{"record":{"id":"45078a652bfbf010","repo":"tailscale/tailscale","slug":"installing-bpf-filter-w","errorCode":null,"errorMessage":"installing BPF filter: %w","messagePattern":"installing BPF filter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wgengine/magicsock/magicsock_linux.go","lineNumber":227,"sourceCode":"\tasm, err := bpf.Assemble(prog)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"assembling filter: %w\", err)\n\t}\n\n\tsock, err := socket.Socket(\n\t\tunix.AF_PACKET,\n\t\tunix.SOCK_DGRAM,\n\t\tproto,\n\t\t\"afpacket\",\n\t\tnil, // no config\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating AF_PACKET socket: %w\", err)\n\t}\n\n\tif err := sock.SetBPF(asm); err != nil {\n\t\tsock.Close()\n\t\treturn nil, fmt.Errorf(\"installing BPF filter: %w\", err)\n\t}\n\n\t// If all the above succeeds, we should be ready to receive. Just\n\t// out of paranoia, check that we do receive a well-formed disco\n\t// packet.\n\ttc, err := net.ListenPacket(udpnet, net.JoinHostPort(addr, \"0\"))\n\tif err != nil {\n\t\tsock.Close()\n\t\treturn nil, fmt.Errorf(\"creating disco test socket: %w\", err)\n\t}\n\tdefer tc.Close()\n\tif _, err := tc.(*net.UDPConn).WriteToUDPAddrPort(testDiscoPacket, testAddr); err != nil {\n\t\tsock.Close()\n\t\treturn nil, fmt.Errorf(\"writing disco test packet: %w\", err)\n\t}\n\n\tconst selfTestTimeout = 100 * time.Millisecond\n\tif err := sock.SetReadDeadline(time.Now().Add(selfTestTimeout)); err != nil {","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/wgengine/magicsock/magicsock_linux.go#L209-L245","documentation":"The AF_PACKET socket was created but setsockopt(SO_ATTACH_FILTER) failed when attaching the assembled BPF program. Indicates kernel-level rejection of the filter, often due to seccomp/LSM restrictions or an unexpected socket state.","triggerScenarios":"Thrown at wgengine/magicsock/magicsock_linux.go:227 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check kernel logs for BPF attach failures (e.g. locked-memory limits for classic BPF)","Relax seccomp/LSM policies that block SO_ATTACH_FILTER","Fall back to non-raw disco listening"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}