13 ms·
Why is the kernel community replacing iptables with BPF?
- qalmakka 8y agoSo what about the elephant in the room, nftables? Are they basically dead in the water now?
- jaimex2 8y agoyep.
- deleted 8y ago[deleted]
- craftyguy 8y agoI'm guessing this is because of the relatively low performance compared to BFP?
- aktau 8y agoI'd hope not, and that the nftables (nft) language can be implemented in top of this new infra. It is much easier to use and audit than iptables. EDIT: me, parent and grandparent should've read the article. There's already two projects underway to make userspace nft work with bpfilter as a backend. Sweet!
- PhantomGremlin 8y agoAn interesting introduction to how Linux currently does packet filtering and how changing to BPF will improve performance. The really amusing thing to me (an OpenBSD user) was the omission of any discussion of the origin of BPF, or even spelling out the acronym (it's the Berkeley Packet Filter). Those GPL guys really really hate acknowledging anything to do with Berkeley! :) Even though in this case it's not directly the University of California, Berkeley but instead the origin of BPF is the Lawrence Berkeley Laboratory.
- sunstone 8y agoWhy are we down voting this post? Is there a real inaccuracy in it somewhere?
- fred_is_fred 8y agoBecause the author took an omission from a technical post and used it to extrapolate the behavior of thousands of people.
- mariuolo 8y ago> The really amusing thing to me (an OpenBSD user) was the omission of any discussion of the origin of BPF, or even spelling out the acronym (it's the Berkeley Packet Filter). I had noticed that. Does it mean it's BSD-licensed? If so, can it be easily integrated with the Linux kernel?
- sigjuice 8y agoWhat is there to acknowledge or discuss? Ancient BSD history doesn't seem particularly relevant to modern-day Linux, and not just in the context of BPF. E.g. no one refers to "sockets" as Berkeley Sockets any more. AFAIK, the networking code in the Linux kernel was written from scratch and there is no shared lineage with any BSD code.
- indigodaddy 8y agoI posted this on a similar current HN thread about BPF, but also relevant here. See Poettering's blog for how you can do very cool access control things via systemd taking advantage of EBPF: http://0pointer.net/blog/ip-accounting-and-access-lists-with-systemd.html http://0pointer.net/blog/ip-accounting-and-access-lists-with...