{
  "id": 8927351,
  "title": "From Access Log to Kernel Drop: Building a Single-Process WAF Ban Pipeline in C",
  "url": "https://urgent.news/2026/09/21/from-access-log-to-kernel-drop-building-a-single-process-waf-ban",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T13:20:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kurtulus/from-access-log-to-kernel-drop-building-a-single-process-waf-ban-pipeline-in-c-1jh1"
  },
  "original_language": "en",
  "account": "The Linux Log Guardian project creates a single-process WAF and dynamic IP ban pipeline for self-hosted Linux infrastructure. By operating as a single C binary, it avoids the architectural fragmentation and memory overhead of separate daemons, while providing median latency of ~26 ms for blocking banned IPs. Key components include a zero-copy log parser, OWASP CRS for pattern matching, policy engine for named skips and purpose binding, and XDP kernel enforcement with automatic ipset fallback. The architecture aims for high performance by offloading log parsing and matching to io_uring, enforcing PCRE2 JIT match limits to prevent ReDoS attacks, and providing user-controlled policy controls via named skips. While offering strong L7 protection, it should be paired with CDN and L3/L4 DDoS mitigation for comprehensive security. The open-source project is available on GitHub with comprehensive test suites and a live demo.",
  "summary": "In self-hosted Linux infrastructure, bridging L7 application security with L3/L4 network enforcement traditionally requires stitching together multiple independent daemons. A typical setup involves an inline proxy module for application-layer inspection, a log parser to tail access logs, and an external utility to push dynamic iptables rules. While functional, this approach introduces…",
  "key_points": [
    "Single-process C binary WAF avoids fragmentation and memory overhead",
    "Zero-copy log parser and OWASP CRS for pattern matching",
    "XDP kernel enforcement with ipset fallback for high performance"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}