Skip to main content

parse_netlink_message

proc_connector

Function parse_netlink_message 

Source 
pub fn parse_netlink_message(
    payload: &[u8],
    len: usize,
) -> Result<Option<ProcEvent>>
Expand description

Parse a single netlink message payload (starting after nlmsghdr) into a ProcEvent.

payload is the full received buffer starting at the nlmsghdr. len is the number of valid bytes in payload.

This function handles:

  • NLMSG_NOOP → None (caller should continue reading)
  • NLMSG_DONE (with no payload, i.e., true multi-part terminator) → None Note: the kernel connector protocol uses NLMSG_DONE with a payload for all data messages, so only 16-byte NLMSG_DONE is treated as a control message.
  • NLMSG_ERROR → Err
  • NLMSG_OVERRUN → Err(Overrun)
  • NLMSG_DATA + valid cn_msg + proc_event → Some(ProcEvent)

§Example

use proc_connector::{parse_netlink_message, Error};

// Too short → Truncated
let buf = [0u8; 4];
assert!(matches!(parse_netlink_message(&buf, 4), Err(Error::Truncated)));

// NLMSG_NOOP → None
let mut buf = [0u8; 16];
buf[0..4].copy_from_slice(&16u32.to_ne_bytes()); // nlmsg_len
buf[4..6].copy_from_slice(&1u16.to_ne_bytes());   // nlmsg_type = NLMSG_NOOP
assert!(parse_netlink_message(&buf, 16).unwrap().is_none());