SneppX-ALG v0.9.4.467 is now released. This update adds a 4-ring firewall architecture around the inference server — Transport (TLS/mTLS), Network (CIDR allow/deny, rate limiting, connection tracking, port knocking), Application (injection filter, path traversal, concurrent limiter), and Security Middleware integration — with MASM x64 hot-path routines for IP matching, rate counting, and connection tracking. The release also ships YAML configuration with env/CLI overrides, geo-IP blocking (optional), and a pure-Python fallback when the native DLL is unavailable.
What's New
4-Ring Firewall Architecture
Ring 1 — Transport (firewall_transport.py)
TLS/mTLS context builder with cert chain, CA verification, and ALPN protocol negotiation
Certificate pinning via SHA-256 fingerprint whitelist
Minimum TLS version enforcement (default: TLSv1.2)
Configurable cipher suites
Ring 2 — Network (firewall_network.py)
IP allowlist/denylist with CIDR subnet matching
Per-IP rate limiting — sliding window counter with configurable max requests and window
Connection tracking — hash table with LRU eviction and configurable timeout
Port knocking — header-based sequence validation with constant-time comparison
Geo-IP blocking (optional, requires `maxminddb` + GeoLite2 DB)
ctypes bridge to ASM hot-path routines (`ip_match`, `rate_counter`, `conn_track`, `port_knock`)
Ring 3 — Application (firewall_application.py)
HTTP method and content-type validation
Path traversal detection (normalized check + URL-encoded pattern blocking)
SQL injection / XSS / command injection pattern filtering
Per-IP concurrent request limiter (semaphore-based)
Request body size enforcement
Suspicious header detection (`x-forwarded-for`, `x-http-method-override`)
Ring 4 — Security Middleware (security_middleware.py)
`check_firewall()` runs before authentication in the HTTP pipeline
`release_concurrent()` at request end to free per-IP semaphore
`security.firewall` property with lazy `FirewallRunner` instantiation
MASM x64 Hot-Path Routines (4 files)
`ip_match.asm` — constant-time CIDR matching via XOR + mask
`rate_counter.asm` — lock-free sliding window rate check with RDTSC
`conn_track.asm` — CRC32-based hash table with LRU eviction
`port_knock.asm` — constant-time port sequence comparison + timestamp window
`build.ps1` — assembles with `ml64`, links into `firewall_core.dll`
Pure-Python fallback when DLL is unavailable
Configuration & CLI
`firewall.yaml` — full YAML config template for all 3 rings
Config hierarchy: CLI flags > environment variables > `firewall.yaml` > defaults
`FIREWALL_CONFIG`, `FIREWALL_ALLOWLIST`, `FIREWALL_DENYLIST`, `FIREWALL_RATE_LIMIT` env vars
`--firewall-config`, `--firewall-{allowlist,denylist,rate-limit,knock-ports}` CLI flags
`--tls-enabled`, `--tls-certfile`, `--tls-keyfile`, `--tls-cafile` transport flags
`set_security(sec_config, firewall_config=...)` API for programmatic setup
Testing
**Firewall Tests**: 24 tests across 3 modules (all passing)
Rate limiting sliding window expiry, LRU eviction, CIDR allow/deny, path traversal variants, injection patterns, concurrent limiter, TLS context failure
By the Numbers
121,000+ core lines + security bindings + firewall
550+ source files
9 new commits for firewall layer
24 new firewall tests (all passing)
4 MASM x64 assembly hot-path routines
87 P0 security tests + 24 firewall tests = 438 total passing
Quick Start
# pip
pip install sneppx-alg
# Docker (CPU)
docker pull ghcr.io/ammar49-cyber/sneppx-alg:cpu-latest
# Source
git clone https://github.com/ammar49-cyber/sneppx-alg.git
See the Packages page for full installation details.