Enforcing encryption at scale

This post details the development and deployment of SSLWall, a system designed to enforce transit encryption policies across Meta's internal network. SSLWall utilizes eBPF (tc-bpf, kprobes) and a management daemon to inspect and block non-SSL connections at the host level, ensuring application-level TLS. It addresses challenges like HTTP CONNECT and STARTTLS, and includes a passive monitoring mode. For services that cannot be easily modified, Transparent TLS (TTLS) is introduced, which uses eBPF to transparently redirect connections to a local proxy for encryption without application changes. Key technical challenges included TCP Fast Open (TFO) interaction and BPF program size limits.