Faster firewalls with bpfilter | LWN

｢ proposed bpfilter as a way to transparently increase iptables performance by translating the filtering rules into BPF programs directly in the kernel ... sort of. Bpfilter was implemented as a user-mode helper, a user-space process started from the kernel, which allows for user-space tools to be used for development and prevents the translation logic from crashing the kernel ｣

https://lwn.net/Articles/1017705/

bpflogd(8) imported into -current https://www.undeadly.org/cgi?action=article;sid=20250507113848 #openbsd #bpflogd #networking #bpf #pcap #packetcapture #packetlogging #devops #development #current #freesoftware #libresoftware

Introducing bpflogd(8): capture packets via BPF to log files https://www.undeadly.org/cgi?action=article;sid=20250425074505 #openbsd #bpflogd #bpf #networking #logging #development #sysadmin #devops #security #platformengineering

FRAME sockets added to OpenBSD https://www.undeadly.org/cgi?action=article;sid=20241219080430 #openbsd #networking #frame #ethernet #lldp #bpf #development #freesoftware #libresoftware

RFC 9669: BPF Instruction Set Architecture (ISA)

On a souvent envie de faire tourner des programmes à soi dans le noyau du système d'exploitation, par exemple à des fins de déboguage ou d'observation du système. Cela soulève plein de problèmes et la technique #eBPF permet, depuis de nombreuses années, de le faire avec moins de risques. Ce #RFC spécifie le jeu d'instructions eBPF.

https://www.bortzmeyer.org/9669.html

"'We show that eBPF is Turing complete, which means it can be used for any computable problem'

[…]

Implementing Game of Life entirely in #eBPF means that it is Turing complete, so any computable problem that can be solved in any programming language, can also be solved in eBPF. Those complex problems that people thought were beyond the capabilities of eBPF, like parsing application-level protocols, or terminating TLS connections, are now shown to be possible. […]"

https://isovalent.com/blog/post/ebpf-for-anything/ #BPF

Check out this TUI by Netflix for real-time eBPF monitoring!

**bpftop**: Provides a dynamic real-time view of running eBPF programs.

Shows average runtime, events per second, and estimated total CPU with stats!

Written in Rust & built with @ratatui_rs

GitHub: https://github.com/Netflix/bpftop