]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
b1c097af YW |
2 | |
3 | #include <errno.h> | |
4 | #include <linux/filter.h> | |
5 | #include <linux/netlink.h> | |
f6dbcebd LP |
6 | #include <linux/sockios.h> |
7 | #include <sys/ioctl.h> | |
f5947a5e | 8 | #include <unistd.h> |
b1c097af YW |
9 | |
10 | #include "sd-device.h" | |
11 | #include "sd-event.h" | |
12 | ||
13 | #include "MurmurHash2.h" | |
14 | #include "alloc-util.h" | |
15 | #include "device-monitor-private.h" | |
16 | #include "device-private.h" | |
17 | #include "device-util.h" | |
f6dbcebd | 18 | #include "errno-util.h" |
b1c097af YW |
19 | #include "fd-util.h" |
20 | #include "format-util.h" | |
21 | #include "hashmap.h" | |
cb310866 | 22 | #include "io-util.h" |
f6dbcebd | 23 | #include "missing_socket.h" |
049af8ad | 24 | #include "mountpoint-util.h" |
b1c097af YW |
25 | #include "set.h" |
26 | #include "socket-util.h" | |
27 | #include "string-util.h" | |
28 | #include "strv.h" | |
29 | ||
30 | struct sd_device_monitor { | |
31 | unsigned n_ref; | |
32 | ||
33 | int sock; | |
34 | union sockaddr_union snl; | |
35 | union sockaddr_union snl_trusted_sender; | |
36 | bool bound; | |
37 | ||
38 | Hashmap *subsystem_filter; | |
39 | Set *tag_filter; | |
40 | bool filter_uptodate; | |
41 | ||
42 | sd_event *event; | |
43 | sd_event_source *event_source; | |
b1c097af YW |
44 | sd_device_monitor_handler_t callback; |
45 | void *userdata; | |
46 | }; | |
47 | ||
48 | #define UDEV_MONITOR_MAGIC 0xfeedcafe | |
49 | ||
50 | typedef struct monitor_netlink_header { | |
51 | /* "libudev" prefix to distinguish libudev and kernel messages */ | |
52 | char prefix[8]; | |
53 | /* Magic to protect against daemon <-> Library message format mismatch | |
54 | * Used in the kernel from socket filter rules; needs to be stored in network order */ | |
55 | unsigned magic; | |
56 | /* Total length of header structure known to the sender */ | |
57 | unsigned header_size; | |
58 | /* Properties string buffer */ | |
59 | unsigned properties_off; | |
60 | unsigned properties_len; | |
61 | /* Hashes of primary device properties strings, to let libudev subscribers | |
62 | * use in-kernel socket filters; values need to be stored in network order */ | |
63 | unsigned filter_subsystem_hash; | |
64 | unsigned filter_devtype_hash; | |
65 | unsigned filter_tag_bloom_hi; | |
66 | unsigned filter_tag_bloom_lo; | |
67 | } monitor_netlink_header; | |
68 | ||
69 | static int monitor_set_nl_address(sd_device_monitor *m) { | |
70 | union sockaddr_union snl; | |
71 | socklen_t addrlen; | |
72 | ||
73 | assert(m); | |
74 | ||
75 | /* Get the address the kernel has assigned us. | |
76 | * It is usually, but not necessarily the pid. */ | |
77 | addrlen = sizeof(struct sockaddr_nl); | |
78 | if (getsockname(m->sock, &snl.sa, &addrlen) < 0) | |
79 | return -errno; | |
80 | ||
81 | m->snl.nl.nl_pid = snl.nl.nl_pid; | |
82 | return 0; | |
83 | } | |
84 | ||
85 | int device_monitor_allow_unicast_sender(sd_device_monitor *m, sd_device_monitor *sender) { | |
86 | assert_return(m, -EINVAL); | |
87 | assert_return(sender, -EINVAL); | |
88 | ||
89 | m->snl_trusted_sender.nl.nl_pid = sender->snl.nl.nl_pid; | |
90 | return 0; | |
91 | } | |
92 | ||
93 | _public_ int sd_device_monitor_set_receive_buffer_size(sd_device_monitor *m, size_t size) { | |
b1c097af | 94 | assert_return(m, -EINVAL); |
b1c097af | 95 | |
2807a794 | 96 | return fd_set_rcvbuf(m->sock, size, false); |
b1c097af YW |
97 | } |
98 | ||
99 | int device_monitor_disconnect(sd_device_monitor *m) { | |
100 | assert(m); | |
101 | ||
102 | m->sock = safe_close(m->sock); | |
103 | return 0; | |
104 | } | |
105 | ||
106 | int device_monitor_get_fd(sd_device_monitor *m) { | |
107 | assert_return(m, -EINVAL); | |
108 | ||
109 | return m->sock; | |
110 | } | |
111 | ||
112 | int device_monitor_new_full(sd_device_monitor **ret, MonitorNetlinkGroup group, int fd) { | |
113 | _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *m = NULL; | |
114 | _cleanup_close_ int sock = -1; | |
115 | int r; | |
116 | ||
117 | assert_return(ret, -EINVAL); | |
118 | assert_return(group >= 0 && group < _MONITOR_NETLINK_GROUP_MAX, -EINVAL); | |
119 | ||
120 | if (group == MONITOR_GROUP_UDEV && | |
121 | access("/run/udev/control", F_OK) < 0 && | |
122 | dev_is_devtmpfs() <= 0) { | |
123 | ||
124 | /* | |
125 | * We do not support subscribing to uevents if no instance of | |
126 | * udev is running. Uevents would otherwise broadcast the | |
127 | * processing data of the host into containers, which is not | |
128 | * desired. | |
129 | * | |
130 | * Containers will currently not get any udev uevents, until | |
131 | * a supporting infrastructure is available. | |
132 | * | |
133 | * We do not set a netlink multicast group here, so the socket | |
134 | * will not receive any messages. | |
135 | */ | |
136 | ||
c7d54dae | 137 | log_debug("sd-device-monitor: The udev service seems not to be active, disabling the monitor"); |
b1c097af YW |
138 | group = MONITOR_GROUP_NONE; |
139 | } | |
140 | ||
141 | if (fd < 0) { | |
142 | sock = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_KOBJECT_UEVENT); | |
143 | if (sock < 0) | |
c7d54dae | 144 | return log_debug_errno(errno, "sd-device-monitor: Failed to create socket: %m"); |
b1c097af YW |
145 | } |
146 | ||
147 | m = new(sd_device_monitor, 1); | |
148 | if (!m) | |
149 | return -ENOMEM; | |
150 | ||
151 | *m = (sd_device_monitor) { | |
152 | .n_ref = 1, | |
153 | .sock = fd >= 0 ? fd : TAKE_FD(sock), | |
154 | .bound = fd >= 0, | |
155 | .snl.nl.nl_family = AF_NETLINK, | |
156 | .snl.nl.nl_groups = group, | |
157 | }; | |
158 | ||
159 | if (fd >= 0) { | |
160 | r = monitor_set_nl_address(m); | |
f6dbcebd LP |
161 | if (r < 0) { |
162 | log_debug_errno(r, "sd-device-monitor: Failed to set netlink address: %m"); | |
163 | goto fail; | |
164 | } | |
165 | } | |
166 | ||
167 | if (DEBUG_LOGGING) { | |
168 | _cleanup_close_ int netns = -1; | |
169 | ||
170 | /* So here's the thing: only AF_NETLINK sockets from the main network namespace will get | |
171 | * hardware events. Let's check if ours is from there, and if not generate a debug message, | |
172 | * since we cannot possibly work correctly otherwise. This is just a safety check to make | |
173 | * things easier to debug. */ | |
174 | ||
175 | netns = ioctl(m->sock, SIOCGSKNS); | |
176 | if (netns < 0) | |
177 | log_debug_errno(errno, "sd-device-monitor: Unable to get network namespace of udev netlink socket, unable to determine if we are in host netns: %m"); | |
178 | else { | |
179 | struct stat a, b; | |
180 | ||
181 | if (fstat(netns, &a) < 0) { | |
182 | r = log_debug_errno(errno, "sd-device-monitor: Failed to stat netns of udev netlink socket: %m"); | |
183 | goto fail; | |
184 | } | |
185 | ||
186 | if (stat("/proc/1/ns/net", &b) < 0) { | |
187 | if (ERRNO_IS_PRIVILEGE(errno)) | |
188 | /* If we can't access PID1's netns info due to permissions, it's fine, this is a | |
189 | * safety check only after all. */ | |
190 | log_debug_errno(errno, "sd-device-monitor: No permission to stat PID1's netns, unable to determine if we are in host netns: %m"); | |
191 | else | |
192 | log_debug_errno(errno, "sd-device-monitor: Failed to stat PID1's netns: %m"); | |
193 | ||
194 | } else if (a.st_dev != b.st_dev || a.st_ino != b.st_ino) | |
195 | log_debug("sd-device-monitor: Netlink socket we listen on is not from host netns, we won't see device events."); | |
196 | } | |
b1c097af YW |
197 | } |
198 | ||
199 | *ret = TAKE_PTR(m); | |
200 | return 0; | |
f6dbcebd LP |
201 | |
202 | fail: | |
203 | /* Let's unset the socket fd in the monitor object before we destroy it so that the fd passed in is | |
204 | * not closed on failure. */ | |
205 | if (fd >= 0) | |
206 | m->sock = -1; | |
207 | ||
208 | return r; | |
b1c097af YW |
209 | } |
210 | ||
211 | _public_ int sd_device_monitor_new(sd_device_monitor **ret) { | |
212 | return device_monitor_new_full(ret, MONITOR_GROUP_UDEV, -1); | |
213 | } | |
214 | ||
215 | _public_ int sd_device_monitor_stop(sd_device_monitor *m) { | |
216 | assert_return(m, -EINVAL); | |
217 | ||
218 | m->event_source = sd_event_source_unref(m->event_source); | |
219 | (void) device_monitor_disconnect(m); | |
220 | ||
221 | return 0; | |
222 | } | |
223 | ||
224 | static int device_monitor_event_handler(sd_event_source *s, int fd, uint32_t revents, void *userdata) { | |
225 | _cleanup_(sd_device_unrefp) sd_device *device = NULL; | |
226 | sd_device_monitor *m = userdata; | |
227 | ||
228 | assert(m); | |
229 | ||
230 | if (device_monitor_receive_device(m, &device) <= 0) | |
231 | return 0; | |
232 | ||
233 | if (m->callback) | |
234 | return m->callback(m, device, m->userdata); | |
235 | ||
236 | return 0; | |
237 | } | |
238 | ||
deb2b734 | 239 | _public_ int sd_device_monitor_start(sd_device_monitor *m, sd_device_monitor_handler_t callback, void *userdata) { |
b1c097af YW |
240 | int r; |
241 | ||
242 | assert_return(m, -EINVAL); | |
243 | ||
244 | if (!m->event) { | |
deb2b734 | 245 | r = sd_device_monitor_attach_event(m, NULL); |
b1c097af YW |
246 | if (r < 0) |
247 | return r; | |
248 | } | |
249 | ||
a153a1de YW |
250 | r = device_monitor_enable_receiving(m); |
251 | if (r < 0) | |
252 | return r; | |
b1c097af YW |
253 | |
254 | m->callback = callback; | |
255 | m->userdata = userdata; | |
256 | ||
deb2b734 | 257 | r = sd_event_add_io(m->event, &m->event_source, m->sock, EPOLLIN, device_monitor_event_handler, m); |
b1c097af YW |
258 | if (r < 0) |
259 | return r; | |
260 | ||
deb2b734 | 261 | (void) sd_event_source_set_description(m->event_source, "sd-device-monitor"); |
b1c097af YW |
262 | |
263 | return 0; | |
264 | } | |
265 | ||
266 | _public_ int sd_device_monitor_detach_event(sd_device_monitor *m) { | |
267 | assert_return(m, -EINVAL); | |
268 | ||
269 | (void) sd_device_monitor_stop(m); | |
270 | m->event = sd_event_unref(m->event); | |
271 | ||
272 | return 0; | |
273 | } | |
274 | ||
deb2b734 | 275 | _public_ int sd_device_monitor_attach_event(sd_device_monitor *m, sd_event *event) { |
b1c097af YW |
276 | int r; |
277 | ||
278 | assert_return(m, -EINVAL); | |
279 | assert_return(!m->event, -EBUSY); | |
280 | ||
281 | if (event) | |
282 | m->event = sd_event_ref(event); | |
283 | else { | |
284 | r = sd_event_default(&m->event); | |
285 | if (r < 0) | |
779c9234 | 286 | return r; |
b1c097af YW |
287 | } |
288 | ||
b1c097af YW |
289 | return 0; |
290 | } | |
291 | ||
292 | _public_ sd_event *sd_device_monitor_get_event(sd_device_monitor *m) { | |
293 | assert_return(m, NULL); | |
294 | ||
295 | return m->event; | |
296 | } | |
297 | ||
bf7712b6 YW |
298 | _public_ sd_event_source *sd_device_monitor_get_event_source(sd_device_monitor *m) { |
299 | assert_return(m, NULL); | |
300 | ||
301 | return m->event_source; | |
302 | } | |
303 | ||
b1c097af YW |
304 | int device_monitor_enable_receiving(sd_device_monitor *m) { |
305 | int r; | |
306 | ||
307 | assert_return(m, -EINVAL); | |
308 | ||
f1d7b787 YW |
309 | r = sd_device_monitor_filter_update(m); |
310 | if (r < 0) | |
311 | return log_debug_errno(r, "sd-device-monitor: Failed to update filter: %m"); | |
b1c097af YW |
312 | |
313 | if (!m->bound) { | |
c821e84a YW |
314 | /* enable receiving of sender credentials */ |
315 | r = setsockopt_int(m->sock, SOL_SOCKET, SO_PASSCRED, true); | |
316 | if (r < 0) | |
317 | return log_debug_errno(r, "sd-device-monitor: Failed to set socket option SO_PASSCRED: %m"); | |
318 | ||
b1c097af | 319 | if (bind(m->sock, &m->snl.sa, sizeof(struct sockaddr_nl)) < 0) |
5cee547a | 320 | return log_debug_errno(errno, "sd-device-monitor: Failed to bind monitoring socket: %m"); |
b1c097af YW |
321 | |
322 | m->bound = true; | |
b1c097af | 323 | |
c821e84a YW |
324 | r = monitor_set_nl_address(m); |
325 | if (r < 0) | |
326 | return log_debug_errno(r, "sd-device-monitor: Failed to set address: %m"); | |
327 | } | |
b1c097af YW |
328 | |
329 | return 0; | |
330 | } | |
331 | ||
332 | static sd_device_monitor *device_monitor_free(sd_device_monitor *m) { | |
333 | assert(m); | |
334 | ||
335 | (void) sd_device_monitor_detach_event(m); | |
336 | ||
337 | hashmap_free_free_free(m->subsystem_filter); | |
338 | set_free_free(m->tag_filter); | |
339 | ||
340 | return mfree(m); | |
341 | } | |
342 | ||
343 | DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_device_monitor, sd_device_monitor, device_monitor_free); | |
344 | ||
345 | static int passes_filter(sd_device_monitor *m, sd_device *device) { | |
346 | const char *tag, *subsystem, *devtype, *s, *d = NULL; | |
b1c097af YW |
347 | int r; |
348 | ||
349 | assert_return(m, -EINVAL); | |
350 | assert_return(device, -EINVAL); | |
351 | ||
352 | if (hashmap_isempty(m->subsystem_filter)) | |
353 | goto tag; | |
354 | ||
355 | r = sd_device_get_subsystem(device, &s); | |
356 | if (r < 0) | |
357 | return r; | |
358 | ||
359 | r = sd_device_get_devtype(device, &d); | |
360 | if (r < 0 && r != -ENOENT) | |
361 | return r; | |
362 | ||
90e74a66 | 363 | HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter) { |
b1c097af YW |
364 | if (!streq(s, subsystem)) |
365 | continue; | |
366 | ||
367 | if (!devtype) | |
368 | goto tag; | |
369 | ||
370 | if (!d) | |
371 | continue; | |
372 | ||
373 | if (streq(d, devtype)) | |
374 | goto tag; | |
375 | } | |
376 | ||
377 | return 0; | |
378 | ||
379 | tag: | |
380 | if (set_isempty(m->tag_filter)) | |
381 | return 1; | |
382 | ||
90e74a66 | 383 | SET_FOREACH(tag, m->tag_filter) |
b1c097af YW |
384 | if (sd_device_has_tag(device, tag) > 0) |
385 | return 1; | |
386 | ||
387 | return 0; | |
388 | } | |
389 | ||
390 | int device_monitor_receive_device(sd_device_monitor *m, sd_device **ret) { | |
391 | _cleanup_(sd_device_unrefp) sd_device *device = NULL; | |
392 | union { | |
393 | monitor_netlink_header nlh; | |
394 | char raw[8192]; | |
395 | } buf; | |
396 | struct iovec iov = { | |
397 | .iov_base = &buf, | |
398 | .iov_len = sizeof(buf) | |
399 | }; | |
fb29cdbe | 400 | CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred))) control; |
b1c097af YW |
401 | union sockaddr_union snl; |
402 | struct msghdr smsg = { | |
403 | .msg_iov = &iov, | |
404 | .msg_iovlen = 1, | |
fb29cdbe LP |
405 | .msg_control = &control, |
406 | .msg_controllen = sizeof(control), | |
b1c097af YW |
407 | .msg_name = &snl, |
408 | .msg_namelen = sizeof(snl), | |
409 | }; | |
410 | struct cmsghdr *cmsg; | |
411 | struct ucred *cred; | |
412 | ssize_t buflen, bufpos; | |
413 | bool is_initialized = false; | |
414 | int r; | |
415 | ||
416 | assert(ret); | |
417 | ||
418 | buflen = recvmsg(m->sock, &smsg, 0); | |
419 | if (buflen < 0) { | |
420 | if (errno != EINTR) | |
c7d54dae | 421 | log_debug_errno(errno, "sd-device-monitor: Failed to receive message: %m"); |
b1c097af YW |
422 | return -errno; |
423 | } | |
424 | ||
425 | if (buflen < 32 || (smsg.msg_flags & MSG_TRUNC)) | |
886cf317 ZJS |
426 | return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), |
427 | "sd-device-monitor: Invalid message length."); | |
b1c097af YW |
428 | |
429 | if (snl.nl.nl_groups == MONITOR_GROUP_NONE) { | |
430 | /* unicast message, check if we trust the sender */ | |
431 | if (m->snl_trusted_sender.nl.nl_pid == 0 || | |
432 | snl.nl.nl_pid != m->snl_trusted_sender.nl.nl_pid) | |
886cf317 ZJS |
433 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
434 | "sd-device-monitor: Unicast netlink message ignored."); | |
b1c097af YW |
435 | |
436 | } else if (snl.nl.nl_groups == MONITOR_GROUP_KERNEL) { | |
437 | if (snl.nl.nl_pid > 0) | |
886cf317 ZJS |
438 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
439 | "sd-device-monitor: Multicast kernel netlink message from PID %"PRIu32" ignored.", snl.nl.nl_pid); | |
b1c097af YW |
440 | } |
441 | ||
442 | cmsg = CMSG_FIRSTHDR(&smsg); | |
443 | if (!cmsg || cmsg->cmsg_type != SCM_CREDENTIALS) | |
886cf317 ZJS |
444 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
445 | "sd-device-monitor: No sender credentials received, message ignored."); | |
b1c097af YW |
446 | |
447 | cred = (struct ucred*) CMSG_DATA(cmsg); | |
448 | if (cred->uid != 0) | |
886cf317 ZJS |
449 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
450 | "sd-device-monitor: Sender uid="UID_FMT", message ignored.", cred->uid); | |
b1c097af YW |
451 | |
452 | if (streq(buf.raw, "libudev")) { | |
453 | /* udev message needs proper version magic */ | |
454 | if (buf.nlh.magic != htobe32(UDEV_MONITOR_MAGIC)) | |
886cf317 ZJS |
455 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
456 | "sd-device-monitor: Invalid message signature (%x != %x)", | |
b1c097af YW |
457 | buf.nlh.magic, htobe32(UDEV_MONITOR_MAGIC)); |
458 | ||
459 | if (buf.nlh.properties_off+32 > (size_t) buflen) | |
886cf317 ZJS |
460 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
461 | "sd-device-monitor: Invalid message length (%u > %zd)", | |
b1c097af YW |
462 | buf.nlh.properties_off+32, buflen); |
463 | ||
464 | bufpos = buf.nlh.properties_off; | |
465 | ||
466 | /* devices received from udev are always initialized */ | |
467 | is_initialized = true; | |
468 | ||
469 | } else { | |
470 | /* kernel message with header */ | |
471 | bufpos = strlen(buf.raw) + 1; | |
472 | if ((size_t) bufpos < sizeof("a@/d") || bufpos >= buflen) | |
886cf317 ZJS |
473 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
474 | "sd-device-monitor: Invalid message length"); | |
b1c097af YW |
475 | |
476 | /* check message header */ | |
477 | if (!strstr(buf.raw, "@/")) | |
886cf317 ZJS |
478 | return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), |
479 | "sd-device-monitor: Invalid message header"); | |
b1c097af YW |
480 | } |
481 | ||
482 | r = device_new_from_nulstr(&device, (uint8_t*) &buf.raw[bufpos], buflen - bufpos); | |
483 | if (r < 0) | |
c7d54dae | 484 | return log_debug_errno(r, "sd-device-monitor: Failed to create device from received message: %m"); |
b1c097af YW |
485 | |
486 | if (is_initialized) | |
487 | device_set_is_initialized(device); | |
488 | ||
489 | /* Skip device, if it does not pass the current filter */ | |
490 | r = passes_filter(m, device); | |
491 | if (r < 0) | |
c7d54dae | 492 | return log_device_debug_errno(device, r, "sd-device-monitor: Failed to check received device passing filter: %m"); |
b1c097af | 493 | if (r == 0) |
c7d54dae | 494 | log_device_debug(device, "sd-device-monitor: Received device does not pass filter, ignoring"); |
b1c097af YW |
495 | else |
496 | *ret = TAKE_PTR(device); | |
497 | ||
498 | return r; | |
499 | } | |
500 | ||
501 | static uint32_t string_hash32(const char *str) { | |
502 | return MurmurHash2(str, strlen(str), 0); | |
503 | } | |
504 | ||
505 | /* Get a bunch of bit numbers out of the hash, and set the bits in our bit field */ | |
506 | static uint64_t string_bloom64(const char *str) { | |
507 | uint64_t bits = 0; | |
508 | uint32_t hash = string_hash32(str); | |
509 | ||
510 | bits |= 1LLU << (hash & 63); | |
511 | bits |= 1LLU << ((hash >> 6) & 63); | |
512 | bits |= 1LLU << ((hash >> 12) & 63); | |
513 | bits |= 1LLU << ((hash >> 18) & 63); | |
514 | return bits; | |
515 | } | |
516 | ||
517 | int device_monitor_send_device( | |
518 | sd_device_monitor *m, | |
519 | sd_device_monitor *destination, | |
520 | sd_device *device) { | |
521 | ||
522 | monitor_netlink_header nlh = { | |
523 | .prefix = "libudev", | |
524 | .magic = htobe32(UDEV_MONITOR_MAGIC), | |
525 | .header_size = sizeof nlh, | |
526 | }; | |
527 | struct iovec iov[2] = { | |
528 | { .iov_base = &nlh, .iov_len = sizeof nlh }, | |
529 | }; | |
530 | struct msghdr smsg = { | |
531 | .msg_iov = iov, | |
532 | .msg_iovlen = 2, | |
533 | }; | |
534 | /* default destination for sending */ | |
535 | union sockaddr_union default_destination = { | |
536 | .nl.nl_family = AF_NETLINK, | |
537 | .nl.nl_groups = MONITOR_GROUP_UDEV, | |
538 | }; | |
539 | uint64_t tag_bloom_bits; | |
540 | const char *buf, *val; | |
541 | ssize_t count; | |
542 | size_t blen; | |
543 | int r; | |
544 | ||
545 | assert(m); | |
546 | assert(device); | |
547 | ||
548 | r = device_get_properties_nulstr(device, (const uint8_t **) &buf, &blen); | |
549 | if (r < 0) | |
c7d54dae | 550 | return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device properties: %m"); |
9e791238 ZJS |
551 | if (blen < 32) |
552 | log_device_debug_errno(device, SYNTHETIC_ERRNO(EINVAL), | |
553 | "sd-device-monitor: Length of device property nulstr is too small to contain valid device information"); | |
b1c097af YW |
554 | |
555 | /* fill in versioned header */ | |
556 | r = sd_device_get_subsystem(device, &val); | |
557 | if (r < 0) | |
c7d54dae | 558 | return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device subsystem: %m"); |
b1c097af YW |
559 | nlh.filter_subsystem_hash = htobe32(string_hash32(val)); |
560 | ||
a537eafe | 561 | if (sd_device_get_devtype(device, &val) >= 0) |
b1c097af YW |
562 | nlh.filter_devtype_hash = htobe32(string_hash32(val)); |
563 | ||
564 | /* add tag bloom filter */ | |
565 | tag_bloom_bits = 0; | |
566 | FOREACH_DEVICE_TAG(device, val) | |
567 | tag_bloom_bits |= string_bloom64(val); | |
568 | ||
569 | if (tag_bloom_bits > 0) { | |
570 | nlh.filter_tag_bloom_hi = htobe32(tag_bloom_bits >> 32); | |
571 | nlh.filter_tag_bloom_lo = htobe32(tag_bloom_bits & 0xffffffff); | |
572 | } | |
573 | ||
574 | /* add properties list */ | |
575 | nlh.properties_off = iov[0].iov_len; | |
576 | nlh.properties_len = blen; | |
cb310866 | 577 | iov[1] = IOVEC_MAKE((char*) buf, blen); |
b1c097af YW |
578 | |
579 | /* | |
580 | * Use custom address for target, or the default one. | |
581 | * | |
582 | * If we send to a multicast group, we will get | |
583 | * ECONNREFUSED, which is expected. | |
584 | */ | |
585 | smsg.msg_name = destination ? &destination->snl : &default_destination; | |
586 | smsg.msg_namelen = sizeof(struct sockaddr_nl); | |
587 | count = sendmsg(m->sock, &smsg, 0); | |
588 | if (count < 0) { | |
589 | if (!destination && errno == ECONNREFUSED) { | |
c7d54dae | 590 | log_device_debug(device, "sd-device-monitor: Passed to netlink monitor"); |
b1c097af YW |
591 | return 0; |
592 | } else | |
c7d54dae | 593 | return log_device_debug_errno(device, errno, "sd-device-monitor: Failed to send device to netlink monitor: %m"); |
b1c097af YW |
594 | } |
595 | ||
c7d54dae | 596 | log_device_debug(device, "sd-device-monitor: Passed %zi byte to netlink monitor", count); |
b1c097af YW |
597 | return count; |
598 | } | |
599 | ||
600 | static void bpf_stmt(struct sock_filter *ins, unsigned *i, | |
601 | unsigned short code, unsigned data) { | |
602 | ins[(*i)++] = (struct sock_filter) { | |
603 | .code = code, | |
604 | .k = data, | |
605 | }; | |
606 | } | |
607 | ||
608 | static void bpf_jmp(struct sock_filter *ins, unsigned *i, | |
609 | unsigned short code, unsigned data, | |
610 | unsigned short jt, unsigned short jf) { | |
611 | ins[(*i)++] = (struct sock_filter) { | |
612 | .code = code, | |
613 | .jt = jt, | |
614 | .jf = jf, | |
615 | .k = data, | |
616 | }; | |
617 | } | |
618 | ||
619 | _public_ int sd_device_monitor_filter_update(sd_device_monitor *m) { | |
620 | struct sock_filter ins[512] = {}; | |
621 | struct sock_fprog filter; | |
622 | const char *subsystem, *devtype, *tag; | |
623 | unsigned i = 0; | |
b1c097af YW |
624 | |
625 | assert_return(m, -EINVAL); | |
626 | ||
f1d7b787 YW |
627 | if (m->filter_uptodate) |
628 | return 0; | |
629 | ||
b1c097af YW |
630 | if (hashmap_isempty(m->subsystem_filter) && |
631 | set_isempty(m->tag_filter)) { | |
632 | m->filter_uptodate = true; | |
633 | return 0; | |
634 | } | |
635 | ||
636 | /* load magic in A */ | |
637 | bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, magic)); | |
638 | /* jump if magic matches */ | |
639 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, UDEV_MONITOR_MAGIC, 1, 0); | |
640 | /* wrong magic, pass packet */ | |
641 | bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff); | |
642 | ||
643 | if (!set_isempty(m->tag_filter)) { | |
644 | int tag_matches = set_size(m->tag_filter); | |
645 | ||
646 | /* add all tags matches */ | |
90e74a66 | 647 | SET_FOREACH(tag, m->tag_filter) { |
b1c097af YW |
648 | uint64_t tag_bloom_bits = string_bloom64(tag); |
649 | uint32_t tag_bloom_hi = tag_bloom_bits >> 32; | |
650 | uint32_t tag_bloom_lo = tag_bloom_bits & 0xffffffff; | |
651 | ||
652 | /* load device bloom bits in A */ | |
653 | bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_hi)); | |
654 | /* clear bits (tag bits & bloom bits) */ | |
655 | bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_hi); | |
656 | /* jump to next tag if it does not match */ | |
657 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_hi, 0, 3); | |
658 | ||
659 | /* load device bloom bits in A */ | |
660 | bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_lo)); | |
661 | /* clear bits (tag bits & bloom bits) */ | |
662 | bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_lo); | |
663 | /* jump behind end of tag match block if tag matches */ | |
664 | tag_matches--; | |
665 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_lo, 1 + (tag_matches * 6), 0); | |
666 | } | |
667 | ||
668 | /* nothing matched, drop packet */ | |
669 | bpf_stmt(ins, &i, BPF_RET|BPF_K, 0); | |
670 | } | |
671 | ||
672 | /* add all subsystem matches */ | |
673 | if (!hashmap_isempty(m->subsystem_filter)) { | |
90e74a66 | 674 | HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter) { |
b1c097af YW |
675 | uint32_t hash = string_hash32(subsystem); |
676 | ||
677 | /* load device subsystem value in A */ | |
678 | bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_subsystem_hash)); | |
679 | if (!devtype) { | |
680 | /* jump if subsystem does not match */ | |
681 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1); | |
682 | } else { | |
b1c097af YW |
683 | /* jump if subsystem does not match */ |
684 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 3); | |
685 | /* load device devtype value in A */ | |
686 | bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_devtype_hash)); | |
687 | /* jump if value does not match */ | |
65fe9c31 | 688 | hash = string_hash32(devtype); |
b1c097af YW |
689 | bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1); |
690 | } | |
691 | ||
692 | /* matched, pass packet */ | |
693 | bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff); | |
694 | ||
695 | if (i+1 >= ELEMENTSOF(ins)) | |
696 | return -E2BIG; | |
697 | } | |
698 | ||
699 | /* nothing matched, drop packet */ | |
700 | bpf_stmt(ins, &i, BPF_RET|BPF_K, 0); | |
701 | } | |
702 | ||
703 | /* matched, pass packet */ | |
704 | bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff); | |
705 | ||
706 | /* install filter */ | |
707 | filter = (struct sock_fprog) { | |
708 | .len = i, | |
709 | .filter = ins, | |
710 | }; | |
711 | if (setsockopt(m->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) < 0) | |
712 | return -errno; | |
713 | ||
714 | m->filter_uptodate = true; | |
715 | return 0; | |
716 | } | |
717 | ||
718 | _public_ int sd_device_monitor_filter_add_match_subsystem_devtype(sd_device_monitor *m, const char *subsystem, const char *devtype) { | |
719 | _cleanup_free_ char *s = NULL, *d = NULL; | |
720 | int r; | |
721 | ||
722 | assert_return(m, -EINVAL); | |
723 | assert_return(subsystem, -EINVAL); | |
724 | ||
725 | s = strdup(subsystem); | |
726 | if (!s) | |
727 | return -ENOMEM; | |
728 | ||
729 | if (devtype) { | |
730 | d = strdup(devtype); | |
731 | if (!d) | |
732 | return -ENOMEM; | |
733 | } | |
734 | ||
735 | r = hashmap_ensure_allocated(&m->subsystem_filter, NULL); | |
736 | if (r < 0) | |
737 | return r; | |
738 | ||
739 | r = hashmap_put(m->subsystem_filter, s, d); | |
740 | if (r < 0) | |
741 | return r; | |
742 | ||
743 | s = d = NULL; | |
744 | m->filter_uptodate = false; | |
745 | ||
746 | return 0; | |
747 | } | |
748 | ||
749 | _public_ int sd_device_monitor_filter_add_match_tag(sd_device_monitor *m, const char *tag) { | |
b1c097af YW |
750 | assert_return(m, -EINVAL); |
751 | assert_return(tag, -EINVAL); | |
752 | ||
aaffd349 ZJS |
753 | int r = set_put_strdup(&m->tag_filter, tag); |
754 | if (r > 0) | |
755 | m->filter_uptodate = false; | |
756 | return r; | |
b1c097af YW |
757 | } |
758 | ||
759 | _public_ int sd_device_monitor_filter_remove(sd_device_monitor *m) { | |
760 | static const struct sock_fprog filter = { 0, NULL }; | |
761 | ||
762 | assert_return(m, -EINVAL); | |
763 | ||
764 | m->subsystem_filter = hashmap_free_free_free(m->subsystem_filter); | |
765 | m->tag_filter = set_free_free(m->tag_filter); | |
766 | ||
b0757173 | 767 | if (setsockopt(m->sock, SOL_SOCKET, SO_DETACH_FILTER, &filter, sizeof(filter)) < 0) |
b1c097af YW |
768 | return -errno; |
769 | ||
770 | m->filter_uptodate = true; | |
771 | return 0; | |
772 | } |