[PATCH] netlink: decode libudev netlink header

[Harsha Sharma]

On Wed, Jan 3, 2018 at 6:33 PM, Harsha Sharma
<harshasharmaiitr at gmail.com> wrote:
> * netlink.c: decode family NETLINK_KOBJECT_UEVENT if prefix is libudev
> * linux/netlink_kobject_uevent.h: New struct (udev_monitor_netlink_header)
>

With this patch,
strace -e%network udevadm monitor -u > /dev/null

recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=282,
nl_groups=0x000002}, msg_namelen=128->12,
msg_iov=[{iov_base={prefix=libudev, magic=4274712062, header_size=40,
properties_off=40, properties_len=299, filter_subsystem_hash=45314243,
filter_devtype_hash=0, filter_tag_bloom_hi=262146,
filter_tag_bloom_lo=32784}, iov_len=8192}], msg_iovlen=1,
msg_control=[{cmsg_len=28, cmsg_level=SOL_SOCKET,
cmsg_type=SCM_CREDENTIALS, cmsg_data={pid=32712, uid=0, gid=0}}],
msg_controllen=32, msg_flags=0}, 0) = 339


> Signed-off-by: Harsha Sharma <harshasharmaiitr at gmail.com>
> ---
>  linux/netlink_kobject_uevent.h | 16 ++++++++++++++++
>  netlink.c                      | 27 ++++++++++++++++++++++++++-
>  2 files changed, 42 insertions(+), 1 deletion(-)
>  create mode 100644 linux/netlink_kobject_uevent.h
>
> diff --git a/linux/netlink_kobject_uevent.h b/linux/netlink_kobject_uevent.h
> new file mode 100644
> index 00000000..d83ccad5
> --- /dev/null
> +++ b/linux/netlink_kobject_uevent.h
> @@ -0,0 +1,16 @@
> +#ifndef STRACE_LINUX_NETLINK_KOBJECT_UEVENT_H
> +#define STRACE_LINUX_NETLINK_KOBJECT_UEVENT_H
> +
> +struct udev_monitor_netlink_header {
> +       char prefix[8];
> +       unsigned int magic;
> +       unsigned int header_size;
> +       unsigned int properties_off;
> +       unsigned int properties_len;
> +       unsigned int filter_subsystem_hash;
> +       unsigned int filter_devtype_hash;
> +       unsigned int filter_tag_bloom_hi;
> +       unsigned int filter_tag_bloom_lo;
> +};
> +
> +#endif /* !STRACE_LINUX_NETLINK_KOBJECT_UEVENT_H */
> diff --git a/netlink.c b/netlink.c
> index 6b9a1f5c..e991ed86 100644
> --- a/netlink.c
> +++ b/netlink.c
> @@ -32,6 +32,7 @@
>  #include "nlattr.h"
>  #include <linux/audit.h>
>  #include <linux/rtnetlink.h>
> +#include <linux/netlink_kobject_uevent.h>
>  #include <linux/xfrm.h>
>  #include "xlat/netlink_ack_flags.h"
>  #include "xlat/netlink_delete_flags.h"
> @@ -183,6 +184,29 @@ decode_nlmsg_type_netfilter(const struct xlat *const xlat,
>                 tprintf("%#x", msg_type);
>  }
>
> +static bool
> +decode_nlmsg_type_kobject_uevent(struct tcb *tcp, kernel_ulong_t addr,
> +                                kernel_ulong_t len,
> +                                const void *const opaque_data)
> +{
> +       struct udev_monitor_netlink_header uh;
> +       const char *prefix = "libudev";
> +
> +       if (len < sizeof(uh))
> +               return false;
> +       if (!umove_or_printaddr(tcp, addr, &uh) &&
> +           strcmp(uh.prefix, prefix) == 0) {
> +               tprintf("{prefix=%s, magic=%u, header_size=%u, properties_off=%u, properties_len=%u, filter_subsystem_hash=%u, filter_devtype_hash=%u, filter_tag_bloom_hi=%u, filter_tag_bloom_lo=%u}", uh.prefix,
> +                   uh.magic, uh.header_size, uh.properties_off,
> +                   uh.properties_len, uh.filter_subsystem_hash,
> +                   uh.filter_devtype_hash, uh.filter_tag_bloom_hi,
> +                   uh.filter_tag_bloom_lo);
> +               return true;
> +       }
> +       return false;
> +}
> +
> +
>  typedef void (*nlmsg_types_decoder_t)(const struct xlat *,
>                                       uint16_t type,
>                                       const char *dflt);
> @@ -628,7 +652,8 @@ decode_netlink(struct tcb *const tcp,
>         const int family = get_fd_nl_family(tcp, fd);
>
>         if (family == NETLINK_KOBJECT_UEVENT) {
> -               printstrn(tcp, addr, len);
> +               if (!decode_nlmsg_type_kobject_uevent(tcp, addr, len, NULL))
> +                       printstrn(tcp, addr, len);
>                 return;
>         }
>
> --
> 2.11.0
>