11 ms·
BPF is actually a tiny virtual machine (!) language designed to run securely in a kernel. This is very different from iptables, where everything has to be expr
by lobster_johnson 11y ago
BPF is actually a tiny virtual machine (!) language designed to run securely in a kernel.
This is very different from iptables, where everything has to be expressed as a rule ("policy") with a set of fixed parameters that match a packet. iptables has a way to jump around in the rule set ("chains"), but it's not quite Turing-complete.
In Linux, BPF has been generalized (as eBPF, "extended BPF") to work not just with networking, but the kernel as a whole, though I'm not sure how extensive the set of available tracepoints is at the moment.
- dsd2222 11y agoNormal BPF already worked with seccomp as well, which is outside of networking. But yes, eBPF is a major advancement, i.e. you can program eBPF code in a C language subset and compile it with LLVM. There's quite some possibilities already used in tracing and networking (here: tc classifier and actions and socket filters).