BPFILTER Landing For Linux 4.18 For Eventually Better Firewall / Packet Filtering
The new BPFILTER capability is a BPF-based packet filtering framework. In its stage for Linux 4.18 this framework is deemed experimental but is striving to provide a Netfilter-compatible implementation by making use of BPF (the Berkeley Packet Filter). Yep, BPF continues getting more powerful.
Along with the BPFILTER framework itself is also an embedded user-mode helper for loading of modules from user-space.
With Linux 4.18 this is the initial framework while ultimately the goal is to replace the existing firewall and packet filtering implementations with this BPF-powered solution. Among the benefits expected for BPFILTER once ready and mature are greater security, easier maintenance, and potential performance improvements via JIT and hardware offloading.
The code is in net-next waiting for the Linux 4.18 merge window that may open this weekend if the Linux 4.17.0 stable release goes out as hoped for on Sunday.
The BPFILTER framework is in addition to many other Linux 4.18 features coming and making us looking forward to June.
7 Comments
