4 ms·

BPF comes to firewalls

• rurban 9y ago
  So should we now forget to disable eBPF jit in our kernel's because it is insecure (spectre attacks)? And eBPF was made even more insecure, with even more superpowers. They added tables! Not in dtrace just eBPF, because linux has so much more superpowers. Time to switch over to a proper kernel, where such things do not happen.
  • progval 9y ago
    BPF != eBPF
    • xtf 9y ago
      Where is the difference between BSD pf and Linux BPF implementation? eBPF aside
    • raesene9 9y ago
      Do you have a reference expanding on that? I was just reading up on BPF/eBPF the other day (https://lwn.net/Articles/740157/ https://lwn.net/Articles/740157/) and (https://qmonnet.github.io/whirl-offload/2016/09/01/dive-into-bpf/ https://qmonnet.github.io/whirl-offload/2016/09/01/dive-into...). From both of those I gathered that, with reference to Linux, BPF == eBPF, with the older implementation (cBPF) being deprecated. So as the linked article is about Linux, I thought that in this case BPF == eBPF
    • rurban 9y ago
      And? Nobody is talking about BPF, only you. And lwn is confused about this, not me.
• okket 9y ago
  Previous discussion from 2 months ago: https://news.ycombinator.com/item?id=16419039 https://news.ycombinator.com/item?id=16419039 (43 comments)
• aisio 9y ago
  Some interesting metrics on bpfilter, especially when combined with smart network card offloading https://www.netronome.com/blog/bpf-ebpf-xdp-and-bpfilter-what-are-these-things-and-what-do-they-mean-enterprise/ https://www.netronome.com/blog/bpf-ebpf-xdp-and-bpfilter-wha...