bpf writes on tun device

[Matthew Luckie]

Hi

I would like to use the BPF device to write packets on a tun device, 
which is bpf type DLT_NULL.  I'm aware that the man page (for 4.X and 
5.X) says that BPF writes are only supported on Ethernet and SLIP links. 
  I did notice, though, that the tunoutput function in sys/net/if_tun.c 
has some BPF code, and the cvs log says that write support was added 
back in revision 1.10 of the if_tun.c code 9 odd years ago.

	/* BPF write needs to be handled specially */
	if (dst->sa_family == AF_UNSPEC) {
		dst->sa_family = *(mtod(m0, int *));
		m0->m_len -= sizeof(int);
		m0->m_pkthdr.len -= sizeof(int);
		m0->m_data += sizeof(int);
	}

it expects the BPF writer to supply an integer defining the address 
family of the packet embedded in the packet we wish to write.

I can successfully write BPF packets up to 1500 bytes in size (1496 IP 
bytes without the address family integer).  Writes larger than this 
return EMSGSIZE.

I presume this is because of the following code in bpfwrite:

	if (datlen > ifp->if_mtu) {
		m_freem(m);
		return (EMSGSIZE);
	}

although I haven't figured out how I manage to write 1514 bytes to an 
ethernet (1500 IP bytes + 14 for the ethernet header).

I've got my code at http://www.wand.net.nz/~mjl12/bpf_null_tx.c which 
forms an ICMP echo request packet.

This is on a FreeBSD 4.10 machine.

I have two questions:

1.  Should I be able to send IP MTU sized packets on tun devices, on any 
FreeBSD releases?

2.  How come the bpf check against the interface MTU succeeds for 
ethernet writes of 1514, despite if->if_mtu seemingly being set to 1500 
in if_ethersubr.c?

Thanks

Matthew