditRequest::AuditSet => self.process_set_status(current_task, nl_header, payload),
1617            AuditRequest::AuditUser => self.process_user_audit(nl_header, payload),
1618        }
1619    }
1620
1621    fn get_nl_response(&self, flags: SocketMessageFlags) -> Option<Vec<u8>> {
1622        if flags.contains(SocketMessageFlags::PEEK) {
1623            if let Some(message) = self.audit_response.lock().as_ref() {
1624                return Some(AuditNetlinkClient::serialize_nlmsg(message.clone()));
1625            }
1626        } else if let Some(message) = self.audit_response.lock().take() {
1627            return Some(AuditNetlinkClient::serialize_nlmsg(message));
1628        }
1629        None
1630    }
1631
1632    /// Function to read an audit message from `AuditLogger`.
1633    fn read_audit_log(self: &Arc<Self>) -> Option<Vec<u8>> {
1634        if let Some(AuditMessage { audit_type, message }) = self.audit_logger.read_audit_log(self) {
1635            return Some(AuditNetlinkClient::serialize_nlmsg(
1636                AuditNetlinkClient::build_audit_nlmsg(0, audit_type, message),
1637            ));
1638        }
1639        None
1640    }
1641
1642    /// Function to read the optional response if present or an audit message.
1643    fn read_nlmsg(self: &Arc<Self>, flags: SocketMessageFlags) -> Result<Vec<u8>, Errno> {
1644        // First check if there is a response and send it if present.
1645        // Send an audit message otherwise or return EAGAIN.
1646        self.get_nl_response(flags).or_else(|| self.read_audit_log()).ok_or_else(|| errno!(EAGAIN))
1647    }
1648
1649    fn process_get_status(
1650        &self,
1651        sequence_number: u32,
1652    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1653        Ok(AuditNetlinkClient::build_audit_nlmsg(
1654            sequence_number,
1655            AUDIT_GET as u16,
1656            self.audit_logger.get_status().as_bytes().to_vec(),
1657        ))
1658    }
1659
1660    fn process_set_status(
1661        self: &Arc<Self>,
1662        current_task: &CurrentTask,
1663        nl_hdr: NetlinkHeader,
1664        nl_payload: Vec<u8>,
1665    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1666        let Some(status) = audit_status::read_from_bytes(nl_payload.as_bytes()).ok() else {
1667            return error!(EINVAL);
1668        };
1669        self.audit_logger.set_status(current_task, status, self)?;
1670        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1671    }
1672
1673    fn process_user_audit(
1674        &self,
1675        nl_hdr: NetlinkHeader,
1676        nl_payload: Vec<u8>,
1677    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1678        let audit_msg = String::from_utf8_lossy(nl_payload.as_bytes());
1679        self.audit_logger.audit_log(nl_hdr.message_type, move || audit_msg);
1680        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1681    }
1682
1683    fn query_events(self: &Arc<Self>) -> FdEvents {
1684        if self.audit_response.lock().is_some() || self.audit_logger.get_backlog_count(self) != 0 {
1685            return FdEvents::POLLIN;
1686        }
1687        FdEvents::empty()
1688    }
1689
1690    fn detach(self: &Arc<Self>) {
1691        self.audit_logger.detach_client(self);
1692    }
1693
1694    fn build_audit_nlmsg(
1695        seq_number: u32,
1696        msg_type: u16,
1697        payload: Vec<u8>,
1698    ) -> NetlinkMessage<GenericMessage> {
1699        // The family in GenericMessage can be used for message type, not only for the Netlink Family,
1700        // because after finalizing the message, the message type is equal to family.
1701        let nl_payload =
1702            NetlinkPayload::InnerMessage(GenericMessage::Other { family: msg_type, payload });
1703        let mut nl_header = NetlinkHeader::default();
1704        nl_header.sequence_number = seq_number;
1705        let mut message = NetlinkMessage::new(nl_header, nl_payload);
1706        message.finalize();
1707        message
1708    }
1709
1710    fn build_audit_ack(
1711        error: Result<(), Errno>,
1712        req_header: NetlinkHeader,
1713    ) -> NetlinkMessage<GenericMessage> {
1714        let error = {
1715            assert_eq!(req_header.buffer_len(), NETLINK_HEADER_LEN);
1716            let mut buffer = vec![0; NETLINK_HEADER_LEN];
1717            req_header.emit(&mut buffer);
1718
1719            let code = match error {
1720                Ok(()) => None,
1721                Err(e) => Some(
1722                    // Audit netlink errors are negative.
1723                    NonZeroI32::new(-(e.code.error_code() as i32))
1724                        .expect("Errno's code must be non-zero"),
1725                ),
1726            };
1727
1728            let mut error = ErrorMessage::default();
1729            error.code = code;
1730            error.header = buffer;
1731            error
1732        };
1733
1734        let payload = NetlinkPayload::<GenericMessage>::Error(error);
1735        let mut resp_header = NetlinkHeader::default();
1736        resp_header.message_type = NLMSG_ERROR;
1737        resp_header.sequence_number = req_header.sequence_number;
1738        let mut message = NetlinkMessage::new(resp_header, payload);
1739        message.finalize();
1740        message
1741    }
1742
1743    fn serialize_nlmsg(message: NetlinkMessage<GenericMessage>) -> Vec<u8> {
1744        let mut buf = vec![0; message.buffer_len()];
1745        message.serialize(&mut buf);
1746        buf
1747    }
1748}
1749
1750/// Audit Netlink Socket structure.
1751pub struct AuditNetlinkSocket {
1752    /// Reference to the `AuditNetlinkClient` associated with self.
1753    audit_client: Arc<AuditNetlinkClient>,
1754}
1755
1756impl AuditNetlinkSocket {
1757    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1758        if kernel.audit_logger().is_disabled() {
1759            return error!(EPROTONOSUPPORT);
1760        }
1761        Ok(Self { audit_client: Arc::new(AuditNetlinkClient::new(kernel.audit_logger())) })
1762    }
1763}
1764
1765impl SocketOps for AuditNetlinkSocket {
1766    fn read(
1767        &self,
1768        _socket: &Socket,
1769        _current_task: &CurrentTask,
1770        data: &mut dyn OutputBuffer,
1771        flags: SocketMessageFlags,
1772    ) -> Result<MessageReadInfo, Errno> {
1773        let buf = self.audit_client.read_nlmsg(flags)?;
1774
1775        let size = data.write_all(buf.as_bytes())?;
1776        Ok(MessageReadInfo {
1777            bytes_read: size,
1778            message_length: size,
1779            address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
1780            ancillary_data: vec![],
1781        })
1782    }
1783
1784    fn write(
1785        &self,
1786        socket: &Socket,
1787        current_task: &CurrentTask,
1788        data: &mut dyn InputBuffer,
1789        _dest_address: &mut Option<SocketAddress>,
1790        _ancillary_data: &mut Vec<AncillaryData>,
1791    ) -> Result<usize, Errno> {
1792        match NetlinkMessage::<GenericMessage>::deserialize(
1793            &(data.peek_all()?),
1794            EmptyDeserializeGenlOptions,
1795        ) {
1796            Ok(nl_message) => {
1797                let header = nl_message.header;
1798                security::check_netlink_send_access(current_task, socket, header.message_type)?;
1799
1800                // Send request to the `AuditNetlinkClient`.
1801                let audit_ack = self
1802                    .audit_client
1803                    .process_request(current_task, nl_message)
1804                    .map_err(|e| AuditNetlinkClient::build_audit_ack(Err(e), header))
1805                    .unwrap_or_else(|nlerr| nlerr);
1806                *self.audit_client.audit_response.lock() = Some(audit_ack);
1807                data.drain();
1808                Ok(header.length as usize)
1809            }
1810            Err(e) => {
1811                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1812                error!(EINVAL)
1813            }
1814        }
1815    }
1816
1817    fn wait_async(
1818        &self,
1819        _socket: &Socket,
1820        _current_task: &CurrentTask,
1821        waiter: &Waiter,
1822        events: FdEvents,
1823        handler: EventHandler,
1824    ) -> WaitCanceler {
1825        self.audit_client.waiters.wait_async_fd_events(waiter, events, handler)
1826    }
1827
1828    fn query_events(
1829        &self,
1830        _socket: &Socket,
1831        _current_task: &CurrentTask,
1832    ) -> Result<FdEvents, Errno> {
1833        Ok(self.audit_client.query_events() & FdEvents::POLLIN)
1834    }
1835
1836    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1837        // If the `AuditNetlinkClient` disconnects, detach it.
1838        self.audit_client.detach();
1839    }
1840
1841    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1842        error!(EOPNOTSUPP)
1843    }
1844
1845    fn connect(
1846        &self,
1847        _socket: &SocketHandle,
1848        _current_task: &CurrentTask,
1849        _peer: SocketPeer,
1850    ) -> Result<(), Errno> {
1851        error!(EOPNOTSUPP)
1852    }
1853
1854    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1855        error!(EOPNOTSUPP)
1856    }
1857
1858    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1859        error!(EOPNOTSUPP)
1860    }
1861
1862    fn bind(
1863        &self,
1864        _socket: &Socket,
1865        _current_task: &CurrentTask,
1866        _socket_address: SocketAddress,
1867    ) -> Result<(), Errno> {
1868        error!(EOPNOTSUPP)
1869    }
1870
1871    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1872        error!(EOPNOTSUPP)
1873    }
1874
1875    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1876        error!(EOPNOTSUPP)
1877    }
1878
1879    fn getsockopt(
1880        &self,
1881        _socket: &Socket,
1882        _current_task: &CurrentTask,
1883        _level: u32,
1884        _optname: u32,
1885        _optlen: u32,
1886    ) -> Result<Vec<u8>, Errno> {
1887        error!(EOPNOTSUPP)
1888    }
1889
1890    fn setsockopt(
1891        &self,
1892        _socket: &Socket,
1893        _current_task: &CurrentTask,
1894        _level: u32,
1895        _optname: u32,
1896        _optval: SockOptValue,
1897    ) -> Result<(), Errno> {
1898        error!(EOPNOTSUPP)
1899    }
1900}
1901
1902#[cfg(test)]
1903mod tests {
1904    use super::*;
1905
1906    use netlink_packet_route::route::RouteMessage;
1907    use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
1908    use test_case::test_case;
1909
1910    // Successfully send the message and observe it's stored in the queue.
1911    #[test_case(true; "sufficient_capacity")]
1912    // Attempting to send when the queue is full should succeed by increasing
1913    // the size of the queue.
1914    #[test_case(false; "insufficient_capacity")]
1915    fn test_netlink_to_client_sender(sufficient_capacity: bool) {
1916        const MODERN_GROUP: u32 = 5;
1917
1918        let mut message: NetlinkMessage<RouteNetlinkMessage> =
1919            RouteNetlinkMessage::NewRoute(RouteMessage::default()).into();
1920        message.finalize();
1921
1922        let (initial_queue_size, final_queue_size) = if sufficient_capacity {
1923            (SOCKET_DEFAULT_SIZE, SOCKET_DEFAULT_SIZE)
1924        } else {
1925            (0, message.buffer_len())
1926        };
1927
1928        let socket_inner = Arc::new(LockDepMutex::new(NetlinkSocketInner {
1929            receive_buffer: MessageQueue::new(initial_queue_size),
1930            ..NetlinkSocketInner::new(NetlinkFamily::Route)
1931        }));
1932
1933        let mut sender = NetlinkToClientSender::<RouteNetlinkMessage>::new(socket_inner.clone());
1934        sender.send(message.clone(), Some(ModernGroup(MODERN_GROUP)));
1935        let Message { data, address, ancillary_data: _ } =
1936            socket_inner.lock().read_message().expect("should read message");
1937
1938        assert_eq!(
1939            address,
1940            Some(SocketAddress::Netlink(NetlinkAddress { pid: 0, groups: 1 << MODERN_GROUP }))
1941        );
1942        let actual_message = NetlinkMessage::<RouteNetlinkMessage>::deserialize(
1943            &data,
1944            RouteNetlinkMessageParseMode::Strict,
1945        )
1946        .expect("message should deserialize into RtnlMessage");
1947        assert_eq!(actual_message, message);
1948        assert_eq!(socket_inner.lock().receive_buffer.capacity(), final_queue_size);
1949    }
1950
1951    fn getsockopt_u32(socket: &NetlinkSocketInner, level: u32, optname: u32) -> u32 {
1952        let byte_vec = socket.getsockopt(level, optname).expect("getsockopt should succeed");
1953        let bytes: [u8; 4] = byte_vec.as_slice().try_into().expect("expected 4 bytes");
1954        u32::from_ne_bytes(bytes)
1955    }
1956
1957    fn sock_opt_value(val: u32) -> SockOptValue {
1958        SockOptValue::Value(val.to_ne_bytes().to_vec())
1959    }
1960
1961    #[::fuchsia::test]
1962    async fn test_set_get_snd_rcv_buf() {
1963        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1964            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
1965
1966            // Verify initialization uses the default value.
1967            let expected_default = u32::try_from(SOCKET_DEFAULT_SIZE).unwrap();
1968            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_default);
1969            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_default);
1970
1971            // Set new values and observe that they were applied.
1972            // Note that applied value is 2 times the requested value.
1973            const SNDBUF_SIZE: u32 = 12345;
1974            const RCVBUF_SIZE: u32 = 54321;
1975            socket
1976                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(SNDBUF_SIZE))
1977                .expect("setsockopt should succeed");
1978            socket
1979                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(RCVBUF_SIZE))
1980                .expect("setsockopt should succeed");
1981            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), SNDBUF_SIZE * 2);
1982            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), RCVBUF_SIZE * 2);
1983        })
1984        .await;
1985    }
1986
1987    #[::fuchsia::test]
1988    async fn test_snd_rcv_buf_limits() {
1989        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1990            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
1991            let too_big = u32::try_from(SOCKET_MAX_SIZE).unwrap() + 1;
1992
1993            // SO_SNDBUF and SO_RCVBUF clamp the size to the limit.
1994            socket
1995                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(too_big))
1996                .expect("setsockopt should succeed");
1997            socket
1998                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(too_big))
1999                .expect("setsockopt should succeed");
2000            let expected_max = u32::try_from(SOCKET_MAX_SIZE).unwrap();
2001            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_max);
2002            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_max);
2003
2004            // SO_SNDBUFFORCE and SO_RCVBUFFORCE do not.
2005            // Note that the applied value is two times the requested value.
2006            socket
2007                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUFFORCE, sock_opt_value(too_big))
2008                .expect("setsockopt should succeed");
2009            socket
2010                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUFFORCE, sock_opt_value(too_big))
2011                .expect("setsockopt should succeed");
2012            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), too_big * 2);
2013            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), too_big * 2);
2014        })
2015        .await;
2016    }
2017}
starnix_core/vfs/socket/socket_netlink.rs

starnix_core/vfs/socket/
socket_netlink.rs
