VortexWAF is a high-performance, polyglot Web Application Firewall (WAF) architected for sub-millisecond request inspection. The system utilizes a distributed approach, leveraging a Rust data plane for memory-safe proxying, a C++ SIMD engine for hardware-accelerated pattern matching via FFI, and a Go control plane for dynamic rule orchestration via Redis.
VortexWAF bypasses the performance bottlenecks of standard regex-based engines by offloading payload scanning to a specialized C++ module.
- Vectorized Pattern Matching: Implements the Aho-Corasick algorithm optimized with AVX2/SSE intrinsics, allowing for simultaneous scanning of request bodies against large signature sets.
- Zero-Copy FFI: The Rust data plane interfaces with the C++ accelerator via a low-overhead Foreign Function Interface (FFI), ensuring rigorous memory safety while maintaining bare-metal execution speeds.
To support high-concurrency environments, VortexWAF implements a zero-downtime configuration update mechanism.
- Arc-Swap Integration: The Rust data plane utilizes
arc-swapfor security signature storage, enabling constant-time reads without the latency penalties associated with Mutex contention. - Atomic Signature Updates: When the Go Control Plane broadcasts new rules via Redis Pub/Sub, the Data Plane performs an atomic pointer swap. In-flight requests continue against the previous state, while new requests immediately utilize the updated rule set, ensuring 100% availability.
| Component | Technology | Responsibility |
|---|---|---|
| Data Plane | Rust (Tokio, Hyper) | Asynchronous L7 proxying, Redis Pub/Sub, FFI management. |
| Accelerator | C++ (AVX2, SSE) | SIMD-accelerated multi-pattern matching. |
| Control Plane | Go (Gin, Redis) | Rule management API, signature distribution, and orchestration. |
| Observability | LGTM Stack | Distributed tracing, P99 latency monitoring, and violation tracking. |
.
├── accelerator # C++ SIMD engine (Aho-Corasick + Hardware Intrinsics)
├── control_plane # Go-based orchestration server and administrative API
├── data_plane # Rust proxy implementation featuring ArcSwap and FFI
├── infra # Containerized environment (Docker) and Prometheus monitoring
└── test # backend simulation scripts && test requester script to send high frequency requests
VortexWAF exports granular Prometheus metrics to quantify the computational cost of security inspection:
- waf_processing_duration_seconds: High-precision histogram measuring the C++ SIMD scanning latency.
- http_requests_total: Throughput telemetry categorized by HTTP status and Proxy ID.
- security_violations_total: Real-time counter of intercepted malicious payloads.
Distributed under the GNU GENERAL PUBLIC LICENSE. See LICENSE for more information.