#ebpf

Wiki 4

  • bora.sh Bora Tanrıkulu's personal blog at bora.sh — short systems-engineering write-ups in the style of "I built X, here's the gnarly platform-specific bit"
  • Bypassing DPI with eBPF sock_ops Bora Tanrıkulu builds gecit — eBPF sock_ops on Linux for in-kernel SNI desync, gVisor + TUN as the "tiny VPN" fallback on macOS/Windows
  • eBPF sock_ops Linux's per-cgroup BPF hook into the kernel TCP socket lifecycle — fires at SYN-sent, established, retransmit, and other transitions
  • Profiling eBPF Code Srinivasan's method for measuring what an eBPF file-open hook costs — C harness, perf, JIT symbols

Toolbox 3

  • gecit System-wide DPI bypass that injects fake TLS ClientHellos from eBPF, no tunnel or remote server
  • gobee Go-to-BPF-C transpiler that reuses clang's BPF backend and generates typed cilium/ebpf bindings
  • Little Snitch for Linux Linux port of the per-app network monitor — eBPF connection tracking with a web UI for blocking