2 This file is part of systemd.
4 Copyright 2008-2012 Kay Sievers <kay@vrfy.org>
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
29 #include <sys/socket.h>
31 #include <arpa/inet.h>
32 #include <linux/netlink.h>
33 #include <linux/filter.h>
36 #include "libudev-private.h"
37 #include "socket-util.h"
41 * SECTION:libudev-monitor
42 * @short_description: device event source
44 * Connects to a device event source.
50 * Opaque object handling an event source.
56 union sockaddr_union snl;
57 union sockaddr_union snl_trusted_sender;
58 union sockaddr_union snl_destination;
60 struct udev_list filter_subsystem_list;
61 struct udev_list filter_tag_list;
65 enum udev_monitor_netlink_group {
71 #define UDEV_MONITOR_MAGIC 0xfeedcafe
72 struct udev_monitor_netlink_header {
73 /* "libudev" prefix to distinguish libudev and kernel messages */
76 * magic to protect against daemon <-> library message format mismatch
77 * used in the kernel from socket filter rules; needs to be stored in network order
80 /* total length of header structure known to the sender */
81 unsigned int header_size;
82 /* properties string buffer */
83 unsigned int properties_off;
84 unsigned int properties_len;
86 * hashes of primary device properties strings, to let libudev subscribers
87 * use in-kernel socket filters; values need to be stored in network order
89 unsigned int filter_subsystem_hash;
90 unsigned int filter_devtype_hash;
91 unsigned int filter_tag_bloom_hi;
92 unsigned int filter_tag_bloom_lo;
95 static struct udev_monitor *udev_monitor_new(struct udev *udev)
97 struct udev_monitor *udev_monitor;
99 udev_monitor = new0(struct udev_monitor, 1);
100 if (udev_monitor == NULL)
102 udev_monitor->refcount = 1;
103 udev_monitor->udev = udev;
104 udev_list_init(udev, &udev_monitor->filter_subsystem_list, false);
105 udev_list_init(udev, &udev_monitor->filter_tag_list, true);
109 /* we consider udev running when /dev is on devtmpfs */
110 static bool udev_has_devtmpfs(struct udev *udev) {
112 union file_handle_union h = FILE_HANDLE_INIT;
113 _cleanup_fclose_ FILE *f = NULL;
114 char line[LINE_MAX], *e;
118 r = name_to_handle_at(AT_FDCWD, "/dev", &h.handle, &mount_id, 0);
120 if (errno != EOPNOTSUPP)
121 log_debug_errno(errno, "name_to_handle_at on /dev: %m");
125 f = fopen("/proc/self/mountinfo", "re");
129 FOREACH_LINE(line, f, return false) {
132 if (sscanf(line, "%i", &mid) != 1)
138 e = strstr(line, " - ");
142 /* accept any name that starts with the currently expected type */
143 if (startswith(e + 3, "devtmpfs"))
150 struct udev_monitor *udev_monitor_new_from_netlink_fd(struct udev *udev, const char *name, int fd)
152 struct udev_monitor *udev_monitor;
159 group = UDEV_MONITOR_NONE;
160 else if (streq(name, "udev")) {
162 * We do not support subscribing to uevents if no instance of
163 * udev is running. Uevents would otherwise broadcast the
164 * processing data of the host into containers, which is not
167 * Containers will currently not get any udev uevents, until
168 * a supporting infrastructure is available.
170 * We do not set a netlink multicast group here, so the socket
171 * will not receive any messages.
173 if (access("/run/udev/control", F_OK) < 0 && !udev_has_devtmpfs(udev)) {
174 log_debug("the udev service seems not to be active, disable the monitor");
175 group = UDEV_MONITOR_NONE;
177 group = UDEV_MONITOR_UDEV;
178 } else if (streq(name, "kernel"))
179 group = UDEV_MONITOR_KERNEL;
183 udev_monitor = udev_monitor_new(udev);
184 if (udev_monitor == NULL)
188 udev_monitor->sock = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_KOBJECT_UEVENT);
189 if (udev_monitor->sock == -1) {
190 log_debug_errno(errno, "error getting socket: %m");
195 udev_monitor->bound = true;
196 udev_monitor->sock = fd;
199 udev_monitor->snl.nl.nl_family = AF_NETLINK;
200 udev_monitor->snl.nl.nl_groups = group;
202 /* default destination for sending */
203 udev_monitor->snl_destination.nl.nl_family = AF_NETLINK;
204 udev_monitor->snl_destination.nl.nl_groups = UDEV_MONITOR_UDEV;
210 * udev_monitor_new_from_netlink:
211 * @udev: udev library context
212 * @name: name of event source
214 * Create new udev monitor and connect to a specified event
215 * source. Valid sources identifiers are "udev" and "kernel".
217 * Applications should usually not connect directly to the
218 * "kernel" events, because the devices might not be useable
219 * at that time, before udev has configured them, and created
220 * device nodes. Accessing devices at the same time as udev,
221 * might result in unpredictable behavior. The "udev" events
222 * are sent out after udev has finished its event processing,
223 * all rules have been processed, and needed device nodes are
226 * The initial refcount is 1, and needs to be decremented to
227 * release the resources of the udev monitor.
229 * Returns: a new udev monitor, or #NULL, in case of an error
231 _public_ struct udev_monitor *udev_monitor_new_from_netlink(struct udev *udev, const char *name)
233 return udev_monitor_new_from_netlink_fd(udev, name, -1);
236 static inline void bpf_stmt(struct sock_filter *inss, unsigned int *i,
237 unsigned short code, unsigned int data)
239 struct sock_filter *ins = &inss[*i];
246 static inline void bpf_jmp(struct sock_filter *inss, unsigned int *i,
247 unsigned short code, unsigned int data,
248 unsigned short jt, unsigned short jf)
250 struct sock_filter *ins = &inss[*i];
260 * udev_monitor_filter_update:
261 * @udev_monitor: monitor
263 * Update the installed socket filter. This is only needed,
264 * if the filter was removed or changed.
266 * Returns: 0 on success, otherwise a negative error value.
268 _public_ int udev_monitor_filter_update(struct udev_monitor *udev_monitor)
270 struct sock_filter ins[512];
271 struct sock_fprog filter;
273 struct udev_list_entry *list_entry;
276 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) == NULL &&
277 udev_list_get_entry(&udev_monitor->filter_tag_list) == NULL)
280 memzero(ins, sizeof(ins));
283 /* load magic in A */
284 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, magic));
285 /* jump if magic matches */
286 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, UDEV_MONITOR_MAGIC, 1, 0);
287 /* wrong magic, pass packet */
288 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
290 if (udev_list_get_entry(&udev_monitor->filter_tag_list) != NULL) {
293 /* count tag matches, to calculate end of tag match block */
295 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list))
298 /* add all tags matches */
299 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list)) {
300 uint64_t tag_bloom_bits = util_string_bloom64(udev_list_entry_get_name(list_entry));
301 uint32_t tag_bloom_hi = tag_bloom_bits >> 32;
302 uint32_t tag_bloom_lo = tag_bloom_bits & 0xffffffff;
304 /* load device bloom bits in A */
305 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_tag_bloom_hi));
306 /* clear bits (tag bits & bloom bits) */
307 bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_hi);
308 /* jump to next tag if it does not match */
309 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_hi, 0, 3);
311 /* load device bloom bits in A */
312 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_tag_bloom_lo));
313 /* clear bits (tag bits & bloom bits) */
314 bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_lo);
315 /* jump behind end of tag match block if tag matches */
317 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_lo, 1 + (tag_matches * 6), 0);
320 /* nothing matched, drop packet */
321 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
324 /* add all subsystem matches */
325 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) != NULL) {
326 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_subsystem_list)) {
327 unsigned int hash = util_string_hash32(udev_list_entry_get_name(list_entry));
329 /* load device subsystem value in A */
330 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_subsystem_hash));
331 if (udev_list_entry_get_value(list_entry) == NULL) {
332 /* jump if subsystem does not match */
333 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
335 /* jump if subsystem does not match */
336 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 3);
338 /* load device devtype value in A */
339 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_devtype_hash));
340 /* jump if value does not match */
341 hash = util_string_hash32(udev_list_entry_get_value(list_entry));
342 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
345 /* matched, pass packet */
346 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
348 if (i+1 >= ELEMENTSOF(ins))
352 /* nothing matched, drop packet */
353 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
356 /* matched, pass packet */
357 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
360 memzero(&filter, sizeof(filter));
363 err = setsockopt(udev_monitor->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter));
364 return err < 0 ? -errno : 0;
367 int udev_monitor_allow_unicast_sender(struct udev_monitor *udev_monitor, struct udev_monitor *sender)
369 udev_monitor->snl_trusted_sender.nl.nl_pid = sender->snl.nl.nl_pid;
373 * udev_monitor_enable_receiving:
374 * @udev_monitor: the monitor which should receive events
376 * Binds the @udev_monitor socket to the event source.
378 * Returns: 0 on success, otherwise a negative error value.
380 _public_ int udev_monitor_enable_receiving(struct udev_monitor *udev_monitor)
385 udev_monitor_filter_update(udev_monitor);
387 if (!udev_monitor->bound) {
388 err = bind(udev_monitor->sock,
389 &udev_monitor->snl.sa, sizeof(struct sockaddr_nl));
391 udev_monitor->bound = true;
395 union sockaddr_union snl;
399 * get the address the kernel has assigned us
400 * it is usually, but not necessarily the pid
402 addrlen = sizeof(struct sockaddr_nl);
403 err = getsockname(udev_monitor->sock, &snl.sa, &addrlen);
405 udev_monitor->snl.nl.nl_pid = snl.nl.nl_pid;
407 log_debug_errno(errno, "bind failed: %m");
411 /* enable receiving of sender credentials */
412 err = setsockopt(udev_monitor->sock, SOL_SOCKET, SO_PASSCRED, &on, sizeof(on));
414 log_debug_errno(errno, "setting SO_PASSCRED failed: %m");
420 * udev_monitor_set_receive_buffer_size:
421 * @udev_monitor: the monitor which should receive events
422 * @size: the size in bytes
424 * Set the size of the kernel socket buffer. This call needs the
425 * appropriate privileges to succeed.
427 * Returns: 0 on success, otherwise -1 on error.
429 _public_ int udev_monitor_set_receive_buffer_size(struct udev_monitor *udev_monitor, int size)
431 if (udev_monitor == NULL)
433 return setsockopt(udev_monitor->sock, SOL_SOCKET, SO_RCVBUFFORCE, &size, sizeof(size));
436 int udev_monitor_disconnect(struct udev_monitor *udev_monitor)
440 err = close(udev_monitor->sock);
441 udev_monitor->sock = -1;
442 return err < 0 ? -errno : 0;
447 * @udev_monitor: udev monitor
449 * Take a reference of a udev monitor.
451 * Returns: the passed udev monitor
453 _public_ struct udev_monitor *udev_monitor_ref(struct udev_monitor *udev_monitor)
455 if (udev_monitor == NULL)
457 udev_monitor->refcount++;
462 * udev_monitor_unref:
463 * @udev_monitor: udev monitor
465 * Drop a reference of a udev monitor. If the refcount reaches zero,
466 * the bound socket will be closed, and the resources of the monitor
471 _public_ struct udev_monitor *udev_monitor_unref(struct udev_monitor *udev_monitor)
473 if (udev_monitor == NULL)
475 udev_monitor->refcount--;
476 if (udev_monitor->refcount > 0)
478 if (udev_monitor->sock >= 0)
479 close(udev_monitor->sock);
480 udev_list_cleanup(&udev_monitor->filter_subsystem_list);
481 udev_list_cleanup(&udev_monitor->filter_tag_list);
487 * udev_monitor_get_udev:
488 * @udev_monitor: udev monitor
490 * Retrieve the udev library context the monitor was created with.
492 * Returns: the udev library context
494 _public_ struct udev *udev_monitor_get_udev(struct udev_monitor *udev_monitor)
496 if (udev_monitor == NULL)
498 return udev_monitor->udev;
502 * udev_monitor_get_fd:
503 * @udev_monitor: udev monitor
505 * Retrieve the socket file descriptor associated with the monitor.
507 * Returns: the socket file descriptor
509 _public_ int udev_monitor_get_fd(struct udev_monitor *udev_monitor)
511 if (udev_monitor == NULL)
513 return udev_monitor->sock;
516 static int passes_filter(struct udev_monitor *udev_monitor, struct udev_device *udev_device)
518 struct udev_list_entry *list_entry;
520 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) == NULL)
522 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_subsystem_list)) {
523 const char *subsys = udev_list_entry_get_name(list_entry);
524 const char *dsubsys = udev_device_get_subsystem(udev_device);
526 const char *ddevtype;
528 if (!streq(dsubsys, subsys))
531 devtype = udev_list_entry_get_value(list_entry);
534 ddevtype = udev_device_get_devtype(udev_device);
535 if (ddevtype == NULL)
537 if (streq(ddevtype, devtype))
543 if (udev_list_get_entry(&udev_monitor->filter_tag_list) == NULL)
545 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list)) {
546 const char *tag = udev_list_entry_get_name(list_entry);
548 if (udev_device_has_tag(udev_device, tag))
555 * udev_monitor_receive_device:
556 * @udev_monitor: udev monitor
558 * Receive data from the udev monitor socket, allocate a new udev
559 * device, fill in the received data, and return the device.
561 * Only socket connections with uid=0 are accepted.
563 * The monitor socket is by default set to NONBLOCK. A variant of poll() on
564 * the file descriptor returned by udev_monitor_get_fd() should to be used to
565 * wake up when new devices arrive, or alternatively the file descriptor
566 * switched into blocking mode.
568 * The initial refcount is 1, and needs to be decremented to
569 * release the resources of the udev device.
571 * Returns: a new udev device, or #NULL, in case of an error
573 _public_ struct udev_device *udev_monitor_receive_device(struct udev_monitor *udev_monitor)
575 struct udev_device *udev_device;
578 char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
579 struct cmsghdr *cmsg;
580 union sockaddr_union snl;
583 struct udev_monitor_netlink_header nlh;
590 if (udev_monitor == NULL)
593 iov.iov_len = sizeof(buf);
594 memzero(&smsg, sizeof(struct msghdr));
597 smsg.msg_control = cred_msg;
598 smsg.msg_controllen = sizeof(cred_msg);
599 smsg.msg_name = &snl;
600 smsg.msg_namelen = sizeof(snl);
602 buflen = recvmsg(udev_monitor->sock, &smsg, 0);
605 log_debug("unable to receive message");
609 if (buflen < 32 || (smsg.msg_flags & MSG_TRUNC)) {
610 log_debug("invalid message length");
614 if (snl.nl.nl_groups == 0) {
615 /* unicast message, check if we trust the sender */
616 if (udev_monitor->snl_trusted_sender.nl.nl_pid == 0 ||
617 snl.nl.nl_pid != udev_monitor->snl_trusted_sender.nl.nl_pid) {
618 log_debug("unicast netlink message ignored");
621 } else if (snl.nl.nl_groups == UDEV_MONITOR_KERNEL) {
622 if (snl.nl.nl_pid > 0) {
623 log_debug("multicast kernel netlink message from pid %d ignored",
629 cmsg = CMSG_FIRSTHDR(&smsg);
630 if (cmsg == NULL || cmsg->cmsg_type != SCM_CREDENTIALS) {
631 log_debug("no sender credentials received, message ignored");
635 cred = (struct ucred *)CMSG_DATA(cmsg);
636 if (cred->uid != 0) {
637 log_debug("sender uid=%d, message ignored", cred->uid);
641 udev_device = udev_device_new(udev_monitor->udev);
642 if (udev_device == NULL)
645 if (memcmp(buf.raw, "libudev", 8) == 0) {
646 /* udev message needs proper version magic */
647 if (buf.nlh.magic != htonl(UDEV_MONITOR_MAGIC)) {
648 log_debug("unrecognized message signature (%x != %x)",
649 buf.nlh.magic, htonl(UDEV_MONITOR_MAGIC));
650 udev_device_unref(udev_device);
653 if (buf.nlh.properties_off+32 > (size_t)buflen) {
654 udev_device_unref(udev_device);
658 bufpos = buf.nlh.properties_off;
660 /* devices received from udev are always initialized */
661 udev_device_set_is_initialized(udev_device);
663 /* kernel message with header */
664 bufpos = strlen(buf.raw) + 1;
665 if ((size_t)bufpos < sizeof("a@/d") || bufpos >= buflen) {
666 log_debug("invalid message length");
667 udev_device_unref(udev_device);
671 /* check message header */
672 if (strstr(buf.raw, "@/") == NULL) {
673 log_debug("unrecognized message header");
674 udev_device_unref(udev_device);
679 udev_device_set_info_loaded(udev_device);
681 while (bufpos < buflen) {
685 key = &buf.raw[bufpos];
686 keylen = strlen(key);
689 bufpos += keylen + 1;
690 udev_device_add_property_from_string_parse(udev_device, key);
693 if (udev_device_add_property_from_string_parse_finish(udev_device) < 0) {
694 log_debug("missing values, invalid device");
695 udev_device_unref(udev_device);
699 /* skip device, if it does not pass the current filter */
700 if (!passes_filter(udev_monitor, udev_device)) {
701 struct pollfd pfd[1];
704 udev_device_unref(udev_device);
706 /* if something is queued, get next device */
707 pfd[0].fd = udev_monitor->sock;
708 pfd[0].events = POLLIN;
709 rc = poll(pfd, 1, 0);
718 int udev_monitor_send_device(struct udev_monitor *udev_monitor,
719 struct udev_monitor *destination, struct udev_device *udev_device)
727 struct udev_monitor_netlink_header nlh;
728 struct udev_list_entry *list_entry;
729 uint64_t tag_bloom_bits;
731 blen = udev_device_get_properties_monitor_buf(udev_device, &buf);
735 /* add versioned header */
736 memzero(&nlh, sizeof(struct udev_monitor_netlink_header));
737 memcpy(nlh.prefix, "libudev", 8);
738 nlh.magic = htonl(UDEV_MONITOR_MAGIC);
739 nlh.header_size = sizeof(struct udev_monitor_netlink_header);
740 val = udev_device_get_subsystem(udev_device);
741 nlh.filter_subsystem_hash = htonl(util_string_hash32(val));
742 val = udev_device_get_devtype(udev_device);
744 nlh.filter_devtype_hash = htonl(util_string_hash32(val));
745 iov[0].iov_base = &nlh;
746 iov[0].iov_len = sizeof(struct udev_monitor_netlink_header);
748 /* add tag bloom filter */
750 udev_list_entry_foreach(list_entry, udev_device_get_tags_list_entry(udev_device))
751 tag_bloom_bits |= util_string_bloom64(udev_list_entry_get_name(list_entry));
752 if (tag_bloom_bits > 0) {
753 nlh.filter_tag_bloom_hi = htonl(tag_bloom_bits >> 32);
754 nlh.filter_tag_bloom_lo = htonl(tag_bloom_bits & 0xffffffff);
757 /* add properties list */
758 nlh.properties_off = iov[0].iov_len;
759 nlh.properties_len = blen;
760 iov[1].iov_base = (char *)buf;
761 iov[1].iov_len = blen;
763 memzero(&smsg, sizeof(struct msghdr));
767 * Use custom address for target, or the default one.
769 * If we send to a multicast group, we will get
770 * ECONNREFUSED, which is expected.
772 if (destination != NULL)
773 smsg.msg_name = &destination->snl;
775 smsg.msg_name = &udev_monitor->snl_destination;
776 smsg.msg_namelen = sizeof(struct sockaddr_nl);
777 count = sendmsg(udev_monitor->sock, &smsg, 0);
778 log_debug("passed %zi bytes to netlink monitor %p", count, udev_monitor);
783 * udev_monitor_filter_add_match_subsystem_devtype:
784 * @udev_monitor: the monitor
785 * @subsystem: the subsystem value to match the incoming devices against
786 * @devtype: the devtype value to match the incoming devices against
788 * This filter is efficiently executed inside the kernel, and libudev subscribers
789 * will usually not be woken up for devices which do not match.
791 * The filter must be installed before the monitor is switched to listening mode.
793 * Returns: 0 on success, otherwise a negative error value.
795 _public_ int udev_monitor_filter_add_match_subsystem_devtype(struct udev_monitor *udev_monitor, const char *subsystem, const char *devtype)
797 if (udev_monitor == NULL)
799 if (subsystem == NULL)
801 if (udev_list_entry_add(&udev_monitor->filter_subsystem_list, subsystem, devtype) == NULL)
807 * udev_monitor_filter_add_match_tag:
808 * @udev_monitor: the monitor
809 * @tag: the name of a tag
811 * This filter is efficiently executed inside the kernel, and libudev subscribers
812 * will usually not be woken up for devices which do not match.
814 * The filter must be installed before the monitor is switched to listening mode.
816 * Returns: 0 on success, otherwise a negative error value.
818 _public_ int udev_monitor_filter_add_match_tag(struct udev_monitor *udev_monitor, const char *tag)
820 if (udev_monitor == NULL)
824 if (udev_list_entry_add(&udev_monitor->filter_tag_list, tag, NULL) == NULL)
830 * udev_monitor_filter_remove:
831 * @udev_monitor: monitor
833 * Remove all filters from monitor.
835 * Returns: 0 on success, otherwise a negative error value.
837 _public_ int udev_monitor_filter_remove(struct udev_monitor *udev_monitor)
839 static struct sock_fprog filter = { 0, NULL };
841 udev_list_cleanup(&udev_monitor->filter_subsystem_list);
842 return setsockopt(udev_monitor->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter));