bpfilter: a BPF-based packet filtering framework
summary
A userspace daemon plus tiny lib on GitHub receives iptables-legacy ipt_replace structs or netlink NFtables messages and generates BPF bytecode into one program per interface/hook, using BPF netfilter hooks (Linux 6.4+), dynamic pointers and per-rule maps for per-rule counters. A prototype links via a -BPF flag to iptables and a netlink pass-through for nftables; it currently regenerates the whole program on change, hits verifier jump-offset limits as rules scale, and shows growing performance wins versus classic iptables as rule counts increase. userspace daemon
AI-written summary · about
chapters (12)
- 0:00Introduction to bpfilter
- 2:09BPfilter architecture overview
- 5:59BPF program generation process
- 10:12Code generation internals
- 13:00BPF program output and usage
- 15:53Performance comparison with iptables
- 17:41Q&A session part 1
- 21:08Q&A session part 2
- 23:35Q&A session part 3
- 27:30Legacy kernel module cleanup
- 28:55Optimization and rule expressivity
- 31:26Future directions and API
related talks
32meBPF: BPF kernel infrastructure
31meBPF 101
21mPerformance Wins with BPF: Getting Started
16mWhy Everyone Should Care About eBPF
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
42mCommunity Driven Breakout Session: eBPF and Auto-Instrumentation
50mIntroduction to eBPF
36meBPF for Runtime Security