NG_SOCKET(4)

💅 ng_socket(4) — the netgraph socket node type, bestie edition 🫶

Okay so real talk: this is the manual page for ng_socket, the netgraph socket node type, and it's genuinely one of the most iconic little bridge-between-worlds situations in the kernel. Let's get into it. ✨

---

🌸 NAME 🌸

ng_socket — netgraph socket node type. That's the whole vibe. A node type. For sockets. Slay.

---

🎀 SYNOPSIS 🎀

#include <sys/types.h>
#include <netgraph/ng_socket.h>

That's it, that's the whole include situation. 💖

---

🦋 DESCRIPTION 🦋

So a socket node is, like, both — a BSD socket and a netgraph node at the same time. Main character duality fr fr. The ng_socket node type is what lets user-mode processes participate in the kernel netgraph(4) networking subsystem using the plain BSD socket interface. No cap.

Heads up though — the process must have root privileges to be able to create netgraph sockets. But once they're created? Any process that has one may use it. The keys are already in the group chat, basically. 🔑

A new ng_socket node gets created by creating a new socket of type NG_CONTROL in the protocol family PF_NETGRAPH, using the socket(2) system call. Any control messages received by the node that don't have a cookie value of NGM_SOCKET_COOKIE get received by the process, using recvfrom(2). The socket address argument there is a struct sockaddr_ng containing the sender's netgraph address. And conversely (iconic word), control messages can be sent to any node by calling sendto(2), supplying the recipient's address in a struct sockaddr_ng. The bind(2) system call may be used to assign a global netgraph name to the node. Global name. It's giving celebrity status. ⭐

Now, to transmit and receive netgraph data packets, a NG_DATA socket must also be created using socket(2) and associated with an ng_socket node. Important: NG_DATA sockets do not automatically have nodes associated with them — they get bound to a specific node via the connect(2) system call. The address argument is the netgraph address of the ng_socket node you already created. Once a data socket is associated with a node, any data packets received by the node are read using recvfrom(2), and any packets to be sent out from the node are written using sendto(2). In the case of data sockets, the struct sockaddr_ng contains the name of the hook on which the data was received or should be sent. 🎯

And here's the cute little special case: to allow netgraph data sockets to be used as stdin or stdout on naive programs, a sendto(2) with a NULL sockaddr pointer, a send(2), or a write(2) will succeed in the case where there is exactly ONE hook attached to the socket node (and thus the path is unambiguous). Lowkey genius. One hook, no confusion, it just works. 🙈

Also! There's a user library that simplifies using netgraph sockets; see netgraph(3). Use the library, bestie, your future self will thank you. 💜

---

🌈 HOOKS 🌈

This node type supports hooks with arbitrary names (as long as they are unique) and always accepts hook connection requests. No gatekeeping. Not once. Never. 💅

---

👑 CONTROL MESSAGES 👑

This node type supports the generic control messages, plus the following:

• NGM_SOCK_CMD_NOLINGER — When the last hook is removed from this node, it will shut down as if it had received a NGM_SHUTDOWN message. Attempts to access the sockets associated will return ENOTCONN.
• NGM_SOCK_CMD_LINGER — This is the default mode. When the last hook is removed, the node will continue to exist, ready to accept new hooks until it is explicitly shut down. It's just standing there. Menacingly. Patiently. 🧚

All other messages with neither the NGM_SOCKET_COOKIE or NGM_GENERIC_COOKIE will be passed unaltered up the NG_CONTROL socket. Passed. Unaltered. Respect the messenger. 🍓

---

💀 SHUTDOWN 💀

This node type shuts down and disappears when both the associated NG_CONTROL and NG_DATA sockets have been closed, or a NGM_SHUTDOWN control message is received.

In that latter case, attempts to write to the still-open sockets will return ENOTCONN. Rude but fair.

And if the NGM_SOCK_CMD_NOLINGER message has been received, closure of the last hook will also initiate a shutdown of the node. So many ways to say goodbye. 😭

---

🔥 SEE ALSO 🔥

socket(2), netgraph(3), netgraph(4), ng_ksocket(4), ngctl(8)

The whole friend group, assembled. 🫶

---

📜 HISTORY 📜

The ng_socket node type was implemented in FreeBSD 4.0. Vintage. Retro. Still slaying. ⭐

---

🎀 AUTHORS 🎀

Julian Elischer <julian@FreeBSD.org>

We stan. 👑

---

🐛 BUGS 🐛

Okay so, two things, and neither is our fault:

• It is not possible to reject the connection of a hook — though any data received on that hook can certainly be ignored. So you can't say no, but you can leave it on read. 💀
• The controlling process is not notified of all events that an in-kernel node would be notified of, e.g. a new hook, or hook removal. Some node-initiated messages should be defined for this purpose (to be sent up the control socket). So like... the group chat notifications are off for some events. Known issue. Fix pending (spiritually).

---

and that's the whole page, bestie — you're officially fluent in ng_socket 💅✨

This little rewrite was brought to you by the Debian build of the page, dated January 19, 1999, footer original NG_SOCKET(4) and all — go forth and socket responsibly. 🦋💖