--- a/src/arp.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/arp.c	Tue May 19 16:09:35 2020 +0000
@@ -222,7 +222,8 @@
 }
 
 void
-arp_packet(struct interface *ifp, uint8_t *data, size_t len, uint8_t bpf_flags)
+arp_packet(struct interface *ifp, uint8_t *data, size_t len,
+    unsigned int bpf_flags)
 {
 	size_t fl = bpf_frame_header_len(ifp), falen;
 	const struct interface *ifn;

--- a/src/arp.h	Tue May 19 16:43:50 2020 +0100
+++ b/src/arp.h	Tue May 19 16:09:35 2020 +0000
@@ -92,7 +92,7 @@
 	((const struct iarp_state *)(ifp)->if_data[IF_DATA_ARP])
 
 #ifdef ARP
-void arp_packet(struct interface *, uint8_t *, size_t, uint8_t);
+void arp_packet(struct interface *, uint8_t *, size_t, unsigned int);
 struct arp_state *arp_new(struct interface *, const struct in_addr *);
 void arp_probe(struct arp_state *);
 void arp_announce(struct arp_state *);

--- a/src/bpf.h	Tue May 19 16:43:50 2020 +0100
+++ b/src/bpf.h	Tue May 19 16:09:35 2020 +0000
@@ -29,9 +29,9 @@
 #ifndef BPF_HEADER
 #define BPF_HEADER
 
-#define	BPF_EOF			0x01
-#define	BPF_PARTIALCSUM		0x02
-#define	BPF_BCAST		0x04
+#define	BPF_EOF			0x01U
+#define	BPF_PARTIALCSUM		0x02U
+#define	BPF_BCAST		0x04U
 
 /*
  * Even though we program the BPF filter should we trust it?
@@ -57,7 +57,7 @@
 struct bpf {
 	const struct interface *bpf_ifp;
 	int bpf_fd;
-	uint8_t bpf_flags;
+	unsigned int bpf_flags;
 	void *bpf_buffer;
 	size_t bpf_size;
 	size_t bpf_len;

--- a/src/dhcp.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/dhcp.c	Tue May 19 16:09:35 2020 +0000
@@ -1676,7 +1676,7 @@
 	struct udphdr udp = {
 	    .uh_sport = htons(BOOTPC),
 	    .uh_dport = htons(BOOTPS),
-	    .uh_ulen = htons(sizeof(udp) + len),
+	    .uh_ulen = htons((uint16_t)(sizeof(udp) + len)),
 	};
 	struct iovec iov[] = {
 	    { .iov_base = &udp, .iov_len = sizeof(udp), },
@@ -3462,7 +3462,8 @@
 }
 
 void
-dhcp_packet(struct interface *ifp, uint8_t *data, size_t len, uint8_t bpf_flags)
+dhcp_packet(struct interface *ifp, uint8_t *data, size_t len,
+    unsigned int bpf_flags)
 {
 	struct bootp *bootp;
 	struct in_addr from;

--- a/src/dhcp.h	Tue May 19 16:43:50 2020 +0100
+++ b/src/dhcp.h	Tue May 19 16:09:35 2020 +0000
@@ -256,7 +256,7 @@
 ssize_t print_rfc3442(FILE *, const uint8_t *, size_t);
 
 int dhcp_openudp(struct in_addr *);
-void dhcp_packet(struct interface *, uint8_t *, size_t, uint8_t);
+void dhcp_packet(struct interface *, uint8_t *, size_t, unsigned int);
 void dhcp_recvmsg(struct dhcpcd_ctx *, struct msghdr *);
 void dhcp_printoptions(const struct dhcpcd_ctx *,
     const struct dhcp_opt *, size_t);

--- a/src/dhcp6.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/dhcp6.c	Tue May 19 16:09:35 2020 +0000
@@ -1214,7 +1214,7 @@
 	struct udphdr udp = {
 	    .uh_sport = htons(DHCP6_CLIENT_PORT),
 	    .uh_dport = htons(DHCP6_SERVER_PORT),
-	    .uh_ulen = htons(sizeof(udp) + state->send_len),
+	    .uh_ulen = htons((uint16_t)(sizeof(udp) + state->send_len)),
 	};
 	struct iovec iov[] = {
 	    { .iov_base = &udp, .iov_len = sizeof(udp), },

--- a/src/if-linux.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/if-linux.c	Tue May 19 16:09:35 2020 +0000
@@ -1587,11 +1587,12 @@
 const char *bpf_name = "Packet Socket";
 
 /* Linux is a special snowflake for opening BPF. */
-int
-bpf_open(struct interface *ifp, int (*filter)(struct interface *, int))
+struct bpf *
+bpf_open(const struct interface *ifp,
+    int (*filter)(const struct bpf *, const struct in_addr *),
+    const struct in_addr *ia)
 {
-	struct ipv4_state *state;
-	int s;
+	struct bpf *bpf;
 	union sockunion {
 		struct sockaddr sa;
 		struct sockaddr_ll sll;
@@ -1605,38 +1606,34 @@
 	int n;
 #endif
 
-	/* Allocate a suitably large buffer for a single packet. */
-	state = ipv4_getstate(ifp);
-	if (state == NULL)
-		return -1;
-	if (state->buffer_size < ETH_DATA_LEN) {
-		void *nb;
+	bpf = calloc(1, sizeof(*bpf));
+	if (bpf == NULL)
+		return NULL;
+	bpf->bpf_ifp = ifp;
 
-		if ((nb = realloc(state->buffer, ETH_DATA_LEN)) == NULL)
-			return -1;
-		state->buffer = nb;
-		state->buffer_size = ETH_DATA_LEN;
-		state->buffer_len = state->buffer_pos = 0;
-	}
+	/* Allocate a suitably large buffer for a single packet. */
+	bpf->bpf_size = ETH_DATA_LEN;
+	bpf->bpf_buffer = malloc(bpf->bpf_size);
+	if (bpf->bpf_buffer == NULL)
+		goto eexit;
 
-
-#define SF	SOCK_CLOEXEC | SOCK_NONBLOCK
-	if ((s = xsocket(PF_PACKET, SOCK_RAW | SF, htons(ETH_P_ALL))) == -1)
-		return -1;
-#undef SF
+	bpf->bpf_fd = xsocket(PF_PACKET, SOCK_RAW|SOCK_CXNB,htons(ETH_P_ALL));
+	if (bpf->bpf_fd == -1)
+		goto eexit;
 
 	/* We cannot validate the correct interface,
 	 * so we MUST set this first. */
-	if (bind(s, &su.sa, sizeof(su.sll)) == -1)
+	if (bind(bpf->bpf_fd, &su.sa, sizeof(su.sll)) == -1)
 		goto eexit;
 
-	if (filter(ifp, s) != 0)
+	if (filter(bpf, ia) != 0)
 		goto eexit;
 
 	/* In the ideal world, this would be set before the bind and filter. */
 #ifdef PACKET_AUXDATA
 	n = 1;
-	if (setsockopt(s, SOL_PACKET, PACKET_AUXDATA, &n, sizeof(n)) != 0) {
+	if (setsockopt(bpf->bpf_fd, SOL_PACKET, PACKET_AUXDATA,
+	    &n, sizeof(n)) != 0) {
 		if (errno != ENOPROTOOPT)
 			goto eexit;
 	}
@@ -1651,25 +1648,25 @@
 	 * Or to put it another way, don't trust the Linux BPF filter.
 	*/
 
-	return s;
+	return bpf;
 
 eexit:
-	close(s);
-	return -1;
+	if (bpf->bpf_fd != -1)
+		close(bpf->bpf_fd);
+	free(bpf->bpf_buffer);
+	free(bpf);
+	return NULL;
 }
 
 /* BPF requires that we read the entire buffer.
  * So we pass the buffer in the API so we can loop on >1 packet. */
 ssize_t
-bpf_read(struct interface *ifp, int s, void *data, size_t len,
-    unsigned int *flags)
+bpf_read(struct bpf *bpf, void *data, size_t len)
 {
 	ssize_t bytes;
-	struct ipv4_state *state = IPV4_STATE(ifp);
-
 	struct iovec iov = {
-		.iov_base = state->buffer,
-		.iov_len = state->buffer_size
+		.iov_base = bpf->bpf_buffer,
+		.iov_len = bpf->bpf_size,
 	};
 	struct msghdr msg = { .msg_iov = &iov, .msg_iovlen = 1 };
 #ifdef PACKET_AUXDATA
@@ -1686,19 +1683,19 @@
 	msg.msg_controllen = sizeof(cmsgbuf.buf);
 #endif
 
-	bytes = recvmsg(s, &msg, 0);
+	bytes = recvmsg(bpf->bpf_fd, &msg, 0);
 	if (bytes == -1)
 		return -1;
-	*flags |= BPF_EOF; /* We only ever read one packet. */
-	*flags &= ~BPF_PARTIALCSUM;
+	bpf->bpf_flags |= BPF_EOF; /* We only ever read one packet. */
+	bpf->bpf_flags &= ~BPF_PARTIALCSUM;
 	if (bytes) {
-		if (bpf_frame_bcast(ifp, state->buffer) == 0)
-			*flags |= BPF_BCAST;
+		if (bpf_frame_bcast(bpf->bpf_ifp, bpf->bpf_buffer) == 0)
+			bpf->bpf_flags |= BPF_BCAST;
 		else
-			*flags &= ~BPF_BCAST;
+			bpf->bpf_flags &= ~BPF_BCAST;
 		if ((size_t)bytes > len)
 			bytes = (ssize_t)len;
-		memcpy(data, state->buffer, (size_t)bytes);
+		memcpy(data, bpf->bpf_buffer, (size_t)bytes);
 #ifdef PACKET_AUXDATA
 		for (cmsg = CMSG_FIRSTHDR(&msg);
 		     cmsg;
@@ -1708,7 +1705,7 @@
 			    cmsg->cmsg_type == PACKET_AUXDATA) {
 				aux = (void *)CMSG_DATA(cmsg);
 				if (aux->tp_status & TP_STATUS_CSUMNOTREADY)
-					*flags |= BPF_PARTIALCSUM;
+					bpf->bpf_flags |= BPF_PARTIALCSUM;
 			}
 		}
 #endif

--- a/src/privsep-bpf.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/privsep-bpf.c	Tue May 19 16:09:35 2020 +0000
@@ -269,8 +269,9 @@
 {
 	struct iovec *iov = msg->msg_iov;
 	struct interface *ifp;
-	uint8_t bpf_flags, *bpf;
+	uint8_t *bpf;
 	size_t bpf_len;
+	unsigned int bpf_flags;
 
 	ifp = if_findindex(ctx->ifaces, psm->ps_id.psi_ifindex);
 	bpf = iov->iov_base;

--- a/src/privsep.c	Tue May 19 16:43:50 2020 +0100
+++ b/src/privsep.c	Tue May 19 16:09:35 2020 +0000
@@ -470,7 +470,7 @@
 
 	if (msg != NULL) {
 		struct iovec *iovp = &iov[1];
-		size_t i;
+		int i;
 
 		psm->ps_namelen = msg->msg_namelen;
 		psm->ps_controllen = (socklen_t)msg->msg_controllen;
@@ -482,8 +482,8 @@
 		iovp->iov_len = msg->msg_controllen;
 		iovlen = 3;
 
-		for (i = 0; i < (size_t)msg->msg_iovlen; i++) {
-			if ((size_t)iovlen + i > __arraycount(iov)) {
+		for (i = 0; i < (int)msg->msg_iovlen; i++) {
+			if ((size_t)(iovlen + i) > __arraycount(iov)) {
 				errno =	ENOBUFS;
 				return -1;
 			}