High speed TLS based filtering able to run entirely in an eBPF filter.
- Linux 6.12.43+
- libpbf and libxdp
Instead of taking the full JA4 hash to fingerprint traffic which is slow to calculate and is hard to implement in a BPF filter, I take a Jenkins hash of the sorted supported ciphers in any given TLS request. To similar effect as JA4, keeping fingerprinting usefulness. Switching to a non-cryptographic hashing algorithm is okay here because any given attacker with enough skill could replicate the ciphers of another client, so any hash reversing would be useless or at best force the attacker to implement a different amount of hashes.
Generate a config file
./generate-config block-curl.fconf blacklist signatures/curl-8.15.0-arch.bin
Load the filter on to a network device
sudo ./fox-filter block-curl.fconf wlan0 fox.bpf