alt Hacker News>> The macOS version uses deep packet inspection to do this more reliably. That's not an option here.
I thought it would be easier to do DPI on Linux than macOS. No???
Replies
amonith • today at 7:55 AM
Yeah I thought that was one of the primary use cases of eBPF. Not an expert though, just read about some of these things.
eBPF is very limited in the code complexity you can achieve. DPI on QUIC, for example, needs a lot of cryptography. That's simply not possible in eBPF. DPI on ordinary TLS still requires that you collect enough network packets to get the name, hold them back until you have a decision and then re-inject them. Holding back packets is not even possible at the layer where we intercept. And even if we find a layer to do this, it adds enough complexity that we no longer pass the verifier.