Reimplementing pf as an eBPF/XDP dataplane on Linux
8 hours ago
- #eBPF
- #Firewall
- #XDP
- PFL is an experimental project aiming to translate pf's firewall language and stateful semantics to Linux's XDP (eXpress Data Path) for efficient packet processing.
- Built on FreeBSD's pfSense legacy, PFL uses Rust for the control plane (pfld) and eBPF dataplane, leveraging XDP's driver-level execution for high packet rates.
- Key architectural features include a tail-call graph pipeline to comply with eBPF verifier constraints, LRU hash maps for connection state, and per-CPU counters.
- PFL achieves significant pf feature parity including filtering, NAT (v4/v6), NAT64, normalization, policy routing, and DoS resistance with SYN cookies.
- Limitations include no full fragment reassembly (due to XDP model) and preliminary performance results (better median latency but higher tail latency and CPU use vs nftables in VM tests).
- Future work includes bare-metal evaluation on Arm appliances, egress fast-path optimization, high availability via pflsync, and protocol depth improvements.
- PFL distinguishes itself by maintaining fidelity to pf language while operating in-kernel with XDP, leaving the host interface usable, unlike userspace alternatives like VPP.