netdev - Re: [PATCH RFC 0/4] net: add bpfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Feb 2018 12:22:26 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     phil@....cc
Cc:     laforge@...monks.org, fw@...len.de, daniel@...earbox.net,
        netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        alexei.starovoitov@...il.com
Subject: Re: [PATCH RFC 0/4] net: add bpfilter

From: Phil Sutter <phil@....cc>
Date: Mon, 19 Feb 2018 18:14:11 +0100

> OK, so reading between the lines you're saying that nftables project
> has failed to provide an adequate successor to iptables?

Whilst it is great that the atomic table update problem was solved, I
think the emphasis on flexibility often at the expense of performance
was a bad move.

Netfilter's chronic performance differential is why a lot of mindshare
was lost to userspace networking technologies.

Thankfully, we are gaining back a lot of that userbase with XDP and
eBPF, thanks to the hard work of many individuals.

To think that people are going to be willing to take the performance
hit (whatever it's size) to go back to the "more flexible" nftables
is really not a realistic expectation.

And we have amassed enough interest and momentum that offloading eBPF
in hardware on current and future hardware is happening.

So I am going to direct us in directions that allow those realities to
be taken advantage of, rather than pretending that this transition
hasn't occurred already.

Thank you.