From Access Log to Kernel Drop: Building a Single-Process WAF Ban Pipeline in C
In self-hosted Linux infrastructure, bridging L7 application security with L3/L4 network enforcement traditionally requires stitching together multiple independent daemons. A typical setup involves an inline proxy module for application-layer inspection, a log parser to tail access logs, and an external utility to push dynamic iptables rules. While functional, this approach introduces…
The Linux Log Guardian project creates a single-process WAF and dynamic IP ban pipeline for self-hosted Linux infrastructure. By operating as a single C binary, it avoids the architectural fragmentation and memory overhead of separate daemons, while providing median latency of ~26 ms for blocking banned IPs. Key components include a zero-copy log parser, OWASP CRS for pattern matching, policy engine for named skips and purpose binding, and XDP kernel enforcement with automatic ipset fallback.
The architecture aims for high performance by offloading log parsing and matching to io_uring, enforcing PCRE2 JIT match limits to prevent ReDoS attacks, and providing user-controlled policy controls via named skips. While offering strong L7 protection, it should be paired with CDN and L3/L4 DDoS mitigation for comprehensive security. The open-source project is available on GitHub with comprehensive test suites and a live demo.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
