We Put an L7 Firewall in the Kernel

Application-layer firewall decisions at XDP, before a socket buffer exists. We built a firewall that decides on HTTP/2 headers in the kernel with eBPF and lets you write the policy as a JavaScript app. The decision lands in the nanoseconds, changing a rule takes no rebuild or restart, and it's already running in front of real enterprise traffic. Here's how it works.