Currently, matcher codegen is hardcoded in a flavor-agnostic switch. With this refactor, each flavor controls its own matcher codegen through a callback, allowing a new flavor to intercept matchers and generate context-appropriate bytecode. The callback generalizes the ad-hoc and callbacks. Instead of having dedicated callbacks for each flavor-sensitive value, every flavor controls its full matcher codegen through a single dispatch point. Packet-based flavors delegate most matchers to a shared function (the extracted switch), overriding only the matchers that need flavor-specific context access. Here is an overview of the architectural changes: Current Architecture bf\_flavor\_ops (7 callbacks): Problem: There is no simple mechanism for a flavor to provide alternative bytecode for the same matcher type. The only two flavor-aware matchers ( and ) use ad-hoc callbacks rather than a general dispatch mechanism. New Architecture (After) bf\_flavor\_ops (6 callbacks):** Notes: Commit a65aca1 adds a missing load instruction that is moved as part of this PR. While this enables flavor-specific matching in a more intuitive way, an even better approach would be a callback-centric approach that let's flavors define their own table of callbacks per matcher. The plan is to add this eventually.
Drop the iptables and nftables translation layers, unused since bfcli became the sole interface to libbpfilter. Remove xlate/ipt/, xlate/nft/, the xlate/front dispatch layer, public API (bf_ipt_, bf_nft_, bf_front_*), BF_FRONT_IPT/BF_FRONT_NFT enum values, libnl3 build dependency, --no-iptables/--no-nftables CLI options, unused external kernel headers, and associated tests, docs, and benchmarks. Promote xlate/cli.c to xlate.c as the sole request handler.
Repository: facebook/bpfilter. Description: eBPF-based packet filtering framework Stars: 313, Forks: 51. Primary language: C. Languages: C (69.2%), Shell (10.2%), Befunge (4.3%), C++ (4.2%), Python (3.3%). License: GPL-2.0. Homepage: https://bpfilter.io/ Open PRs: 3, open issues: 24. Last activity: 2h ago. Top contributors: qdeslandes, pzmarzly, yaakov-stein, SkohTV, ryanbsull, rphibel, AliGhaffarian, vinxcls, daandemeyer, JonSnow1807 and others.
Last 12 weeks · 111 commits
When updating a chain, bpfilter will discard the previous packet counters and create new ones. We should be able to restore the counters to their previous values. We will have to match rules from the old chain to the new one. Design is required.
Latest Claude is broken: https://github.com/anthropics/claude-code-action/issues/1013 I'll monitor that thread and remove the pin once it's fixed. NOTE: With pull_request_target, workflow definition is taken from target branch, not source, so this PR will have red signal. Demo: https://github.com/pzmarzly/demo--claude-bot-reviews/actions/runs/22709516659/job/65843898737?pr=8