Re: any interest in JIT for bpf and npf_ncode?

[Darren Reed <darrenr%netbsd.org@localhost>]

Alexander Nasonov wrote:
> ...
> Code is available on github: https://github.com/alnsn/bpfjit
>
> Is there is interest, I can look into porting sljit to the kernel and
> adding npf_ncode.
>   

This is probably quite important for NPF as it moves NPF away from using 
the byte
code method. This is important for anyone thinking of hardware devices 
using NPF
as NPF seems dangerously close to what Checkpoint patented for 
Firewall-1 back
in 1995.

It is for the above reason that I've never considered using BPF 
instructions in IPFilter
rules as something more than experimental:

# To enable rules to be written with BPF syntax, uncomment these two lines.
#
# WARNING: If you're building a commercial product based on IPFilter, using
#          this options *may* infringe at least one patent held by 
CheckPoint
#          (5,606,668.)
#
#IPFBPF=-DIPFILTER_BPF -I/usr/local/include
#LIBBPF=-L/usr/local/lib -lpcap

... more than the above I cannot speculate on as I've not researched it 
any further.

Darren