tailscale/tailscale · error

installing BPF filter: %w

Error message

installing BPF filter: %w

What it means

The AF_PACKET socket was created but setsockopt(SO_ATTACH_FILTER) failed when attaching the assembled BPF program. Indicates kernel-level rejection of the filter, often due to seccomp/LSM restrictions or an unexpected socket state.

Source

Thrown at wgengine/magicsock/magicsock_linux.go:227

	asm, err := bpf.Assemble(prog)
	if err != nil {
		return nil, fmt.Errorf("assembling filter: %w", err)
	}

	sock, err := socket.Socket(
		unix.AF_PACKET,
		unix.SOCK_DGRAM,
		proto,
		"afpacket",
		nil, // no config
	)
	if err != nil {
		return nil, fmt.Errorf("creating AF_PACKET socket: %w", err)
	}

	if err := sock.SetBPF(asm); err != nil {
		sock.Close()
		return nil, fmt.Errorf("installing BPF filter: %w", err)
	}

	// If all the above succeeds, we should be ready to receive. Just
	// out of paranoia, check that we do receive a well-formed disco
	// packet.
	tc, err := net.ListenPacket(udpnet, net.JoinHostPort(addr, "0"))
	if err != nil {
		sock.Close()
		return nil, fmt.Errorf("creating disco test socket: %w", err)
	}
	defer tc.Close()
	if _, err := tc.(*net.UDPConn).WriteToUDPAddrPort(testDiscoPacket, testAddr); err != nil {
		sock.Close()
		return nil, fmt.Errorf("writing disco test packet: %w", err)
	}

	const selfTestTimeout = 100 * time.Millisecond
	if err := sock.SetReadDeadline(time.Now().Add(selfTestTimeout)); err != nil {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Check kernel logs for BPF attach failures (e.g. locked-memory limits for classic BPF)
2. Relax seccomp/LSM policies that block SO_ATTACH_FILTER
3. Fall back to non-raw disco listening

When it happens

Trigger: Thrown at wgengine/magicsock/magicsock_linux.go:227 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/45078a652bfbf010. Report an issue: GitHub.