Index | Thread | Search

From:
Florian Obser <florian@openbsd.org>
Subject:
Re: bpf filtering on arbitrary sockets
To:
Damien Miller <djm@mindrot.org>
Cc:
tech@openbsd.org
Date:
Thu, 30 Oct 2025 09:03:11 +0100

Download raw body.

Thread
On 2025-10-30 16:03 +11, Damien Miller <djm@mindrot.org> wrote:
> What do you think? What would be a good daemon to try this against?
> I was thinking dhcpleased but that seems to use bpf for most of its
> sending, though that should IMO be converted to AF_FRAME now that we
> have it.

dhcpleased(8) cannot work with AF_FRAME because:

     frame protocol family sockets are designed as an alternative to bpf(4)
     for handling low data and packet rate communication protocols.  Rather
     than filtering every frame entering the system before the network stack,
     like bpf(4), processing of the frame protocol family runs after the built
     in protocol handlers in the kernel, thus avoiding the overhead.  For this
     reason, it is not possible to handle IPv4 or IPv6 packets with frame
     protocol sockets because the kernel network stack consumes them before
     the receive handling for frame sockets is run.

dhcp packets are IPv4/UDP.


-- 
In my defence, I have been left unsupervised.