src/libsystemd/sd-device/device-monitor.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <linux/filter.h>
   5 #include <linux/netlink.h>
   6 #include <linux/sockios.h>
   7 #include <sys/ioctl.h>
   8 #include <unistd.h>
   9
  10 #include "sd-device.h"
  11 #include "sd-event.h"
  12
  13 #include "MurmurHash2.h"
  14 #include "alloc-util.h"
  15 #include "device-monitor-private.h"
  16 #include "device-private.h"
  17 #include "device-util.h"
  18 #include "errno-util.h"
  19 #include "fd-util.h"
  20 #include "format-util.h"
  21 #include "hashmap.h"
  22 #include "io-util.h"
  23 #include "missing_socket.h"
  24 #include "mountpoint-util.h"
  25 #include "set.h"
  26 #include "socket-util.h"
  27 #include "string-util.h"
  28 #include "strv.h"
  29
  30 struct sd_device_monitor {
  31         unsigned n_ref;
  32
  33         int sock;
  34         union sockaddr_union snl;
  35         union sockaddr_union snl_trusted_sender;
  36         bool bound;
  37
  38         Hashmap *subsystem_filter;
  39         Set *tag_filter;
  40         bool filter_uptodate;
  41
  42         sd_event *event;
  43         sd_event_source *event_source;
  44         sd_device_monitor_handler_t callback;
  45         void *userdata;
  46 };
  47
  48 #define UDEV_MONITOR_MAGIC                0xfeedcafe
  49
  50 typedef struct monitor_netlink_header {
  51         /* "libudev" prefix to distinguish libudev and kernel messages */
  52         char prefix[8];
  53         /* Magic to protect against daemon <-> Library message format mismatch
  54          * Used in the kernel from socket filter rules; needs to be stored in network order */
  55         unsigned magic;
  56         /* Total length of header structure known to the sender */
  57         unsigned header_size;
  58         /* Properties string buffer */
  59         unsigned properties_off;
  60         unsigned properties_len;
  61         /* Hashes of primary device properties strings, to let libudev subscribers
  62          * use in-kernel socket filters; values need to be stored in network order */
  63         unsigned filter_subsystem_hash;
  64         unsigned filter_devtype_hash;
  65         unsigned filter_tag_bloom_hi;
  66         unsigned filter_tag_bloom_lo;
  67 } monitor_netlink_header;
  68
  69 static int monitor_set_nl_address(sd_device_monitor *m) {
  70         union sockaddr_union snl;
  71         socklen_t addrlen;
  72
  73         assert(m);
  74
  75         /* Get the address the kernel has assigned us.
  76          * It is usually, but not necessarily the pid. */
  77         addrlen = sizeof(struct sockaddr_nl);
  78         if (getsockname(m->sock, &snl.sa, &addrlen) < 0)
  79                 return -errno;
  80
  81         m->snl.nl.nl_pid = snl.nl.nl_pid;
  82         return 0;
  83 }
  84
  85 int device_monitor_allow_unicast_sender(sd_device_monitor *m, sd_device_monitor *sender) {
  86         assert_return(m, -EINVAL);
  87         assert_return(sender, -EINVAL);
  88
  89         m->snl_trusted_sender.nl.nl_pid = sender->snl.nl.nl_pid;
  90         return 0;
  91 }
  92
  93 _public_ int sd_device_monitor_set_receive_buffer_size(sd_device_monitor *m, size_t size) {
  94         int r, n = (int) size;
  95
  96         assert_return(m, -EINVAL);
  97         assert_return((size_t) n == size, -EINVAL);
  98
  99         if (setsockopt_int(m->sock, SOL_SOCKET, SO_RCVBUFFORCE, n) < 0) {
 100                 r = setsockopt_int(m->sock, SOL_SOCKET, SO_RCVBUF, n);
 101                 if (r < 0)
 102                         return r;
 103         }
 104
 105         return 0;
 106 }
 107
 108 int device_monitor_disconnect(sd_device_monitor *m) {
 109         assert(m);
 110
 111         m->sock = safe_close(m->sock);
 112         return 0;
 113 }
 114
 115 int device_monitor_get_fd(sd_device_monitor *m) {
 116         assert_return(m, -EINVAL);
 117
 118         return m->sock;
 119 }
 120
 121 int device_monitor_new_full(sd_device_monitor **ret, MonitorNetlinkGroup group, int fd) {
 122         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *m = NULL;
 123         _cleanup_close_ int sock = -1;
 124         int r;
 125
 126         assert_return(ret, -EINVAL);
 127         assert_return(group >= 0 && group < _MONITOR_NETLINK_GROUP_MAX, -EINVAL);
 128
 129         if (group == MONITOR_GROUP_UDEV &&
 130             access("/run/udev/control", F_OK) < 0 &&
 131             dev_is_devtmpfs() <= 0) {
 132
 133                 /*
 134                  * We do not support subscribing to uevents if no instance of
 135                  * udev is running. Uevents would otherwise broadcast the
 136                  * processing data of the host into containers, which is not
 137                  * desired.
 138                  *
 139                  * Containers will currently not get any udev uevents, until
 140                  * a supporting infrastructure is available.
 141                  *
 142                  * We do not set a netlink multicast group here, so the socket
 143                  * will not receive any messages.
 144                  */
 145
 146                 log_debug("sd-device-monitor: The udev service seems not to be active, disabling the monitor");
 147                 group = MONITOR_GROUP_NONE;
 148         }
 149
 150         if (fd < 0) {
 151                 sock = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_KOBJECT_UEVENT);
 152                 if (sock < 0)
 153                         return log_debug_errno(errno, "sd-device-monitor: Failed to create socket: %m");
 154         }
 155
 156         m = new(sd_device_monitor, 1);
 157         if (!m)
 158                 return -ENOMEM;
 159
 160         *m = (sd_device_monitor) {
 161                 .n_ref = 1,
 162                 .sock = fd >= 0 ? fd : TAKE_FD(sock),
 163                 .bound = fd >= 0,
 164                 .snl.nl.nl_family = AF_NETLINK,
 165                 .snl.nl.nl_groups = group,
 166         };
 167
 168         if (fd >= 0) {
 169                 r = monitor_set_nl_address(m);
 170                 if (r < 0) {
 171                         log_debug_errno(r, "sd-device-monitor: Failed to set netlink address: %m");
 172                         goto fail;
 173                 }
 174         }
 175
 176         if (DEBUG_LOGGING) {
 177                 _cleanup_close_ int netns = -1;
 178
 179                 /* So here's the thing: only AF_NETLINK sockets from the main network namespace will get
 180                  * hardware events. Let's check if ours is from there, and if not generate a debug message,
 181                  * since we cannot possibly work correctly otherwise. This is just a safety check to make
 182                  * things easier to debug. */
 183
 184                 netns = ioctl(m->sock, SIOCGSKNS);
 185                 if (netns < 0)
 186                         log_debug_errno(errno, "sd-device-monitor: Unable to get network namespace of udev netlink socket, unable to determine if we are in host netns: %m");
 187                 else {
 188                         struct stat a, b;
 189
 190                         if (fstat(netns, &a) < 0) {
 191                                 r = log_debug_errno(errno, "sd-device-monitor: Failed to stat netns of udev netlink socket: %m");
 192                                 goto fail;
 193                         }
 194
 195                         if (stat("/proc/1/ns/net", &b) < 0) {
 196                                 if (ERRNO_IS_PRIVILEGE(errno))
 197                                         /* If we can't access PID1's netns info due to permissions, it's fine, this is a
 198                                          * safety check only after all. */
 199                                         log_debug_errno(errno, "sd-device-monitor: No permission to stat PID1's netns, unable to determine if we are in host netns: %m");
 200                                 else
 201                                         log_debug_errno(errno, "sd-device-monitor: Failed to stat PID1's netns: %m");
 202
 203                         } else if (a.st_dev != b.st_dev || a.st_ino != b.st_ino)
 204                                 log_debug("sd-device-monitor: Netlink socket we listen on is not from host netns, we won't see device events.");
 205                 }
 206         }
 207
 208         *ret = TAKE_PTR(m);
 209         return 0;
 210
 211 fail:
 212         /* Let's unset the socket fd in the monitor object before we destroy it so that the fd passed in is
 213          * not closed on failure. */
 214         if (fd >= 0)
 215                 m->sock = -1;
 216
 217         return r;
 218 }
 219
 220 _public_ int sd_device_monitor_new(sd_device_monitor **ret) {
 221         return device_monitor_new_full(ret, MONITOR_GROUP_UDEV, -1);
 222 }
 223
 224 _public_ int sd_device_monitor_stop(sd_device_monitor *m) {
 225         assert_return(m, -EINVAL);
 226
 227         m->event_source = sd_event_source_unref(m->event_source);
 228         (void) device_monitor_disconnect(m);
 229
 230         return 0;
 231 }
 232
 233 static int device_monitor_event_handler(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 234         _cleanup_(sd_device_unrefp) sd_device *device = NULL;
 235         sd_device_monitor *m = userdata;
 236
 237         assert(m);
 238
 239         if (device_monitor_receive_device(m, &device) <= 0)
 240                 return 0;
 241
 242         if (m->callback)
 243                 return m->callback(m, device, m->userdata);
 244
 245         return 0;
 246 }
 247
 248 _public_ int sd_device_monitor_start(sd_device_monitor *m, sd_device_monitor_handler_t callback, void *userdata) {
 249         int r;
 250
 251         assert_return(m, -EINVAL);
 252
 253         if (!m->event) {
 254                 r = sd_device_monitor_attach_event(m, NULL);
 255                 if (r < 0)
 256                         return r;
 257         }
 258
 259         r = device_monitor_enable_receiving(m);
 260         if (r < 0)
 261                 return r;
 262
 263         m->callback = callback;
 264         m->userdata = userdata;
 265
 266         r = sd_event_add_io(m->event, &m->event_source, m->sock, EPOLLIN, device_monitor_event_handler, m);
 267         if (r < 0)
 268                 return r;
 269
 270         (void) sd_event_source_set_description(m->event_source, "sd-device-monitor");
 271
 272         return 0;
 273 }
 274
 275 _public_ int sd_device_monitor_detach_event(sd_device_monitor *m) {
 276         assert_return(m, -EINVAL);
 277
 278         (void) sd_device_monitor_stop(m);
 279         m->event = sd_event_unref(m->event);
 280
 281         return 0;
 282 }
 283
 284 _public_ int sd_device_monitor_attach_event(sd_device_monitor *m, sd_event *event) {
 285         int r;
 286
 287         assert_return(m, -EINVAL);
 288         assert_return(!m->event, -EBUSY);
 289
 290         if (event)
 291                 m->event = sd_event_ref(event);
 292         else {
 293                 r = sd_event_default(&m->event);
 294                 if (r < 0)
 295                         return r;
 296         }
 297
 298         return 0;
 299 }
 300
 301 _public_ sd_event *sd_device_monitor_get_event(sd_device_monitor *m) {
 302         assert_return(m, NULL);
 303
 304         return m->event;
 305 }
 306
 307 _public_ sd_event_source *sd_device_monitor_get_event_source(sd_device_monitor *m) {
 308         assert_return(m, NULL);
 309
 310         return m->event_source;
 311 }
 312
 313 int device_monitor_enable_receiving(sd_device_monitor *m) {
 314         int r;
 315
 316         assert_return(m, -EINVAL);
 317
 318         r = sd_device_monitor_filter_update(m);
 319         if (r < 0)
 320                 return log_debug_errno(r, "sd-device-monitor: Failed to update filter: %m");
 321
 322         if (!m->bound) {
 323                 /* enable receiving of sender credentials */
 324                 r = setsockopt_int(m->sock, SOL_SOCKET, SO_PASSCRED, true);
 325                 if (r < 0)
 326                         return log_debug_errno(r, "sd-device-monitor: Failed to set socket option SO_PASSCRED: %m");
 327
 328                 if (bind(m->sock, &m->snl.sa, sizeof(struct sockaddr_nl)) < 0)
 329                         return log_debug_errno(errno, "sd-device-monitor: Failed to bind monitoring socket: %m");
 330
 331                 m->bound = true;
 332
 333                 r = monitor_set_nl_address(m);
 334                 if (r < 0)
 335                         return log_debug_errno(r, "sd-device-monitor: Failed to set address: %m");
 336         }
 337
 338         return 0;
 339 }
 340
 341 static sd_device_monitor *device_monitor_free(sd_device_monitor *m) {
 342         assert(m);
 343
 344         (void) sd_device_monitor_detach_event(m);
 345
 346         hashmap_free_free_free(m->subsystem_filter);
 347         set_free_free(m->tag_filter);
 348
 349         return mfree(m);
 350 }
 351
 352 DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_device_monitor, sd_device_monitor, device_monitor_free);
 353
 354 static int passes_filter(sd_device_monitor *m, sd_device *device) {
 355         const char *tag, *subsystem, *devtype, *s, *d = NULL;
 356         Iterator i;
 357         int r;
 358
 359         assert_return(m, -EINVAL);
 360         assert_return(device, -EINVAL);
 361
 362         if (hashmap_isempty(m->subsystem_filter))
 363                 goto tag;
 364
 365         r = sd_device_get_subsystem(device, &s);
 366         if (r < 0)
 367                 return r;
 368
 369         r = sd_device_get_devtype(device, &d);
 370         if (r < 0 && r != -ENOENT)
 371                 return r;
 372
 373         HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter, i) {
 374                 if (!streq(s, subsystem))
 375                         continue;
 376
 377                 if (!devtype)
 378                         goto tag;
 379
 380                 if (!d)
 381                         continue;
 382
 383                 if (streq(d, devtype))
 384                         goto tag;
 385         }
 386
 387         return 0;
 388
 389 tag:
 390         if (set_isempty(m->tag_filter))
 391                 return 1;
 392
 393         SET_FOREACH(tag, m->tag_filter, i)
 394                 if (sd_device_has_tag(device, tag) > 0)
 395                         return 1;
 396
 397         return 0;
 398 }
 399
 400 int device_monitor_receive_device(sd_device_monitor *m, sd_device **ret) {
 401         _cleanup_(sd_device_unrefp) sd_device *device = NULL;
 402         union {
 403                 monitor_netlink_header nlh;
 404                 char raw[8192];
 405         } buf;
 406         struct iovec iov = {
 407                 .iov_base = &buf,
 408                 .iov_len = sizeof(buf)
 409         };
 410         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred))) control;
 411         union sockaddr_union snl;
 412         struct msghdr smsg = {
 413                 .msg_iov = &iov,
 414                 .msg_iovlen = 1,
 415                 .msg_control = &control,
 416                 .msg_controllen = sizeof(control),
 417                 .msg_name = &snl,
 418                 .msg_namelen = sizeof(snl),
 419         };
 420         struct cmsghdr *cmsg;
 421         struct ucred *cred;
 422         ssize_t buflen, bufpos;
 423         bool is_initialized = false;
 424         int r;
 425
 426         assert(ret);
 427
 428         buflen = recvmsg(m->sock, &smsg, 0);
 429         if (buflen < 0) {
 430                 if (errno != EINTR)
 431                         log_debug_errno(errno, "sd-device-monitor: Failed to receive message: %m");
 432                 return -errno;
 433         }
 434
 435         if (buflen < 32 || (smsg.msg_flags & MSG_TRUNC))
 436                 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
 437                                        "sd-device-monitor: Invalid message length.");
 438
 439         if (snl.nl.nl_groups == MONITOR_GROUP_NONE) {
 440                 /* unicast message, check if we trust the sender */
 441                 if (m->snl_trusted_sender.nl.nl_pid == 0 ||
 442                     snl.nl.nl_pid != m->snl_trusted_sender.nl.nl_pid)
 443                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 444                                                "sd-device-monitor: Unicast netlink message ignored.");
 445
 446         } else if (snl.nl.nl_groups == MONITOR_GROUP_KERNEL) {
 447                 if (snl.nl.nl_pid > 0)
 448                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 449                                                "sd-device-monitor: Multicast kernel netlink message from PID %"PRIu32" ignored.", snl.nl.nl_pid);
 450         }
 451
 452         cmsg = CMSG_FIRSTHDR(&smsg);
 453         if (!cmsg || cmsg->cmsg_type != SCM_CREDENTIALS)
 454                 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 455                                        "sd-device-monitor: No sender credentials received, message ignored.");
 456
 457         cred = (struct ucred*) CMSG_DATA(cmsg);
 458         if (cred->uid != 0)
 459                 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 460                                        "sd-device-monitor: Sender uid="UID_FMT", message ignored.", cred->uid);
 461
 462         if (streq(buf.raw, "libudev")) {
 463                 /* udev message needs proper version magic */
 464                 if (buf.nlh.magic != htobe32(UDEV_MONITOR_MAGIC))
 465                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 466                                                "sd-device-monitor: Invalid message signature (%x != %x)",
 467                                                buf.nlh.magic, htobe32(UDEV_MONITOR_MAGIC));
 468
 469                 if (buf.nlh.properties_off+32 > (size_t) buflen)
 470                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 471                                                "sd-device-monitor: Invalid message length (%u > %zd)",
 472                                                buf.nlh.properties_off+32, buflen);
 473
 474                 bufpos = buf.nlh.properties_off;
 475
 476                 /* devices received from udev are always initialized */
 477                 is_initialized = true;
 478
 479         } else {
 480                 /* kernel message with header */
 481                 bufpos = strlen(buf.raw) + 1;
 482                 if ((size_t) bufpos < sizeof("a@/d") || bufpos >= buflen)
 483                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 484                                                "sd-device-monitor: Invalid message length");
 485
 486                 /* check message header */
 487                 if (!strstr(buf.raw, "@/"))
 488                         return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 489                                                "sd-device-monitor: Invalid message header");
 490         }
 491
 492         r = device_new_from_nulstr(&device, (uint8_t*) &buf.raw[bufpos], buflen - bufpos);
 493         if (r < 0)
 494                 return log_debug_errno(r, "sd-device-monitor: Failed to create device from received message: %m");
 495
 496         if (is_initialized)
 497                 device_set_is_initialized(device);
 498
 499         /* Skip device, if it does not pass the current filter */
 500         r = passes_filter(m, device);
 501         if (r < 0)
 502                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to check received device passing filter: %m");
 503         if (r == 0)
 504                 log_device_debug(device, "sd-device-monitor: Received device does not pass filter, ignoring");
 505         else
 506                 *ret = TAKE_PTR(device);
 507
 508         return r;
 509 }
 510
 511 static uint32_t string_hash32(const char *str) {
 512         return MurmurHash2(str, strlen(str), 0);
 513 }
 514
 515 /* Get a bunch of bit numbers out of the hash, and set the bits in our bit field */
 516 static uint64_t string_bloom64(const char *str) {
 517         uint64_t bits = 0;
 518         uint32_t hash = string_hash32(str);
 519
 520         bits |= 1LLU << (hash & 63);
 521         bits |= 1LLU << ((hash >> 6) & 63);
 522         bits |= 1LLU << ((hash >> 12) & 63);
 523         bits |= 1LLU << ((hash >> 18) & 63);
 524         return bits;
 525 }
 526
 527 int device_monitor_send_device(
 528                 sd_device_monitor *m,
 529                 sd_device_monitor *destination,
 530                 sd_device *device) {
 531
 532         monitor_netlink_header nlh = {
 533                 .prefix = "libudev",
 534                 .magic = htobe32(UDEV_MONITOR_MAGIC),
 535                 .header_size = sizeof nlh,
 536         };
 537         struct iovec iov[2] = {
 538                 { .iov_base = &nlh, .iov_len = sizeof nlh },
 539         };
 540         struct msghdr smsg = {
 541                 .msg_iov = iov,
 542                 .msg_iovlen = 2,
 543         };
 544         /* default destination for sending */
 545         union sockaddr_union default_destination = {
 546                 .nl.nl_family = AF_NETLINK,
 547                 .nl.nl_groups = MONITOR_GROUP_UDEV,
 548         };
 549         uint64_t tag_bloom_bits;
 550         const char *buf, *val;
 551         ssize_t count;
 552         size_t blen;
 553         int r;
 554
 555         assert(m);
 556         assert(device);
 557
 558         r = device_get_properties_nulstr(device, (const uint8_t **) &buf, &blen);
 559         if (r < 0)
 560                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device properties: %m");
 561         if (blen < 32) {
 562                 log_device_debug(device, "sd-device-monitor: Length of device property nulstr is too small to contain valid device information");
 563                 return -EINVAL;
 564         }
 565
 566         /* fill in versioned header */
 567         r = sd_device_get_subsystem(device, &val);
 568         if (r < 0)
 569                 return log_device_debug_errno(device, r, "sd-device-monitor: Failed to get device subsystem: %m");
 570         nlh.filter_subsystem_hash = htobe32(string_hash32(val));
 571
 572         if (sd_device_get_devtype(device, &val) >= 0)
 573                 nlh.filter_devtype_hash = htobe32(string_hash32(val));
 574
 575         /* add tag bloom filter */
 576         tag_bloom_bits = 0;
 577         FOREACH_DEVICE_TAG(device, val)
 578                 tag_bloom_bits |= string_bloom64(val);
 579
 580         if (tag_bloom_bits > 0) {
 581                 nlh.filter_tag_bloom_hi = htobe32(tag_bloom_bits >> 32);
 582                 nlh.filter_tag_bloom_lo = htobe32(tag_bloom_bits & 0xffffffff);
 583         }
 584
 585         /* add properties list */
 586         nlh.properties_off = iov[0].iov_len;
 587         nlh.properties_len = blen;
 588         iov[1] = IOVEC_MAKE((char*) buf, blen);
 589
 590         /*
 591          * Use custom address for target, or the default one.
 592          *
 593          * If we send to a multicast group, we will get
 594          * ECONNREFUSED, which is expected.
 595          */
 596         smsg.msg_name = destination ? &destination->snl : &default_destination;
 597         smsg.msg_namelen = sizeof(struct sockaddr_nl);
 598         count = sendmsg(m->sock, &smsg, 0);
 599         if (count < 0) {
 600                 if (!destination && errno == ECONNREFUSED) {
 601                         log_device_debug(device, "sd-device-monitor: Passed to netlink monitor");
 602                         return 0;
 603                 } else
 604                         return log_device_debug_errno(device, errno, "sd-device-monitor: Failed to send device to netlink monitor: %m");
 605         }
 606
 607         log_device_debug(device, "sd-device-monitor: Passed %zi byte to netlink monitor", count);
 608         return count;
 609 }
 610
 611 static void bpf_stmt(struct sock_filter *ins, unsigned *i,
 612                      unsigned short code, unsigned data) {
 613         ins[(*i)++] = (struct sock_filter) {
 614                 .code = code,
 615                 .k = data,
 616         };
 617 }
 618
 619 static void bpf_jmp(struct sock_filter *ins, unsigned *i,
 620                     unsigned short code, unsigned data,
 621                     unsigned short jt, unsigned short jf) {
 622         ins[(*i)++] = (struct sock_filter) {
 623                 .code = code,
 624                 .jt = jt,
 625                 .jf = jf,
 626                 .k = data,
 627         };
 628 }
 629
 630 _public_ int sd_device_monitor_filter_update(sd_device_monitor *m) {
 631         struct sock_filter ins[512] = {};
 632         struct sock_fprog filter;
 633         const char *subsystem, *devtype, *tag;
 634         unsigned i = 0;
 635         Iterator it;
 636
 637         assert_return(m, -EINVAL);
 638
 639         if (m->filter_uptodate)
 640                 return 0;
 641
 642         if (hashmap_isempty(m->subsystem_filter) &&
 643             set_isempty(m->tag_filter)) {
 644                 m->filter_uptodate = true;
 645                 return 0;
 646         }
 647
 648         /* load magic in A */
 649         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, magic));
 650         /* jump if magic matches */
 651         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, UDEV_MONITOR_MAGIC, 1, 0);
 652         /* wrong magic, pass packet */
 653         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 654
 655         if (!set_isempty(m->tag_filter)) {
 656                 int tag_matches = set_size(m->tag_filter);
 657
 658                 /* add all tags matches */
 659                 SET_FOREACH(tag, m->tag_filter, it) {
 660                         uint64_t tag_bloom_bits = string_bloom64(tag);
 661                         uint32_t tag_bloom_hi = tag_bloom_bits >> 32;
 662                         uint32_t tag_bloom_lo = tag_bloom_bits & 0xffffffff;
 663
 664                         /* load device bloom bits in A */
 665                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_hi));
 666                         /* clear bits (tag bits & bloom bits) */
 667                         bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_hi);
 668                         /* jump to next tag if it does not match */
 669                         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_hi, 0, 3);
 670
 671                         /* load device bloom bits in A */
 672                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_tag_bloom_lo));
 673                         /* clear bits (tag bits & bloom bits) */
 674                         bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_lo);
 675                         /* jump behind end of tag match block if tag matches */
 676                         tag_matches--;
 677                         bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_lo, 1 + (tag_matches * 6), 0);
 678                 }
 679
 680                 /* nothing matched, drop packet */
 681                 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
 682         }
 683
 684         /* add all subsystem matches */
 685         if (!hashmap_isempty(m->subsystem_filter)) {
 686                 HASHMAP_FOREACH_KEY(devtype, subsystem, m->subsystem_filter, it) {
 687                         uint32_t hash = string_hash32(subsystem);
 688
 689                         /* load device subsystem value in A */
 690                         bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_subsystem_hash));
 691                         if (!devtype) {
 692                                 /* jump if subsystem does not match */
 693                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
 694                         } else {
 695                                 /* jump if subsystem does not match */
 696                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 3);
 697                                 /* load device devtype value in A */
 698                                 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(monitor_netlink_header, filter_devtype_hash));
 699                                 /* jump if value does not match */
 700                                 hash = string_hash32(devtype);
 701                                 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
 702                         }
 703
 704                         /* matched, pass packet */
 705                         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 706
 707                         if (i+1 >= ELEMENTSOF(ins))
 708                                 return -E2BIG;
 709                 }
 710
 711                 /* nothing matched, drop packet */
 712                 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
 713         }
 714
 715         /* matched, pass packet */
 716         bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
 717
 718         /* install filter */
 719         filter = (struct sock_fprog) {
 720                 .len = i,
 721                 .filter = ins,
 722         };
 723         if (setsockopt(m->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) < 0)
 724                 return -errno;
 725
 726         m->filter_uptodate = true;
 727         return 0;
 728 }
 729
 730 _public_ int sd_device_monitor_filter_add_match_subsystem_devtype(sd_device_monitor *m, const char *subsystem, const char *devtype) {
 731         _cleanup_free_ char *s = NULL, *d = NULL;
 732         int r;
 733
 734         assert_return(m, -EINVAL);
 735         assert_return(subsystem, -EINVAL);
 736
 737         s = strdup(subsystem);
 738         if (!s)
 739                 return -ENOMEM;
 740
 741         if (devtype) {
 742                 d = strdup(devtype);
 743                 if (!d)
 744                         return -ENOMEM;
 745         }
 746
 747         r = hashmap_ensure_allocated(&m->subsystem_filter, NULL);
 748         if (r < 0)
 749                 return r;
 750
 751         r = hashmap_put(m->subsystem_filter, s, d);
 752         if (r < 0)
 753                 return r;
 754
 755         s = d = NULL;
 756         m->filter_uptodate = false;
 757
 758         return 0;
 759 }
 760
 761 _public_ int sd_device_monitor_filter_add_match_tag(sd_device_monitor *m, const char *tag) {
 762         _cleanup_free_ char *t = NULL;
 763         int r;
 764
 765         assert_return(m, -EINVAL);
 766         assert_return(tag, -EINVAL);
 767
 768         t = strdup(tag);
 769         if (!t)
 770                 return -ENOMEM;
 771
 772         r = set_ensure_allocated(&m->tag_filter, &string_hash_ops);
 773         if (r < 0)
 774                 return r;
 775
 776         r = set_put(m->tag_filter, t);
 777         if (r == -EEXIST)
 778                 return 0;
 779         if (r < 0)
 780                 return r;
 781
 782         TAKE_PTR(t);
 783         m->filter_uptodate = false;
 784
 785         return 0;
 786 }
 787
 788 _public_ int sd_device_monitor_filter_remove(sd_device_monitor *m) {
 789         static const struct sock_fprog filter = { 0, NULL };
 790
 791         assert_return(m, -EINVAL);
 792
 793         m->subsystem_filter = hashmap_free_free_free(m->subsystem_filter);
 794         m->tag_filter = set_free_free(m->tag_filter);
 795
 796         if (setsockopt(m->sock, SOL_SOCKET, SO_DETACH_FILTER, &filter, sizeof(filter)) < 0)
 797                 return -errno;
 798
 799         m->filter_uptodate = true;
 800         return 0;
 801 }