Re: Order of ipf, ipnat and bpf

[Lloyd Parkes <lloyd%must-have-coffee.gen.nz@localhost>]

On 27/05/22 23:36, Edgar Fuß wrote:
> > Find the driver you are using, and start reading the receive processing.
> So the order may be different for bge from the one in wm?

I'm pretty sure that all this is handled in the common network stack and 
not in the driver. I'm also pretty sure that BPF happens _very_ early in 
the stack.

The last time I looked at the code was before NPF existed...

So I looked at the code and it's all very different now.

BPF is done even earlier than it used to be IIRC. The packet is tapped 
off just before it is passed up to the common network stack via 
ifp->_if_input().

It seems to me that NPF/IPF are done later via a call to 
pfil_run_hooks(), which all makes sense.

Cheers,
Lloyd