Netlink is a

socket Socket may refer to: Mechanics * Socket wrench, a type of wrench that uses separate, removable sockets to fit different sizes of nuts and bolts * Socket head screw, a screw (or bolt) with a cylindrical head containing a socket into which the hexag ...

family used for

inter-process communication In computer science, inter-process communication or interprocess communication (IPC) refers specifically to the mechanisms an operating system provides to allow the processes to manage shared data. Typically, applications can use IPC, categori ...

(IPC) between both the kernel and

userspace A modern computer operating system usually segregates virtual memory into user space and kernel space. Primarily, this separation serves to provide memory protection and hardware protection from malicious or errant software behaviour. Kernel ...

processes, and between different userspace processes, in a way similar to the

Unix domain socket A Unix domain socket aka UDS or IPC socket ( inter-process communication socket) is a data communications endpoint for exchanging data between processes executing on the same host operating system. It is also referred to by its address family AF_U ...

s available on certain Unix-like

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...

s, including its original incarnation as a

Linux kernel interface The Linux kernel provides several interfaces to user-space applications that are used for different purposes and that have different properties by design. There are two types of application programming interface (API) in the Linux kernel that ...

, as well as in the form of a later implementation on

FreeBSD FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...

. Similarly to the

Unix domain sockets A Unix domain socket aka UDS or IPC socket (inter-process communication socket) is a data communications endpoint for exchanging data between processes executing on the same host operating system. It is also referred to by its address family AF_UN ...

, and unlike INET sockets, Netlink communication cannot traverse host boundaries. However, while the Unix domain sockets use the

file system In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one larg ...

namespace, Netlink sockets are usually addressed by

process identifier In computing, the process identifier (a.k.a. process ID or PID) is a number used by most operating system kernels—such as those of Unix, macOS and Windows—to uniquely identify an active process. This number may be used as a parameter in various ...

s (PIDs). Netlink is designed and used for transferring miscellaneous networking information between the

kernel space A modern computer operating system usually segregates virtual memory into user space and kernel space. Primarily, this separation serves to provide memory protection and hardware protection from malicious or errant software behaviour. Kernel ...

and userspace processes. Networking utilities, such as the

iproute2 iproute2 is a collection of userspace utilities for controlling and monitoring various aspects of networking in the Linux kernel, including routing, network interfaces, tunnels, traffic control, and network-related device drivers. iproute2 ...

family and the utilities used for configuring

mac80211 A wireless network interface controller (WNIC) is a network interface controller which connects to a wireless network, such as Wi-Fi or Bluetooth, rather than a wired network, such as a Token Ring or Ethernet. A WNIC, just like other NICs, wor ...

-based wireless drivers, use Netlink to communicate with the

Linux kernel The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel. It was originally authored in 1991 by Linus Torvalds for his i386-based PC, and it was soon adopted as the kernel for the GNU ope ...

from userspace. Netlink provides a standard

-based interface for userspace processes, and a kernel-side

API An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software Interface (computing), interface, offering a service to other pieces of software. A document or standa ...

for internal use by

kernel module In computing, a loadable kernel module (LKM) is an object file that contains code to extend the running kernel, or so-called ''base kernel'', of an operating system. LKMs are typically used to add support for new hardware (as device drivers) and/ ...

s. Originally, Netlink used the socket family. Netlink is designed to be a more flexible successor to

ioctl In computing, ioctl (an abbreviation of input/output control) is a system call for device-specific input/output operations and other operations which cannot be expressed by regular system calls. It takes a parameter specifying a request code; th ...

RFC 3549
describes the protocol in detail.

History

Netlink was created by Alexey Kuznetsov as a more flexible alternative to the sophisticated but awkward communication method used for setting and getting external socket options. The Linux kernel continues to support for backward compatibility. Netlink was first provided in the 2.0 series of the Linux kernel, implemented as a

character device In Unix-like operating systems, a device file or special file is an interface to a device driver that appears in a file system as if it were an ordinary file. There are also special files in DOS, OS/2, and Windows. These special files allow an ...

. By 2013, this interface is obsolete, but still forms an

communication method; compare the use of . The Netlink socket interface appeared in 2.2 series of the Linux kernel. In 2022, experimental support for the Netlink protocol was added to FreeBSD. Initially, only a subset of the NETLINK_ROUTE functionality is supported.

Packet structure

Unlike BSD sockets using Internet protocols such as TCP, where the message headers are autogenerated, the Netlink message header (available as ) must be prepared by the caller. The Netlink socket generally works in a -like mode, even if was used to create it. The data portion then contains a subsystem-specific message that may be further nested.

Netlink socket families

The family offers multiple protocol subsets. Each interfaces to a different kernel component and has a different messaging subset. The subset is referenced by the protocol field in the socket call: int socket(AF_NETLINK, SOCK_DGRAM ''or'' SOCK_RAW, ''protocol'') Lacking a standard, and are not guaranteed to be implemented in a given Linux (or other OS) release. Some sources state that both options are legitimate, and the reference below from

Red Hat Red Hat, Inc. is an American software company that provides open source software products to enterprises. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina, with other offices worldwide. Red Hat has become ass ...

states that is always the parameter. However, iproute2 uses both interchangeably.

Netlink protocols

A non-exhaustive list of the supported ''protocol'' entries follows: ; NETLINK_ROUTE provides routing and link information. This information is used primarily for user-space routing daemons.

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...

implements a large subset of messages: * Link layer: ''RTM_NEWLINK'', ''RTM_DELLINK'', ''RTM_GETLINK'', ''RTM_SETLINK'' * Address settings: ''RTM_NEWADDR'', ''RTM_DELADDR'', ''RTM_GETADDR'' * Routing tables: ''RTM_NEWROUTE'', ''RTM_DELROUTE'', ''RTM_GETROUTE'' * Neighbor cache: ''RTM_NEWNEIGH'', ''RTM_DELNEIGH'', ''RTM_GETNEIGH'' * Routing rules: ''RTM_NEWRULE'', ''RTM_DELRULE'', ''RTM_GETRULE'' * Queuing discipline settings: ''RTM_NEWQDISC'', ''RTM_DELQDISC'', ''RTM_GETQDISC'' * Traffic classes used with queues: ''RTM_NEWTCLASS'', ''RTM_DELTCLASS'', ''RTM_GETTCLASS'' * Traffic filters: ''RTM_NEWTFILTER'', ''RTM_DELTFILTER'', ''RTM_GETTFILTER'' * Others: ''RTM_NEWACTION'', ''RTM_DELACTION'', ''RTM_GETACTION'', ''RTM_NEWPREFIX'', ''RTM_GETPREFIX'', ''RTM_GETMULTICAST'', ''RTM_GETANYCAST'', ''RTM_NEWNEIGHTBL'', ''RTM_GETNEIGHTBL'', ''RTM_SETNEIGHTBL'' ; NETLINK_FIREWALL provides an interface for a user-space app to receive packets from the

firewall Firewall may refer to: * Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts * Firewall (construction), a barrier inside a building, designed to limit the spre ...

. ; NETLINK_NFLOG provides an interface used to communicate between

Netfilter Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network addre ...

and

iptables iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules. The filters are organized in different tables, which ...

. ; NETLINK_ARPD provides an interface to manage the ARP table from user-space. ; NETLINK_AUDIT provides an interface to the audit subsystem found in Linux kernel versions 2.6.6 and later. ; NETLINK_IP6_FW provides an interface to transport packets from netfilter to user-space. ; NETLINK_ROUTE6 ; NETLINK_TAPBASE ; NETLINK_NETFILTER ; NETLINK_TCPDIAG ; NETLINK_XFRM provides an interface to manage the

IPsec In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...

security association A security association (SA) is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and paramet ...

and security policy databases - mostly used by key-manager daemons using the

Internet Key Exchange In computing, Internet Key Exchange (IKE, sometimes IKEv1 or IKEv2, depending on version) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP.The Internet Key Excha ...

protocol. ; NETLINK_KOBJECT_UEVENT provides the interface in which the kernel broadcasts uevents, typically consumed by

udev udev (userspace ) is a device manager for the Linux kernel. As the successor of devfsd and hotplug, udev primarily manages device nodes in the directory. At the same time, udev also handles all user space events raised when hardware devices ar ...

. ; NETLINK_GENERIC One of the drawbacks of the Netlink protocol is that the number of protocol families is limited to 32 ().This is one of the main reasons that the generic Netlink family was created—to provide support for adding a higher number of families. It acts as a Netlink multiplexer and works with a single Netlink family . The generic Netlink protocol is based on the Netlink protocol and uses its API.

User-defined Netlink protocol

Users can add a Netlink handler in their own kernel routines. This allows the development of additional Netlink protocols to address new kernel modules.

References

External links

Pablo Neira Ayuso, Rafael M. Gasca, Laurent Lefèvre. Communicating between the kernel and user-space in Linux using Netlink sockets. Software: Practice and Experience, 40(9):797-810, August 2010

Why and How to Use Netlink Sockets

RFC 3549

netfilter/iptables project homepage - The netfilter.org "libmnl" project
– Minimalist Library for Netlink – userspace library for construction and parsing of Netlink messages
libnl - Netlink Protocol Library Suite
– Netlink Protocol Library Suite – full functional library covering almost all aspects of working with Netlink sockets
Manipulating the Networking Environment Using RTNETLINK

Netlink Protocol Library Suite

"Linux Kernel Networking" by Rami Rosen, Apress 2013: Chapter 2, Netlink Sockets
{{Linux kernel Interfaces of the Linux kernel Linux kernel features