Hello,
I came across the kernel driver code implementing some sort of IGMP snooping backend and as part of its functionalilty it creates a new socket address family, AF_IGMPSNOOP, but actually implements just a few operations for this type of socket:
static struct proto_ops igmp_snoop_ops = { family: AF_IGMP_SNOOP, release: _igmp_snoop_sock_release, bind: sock_no_bind, connect: sock_no_connect, socketpair: sock_no_socketpair, accept: sock_no_accept, getname: sock_no_getname, poll: datagram_poll, ioctl: sock_no_ioctl, listen: sock_no_listen, shutdown: sock_no_shutdown, setsockopt: _igmp_snoop_setsockopt, getsockopt: sock_no_getsockopt, sendmsg: _igmp_snoop_sock_sendmsg, recvmsg: _igmp_snoop_sock_recvmsg, mmap: sock_no_mmap, sendpage: sock_no_sendpage, }
However from a user space perspective a socket is created as:
fd = socket (AF_IGMPSNOOP, SOCK_RAW, IPPROTO_IGMP)
I'm wondering what is the rationale for adding a new family, while in fact a raw socket is being used to access the stack for IGMP packets? Would not it be the same to just create AF_INET raw socket and do the things?
Looking forward to hearing form you ! Thanks.
Mark