Linux Netlink通信机制详解（下）

ゞ浴缸里的玫瑰 2022-08-05 14:18 250阅读 0赞

这里我以路由中的netlink为例，看一下内核中的处理流程是怎么样的！在/kernel/net/core/rtnetlink.c文件中，有一个接收从用户空间过来的Netlink消息的函数。

1.  static void rtnetlink\_rcv(struct sock \*sk,  int len)  
    
2.  \{   
    
3.  unsigned int qlen  = 0;  
    
4.    
    
5.  do \{   
    
6.  rtnl\_lock();  
    
7.  netlink\_run\_queue(sk, &qlen,  &rtnetlink\_rcv\_msg);  
    
8.  up(&rtnl\_sem);  
    
9.    
    
10. netdev\_run\_todo();  
    
11. \} while (qlen);  
    
12. \}

上面的内核函数就是用来接收用户路由方面Netlink消息的，当我们使用route命令添加一条路由时，就会调用该函数接收。该函数是再netlink的初始化是注册的。同样在rtnetlink.c文件中。

1.  void \_\_init rtnetlink\_init(void)  
    
2.  \{   
    
3.  int i;  
    
4.    
    
5.  rtattr\_max = 0;  
    
6.  for (i = 0; i  < ARRAY\_SIZE(rta\_max); i\+\+)  
    
7.  if (rta\_max\[i\] > rtattr\_max)  
    
8.  rtattr\_max = rta\_max\[i\];  
    
9.  rta\_buf = kmalloc(rtattr\_max \* sizeof(struct rtattr \*), GFP\_KERNEL);  
    
10. if (!rta\_buf)  
    
11. panic("rtnetlink\_init: cannot allocate rta\_buf\\n");  
    
12.   
    
13. rtnl = netlink\_kernel\_create(NETLINK\_ROUTE, RTNLGRP\_MAX, rtnetlink\_rcv,  
    
14. THIS\_MODULE);//在创建内核的netlink时，注册了路由netlink的接收函数，rtnetlink\_rcv.  
    
15. if (rtnl ==  NULL)  
    
16. panic("rtnetlink\_init: cannot initialize rtnetlink\\n");  
    
17. netlink\_set\_nonroot(NETLINK\_ROUTE, NL\_NONROOT\_RECV);  
    
18. register\_netdevice\_notifier(&rtnetlink\_dev\_notifier);  
    
19. rtnetlink\_links\[PF\_UNSPEC\] = link\_rtnetlink\_table;  
    
20. rtnetlink\_links\[PF\_PACKET\] = link\_rtnetlink\_table;  
    
21. \}

在netlink\_kernel\_create函数中，可以看到内核接收用户空间传过来的消息的接收函数，

1.  struct sock \*  
    
2.  netlink\_kernel\_create(int unit, unsigned int groups,  
    
3.  void (\*input)(struct sock \*sk,  int len),  
    
4.  struct module \*module)  
    
5.  \{   
    
6.  struct socket \*sock;  
    
7.  struct sock \*sk;  
    
8.  struct netlink\_sock \*nlk;  
    
9.    
    
10. if (!nl\_table)  
    
11. return NULL;  
    
12.   
    
13. if (unit<0 || unit>=MAX\_LINKS)  
    
14. return NULL;  
    
15.   
    
16. if (sock\_create\_lite(PF\_NETLINK, SOCK\_DGRAM, unit, &sock))  
    
17. return NULL;  
    
18.   
    
19. if (\_\_netlink\_create(sock, unit) < 0)  
    
20. goto out\_sock\_release;  
    
21.   
    
22. sk = sock\->sk;  
    
23. sk\->sk\_data\_ready = netlink\_data\_ready;  
    
24. if (input)  
    
25. nlk\_sk(sk)\->data\_ready = input;//设置内核接收Netlink消息的函数，这里就是前面的rtnetlink\_rcv函数  
    
26.   
    
27. if (netlink\_insert(sk, 0))  
    
28. goto out\_sock\_release;  
    
29.   
    
30. nlk = nlk\_sk(sk); //取得sock嵌入的netlink\_sock结构体  
    
31. nlk\->flags |= NETLINK\_KERNEL\_SOCKET;  
    
32.   
    
33. netlink\_table\_grab();  
    
34. nl\_table\[unit\].groups = groups < 32 ? 32 : groups;  
    
35. nl\_table\[unit\].module = module;  
    
36. nl\_table\[unit\].registered = 1;// 更新netlink\_table结构体信息，每中协议对应一个netlink\_  
    
37. table结构  
    
38. netlink\_table\_ungrab();  
    
39.   
    
40. return sk;  
    
41.   
    
42. out\_sock\_release:  
    
43. sock\_release(sock);  
    
44. return NULL;  
    
45. \}

到此，内核创建netlink到接收用户空间发送过来消息整个流程就清晰了。那当我们添加一条新路由时，在接收函数rtnetlink\_rcv中的循环中，会从一个队列中调用实际的接收处理函数，这里为rtnetlink\_rcv\_msg函数。

1.  /\*\*  
    
2.  \* nelink\_run\_queue  \- Process netlink receive queue.  
    
3.  \* @sk: Netlink socket containing the queue  
    
4.  \* @qlen: Place to store queue length upon entry  
    
5.  \* @cb: Callback function invoked for each netlink message found  
    
6.  \*  
    
7.  \* Processes as much as there was  in the queue upon entry and invokes  
    
8.  \* a callback  function for  each netlink message found. The callback  
    
9.  \* function may refuse a message by returning a negative error code  
    
10. \* but setting the  error pointer to 0  in which case this  function  
    
11. \* returns with a qlen  != 0.  
    
12. \*  
    
13. \* qlen must be initialized  to 0 before the initial entry, afterwards  
    
14. \* the function may be called repeatedly until qlen reaches 0.  
    
15. \*/  
    
16. void netlink\_run\_queue(struct sock  \*sk, unsigned  int \*qlen,  
    
17. int (\*cb)(struct sk\_buff \*, struct nlmsghdr \*,  int \*))  
    
18. \{   
    
19. struct sk\_buff \*skb;  
    
20.   
    
21. if (!\*qlen ||  \*qlen > skb\_queue\_len(&sk\->sk\_receive\_queue))  
    
22. \*qlen  = skb\_queue\_len(&sk\->sk\_receive\_queue);  
    
23.   
    
24. for (; \*qlen;  (\*qlen)\-\-) \{   
    
25. skb = skb\_dequeue(&sk\->sk\_receive\_queue);  
    
26. if (netlink\_rcv\_skb(skb, cb)) \{   
    
27. if  (skb\->len)  
    
28. skb\_queue\_head(&sk\->sk\_receive\_queue, skb);  
    
29. else  \{   
    
30. kfree\_skb(skb);  
    
31. (\*qlen)\-\-;  
    
32. \}  
    
33. break;  
    
34. \}  
    
35.   
    
36. kfree\_skb(skb);  
    
37. \}  
    
38. \}

下面是rtnetlink\_rcv\_msg()函数的实现，对netlink消息进行相应的处理。其中有一个数据结构

struct rtnetlink\_link \*link; 其定义如下：是两个不同的处理函数

1.  struct rtnetlink\_link  
    
2.  \{   
    
3.  int (\*doit)(struct sk\_buff \*, struct nlmsghdr\*, void \*attr);  
    
4.  int (\*dumpit)(struct sk\_buff \*, struct netlink\_callback \*cb);  
    
5.  \};  
    
6.  /\* Process one rtnetlink message. \*/  
    
7.    
    
8.  static \_\_inline\_\_ int  
    
9.  rtnetlink\_rcv\_msg(struct sk\_buff  \*skb, struct nlmsghdr  \*nlh, int \*errp)  
    
10. \{   
    
11. struct rtnetlink\_link \*link;  
    
12. struct rtnetlink\_link \*link\_tab;  
    
13. int sz\_idx, kind;  
    
14. int min\_len;  
    
15. int family;  
    
16. int type;  
    
17. int err;  
    
18.   
    
19. /\* Only requests are handled by kernel now \*/  
    
20. if (!(nlh\->nlmsg\_flags&NLM\_F\_REQUEST))  
    
21. return 0;  
    
22. type = nlh\->nlmsg\_type;  
    
23. /\* A control message: ignore them \*/  
    
24. if (type < RTM\_BASE)  
    
25. return 0;  
    
26. /\* Unknown message: reply with EINVAL \*/  
    
27. if (type > RTM\_MAX)  
    
28. goto err\_inval;  
    
29. type \-= RTM\_BASE;  
    
30. /\* All the messages must have at least 1 byte length \*/  
    
31. if (nlh\->nlmsg\_len < NLMSG\_LENGTH(sizeof(struct rtgenmsg)))  
    
32. return 0;  
    
33. family = ((struct rtgenmsg\*)NLMSG\_DATA(nlh))\->rtgen\_family;  
    
34. if (family >= NPROTO) \{   
    
35. \*errp  = \-EAFNOSUPPORT;  
    
36. return \-1;  
    
37. \}  
    
38.   
    
39. link\_tab = rtnetlink\_links\[family\];//根据用户空间传过来的不同德family类型，调用不同的处理函数，这里以路由为例的话为AF\_ROUTE或者AF\_NETLINK  
    
40. if (link\_tab ==  NULL)  
    
41. link\_tab = rtnetlink\_links\[PF\_UNSPEC\];  
    
42. link = &link\_tab\[type\]; //根据不同的type调用不同的处理函数。这里的type为RTM\_NEWROUTE  
    
43.   
    
44. sz\_idx = type>>2;  
    
45. kind = type&3;  
    
46.   
    
47. if (kind != 2  && security\_netlink\_recv(skb)) \{   
    
48. \*errp  = \-EPERM;  
    
49. return \-1;  
    
50. \}  
    
51.   
    
52. if (kind == 2  && nlh\->nlmsg\_flags&NLM\_F\_DUMP) \{   
    
53. if (link\->dumpit ==  NULL)  
    
54. link  = &(rtnetlink\_links\[PF\_UNSPEC\]\[type\]);  
    
55.   
    
56. if (link\->dumpit ==  NULL)  
    
57. goto err\_inval;  
    
58.   
    
59. if ((\*errp = netlink\_dump\_start(rtnl, skb, nlh,  
    
60. link\->dumpit, NULL)) != 0) \{   
    
61. return \-1;  
    
62. \}  
    
63.   
    
64. netlink\_queue\_skip(nlh, skb);  
    
65. return \-1;  
    
66. \}  
    
67.   
    
68. memset(rta\_buf, 0, (rtattr\_max \* sizeof(struct rtattr \*)));  
    
69.   
    
70. min\_len = rtm\_min\[sz\_idx\];  
    
71. if (nlh\->nlmsg\_len < min\_len)  
    
72. goto err\_inval;  
    
73.   
    
74. if (nlh\->nlmsg\_len > min\_len)  \{   
    
75. int attrlen  = nlh\->nlmsg\_len \- NLMSG\_ALIGN(min\_len);  
    
76. struct rtattr \*attr  = (void\*)nlh \+ NLMSG\_ALIGN(min\_len);  
    
77.   
    
78. while  (RTA\_OK(attr, attrlen)) \{   
    
79. unsigned flavor = attr\->rta\_type;  
    
80. if  (flavor) \{   
    
81. if  (flavor > rta\_max\[sz\_idx\])  
    
82. goto err\_inval;  
    
83. rta\_buf\[flavor\-1\] = attr;  
    
84. \}  
    
85. attr = RTA\_NEXT(attr, attrlen);  
    
86. \}  
    
87. \}  
    
88.   
    
89. if (link\->doit ==  NULL)  
    
90. link = &(rtnetlink\_links\[PF\_UNSPEC\]\[type\]);  
    
91. if (link\->doit ==  NULL)  
    
92. goto err\_inval;  
    
93. err = link\->doit(skb, nlh, (void \*)&rta\_buf\[0\]);//此处调用RTM\_NEWROUTE，对应的route处理函数，也就是下面的inet6\_rtm\_newroute函数。  
    
94.   
    
95. \*errp = err;  
    
96. return err;  
    
97.   
    
98. err\_inval:  
    
99. \*errp = \-EINVAL;  
    
100. return \-1;  
    
101. \}  
    
102. int inet6\_rtm\_newroute(struct sk\_buff \*skb, struct nlmsghdr\* nlh, void \*arg)  
    
103. \{   
    
104. struct rtmsg \*r  = NLMSG\_DATA(nlh);  
    
105. struct in6\_rtmsg rtmsg;  
    
106.   
    
107. if (inet6\_rtm\_to\_rtmsg(r, arg, &rtmsg))  
    
108. return \-EINVAL;  
    
109. return ip6\_route\_add(&rtmsg, nlh, arg, &NETLINK\_CB(skb));  
    
110. \}

inet6\_rtm\_newroute函数通过下面的数组进行了相应的注册处理，所以上面的link->doit(skb, nlh, (void \*)&rta\_buf\[0\])就是根据下面的这个调用的。

1.  static struct rtnetlink\_link inet6\_rtnetlink\_table\[RTM\_NR\_MSGTYPES\] = \{   
    
2.  \[RTM\_GETLINK  \- RTM\_BASE\]  = \{  .dumpit = inet6\_dump\_ifinfo, \},  
    
3.  \[RTM\_NEWADDR  \- RTM\_BASE\]  = \{  .doit = inet6\_rtm\_newaddr, \},  
    
4.  \[RTM\_DELADDR  \- RTM\_BASE\]  = \{  .doit = inet6\_rtm\_deladdr, \},  
    
5.  \[RTM\_GETADDR  \- RTM\_BASE\]  = \{  .dumpit = inet6\_dump\_ifaddr, \},  
    
6.  \[RTM\_GETMULTICAST  \- RTM\_BASE\]  = \{  .dumpit = inet6\_dump\_ifmcaddr, \},  
    
7.  \[RTM\_GETANYCAST  \- RTM\_BASE\]  = \{  .dumpit = inet6\_dump\_ifacaddr, \},  
    
8.  \[RTM\_NEWROUTE  \- RTM\_BASE\]  = \{  .doit = inet6\_rtm\_newroute, \},  
    
9.  \[RTM\_DELROUTE  \- RTM\_BASE\]  = \{  .doit = inet6\_rtm\_delroute, \},  
    
10. \[RTM\_GETROUTE  \- RTM\_BASE\]  = \{  .doit = inet6\_rtm\_getroute,  
    
11. .dumpit = inet6\_dump\_fib, \},  
    
12. \};

相关的结构体：

内核中所有的netlink套接字存储在一个全局的哈新表中，该结构定义如下

static struct netlink\_table \*nl\_table;其中每个协议对应一个哈希表，所有的同一种协议的数

据报散列在同哈希表中

下面为一种协议所连接的哈希表结构：

struct netlink\_table \{

struct nl\_pid\_hashhash; // 根据pid进行HASH的netlink sock链表, 相当于客户端链表

struct hlist\_headmc\_list; // 多播的sock链表

unsigned int nl\_nonroot;// 监听者标志

unsigned int groups;// 每个netlink的协议类型可以定义多个组, 8的倍数,最小是32

struct module \*module;

int registered;

\};最大可有MAX\_LINKS(32)个表，处理不同协议类型的netlink套接口, 注意由于是自身的通信, 本机

同时作为服务器和客户端, 服务端需要一个套接口对应,每个客户端也要有一个套接口对应, 多个客户端的套接口形成一个链表.

1.  struct hlist\_head \*table; // 链表节点，每个桶中协议的sock连入其中，根据哈希值可得确定  
    
2.  的sock  
    
3.  unsigned long rehash\_time;  // 重新计算HASH的时间间隔  
    
4.    
    
5.  unsigned int mask;  
    
6.  unsigned int shift;  
    
7.    
    
8.  unsigned int entries; // 链表节点数  
    
9.  unsigned int max\_shift; // 最大幂值  
    
10. u32 rnd; // 随机数  
    
11. \};

在kernel/include/linux/Net.h中

1.  struct proto\_ops \{   
    
2.  int family;  
    
3.  struct module \*owner;  
    
4.  int (\*release) (struct socket \*sock);  
    
5.  int (\*bind) (struct socket \*sock,  
    
6.  struct sockaddr \*myaddr,  
    
7.  int sockaddr\_len);  
    
8.  int (\*connect) (struct socket \*sock,  
    
9.  struct sockaddr \*vaddr,  
    
10. int sockaddr\_len, int flags);  
    
11. int (\*socketpair)(struct socket \*sock1,  
    
12. struct socket \*sock2);  
    
13. int (\*accept) (struct socket \*sock,  
    
14. struct socket \*newsock, int flags);  
    
15. int (\*getname) (struct socket \*sock,  
    
16. struct sockaddr \*addr,  
    
17. int  \*sockaddr\_len,  int peer);  
    
18. unsigned int (\*poll) (struct file \*file, struct socket \*sock,  
    
19. struct poll\_table\_struct \*wait);  
    
20. int (\*ioctl) (struct socket \*sock, unsigned int cmd,  
    
21. unsigned long arg);  
    
22. int (\*listen) (struct socket \*sock, int len);  
    
23. int (\*shutdown) (struct socket \*sock, int flags);  
    
24. int (\*setsockopt)(struct socket \*sock,  int level,  
    
25. int optname, char \_\_user \*optval,  int optlen);  
    
26. int (\*getsockopt)(struct socket \*sock,  int level,  
    
27. int optname, char \_\_user \*optval,  int \_\_user \*optlen);  
    
28. int (\*sendmsg) (struct kiocb \*iocb, struct socket \*sock,//netlink套接字实际的发送与接收函数  
    
29. struct msghdr \*m, size\_t total\_len);  
    
30. int (\*recvmsg) (struct kiocb \*iocb, struct socket \*sock,  
    
31. struct msghdr \*m, size\_t total\_len,  
    
32. int flags);  
    
33. int (\*mmap) (struct file \*file, struct socket \*sock,  
    
34. struct vm\_area\_struct \* vma);  
    
35. ssize\_t (\*sendpage) (struct socket \*sock, struct page \*page,  
    
36. int offset, size\_t size, int flags);  
    
37. \};

下面我们看看，当我们使用route命令添加一个新的路由是，这个函数的调用顺序是怎么样的。下面是主要的函数;

Dput（）

sys\_sendmsg（）//内核的接受函数

new\_inode（）

netlink\_sendmsg//**内核态接收用户态发送的数据**

rtnetlink\_rcv（）

netlink\_run\_queue（）

rtnetlink\_rcv\_msg（）

inet6\_rtm\_newroute（）

在kernel/net/netlink/af\_netlink.c文件中，**内核态接收用户态发送的数据，在netlink\_sendskb函数中调用sock的队列，执行相应的netlink接收函数**

1.  static int netlink\_sendmsg(struct kiocb \*kiocb, struct socket \*sock,  
    
2.  struct msghdr \*msg, size\_t len)  
    
3.  \{   
    
4.  struct sock\_iocb \*siocb  = kiocb\_to\_siocb(kiocb);  
    
5.  struct sock \*sk  = sock\->sk;  
    
6.  struct netlink\_sock \*nlk  = nlk\_sk(sk);  
    
7.  struct sockaddr\_nl \*addr=msg\->msg\_name;  
    
8.  u32 dst\_pid;  
    
9.  u32 dst\_group;  
    
10. struct sk\_buff \*skb;  
    
11. int err;  
    
12. struct scm\_cookie scm;  
    
13.   
    
14. if (msg\->msg\_flags&MSG\_OOB)  
    
15. return \-EOPNOTSUPP;  
    
16.   
    
17. if (NULL == siocb\->scm)  
    
18. siocb\->scm = &scm;  
    
19. err = scm\_send(sock, msg, siocb\->scm);  
    
20. if (err < 0)  
    
21. return err;  
    
22.   
    
23. if (msg\->msg\_namelen) \{   
    
24. if (addr\->nl\_family != AF\_NETLINK)  
    
25. return \-EINVAL;  
    
26. dst\_pid = addr\->nl\_pid;  
    
27. dst\_group = ffs(addr\->nl\_groups);  
    
28. if (dst\_group &&  !netlink\_capable(sock, NL\_NONROOT\_SEND))  
    
29. return \-EPERM;  
    
30. \} else \{   
    
31. dst\_pid = nlk\->dst\_pid;  
    
32. dst\_group = nlk\->dst\_group;  
    
33. \}  
    
34.   
    
35. if (!nlk\->pid) \{   
    
36. err = netlink\_autobind(sock);  
    
37. if (err)  
    
38. goto out;  
    
39. \}  
    
40.   
    
41. err = \-EMSGSIZE;  
    
42. if (len > sk\->sk\_sndbuf \- 32)  
    
43. goto out;  
    
44. err = \-ENOBUFS;  
    
45. skb = alloc\_skb(len, GFP\_KERNEL);// 分配一个sk\_buff结构，将msghdr结构转化为sk\_buff结构  
    
46. if (skb==NULL)  
    
47. goto out;  
    
48.   
    
49. NETLINK\_CB(skb).pid = nlk\->pid;//填写本地的pid信息  
    
50. NETLINK\_CB(skb).dst\_pid = dst\_pid;  
    
51. NETLINK\_CB(skb).dst\_group = dst\_group;  
    
52. NETLINK\_CB(skb).loginuid = audit\_get\_loginuid(current\->audit\_context);  
    
53. memcpy(NETLINK\_CREDS(skb), &siocb\->scm\->creds, sizeof(struct ucred));  
    
54.   
    
55. /\* What can I do? Netlink is asynchronous, so that  
    
56. we will have to save current capabilities to  
    
57. check them, when this message will be delivered  
    
58. to corresponding kernel module. \-\-ANK  (980802)  
    
59. \*/  
    
60.   
    
61. err = \-EFAULT;  
    
62. //数据拷贝进sk\_buff中  
    
63. if (memcpy\_fromiovec(skb\_put(skb,len), msg\->msg\_iov, len)) \{   
    
64. kfree\_skb(skb);  
    
65. goto out;  
    
66. \}  
    
67.   
    
68. err = security\_netlink\_send(sk, skb);  
    
69. if (err) \{   
    
70. kfree\_skb(skb);  
    
71. goto out;  
    
72. \}  
    
73.   
    
74. if (dst\_group) \{   
    
75. atomic\_inc(&skb\->users);  
    
76. netlink\_broadcast(sk, skb, dst\_pid, dst\_group, GFP\_KERNEL);  
    
77. \}  
    
78. err = netlink\_unicast(sk, skb, dst\_pid, msg\->msg\_flags&MSG\_DONTWAIT);  
    
79.   
    
80. out:  
    
81. return err;  
    
82. \}