23 days ago
- The firewall uses eBPF in the kernel to make HTTP/2 header decisions in nanoseconds, avoiding userspace proxy delays.
- Policy is written as JavaScript apps, allowing updates via git push without rebuilds, redeploys, or restarts.
- Matches on HTTP/2 headers like :authority, User-Agent, and source address using boolean logic rules.
- Uses XDP hook for early packet filtering, dropping packets before kernel socket allocation for minimal cost.