Session

Secure Web Gateways protect outbound HTTPS traffic, but their deep packet inspection intercepts TLS by terminating each connection through a CA installed on every client, an approach that the commodity hardware of Wi-Fi access points typically cannot sustain. This paper presents a kernel- userspace datapath pipeline that filters L7 traffic by inspect- ing DNS queries, HTTP requests, and TLS handshake meta- data rather than intercepting the connection. Both halves run in Lua: a userspace agent generates an nftables bridge rule- set that dispatches each new flow to a Netfilter hook for clas- sification. Then, nftables caches the verdict in a set, and subsequent packets bypass Lua entirely. The pipeline builds on Lunatik, our Linux kernel-scripting framework presented at Netdev 0x14 and 0x17, and contributes three new bind- ings: luanetfilter for direct Netfilter hooks, luaskb for socket-buffer access and reply synthesis, and luanftables, a userspace libnftables wrapper. On a Wi-Fi 6 access point under a combined Ethernet and Wi-Fi HTTPS work- load, the pipeline sustains 1.4 Gbps at parity with a plain Linux bridge in throughput and latency. The pipeline ships in production as Ring Zero Dome, the in-kernel engine of the NetExperience Secure Wireless Gateway on OpenWiFi access points.