Filtering with BPF-based Maps

In this lesson, you will learn how to maintain high-performance network filtering by using long-lived BPF maps to store and update your criteria in real-time without restarting your programs.

The Problem with Static Rules

Traditionally, if you wanted to update a firewall rule (like blocking an IP address), you might need to reload a configuration file or restart a service. In high-traffic environments, this causes latency spikes or dropped packets. By using BPF Maps, we move the filtering data out of the program logic and into a persistent memory area that resides in the kernel.

How BPF Maps Work for Filtering

Think of a BPF map as a key-value store shared between your user-space control plane and the kernel’s packet-processing engine.

1. The Kernel-Side: Your BPF program (running at an XDP or TC hook) performs a constant, lightning-fast lookup in the map for every incoming packet header.
2. The User-Side: A management script or agent keeps the map populated. When you need to block a new IP, your script simply executes an update operation on the map.

Because the BPF program only reads from the map, it never needs to be recompiled or reloaded. The updated rule takes effect for the very next packet that hits the interface.

Example Logic

In your BPF C code, the lookup looks like this:

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, __u32);   // IPv4 Address
    __type(value, __u8);  // Action: 0 for allow, 1 for block
    __uint(max_entries, 10000);
} filter_map SEC(".maps");

// Inside the packet processing function:
__u32 *ip = // extract source IP from packet;
__u8 *action = bpf_map_lookup_elem(&filter_map, ip);

if (action && *action == 1) {
    return XDP_DROP; // Filtered in real-time
}

By decoupling the "ruleset" (the map) from the "logic" (the BPF bytecode), you achieve a dynamic firewall that scales to thousands of entries while maintaining near-line-rate performance. You can add, remove, or modify entries via standard system calls at any time, ensuring your network infrastructure remains agile under load.

Key Takeaway: Storing filter criteria in BPF maps enables sub-millisecond rule updates without interrupting packet processing, providing a high-performance alternative to traditional reloading-based firewalls.