3 ms·
The OP states that BPF is replacing nftables as if it was a foregone conclusion, but it's not at all certain - it's still far from happening.
by catern 8y ago
The OP states that BPF is replacing nftables as if it was a foregone conclusion, but it's not at all certain - it's still far from happening.
- hardwaresofton 8y agoIt was actually the lwn post (which is basically a summary of the mailing list) that made me think that nftables was doomed. https://lwn.net/Articles/747551/ https://lwn.net/Articles/747551/ seems that BPF is taking the nftables API, which seemed to be the core value-add (reimagined iptables API), and actually delivering on the performance benefits as well. I hold people that work on the kernel in pretty high regard, and I expect them to be pragmatic about it (the whole "strong opinions loosely held" thing), and if BPF doesn't introduce too many possible security vulnerabilities (that's about the only issue with it I can see), it might represent the best of both worlds -- new api + improved performance.