Struct netlink_packet_audit::NetlinkAuditCodec

#[non_exhaustive]
pub struct NetlinkAuditCodec { /* private fields */ }

audit specific implementation of NetlinkMessageCodec due to the protocol violations in messages generated by kernal audit.

Among the known bugs in kernel audit messages:

• nlmsg_len sometimes contains the padding too (it shouldn’t)
• nlmsg_len sometimes doesn’t contain the header (it really should)

See also:

• https://blog.des.no/2020/08/netlink-auditing-and-counting-bytes/
• https://github.com/torvalds/linux/blob/b5013d084e03e82ceeab4db8ae8ceeaebe76b0eb/kernel/audit.c#L2386
• https://github.com/mozilla/libaudit-go/issues/24
• https://github.com/linux-audit/audit-userspace/issues/78

Trait Implementations

impl NetlinkMessageCodec for NetlinkAuditCodec

fn decode<T>(src: &mut BytesMut) -> Result<Option<NetlinkMessage<T>>>where T: NetlinkDeserializable + Debug,

Decode message of given type from datagram payload

fn encode<T>(msg: NetlinkMessage<T>, buf: &mut BytesMut) -> Result<()>where T: Debug + NetlinkSerializable,

Encode message to (datagram) buffer