BPFire Lunatik LuaXDP TLS/SSL Server Name Lua parsing to Block Website

Опубликовано: 18 Март 2025
на канале: BPFire

Now most of websites are encrypted with TLS/SSL, if you want to stop user from accessing some unwanted domain or website without decrypting the user request, you can lookup the server name in TLS clienthello which is not encrypted and stop user from access the website based on the server name.

eBPF XDP program can be used to parse the clienthello server name SNI extension, but it is difficult to workaround eBPF verifier because of dynamic nature and variation of clienthello packet. Lunatik LuaXDP provided alternative solution which is to move the parsing to Lua scripting without visible XDP performance suffering. Here is demo on how LuaXDP and Lua script to achieve that.