Vaanvil is the SNI/DNS and Layer 7 policy engine inside Neurowall. A TC eBPF data plane extracts connection metadata in kernel space; a Go control plane evaluates policy and writes verdicts back to BPF maps — no userspace proxying of traffic.
Traffic is never proxied through userspace. TC eBPF handles ingress metadata extraction and egress enforcement; the Go control plane only evaluates policy in between.
Extracts TLS SNI, ALPN, JA3/JA4 fingerprints, QUIC DCID, and HTTP/2 pseudo-header metadata from the first packets of a connection, entirely in kernel space.
Rules are evaluated in priority order against extracted metadata. Supported match fields include SNI, ALPN, JA3/JA4 (plus pattern variants), source/destination IP, and certificate pinning fields used by the QUIC and TLS validation paths.
Verdicts are written back to BPF maps and enforced on egress via map lookup — allow, drop, or redirect — without a userspace proxy in the traffic path.
Policy rules match on TLS/QUIC fingerprints and metadata, not just source and destination addresses.
Rules can match on sni, alpn, ja3, ja3_pattern, ja4, ja4plus, ja4_pattern, src_ip, dst_ip, ip, and certificate pinning fields used by the QUIC and TLS validation paths.
allow, drop, or redirect — applied per flow, by priority order.
dcid is parsed and exposed in the policy schema but currently rejected at validation time as unenforced. HTTP/2 metadata extraction exists, but HTTP/2 pseudo-header matching is not enforced as a policy criterion in the current engine — documented in code as an unsupported match path.
Broader routing/firewall ambitions (BGP/OSPF, VPN termination, full NAT stacks) referenced elsewhere should be treated as roadmap, not shipped capability.
Recorded 2026-05-13 on a veth-based test setup, comparing baseline HTTP traffic against Vaanvil using wrk with new TCP connections per request. Dominant overhead is per-packet TC hook processing, not the policy engine — measured policy cost is about 0.14 ms per flow.
| Concurrency | Baseline RPS | Vaanvil RPS | Baseline p99 | Vaanvil p99 |
|---|---|---|---|---|
| 10 | 44,574 | 21,182 | 1.72 ms | 3.80 ms |
| 100 | 55,401 | 29,891 | 6.46 ms | 10.61 ms |
| 1000 | 45,489 | 26,642 | 29.94 ms | 48.45 ms |
About 46% RPS overhead at 100 concurrent new-connection requests. No errors observed up to 1000 concurrent connections. This is one recorded run on a veth test setup — not a production line-rate benchmark.
Daemon lifecycle management, policy loading and validation, BPF map updates, policy CRUD through the HTTP API, CLI access via vnfw, etcd-backed policy distribution, and failover coordination for HA deployments.
Packet and flow counters, verdict counters, policy update counters, policy and extraction latency totals, QUIC allowlist metrics, and webhook delivery metrics. Grafana dashboards and Prometheus configs ship under deploy/monitoring.
Kubernetes manifests, systemd unit files, and init.d support ship in the repo alongside Prometheus deployment and Grafana dashboard configs.