/dev/net/ed1 8-).

Open it and ioctl to get an fd for inbound or outbound (you want fd's so that _exit() will fix it when your daemon crashes).

I think you want to be able to implement firewalling at this level, so you would need to be able to attach both inbound and outbound control segments.

Using fd's would also allow you to use select() to do everything in one daemon.

The use of a special /dev/net (if we drag devfs into it 8-)) would let you iterate all devices, and set a select for exceptional conditions for /dev/net itself. Then when you hot-plug a PCMCIA card in, and a device is created, you could install your filtering.

You could also bring the interface online and offline automatically based on the select for exceptional /dev/net events... not that you would even open /dev/ed1 for that. ;-).

You'd probably want a seperate ioctl for the /dev/net/ed1 to start the break and filter through user space; for a configured device, that would mean that you don't lose packets between opening the fd's via the ioctl() and the point where you are set up enough to be able to process them.

Installing BPF would be as simple as running a bpf daemon -- which would create a device /dev/net/bpf using a "device tunnel" (open any device in /dev or /dev iteself and ioctl() to create a subdevice which is a tunnel with your process on the "master" end) and hook itself into the service pipeline.

Or you could load the thing as an LKM using the kernel version of the interface (I think you could fix the domain crossing and scheduling problems using locked code segments and RT scheduling classes, respectively... ioctl down the address of the processing function in the process address space (assume PIC code) and the kernel could call it directly, provided the pages were in core and there was no global state. There's really no reason why process context is needed to access code pages if they are dual-mapped).

Anything loaded this way would, like a better PTY driver, be a cloning device, so you wouldn't have to preconfigure resource limits.