starnix_core/vfs/socket/
socket_netlink.rs

1// Copyright 2022 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::security::{self, AuditLogger, AuditMessage, AuditRequest};
6use crate::vfs::socket::{SockOptValue, SocketDomain};
7use futures::channel::mpsc::{
8    UnboundedReceiver, UnboundedSender, {self},
9};
10use linux_uapi::{AUDIT_GET, NETLINK_GET_STRICT_CHK, audit_status};
11use netlink::messaging::{
12    AccessControl, MessageWithPermission, NetlinkContext, NetlinkMessageWithCreds, Permission,
13    Sender, UnparsedNetlinkMessage,
14};
15use netlink::multicast_groups::{
16    InvalidLegacyGroupsError, InvalidModernGroupError, LegacyGroups, ModernGroup,
17    NoMappingFromModernToLegacyGroupError, SingleLegacyGroup,
18};
19use netlink::protocol_family::NetlinkClient;
20use netlink::protocol_family::route::NetlinkRouteClient;
21use netlink::protocol_family::sock_diag::NetlinkSockDiagClient;
22use netlink::{NETLINK_LOG_TAG, NewClientError};
23use netlink_packet_core::{
24    ErrorMessage, NETLINK_HEADER_LEN, NLMSG_ERROR, NetlinkBuffer, NetlinkDeserializable,
25    NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
26};
27use netlink_packet_generic::message::EmptyDeserializeOptions as EmptyDeserializeGenlOptions;
28use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
29use netlink_packet_sock_diag::SockDiagRequest;
30use netlink_packet_sock_diag::message::EmptyDeserializeOptions as EmptyDeserializeSockDiagOptions;
31use netlink_packet_utils::{DecodeError, Emitable as _};
32use starnix_sync::{
33    AuditNetlinkClientAuditResponseLock, LockDepGuard, LockDepMutex, NetlinkSocketInnerLock,
34    NflogListenersLock, UEventNetlinkSocketDeviceListenerKeyLock,
35};
36use std::io::Write;
37use std::marker::PhantomData;
38use std::num::{NonZeroI32, NonZeroU32};
39use std::sync::Arc;
40use zerocopy::{FromBytes, IntoBytes};
41
42use crate::device::kobject::{Device, UEventAction, UEventContext, flatten_uevent_properties};
43use crate::device::{DeviceListener, DeviceListenerKey};
44use crate::task::{CurrentTask, EventHandler, Kernel, WaitCanceler, WaitQueue, Waiter};
45use crate::vfs::buffers::{
46    AncillaryData, InputBuffer, Message, MessageQueue, MessageReadInfo, OutputBuffer,
47    UnixControlData, VecInputBuffer,
48};
49use crate::vfs::socket::{
50    GenericMessage, GenericNetlinkClientHandle, Socket, SocketAddress, SocketHandle,
51    SocketMessageFlags, SocketOps, SocketPeer, SocketShutdownFlags, SocketType,
52};
53use starnix_logging::{log_debug, log_error, log_warn, track_stub};
54use starnix_uapi::auth::{CAP_AUDIT_CONTROL, CAP_AUDIT_WRITE, CAP_NET_ADMIN, Credentials};
55use starnix_uapi::errors::Errno;
56use starnix_uapi::vfs::FdEvents;
57use starnix_uapi::{
58    AF_NETLINK, NETLINK_ADD_MEMBERSHIP, NETLINK_AUDIT, NETLINK_CONNECTOR, NETLINK_CRYPTO,
59    NETLINK_DNRTMSG, NETLINK_DROP_MEMBERSHIP, NETLINK_ECRYPTFS, NETLINK_FIB_LOOKUP,
60    NETLINK_FIREWALL, NETLINK_GENERIC, NETLINK_IP6_FW, NETLINK_ISCSI, NETLINK_KOBJECT_UEVENT,
61    NETLINK_NETFILTER, NETLINK_NFLOG, NETLINK_RDMA, NETLINK_ROUTE, NETLINK_SCSITRANSPORT,
62    NETLINK_SELINUX, NETLINK_SMC, NETLINK_SOCK_DIAG, NETLINK_USERSOCK, NETLINK_XFRM, NLM_F_MULTI,
63    NLMSG_DONE, SO_PASSCRED, SO_PROTOCOL, SO_RCVBUF, SO_RCVBUFFORCE, SO_SNDBUF, SO_SNDBUFFORCE,
64    SO_TIMESTAMP, SOL_SOCKET, errno, error, nlmsghdr, sockaddr_nl, socklen_t, ucred,
65};
66
67// From netlink/socket.go in gVisor.
68pub const SOCKET_MIN_SIZE: usize = 4 << 10;
69pub const SOCKET_DEFAULT_SIZE: usize = 16 * 1024;
70pub const SOCKET_MAX_SIZE: usize = 4 << 20;
71
72// From linux/socket.go in gVisor.
73const SOL_NETLINK: u32 = 270;
74
75pub fn new_netlink_socket(
76    kernel: &Arc<Kernel>,
77    socket_type: SocketType,
78    family: NetlinkFamily,
79) -> Result<Box<dyn SocketOps>, Errno> {
80    log_debug!(tag = NETLINK_LOG_TAG; "Creating {:?} Netlink Socket", family);
81    if socket_type != SocketType::Datagram && socket_type != SocketType::Raw {
82        return error!(ESOCKTNOSUPPORT);
83    }
84
85    let ops: Box<dyn SocketOps> = match family {
86        NetlinkFamily::KobjectUevent => Box::new(UEventNetlinkSocket::default()),
87        NetlinkFamily::Route => Box::new(new_route_socket(kernel)?),
88        NetlinkFamily::Generic => Box::new(GenericNetlinkSocket::new(kernel)?),
89        NetlinkFamily::SockDiag => Box::new(new_sock_diag_socket(kernel)?),
90        NetlinkFamily::Audit => Box::new(AuditNetlinkSocket::new(kernel)?),
91        NetlinkFamily::Nflog => {
92            let inner = Arc::new(NetlinkSocketInner::new(NetlinkFamily::Nflog).into());
93            Box::new(NflogNetlinkSocket::new(inner))
94        }
95        NetlinkFamily::Usersock
96        | NetlinkFamily::Firewall
97        | NetlinkFamily::Xfrm
98        | NetlinkFamily::Selinux
99        | NetlinkFamily::Iscsi
100        | NetlinkFamily::FibLookup
101        | NetlinkFamily::Connector
102        | NetlinkFamily::Netfilter
103        | NetlinkFamily::Ip6Fw
104        | NetlinkFamily::Dnrtmsg
105        | NetlinkFamily::Scsitransport
106        | NetlinkFamily::Ecryptfs
107        | NetlinkFamily::Rdma
108        | NetlinkFamily::Crypto
109        | NetlinkFamily::Smc => Box::new(StubbedNetlinkSocket::new(family)),
110        NetlinkFamily::Invalid => return error!(EINVAL),
111    };
112    Ok(ops)
113}
114
115#[derive(Default, Debug, Clone, PartialEq, Eq)]
116#[repr(C)]
117pub struct NetlinkAddress {
118    pid: u32,
119    groups: u32,
120}
121
122impl NetlinkAddress {
123    pub fn new(pid: u32, groups: u32) -> Self {
124        NetlinkAddress { pid, groups }
125    }
126
127    pub fn set_pid_if_zero(&mut self, pid: i32) {
128        if self.pid == 0 {
129            self.pid = pid as u32;
130        }
131    }
132
133    pub fn to_bytes(&self) -> Vec<u8> {
134        sockaddr_nl { nl_family: AF_NETLINK, nl_pid: self.pid, nl_pad: 0, nl_groups: self.groups }
135            .as_bytes()
136            .to_vec()
137    }
138}
139
140#[derive(Debug, Hash, Eq, PartialEq, Clone)]
141pub enum NetlinkFamily {
142    Invalid,
143    Route,
144    Usersock,
145    Firewall,
146    SockDiag,
147    Nflog,
148    Xfrm,
149    Selinux,
150    Iscsi,
151    Audit,
152    FibLookup,
153    Connector,
154    Netfilter,
155    Ip6Fw,
156    Dnrtmsg,
157    KobjectUevent,
158    Generic,
159    Scsitransport,
160    Ecryptfs,
161    Rdma,
162    Crypto,
163    Smc,
164}
165
166impl NetlinkFamily {
167    pub fn from_raw(family: u32) -> Self {
168        match family {
169            NETLINK_ROUTE => NetlinkFamily::Route,
170            NETLINK_USERSOCK => NetlinkFamily::Usersock,
171            NETLINK_FIREWALL => NetlinkFamily::Firewall,
172            NETLINK_SOCK_DIAG => NetlinkFamily::SockDiag,
173            NETLINK_NFLOG => NetlinkFamily::Nflog,
174            NETLINK_XFRM => NetlinkFamily::Xfrm,
175            NETLINK_SELINUX => NetlinkFamily::Selinux,
176            NETLINK_ISCSI => NetlinkFamily::Iscsi,
177            NETLINK_AUDIT => NetlinkFamily::Audit,
178            NETLINK_FIB_LOOKUP => NetlinkFamily::FibLookup,
179            NETLINK_CONNECTOR => NetlinkFamily::Connector,
180            NETLINK_NETFILTER => NetlinkFamily::Netfilter,
181            NETLINK_IP6_FW => NetlinkFamily::Ip6Fw,
182            NETLINK_DNRTMSG => NetlinkFamily::Dnrtmsg,
183            NETLINK_KOBJECT_UEVENT => NetlinkFamily::KobjectUevent,
184            NETLINK_GENERIC => NetlinkFamily::Generic,
185            NETLINK_SCSITRANSPORT => NetlinkFamily::Scsitransport,
186            NETLINK_ECRYPTFS => NetlinkFamily::Ecryptfs,
187            NETLINK_RDMA => NetlinkFamily::Rdma,
188            NETLINK_CRYPTO => NetlinkFamily::Crypto,
189            NETLINK_SMC => NetlinkFamily::Smc,
190            _ => NetlinkFamily::Invalid,
191        }
192    }
193
194    pub fn as_raw(&self) -> u32 {
195        match self {
196            NetlinkFamily::Route => NETLINK_ROUTE,
197            NetlinkFamily::KobjectUevent => NETLINK_KOBJECT_UEVENT,
198            NetlinkFamily::Audit => NETLINK_AUDIT,
199            _ => 0,
200        }
201    }
202}
203
204struct NetlinkSocketInner {
205    /// The specific type of netlink socket.
206    family: NetlinkFamily,
207
208    /// The [`MessageQueue`] that contains messages from netlink to the client.
209    receive_buffer: MessageQueue,
210
211    /// The socket's send buffer size. Note, This value is only used
212    /// to serve getsockopt calls for `SO_SNDBUF`. It does not yet enforce a
213    /// limit on the number of messages netlink will buffer from the client.
214    /// TODO(https://fxbug.dev/285880057): Limit the size of the send buffer.
215    send_buf_size: usize,
216
217    /// This queue will be notified on reads, writes, disconnects etc.
218    waiters: WaitQueue,
219
220    /// The address of this socket.
221    address: Option<NetlinkAddress>,
222
223    /// See SO_PASSCRED.
224    pub passcred: bool,
225
226    /// See SO_TIMESTAMP.
227    pub timestamp: bool,
228
229    /// See NETLINK_GET_STRICT_CHK.
230    pub strict_chk: bool,
231}
232
233impl NetlinkSocketInner {
234    fn new(family: NetlinkFamily) -> Self {
235        Self {
236            family,
237            receive_buffer: MessageQueue::new(SOCKET_DEFAULT_SIZE),
238            send_buf_size: SOCKET_DEFAULT_SIZE,
239            waiters: WaitQueue::default(),
240            address: None,
241            passcred: false,
242            timestamp: false,
243            strict_chk: false,
244        }
245    }
246
247    fn bind(
248        &mut self,
249        current_task: &CurrentTask,
250        socket_address: SocketAddress,
251    ) -> Result<(), Errno> {
252        if self.address.is_some() {
253            return error!(EINVAL);
254        }
255
256        let netlink_address = match socket_address {
257            SocketAddress::Netlink(mut netlink_address) => {
258                // TODO: Support distinct IDs for processes with multiple netlink sockets.
259                netlink_address.set_pid_if_zero(current_task.get_pid());
260                netlink_address
261            }
262            _ => return error!(EINVAL),
263        };
264
265        self.address = Some(netlink_address);
266        Ok(())
267    }
268
269    fn connect(&mut self, current_task: &CurrentTask, peer: SocketPeer) -> Result<(), Errno> {
270        let address = match peer {
271            SocketPeer::Address(address) => address,
272            _ => return error!(EINVAL),
273        };
274        // Connect is equivalent to bind, but error are ignored.
275        let _ = self.bind(current_task, address);
276        Ok(())
277    }
278
279    fn read_message(&mut self) -> Option<Message> {
280        let message = self.receive_buffer.read_message();
281        if message.is_some() {
282            self.waiters.notify_fd_events(FdEvents::POLLOUT);
283        }
284        message
285    }
286
287    fn read_datagram(
288        &mut self,
289        data: &mut dyn OutputBuffer,
290        flags: SocketMessageFlags,
291    ) -> Result<MessageReadInfo, Errno> {
292        let (mut info, has_message) = if flags.contains(SocketMessageFlags::PEEK) {
293            self.receive_buffer.peek_datagram(data)
294        } else {
295            self.receive_buffer.read_datagram(data)
296        }?;
297        if !has_message {
298            return error!(EAGAIN);
299        }
300
301        if let Some(creds) = info.credentials {
302            info.ancillary_data.insert(0, AncillaryData::Unix(UnixControlData::Credentials(creds)));
303        }
304        if self.passcred {
305            track_stub!(TODO("https://fxbug.dev/297373991"), "SCM_CREDENTIALS/SO_PASSCRED");
306            info.ancillary_data.push(AncillaryData::Unix(UnixControlData::unknown_creds()));
307        }
308
309        Ok(info)
310    }
311
312    fn write_to_queue(
313        &mut self,
314        data: &mut dyn InputBuffer,
315        address: Option<NetlinkAddress>,
316        credentials: Option<ucred>,
317        ancillary_data: &mut Vec<AncillaryData>,
318    ) -> Result<usize, Errno> {
319        let socket_address = match address {
320            Some(addr) => Some(SocketAddress::Netlink(addr)),
321            None => self.address.as_ref().map(|addr| SocketAddress::Netlink(addr.clone())),
322        };
323        let bytes_written = self.receive_buffer.write_datagram(
324            data,
325            socket_address,
326            credentials,
327            ancillary_data,
328        )?;
329        if bytes_written > 0 {
330            self.waiters.notify_fd_events(FdEvents::POLLIN);
331        }
332        Ok(bytes_written)
333    }
334
335    fn wait_async(
336        &mut self,
337        waiter: &Waiter,
338        events: FdEvents,
339        handler: EventHandler,
340    ) -> WaitCanceler {
341        self.waiters.wait_async_fd_events(waiter, events, handler)
342    }
343
344    fn query_events(&self) -> FdEvents {
345        self.receive_buffer.query_events()
346    }
347
348    fn getsockname(&self) -> Result<SocketAddress, Errno> {
349        match &self.address {
350            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
351            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
352        }
353    }
354
355    fn getpeername(&self) -> Result<SocketAddress, Errno> {
356        match &self.address {
357            Some(addr) => Ok(SocketAddress::Netlink(addr.clone())),
358            _ => Ok(SocketAddress::default_for_domain(SocketDomain::Netlink)),
359        }
360    }
361
362    fn getsockopt(&self, level: u32, optname: u32) -> Result<Vec<u8>, Errno> {
363        let opt_value = match level {
364            SOL_SOCKET => match optname {
365                SO_PASSCRED => (self.passcred as u32).as_bytes().to_vec(),
366                SO_TIMESTAMP => (self.timestamp as u32).as_bytes().to_vec(),
367                SO_SNDBUF => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
368                SO_RCVBUF => (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec(),
369                SO_SNDBUFFORCE => (self.send_buf_size as socklen_t).to_ne_bytes().to_vec(),
370                SO_RCVBUFFORCE => {
371                    (self.receive_buffer.capacity() as socklen_t).to_ne_bytes().to_vec()
372                }
373                SO_PROTOCOL => self.family.as_raw().as_bytes().to_vec(),
374                _ => return error!(ENOSYS),
375            },
376            SOL_NETLINK => match optname {
377                NETLINK_GET_STRICT_CHK => (self.strict_chk as u32).as_bytes().to_vec(),
378                _ => return error!(ENOSYS),
379            },
380            _ => vec![],
381        };
382
383        Ok(opt_value)
384    }
385
386    fn setsockopt(
387        &mut self,
388        current_task: &CurrentTask,
389        level: u32,
390        optname: u32,
391        optval: SockOptValue,
392    ) -> Result<(), Errno> {
393        match level {
394            SOL_SOCKET => match optname {
395                SO_SNDBUF => {
396                    let requested_capacity: socklen_t = optval.read(current_task)?;
397                    // SO_SNDBUF doubles the requested capacity to leave space for bookkeeping.
398                    // See https://man7.org/linux/man-pages/man7/socket.7.html
399                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
400                    // TODO(https://fxbug.dev/322907334): Clamp to `wmem_max`.
401                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
402                    self.send_buf_size = capacity;
403                }
404                SO_SNDBUFFORCE => {
405                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
406                    let requested_capacity: socklen_t = optval.read(current_task)?;
407                    // SO_SNDBUFFORE doubles the requested capacity to leave space for bookkeeping.
408                    // See https://man7.org/linux/man-pages/man7/socket.7.html
409                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
410                    self.send_buf_size = capacity;
411                }
412                SO_RCVBUF => {
413                    let requested_capacity: socklen_t = optval.read(current_task)?;
414                    // SO_RCVBUF doubles the requested capacity to leave space for bookkeeping.
415                    // See https://man7.org/linux/man-pages/man7/socket.7.html
416                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
417                    // TODO(https://fxbug.dev/322906968): Clamp to `rmem_max`.
418                    let capacity = capacity.clamp(SOCKET_MIN_SIZE, SOCKET_MAX_SIZE);
419                    self.receive_buffer.set_capacity(capacity)?;
420                }
421                SO_RCVBUFFORCE => {
422                    security::check_task_capable(current_task, CAP_NET_ADMIN)?;
423                    let requested_capacity: socklen_t = optval.read(current_task)?;
424                    // SO_RCVBUFFORE doubles the requested capacity to leave space for bookkeeping.
425                    // See https://man7.org/linux/man-pages/man7/socket.7.html
426                    let capacity = usize::try_from(requested_capacity * 2).unwrap_or(usize::MAX);
427                    self.receive_buffer.set_capacity(capacity)?;
428                }
429                SO_PASSCRED => {
430                    let passcred: u32 = optval.read(current_task)?;
431                    self.passcred = passcred != 0;
432                }
433                SO_TIMESTAMP => {
434                    let timestamp: u32 = optval.read(current_task)?;
435                    self.timestamp = timestamp != 0;
436                }
437                _ => return error!(ENOSYS),
438            },
439            SOL_NETLINK => match optname {
440                NETLINK_GET_STRICT_CHK => {
441                    let strict_chk: u32 = optval.read(current_task)?;
442                    self.strict_chk = strict_chk != 0;
443                }
444                _ => return error!(ENOSYS),
445            },
446            _ => return error!(ENOSYS),
447        }
448
449        Ok(())
450    }
451}
452
453struct NflogListener {
454    inner: std::sync::Weak<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
455}
456
457static NFLOG_LISTENERS: std::sync::LazyLock<LockDepMutex<Vec<NflogListener>, NflogListenersLock>> =
458    std::sync::LazyLock::new(|| LockDepMutex::new(Vec::new()));
459
460struct NflogNetlinkSocket {
461    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
462}
463
464impl NflogNetlinkSocket {
465    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
466        NFLOG_LISTENERS.lock().push(NflogListener { inner: Arc::downgrade(&inner) });
467        Self { inner }
468    }
469
470    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
471        self.inner.lock()
472    }
473}
474
475impl Drop for NflogNetlinkSocket {
476    fn drop(&mut self) {
477        let mut listeners = NFLOG_LISTENERS.lock();
478        listeners.retain(|l| {
479            if let Some(arc) = l.inner.upgrade() { !Arc::ptr_eq(&arc, &self.inner) } else { false }
480        });
481    }
482}
483
484impl SocketOps for NflogNetlinkSocket {
485    fn connect(
486        &self,
487        _socket: &SocketHandle,
488        current_task: &CurrentTask,
489        peer: SocketPeer,
490    ) -> Result<(), Errno> {
491        self.lock().connect(current_task, peer)
492    }
493
494    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
495        error!(EOPNOTSUPP)
496    }
497
498    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
499        error!(EOPNOTSUPP)
500    }
501
502    fn bind(
503        &self,
504        _socket: &Socket,
505        current_task: &CurrentTask,
506        socket_address: SocketAddress,
507    ) -> Result<(), Errno> {
508        self.lock().bind(current_task, socket_address)
509    }
510
511    fn read(
512        &self,
513        _socket: &Socket,
514        _current_task: &CurrentTask,
515        data: &mut dyn OutputBuffer,
516        flags: SocketMessageFlags,
517    ) -> Result<MessageReadInfo, Errno> {
518        self.lock().read_datagram(data, flags)
519    }
520
521    fn write(
522        &self,
523        _socket: &Socket,
524        _current_task: &CurrentTask,
525        _data: &mut dyn InputBuffer,
526        _dest_address: &mut Option<SocketAddress>,
527        _ancillary_data: &mut Vec<AncillaryData>,
528    ) -> Result<usize, Errno> {
529        error!(EOPNOTSUPP)
530    }
531
532    fn wait_async(
533        &self,
534        _socket: &Socket,
535        _current_task: &CurrentTask,
536        waiter: &Waiter,
537        events: FdEvents,
538        handler: EventHandler,
539    ) -> WaitCanceler {
540        self.lock().wait_async(waiter, events, handler)
541    }
542
543    fn query_events(
544        &self,
545        _socket: &Socket,
546        _current_task: &CurrentTask,
547    ) -> Result<FdEvents, Errno> {
548        Ok(self.lock().query_events() & FdEvents::POLLIN)
549    }
550
551    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
552        Ok(())
553    }
554
555    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
556
557    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
558        self.lock().getsockname()
559    }
560
561    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
562        self.lock().getpeername()
563    }
564
565    fn getsockopt(
566        &self,
567        _socket: &Socket,
568        _current_task: &CurrentTask,
569        level: u32,
570        optname: u32,
571        _optlen: u32,
572    ) -> Result<Vec<u8>, Errno> {
573        self.lock().getsockopt(level, optname)
574    }
575
576    fn setsockopt(
577        &self,
578        _socket: &Socket,
579        current_task: &CurrentTask,
580        level: u32,
581        optname: u32,
582        optval: SockOptValue,
583    ) -> Result<(), Errno> {
584        self.lock().setsockopt(current_task, level, optname, optval)
585    }
586}
587
588fn write_attr(buf: &mut Vec<u8>, attr_type: u16, data: &[u8]) {
589    let len = 4 + data.len();
590    buf.extend_from_slice(&(len as u16).to_ne_bytes());
591    buf.extend_from_slice(&attr_type.to_ne_bytes());
592    buf.extend_from_slice(data);
593    let pad = (4 - (data.len() % 4)) % 4;
594    for _ in 0..pad {
595        buf.push(0);
596    }
597}
598
599pub fn send_fake_nflog_message(uid: u32) {
600    const NFNL_SUBSYS_ULOG: u16 = 4;
601    const NFULNL_MSG_PACKET: u8 = 0;
602    const LOCAL_NFLOG_PACKET: u16 = (NFNL_SUBSYS_ULOG << 8) | (NFULNL_MSG_PACKET as u16);
603    const NFULA_PAYLOAD: u16 = 9;
604    const NFULA_UID: u16 = 11;
605
606    let mut msg_body = vec![0u8; 4]; // 4 bytes of nfgenmsg header
607
608    // Write UID attribute
609    let uid_bytes = uid.to_be_bytes();
610    write_attr(&mut msg_body, NFULA_UID, &uid_bytes);
611
612    // Write PAYLOAD attribute (placeholder IPv4 header)
613    let mut ip_hdr = vec![0u8; 20];
614    ip_hdr[0] = 0x45; // Version 4, IHL 5
615    ip_hdr[12..16].copy_from_slice(&[127, 0, 0, 1]);
616    ip_hdr[16..20].copy_from_slice(&[8, 8, 8, 8]);
617    write_attr(&mut msg_body, NFULA_PAYLOAD, &ip_hdr);
618
619    // Construct nlmsghdr
620    let total_len = 16 + msg_body.len();
621    let mut packet = vec![];
622    packet.extend_from_slice(&(total_len as u32).to_ne_bytes());
623    packet.extend_from_slice(&LOCAL_NFLOG_PACKET.to_ne_bytes());
624    packet.extend_from_slice(&0u16.to_ne_bytes()); // flags
625    packet.extend_from_slice(&0u32.to_ne_bytes()); // seq
626    packet.extend_from_slice(&0u32.to_ne_bytes()); // pid
627    packet.extend_from_slice(&msg_body);
628
629    // Broadcast to all listeners
630    let listeners = NFLOG_LISTENERS.lock();
631
632    for listener in listeners.iter() {
633        if let Some(socket) = listener.inner.upgrade() {
634            let _ = socket.lock().write_to_queue(
635                &mut VecInputBuffer::new(&packet),
636                Some(NetlinkAddress { pid: 0, groups: 1 }),
637                Some(Default::default()),
638                &mut Vec::new(),
639            );
640        }
641    }
642}
643
644/// A fake Netlink socket that loops messages back to the client.
645///
646/// Used as a placeholder implementation for protocol families that lack a real
647/// implementation.
648struct StubbedNetlinkSocket {
649    inner: LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>,
650}
651
652impl StubbedNetlinkSocket {
653    pub fn new(family: NetlinkFamily) -> Self {
654        track_stub!(
655            TODO("https://fxbug.dev/278565021"),
656            format!("Creating StubbedNetlinkSocket: {:?}", family).as_str()
657        );
658        StubbedNetlinkSocket { inner: NetlinkSocketInner::new(family).into() }
659    }
660
661    /// Locks and returns the inner state of the Socket.
662    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
663        self.inner.lock()
664    }
665}
666
667impl SocketOps for StubbedNetlinkSocket {
668    fn connect(
669        &self,
670        _socket: &SocketHandle,
671        current_task: &CurrentTask,
672        peer: SocketPeer,
673    ) -> Result<(), Errno> {
674        self.lock().connect(current_task, peer)
675    }
676
677    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
678        error!(EOPNOTSUPP)
679    }
680
681    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
682        error!(EOPNOTSUPP)
683    }
684
685    fn bind(
686        &self,
687        _socket: &Socket,
688        current_task: &CurrentTask,
689        socket_address: SocketAddress,
690    ) -> Result<(), Errno> {
691        self.lock().bind(current_task, socket_address)
692    }
693
694    fn read(
695        &self,
696        _socket: &Socket,
697        _current_task: &CurrentTask,
698        data: &mut dyn OutputBuffer,
699        _flags: SocketMessageFlags,
700    ) -> Result<MessageReadInfo, Errno> {
701        let msg = self.lock().read_message();
702        match msg {
703            Some(message) => {
704                // Mark the message as complete and return it.
705                let (mut nl_msg, _) =
706                    nlmsghdr::read_from_prefix(&message.data).map_err(|_| errno!(EINVAL))?;
707                nl_msg.nlmsg_type = NLMSG_DONE as u16;
708                nl_msg.nlmsg_flags &= NLM_F_MULTI as u16;
709                let msg_bytes = nl_msg.as_bytes();
710                let bytes_read = data.write(msg_bytes)?;
711
712                let info = MessageReadInfo {
713                    bytes_read,
714                    message_length: msg_bytes.len(),
715                    address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
716                    credentials: None,
717                    ancillary_data: vec![],
718                };
719                Ok(info)
720            }
721            None => Ok(MessageReadInfo::default()),
722        }
723    }
724
725    fn write(
726        &self,
727        socket: &Socket,
728        current_task: &CurrentTask,
729        data: &mut dyn InputBuffer,
730        dest_address: &mut Option<SocketAddress>,
731        ancillary_data: &mut Vec<AncillaryData>,
732    ) -> Result<usize, Errno> {
733        let bytes = data.peek_all()?;
734        if let Ok((nl_msg, _)) = nlmsghdr::read_from_prefix(&bytes) {
735            security::check_netlink_send_access(current_task, socket, nl_msg.nlmsg_type)?;
736        }
737
738        let mut local_address = self.lock().address.clone();
739
740        let destination = match dest_address {
741            Some(SocketAddress::Netlink(addr)) => addr,
742            _ => match &mut local_address {
743                Some(addr) => addr,
744                _ => return Ok(data.drain()),
745            },
746        };
747
748        if destination.groups != 0 {
749            track_stub!(TODO("https://fxbug.dev/322874956"), "StubbedNetlinkSockets multicasting");
750            return Ok(data.drain());
751        }
752
753        self.lock().write_to_queue(data, Some(NetlinkAddress::default()), None, ancillary_data)
754    }
755
756    fn wait_async(
757        &self,
758        _socket: &Socket,
759        _current_task: &CurrentTask,
760        waiter: &Waiter,
761        events: FdEvents,
762        handler: EventHandler,
763    ) -> WaitCanceler {
764        self.lock().wait_async(waiter, events, handler)
765    }
766
767    fn query_events(
768        &self,
769        _socket: &Socket,
770        _current_task: &CurrentTask,
771    ) -> Result<FdEvents, Errno> {
772        Ok(self.lock().query_events() & FdEvents::POLLIN)
773    }
774
775    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
776        track_stub!(TODO("https://fxbug.dev/322875507"), "StubbedNetlinkSocket::shutdown");
777        Ok(())
778    }
779
780    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
781
782    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
783        self.lock().getsockname()
784    }
785
786    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
787        self.lock().getpeername()
788    }
789
790    fn getsockopt(
791        &self,
792        _socket: &Socket,
793        _current_task: &CurrentTask,
794        level: u32,
795        optname: u32,
796        _optlen: u32,
797    ) -> Result<Vec<u8>, Errno> {
798        self.lock().getsockopt(level, optname)
799    }
800
801    fn setsockopt(
802        &self,
803        _socket: &Socket,
804        current_task: &CurrentTask,
805        level: u32,
806        optname: u32,
807        optval: SockOptValue,
808    ) -> Result<(), Errno> {
809        self.lock().setsockopt(current_task, level, optname, optval)
810    }
811}
812
813/// Socket implementation for the NETLINK_KOBJECT_UEVENT family of netlink sockets.
814struct UEventNetlinkSocket {
815    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
816    device_listener_key:
817        LockDepMutex<Option<DeviceListenerKey>, UEventNetlinkSocketDeviceListenerKeyLock>,
818}
819
820impl Default for UEventNetlinkSocket {
821    #[allow(clippy::let_and_return)]
822    fn default() -> Self {
823        let result = Self {
824            inner: Arc::new(NetlinkSocketInner::new(NetlinkFamily::KobjectUevent).into()),
825            device_listener_key: Default::default(),
826        };
827        #[cfg(any(test, debug_assertions))]
828        {
829            let _l1 = result.device_listener_key.lock();
830            let _l2 = result.lock();
831        }
832        result
833    }
834}
835
836impl UEventNetlinkSocket {
837    /// Locks and returns the inner state of the Socket.
838    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
839        self.inner.lock()
840    }
841
842    fn register_listener(
843        &self,
844        current_task: &CurrentTask,
845        state: LockDepGuard<'_, NetlinkSocketInner>,
846    ) {
847        if state.address.is_none() {
848            return;
849        }
850        std::mem::drop(state);
851        let mut key_state = self.device_listener_key.lock();
852        if key_state.is_none() {
853            *key_state =
854                Some(current_task.kernel().device_registry.register_listener(self.inner.clone()));
855        }
856    }
857}
858
859impl SocketOps for UEventNetlinkSocket {
860    fn connect(
861        &self,
862        _socket: &SocketHandle,
863        current_task: &CurrentTask,
864        peer: SocketPeer,
865    ) -> Result<(), Errno> {
866        let mut state = self.lock();
867        state.connect(current_task, peer)?;
868        self.register_listener(current_task, state);
869        Ok(())
870    }
871
872    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
873        error!(EOPNOTSUPP)
874    }
875
876    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
877        error!(EOPNOTSUPP)
878    }
879
880    fn bind(
881        &self,
882        _socket: &Socket,
883        current_task: &CurrentTask,
884        socket_address: SocketAddress,
885    ) -> Result<(), Errno> {
886        let mut state = self.lock();
887        state.bind(current_task, socket_address)?;
888        self.register_listener(current_task, state);
889        Ok(())
890    }
891
892    fn read(
893        &self,
894        _socket: &Socket,
895        _current_task: &CurrentTask,
896        data: &mut dyn OutputBuffer,
897        flags: SocketMessageFlags,
898    ) -> Result<MessageReadInfo, Errno> {
899        self.lock().read_datagram(data, flags)
900    }
901
902    fn write(
903        &self,
904        _socket: &Socket,
905        _current_task: &CurrentTask,
906        _data: &mut dyn InputBuffer,
907        _dest_address: &mut Option<SocketAddress>,
908        _ancillary_data: &mut Vec<AncillaryData>,
909    ) -> Result<usize, Errno> {
910        error!(EOPNOTSUPP)
911    }
912
913    fn wait_async(
914        &self,
915        _socket: &Socket,
916        _current_task: &CurrentTask,
917        waiter: &Waiter,
918        events: FdEvents,
919        handler: EventHandler,
920    ) -> WaitCanceler {
921        self.lock().wait_async(waiter, events, handler)
922    }
923
924    fn query_events(
925        &self,
926        _socket: &Socket,
927        _current_task: &CurrentTask,
928    ) -> Result<FdEvents, Errno> {
929        Ok(self.lock().query_events() & FdEvents::POLLIN)
930    }
931
932    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
933        track_stub!(TODO("https://fxbug.dev/322875507"), "UEventNetlinkSocket::shutdown");
934        Ok(())
935    }
936
937    fn close(&self, current_task: &CurrentTask, _socket: &Socket) {
938        let id = self.device_listener_key.lock().take();
939        if let Some(id) = id {
940            current_task.kernel().device_registry.unregister_listener(&id);
941        }
942    }
943
944    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
945        self.lock().getsockname()
946    }
947
948    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
949        self.lock().getpeername()
950    }
951
952    fn getsockopt(
953        &self,
954        _socket: &Socket,
955        _current_task: &CurrentTask,
956        level: u32,
957        optname: u32,
958        _optlen: u32,
959    ) -> Result<Vec<u8>, Errno> {
960        self.lock().getsockopt(level, optname)
961    }
962
963    fn setsockopt(
964        &self,
965        _socket: &Socket,
966        current_task: &CurrentTask,
967        level: u32,
968        optname: u32,
969        optval: SockOptValue,
970    ) -> Result<(), Errno> {
971        self.lock().setsockopt(current_task, level, optname, optval)
972    }
973}
974
975impl DeviceListener for Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>> {
976    fn on_device_event(&self, action: UEventAction, device: Device, context: UEventContext) {
977        let path = device.path_from_depth(0);
978
979        let mut props = device.get_uevent_properties_list();
980
981        // Prepend ACTION and SEQNUM to maintain existing order
982        props.insert(0, (b"ACTION".into(), action.to_string().into()));
983        props.insert(1, (b"SEQNUM".into(), context.seqnum.to_string().into()));
984
985        let flattened = flatten_uevent_properties(props, '\0');
986
987        let mut message = vec![];
988        write!(&mut message, "{action}@/{path}\0", action = action, path = path).unwrap();
989        message.extend_from_slice(flattened.as_ref());
990
991        // Ignore write errors
992        let _ = self.lock().write_to_queue(
993            &mut VecInputBuffer::new(&message),
994            Some(NetlinkAddress { pid: 0, groups: 1 }),
995            Some(Default::default()),
996            &mut Vec::new(),
997        );
998    }
999}
1000
1001/// Type for sending messages from [`netlink::Netlink`] to an individual socket.
1002#[derive(Clone)]
1003pub struct NetlinkToClientSender<M> {
1004    /// The inner socket implementation, which holds a message queue.
1005    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1006
1007    /// `PhantomData<fn(M) -> M>` is used instead of `PhantomData<M>` in order
1008    /// to ensure that the type is invariant over `M` and that it implements
1009    /// `Sync` even if `M` is not `Sync`.
1010    _message_type: PhantomData<fn(M) -> M>,
1011}
1012
1013impl<M> NetlinkToClientSender<M> {
1014    fn new(inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>) -> Self {
1015        NetlinkToClientSender { _message_type: Default::default(), inner }
1016    }
1017}
1018
1019impl<M: Clone + NetlinkSerializable + Send> Sender<M> for NetlinkToClientSender<M> {
1020    fn send(&mut self, message: NetlinkMessage<M>, group: Option<ModernGroup>) {
1021        // Serialize the message
1022        let mut buf = vec![0; message.buffer_len()];
1023        message.emit(&mut buf);
1024        let mut buf: VecInputBuffer = buf.into();
1025        // Write the message into the inner socket buffer.
1026        let NetlinkToClientSender { _message_type: _, inner } = self;
1027        let mut guard = inner.lock();
1028
1029        // To avoid dropping messages when the receive buffer is
1030        // full, grow the buffer on behalf of the client.
1031        // This is a stop gap measure to avoid dropping messages
1032        // when netlink produces a large response to a
1033        // NLM_F_DUMP request.
1034        //
1035        // TODO(https://fxbug.dev/459883760): The memory
1036        // implications of this may be problematic. It should be
1037        // replaced with a proper mechanism to handle a backlog
1038        // of NLM_F_DUMP responses.
1039        let available = guard.receive_buffer.available_capacity();
1040        let required = buf.available();
1041        if available < required {
1042            let delta = required - available;
1043            let current_capacity = guard.receive_buffer.capacity();
1044            let new_capacity = (current_capacity + delta).min(SOCKET_MAX_SIZE);
1045            match guard.receive_buffer.set_capacity(new_capacity) {
1046                Ok(()) => {}
1047                Err(e) => {
1048                    log_error!(
1049                        tag = NETLINK_LOG_TAG;
1050                        "Failed to increase receive buffer size: {:?}",
1051                        e
1052                    );
1053                }
1054            }
1055        }
1056
1057        let _bytes_written: usize = guard
1058            .write_to_queue(
1059                &mut buf,
1060                Some(NetlinkAddress {
1061                    // All messages come from the "kernel" which has PID of 0.
1062                    pid: 0,
1063                    // If this is a multicast message, set the group the multicast
1064                    // message is from.
1065                    groups: group
1066                        .map(SingleLegacyGroup::try_from)
1067                        .and_then(Result::<_, NoMappingFromModernToLegacyGroupError>::ok)
1068                        .map_or(0, |g| g.inner()),
1069                }),
1070                None,
1071                &mut Vec::new(),
1072            )
1073            .unwrap_or_else(|e| {
1074                log_error!(
1075                    tag = NETLINK_LOG_TAG;
1076                    "Failed to write message into buffer for socket. Errno: {:?}",
1077                    e
1078                );
1079                0
1080            });
1081    }
1082}
1083
1084#[derive(Clone)]
1085pub struct NetlinkAccessControl<'a> {
1086    current_task: &'a CurrentTask,
1087}
1088
1089impl<'a> NetlinkAccessControl<'a> {
1090    pub fn new(current_task: &'a CurrentTask) -> Self {
1091        Self { current_task }
1092    }
1093}
1094
1095impl<'a> AccessControl<Arc<Credentials>> for NetlinkAccessControl<'a> {
1096    fn grant_assess(
1097        &self,
1098        creds: &Arc<Credentials>,
1099        permission: Permission,
1100    ) -> Result<(), netlink::Errno> {
1101        let need_cap_net_admin = match permission {
1102            Permission::NetlinkRouteRead => false,
1103            Permission::NetlinkRouteWrite => true,
1104            Permission::NetlinkSockDiagRead => false,
1105            Permission::NetlinkSockDiagDestroy => true,
1106        };
1107        if !need_cap_net_admin {
1108            return Ok(());
1109        }
1110
1111        self.current_task.override_creds(creds.clone(), || {
1112            security::check_task_capable(self.current_task, CAP_NET_ADMIN).map_err(|error| {
1113                netlink::Errno::new(error.code.error_code() as i32)
1114                    .expect("Errno::error_code() is expected to be in range [1..max_i32]")
1115            })
1116        })
1117    }
1118}
1119pub struct NetlinkContextImpl;
1120
1121impl NetlinkContext for NetlinkContextImpl {
1122    type Creds = Arc<Credentials>;
1123    type Sender<M: Clone + NetlinkSerializable + Send> = NetlinkToClientSender<M>;
1124    type Receiver<
1125        M: Send + MessageWithPermission + NetlinkDeserializable<Error: Into<DecodeError>>,
1126    > = UnboundedReceiver<NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, M>, Self::Creds>>;
1127    type AccessControl<'a> = NetlinkAccessControl<'a>;
1128}
1129
1130fn new_route_socket(kernel: &Arc<Kernel>) -> Result<NetlinkSocket<NetlinkRouteClient>, Errno> {
1131    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Route)));
1132    let (message_sender, message_receiver) = mpsc::unbounded();
1133    let client = match kernel
1134        .network_netlink()
1135        .new_route_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1136    {
1137        Ok(client) => client,
1138        Err(NewClientError::Disconnected) => {
1139            log_error!(
1140                tag = NETLINK_LOG_TAG;
1141                "Netlink async worker is unexpectedly disconnected"
1142            );
1143            return error!(EPIPE);
1144        }
1145    };
1146    Ok(NetlinkSocket { inner, client, message_sender })
1147}
1148
1149fn new_sock_diag_socket(
1150    kernel: &Arc<Kernel>,
1151) -> Result<NetlinkSocket<NetlinkSockDiagClient>, Errno> {
1152    let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::SockDiag)));
1153    let (message_sender, message_receiver) = mpsc::unbounded();
1154    let client = match kernel
1155        .network_netlink()
1156        .new_sock_diag_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1157    {
1158        Ok(client) => client,
1159        Err(NewClientError::Disconnected) => {
1160            log_error!(
1161                tag = NETLINK_LOG_TAG;
1162                "Netlink async worker is unexpectedly disconnected"
1163            );
1164            return error!(EPIPE);
1165        }
1166    };
1167    Ok(NetlinkSocket { inner, client, message_sender })
1168}
1169
1170/// An abstraction over common networking-specific netlink sockets.
1171struct NetlinkSocket<C: NetlinkClient> {
1172    /// The inner Netlink socket implementation
1173    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1174    /// The implementation of a client (socket connection) to a netlink protocol
1175    /// family.
1176    client: C,
1177    /// The sender of messages from this socket to Netlink.
1178    // TODO(https://issuetracker.google.com/285880057): Bound the capacity of
1179    // the "send buffer".
1180    message_sender: UnboundedSender<
1181        NetlinkMessageWithCreds<UnparsedNetlinkMessage<Vec<u8>, C::Request>, Arc<Credentials>>,
1182    >,
1183}
1184
1185/// A type that provides Netlink message deserialization options.
1186trait DeserializeOptionsProvider {
1187    /// The type of the message to deserialize.
1188    type Message: NetlinkDeserializable;
1189    /// The options to use when deserializing a `Message`.
1190    fn options(&self) -> <Self::Message as NetlinkDeserializable>::DeserializeOptions;
1191}
1192
1193impl DeserializeOptionsProvider for NetlinkSocket<NetlinkRouteClient> {
1194    type Message = RouteNetlinkMessage;
1195    fn options(&self) -> RouteNetlinkMessageParseMode {
1196        let strict = self.inner.lock().strict_chk;
1197        if strict {
1198            RouteNetlinkMessageParseMode::Strict
1199        } else {
1200            RouteNetlinkMessageParseMode::Relaxed
1201        }
1202    }
1203}
1204
1205impl DeserializeOptionsProvider for NetlinkSocket<NetlinkSockDiagClient> {
1206    type Message = SockDiagRequest;
1207    fn options(&self) -> EmptyDeserializeSockDiagOptions {
1208        EmptyDeserializeSockDiagOptions
1209    }
1210}
1211
1212impl<C: NetlinkClient + 'static> SocketOps for NetlinkSocket<C>
1213where
1214    Self: DeserializeOptionsProvider<Message = C::Request>,
1215{
1216    fn connect(
1217        &self,
1218        _socket: &SocketHandle,
1219        current_task: &CurrentTask,
1220        peer: SocketPeer,
1221    ) -> Result<(), Errno> {
1222        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1223        inner.lock().connect(current_task, peer)
1224    }
1225
1226    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1227        error!(EOPNOTSUPP)
1228    }
1229
1230    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1231        error!(EOPNOTSUPP)
1232    }
1233
1234    fn bind(
1235        &self,
1236        _socket: &Socket,
1237        current_task: &CurrentTask,
1238        socket_address: SocketAddress,
1239    ) -> Result<(), Errno> {
1240        let NetlinkSocket { inner, client, message_sender: _ } = self;
1241
1242        let multicast_groups = match &socket_address {
1243            SocketAddress::Netlink(NetlinkAddress { pid: _, groups }) => *groups,
1244            _ => return error!(EINVAL),
1245        };
1246        let pid = {
1247            let mut inner = inner.lock();
1248            inner.bind(current_task, socket_address)?;
1249            inner
1250                .address
1251                .as_ref()
1252                .and_then(|NetlinkAddress { pid, groups: _ }| NonZeroU32::new(*pid))
1253        };
1254        if let Some(pid) = pid {
1255            client.set_pid(pid);
1256        }
1257        // This "blocks" in order to synchronize with the internal
1258        // state of the netlink worker, but we're not blocking on
1259        // the completion of any i/o or any expensive computation,
1260        // so there's no need to support interrupts here.
1261        client
1262            .set_legacy_memberships(LegacyGroups(multicast_groups))
1263            .map_err(|InvalidLegacyGroupsError {}| errno!(EPERM))?
1264            .wait_until_complete();
1265        Ok(())
1266    }
1267
1268    fn read(
1269        &self,
1270        _socket: &Socket,
1271        _current_task: &CurrentTask,
1272        data: &mut dyn OutputBuffer,
1273        flags: SocketMessageFlags,
1274    ) -> Result<MessageReadInfo, Errno> {
1275        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1276        inner.lock().read_datagram(data, flags)
1277    }
1278
1279    fn write(
1280        &self,
1281        socket: &Socket,
1282        current_task: &CurrentTask,
1283        data: &mut dyn InputBuffer,
1284        _dest_address: &mut Option<SocketAddress>,
1285        _ancillary_data: &mut Vec<AncillaryData>,
1286    ) -> Result<usize, Errno> {
1287        let NetlinkSocket { inner: _, client: _, message_sender } = self;
1288
1289        let bytes = data.peek_all()?;
1290        let bytes_len = bytes.len();
1291
1292        // Parse only the netlink header to send it through security check.
1293        match NetlinkBuffer::new(&bytes) {
1294            Ok(buffer) => {
1295                security::check_netlink_send_access(current_task, socket, buffer.message_type())?;
1296            }
1297            Err(e) => {
1298                // If we can't even decode the header of the netlink message,
1299                // then return early here as a stronger statement that we're not
1300                // going to accidentally operate on it and violate the security
1301                // check. The netlink crate would end up dropping this with no
1302                // response as well.
1303                log_warn!(tag = NETLINK_LOG_TAG;
1304                    "Failed to parse netlink header {e:?}"
1305                );
1306                data.drain();
1307                return Ok(bytes_len);
1308            }
1309        }
1310
1311        let msg = NetlinkMessageWithCreds::new(
1312            UnparsedNetlinkMessage::new(bytes, self.options()),
1313            current_task.current_creds().clone(),
1314        );
1315        message_sender.unbounded_send(msg).map_err(|e| {
1316            log_warn!(
1317                tag = NETLINK_LOG_TAG;
1318                "Netlink receiver unexpectedly disconnected for socket: {:?}",
1319                e
1320            );
1321            errno!(EPIPE)
1322        })?;
1323        data.drain();
1324        Ok(bytes_len)
1325    }
1326
1327    fn wait_async(
1328        &self,
1329        _socket: &Socket,
1330        _current_task: &CurrentTask,
1331        waiter: &Waiter,
1332        events: FdEvents,
1333        handler: EventHandler,
1334    ) -> WaitCanceler {
1335        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1336        inner.lock().wait_async(waiter, events, handler)
1337    }
1338
1339    fn query_events(
1340        &self,
1341        _socket: &Socket,
1342        _current_task: &CurrentTask,
1343    ) -> Result<FdEvents, Errno> {
1344        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1345        Ok(inner.lock().query_events() & FdEvents::POLLIN)
1346    }
1347
1348    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1349        error!(EOPNOTSUPP)
1350    }
1351
1352    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1353        // Close the underlying channel to the Netlink worker.
1354        self.message_sender.close_channel();
1355    }
1356
1357    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1358        let NetlinkSocket { inner, client: _, message_sender: _ } = self;
1359        inner.lock().getsockname()
1360    }
1361
1362    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1363        self.inner.lock().getpeername()
1364    }
1365
1366    fn getsockopt(
1367        &self,
1368        _socket: &Socket,
1369        _current_task: &CurrentTask,
1370        level: u32,
1371        optname: u32,
1372        _optlen: u32,
1373    ) -> Result<Vec<u8>, Errno> {
1374        self.inner.lock().getsockopt(level, optname)
1375    }
1376
1377    fn setsockopt(
1378        &self,
1379        _socket: &Socket,
1380        current_task: &CurrentTask,
1381        level: u32,
1382        optname: u32,
1383        optval: SockOptValue,
1384    ) -> Result<(), Errno> {
1385        match (level, optname) {
1386            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1387                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1388                let group: u32 = optval.read(current_task)?;
1389                let async_work = client
1390                    .add_membership(ModernGroup(group))
1391                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1392                // This "blocks" in order to synchronize with the internal
1393                // state of the rtnetlink worker, but we're not blocking on
1394                // the completion of any i/o or any expensive computation,
1395                // so there's no need to support interrupts here.
1396                async_work.wait_until_complete();
1397                Ok(())
1398            }
1399            (SOL_NETLINK, NETLINK_DROP_MEMBERSHIP) => {
1400                let NetlinkSocket { inner: _, client, message_sender: _ } = self;
1401                let group: u32 = optval.read(current_task)?;
1402                client
1403                    .del_membership(ModernGroup(group))
1404                    .map_err(|InvalidModernGroupError| errno!(EINVAL))?;
1405                Ok(())
1406            }
1407            _ => self.inner.lock().setsockopt(current_task, level, optname, optval),
1408        }
1409    }
1410}
1411
1412/// Socket implementation for the NETLINK_GENERIC family of netlink sockets.
1413struct GenericNetlinkSocket {
1414    inner: Arc<LockDepMutex<NetlinkSocketInner, NetlinkSocketInnerLock>>,
1415    client: GenericNetlinkClientHandle<NetlinkToClientSender<GenericMessage>>,
1416    message_sender: mpsc::UnboundedSender<NetlinkMessage<GenericMessage>>,
1417}
1418
1419impl GenericNetlinkSocket {
1420    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1421        let inner = Arc::new(LockDepMutex::new(NetlinkSocketInner::new(NetlinkFamily::Generic)));
1422        let (message_sender, message_receiver) = mpsc::unbounded();
1423        match kernel
1424            .generic_netlink()
1425            .new_generic_client(NetlinkToClientSender::new(inner.clone()), message_receiver)
1426        {
1427            Ok(client) => Ok(Self { inner, client, message_sender }),
1428            Err(e) => {
1429                log_warn!(
1430                    tag = NETLINK_LOG_TAG;
1431                    "Failed to connect to generic netlink server. Errno: {:?}",
1432                    e
1433                );
1434                error!(EPIPE)
1435            }
1436        }
1437    }
1438
1439    /// Locks and returns the inner state of the Socket.
1440    fn lock(&self) -> LockDepGuard<'_, NetlinkSocketInner> {
1441        self.inner.lock()
1442    }
1443}
1444
1445impl SocketOps for GenericNetlinkSocket {
1446    fn connect(
1447        &self,
1448        _socket: &SocketHandle,
1449        current_task: &CurrentTask,
1450        peer: SocketPeer,
1451    ) -> Result<(), Errno> {
1452        let mut state = self.lock();
1453        state.connect(current_task, peer)
1454    }
1455
1456    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1457        error!(EOPNOTSUPP)
1458    }
1459
1460    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1461        error!(EOPNOTSUPP)
1462    }
1463
1464    fn bind(
1465        &self,
1466        _socket: &Socket,
1467        current_task: &CurrentTask,
1468        socket_address: SocketAddress,
1469    ) -> Result<(), Errno> {
1470        let mut state = self.lock();
1471        state.bind(current_task, socket_address)
1472    }
1473
1474    fn read(
1475        &self,
1476        _socket: &Socket,
1477        _current_task: &CurrentTask,
1478        data: &mut dyn OutputBuffer,
1479        flags: SocketMessageFlags,
1480    ) -> Result<MessageReadInfo, Errno> {
1481        self.lock().read_datagram(data, flags)
1482    }
1483
1484    fn write(
1485        &self,
1486        socket: &Socket,
1487        current_task: &CurrentTask,
1488        data: &mut dyn InputBuffer,
1489        _dest_address: &mut Option<SocketAddress>,
1490        _ancillary_data: &mut Vec<AncillaryData>,
1491    ) -> Result<usize, Errno> {
1492        let bytes = data.read_all()?;
1493        match NetlinkMessage::<GenericMessage>::deserialize(&bytes, EmptyDeserializeGenlOptions) {
1494            Err(e) => {
1495                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1496                error!(EINVAL)
1497            }
1498            Ok(msg) => {
1499                security::check_netlink_send_access(current_task, socket, msg.header.message_type)?;
1500                match self.message_sender.unbounded_send(msg) {
1501                    Ok(()) => Ok(bytes.len()),
1502                    Err(e) => {
1503                        log_warn!("Netlink receiver unexpectedly disconnected for socket: {:?}", e);
1504                        error!(EPIPE)
1505                    }
1506                }
1507            }
1508        }
1509    }
1510
1511    fn wait_async(
1512        &self,
1513        _socket: &Socket,
1514        _current_task: &CurrentTask,
1515        waiter: &Waiter,
1516        events: FdEvents,
1517        handler: EventHandler,
1518    ) -> WaitCanceler {
1519        self.lock().wait_async(waiter, events, handler)
1520    }
1521
1522    fn query_events(
1523        &self,
1524        _socket: &Socket,
1525        _current_task: &CurrentTask,
1526    ) -> Result<FdEvents, Errno> {
1527        Ok(self.lock().query_events() & FdEvents::POLLIN)
1528    }
1529
1530    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1531        track_stub!(TODO("https://fxbug.dev/322875507"), "GenericNetlinkSocket::shutdown");
1532        Ok(())
1533    }
1534
1535    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {}
1536
1537    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1538        self.lock().getsockname()
1539    }
1540
1541    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1542        self.lock().getpeername()
1543    }
1544
1545    fn getsockopt(
1546        &self,
1547        _socket: &Socket,
1548        _current_task: &CurrentTask,
1549        level: u32,
1550        optname: u32,
1551        _optlen: u32,
1552    ) -> Result<Vec<u8>, Errno> {
1553        self.lock().getsockopt(level, optname)
1554    }
1555
1556    fn setsockopt(
1557        &self,
1558        _socket: &Socket,
1559        current_task: &CurrentTask,
1560        level: u32,
1561        optname: u32,
1562        optval: SockOptValue,
1563    ) -> Result<(), Errno> {
1564        match (level, optname) {
1565            (SOL_NETLINK, NETLINK_ADD_MEMBERSHIP) => {
1566                let group_id: u32 = optval.read(current_task)?;
1567                self.client.add_membership(ModernGroup(group_id))
1568            }
1569            _ => self.lock().setsockopt(current_task, level, optname, optval),
1570        }
1571    }
1572}
1573
1574/// Audit client that can be attached to the `AuditLogger`.
1575pub struct AuditNetlinkClient {
1576    /// Reference to the `AuditLogger`.
1577    audit_logger: Arc<AuditLogger>,
1578    /// The waiters queue present in `AuditNetlinkSocket`.
1579    waiters: WaitQueue,
1580    /// Optional response from the `AuditLogger`.
1581    audit_response:
1582        LockDepMutex<Option<NetlinkMessage<GenericMessage>>, AuditNetlinkClientAuditResponseLock>,
1583}
1584
1585impl AuditNetlinkClient {
1586    fn new(audit_logger: Arc<AuditLogger>) -> Self {
1587        Self { audit_logger, waiters: Default::default(), audit_response: Default::default() }
1588    }
1589
1590    pub fn notify(&self) {
1591        self.waiters.notify_fd_events(FdEvents::POLLIN);
1592    }
1593
1594    /// Function to check the capabilities of the current task against CAP_AUDIT_*
1595    fn check_audit_access(
1596        &self,
1597        current_task: &CurrentTask,
1598        request_type: &AuditRequest,
1599    ) -> Result<(), Errno> {
1600        match request_type {
1601            AuditRequest::AuditGet | AuditRequest::AuditSet => {
1602                security::check_task_capable(current_task, CAP_AUDIT_CONTROL)
1603            }
1604            AuditRequest::AuditUser => security::check_task_capable(current_task, CAP_AUDIT_WRITE),
1605        }
1606    }
1607
1608    /// Function to process request coming from userspace, it returns the response after processing
1609    fn process_request(
1610        self: &Arc<Self>,
1611        current_task: &CurrentTask,
1612        nl_message: NetlinkMessage<GenericMessage>,
1613    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1614        let (nl_header, nl_payload) = nl_message.into_parts();
1615        let audit_request_type = AuditRequest::try_from(nl_header.message_type as u32)?;
1616        self.check_audit_access(current_task, &audit_request_type)?;
1617
1618        // If there is no GenericMessage, return an ErrorMessage.
1619        let NetlinkPayload::InnerMessage(GenericMessage::Other { payload, .. }) = nl_payload else {
1620            return error!(EINVAL);
1621        };
1622        match audit_request_type {
1623            AuditRequest::AuditGet => self.process_get_status(nl_header.sequence_number),
1624            AuditRequest::AuditSet => self.process_set_status(current_task, nl_header, payload),
1625            AuditRequest::AuditUser => self.process_user_audit(nl_header, payload),
1626        }
1627    }
1628
1629    fn get_nl_response(&self, flags: SocketMessageFlags) -> Option<Vec<u8>> {
1630        if flags.contains(SocketMessageFlags::PEEK) {
1631            if let Some(message) = self.audit_response.lock().as_ref() {
1632                return Some(AuditNetlinkClient::serialize_nlmsg(message.clone()));
1633            }
1634        } else if let Some(message) = self.audit_response.lock().take() {
1635            return Some(AuditNetlinkClient::serialize_nlmsg(message));
1636        }
1637        None
1638    }
1639
1640    /// Function to read an audit message from `AuditLogger`.
1641    fn read_audit_log(self: &Arc<Self>) -> Option<Vec<u8>> {
1642        if let Some(AuditMessage { audit_type, message }) = self.audit_logger.read_audit_log(self) {
1643            return Some(AuditNetlinkClient::serialize_nlmsg(
1644                AuditNetlinkClient::build_audit_nlmsg(0, audit_type, message),
1645            ));
1646        }
1647        None
1648    }
1649
1650    /// Function to read the optional response if present or an audit message.
1651    fn read_nlmsg(self: &Arc<Self>, flags: SocketMessageFlags) -> Result<Vec<u8>, Errno> {
1652        // First check if there is a response and send it if present.
1653        // Send an audit message otherwise or return EAGAIN.
1654        self.get_nl_response(flags).or_else(|| self.read_audit_log()).ok_or_else(|| errno!(EAGAIN))
1655    }
1656
1657    fn process_get_status(
1658        &self,
1659        sequence_number: u32,
1660    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1661        Ok(AuditNetlinkClient::build_audit_nlmsg(
1662            sequence_number,
1663            AUDIT_GET as u16,
1664            self.audit_logger.get_status().as_bytes().to_vec(),
1665        ))
1666    }
1667
1668    fn process_set_status(
1669        self: &Arc<Self>,
1670        current_task: &CurrentTask,
1671        nl_hdr: NetlinkHeader,
1672        nl_payload: Vec<u8>,
1673    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1674        let Some(status) = audit_status::read_from_bytes(nl_payload.as_bytes()).ok() else {
1675            return error!(EINVAL);
1676        };
1677        self.audit_logger.set_status(current_task, status, self)?;
1678        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1679    }
1680
1681    fn process_user_audit(
1682        &self,
1683        nl_hdr: NetlinkHeader,
1684        nl_payload: Vec<u8>,
1685    ) -> Result<NetlinkMessage<GenericMessage>, Errno> {
1686        let audit_msg = String::from_utf8_lossy(nl_payload.as_bytes());
1687        self.audit_logger.audit_log(nl_hdr.message_type, move || audit_msg);
1688        Ok(AuditNetlinkClient::build_audit_ack(Ok(()), nl_hdr))
1689    }
1690
1691    fn query_events(self: &Arc<Self>) -> FdEvents {
1692        if self.audit_response.lock().is_some() || self.audit_logger.get_backlog_count(self) != 0 {
1693            return FdEvents::POLLIN;
1694        }
1695        FdEvents::empty()
1696    }
1697
1698    fn detach(self: &Arc<Self>) {
1699        self.audit_logger.detach_client(self);
1700    }
1701
1702    fn build_audit_nlmsg(
1703        seq_number: u32,
1704        msg_type: u16,
1705        payload: Vec<u8>,
1706    ) -> NetlinkMessage<GenericMessage> {
1707        // The family in GenericMessage can be used for message type, not only for the Netlink Family,
1708        // because after finalizing the message, the message type is equal to family.
1709        let nl_payload =
1710            NetlinkPayload::InnerMessage(GenericMessage::Other { family: msg_type, payload });
1711        let mut nl_header = NetlinkHeader::default();
1712        nl_header.sequence_number = seq_number;
1713        let mut message = NetlinkMessage::new(nl_header, nl_payload);
1714        message.finalize();
1715        message
1716    }
1717
1718    fn build_audit_ack(
1719        error: Result<(), Errno>,
1720        req_header: NetlinkHeader,
1721    ) -> NetlinkMessage<GenericMessage> {
1722        let error = {
1723            assert_eq!(req_header.buffer_len(), NETLINK_HEADER_LEN);
1724            let mut buffer = vec![0; NETLINK_HEADER_LEN];
1725            req_header.emit(&mut buffer);
1726
1727            let code = match error {
1728                Ok(()) => None,
1729                Err(e) => Some(
1730                    // Audit netlink errors are negative.
1731                    NonZeroI32::new(-(e.code.error_code() as i32))
1732                        .expect("Errno's code must be non-zero"),
1733                ),
1734            };
1735
1736            let mut error = ErrorMessage::default();
1737            error.code = code;
1738            error.header = buffer;
1739            error
1740        };
1741
1742        let payload = NetlinkPayload::<GenericMessage>::Error(error);
1743        let mut resp_header = NetlinkHeader::default();
1744        resp_header.message_type = NLMSG_ERROR;
1745        resp_header.sequence_number = req_header.sequence_number;
1746        let mut message = NetlinkMessage::new(resp_header, payload);
1747        message.finalize();
1748        message
1749    }
1750
1751    fn serialize_nlmsg(message: NetlinkMessage<GenericMessage>) -> Vec<u8> {
1752        let mut buf = vec![0; message.buffer_len()];
1753        message.serialize(&mut buf);
1754        buf
1755    }
1756}
1757
1758/// Audit Netlink Socket structure.
1759pub struct AuditNetlinkSocket {
1760    /// Reference to the `AuditNetlinkClient` associated with self.
1761    audit_client: Arc<AuditNetlinkClient>,
1762}
1763
1764impl AuditNetlinkSocket {
1765    pub fn new(kernel: &Kernel) -> Result<Self, Errno> {
1766        if kernel.audit_logger().is_disabled() {
1767            return error!(EPROTONOSUPPORT);
1768        }
1769        Ok(Self { audit_client: Arc::new(AuditNetlinkClient::new(kernel.audit_logger())) })
1770    }
1771}
1772
1773impl SocketOps for AuditNetlinkSocket {
1774    fn read(
1775        &self,
1776        _socket: &Socket,
1777        _current_task: &CurrentTask,
1778        data: &mut dyn OutputBuffer,
1779        flags: SocketMessageFlags,
1780    ) -> Result<MessageReadInfo, Errno> {
1781        let buf = self.audit_client.read_nlmsg(flags)?;
1782
1783        let size = data.write_all(buf.as_bytes())?;
1784        Ok(MessageReadInfo {
1785            bytes_read: size,
1786            message_length: size,
1787            address: Some(SocketAddress::Netlink(NetlinkAddress::default())),
1788            credentials: None,
1789            ancillary_data: vec![],
1790        })
1791    }
1792
1793    fn write(
1794        &self,
1795        socket: &Socket,
1796        current_task: &CurrentTask,
1797        data: &mut dyn InputBuffer,
1798        _dest_address: &mut Option<SocketAddress>,
1799        _ancillary_data: &mut Vec<AncillaryData>,
1800    ) -> Result<usize, Errno> {
1801        match NetlinkMessage::<GenericMessage>::deserialize(
1802            &(data.peek_all()?),
1803            EmptyDeserializeGenlOptions,
1804        ) {
1805            Ok(nl_message) => {
1806                let header = nl_message.header;
1807                security::check_netlink_send_access(current_task, socket, header.message_type)?;
1808
1809                // Send request to the `AuditNetlinkClient`.
1810                let audit_ack = self
1811                    .audit_client
1812                    .process_request(current_task, nl_message)
1813                    .map_err(|e| AuditNetlinkClient::build_audit_ack(Err(e), header))
1814                    .unwrap_or_else(|nlerr| nlerr);
1815                *self.audit_client.audit_response.lock() = Some(audit_ack);
1816                data.drain();
1817                Ok(header.length as usize)
1818            }
1819            Err(e) => {
1820                log_warn!("Failed to process write; data could not be deserialized: {:?}", e);
1821                error!(EINVAL)
1822            }
1823        }
1824    }
1825
1826    fn wait_async(
1827        &self,
1828        _socket: &Socket,
1829        _current_task: &CurrentTask,
1830        waiter: &Waiter,
1831        events: FdEvents,
1832        handler: EventHandler,
1833    ) -> WaitCanceler {
1834        self.audit_client.waiters.wait_async_fd_events(waiter, events, handler)
1835    }
1836
1837    fn query_events(
1838        &self,
1839        _socket: &Socket,
1840        _current_task: &CurrentTask,
1841    ) -> Result<FdEvents, Errno> {
1842        Ok(self.audit_client.query_events() & FdEvents::POLLIN)
1843    }
1844
1845    fn close(&self, _current_task: &CurrentTask, _socket: &Socket) {
1846        // If the `AuditNetlinkClient` disconnects, detach it.
1847        self.audit_client.detach();
1848    }
1849
1850    fn shutdown(&self, _socket: &Socket, _how: SocketShutdownFlags) -> Result<(), Errno> {
1851        error!(EOPNOTSUPP)
1852    }
1853
1854    fn connect(
1855        &self,
1856        _socket: &SocketHandle,
1857        _current_task: &CurrentTask,
1858        _peer: SocketPeer,
1859    ) -> Result<(), Errno> {
1860        error!(EOPNOTSUPP)
1861    }
1862
1863    fn listen(&self, _socket: &Socket, _backlog: i32, _credentials: ucred) -> Result<(), Errno> {
1864        error!(EOPNOTSUPP)
1865    }
1866
1867    fn accept(&self, _socket: &Socket, _current_task: &CurrentTask) -> Result<SocketHandle, Errno> {
1868        error!(EOPNOTSUPP)
1869    }
1870
1871    fn bind(
1872        &self,
1873        _socket: &Socket,
1874        _current_task: &CurrentTask,
1875        _socket_address: SocketAddress,
1876    ) -> Result<(), Errno> {
1877        error!(EOPNOTSUPP)
1878    }
1879
1880    fn getsockname(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1881        error!(EOPNOTSUPP)
1882    }
1883
1884    fn getpeername(&self, _socket: &Socket) -> Result<SocketAddress, Errno> {
1885        error!(EOPNOTSUPP)
1886    }
1887
1888    fn getsockopt(
1889        &self,
1890        _socket: &Socket,
1891        _current_task: &CurrentTask,
1892        _level: u32,
1893        _optname: u32,
1894        _optlen: u32,
1895    ) -> Result<Vec<u8>, Errno> {
1896        error!(EOPNOTSUPP)
1897    }
1898
1899    fn setsockopt(
1900        &self,
1901        _socket: &Socket,
1902        _current_task: &CurrentTask,
1903        _level: u32,
1904        _optname: u32,
1905        _optval: SockOptValue,
1906    ) -> Result<(), Errno> {
1907        error!(EOPNOTSUPP)
1908    }
1909}
1910
1911#[cfg(test)]
1912mod tests {
1913    use super::*;
1914
1915    use netlink_packet_route::route::RouteMessage;
1916    use netlink_packet_route::{RouteNetlinkMessage, RouteNetlinkMessageParseMode};
1917    use test_case::test_case;
1918
1919    // Successfully send the message and observe it's stored in the queue.
1920    #[test_case(true; "sufficient_capacity")]
1921    // Attempting to send when the queue is full should succeed by increasing
1922    // the size of the queue.
1923    #[test_case(false; "insufficient_capacity")]
1924    fn test_netlink_to_client_sender(sufficient_capacity: bool) {
1925        const MODERN_GROUP: u32 = 5;
1926
1927        let mut message: NetlinkMessage<RouteNetlinkMessage> =
1928            RouteNetlinkMessage::NewRoute(RouteMessage::default()).into();
1929        message.finalize();
1930
1931        let (initial_queue_size, final_queue_size) = if sufficient_capacity {
1932            (SOCKET_DEFAULT_SIZE, SOCKET_DEFAULT_SIZE)
1933        } else {
1934            (0, message.buffer_len())
1935        };
1936
1937        let socket_inner = Arc::new(LockDepMutex::new(NetlinkSocketInner {
1938            receive_buffer: MessageQueue::new(initial_queue_size),
1939            ..NetlinkSocketInner::new(NetlinkFamily::Route)
1940        }));
1941
1942        let mut sender = NetlinkToClientSender::<RouteNetlinkMessage>::new(socket_inner.clone());
1943        sender.send(message.clone(), Some(ModernGroup(MODERN_GROUP)));
1944        let Message { data, address, credentials: _, ancillary_data: _ } =
1945            socket_inner.lock().read_message().expect("should read message");
1946
1947        assert_eq!(
1948            address,
1949            Some(SocketAddress::Netlink(NetlinkAddress { pid: 0, groups: 1 << MODERN_GROUP }))
1950        );
1951        let actual_message = NetlinkMessage::<RouteNetlinkMessage>::deserialize(
1952            &data,
1953            RouteNetlinkMessageParseMode::Strict,
1954        )
1955        .expect("message should deserialize into RtnlMessage");
1956        assert_eq!(actual_message, message);
1957        assert_eq!(socket_inner.lock().receive_buffer.capacity(), final_queue_size);
1958    }
1959
1960    fn getsockopt_u32(socket: &NetlinkSocketInner, level: u32, optname: u32) -> u32 {
1961        let byte_vec = socket.getsockopt(level, optname).expect("getsockopt should succeed");
1962        let bytes: [u8; 4] = byte_vec.as_slice().try_into().expect("expected 4 bytes");
1963        u32::from_ne_bytes(bytes)
1964    }
1965
1966    fn sock_opt_value(val: u32) -> SockOptValue {
1967        SockOptValue::Value(val.to_ne_bytes().to_vec())
1968    }
1969
1970    #[::fuchsia::test]
1971    async fn test_set_get_snd_rcv_buf() {
1972        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1973            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
1974
1975            // Verify initialization uses the default value.
1976            let expected_default = u32::try_from(SOCKET_DEFAULT_SIZE).unwrap();
1977            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_default);
1978            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_default);
1979
1980            // Set new values and observe that they were applied.
1981            // Note that applied value is 2 times the requested value.
1982            const SNDBUF_SIZE: u32 = 12345;
1983            const RCVBUF_SIZE: u32 = 54321;
1984            socket
1985                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(SNDBUF_SIZE))
1986                .expect("setsockopt should succeed");
1987            socket
1988                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(RCVBUF_SIZE))
1989                .expect("setsockopt should succeed");
1990            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), SNDBUF_SIZE * 2);
1991            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), RCVBUF_SIZE * 2);
1992        })
1993        .await;
1994    }
1995
1996    #[::fuchsia::test]
1997    async fn test_snd_rcv_buf_limits() {
1998        crate::testing::spawn_kernel_and_run_sync(|current_task| {
1999            let mut socket = NetlinkSocketInner::new(NetlinkFamily::Route);
2000            let too_big = u32::try_from(SOCKET_MAX_SIZE).unwrap() + 1;
2001
2002            // SO_SNDBUF and SO_RCVBUF clamp the size to the limit.
2003            socket
2004                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUF, sock_opt_value(too_big))
2005                .expect("setsockopt should succeed");
2006            socket
2007                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUF, sock_opt_value(too_big))
2008                .expect("setsockopt should succeed");
2009            let expected_max = u32::try_from(SOCKET_MAX_SIZE).unwrap();
2010            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), expected_max);
2011            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), expected_max);
2012
2013            // SO_SNDBUFFORCE and SO_RCVBUFFORCE do not.
2014            // Note that the applied value is two times the requested value.
2015            socket
2016                .setsockopt(current_task, SOL_SOCKET, SO_SNDBUFFORCE, sock_opt_value(too_big))
2017                .expect("setsockopt should succeed");
2018            socket
2019                .setsockopt(current_task, SOL_SOCKET, SO_RCVBUFFORCE, sock_opt_value(too_big))
2020                .expect("setsockopt should succeed");
2021            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_SNDBUF), too_big * 2);
2022            assert_eq!(getsockopt_u32(&socket, SOL_SOCKET, SO_RCVBUF), too_big * 2);
2023        })
2024        .await;
2025    }
2026}
starnix_core/vfs/socket/socket_netlink.rs

starnix_core/vfs/socket/
socket_netlink.rs
