[systemd-devel] Filter/Parse NETLINK_KOBJECT_UEVENT Messages

[Lennart Poettering]

On Di, 14.09.21 01:08, Ryan McClue (re.mcclue at protonmail.com) wrote:

> I understand this is slightly off-topic, but I'm completely new to
> BPF. Analyzing libudev source and Internet I understand the general
> idea. However, I don't understand how information/what information
> is passed to the filter from the socket. For example, in my case the
> socket payload, i.e. buf_str =
> add@/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2.4/1-2.4:1.0/input/input38/event14

> 1. How do I pass this string to the sock_filter/sock_fprog
> structures?

You don't. The bpf filtering, and in particular the bloom filter that
is used for that is mostly internal to udev, and not something that is
consider official API and should be reimplemented.

Use sd-device/libudev, it implements all of this, and is the only official API
to the bpf bloom filter stuff udev does there.

Lennart

--
Lennart Poettering, Berlin