VLAN information using NETLINK

Question

How do you get VLAN information like addition and deletion of VLAN sub interface from kernel to userspace using NETLINK socket in C?

I did little study in NETLINK man as suggested in comments. I added and deleted a VLAN sub interface and monitored using netlink socket program. For addition & deletion each receiving 3 messages. Addition sends 3 NEWLINK message and deletion sends 2 NEWLINK & 1 DELLINK message. Why is that so?

For addition of new VLAN interface eth1.75:

RTM_NEWLINK Link eth2.75 Down
RTM_NEWLINK Link eth2 Up
RTM_NEWLINK Link eth2.75 Up

For Deletion of VLAN interface eth2.75:

RTM_NEWLINK Link eth2 Up
RTM_NEWLINK Link eth2.75 Down
RTM_DELLINK eth2.75

Backbend

Read the man pages and come back when you're stuck on a specific question. Start with man 7 netlink and then man 7 rtnetlink. I think you'll get a RTM_NEWLINK for addition and RTM_DELINK for removal. Look in the source code for Network Manager for examples. – Croon

Answer 1

While creating a netlink socket, it create 3 devices. This is why you receive 3 events. Here is the 3 devices it creates while add event.

• Network subsystem.
• Sending Queue subsystem.
• Receiving Queue subsystem.

net subsystem is the upper level control device. Other two are queues for handing data. You can verify it as below.

When I do a udevadm monitor --env and create a vlan I get the following events from kernel:

UDEV  [305215.045416] add      /devices/virtual/net/vpn0 (net)
ACTION=add
DEVPATH=/devices/virtual/net/vpn0
ID_MM_CANDIDATE=1
IFINDEX=10
INTERFACE=vpn0
SEQNUM=3665
SUBSYSTEM=net
USEC_INITIALIZED=5215023319

UDEV  [305215.046658] add      /devices/virtual/net/vpn0/queues/rx-0 (queues)
ACTION=add
DEVPATH=/devices/virtual/net/vpn0/queues/rx-0
SEQNUM=3666
SUBSYSTEM=queues
USEC_INITIALIZED=15044665

UDEV  [305215.047628] add      /devices/virtual/net/vpn0/queues/tx-0 (queues)
ACTION=add
DEVPATH=/devices/virtual/net/vpn0/queues/tx-0
SEQNUM=3667
SUBSYSTEM=queues
USEC_INITIALIZED=5215044729

Loosetongued

Answer 2

RTM_NEWLINK messages are sent for every change in an interface state, typically from netdev_state_change (see: http://lxr.free-electrons.com/source/net/core/dev.c#L1226).

Basically, think about RTM_NEWLINK as "an interface changed state", rather than just "a new interface created".

For example, for addition of VLAN interface you get:

1. Notification of a new interface eth2.75 in DOWN state
2. Notification of the state of the underlying physical interface eth2 (it now has a "subordinate" interface which it didn't have before - for example some NIC cards has HW offload to filter unwanted VLAN tags. The interface may now need to update the NIC etc.). eth2 is in UP state and remains so - but its internal state changed.
3. Notification that eth2.75 went from DOWN to UP state.

In a similar fashion for delete you see:

1. Notification of eth2 state change (disassociated from eth2.75 and the VLAN)
2. Notification of eth2.75 going from UP to DOWN state
3. Notification of removal of eth2.75 interface

Fe

Answer 3

Likely you are using ifupdown utility, e.g. ifup, right?

For some reason it contains a strange logic: during adding or upping procedure if interface name contains a dot symbol ('.'), then it calls ip link set up for "parent" interface before processing a child one. It also contains a special logic for "set down" procedure similar that you are writing about. You can check it in "link.defn" file of ifupdown sources.

By the way, nowadays you can use strace utility for debugging netlink, e.g.

sudo strace ip link add link eth2 name eth2.75 type vlan id 75 2> ./log.

Then look for sendmsg or sendto instructions in log file.

Mb