syscall: Netlink message captured by syscall.ParseNetlinkMessage always has 0 pid

[lubronzhan]

Go version

go version go1.22.0 darwin/amd64

Output of go env in your module/workspace:

GO111MODULE='on'
GOARCH='amd64'
GOBIN=''
GOCACHE='/Users/lzhan/Library/Caches/go-build'
GOENV='/Users/lzhan/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/lzhan/work/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/Users/lzhan/work'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/opt/go/libexec'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/opt/go/libexec/pkg/tool/darwin_amd64'
GOVCS=''
GOVERSION='go1.22.0'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='cc'
CXX='c++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/yz/2cfkf6v56cg_p1srf2dsk6pm0000gp/T/go-build2040811365=/tmp/go-build -gno-record-gcc-switches -fno-common'
 ~/work/src/gitlab.eng.vmware.com/TKG/bolt/yaml   topic/lubron

What did you do?

I followed this example and wrote a simple program to subscribe netlink message using syscall.ParseNetlinkMessage
But the pid of the message is always 0

package main

import (
    "fmt"
    "syscall"
)

func main() {
    l, _ := ListenNetlink()

    for {
        msgs, err := l.ReadMsgs()
        if err != nil {
            fmt.Println("Could not read netlink: %s", err)
        }

        for _, m := range msgs {
            fmt.Println(m.Header.Pid)
        }
    }
}

type NetlinkListener struct {
    fd int
    sa *syscall.SockaddrNetlink
}

func ListenNetlink() (*NetlinkListener, error) {
    groups := (1 << (syscall.RTNLGRP_LINK - 1)) |
        (1 << (syscall.RTNLGRP_IPV4_IFADDR - 1)) |
        (1 << (syscall.RTNLGRP_IPV6_IFADDR - 1))

    s, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_DGRAM,
        syscall.NETLINK_ROUTE)
    if err != nil {
        return nil, fmt.Errorf("socket: %s", err)
    }

    saddr := &syscall.SockaddrNetlink{
        Family: syscall.AF_NETLINK,
        Pid:    uint32(0),
        Groups: uint32(groups),
    }

    err = syscall.Bind(s, saddr)
    if err != nil {
        return nil, fmt.Errorf("bind: %s", err)
    }

    return &NetlinkListener{fd: s, sa: saddr}, nil
}

func (l *NetlinkListener) ReadMsgs() ([]syscall.NetlinkMessage, error) {
    defer func() {
        recover()
    }()

    pkt := make([]byte, 2048)

    n, err := syscall.Read(l.fd, pkt)
    if err != nil {
        return nil, fmt.Errorf("read: %s", err)
    }

    msgs, err := syscall.ParseNetlinkMessage(pkt[:n])
    if err != nil {
        return nil, fmt.Errorf("parse: %s", err)
    }

    return msgs, nil
}
}

Then I tried create kubernetes pod on the node, CNI is calico

What did you see happen?

sender PID is always 0

What did you expect to see?

The pid should be the id of process who sent out the request. For example, in my case it should be calico.

If I use rtmon and extract the message using iproute2, I could see correct pid

[ianlancetaylor]

Just checking: you are reporting that you are using darwin/amd64, but SockaddrNetlink is only defined on Linux.

[lubronzhan]

Sorry, I compiled using GOOS=linux and GOARCH=amd64. Let me update the description

[linsite]

@lubronzhan Can you verify with minimium test like a strace -y ip addr add or remove random ip on loopback.

Please checkout the last recvmsg for pid is zero or not. I've tried your code on my Ubuntu18.04 PC , works fine, not a zero. It's the ip command process ID.

recvmsg(3<socket:[1472877011]>, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=1732624480, pid=22070}, {error=0, msg={len=40, type=RTM_NEWADDR, flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_REPLACE|NLM_F_CREATE, seq=1732624480, pid=0}}}, iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
exit_group(0) 

Also, according to the Linux document, the pid is short for port_id, but not always a PID, it may depend on the kernel's version?

https://www.kernel.org/doc/html/next/userspace-api/netlink/intro.html#nlmsg-pid

nlmsghdr.nlmsg_pid is the Netlink equivalent of an address. It is referred to as Port ID, sometimes Process ID because for historical reasons if the application does not select (bind() to) an explicit Port ID kernel will automatically assign it the ID equal to its Process ID (as reported by the getpid() system call).