Why is the kernel community replacing iptables with BPF? | Hacker News Reader

Why is the kernel community replacing iptables with BPF?

cilium.io

54 pointslunchbreak10 comments

An interesting introduction to how Linux currently does packet filtering and how changing to BPF will improve performance.

The really amusing thing to me (an OpenBSD user) was the omission of any discussion of the origin of BPF, or even spelling out the acronym (it's the Berkeley Packet Filter).

Those GPL guys really really hate acknowledging anything to do with Berkeley! :) Even though in this case it's not directly the University of California, Berkeley but instead the origin of BPF is the Lawrence Berkeley Laboratory.

Why are we down voting this post? Is there a real inaccuracy in it somewhere?

Because the author took an omission from a technical post and used it to extrapolate the behavior of thousands of people.

> The really amusing thing to me (an OpenBSD user) was the omission of any discussion of the origin of BPF, or even spelling out the acronym (it's the Berkeley Packet Filter).

I had noticed that. Does it mean it's BSD-licensed? If so, can it be easily integrated with the Linux kernel?

What is there to acknowledge or discuss? Ancient BSD history doesn't seem particularly relevant to modern-day Linux, and not just in the context of BPF. E.g. no one refers to "sockets" as Berkeley Sockets any more. AFAIK, the networking code in the Linux kernel was written from scratch and there is no shared lineage with any BSD code.

I posted this on a similar current HN thread about BPF, but also relevant here. See Poettering's blog for how you can do very cool access control things via systemd taking advantage of EBPF:

http://0pointer.net/blog/ip-accounting-and-access-lists-with...

So what about the elephant in the room, nftables? Are they basically dead in the water now?

yep.

I'm guessing this is because of the relatively low performance compared to BFP?

I'd hope not, and that the nftables (nft) language can be implemented in top of this new infra. It is much easier to use and audit than iptables.

EDIT: me, parent and grandparent should've read the article. There's already two projects underway to make userspace nft work with bpfilter as a backend. Sweet!

Reply on news.ycombinator.com