Technical overview · For Red Hat reviewers
How DAV NGWAF works
DAV NGWAF is a host-based web application firewall for Red Hat Enterprise Linux. It reads the web server's access log, classifies each request, and, when the administrator enables enforcement, bans hostile IPv4 sources in its own nftables table. These pages explain what it installs, what it changes on the system, and what privileges it uses.
Certification target: Red Hat Enterprise Linux 10.2, x86_64, as a standalone, non-containerized application
(Red Hat certification ID 744987, in progress). The engine is also built and tested on ARM64.
Components
| Component | What it does | Runs as | Required |
|---|---|---|---|
Detection engine (davco_ids) | Reads the NGINX access log, evaluates every request, writes detections and structured events, and requests bans | davco, a locked service account with no shell | Yes |
Enforcement helper (davco-ip-enforce) | The only privileged entry point. Validates each request and adds or removes addresses in DAV's nftables sets | root, called through one narrow sudo rule | Only with enforcement |
| Firewall loader | Loads DAV's own ip davco4 nftables table, in log or drop mode | root, oneshot | Only with enforcement |
| XDP packet filter | Drops banned addresses at the network interface, before the kernel network stack | root | Optional, installed disabled |
Event ingestion (davco-ingest) | Commits structured events to PostgreSQL for reporting | unprivileged | Optional |
| DAV SOC | Web dashboard and REST API for detections, bans and MITRE ATT&CK classifications | web server and an unprivileged API service | Optional |
From log line to ban
1. NGINX writes the request
All sites on the server log to one shared access log in a key-value format the engine parses (client address, host, method, URI, status, timing, user agent, referrer).
All sites on the server log to one shared access log in a key-value format the engine parses (client address, host, method, URI, status, timing, user agent, referrer).
2. The engine reads it
The engine follows the log from its end, checking for new lines every 100 ms, and handles log rotation and truncation.
The engine follows the log from its end, checking for new lines every 100 ms, and handles log rotation and truncation.
3. The request is evaluated
Rule-based checks, behavior tracking and, if enabled, the machine-learning model produce a verdict and a reason.
Rule-based checks, behavior tracking and, if enabled, the machine-learning model produce a verdict and a reason.
4. A decision is recorded
Every detection is written to the engine's logs and as a structured event. In monitor-only mode, the process stops here.
Every detection is written to the engine's logs and as a structured event. In monitor-only mode, the process stops here.
5. A ban is requested
With enforcement enabled, the engine asks the root helper to ban the address. The helper validates it and adds it to an nftables set with a 48-hour timeout.
With enforcement enabled, the engine asks the root helper to ban the address. The helper validates it and adds it to an nftables set with a 48-hour timeout.
6. The kernel drops the traffic
DAV's nftables chain drops packets from banned addresses, including on connections that were already open. With XDP enabled, they are dropped earlier, at the network interface.
DAV's nftables chain drops packets from banned addresses, including on connections that were already open. With XDP enabled, they are dropped earlier, at the network interface.
Design principles
- Monitor-only by default. Enforcement is turned on explicitly by the administrator.
- Least privilege. The engine has no root access and no shell; one validated helper performs the privileged action.
- Own namespace, no takeover. DAV uses its own nftables table and never modifies firewalld's rules or the host firewall configuration.
- RHEL-native components. Enforcement uses nftables from RHEL's supported kernel and packages; dependencies come from Red Hat repositories.
- Verifiable installation. Every installed file is checked against a SHA-256 manifest, before and after installation.