starnix_core/vfs/socket/
socket_netlink.rs

1// Copyright 2022 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::security::{self, AuditLogger, AuditMessage, AuditRequest};
6use crate::vfs::socket::{SockOptValue, SocketDomain};
7use futures::channel::mpsc::{
8    UnboundedReceiver, UnboundedSender, {self},
9};
10use linux_uapi::{AUDIT_GET, NETLINK_GET_STRICT_CHK, audit_status};
11use netlink::messaging::{
12    AccessControl, MessageWithPermission, NetlinkContext, NetlinkMessageWithCreds, Permission,
13    Sender, UnparsedNetlinkMessage,
14};
15use netlink::multicast_groups::{
16    InvalidLegacyGroupsError, InvalidModernGroupError, LegacyGroups, ModernGroup,
17    NoMappingFromModernToLegacyGroupError, SingleLegacyGroup,
18};
19use netlink::protocol_family::NetlinkClient;
20use netlink::protocol_family::route::NetlinkRouteClient;
21use netlink::protocol_family::sock_diag::NetlinkSockDiagClient;
22use netlink::{NETLINK_LOG_TAG, NewClientError};
23use netlink_packet_core::{
24    ErrorMessage, NETLINK_HEADER_LEN, NLMSG_ERROR, NetlinkBuffer, NetlinkDeserializable,
25    NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
26};
27use netlink_packet_generic::message::EmptyDeserializeOptions as EmptyDeserializeGenlOptions;
28use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
29use netlink_packet_sock_diag::SockDiagRequest;
30use netlink_packet_sock_diag::message::EmptyDeserializeOptions as EmptyDeserializeSockDiagOptions;
31use netlink_packet_utils::{DecodeError, Emitable as _};
32use starnix_sync::{
33    AuditNetlinkClientAuditResponseLock, LockDepGuard, LockDepMutex, NetlinkSocketInnerLock,
34    UEventNetlinkSocketDeviceListenerKeyLock,
35};
36use std::io::Write;
37use std::marker::PhantomData;
38use std::num::{NonZeroI32, NonZeroU32};
39use std::sync::Arc;
40use zerocopy::{FromBytes, IntoBytes};
41
42use crate::device::kobject::{Device, UEventAction, UEventContext, flatten_uevent_properties};
43use crate::device::{DeviceListener, DeviceListenerKey};
44use crate::task::{CurrentTask, EventHandler, Kernel, WaitCanceler, WaitQueue, Waiter};
45use crate::vfs::buffers::{
46    AncillaryData, InputBuffer, Message, MessageQueue, MessageReadInfo, OutputBuffer,
47    UnixControlData, VecInputBuffer,
48};
49use crate::vfs::socket::{
50    GenericMessage, GenericNetlinkClientHandle, Socket, SocketAddress, SocketHandle,
51    SocketMessageFlags, SocketOps, SocketPeer, SocketShutdownFlags, SocketType,
52};
53use starnix_logging::{log_debug, log_error, log_warn, track_stub};
54use starnix_uapi::auth::{CAP_AUDIT_CONTROL, CAP_AUDIT_WRITE, CAP_NET_ADMIN, Credentials};
55use starnix_uapi::errors::Errno;
56use starnix_uapi::vfs::FdEvents;
57use starnix_uapi::{
58    AF_NETLINK, NETLINK_ADD_MEMBERSHIP, NETLINK_AUDIT, NETLINK_CONNECTOR, NETLINK_CRYPTO,
59    NETLINK_DNRTMSG, NETLINK_DROP_MEMBERSHIP, NETLINK_ECRYPTFS, NETLINK_FIB_LOOKUP,
60    NETLINK_FIREWALL, NETLINK_GENERIC, NETLINK_IP6_FW, NETLINK_ISCSI, NETLINK_KOBJECT_UEVENT,
61    NETLINK_NETFILTER, NETLINK_NFLOG, NETLINK_RDMA, NETLINK_ROUTE, NETLINK_SCSITRANSPORT,
62    NETLINK_SELINUX, NETLINK_SMC, NETLINK_SOCK_DIAG, NETLINK_USERSOCK, NETLINK_XFRM, NLM_F_MULTI,
63    NLMSG_DONE, SO_PASSCRED, SO_PROTOCOL, SO_RCVBUF, SO_RCVBUFFORCE, SO_SNDBUF, SO_SNDBUFFORCE,
64    SO_TIMESTAMP, SOL_SOCKET, errno, error, nlmsghdr, sockaddr_nl, socklen_t, ucred,
65};
66
67// From netlink/socket.go in gVisor.
68pub const SOCKET_MIN_SIZE: usize = 4 << 10;
69pub const SOCKET_DEFAULT_SIZE: usize = 16 * 1024;
70pub const SOCKET_MAX_SIZE: usize = 4 << 20;
71
72// From linux/socket.go in gVisor.
73const SOL_NETLINK: u32 = 270;
74
75pub fn new_netlink_socket(
76    kernel: &Arc<Kernel>,
77    socket_type: SocketType,
78    family: NetlinkFamily,
79) -> Result<Box<dyn SocketOps>, Errno> {
80    log_debug!(tag = NETLINK_LOG_TAG; "Creating {:?} Netlink Socket", family);
81    if socket_type != SocketType::Datagram && socket_type != SocketType::Raw {
82        return error!(ESOCKTNOSUPPORT);
83    }
84
85    let ops: Box<dyn SocketOps> = match family {
86        NetlinkFamily::KobjectUevent => Box::new(UEventNetlinkSocket::default()),
87        NetlinkFamily::Route => Box::new(new_route_socket(kernel)?),
88        NetlinkFamily::Generic => Box::new(GenericNetlinkSocket::new(kernel)?),
89        NetlinkFamily::SockDiag => Box::new(new_sock_diag_socket(kernel)?),
90        NetlinkFamily::Audit => Box::new(AuditNetlinkSocket::new(kernel)?),
91        NetlinkFamily::Nflog => {
92            let inner = Arc::new(NetlinkSocketInner::new(NetlinkFamily::Nflog).into());
93            Box::new(NflogNetlinkSocket::new(inner))
94        }
95        NetlinkFamily::Usersock
96        | NetlinkFamily::Firewall
97        | NetlinkFamily::Xfrm
98        | NetlinkFamily::Selinux
99        | NetlinkFamily::Iscsi
100        | NetlinkFamily::FibLookup
101        | NetlinkFamily::Connector
102        | NetlinkFamily::Netfilter
103        | NetlinkFamily::Ip6Fw
104        | NetlinkFamily::Dnrtmsg
105        | NetlinkFamily::Scsitransport
106        | NetlinkFamily::Ecryptfs
107        | NetlinkFamily::Rdma
108        | NetlinkFamily::Crypto
109        | NetlinkFamily::Smc => Box::new(StubbedNetlinkSocket::new(family)),
110        NetlinkFamily::Invalid => return error!(EINVAL),
111    };
112    Ok(ops)
113}
114
115#[derive(Default, Debug, Clone, PartialEq, Eq)]
116#[repr(C)]
117pub struct NetlinkAddress {
118    pid: u32,
119    groups: u32,
120}
121
122impl NetlinkAddress {
123    pub fn new(pid: u32, groups: u32) -> Self {
124        NetlinkAddress { pid, groups }
125    }
126
127    pub fn set_pid_if_zero(&mut self, pid: i32) {
128        if self.pid == 0 {
129            self.pid = pid as u32;
130        }
131    }
132
133    pub fn to_bytes(&self) -> Vec<u8> {
134        sockaddr_nl { nl_family: AF_NETLINK, nl_pid: self.pid, nl_pad: 0, nl_groups: self.groups }
135            .as_bytes()
136            .to_vec()
137    }
138}
139
140#[derive(Debug, Hash, Eq, PartialEq, Clone)]
141pub enum NetlinkFamily {
142    Invalid,
143    Route,
144    Usersock,
145    Firewall,
146    SockDiag,
147    Nflog,
148    Xfrm,
149    Selinux,
150    Iscsi,
151    Audit,
152    FibLookup,
153    Connector,
154    Netfilter,
155    Ip6Fw,
156    Dnrtmsg,
157    KobjectUevent,
158    Generic,
159    Scsitransport,
160    Ecryptfs,
161    Rdma,
162    Crypto,
163    Smc,
164}
165
166impl NetlinkFamily {
167    pub fn from_raw(family: u32) -> Self {
168        match family {
169            NETLINK_ROUTE => NetlinkFamily::Route,
170            NETLINK_USERSOCK => NetlinkFamily::Usersock,
171            NETLINK_FIREWALL => NetlinkFamily::Firewall,
172            NETLINK_SOCK_DIAG => NetlinkFamily::SockDiag,
173            NETLINK_NFLOG => NetlinkFamily::Nflog,
174            NETLINK_XFRM => NetlinkFamily::Xfrm,
175            NETLINK_SELINUX => NetlinkFamily::Selinux,
176            NETLINK_ISCSI => NetlinkFamily::Iscsi,
177            NETLINK_AUDIT => NetlinkFamily::Audit,
178            NETLINK_FIB_LOOKUP => NetlinkFamily::FibLookup,
179            NETLINK_CONNECTOR => NetlinkFamily::Connector,
180            NETLINK_NETFILTER => NetlinkFamily::Netfilter,
181            NETLINK_IP6_FW => NetlinkFamily::Ip6Fw,
182            NETLINK_DNRTMSG => NetlinkFamily::Dnrtmsg,
183            NETLINK_KOBJECT_UEVENT => NetlinkFamily::KobjectUevent,
184            NETLINK_GENERIC => NetlinkFamily::Generic,
185            NETLINK_SCSITRANSPORT => NetlinkFamily::Scsitransport,
186            NETLINK_ECRYPTFS => NetlinkFamily::Ecryptfs,
187            NETLINK_RDMA => NetlinkFamily::Rdma,
188            NETLINK_CRYPTO => NetlinkFamily::Crypto,
189            NETLINK_SMC => NetlinkFamily::Smc,
190            _ => NetlinkFamily::Invalid,
191        }
192    }
193
194    pub fn as_raw(&self) -> u32 {
195        match self {
196            NetlinkFamily::Route => NETLINK_ROUTE,
197            NetlinkFamily::KobjectUevent => NETLINK_KOBJECT_UEVENT,
198            NetlinkFamily::Audit => NETLINK_AUDIT,
199            _ => 0,
200        }
201    }
202}
203
204struct NetlinkSocketInner {
205    /// The specific type of netlink socket.
206    family: NetlinkFamily,
207
208    /// The [`MessageQueue`] that contains messages from netlink to the client.
209    receive_buffer: MessageQueue,
210
211    /// The socket's send buffer size. Note, This value is only used
212    /// to serve getsockopt calls for `SO_SNDBUF`. It does not yet enforce a
213    /// limit on the number of messages netlink will buffer from the client.
214    /// TODO(https://fxbug.dev/285880057): Limit the size of the send buffer.
215    send_buf_size: usize,
216
217    /// This queue will be notified on reads, writes, disconnects etc.
218    waiters: WaitQueue,
219
220    /// The address of this socket.
221    address: Option<NetlinkAddress>,
222
223    /// See SO_PASSCRED.
224    pub passcred: bool,
225
226    /// See SO_TIMESTAMP.
227    pub timestamp: bool,
228
229    /// See NETLINK_GET_STRICT_CHK.
230    pub strict_chk: bool,
231}
232
233impl NetlinkSocketInner {
234    fn new(family: NetlinkFamily) -> Self {
235        Self {
236            family,
237            receive_buffer: MessageQueue::new(SOCKET_DEFAULT_SIZE),
238            send_buf_size: SOCKET_DEFAULT_SIZE,
239            waiters: WaitQueue::default(),
240            address: None,
241            passcred: false,
242            timestamp: false,
243            strict_chk: false,
244        }
245    }
246
247    fn bind(
248        &mut self,
249        current_task: &CurrentTask,
250        socket_address: SocketAddress,
251    ) -> Result<(), Errno> {
252        if self.address.is_some() {
253            return error!(EINVAL);
254        }
255
256        let netlink_address = match socket_address {
257            SocketAddress::Netlink(mut netlink_address) => {
258                // TODO: Support distinct IDs for processes with multiple netlink sockets.
259                netlink_address.set_pid_if_zero(current_task.get_pid());
260                netlink_address
261            }
262            _ => return error!(EINVAL),
263        };
264
265        self.address = Some(netlink_address);
266        Ok(())
267    }
268
269    fn connect(&mut self, current_task: &CurrentTask, peer: SocketPeer) -> Result<(), Errno> {
270        let address = match peer {
271            SocketPeer::Address(address) => address,
272            _ => return error!(EINVAL),
273        };
274        // Connect is equivalent to bind, but error are ignored.
275        let _ = self.bind(current_task, address);
276        Ok(())
277    }
278
279    fn read_message(&mut self) -> Option<Message> {
280        let message = self.receive_buffer.read_message();
281        if message.is_some() {
282            self.waiters.notify_fd_events(FdEvents::POLLOUT);
283        }
284        message
285    }
286
287    fn read_datagram(
288        &mut self,
289        data: &mut dyn OutputBuffer,
290        flags: SocketMessageFlags,
291    ) -> Result<MessageReadInfo, Errno> {
292        let mut info = if flags.contains(SocketMessageFlags::PEEK) {
293            self.receive_buffer.peek_datagram(data)
294        } else {
295            self.receive_buffer.read_datagram(data)
296        }?;
297        if info.message_length == 0 {
298            return error!(EAGAIN);
299        }
300
301        if self.passcred {
302            track_stub!(TODO("https://fxbug.dev/297373991"), "SCM_CREDENTIALS/SO_PASSCRED");
303            info.ancillary_data.push(AncillaryData::Unix(UnixControlData::unknown_creds()));
304        }
305
306        Ok(info)
307    }
308
309    fn write_to_queue(
310        &mut self,
311        data: &mut dyn InputBuffer,
312        address: Option<NetlinkAddress>,
313        ancillary_data: &mut Vec<AncillaryData>,
314    ) -> Result<usize, Errno> {
315        let socket_address = match address {
316            Some(addr) => Some(SocketAddress::Netlink(addr)),
317            None => self.address.as_ref().map(|addr| SocketAddress::Netlink(addr.clone())),
318        };
319        let bytes_written =
320            self.receive_buffer.write_datagram(data, socket_address, ancillary_data)?;
321        if bytes_written > 0 {
322            self.waiters.notify_fd_events(FdEvents::POLLIN);
323        }
324        Ok(bytes_written)
325    }
326
327    fn wait_async(
328        &mut self,
329        waiter: &Waiter,
330        events: FdEvents,
331        handler: EventHandler,
332    ) -> WaitCanceler {
333        self.waiters.wait_async_fd_events(waiter, events, handler)
334    }
335
336    fn query_events(&self) -> FdEvents {
337        self.receive_buffer.query_events()
338    }
339
340    fn getsockname(&self) -> Result<SocketAddress, Errno> {
341        match &self.address {
342            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
343            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
344        }
345    }
346
347    fn getpeername(&self) -> Result<SocketAddress, Errno> {
348        match &self.address {
349            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
350            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
351        }
352    }
353
354    fn getsockopt(&self, level: u32, optname: u32) -> Result<Vec<u8>, Errno> {
355        let opt_value = match level {
356            SOL_SOCKET => match optname {
357                SO_PASSCRED => (self.passcred as u32).as_bytes().to_vec(),
358                SO_TIMESTAMP => (self.timestamp as u32).as_bytes().to_vec(),
359                SO_SNDBUF => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
360                SO_RCVBUF => (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec(),
361                SO_SNDBUFFORCE => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
362                SO_RCVBUFFORCE => {
363                    (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec()
364                }
365                SO_PROTOCOL => self.family.as_raw().as_bytes().to_vec(),
366                _ => return error!(ENOSYS),
367            },
368            SOL_NETLINK => match optname {
369                NETLINK_GET_STRICT_CHK => (self.strict_chk as u32).as_bytes().to_vec(),
370                _ => return error!(ENOSYS),
371            },
372            _ => vec![],
373        };
374
375        Ok(opt_value)
376    }
377
378    fn setsockopt(
379        &mut self,
380        current_task: &CurrentTask,
381        level: u32,
382        optname: u32,
383        optval: SockOptValue,
384    ) -> Result<(), Errno> {
385        match level {
386            SOL_SOCKET => match optname {
387                SO_SNDBUF => {
388                    let requested_capacity: socklen_t = optval.read(current_task)?;
389                    // SO_SNDBUF doubles the requested capacity to leave space for bookkeeping.
390                    // See https://man7.org/linux/man-pages/man7/socket.7.html
391                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
392                    // TODO(https://fxbug.dev/322907334): Clamp to `wmem_max`.
393                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
394                    self.send_buf_size = capacity;
395                }
396                SO_SNDBUFFORCE => {
397                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
398                    let requested_capacity: socklen_t = optval.read(current_task)?;
399                    // SO_SNDBUFFORE doubles the requested capacity to leave space for bookkeeping.
400                    // See https://man7.org/linux/man-pages/man7/socket.7.html
401                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
402                    self.send_buf_size = capacity;
403                }
404                SO_RCVBUF => {
405                    let requested_capacity: socklen_t = optval.read(current_task)?;
406                    // SO_RCVBUF doubles the requested capacity to leave space for bookkeeping.
407                    // See https://man7.org/linux/man-pages/man7/socket.7.html
408                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
409                    // TODO(https://fxbug.dev/322906968): Clamp to `rmem_max`.
410                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
411                    self.receive_buffer.set_capacity(capacity)?;
412                }
413                SO_RCVBUFFORCE => {
414                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
415                    let requested_capacity: socklen_t = optval.read(current_task)?;
416                    // SO_RCVBUFFORE doubles the requested capacity to leave space for bookkeeping.
417                    // See https://man7.org/linux/man-pages/man7/socket.7.html
418                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
419                    self.receive_buffer.set_capacity(capacity)?;
420                }
421                SO_PASSCRED => {
422                    let passcred: u32 = optval.read(current_task)?;
423                    self.passcred = passcred != 0;
424                }
425                SO_TIMESTAMP => {
426                    let timestamp: u32 = optval.read(current_task)?;
427                    self.timestamp = timestamp != 0;
428                }
429                _ => return error!(ENOSYS),
430            },
431            SOL_NETLINK => match optname {
432                NETLINK_GET_STRICT_CHK => {
433                    let strict_chk: u32 = optval.read(current_task)?;
434                    self.strict_chk = strict_chk != 0;
435                }
436                _ => return error!(ENOSYS),
437            },
438            _ => return error!(ENOSYS),
439        }
440
441        Ok(())
442    }
443}
444
445struct NflogListener {
446    inner: std::sync::Weak<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
447}
448
449static NFLOG_LISTENERS: std::sync::LazyLock<std::sync::Mutex<Vec<NflogListener>>> =
450    std::sync::LazyLock::new(|| std::sync::Mutex::new(Vec::new()));
451
452struct NflogNetlinkSocket {
453    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
454}
455
456impl NflogNetlinkSocket {
457    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
458        NFLOG_LISTENERS.lock().unwrap().push(NflogListener { inner: Arc::downgrade(&inner) });
459        Self { inner }
460    }
461
462    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
463        self.inner.lock()
464    }
465}
466
467impl Drop for NflogNetlinkSocket {
468    fn drop(&mut self) {
469        let mut listeners = NFLOG_LISTENERS.lock().unwrap();
470        listeners.retain(|l| {
471            if let Some(arc) = l.inner.upgrade() { !Arc::ptr_eq(&arc, &self.inner) } else { false }
472        });
473    }
474}
475
476impl SocketOps for NflogNetlinkSocket {
477    fn connect(
478        &self,
479        _socket: &SocketHandle,
480        current_task: &CurrentTask,
481        peer: SocketPeer,
482    ) -> Result<(), Errno> {
483        self.lock().connect(current_task, peer)
484    }
485
486    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
487        error!(EOPNOTSUPP)
488    }
489
490    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
491        error!(EOPNOTSUPP)
492    }
493
494    fn bind(
495        &self,
496        _socket: &Socket,
497        current_task: &CurrentTask,
498        socket_address: SocketAddress,
499    ) -> Result<(), Errno> {
500        self.lock().bind(current_task, socket_address)
501    }
502
503    fn read(
504        &self,
505        _socket: &Socket,
506        _current_task: &CurrentTask,
507        data: &mut dyn OutputBuffer,
508        flags: SocketMessageFlags,
509    ) -> Result<MessageReadInfo, Errno> {
510        self.lock().read_datagram(data, flags)
511    }
512
513    fn write(
514        &self,
515        _socket: &Socket,
516        _current_task: &CurrentTask,
517        _data: &mut dyn InputBuffer,
518        _dest_address: &mut Option<SocketAddress>,
519        _ancillary_data: &mut Vec<AncillaryData>,
520    ) -> Result<usize, Errno> {
521        error!(EOPNOTSUPP)
522    }
523
524    fn wait_async(
525        &self,
526        _socket: &Socket,
527        _current_task: &CurrentTask,
528        waiter: &Waiter,
529        events: FdEvents,
530        handler: EventHandler,
531    ) -> WaitCanceler {
532        self.lock().wait_async(waiter, events, handler)
533    }
534
535    fn query_events(
536        &self,
537        _socket: &Socket,
538        _current_task: &CurrentTask,
539    ) -> Result<FdEvents, Errno> {
540        Ok(self.lock().query_events() & FdEvents::POLLIN)
541    }
542
543    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
544        Ok(())
545    }
546
547    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
548
549    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
550        self.lock().getsockname()
551    }
552
553    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
554        self.lock().getpeername()
555    }
556
557    fn getsockopt(
558        &self,
559        _socket: &Socket,
560        _current_task: &CurrentTask,
561        level: u32,
562        optname: u32,
563        _optlen: u32,
564    ) -> Result<Vec<u8>, Errno> {
565        self.lock().getsockopt(level, optname)
566    }
567
568    fn setsockopt(
569        &self,
570        _socket: &Socket,
571        current_task: &CurrentTask,
572        level: u32,
573        optname: u32,
574        optval: SockOptValue,
575    ) -> Result<(), Errno> {
576        self.lock().setsockopt(current_task, level, optname, optval)
577    }
578}
579
580fn write_attr(buf: &mut Vec<u8>, attr_type: u16, data: &[u8]) {
581    let len = 4 + data.len();
582    buf.extend_from_slice(&(len as u16).to_ne_bytes());
583    buf.extend_from_slice(&attr_type.to_ne_bytes());
584    buf.extend_from_slice(data);
585    let pad = (4 - (data.len() % 4)) % 4;
586    for _ in 0..pad {
587        buf.push(0);
588    }
589}
590
591pub fn send_fake_nflog_message(uid: u32) {
592    const NFNL_SUBSYS_ULOG: u16 = 4;
593    const NFULNL_MSG_PACKET: u8 = 0;
594    const LOCAL_NFLOG_PACKET: u16 = (NFNL_SUBSYS_ULOG << 8) | (NFULNL_MSG_PACKET as u16);
595    const NFULA_PAYLOAD: u16 = 9;
596    const NFULA_UID: u16 = 11;
597
598    let mut msg_body = vec![0u8; 4]; // 4 bytes of nfgenmsg header
599
600    // Write UID attribute
601    let uid_bytes = uid.to_be_bytes();
602    write_attr(&mut msg_body, NFULA_UID, &uid_bytes);
603
604    // Write PAYLOAD attribute (placeholder IPv4 header)
605    let mut ip_hdr = vec![0u8; 20];
606    ip_hdr[0] = 0x45; // Version 4, IHL 5
607    ip_hdr[12..16].copy_from_slice(&[127, 0, 0, 1]);
608    ip_hdr[16..20].copy_from_slice(&[8, 8, 8, 8]);
609    write_attr(&mut msg_body, NFULA_PAYLOAD, &ip_hdr);
610
611    // Construct nlmsghdr
612    let total_len = 16 + msg_body.len();
613    let mut packet = vec![];
614    packet.extend_from_slice(&(total_len as u32).to_ne_bytes());
615    packet.extend_from_slice(&LOCAL_NFLOG_PACKET.to_ne_bytes());
616    packet.extend_from_slice(&0u16.to_ne_bytes()); // flags
617    packet.extend_from_slice(&0u32.to_ne_bytes()); // seq
618    packet.extend_from_slice(&0u32.to_ne_bytes()); // pid
619    packet.extend_from_slice(&msg_body);
620
621    // Broadcast to all listeners
622    let listeners = NFLOG_LISTENERS.lock().unwrap();
623    let ancillary_data = AncillaryData::Unix(UnixControlData::Credentials(Default::default()));
624    let mut ancillary_data = vec![ancillary_data];
625
626    for listener in listeners.iter() {
627        if let Some(socket) = listener.inner.upgrade() {
628            let _ = socket.lock().write_to_queue(
629                &mut VecInputBuffer::new(&packet),
630                Some(NetlinkAddress { pid: 0, groups: 1 }),
631                &mut ancillary_data,
632            );
633        }
634    }
635}
636
637/// A fake Netlink socket that loops messages back to the client.
638///
639/// Used as a placeholder implementation for protocol families that lack a real
640/// implementation.
641struct StubbedNetlinkSocket {
642    inner: LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>,
643}
644
645impl StubbedNetlinkSocket {
646    pub fn new(family: NetlinkFamily) -> Self {
647        track_stub!(
648            TODO("https://fxbug.dev/278565021"),
649            format!("Creating StubbedNetlinkSocket: {:?}", family).as_str()
650        );
651        StubbedNetlinkSocket { inner: NetlinkSocketInner::new(family).into() }
652    }
653
654    /// Locks and returns the inner state of the Socket.
655    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
656        self.inner.lock()
657    }
658}
659
660impl SocketOps for StubbedNetlinkSocket {
661    fn connect(
662        &self,
663        _socket: &SocketHandle,
664        current_task: &CurrentTask,
665        peer: SocketPeer,
666    ) -> Result<(), Errno> {
667        self.lock().connect(current_task, peer)
668    }
669
670    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
671        error!(EOPNOTSUPP)
672    }
673
674    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
675        error!(EOPNOTSUPP)
676    }
677
678    fn bind(
679        &self,
680        _socket: &Socket,
681        current_task: &CurrentTask,
682        socket_address: SocketAddress,
683    ) -> Result<(), Errno> {
684        self.lock().bind(current_task, socket_address)
685    }
686
687    fn read(
688        &self,
689        _socket: &Socket,
690        _current_task: &CurrentTask,
691        data: &mut dyn OutputBuffer,
692        _flags: SocketMessageFlags,
693    ) -> Result<MessageReadInfo, Errno> {
694        let msg = self.lock().read_message();
695        match msg {
696            Some(message) => {
697                // Mark the message as complete and return it.
698                let (mut nl_msg, _) =
699                    nlmsghdr::read_from_prefix(&message.data).map_err(|_| errno!(EINVAL))?;
700                nl_msg.nlmsg_type = NLMSG_DONE as u16;
701                nl_msg.nlmsg_flags &= NLM_F_MULTI as u16;
702                let msg_bytes = nl_msg.as_bytes();
703                let bytes_read = data.write(msg_bytes)?;
704
705                let info = MessageReadInfo {
706                    bytes_read,
707                    message_length: msg_bytes.len(),
708                    address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
709                    ancillary_data: vec![],
710                };
711                Ok(info)
712            }
713            None => Ok(MessageReadInfo::default()),
714        }
715    }
716
717    fn write(
718        &self,
719        _socket: &Socket,
720        _current_task: &CurrentTask,
721        data: &mut dyn InputBuffer,
722        dest_address: &mut Option<SocketAddress>,
723        ancillary_data: &mut Vec<AncillaryData>,
724    ) -> Result<usize, Errno> {
725        let mut local_address = self.lock().address.clone();
726
727        let destination = match dest_address {
728            Some(SocketAddress::Netlink(addr)) => addr,
729            _ => match &mut local_address {
730                Some(addr) => addr,
731                _ => return Ok(data.drain()),
732            },
733        };
734
735        if destination.groups != 0 {
736            track_stub!(TODO("https://fxbug.dev/322874956"), "StubbedNetlinkSockets multicasting");
737            return Ok(data.drain());
738        }
739
740        self.lock().write_to_queue(data, Some(NetlinkAddress::default()), ancillary_data)
741    }
742
743    fn wait_async(
744        &self,
745        _socket: &Socket,
746        _current_task: &CurrentTask,
747        waiter: &Waiter,
748        events: FdEvents,
749        handler: EventHandler,
750    ) -> WaitCanceler {
751        self.lock().wait_async(waiter, events, handler)
752    }
753
754    fn query_events(
755        &self,
756        _socket: &Socket,
757        _current_task: &CurrentTask,
758    ) -> Result<FdEvents, Errno> {
759        Ok(self.lock().query_events() & FdEvents::POLLIN)
760    }
761
762    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
763        track_stub!(TODO("https://fxbug.dev/322875507"), "StubbedNetlinkSocket::shutdown");
764        Ok(())
765    }
766
767    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
768
769    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
770        self.lock().getsockname()
771    }
772
773    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
774        self.lock().getpeername()
775    }
776
777    fn getsockopt(
778        &self,
779        _socket: &Socket,
780        _current_task: &CurrentTask,
781        level: u32,
782        optname: u32,
783        _optlen: u32,
784    ) -> Result<Vec<u8>, Errno> {
785        self.lock().getsockopt(level, optname)
786    }
787
788    fn setsockopt(
789        &self,
790        _socket: &Socket,
791        current_task: &CurrentTask,
792        level: u32,
793        optname: u32,
794        optval: SockOptValue,
795    ) -> Result<(), Errno> {
796        self.lock().setsockopt(current_task, level, optname, optval)
797    }
798}
799
800/// Socket implementation for the NETLINK_KOBJECT_UEVENT family of netlink sockets.
801struct UEventNetlinkSocket {
802    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
803    device_listener_key:
804        LockDepMutex<Option<DeviceListenerKey>, UEventNetlinkSocketDeviceListenerKeyLock>,
805}
806
807impl Default for UEventNetlinkSocket {
808    #[allow(clippy::let_and_return)]
809    fn default() -> Self {
810        let result = Self {
811            inner: Arc::new(NetlinkSocketInner::new(NetlinkFamily::KobjectUevent).into()),
812            device_listener_key: Default::default(),
813        };
814        #[cfg(any(test, debug_assertions))]
815        {
816            let _l1 = result.device_listener_key.lock();
817            let _l2 = result.lock();
818        }
819        result
820    }
821}
822
823impl UEventNetlinkSocket {
824    /// Locks and returns the inner state of the Socket.
825    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
826        self.inner.lock()
827    }
828
829    fn register_listener(
830        &self,
831        current_task: &CurrentTask,
832        state: LockDepGuard<'_, NetlinkSocketInner>,
833    ) {
834        if state.address.is_none() {
835            return;
836        }
837        std::mem::drop(state);
838        let mut key_state = self.device_listener_key.lock();
839        if key_state.is_none() {
840            *key_state =
841                Some(current_task.kernel().device_registry.register_listener(self.inner.clone()));
842        }
843    }
844}
845
846impl SocketOps for UEventNetlinkSocket {
847    fn connect(
848        &self,
849        _socket: &SocketHandle,
850        current_task: &CurrentTask,
851        peer: SocketPeer,
852    ) -> Result<(), Errno> {
853        let mut state = self.lock();
854        state.connect(current_task, peer)?;
855        self.register_listener(current_task, state);
856        Ok(())
857    }
858
859    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
860        error!(EOPNOTSUPP)
861    }
862
863    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
864        error!(EOPNOTSUPP)
865    }
866
867    fn bind(
868        &self,
869        _socket: &Socket,
870        current_task: &CurrentTask,
871        socket_address: SocketAddress,
872    ) -> Result<(), Errno> {
873        let mut state = self.lock();
874        state.bind(current_task, socket_address)?;
875        self.register_listener(current_task, state);
876        Ok(())
877    }
878
879    fn read(
880        &self,
881        _socket: &Socket,
882        _current_task: &CurrentTask,
883        data: &mut dyn OutputBuffer,
884        flags: SocketMessageFlags,
885    ) -> Result<MessageReadInfo, Errno> {
886        self.lock().read_datagram(data, flags)
887    }
888
889    fn write(
890        &self,
891        _socket: &Socket,
892        _current_task: &CurrentTask,
893        _data: &mut dyn InputBuffer,
894        _dest_address: &mut Option<SocketAddress>,
895        _ancillary_data: &mut Vec<AncillaryData>,
896    ) -> Result<usize, Errno> {
897        error!(EOPNOTSUPP)
898    }
899
900    fn wait_async(
901        &self,
902        _socket: &Socket,
903        _current_task: &CurrentTask,
904        waiter: &Waiter,
905        events: FdEvents,
906        handler: EventHandler,
907    ) -> WaitCanceler {
908        self.lock().wait_async(waiter, events, handler)
909    }
910
911    fn query_events(
912        &self,
913        _socket: &Socket,
914        _current_task: &CurrentTask,
915    ) -> Result<FdEvents, Errno> {
916        Ok(self.lock().query_events() & FdEvents::POLLIN)
917    }
918
919    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
920        track_stub!(TODO("https://fxbug.dev/322875507"), "UEventNetlinkSocket::shutdown");
921        Ok(())
922    }
923
924    fn close(&self, current_task: &CurrentTask, _socket: &Socket) {
925        let id = self.device_listener_key.lock().take();
926        if let Some(id) = id {
927            current_task.kernel().device_registry.unregister_listener(&id);
928        }
929    }
930
931    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
932        self.lock().getsockname()
933    }
934
935    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
936        self.lock().getpeername()
937    }
938
939    fn getsockopt(
940        &self,
941        _socket: &Socket,
942        _current_task: &CurrentTask,
943        level: u32,
944        optname: u32,
945        _optlen: u32,
946    ) -> Result<Vec<u8>, Errno> {
947        self.lock().getsockopt(level, optname)
948    }
949
950    fn setsockopt(
951        &self,
952        _socket: &Socket,
953        current_task: &CurrentTask,
954        level: u32,
955        optname: u32,
956        optval: SockOptValue,
957    ) -> Result<(), Errno> {
958        self.lock().setsockopt(current_task, level, optname, optval)
959    }
960}
961
962impl DeviceListener for Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>> {
963    fn on_device_event(&self, action: UEventAction, device: Device, context: UEventContext) {
964        let path = device.path_from_depth(0);
965
966        let mut props = device.get_uevent_properties_list();
967
968        // Prepend ACTION and SEQNUM to maintain existing order
969        props.insert(0, (b"ACTION".into(), action.to_string().into()));
970        props.insert(1, (b"SEQNUM".into(), context.seqnum.to_string().into()));
971
972        let flattened = flatten_uevent_properties(props, '\0');
973
974        let mut message = vec![];
975        write!(&mut message, "{action}@/{path}\0", action = action, path = path).unwrap();
976        message.extend_from_slice(flattened.as_ref());
977
978        let ancillary_data = AncillaryData::Unix(UnixControlData::Credentials(Default::default()));
979        let mut ancillary_data = vec![ancillary_data];
980        // Ignore write errors
981        let _ = self.lock().write_to_queue(
982            &mut VecInputBuffer::new(&message),
983            Some(NetlinkAddress { pid: 0, groups: 1 }),
984            &mut ancillary_data,
985        );
986    }
987}
988
989/// Type for sending messages from [`netlink::Netlink`] to an individual socket.
990#[derive(Clone)]
991pub struct NetlinkToClientSender<M> {
992    /// The inner socket implementation, which holds a message queue.
993    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
994
995    /// `PhantomData<fn(M) -> M>` is used instead of `PhantomData<M>` in order
996    /// to ensure that the type is invariant over `M` and that it implements
997    /// `Sync` even if `M` is not `Sync`.
998    _message_type: PhantomData<fn(M) -> M>,
999}
1000
1001impl<M> NetlinkToClientSender<M> {
1002    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
1003        NetlinkToClientSender { _message_type: Default::default(), inner }
1004    }
1005}
1006
1007impl<M: Clone + NetlinkSerializable + Send> Sender<M> for NetlinkToClientSender<M> {
1008    fn send(&mut self, message: NetlinkMessage<M>, group: Option<ModernGroup>) {
1009        // Serialize the message
1010        let mut buf = vec![0; message.buffer_len()];
1011        message.emit(&mut buf);
1012        let mut buf: VecInputBuffer = buf.into();
1013        // Write the message into the inner socket buffer.
1014        let NetlinkToClientSender { _message_type: _, inner } = self;
1015        let mut guard = inner.lock();
1016
1017        // To avoid dropping messages when the receive buffer is
1018        // full, grow the buffer on behalf of the client.
1019        // This is a stop gap measure to avoid dropping messages
1020        // when netlink produces a large response to a
1021        // NLM_F_DUMP request.
1022        //
1023        // TODO(https://fxbug.dev/459883760): The memory
1024        // implications of this may be problematic. It should be
1025        // replaced with a proper mechanism to handle a backlog
1026        // of NLM_F_DUMP responses.
1027        let available = guard.receive_buffer.available_capacity();
1028        let required = buf.available();
1029        if available < required {
1030            let delta = required - available;
1031            let current_capacity = guard.receive_buffer.capacity();
1032            let new_capacity = (current_capacity + delta).min(SOCKET_MAX_SIZE);
1033            match guard.receive_buffer.set_capacity(new_capacity) {
1034                Ok(()) => {}
1035                Err(e) => {
1036                    log_error!(
1037                        tag = NETLINK_LOG_TAG;
1038                        "Failed to increase receive buffer size: {:?}",
1039                        e
1040                    );
1041                }
1042            }
1043        }
1044
1045        let _bytes_written: usize = guard
1046            .write_to_queue(
1047                &mut buf,
1048                Some(NetlinkAddress {
1049                    // All messages come from the "kernel" which has PID of 0.
1050                    pid: 0,
1051                    // If this is a multicast message, set the group the multicast
1052                    // message is from.
1053                    groups: group
1054                        .map(SingleLegacyGroup::try_from)
1055                        .and_then(Result::<_, NoMappingFromModernToLegacyGroupError>::ok)
1056                        .map_or(0, |g| g.inner()),
1057                }),
1058                &mut Vec::new(),
1059            )
1060            .unwrap_or_else(|e| {
1061                log_error!(
1062                    tag = NETLINK_LOG_TAG;
1063                    "Failed to write message into buffer for socket. Errno: {:?}",
1064                    e
1065                );
1066                0
1067            });
1068    }
1069}
1070
1071#[derive(Clone)]
1072pub struct NetlinkAccessControl<'a> {
1073    current_task: &'a CurrentTask,
1074}
1075
1076impl<'a> NetlinkAccessControl<'a> {
1077    pub fn new(current_task: &'a CurrentTask) -> Self {
1078        Self { current_task }
1079    }
1080}
1081
1082impl<'a> AccessControl<Arc<Credentials>> for NetlinkAccessControl<'a> {
1083    fn grant_assess(
1084        &self,
1085        creds: &Arc<Credentials>,
1086        permission: Permission,
1087    ) -> Result<(), netlink::Errno> {
1088        let need_cap_net_admin = match permission {
1089            Permission::NetlinkRouteRead => false,
1090            Permission::NetlinkRouteWrite => true,
1091            Permission::NetlinkSockDiagRead => false,
1092            Permission::NetlinkSockDiagDestroy => true,
1093        };
1094        if !need_cap_net_admin {
1095            return Ok(());
1096        }
1097
1098        self.current_task.override_creds(creds.clone(), || {
1099            security::check_task_capable(self.current_task, CAP_NET_ADMIN).map_err(|error| {
1100                netlink::Errno::new(error.code.error_code() as i32)
1101                    .expect("Errno::error_code() is expected to be in range [1..max_i32]")
1102            })
1103        })
1104    }
1105}
1106pub struct NetlinkContextImpl;
1107
1108impl NetlinkContext for NetlinkContextImpl {
1109    type Creds = Arc<Credentials>;
1110    type Sender<M: Clone + NetlinkSerializable + Send> = NetlinkToClientSender<M>;
1111    type Receiver<
1112        M: Send + MessageWithPermission + NetlinkDeserializable<Error: Into<DecodeError>>,
1113    > = UnboundedReceiver<NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, M>, Self::Creds>>;
1114    type AccessControl<'a> = NetlinkAccessControl<'a>;
1115}
1116
1117fn new_route_socket(kernel: &Arc<Kernel>) -> Result<NetlinkSocket<NetlinkRouteClient>, Errno> {
1118    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Route)));
1119    let (message_sender, message_receiver) = mpsc::unbounded();
1120    let client = match kernel
1121        .network_netlink()
1122        .new_route_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1123    {
1124        Ok(client) => client,
1125        Err(NewClientError::Disconnected) => {
1126            log_error!(
1127                tag = NETLINK_LOG_TAG;
1128                "Netlink async worker is unexpectedly disconnected"
1129            );
1130            return error!(EPIPE);
1131        }
1132    };
1133    Ok(NetlinkSocket { inner, client, message_sender })
1134}
1135
1136fn new_sock_diag_socket(
1137    kernel: &Arc<Kernel>,
1138) -> Result<NetlinkSocket<NetlinkSockDiagClient>, Errno> {
1139    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::SockDiag)));
1140    let (message_sender, message_receiver) = mpsc::unbounded();
1141    let client = match kernel
1142        .network_netlink()
1143        .new_sock_diag_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1144    {
1145        Ok(client) => client,
1146        Err(NewClientError::Disconnected) => {
1147            log_error!(
1148                tag = NETLINK_LOG_TAG;
1149                "Netlink async worker is unexpectedly disconnected"
1150            );
1151            return error!(EPIPE);
1152        }
1153    };
1154    Ok(NetlinkSocket { inner, client, message_sender })
1155}
1156
1157/// An abstraction over common networking-specific netlink sockets.
1158struct NetlinkSocket<C: NetlinkClient> {
1159    /// The inner Netlink socket implementation
1160    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1161    /// The implementation of a client (socket connection) to a netlink protocol
1162    /// family.
1163    client: C,
1164    /// The sender of messages from this socket to Netlink.
1165    // TODO(https://issuetracker.google.com/285880057): Bound the capacity of
1166    // the "send buffer".
1167    message_sender: UnboundedSender<
1168        NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, C::Request>, Arc<Credentials>>,
1169    >,
1170}
1171
1172/// A type that provides Netlink message deserialization options.
1173trait DeserializeOptionsProvider {
1174    /// The type of the message to deserialize.
1175    type Message: NetlinkDeserializable;
1176    /// The options to use when deserializing a `Message`.
1177    fn options(&self) -> <Self::Message as NetlinkDeserializable>::DeserializeOptions;
1178}
1179
1180impl DeserializeOptionsProvider for NetlinkSocket<NetlinkRouteClient> {
1181    type Message = RouteNetlinkMessage;
1182    fn options(&self) -> RouteNetlinkMessageParseMode {
1183        let strict = self.inner.lock().strict_chk;
1184        if strict {
1185            RouteNetlinkMessageParseMode::Strict
1186        } else {
1187            RouteNetlinkMessageParseMode::Relaxed
1188        }
1189    }
1190}
1191
1192impl DeserializeOptionsProvider for NetlinkSocket<NetlinkSockDiagClient> {
1193    type Message = SockDiagRequest;
1194    fn options(&self) -> EmptyDeserializeSockDiagOptions {
1195        EmptyDeserializeSockDiagOptions
1196    }
1197}
1198
1199impl<C: NetlinkClient + 'static> SocketOps for NetlinkSocket<C>
1200where
1201    Self: DeserializeOptionsProvider<Message = C::Request>,
1202{
1203    fn connect(
1204        &self,
1205        _socket: &SocketHandle,
1206        current_task: &CurrentTask,
1207        peer: SocketPeer,
1208    ) -> Result<(), Errno> {
1209        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1210        inner.lock().connect(current_task, peer)
1211    }
1212
1213    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1214        error!(EOPNOTSUPP)
1215    }
1216
1217    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1218        error!(EOPNOTSUPP)
1219    }
1220
1221    fn bind(
1222        &self,
1223        _socket: &Socket,
1224        current_task: &CurrentTask,
1225        socket_address: SocketAddress,
1226    ) -> Result<(), Errno> {
1227        let NetlinkSocket { inner, client, message_sender: _ } = self;
1228
1229        let multicast_groups = match &socket_address {
1230            SocketAddress::Netlink(NetlinkAddress { pid: _, groups }) => *groups,
1231            _ => return error!(EINVAL),
1232        };
1233        let pid = {
1234            let mut inner = inner.lock();
1235            inner.bind(current_task, socket_address)?;
1236            inner
1237                .address
1238                .as_ref()
1239                .and_then(|NetlinkAddress { pid, groups: _ }| NonZeroU32::new(*pid))
1240        };
1241        if let Some(pid) = pid {
1242            client.set_pid(pid);
1243        }
1244        // This "blocks" in order to synchronize with the internal
1245        // state of the netlink worker, but we're not blocking on
1246        // the completion of any i/o or any expensive computation,
1247        // so there's no need to support interrupts here.
1248        client
1249            .set_legacy_memberships(LegacyGroups(multicast_groups))
1250            .map_err(|InvalidLegacyGroupsError {}| errno!(EPERM))?
1251            .wait_until_complete();
1252        Ok(())
1253    }
1254
1255    fn read(
1256        &self,
1257        _socket: &Socket,
1258        _current_task: &CurrentTask,
1259        data: &mut dyn OutputBuffer,
1260        flags: SocketMessageFlags,
1261    ) -> Result<MessageReadInfo, Errno> {
1262        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1263        inner.lock().read_datagram(data, flags)
1264    }
1265
1266    fn write(
1267        &self,
1268        socket: &Socket,
1269        current_task: &CurrentTask,
1270        data: &mut dyn InputBuffer,
1271        _dest_address: &mut Option<SocketAddress>,
1272        _ancillary_data: &mut Vec<AncillaryData>,
1273    ) -> Result<usize, Errno> {
1274        let NetlinkSocket { inner: _, client: _, message_sender } = self;
1275
1276        let bytes = data.peek_all()?;
1277        let bytes_len = bytes.len();
1278
1279        // Parse only the netlink header to send it through security check.
1280        match NetlinkBuffer::new(&bytes) {
1281            Ok(buffer) => {
1282                security::check_netlink_send_access(current_task, socket, buffer.message_type())?;
1283            }
1284            Err(e) => {
1285                // If we can't even decode the header of the netlink message,
1286                // then return early here as a stronger statement that we're not
1287                // going to accidentally operate on it and violate the security
1288                // check. The netlink crate would end up dropping this with no
1289                // response as well.
1290                log_warn!(tag = NETLINK_LOG_TAG;
1291                    "Failed to parse netlink header {e:?}"
1292                );
1293                data.drain();
1294                return Ok(bytes_len);
1295            }
1296        }
1297
1298        let msg = NetlinkMessageWithCreds::new(
1299            UnparsedNetlinkMessage::new(bytes, self.options()),
1300            current_task.current_creds().clone(),
1301        );
1302        message_sender.unbounded_send(msg).map_err(|e| {
1303            log_warn!(
1304                tag = NETLINK_LOG_TAG;
1305                "Netlink receiver unexpectedly disconnected for socket: {:?}",
1306                e
1307            );
1308            errno!(EPIPE)
1309        })?;
1310        data.drain();
1311        Ok(bytes_len)
1312    }
1313
1314    fn wait_async(
1315        &self,
1316        _socket: &Socket,
1317        _current_task: &CurrentTask,
1318        waiter: &Waiter,
1319        events: FdEvents,
1320        handler: EventHandler,
1321    ) -> WaitCanceler {
1322        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1323        inner.lock().wait_async(waiter, events, handler)
1324    }
1325
1326    fn query_events(
1327        &self,
1328        _socket: &Socket,
1329        _current_task: &CurrentTask,
1330    ) -> Result<FdEvents, Errno> {
1331        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1332        Ok(inner.lock().query_events() & FdEvents::POLLIN)
1333    }
1334
1335    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1336        error!(EOPNOTSUPP)
1337    }
1338
1339    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1340        // Close the underlying channel to the Netlink worker.
1341        self.message_sender.close_channel();
1342    }
1343
1344    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1345        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1346        inner.lock().getsockname()
1347    }
1348
1349    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1350        self.inner.lock().getpeername()
1351    }
1352
1353    fn getsockopt(
1354        &self,
1355        _socket: &Socket,
1356        _current_task: &CurrentTask,
1357        level: u32,
1358        optname: u32,
1359        _optlen: u32,
1360    ) -> Result<Vec<u8>, Errno> {
1361        self.inner.lock().getsockopt(level, optname)
1362    }
1363
1364    fn setsockopt(
1365        &self,
1366        _socket: &Socket,
1367        current_task: &CurrentTask,
1368        level: u32,
1369        optname: u32,
1370        optval: SockOptValue,
1371    ) -> Result<(), Errno> {
1372        match (level, optname) {
1373            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1374                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1375                let group: u32 = optval.read(current_task)?;
1376                let async_work = client
1377                    .add_membership(ModernGroup(group))
1378                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1379                // This "blocks" in order to synchronize with the internal
1380                // state of the rtnetlink worker, but we're not blocking on
1381                // the completion of any i/o or any expensive computation,
1382                // so there's no need to support interrupts here.
1383                async_work.wait_until_complete();
1384                Ok(())
1385            }
1386            (SOL_NETLINK, NETLINK_DROP_MEMBERSHIP) => {
1387                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1388                let group: u32 = optval.read(current_task)?;
1389                client
1390                    .del_membership(ModernGroup(group))
1391                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1392                Ok(())
1393            }
1394            _ => self.inner.lock().setsockopt(current_task, level, optname, optval),
1395        }
1396    }
1397}
1398
1399/// Socket implementation for the NETLINK_GENERIC family of netlink sockets.
1400struct GenericNetlinkSocket {
1401    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1402    client: GenericNetlinkClientHandle<NetlinkToClientSender<GenericMessage>>,
1403    message_sender: mpsc::UnboundedSender<NetlinkMessage<GenericMessage>>,
1404}
1405
1406impl GenericNetlinkSocket {
1407    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1408        let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Generic)));
1409        let (message_sender, message_receiver) = mpsc::unbounded();
1410        match kernel
1411            .generic_netlink()
1412            .new_generic_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1413        {
1414            Ok(client) => Ok(Self { inner, client, message_sender }),
1415            Err(e) => {
1416                log_warn!(
1417                    tag = NETLINK_LOG_TAG;
1418                    "Failed to connect to generic netlink server. Errno: {:?}",
1419                    e
1420                );
1421                error!(EPIPE)
1422            }
1423        }
1424    }
1425
1426    /// Locks and returns the inner state of the Socket.
1427    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
1428        self.inner.lock()
1429    }
1430}
1431
1432impl SocketOps for GenericNetlinkSocket {
1433    fn connect(
1434        &self,
1435        _socket: &SocketHandle,
1436        current_task: &CurrentTask,
1437        peer: SocketPeer,
1438    ) -> Result<(), Errno> {
1439        let mut state = self.lock();
1440        state.connect(current_task, peer)
1441    }
1442
1443    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1444        error!(EOPNOTSUPP)
1445    }
1446
1447    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1448        error!(EOPNOTSUPP)
1449    }
1450
1451    fn bind(
1452        &self,
1453        _socket: &Socket,
1454        current_task: &CurrentTask,
1455        socket_address: SocketAddress,
1456    ) -> Result<(), Errno> {
1457        let mut state = self.lock();
1458        state.bind(current_task, socket_address)
1459    }
1460
1461    fn read(
1462        &self,
1463        _socket: &Socket,
1464        _current_task: &CurrentTask,
1465        data: &mut dyn OutputBuffer,
1466        flags: SocketMessageFlags,
1467    ) -> Result<MessageReadInfo, Errno> {
1468        self.lock().read_datagram(data, flags)
1469    }
1470
1471    fn write(
1472        &self,
1473        _socket: &Socket,
1474        _current_task: &CurrentTask,
1475        data: &mut dyn InputBuffer,
1476        _dest_address: &mut Option<SocketAddress>,
1477        _ancillary_data: &mut Vec<AncillaryData>,
1478    ) -> Result<usize, Errno> {
1479        let bytes = data.read_all()?;
1480        match NetlinkMessage::<GenericMessage>::deserialize(&bytes, EmptyDeserializeGenlOptions) {
1481            Err(e) => {
1482                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1483                error!(EINVAL)
1484            }
1485            Ok(msg) => match self.message_sender.unbounded_send(msg) {
1486                Ok(()) => Ok(bytes.len()),
1487                Err(e) => {
1488                    log_warn!("Netlink receiver unexpectedly disconnected for socket: {:?}", e);
1489                    error!(EPIPE)
1490                }
1491            },
1492        }
1493    }
1494
1495    fn wait_async(
1496        &self,
1497        _socket: &Socket,
1498        _current_task: &CurrentTask,
1499        waiter: &Waiter,
1500        events: FdEvents,
1501        handler: EventHandler,
1502    ) -> WaitCanceler {
1503        self.lock().wait_async(waiter, events, handler)
1504    }
1505
1506    fn query_events(
1507        &self,
1508        _socket: &Socket,
1509        _current_task: &CurrentTask,
1510    ) -> Result<FdEvents, Errno> {
1511        Ok(self.lock().query_events() & FdEvents::POLLIN)
1512    }
1513
1514    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1515        track_stub!(TODO("https://fxbug.dev/322875507"), "GenericNetlinkSocket::shutdown");
1516        Ok(())
1517    }
1518
1519    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
1520
1521    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1522        self.lock().getsockname()
1523    }
1524
1525    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1526        self.lock().getpeername()
1527    }
1528
1529    fn getsockopt(
1530        &self,
1531        _socket: &Socket,
1532        _current_task: &CurrentTask,
1533        level: u32,
1534        optname: u32,
1535        _optlen: u32,
1536    ) -> Result<Vec<u8>, Errno> {
1537        self.lock().getsockopt(level, optname)
1538    }
1539
1540    fn setsockopt(
1541        &self,
1542        _socket: &Socket,
1543        current_task: &CurrentTask,
1544        level: u32,
1545        optname: u32,
1546        optval: SockOptValue,
1547    ) -> Result<(), Errno> {
1548        match (level, optname) {
1549            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1550                let group_id: u32 = optval.read(current_task)?;
1551                self.client.add_membership(ModernGroup(group_id))
1552            }
1553            _ => self.lock().setsockopt(current_task, level, optname, optval),
1554        }
1555    }
1556}
1557
1558/// Audit client that can be attached to the `AuditLogger`.
1559pub struct AuditNetlinkClient {
1560    /// Reference to the `AuditLogger`.
1561    audit_logger: Arc<AuditLogger>,
1562    /// The waiters queue present in `AuditNetlinkSocket`.
1563    waiters: WaitQueue,
1564    /// Optional response from the `AuditLogger`.
1565    audit_response:
1566        LockDepMutex<Option<NetlinkMessage<GenericMessage>>, AuditNetlinkClientAuditResponseLock>,
1567}
1568
1569impl AuditNetlinkClient {
1570    fn new(audit_logger: Arc<AuditLogger>) -> Self {
1571        Self { audit_logger, waiters: Default::default(), audit_response: Default::default() }
1572    }
1573
1574    pub fn notify(&self) {
1575        self.waiters.notify_fd_events(FdEvents::POLLIN);
1576    }
1577
1578    /// Function to check the capabilities of the current task against CAP_AUDIT_*
1579    fn check_audit_access(
1580        &self,
1581        current_task: &CurrentTask,
1582        request_type: &AuditRequest,
1583    ) -> Result<(), Errno> {
1584        match request_type {
1585            AuditRequest::AuditGet | AuditRequest::AuditSet => {
1586                security::check_task_capable(current_task, CAP_AUDIT_CONTROL)
1587            }
1588            AuditRequest::AuditUser => security::check_task_capable(current_task, CAP_AUDIT_WRITE),
1589        }
1590    }
1591
1592    /// Function to process request coming from userspace, it returns the response after processing
1593    fn process_request(
1594        self: &Arc<Self>,
1595        current_task: &CurrentTask,
1596        nl_message: NetlinkMessage<GenericMessage>,
1597    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1598        let (nl_header, nl_payload) = nl_message.into_parts();
1599        let audit_request_type = AuditRequest::try_from(nl_header.message_type as u32)?;
1600        self.check_audit_access(current_task, &audit_request_type)?;
1601
1602        // If there is no GenericMessage, return an ErrorMessage.
1603        let NetlinkPayload::InnerMessage(GenericMessage::Other { payload, .. }) = nl_payload else {
1604            return error!(EINVAL);
1605        };
1606        match audit_request_type {
1607            AuditRequest::AuditGet => self.process_get_status(nl_header.sequence_number),
1608            AuditRequest::AuditSet => self.process_set_status(current_task, nl_header, payload),
1609            AuditRequest::AuditUser => self.process_user_audit(nl_header, payload),
1610        }
1611    }
1612
1613    fn get_nl_response(&self, flags: SocketMessageFlags) -> Option<Vec<u8>> {
1614        if flags.contains(SocketMessageFlags::PEEK) {
1615            if let Some(message) = self.audit_response.lock().as_ref() {
1616                return Some(AuditNetlinkClient::serialize_nlmsg(message.clone()));
1617            }
1618        } else if let Some(message) = self.audit_response.lock().take() {
1619            return Some(AuditNetlinkClient::serialize_nlmsg(message));
1620        }
1621        None
1622    }
1623
1624    /// Function to read an audit message from `AuditLogger`.
1625    fn read_audit_log(self: &Arc<Self>) -> Option<Vec<u8>> {
1626        if let Some(AuditMessage { audit_type, message }) = self.audit_logger.read_audit_log(self) {
1627            return Some(AuditNetlinkClient::serialize_nlmsg(
1628                AuditNetlinkClient::build_audit_nlmsg(0, audit_type, message),
1629            ));
1630        }
1631        None
1632    }
1633
1634    /// Function to read the optional response if present or an audit message.
1635    fn read_nlmsg(self: &Arc<Self>, flags: SocketMessageFlags) -> Result<Vec<u8>, Errno> {
1636        // First check if there is a response and send it if present.
1637        // Send an audit message otherwise or return EAGAIN.
1638        self.get_nl_response(flags).or_else(|| self.read_audit_log()).ok_or_else(|| errno!(EAGAIN))
1639    }
1640
1641    fn process_get_status(
1642        &self,
1643        sequence_number: u32,
1644    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1645        Ok(AuditNetlinkClient::build_audit_nlmsg(
1646            sequence_number,
1647            AUDIT_GET as u16,
1648            self.audit_logger.get_status().as_bytes().to_vec(),
1649        ))
1650    }
1651
1652    fn process_set_status(
1653        self: &Arc<Self>,
1654        current_task: &CurrentTask,
1655        nl_hdr: NetlinkHeader,
1656        nl_payload: Vec<u8>,
1657    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1658        let Some(status) = audit_status::read_from_bytes(nl_payload.as_bytes()).ok() else {
1659            return error!(EINVAL);
1660        };
1661        self.audit_logger.set_status(current_task, status, self)?;
1662        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1663    }
1664
1665    fn process_user_audit(
1666        &self,
1667        nl_hdr: NetlinkHeader,
1668        nl_payload: Vec<u8>,
1669    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1670        let audit_msg = String::from_utf8_lossy(nl_payload.as_bytes());
1671        self.audit_logger.audit_log(nl_hdr.message_type, move || audit_msg);
1672        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1673    }
1674
1675    fn query_events(self: &Arc<Self>) -> FdEvents {
1676        if self.audit_response.lock().is_some() || self.audit_logger.get_backlog_count(self) != 0 {
1677            return FdEvents::POLLIN;
1678        }
1679        FdEvents::empty()
1680    }
1681
1682    fn detach(self: &Arc<Self>) {
1683        self.audit_logger.detach_client(self);
1684    }
1685
1686    fn build_audit_nlmsg(
1687        seq_number: u32,
1688        msg_type: u16,
1689        payload: Vec<u8>,
1690    ) -> NetlinkMessage<GenericMessage> {
1691        // The family in GenericMessage can be used for message type, not only for the Netlink Family,
1692        // because after finalizing the message, the message type is equal to family.
1693        let nl_payload =
1694            NetlinkPayload::InnerMessage(GenericMessage::Other { family: msg_type, payload });
1695        let mut nl_header = NetlinkHeader::default();
1696        nl_header.sequence_number = seq_number;
1697        let mut message = NetlinkMessage::new(nl_header, nl_payload);
1698        message.finalize();
1699        message
1700    }
1701
1702    fn build_audit_ack(
1703        error: Result<(), Errno>,
1704        req_header: NetlinkHeader,
1705    ) -> NetlinkMessage<GenericMessage> {
1706        let error = {
1707            assert_eq!(req_header.buffer_len(), NETLINK_HEADER_LEN);
1708            let mut buffer = vec![0; NETLINK_HEADER_LEN];
1709            req_header.emit(&mut buffer);
1710
1711            let code = match error {
1712                Ok(()) => None,
1713                Err(e) => Some(
1714                    // Audit netlink errors are negative.
1715                    NonZeroI32::new(-(e.code.error_code() as i32))
1716                        .expect("Errno's code must be non-zero"),
1717                ),
1718            };
1719
1720            let mut error = ErrorMessage::default();
1721            error.code = code;
1722            error.header = buffer;
1723            error
1724        };
1725
1726        let payload = NetlinkPayload::<GenericMessage>::Error(error);
1727        let mut resp_header = NetlinkHeader::default();
1728        resp_header.message_type = NLMSG_ERROR;
1729        resp_header.sequence_number = req_header.sequence_number;
1730        let mut message = NetlinkMessage::new(resp_header, payload);
1731        message.finalize();
1732        message
1733    }
1734
1735    fn serialize_nlmsg(message: NetlinkMessage<GenericMessage>) -> Vec<u8> {
1736        let mut buf = vec![0; message.buffer_len()];
1737        message.serialize(&mut buf);
1738        buf
1739    }
1740}
1741
1742/// Audit Netlink Socket structure.
1743pub struct AuditNetlinkSocket {
1744    /// Reference to the `AuditNetlinkClient` associated with self.
1745    audit_client: Arc<AuditNetlinkClient>,
1746}
1747
1748impl AuditNetlinkSocket {
1749    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1750        if kernel.audit_logger().is_disabled() {
1751            return error!(EPROTONOSUPPORT);
1752        }
1753        Ok(Self { audit_client: Arc::new(AuditNetlinkClient::new(kernel.audit_logger())) })
1754    }
1755}
1756
1757impl SocketOps for AuditNetlinkSocket {
1758    fn read(
1759        &self,
1760        _socket: &Socket,
1761        _current_task: &CurrentTask,
1762        data: &mut dyn OutputBuffer,
1763        flags: SocketMessageFlags,
1764    ) -> Result<MessageReadInfo, Errno> {
1765        let buf = self.audit_client.read_nlmsg(flags)?;
1766
1767        let size = data.write_all(buf.as_bytes())?;
1768        Ok(MessageReadInfo {
1769            bytes_read: size,
1770            message_length: size,
1771            address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
1772            ancillary_data: vec![],
1773        })
1774    }
1775
1776    fn write(
1777        &self,
1778        socket: &Socket,
1779        current_task: &CurrentTask,
1780        data: &mut dyn InputBuffer,
1781        _dest_address: &mut Option<SocketAddress>,
1782        _ancillary_data: &mut Vec<AncillaryData>,
1783    ) -> Result<usize, Errno> {
1784        match NetlinkMessage::<GenericMessage>::deserialize(
1785            &(data.peek_all()?),
1786            EmptyDeserializeGenlOptions,
1787        ) {
1788            Ok(nl_message) => {
1789                let header = nl_message.header;
1790                security::check_netlink_send_access(current_task, socket, header.message_type)?;
1791
1792                // Send request to the `AuditNetlinkClient`.
1793                let audit_ack = self
1794                    .audit_client
1795                    .process_request(current_task, nl_message)
1796                    .map_err(|e| AuditNetlinkClient::build_audit_ack(Err(e), header))
1797                    .unwrap_or_else(|nlerr| nlerr);
1798                *self.audit_client.audit_response.lock() = Some(audit_ack);
1799                data.drain();
1800                Ok(header.length as usize)
1801            }
1802            Err(e) => {
1803                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1804                error!(EINVAL)
1805            }
1806        }
1807    }
1808
1809    fn wait_async(
1810        &self,
1811        _socket: &Socket,
1812        _current_task: &CurrentTask,
1813        waiter: &Waiter,
1814        events: FdEvents,
1815        handler: EventHandler,
1816    ) -> WaitCanceler {
1817        self.audit_client.waiters.wait_async_fd_events(waiter, events, handler)
1818    }
1819
1820    fn query_events(
1821        &self,
1822        _socket: &Socket,
1823        _current_task: &CurrentTask,
1824    ) -> Result<FdEvents, Errno> {
1825        Ok(self.audit_client.query_events() & FdEvents::POLLIN)
1826    }
1827
1828    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1829        // If the `AuditNetlinkClient` disconnects, detach it.
1830        self.audit_client.detach();
1831    }
1832
1833    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1834        error!(EOPNOTSUPP)
1835    }
1836
1837    fn connect(
1838        &self,
1839        _socket: &SocketHandle,
1840        _current_task: &CurrentTask,
1841        _peer: SocketPeer,
1842    ) -> Result<(), Errno> {
1843        error!(EOPNOTSUPP)
1844    }
1845
1846    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1847        error!(EOPNOTSUPP)
1848    }
1849
1850    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1851        error!(EOPNOTSUPP)
1852    }
1853
1854    fn bind(
1855        &self,
1856        _socket: &Socket,
1857        _current_task: &CurrentTask,
1858        _socket_address: SocketAddress,
1859    ) -> Result<(), Errno> {
1860        error!(EOPNOTSUPP)
1861    }
1862
1863    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1864        error!(EOPNOTSUPP)
1865    }
1866
1867    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1868        error!(EOPNOTSUPP)
1869    }
1870
1871    fn getsockopt(
1872        &self,
1873        _socket: &Socket,
1874        _current_task: &CurrentTask,
1875        _level: u32,
1876        _optname: u32,
1877        _optlen: u32,
1878    ) -> Result<Vec<u8>, Errno> {
1879        error!(EOPNOTSUPP)
1880    }
1881
1882    fn setsockopt(
1883        &self,
1884        _socket: &Socket,
1885        _current_task: &CurrentTask,
1886        _level: u32,
1887        _optname: u32,
1888        _optval: SockOptValue,
1889    ) -> Result<(), Errno> {
1890        error!(EOPNOTSUPP)
1891    }
1892}
1893
1894#[cfg(test)]
1895mod tests {
1896    use super::*;
1897
1898    use netlink_packet_route::route::RouteMessage;
1899    use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
1900    use test_case::test_case;
1901
1902    // Successfully send the message and observe it's stored in the queue.
1903    #[test_case(true; "sufficient_capacity")]
1904    // Attempting to send when the queue is full should succeed by increasing
1905    // the size of the queue.
1906    #[test_case(false; "insufficient_capacity")]
1907    fn test_netlink_to_client_sender(sufficient_capacity: bool) {
1908        const MODERN_GROUP: u32 = 5;
1909
1910        let mut message: NetlinkMessage<RouteNetlinkMessage> =
1911            RouteNetlinkMessage::NewRoute(RouteMessage::default()).into();
1912        message.finalize();
1913
1914        let (initial_queue_size, final_queue_size) = if sufficient_capacity {
1915            (SOCKET_DEFAULT_SIZE, SOCKET_DEFAULT_SIZE)
1916        } else {
1917            (0, message.buffer_len())
1918        };
1919
1920        let socket_inner = Arc::new(LockDepMutex::new(NetlinkSocketInner {
1921            receive_buffer: MessageQueue::new(initial_queue_size),
1922            ..NetlinkSocketInner::new(NetlinkFamily::Route)
1923        }));
1924
1925        let mut sender = NetlinkToClientSender::<RouteNetlinkMessage>::new(socket_inner.clone());
1926        sender.send(message.clone(), Some(ModernGroup(MODERN_GROUP)));
1927        let Message { data, address, ancillary_data: _ } =
1928            socket_inner.lock().read_message().expect("should read message");
1929
1930        assert_eq!(
1931            address,
1932            Some(SocketAddress::Netlink(NetlinkAddress { pid: 0, groups: 1 << MODERN_GROUP }))
1933        );
1934        let actual_message = NetlinkMessage::<RouteNetlinkMessage>::deserialize(
1935            &data,
1936            RouteNetlinkMessageParseMode::Strict,
1937        )
1938        .expect("message should deserialize into RtnlMessage");
1939        assert_eq!(actual_message, message);
1940        assert_eq!(socket_inner.lock().receive_buffer.capacity(), final_queue_size);
1941    }
1942
1943    fn getsockopt_u32(socket: &NetlinkSocketInner, level: u32, optname: u32) -> u32 {
1944        let byte_vec = socket.getsockopt(level, optname).expect("getsockopt should succeed");
1945        let bytes: [u8; 4] = byte_vec.as_slice().try_into().expect("expected 4 bytes");
1946        u32::from_ne_bytes(bytes)
1947    }
1948
1949    fn sock_opt_value(val: u32) -> SockOptValue {
1950        SockOptValue::Value(val.to_ne_bytes().to_vec())
1951    }
1952
1953    #[::fuchsia::test]
1954    async fn test_set_get_snd_rcv_buf() {
1955        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1956            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
1957
1958            // Verify initialization uses the default value.
1959            let expected_default = u32::try_from(SOCKET_DEFAULT_SIZE).unwrap();
1960            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_default);
1961            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_default);
1962
1963            // Set new values and observe that they were applied.
1964            // Note that applied value is 2 times the requested value.
1965            const SNDBUF_SIZE: u32 = 12345;
1966            const RCVBUF_SIZE: u32 = 54321;
1967            socket
1968                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(SNDBUF_SIZE))
1969                .expect("setsockopt should succeed");
1970            socket
1971                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(RCVBUF_SIZE))
1972                .expect("setsockopt should succeed");
1973            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), SNDBUF_SIZE * 2);
1974            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), RCVBUF_SIZE * 2);
1975        })
1976        .await;
1977    }
1978
1979    #[::fuchsia::test]
1980    async fn test_snd_rcv_buf_limits() {
1981        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1982            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
1983            let too_big = u32::try_from(SOCKET_MAX_SIZE).unwrap() + 1;
1984
1985            // SO_SNDBUF and SO_RCVBUF clamp the size to the limit.
1986            socket
1987                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(too_big))
1988                .expect("setsockopt should succeed");
1989            socket
1990                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(too_big))
1991                .expect("setsockopt should succeed");
1992            let expected_max = u32::try_from(SOCKET_MAX_SIZE).unwrap();
1993            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_max);
1994            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_max);
1995
1996            // SO_SNDBUFFORCE and SO_RCVBUFFORCE do not.
1997            // Note that the applied value is two times the requested value.
1998            socket
1999                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUFFORCE, sock_opt_value(too_big))
2000                .expect("setsockopt should succeed");
2001            socket
2002                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUFFORCE, sock_opt_value(too_big))
2003                .expect("setsockopt should succeed");
2004            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), too_big * 2);
2005            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), too_big * 2);
2006        })
2007        .await;
2008    }
2009}
starnix_core/vfs/socket/socket_netlink.rs

starnix_core/vfs/socket/
socket_netlink.rs
