NFD

The presence of an ifupdown script that restarts NFD is orthogonal to this issue. NFD should not crash, period.

If I remember correctly, some time ago we decided that--in case of network connectivity changes--an external entity would send a HUP signal to NFD, which in turn would reload its config file and reinitialize the affected channels and multicast faces. This implies that NFD must survive the "interface down" event, otherwise using SIGHUP is pointless.

Junxiao Shi wrote:

EthernetFace::handleRead also throws exceptions when captured frame is too short or has incorrect Ethertype.
These exceptions are acceptable, because libpcap should never return such unexpected frames.

Are you sure that libpcap never returns short frames? For robustness we should call fail (or ignore the captured frame and continue) in such cases as well.

Are you sure that libpcap never returns short frames? For robustness we should call fail (or ignore the captured frame and continue) in such cases as well.

libpcap is expected not to return anything that does not match the bpf_program.
This is part of the contract, and it's unnecessary to double check.

Junxiao Shi wrote:

libpcap is expected not to return anything that does not match the bpf_program.

There is nothing in the BPF filter about too-short frames (so called runt frames). They should be discarded simply because they violate IEEE 802.3

This is part of the contract, and it's unnecessary to double check.

Assuming that you're talking about the ethertype, the check is already there. What I'm saying is that we should just ignore the packet or call fail, instead of throwing an exception and dying. Are you arguing that we should remove the check altogether?

We should look at libpcap documentation to understand whether it should discard runt frames.
If yes, ASSERT that runt frames are not coming to our code.
If no, check for runt frames and ignore them.

Since bpf_program guarantees correct Ethertype, we can ASSERT Ethertype is correct.
In production builds, this check is effectively disabled because it's unnecessary.