Rust网络诊断库netlink-packet-sock-diag的使用：Linux套接字状态监控与网络连接分析

netlink-packet-sock-diag是一个Rust库，用于通过Linux的netlink接口访问套接字诊断信息。它允许开发者以编程方式获取Linux系统中套接字的状态和统计信息，非常适合网络监控、诊断工具和连接分析应用的开发。

主要功能

• 查询系统中所有打开的套接字
• 获取TCP/UDP/UNIX域套接字的详细信息
• 监控套接字状态变化
• 分析网络连接统计信息

使用方法

添加依赖

首先在Cargo.toml中添加依赖：

[dependencies]
netlink-packet-sock-diag = "0.2"
netlink-sys = "0.8"

基本示例：列出所有TCP套接字

use netlink_packet_sock_diag::{
    constants::*,
    inet::{InetRequest, SocketId},
    SockDiagMessage,
};
use netlink_sys::{protocols::NETLINK_SOCK_DIAG, Socket, SocketAddr};

fn list_tcp_sockets() -> Result<(), String> {
    // 创建netlink套接字
    let mut socket = Socket::new(NETLINK_SOCK_DIAG)
        .map_err(|e| format!("Failed to create socket: {}", e))?;
    
    // 连接到内核
    let kernel_addr = SocketAddr::new(0, 0);
    socket.bind(&kernel_addr)
        .map_err(|e| format!("Failed to bind: {}", e))?;

    // 构建请求消息
    let mut msg = SockDiagMessage::new_inet_request(InetRequest {
        header: SockDiagHeader {
            family极问题，建议适当过滤
- 某些信息可能因内核版本不同而有所变化

通过`netlink-packet-sock-diag`库，Rust开发者可以方便地构建强大的网络诊断工具，深入分析Linux系统的网络连接状态。

## 完整示例代码

下面是一个完整的网络连接监控工具示例，结合了上述所有功能：

```rust
use netlink_packet_sock_diag::{
    constants::*,
    inet::{InetRequest, InetResponse, SocketId},
    unix::{UnixRequest, UnixResponse},
    SockDiagHeader, SockDiagMessage,
};
use netlink_sys::{protocols::NETLINK_SOCK_DIAG, Socket, SocketAddr};
use std::process;

fn main() {
    println!("Linux Socket Monitor Tool");
    println!("1. List all TCP sockets");
    println!("2. Monitor established TCP connections");
    println!("3. List UNIX domain sockets");
    println!("4. Exit");

    loop {
        let mut input = String::new();
        std::io::stdin()
            .read_line(&mut input)
            .expect("Failed to read input");

        match input.trim() {
            "1" => {
                if let Err(e) = list_tcp_sockets() {
                    eprintln!("Error: {}", e);
                }
            }
            "2" => {
                if let Err(e) = monitor_established_connections() {
                    eprintln!("Error: {}", e);
                }
            }
            "3" => {
                if let Err(e) = list_unix_sockets() {
                    eprintln!("Error: {}", e);
                }
            }
            "4" => process::exit(0),
            _ => println!("Invalid option"),
        }
    }
}

fn list_tcp_sockets() -> Result<(), String> {
    let mut socket = Socket::new(NETLINK_SOCK_DIAG)
        .map_err(|e| format!("Failed to create socket: {}", e))?;
    
    let kernel_addr = SocketAddr::new(0, 0);
    socket.bind(&kernel_addr)
        .map_err(|e| format!("Failed to bind: {}", e))?;

    let mut msg = SockDiagMessage::new_inet_request(InetRequest {
        header: SockDiagHeader {
            family: AF_INET as u8,
            protocol: IPPROTO_TCP as u8,
            states: (1 << TCP_ESTABLISHED) | (1 << TCP_LISTEN) | (1 << TCP_CLOSE_WAIT),
            ..Default::default()
        },
        socket_id: SocketId::default(),
    });

    socket.send(&msg)
        .map_err(|e| format!("Failed to send request: {}", e))?;

    println!("TCP Sockets:");
    println!("{:<20} {:<10} {:<20} {:<10} {:<15}", "Source IP", "Port", "Dest IP", "Port", "State");

    loop {
        let mut buf = vec![0; 4096];
        let len = match socket.recv(&mut buf, 0) {
            Ok(len) => len,
            Err(_) => break, // 接收结束
        };
        
        let response = SockDiagMessage::parse(&buf[..len])
            .map_err(|e| format!("Failed to parse response: {}", e))?;

        if let SockDiagMessage::InetResponse(InetResponse { header, socket_id, .. }) = response {
            let state = match header.states {
                s if s == (1 << TCP_ESTABLISHED) => "ESTABLISHED",
                s if s == (1 << TCP_LISTEN) => "LISTEN",
                s if s == (1 << TCP_CLOSE_WAIT) => "CLOSE_WAIT",
                _ => "UNKNOWN",
            };

            println!(
                "{:<20} {:<10} {:<20} {:<10} {:<15}",
                socket_id.source.ip(),
                socket_id.source.port(),
                socket_id.destination.ip(),
                socket_id.destination.port(),
                state
            );
        }
    }

    Ok(())
}

fn monitor_established_connections() -> Result<(), String> {
    let mut socket = Socket::new(NETLINK_SOCK_DIAG)
        .map_err(|e| format!("Failed to create socket: {}", e))?;
    
    let kernel_addr = SocketAddr::new(0, 0);
    socket.bind(&kernel_addr)
        .map_err(|e| format!("Failed to bind: {}", e))?;

    let mut msg = SockDiagMessage::new_inet_request(InetRequest {
        header: SockDiagHeader {
            family: AF_INET as u8,
            protocol: IPPROTO_TCP as u8,
            states: 1 << TCP_ESTABLISHED,
            ..Default::default()
        },
        socket_id: SocketId::default(),
    });

    socket.send(&msg)
        .map_err(|e| format!("Failed to send request: {}", e))?;

    println!("Monitoring established TCP connections...");
    println!("Press Ctrl+C to stop");
    println!("{:<20} {:<10} {:<20} {:<10}", "Source IP", "Port", "Dest IP", "Port");

    loop {
        let mut buf = vec![0; 4096];
        let len = socket.recv(&mut buf, 0)
            .map_err(|e| format!("Failed to receive: {}", e))?;
        
        let response = SockDiagMessage::parse(&buf[..len])
            .map_err(|e| format!("Failed to parse: {}", e))?;

        if let SockDiagMessage::InetResponse(InetResponse { socket_id, .. }) = response {
            println!(
                "{:<20} {:<10} {:<20} {:<10}",
                socket_id.source.ip(),
                socket_id.source.port(),
                socket_id.destination.ip(),
                socket_id.destination.port()
            );
        }
    }
}

fn list_unix_sockets() -> Result<(), String> {
    let mut socket = Socket::new(NETLINK_SOCK_DIAG)
        .map_err(|e| format!("Failed to create socket: {}", e))?;
    
    let kernel_addr = SocketAddr::new(0, 0);
    socket.bind(&kernel_addr)
        .map_err(|e| format!("Failed to bind: {}", e))?;

    let mut msg = SockDiagMessage::new_unix_request(UnixRequest {
        header: SockDiagHeader {
            family: AF_UNIX as u8,
            ..Default::default()
        },
        states: 0xffffffff,
    });

    socket.send(&msg)
        .map_err(|e| format!("Failed to send request: {}", e))?;

    println!("UNIX Domain Sockets:");
    println!("{:<15} {:<50}", "Inode", "Path");

    loop {
        let mut buf = vec![0; 4096];
        let len = match socket.recv(&mut buf, 0) {
            Ok(len) => len,
            Err(_) => break,
        };
        
        let response = SockDiagMessage::parse(&buf[..len])
            .map_err(|e| format!("Failed to parse response: {}", e))?;

        if let SockDiagMessage::UnixResponse(UnixResponse { attributes, .. }) = response {
            let path = attributes.path.as_deref().unwrap_or("");
            println!("{:<15} {:<50}", attributes.inode.unwrap_or(0), path);
        }
    }

    Ok(())
}

这个完整示例提供了一个交互式命令行工具，可以：

1. 列出所有TCP套接字及其状态
2. 实时监控已建立的TCP连接
3. 列出所有UNIX域套接字及其inode和路径

每个功能都使用了netlink-packet-sock-diag库来与Linux内核通信，并格式化输出结果以便于阅读。