2 This file is part of systemd.
4 Copyright 2008-2012 Kay Sievers <kay@vrfy.org>
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
29 #include <sys/socket.h>
31 #include <arpa/inet.h>
32 #include <linux/netlink.h>
33 #include <linux/filter.h>
36 #include "libudev-private.h"
37 #include "socket-util.h"
41 * SECTION:libudev-monitor
42 * @short_description: device event source
44 * Connects to a device event source.
50 * Opaque object handling an event source.
56 union sockaddr_union snl;
57 union sockaddr_union snl_trusted_sender;
58 union sockaddr_union snl_destination;
60 struct udev_list filter_subsystem_list;
61 struct udev_list filter_tag_list;
65 enum udev_monitor_netlink_group {
71 #define UDEV_MONITOR_MAGIC 0xfeedcafe
72 struct udev_monitor_netlink_header {
73 /* "libudev" prefix to distinguish libudev and kernel messages */
76 * magic to protect against daemon <-> library message format mismatch
77 * used in the kernel from socket filter rules; needs to be stored in network order
80 /* total length of header structure known to the sender */
81 unsigned int header_size;
82 /* properties string buffer */
83 unsigned int properties_off;
84 unsigned int properties_len;
86 * hashes of primary device properties strings, to let libudev subscribers
87 * use in-kernel socket filters; values need to be stored in network order
89 unsigned int filter_subsystem_hash;
90 unsigned int filter_devtype_hash;
91 unsigned int filter_tag_bloom_hi;
92 unsigned int filter_tag_bloom_lo;
95 static struct udev_monitor *udev_monitor_new(struct udev *udev)
97 struct udev_monitor *udev_monitor;
99 udev_monitor = new0(struct udev_monitor, 1);
100 if (udev_monitor == NULL)
102 udev_monitor->refcount = 1;
103 udev_monitor->udev = udev;
104 udev_list_init(udev, &udev_monitor->filter_subsystem_list, false);
105 udev_list_init(udev, &udev_monitor->filter_tag_list, true);
109 /* we consider udev running when /dev is on devtmpfs */
110 static bool udev_has_devtmpfs(struct udev *udev) {
112 union file_handle_union h = {
113 .handle.handle_bytes = MAX_HANDLE_SZ
116 _cleanup_fclose_ FILE *f = NULL;
117 char line[LINE_MAX], *e;
121 r = name_to_handle_at(AT_FDCWD, "/dev", &h.handle, &mount_id, 0);
123 if (errno != EOPNOTSUPP)
124 log_debug_errno(errno, "name_to_handle_at on /dev: %m");
128 f = fopen("/proc/self/mountinfo", "re");
132 FOREACH_LINE(line, f, return false) {
135 if (sscanf(line, "%i", &mid) != 1)
141 e = strstr(line, " - ");
145 /* accept any name that starts with the currently expected type */
146 if (startswith(e + 3, "devtmpfs"))
153 struct udev_monitor *udev_monitor_new_from_netlink_fd(struct udev *udev, const char *name, int fd)
155 struct udev_monitor *udev_monitor;
162 group = UDEV_MONITOR_NONE;
163 else if (streq(name, "udev")) {
165 * We do not support subscribing to uevents if no instance of
166 * udev is running. Uevents would otherwise broadcast the
167 * processing data of the host into containers, which is not
170 * Containers will currently not get any udev uevents, until
171 * a supporting infrastructure is available.
173 * We do not set a netlink multicast group here, so the socket
174 * will not receive any messages.
176 if (access("/run/udev/control", F_OK) < 0 && !udev_has_devtmpfs(udev)) {
177 log_debug("the udev service seems not to be active, disable the monitor");
178 group = UDEV_MONITOR_NONE;
180 group = UDEV_MONITOR_UDEV;
181 } else if (streq(name, "kernel"))
182 group = UDEV_MONITOR_KERNEL;
186 udev_monitor = udev_monitor_new(udev);
187 if (udev_monitor == NULL)
191 udev_monitor->sock = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_KOBJECT_UEVENT);
192 if (udev_monitor->sock == -1) {
193 log_debug_errno(errno, "error getting socket: %m");
198 udev_monitor->bound = true;
199 udev_monitor->sock = fd;
202 udev_monitor->snl.nl.nl_family = AF_NETLINK;
203 udev_monitor->snl.nl.nl_groups = group;
205 /* default destination for sending */
206 udev_monitor->snl_destination.nl.nl_family = AF_NETLINK;
207 udev_monitor->snl_destination.nl.nl_groups = UDEV_MONITOR_UDEV;
213 * udev_monitor_new_from_netlink:
214 * @udev: udev library context
215 * @name: name of event source
217 * Create new udev monitor and connect to a specified event
218 * source. Valid sources identifiers are "udev" and "kernel".
220 * Applications should usually not connect directly to the
221 * "kernel" events, because the devices might not be useable
222 * at that time, before udev has configured them, and created
223 * device nodes. Accessing devices at the same time as udev,
224 * might result in unpredictable behavior. The "udev" events
225 * are sent out after udev has finished its event processing,
226 * all rules have been processed, and needed device nodes are
229 * The initial refcount is 1, and needs to be decremented to
230 * release the resources of the udev monitor.
232 * Returns: a new udev monitor, or #NULL, in case of an error
234 _public_ struct udev_monitor *udev_monitor_new_from_netlink(struct udev *udev, const char *name)
236 return udev_monitor_new_from_netlink_fd(udev, name, -1);
239 static inline void bpf_stmt(struct sock_filter *inss, unsigned int *i,
240 unsigned short code, unsigned int data)
242 struct sock_filter *ins = &inss[*i];
249 static inline void bpf_jmp(struct sock_filter *inss, unsigned int *i,
250 unsigned short code, unsigned int data,
251 unsigned short jt, unsigned short jf)
253 struct sock_filter *ins = &inss[*i];
263 * udev_monitor_filter_update:
264 * @udev_monitor: monitor
266 * Update the installed socket filter. This is only needed,
267 * if the filter was removed or changed.
269 * Returns: 0 on success, otherwise a negative error value.
271 _public_ int udev_monitor_filter_update(struct udev_monitor *udev_monitor)
273 struct sock_filter ins[512];
274 struct sock_fprog filter;
276 struct udev_list_entry *list_entry;
279 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) == NULL &&
280 udev_list_get_entry(&udev_monitor->filter_tag_list) == NULL)
283 memzero(ins, sizeof(ins));
286 /* load magic in A */
287 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, magic));
288 /* jump if magic matches */
289 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, UDEV_MONITOR_MAGIC, 1, 0);
290 /* wrong magic, pass packet */
291 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
293 if (udev_list_get_entry(&udev_monitor->filter_tag_list) != NULL) {
296 /* count tag matches, to calculate end of tag match block */
298 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list))
301 /* add all tags matches */
302 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list)) {
303 uint64_t tag_bloom_bits = util_string_bloom64(udev_list_entry_get_name(list_entry));
304 uint32_t tag_bloom_hi = tag_bloom_bits >> 32;
305 uint32_t tag_bloom_lo = tag_bloom_bits & 0xffffffff;
307 /* load device bloom bits in A */
308 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_tag_bloom_hi));
309 /* clear bits (tag bits & bloom bits) */
310 bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_hi);
311 /* jump to next tag if it does not match */
312 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_hi, 0, 3);
314 /* load device bloom bits in A */
315 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_tag_bloom_lo));
316 /* clear bits (tag bits & bloom bits) */
317 bpf_stmt(ins, &i, BPF_ALU|BPF_AND|BPF_K, tag_bloom_lo);
318 /* jump behind end of tag match block if tag matches */
320 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, tag_bloom_lo, 1 + (tag_matches * 6), 0);
323 /* nothing matched, drop packet */
324 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
327 /* add all subsystem matches */
328 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) != NULL) {
329 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_subsystem_list)) {
330 unsigned int hash = util_string_hash32(udev_list_entry_get_name(list_entry));
332 /* load device subsystem value in A */
333 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_subsystem_hash));
334 if (udev_list_entry_get_value(list_entry) == NULL) {
335 /* jump if subsystem does not match */
336 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
338 /* jump if subsystem does not match */
339 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 3);
341 /* load device devtype value in A */
342 bpf_stmt(ins, &i, BPF_LD|BPF_W|BPF_ABS, offsetof(struct udev_monitor_netlink_header, filter_devtype_hash));
343 /* jump if value does not match */
344 hash = util_string_hash32(udev_list_entry_get_value(list_entry));
345 bpf_jmp(ins, &i, BPF_JMP|BPF_JEQ|BPF_K, hash, 0, 1);
348 /* matched, pass packet */
349 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
351 if (i+1 >= ELEMENTSOF(ins))
355 /* nothing matched, drop packet */
356 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0);
359 /* matched, pass packet */
360 bpf_stmt(ins, &i, BPF_RET|BPF_K, 0xffffffff);
363 memzero(&filter, sizeof(filter));
366 err = setsockopt(udev_monitor->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter));
367 return err < 0 ? -errno : 0;
370 int udev_monitor_allow_unicast_sender(struct udev_monitor *udev_monitor, struct udev_monitor *sender)
372 udev_monitor->snl_trusted_sender.nl.nl_pid = sender->snl.nl.nl_pid;
376 * udev_monitor_enable_receiving:
377 * @udev_monitor: the monitor which should receive events
379 * Binds the @udev_monitor socket to the event source.
381 * Returns: 0 on success, otherwise a negative error value.
383 _public_ int udev_monitor_enable_receiving(struct udev_monitor *udev_monitor)
388 udev_monitor_filter_update(udev_monitor);
390 if (!udev_monitor->bound) {
391 err = bind(udev_monitor->sock,
392 &udev_monitor->snl.sa, sizeof(struct sockaddr_nl));
394 udev_monitor->bound = true;
398 union sockaddr_union snl;
402 * get the address the kernel has assigned us
403 * it is usually, but not necessarily the pid
405 addrlen = sizeof(struct sockaddr_nl);
406 err = getsockname(udev_monitor->sock, &snl.sa, &addrlen);
408 udev_monitor->snl.nl.nl_pid = snl.nl.nl_pid;
410 log_debug_errno(errno, "bind failed: %m");
414 /* enable receiving of sender credentials */
415 err = setsockopt(udev_monitor->sock, SOL_SOCKET, SO_PASSCRED, &on, sizeof(on));
417 log_debug_errno(errno, "setting SO_PASSCRED failed: %m");
423 * udev_monitor_set_receive_buffer_size:
424 * @udev_monitor: the monitor which should receive events
425 * @size: the size in bytes
427 * Set the size of the kernel socket buffer. This call needs the
428 * appropriate privileges to succeed.
430 * Returns: 0 on success, otherwise -1 on error.
432 _public_ int udev_monitor_set_receive_buffer_size(struct udev_monitor *udev_monitor, int size)
434 if (udev_monitor == NULL)
436 return setsockopt(udev_monitor->sock, SOL_SOCKET, SO_RCVBUFFORCE, &size, sizeof(size));
439 int udev_monitor_disconnect(struct udev_monitor *udev_monitor)
443 err = close(udev_monitor->sock);
444 udev_monitor->sock = -1;
445 return err < 0 ? -errno : 0;
450 * @udev_monitor: udev monitor
452 * Take a reference of a udev monitor.
454 * Returns: the passed udev monitor
456 _public_ struct udev_monitor *udev_monitor_ref(struct udev_monitor *udev_monitor)
458 if (udev_monitor == NULL)
460 udev_monitor->refcount++;
465 * udev_monitor_unref:
466 * @udev_monitor: udev monitor
468 * Drop a reference of a udev monitor. If the refcount reaches zero,
469 * the bound socket will be closed, and the resources of the monitor
474 _public_ struct udev_monitor *udev_monitor_unref(struct udev_monitor *udev_monitor)
476 if (udev_monitor == NULL)
478 udev_monitor->refcount--;
479 if (udev_monitor->refcount > 0)
481 if (udev_monitor->sock >= 0)
482 close(udev_monitor->sock);
483 udev_list_cleanup(&udev_monitor->filter_subsystem_list);
484 udev_list_cleanup(&udev_monitor->filter_tag_list);
490 * udev_monitor_get_udev:
491 * @udev_monitor: udev monitor
493 * Retrieve the udev library context the monitor was created with.
495 * Returns: the udev library context
497 _public_ struct udev *udev_monitor_get_udev(struct udev_monitor *udev_monitor)
499 if (udev_monitor == NULL)
501 return udev_monitor->udev;
505 * udev_monitor_get_fd:
506 * @udev_monitor: udev monitor
508 * Retrieve the socket file descriptor associated with the monitor.
510 * Returns: the socket file descriptor
512 _public_ int udev_monitor_get_fd(struct udev_monitor *udev_monitor)
514 if (udev_monitor == NULL)
516 return udev_monitor->sock;
519 static int passes_filter(struct udev_monitor *udev_monitor, struct udev_device *udev_device)
521 struct udev_list_entry *list_entry;
523 if (udev_list_get_entry(&udev_monitor->filter_subsystem_list) == NULL)
525 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_subsystem_list)) {
526 const char *subsys = udev_list_entry_get_name(list_entry);
527 const char *dsubsys = udev_device_get_subsystem(udev_device);
529 const char *ddevtype;
531 if (!streq(dsubsys, subsys))
534 devtype = udev_list_entry_get_value(list_entry);
537 ddevtype = udev_device_get_devtype(udev_device);
538 if (ddevtype == NULL)
540 if (streq(ddevtype, devtype))
546 if (udev_list_get_entry(&udev_monitor->filter_tag_list) == NULL)
548 udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_monitor->filter_tag_list)) {
549 const char *tag = udev_list_entry_get_name(list_entry);
551 if (udev_device_has_tag(udev_device, tag))
558 * udev_monitor_receive_device:
559 * @udev_monitor: udev monitor
561 * Receive data from the udev monitor socket, allocate a new udev
562 * device, fill in the received data, and return the device.
564 * Only socket connections with uid=0 are accepted.
566 * The monitor socket is by default set to NONBLOCK. A variant of poll() on
567 * the file descriptor returned by udev_monitor_get_fd() should to be used to
568 * wake up when new devices arrive, or alternatively the file descriptor
569 * switched into blocking mode.
571 * The initial refcount is 1, and needs to be decremented to
572 * release the resources of the udev device.
574 * Returns: a new udev device, or #NULL, in case of an error
576 _public_ struct udev_device *udev_monitor_receive_device(struct udev_monitor *udev_monitor)
578 struct udev_device *udev_device;
581 char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
582 struct cmsghdr *cmsg;
583 union sockaddr_union snl;
590 if (udev_monitor == NULL)
593 iov.iov_len = sizeof(buf);
594 memzero(&smsg, sizeof(struct msghdr));
597 smsg.msg_control = cred_msg;
598 smsg.msg_controllen = sizeof(cred_msg);
599 smsg.msg_name = &snl;
600 smsg.msg_namelen = sizeof(snl);
602 buflen = recvmsg(udev_monitor->sock, &smsg, 0);
605 log_debug("unable to receive message");
609 if (buflen < 32 || (size_t)buflen >= sizeof(buf)) {
610 log_debug("invalid message length");
614 if (snl.nl.nl_groups == 0) {
615 /* unicast message, check if we trust the sender */
616 if (udev_monitor->snl_trusted_sender.nl.nl_pid == 0 ||
617 snl.nl.nl_pid != udev_monitor->snl_trusted_sender.nl.nl_pid) {
618 log_debug("unicast netlink message ignored");
621 } else if (snl.nl.nl_groups == UDEV_MONITOR_KERNEL) {
622 if (snl.nl.nl_pid > 0) {
623 log_debug("multicast kernel netlink message from pid %d ignored",
629 cmsg = CMSG_FIRSTHDR(&smsg);
630 if (cmsg == NULL || cmsg->cmsg_type != SCM_CREDENTIALS) {
631 log_debug("no sender credentials received, message ignored");
635 cred = (struct ucred *)CMSG_DATA(cmsg);
636 if (cred->uid != 0) {
637 log_debug("sender uid=%d, message ignored", cred->uid);
641 udev_device = udev_device_new(udev_monitor->udev);
642 if (udev_device == NULL)
645 if (memcmp(buf, "libudev", 8) == 0) {
646 struct udev_monitor_netlink_header *nlh;
648 /* udev message needs proper version magic */
649 nlh = (struct udev_monitor_netlink_header *) buf;
650 if (nlh->magic != htonl(UDEV_MONITOR_MAGIC)) {
651 log_debug("unrecognized message signature (%x != %x)",
652 nlh->magic, htonl(UDEV_MONITOR_MAGIC));
653 udev_device_unref(udev_device);
656 if (nlh->properties_off+32 > (size_t)buflen) {
657 udev_device_unref(udev_device);
661 bufpos = nlh->properties_off;
663 /* devices received from udev are always initialized */
664 udev_device_set_is_initialized(udev_device);
666 /* kernel message with header */
667 bufpos = strlen(buf) + 1;
668 if ((size_t)bufpos < sizeof("a@/d") || bufpos >= buflen) {
669 log_debug("invalid message length");
670 udev_device_unref(udev_device);
674 /* check message header */
675 if (strstr(buf, "@/") == NULL) {
676 log_debug("unrecognized message header");
677 udev_device_unref(udev_device);
682 udev_device_set_info_loaded(udev_device);
684 while (bufpos < buflen) {
689 keylen = strlen(key);
692 bufpos += keylen + 1;
693 udev_device_add_property_from_string_parse(udev_device, key);
696 if (udev_device_add_property_from_string_parse_finish(udev_device) < 0) {
697 log_debug("missing values, invalid device");
698 udev_device_unref(udev_device);
702 /* skip device, if it does not pass the current filter */
703 if (!passes_filter(udev_monitor, udev_device)) {
704 struct pollfd pfd[1];
707 udev_device_unref(udev_device);
709 /* if something is queued, get next device */
710 pfd[0].fd = udev_monitor->sock;
711 pfd[0].events = POLLIN;
712 rc = poll(pfd, 1, 0);
721 int udev_monitor_send_device(struct udev_monitor *udev_monitor,
722 struct udev_monitor *destination, struct udev_device *udev_device)
730 struct udev_monitor_netlink_header nlh;
731 struct udev_list_entry *list_entry;
732 uint64_t tag_bloom_bits;
734 blen = udev_device_get_properties_monitor_buf(udev_device, &buf);
738 /* add versioned header */
739 memzero(&nlh, sizeof(struct udev_monitor_netlink_header));
740 memcpy(nlh.prefix, "libudev", 8);
741 nlh.magic = htonl(UDEV_MONITOR_MAGIC);
742 nlh.header_size = sizeof(struct udev_monitor_netlink_header);
743 val = udev_device_get_subsystem(udev_device);
744 nlh.filter_subsystem_hash = htonl(util_string_hash32(val));
745 val = udev_device_get_devtype(udev_device);
747 nlh.filter_devtype_hash = htonl(util_string_hash32(val));
748 iov[0].iov_base = &nlh;
749 iov[0].iov_len = sizeof(struct udev_monitor_netlink_header);
751 /* add tag bloom filter */
753 udev_list_entry_foreach(list_entry, udev_device_get_tags_list_entry(udev_device))
754 tag_bloom_bits |= util_string_bloom64(udev_list_entry_get_name(list_entry));
755 if (tag_bloom_bits > 0) {
756 nlh.filter_tag_bloom_hi = htonl(tag_bloom_bits >> 32);
757 nlh.filter_tag_bloom_lo = htonl(tag_bloom_bits & 0xffffffff);
760 /* add properties list */
761 nlh.properties_off = iov[0].iov_len;
762 nlh.properties_len = blen;
763 iov[1].iov_base = (char *)buf;
764 iov[1].iov_len = blen;
766 memzero(&smsg, sizeof(struct msghdr));
770 * Use custom address for target, or the default one.
772 * If we send to a multicast group, we will get
773 * ECONNREFUSED, which is expected.
775 if (destination != NULL)
776 smsg.msg_name = &destination->snl;
778 smsg.msg_name = &udev_monitor->snl_destination;
779 smsg.msg_namelen = sizeof(struct sockaddr_nl);
780 count = sendmsg(udev_monitor->sock, &smsg, 0);
781 log_debug("passed %zi bytes to netlink monitor %p", count, udev_monitor);
786 * udev_monitor_filter_add_match_subsystem_devtype:
787 * @udev_monitor: the monitor
788 * @subsystem: the subsystem value to match the incoming devices against
789 * @devtype: the devtype value to match the incoming devices against
791 * This filter is efficiently executed inside the kernel, and libudev subscribers
792 * will usually not be woken up for devices which do not match.
794 * The filter must be installed before the monitor is switched to listening mode.
796 * Returns: 0 on success, otherwise a negative error value.
798 _public_ int udev_monitor_filter_add_match_subsystem_devtype(struct udev_monitor *udev_monitor, const char *subsystem, const char *devtype)
800 if (udev_monitor == NULL)
802 if (subsystem == NULL)
804 if (udev_list_entry_add(&udev_monitor->filter_subsystem_list, subsystem, devtype) == NULL)
810 * udev_monitor_filter_add_match_tag:
811 * @udev_monitor: the monitor
812 * @tag: the name of a tag
814 * This filter is efficiently executed inside the kernel, and libudev subscribers
815 * will usually not be woken up for devices which do not match.
817 * The filter must be installed before the monitor is switched to listening mode.
819 * Returns: 0 on success, otherwise a negative error value.
821 _public_ int udev_monitor_filter_add_match_tag(struct udev_monitor *udev_monitor, const char *tag)
823 if (udev_monitor == NULL)
827 if (udev_list_entry_add(&udev_monitor->filter_tag_list, tag, NULL) == NULL)
833 * udev_monitor_filter_remove:
834 * @udev_monitor: monitor
836 * Remove all filters from monitor.
838 * Returns: 0 on success, otherwise a negative error value.
840 _public_ int udev_monitor_filter_remove(struct udev_monitor *udev_monitor)
842 static struct sock_fprog filter = { 0, NULL };
844 udev_list_cleanup(&udev_monitor->filter_subsystem_list);
845 return setsockopt(udev_monitor->sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter));