src/libsystemd/sd-device/device-monitor.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <linux/filter.h>
   5 #include <linux/netlink.h>
   6 #include <sys/socket.h>
   7
   8 #include "sd-device.h"
   9 #include "sd-event.h"
  10
  11 #include "MurmurHash2.h"
  12 #include "alloc-util.h"
  13 #include "device-monitor-private.h"
  14 #include "device-private.h"
  15 #include "device-util.h"
  16 #include "fd-util.h"
  17 #include "format-util.h"
  18 #include "hashmap.h"
  19 #include "missing.h"
  20 #include "mount-util.h"
  21 #include "set.h"
  22 #include "socket-util.h"
  23 #include "string-util.h"
  24 #include "strv.h"
  25
  26 struct sd_device_monitor {
  27         unsigned n_ref;
  28
  29         int sock;
  30         union sockaddr_union snl;
  31         union sockaddr_union snl_trusted_sender;
  32         bool bound;
  33
  34         Hashmap *subsystem_filter;
  35         Set *tag_filter;
  36         bool filter_uptodate;
  37
  38         sd_event *event;
  39         sd_event_source *event_source;
  40         int64_t event_priority;
  41         sd_device_monitor_handler_t callback;
  42         void *userdata;
  43 };
  44
  45 #define UDEV_MONITOR_MAGIC                0xfeedcafe
  46
  47 typedef struct monitor_netlink_header {
  48         /* "libudev" prefix to distinguish libudev and kernel messages */
  49         char prefix[8];
  50         /* Magic to protect against daemon <-> Library message format mismatch
  51          * Used in the kernel from socket filter rules; needs to be stored in network order */
  52         unsigned magic;
  53         /* Total length of header structure known to the sender */
  54         unsigned header_size;
  55         /* Properties string buffer */
  56         unsigned properties_off;
  57         unsigned properties_len;
  58         /* Hashes of primary device properties strings, to let libudev subscribers
  59          * use in-kernel socket filters; values need to be stored in network order */
  60         unsigned filter_subsystem_hash;
  61         unsigned filter_devtype_hash;
  62         unsigned filter_tag_bloom_hi;
  63         unsigned filter_tag_bloom_lo;
  64 } monitor_netlink_header;
  65
  66 static int monitor_set_nl_address(sd_device_monitor *m) {
  67         union sockaddr_union snl;
  68         socklen_t addrlen;
  69
  70         assert(m);
  71
  72         /* Get the address the kernel has assigned us.
  73          * It is usually, but not necessarily the pid. */
  74         addrlen = sizeof(struct sockaddr_nl);
  75         if (getsockname(m->sock, &snl.sa, &addrlen) < 0)
  76                 return -errno;
  77
  78         m->snl.nl.nl_pid = snl.nl.nl_pid;
  79         return 0;
  80 }
  81
  82 int device_monitor_allow_unicast_sender(sd_device_monitor *m, sd_device_monitor *sender) {
  83         assert_return(m, -EINVAL);
  84         assert_return(sender, -EINVAL);
  85
  86         m->snl_trusted_sender.nl.nl_pid = sender->snl.nl.nl_pid;
  87         return 0;
  88 }
  89
  90 _public_ int sd_device_monitor_set_receive_buffer_size(sd_device_monitor *m, size_t size) {
  91         int r, n = (int) size;
  92
  93         assert_return(m, -EINVAL);
  94         assert_return((size_t) n == size, -EINVAL);
  95
  96         if (setsockopt_int(m->sock, SOL_SOCKET, SO_RCVBUF, n) < 0) {
  97                 r = setsockopt_int(m->sock, SOL_SOCKET, SO_RCVBUFFORCE, n);
  98                 if (r < 0)
  99                         return r;
 100         }
 101
 102         return 0;
 103 }
 104
 105 int device_monitor_disconnect(sd_device_monitor *m) {
 106         assert(m);
 107
 108         m->sock = safe_close(m->sock);
 109         return 0;
 110 }
 111
 112 int device_monitor_get_fd(sd_device_monitor *m) {
 113         assert_return(m, -EINVAL);
 114
 115         return m->sock;
 116 }
 117
 118 int device_monitor_new_full(sd_device_monitor **ret, MonitorNetlinkGroup group, int fd) {
 119         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *m = NULL;
 120         _cleanup_close_ int sock = -1;
 121         int r;
 122
 123         assert_return(ret, -EINVAL);
 124         assert_return(group >= 0 && group < _MONITOR_NETLINK_GROUP_MAX, -EINVAL);
 125
 126         if (group == MONITOR_GROUP_UDEV &&
 127             access("/run/udev/control", F_OK) < 0 &&
 128             dev_is_devtmpfs() <= 0) {
 129
 130                 /*
 131                  * We do not support subscribing to uevents if no instance of
 132                  * udev is running. Uevents would otherwise broadcast the
 133                  * processing data of the host into containers, which is not
 134                  * desired.
 135                  *
 136                  * Containers will currently not get any udev uevents, until
 137                  * a supporting infrastructure is available.
 138                  *
 139                  * We do not set a netlink multicast group here, so the socket
 140                  * will not receive any messages.
 141                  */
 142
 143                 log_debug("sd-device-monitor: The udev service seems not to be active, disabling the monitor");
 144                 group = MONITOR_GROUP_NONE;
 145         }
 146
 147         if (fd < 0) {
 148                 sock = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_KOBJECT_UEVENT);
 149                 if (sock < 0)
 150                         return log_debug_errno(errno, "sd-device-monitor: Failed to create socket: %m");
 151         }
 152
 153         m = new(sd_device_monitor, 1);
 154         if (!m)
 155                 return -ENOMEM;
 156
 157         *m = (sd_device_monitor) {
 158                 .n_ref = 1,
 159                 .sock = fd >= 0 ? fd : TAKE_FD(sock),
 160                 .bound = fd >= 0,
 161                 .snl.nl.nl_family = AF_NETLINK,
 162                 .snl.nl.nl_groups = group,
 163         };
 164
 165         if (fd >= 0) {
 166                 r = monitor_set_nl_address(m);
 167                 if (r < 0)
 168                         return log_debug_errno(r, "sd-device-monitor: Failed to set netlink address: %m");
 169         }
 170
 171         *ret = TAKE_PTR(m);
 172         return 0;
 173 }
 174
 175 _public_ int sd_device_monitor_new(sd_device_monitor **ret) {
 176         return device_monitor_new_full(ret, MONITOR_GROUP_UDEV, -1);
 177 }
 178
 179 _public_ int sd_device_monitor_stop(sd_device_monitor *m) {
 180         assert_return(m, -EINVAL);
 181
 182         m->event_source = sd_event_source_unref(m->event_source);
 183         (void) device_monitor_disconnect(m);
 184
 185         return 0;
 186 }
 187
 188 static int device_monitor_event_handler(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 189         _cleanup_(sd_device_unrefp) sd_device *device = NULL;
 190         sd_device_monitor *m = userdata;
 191
 192         assert(m);
 193
 194         if (device_monitor_receive_device(m, &device) <= 0)
 195                 return 0;
 196
 197         if (m->callback)
 198                 return m->callback(m, device, m->userdata);
 199
 200         return 0;
 201 }
 202
 203 _public_ int sd_device_monitor_start(sd_device_monitor *m, sd_device_monitor_handler_t callback, void *userdata, const char *description) {
 204         _cleanup_(sd_event_source_unrefp) sd_event_source *s = NULL;
 205         int r;
 206
 207         assert_return(m, -EINVAL);
 208
 209         if (!m->event) {
 210                 r = sd_device_monitor_attach_event(m, NULL, 0);
 211                 if (r < 0)
 212                         return r;
 213         }
 214
 215         r = device_monitor_enable_receiving(m);
 216         if (r < 0)
 217                 return r;
 218
 219         m->callback = callback;
 220         m->userdata = userdata;
 221
 222         r = sd_event_add_io(m->event, &s, m->sock, EPOLLIN, device_monitor_event_handler, m);
 223         if (r < 0)
 224                 return r;
 225
 226         r = sd_event_source_set_priority(s, m->event_priority);
 227         if (r < 0)
 228                 return r;
 229
 230         if (description) {
 231                 r = sd_event_source_set_description(s, description);
 232                 if (r < 0)
 233                         return r;
 234         }
 235
 236         m->event_source = TAKE_PTR(s);
 237
 238         return 0;
 239 }
 240
 241 _public_ int sd_device_monitor_detach_event(sd_device_monitor *m) {
 242         assert_return(m, -EINVAL);
 243
 244         (void) sd_device_monitor_stop(m);
 245         m->event = sd_event_unref(m->event);
 246
 247         return 0;
 248 }
 249
 250 _public_ int sd_device_monitor_attach_event(sd_device_monitor *m, sd_event *event, int64_t priority) {
 251         int r;
 252
 253         assert_return(m, -EINVAL);
 254         assert_return(!m->event, -EBUSY);
 255
 256         if (event)
 257                 m->event = sd_event_ref(event);
 258         else {
 259                 r = sd_event_default(&m->event);
 260                 if (r < 0)
 261                         return 0;
 262         }
 263
 264         m->event_priority = priority;
 265
 266         return 0;
 267 }
 268
 269 _public_ sd_event *sd_device_monitor_get_event(sd_device_monitor *m) {
 270         assert_return(m, NULL);
 271
 272         return m->event;
 273 }
 274
 275 _public_ sd_event_source *sd_device_monitor_get_event_source(sd_device_monitor *m) {
 276         assert_return(m, NULL);
 277
 278         return m->event_source;
 279 }
 280
 281 int device_monitor_enable_receiving(sd_device_monitor *m) {
 282         int r;
 283
 284         assert_return(m, -EINVAL);
 285
 286         if (!m->filter_uptodate) {
 287                 r = sd_device_monitor_filter_update(m);
 288                 if (r < 0)
 289                         return log_debug_errno(r, "sd-device-monitor: Failed to update filter: %m");
 290         }
 291
 292         if (!m->bound) {
 293                 if (bind(m->sock, &m->snl.sa, sizeof(struct sockaddr_nl)) < 0)
 294                         return log_debug_errno(errno, "sd-device-monitor: Failed to bind monitoring socket to event source: %m");
 295
 296                 m->bound = true;
 297         }
 298
 299         r = monitor_set_nl_address(m);
 300         if (r < 0)
 301                 return log_debug_errno(r, "sd-device-monitor: Failed to set address: %m");
 302
 303         /* enable receiving of sender credentials */
 304         r = setsockopt_int(m->sock, SOL_SOCKET, SO_PASSCRED, true);
 305         if (r < 0)
 306                 return log_debug_errno(r, "sd-device-monitor: Failed to set socket option SO_PASSCRED: %m");
 307
 308         return 0;
 309 }
 310
 311 static sd_device_monitor *device_monitor_free(sd_device_monitor *m) {
 312         assert(m);
 313
 314         (void) sd_device_monitor_detach_event(m);
 315
 316         hashmap_free_free_free(m->subsystem_filter);
 317         set_free_free(m->tag_filter);
 318
 319         return mfree(m);
 320 }
 321
 322 DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_device_monitor, sd_device_monitor, device_monitor_free);
 323
 324 static int passes_filter(sd_device_monitor *m, sd_device *device) {
 325         const char *tag, *subsystem, *devtype, *s, *d = NULL;
 326         Iterator i;
 327         int r;
 328
 329         assert_return(m, -EINVAL);
 330         assert_return(device, -EINVAL);
 331
 332         if (hashmap_isempty(m->subsystem_filter))
 333                 goto tag;
 334
 335         r = sd_device_get_subsystem(device, &s);
 336         if (r < 0)
 337                 return r;
 338
 339         r = sd_device_get_devtype(device, &d);
 340         if (r < 0 && r != -ENOENT)
 341                 return r;
 342
 343         HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter, i) {
 344                 if (!streq(s, subsystem))
 345                         continue;
 346
 347                 if (!devtype)
 348                         goto tag;
 349
 350                 if (!d)
 351                         continue;
 352
 353                 if (streq(d, devtype))
 354                         goto tag;
 355         }
 356
 357         return 0;
 358
 359 tag:
 360         if (set_isempty(m->tag_filter))
 361                 return 1;
 362
 363         SET_FOREACH(tag, m->tag_filter, i)
 364                 if (sd_device_has_tag(device, tag) > 0)
 365                         return 1;
 366
 367         return 0;
 368 }
 369
 370 int device_monitor_receive_device(sd_device_monitor *m, sd_device **ret) {
 371         _cleanup_(sd_device_unrefp) sd_device *device = NULL;
 372         union {
 373                 monitor_netlink_header nlh;
 374                 char raw[8192];
 375         } buf;
 376         struct iovec iov = {
 377                 .iov_base = &buf,
 378                 .iov_len = sizeof(buf)
 379         };
 380         char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
 381         union sockaddr_union snl;
 382         struct msghdr smsg = {
 383                 .msg_iov = &iov,
 384                 .msg_iovlen = 1,
 385                 .msg_control = cred_msg,
 386                 .msg_controllen = sizeof(cred_msg),
 387                 .msg_name = &snl,
 388                 .msg_namelen = sizeof(snl),
 389         };
 390         struct cmsghdr *cmsg;
 391         struct ucred *cred;
 392         ssize_t buflen, bufpos;
 393         bool is_initialized = false;
 394         int r;
 395
 396         assert(ret);
 397
 398         buflen = recvmsg(m->sock, &smsg, 0);
 399         if (buflen < 0) {
 400                 if (errno != EINTR)
 401                         log_debug_errno(errno, "sd-device-monitor: Failed to receive message: %m");
 402                 return -errno;
 403         }
 404
 405         if (buflen < 32 || (smsg.msg_flags & MSG_TRUNC))
 406                 return log_debug_errno(EINVAL, "sd-device-monitor: Invalid message length.");
 407
 408         if (snl.nl.nl_groups == MONITOR_GROUP_NONE) {
 409                 /* unicast message, check if we trust the sender */
 410                 if (m->snl_trusted_sender.nl.nl_pid == 0 ||
 411                     snl.nl.nl_pid != m->snl_trusted_sender.nl.nl_pid)
 412                         return log_debug_errno(EAGAIN, "sd-device-monitor: Unicast netlink message ignored.");
 413
 414         } else if (snl.nl.nl_groups == MONITOR_GROUP_KERNEL) {
 415                 if (snl.nl.nl_pid > 0)
 416                         return log_debug_errno(EAGAIN, "sd-device-monitor: Multicast kernel netlink message from PID %"PRIu32" ignored.", snl.nl.nl_pid);
 417         }
 418
 419         cmsg = CMSG_FIRSTHDR(&smsg);
 420         if (!cmsg || cmsg->cmsg_type != SCM_CREDENTIALS)
 421                 return log_debug_errno(EAGAIN, "sd-device-monitor: No sender credentials received, message ignored.");
 422
 423         cred = (struct ucred*) CMSG_DATA(cmsg);
 424         if (cred->uid != 0)
 425                 return log_debug_errno(EAGAIN, "sd-device-monitor: Sender uid="UID_FMT", message ignored.", cred->uid);
 426
 427         if (streq(buf.raw, "libudev")) {
 428                 /* udev message needs proper version magic */
 429                 if (buf.nlh.magic != htobe32(UDEV_MONITOR_MAGIC))
 430                         return log_debug_errno(EAGAIN, "sd-device-monitor: Invalid message signature (%x != %x)",
 431                                                buf.nlh.magic, htobe32(UDEV_MONITOR_MAGIC));
 432
 433                 if (buf.nlh.properties_off+32 > (size_t) buflen)
 434                         return log_debug_errno(EAGAIN, "sd-device-monitor: Invalid message length (%u > %zd)",
 435                                                buf.nlh.properties_off+32, buflen);
 436
 437                 bufpos = buf.nlh.properties_off;
 438
 439                 /* devices received from udev are always initialized */
 440                 is_initialized = true;
 441
 442         } else {
 443                 /* kernel message with header */
 444                 bufpos = strlen(buf.raw) + 1;
 445                 if ((size_t) bufpos < sizeof("a@/d") || bufpos >= buflen)
 446                         return log_debug_errno(EAGAIN, "sd-device-monitor: Invalid message length");
 447
 448                 /* check message header */
 449                 if (!strstr(buf.raw, "@/"))
 450                         return log_debug_errno(EAGAIN, "sd-device-monitor: Invalid message header");
 451         }
 452
 453         r = device_new_from_nulstr(&device, (uint8_t*) &buf.raw[bufpos], buflen - bufpos);
 454         if (r < 0)
 455                 return log_debug_errno(r, "sd-device-monitor: Failed to create device from received message: %m");
 456
 457         if (is_initialized)
 458                 device_set_is_initialized(device);
 459
 460         /* Skip device, if it does not pass the current filter */
 461         r = passes_filter(m, device);
 462         if (r < 0)
 463                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to check received device passing filter: %m");
 464         if (r == 0)
 465                 log_device_debug(device, "sd-device-monitor: Received device does not pass filter, ignoring");
 466         else
 467                 *ret = TAKE_PTR(device);
 468
 469         return r;
 470 }
 471
 472 static uint32_t string_hash32(const char *str) {
 473         return MurmurHash2(str, strlen(str), 0);
 474 }
 475
 476 /* Get a bunch of bit numbers out of the hash, and set the bits in our bit field */
 477 static uint64_t string_bloom64(const char *str) {
 478         uint64_t bits = 0;
 479         uint32_t hash = string_hash32(str);
 480
 481         bits |= 1LLU << (hash & 63);
 482         bits |= 1LLU << ((hash >> 6) & 63);
 483         bits |= 1LLU << ((hash >> 12) & 63);
 484         bits |= 1LLU << ((hash >> 18) & 63);
 485         return bits;
 486 }
 487
 488 int device_monitor_send_device(
 489                 sd_device_monitor *m,
 490                 sd_device_monitor *destination,
 491                 sd_device *device) {
 492
 493         monitor_netlink_header nlh = {
 494                 .prefix = "libudev",
 495                 .magic = htobe32(UDEV_MONITOR_MAGIC),
 496                 .header_size = sizeof nlh,
 497         };
 498         struct iovec iov[2] = {
 499                 { .iov_base = &nlh, .iov_len = sizeof nlh },
 500         };
 501         struct msghdr smsg = {
 502                 .msg_iov = iov,
 503                 .msg_iovlen = 2,
 504         };
 505         /* default destination for sending */
 506         union sockaddr_union default_destination = {
 507                 .nl.nl_family = AF_NETLINK,
 508                 .nl.nl_groups = MONITOR_GROUP_UDEV,
 509         };
 510         uint64_t tag_bloom_bits;
 511         const char *buf, *val;
 512         ssize_t count;
 513         size_t blen;
 514         int r;
 515
 516         assert(m);
 517         assert(device);
 518
 519         r = device_get_properties_nulstr(device, (const uint8_t **) &buf, &blen);
 520         if (r < 0)
 521                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device properties: %m");
 522         if (blen < 32) {
 523                 log_device_debug(device, "sd-device-monitor: Length of device property nulstr is too small to contain valid device information");
 524                 return -EINVAL;
 525         }
 526
 527         /* fill in versioned header */
 528         r = sd_device_get_subsystem(device, &val);
 529         if (r < 0)
 530                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device subsystem: %m");
 531         nlh.filter_subsystem_hash = htobe32(string_hash32(val));
 532
 533         if (sd_device_get_devtype(device, &val) >= 0)
 534                 nlh.filter_devtype_hash = htobe32(string_hash32(val));
 535
 536         /* add tag bloom filter */
 537         tag_bloom_bits = 0;
 538         FOREACH_DEVICE_TAG(device, val)
 539                 tag_bloom_bits |= string_bloom64(val);
 540
 541         if (tag_bloom_bits > 0) {
 542                 nlh.filter_tag_bloom_hi = htobe32(tag_bloom_bits >> 32);
 543                 nlh.filter_tag_bloom_lo = htobe32(tag_bloom_bits & 0xffffffff);
 544         }
 545
 546         /* add properties list */
 547         nlh.properties_off = iov[0].iov_len;
 548         nlh.properties_len = blen;
 549         iov[1] = (struct iovec) {
 550                 .iov_base = (char*) buf,
 551                 .iov_len = blen,
 552         };
 553
 554         /*
 555          * Use custom address for target, or the default one.
 556          *
 557          * If we send to a multicast group, we will get
 558          * ECONNREFUSED, which is expected.
 559          */
 560         smsg.msg_name = destination ? &destination->snl : &default_destination;
 561         smsg.msg_namelen = sizeof(struct sockaddr_nl);
 562         count = sendmsg(m->sock, &smsg, 0);
 563         if (count < 0) {
 564                 if (!destination && errno == ECONNREFUSED) {
 565                         log_device_debug(device, "sd-device-monitor: Passed to netlink monitor");
 566                         return 0;
 567                 } else
 568                         return log_device_debug_errno(device, errno, "sd-device-monitor: Failed to send device to netlink monitor: %m");
 569         }
 570
 571         log_device_debug(device, "sd-device-monitor: Passed %zi byte to netlink monitor", count);
 572         return count;
 573 }
 574
 575 static void bpf_stmt(struct sock_filter *ins, unsigned *i,
 576                      unsigned short code, unsigned data) {
 577         ins[(*i)++] = (struct sock_filter) {
 578                 .code = code,
 579                 .k = data,
 580         };
 581 }
 582
 583 static void bpf_jmp(struct sock_filter *ins, unsigned *i,
 584                     unsigned short code, unsigned data,
 585                     unsigned short jt, unsigned short jf) {
 586         ins[(*i)++] = (struct sock_filter) {
 587                 .code = code,
 588                 .jt = jt,
 589                 .jf = jf,
 590                 .k = data,
 591         };
 592 }
 593
 594 _public_ int sd_device_monitor_filter_update(sd_device_monitor *m) {
 595         struct sock_filter ins[512] = {};
 596         struct sock_fprog filter;
 597         const char *subsystem, *devtype, *tag;
 598         unsigned i = 0;
 599         Iterator it;
 600
 601         assert_return(m, -EINVAL);
 602
 603         if (hashmap_isempty(m->subsystem_filter) &&
 604             set_isempty(m->tag_filter)) {
 605                 m->filter_uptodate = true;
 606                 return 0;
 607         }
 608
 609         /* load magic in A */
 610         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, magic));
 611         /* jump if magic matches */
 612         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, UDEV_MONITOR_MAGIC, 1, 0);
 613         /* wrong magic, pass packet */
 614         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 615
 616         if (!set_isempty(m->tag_filter)) {
 617                 int tag_matches = set_size(m->tag_filter);
 618
 619                 /* add all tags matches */
 620                 SET_FOREACH(tag, m->tag_filter, it) {
 621                         uint64_t tag_bloom_bits = string_bloom64(tag);
 622                         uint32_t tag_bloom_hi = tag_bloom_bits >> 32;
 623                         uint32_t tag_bloom_lo = tag_bloom_bits & 0xffffffff;
 624
 625                         /* load device bloom bits in A */
 626                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_hi));
 627                         /* clear bits (tag bits & bloom bits) */
 628                         bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_hi);
 629                         /* jump to next tag if it does not match */
 630                         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_hi, 0, 3);
 631
 632                         /* load device bloom bits in A */
 633                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_lo));
 634                         /* clear bits (tag bits & bloom bits) */
 635                         bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_lo);
 636                         /* jump behind end of tag match block if tag matches */
 637                         tag_matches--;
 638                         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_lo, 1 + (tag_matches * 6), 0);
 639                 }
 640
 641                 /* nothing matched, drop packet */
 642                 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
 643         }
 644
 645         /* add all subsystem matches */
 646         if (!hashmap_isempty(m->subsystem_filter)) {
 647                 HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter, it) {
 648                         uint32_t hash = string_hash32(subsystem);
 649
 650                         /* load device subsystem value in A */
 651                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_subsystem_hash));
 652                         if (!devtype) {
 653                                 /* jump if subsystem does not match */
 654                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
 655                         } else {
 656                                 hash = string_hash32(devtype);
 657
 658                                 /* jump if subsystem does not match */
 659                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 3);
 660                                 /* load device devtype value in A */
 661                                 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_devtype_hash));
 662                                 /* jump if value does not match */
 663                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
 664                         }
 665
 666                         /* matched, pass packet */
 667                         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 668
 669                         if (i+1 >= ELEMENTSOF(ins))
 670                                 return -E2BIG;
 671                 }
 672
 673                 /* nothing matched, drop packet */
 674                 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
 675         }
 676
 677         /* matched, pass packet */
 678         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 679
 680         /* install filter */
 681         filter = (struct sock_fprog) {
 682                 .len = i,
 683                 .filter = ins,
 684         };
 685         if (setsockopt(m->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) < 0)
 686                 return -errno;
 687
 688         m->filter_uptodate = true;
 689         return 0;
 690 }
 691
 692 _public_ int sd_device_monitor_filter_add_match_subsystem_devtype(sd_device_monitor *m, const char *subsystem, const char *devtype) {
 693         _cleanup_free_ char *s = NULL, *d = NULL;
 694         int r;
 695
 696         assert_return(m, -EINVAL);
 697         assert_return(subsystem, -EINVAL);
 698
 699         s = strdup(subsystem);
 700         if (!s)
 701                 return -ENOMEM;
 702
 703         if (devtype) {
 704                 d = strdup(devtype);
 705                 if (!d)
 706                         return -ENOMEM;
 707         }
 708
 709         r = hashmap_ensure_allocated(&m->subsystem_filter, NULL);
 710         if (r < 0)
 711                 return r;
 712
 713         r = hashmap_put(m->subsystem_filter, s, d);
 714         if (r < 0)
 715                 return r;
 716
 717         s = d = NULL;
 718         m->filter_uptodate = false;
 719
 720         return 0;
 721 }
 722
 723 _public_ int sd_device_monitor_filter_add_match_tag(sd_device_monitor *m, const char *tag) {
 724         _cleanup_free_ char *t = NULL;
 725         int r;
 726
 727         assert_return(m, -EINVAL);
 728         assert_return(tag, -EINVAL);
 729
 730         t = strdup(tag);
 731         if (!t)
 732                 return -ENOMEM;
 733
 734         r = set_ensure_allocated(&m->tag_filter, &string_hash_ops);
 735         if (r < 0)
 736                 return r;
 737
 738         r = set_put(m->tag_filter, t);
 739         if (r == -EEXIST)
 740                 return 0;
 741         if (r < 0)
 742                 return r;
 743
 744         TAKE_PTR(t);
 745         m->filter_uptodate = false;
 746
 747         return 0;
 748 }
 749
 750 _public_ int sd_device_monitor_filter_remove(sd_device_monitor *m) {
 751         static const struct sock_fprog filter = { 0, NULL };
 752
 753         assert_return(m, -EINVAL);
 754
 755         m->subsystem_filter = hashmap_free_free_free(m->subsystem_filter);
 756         m->tag_filter = set_free_free(m->tag_filter);
 757
 758         if (setsockopt(m->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) < 0)
 759                 return -errno;
 760
 761         m->filter_uptodate = true;
 762         return 0;
 763 }