[codex] Harden DDoS protection controls

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
             tools/test_ai_tools.py \
             tools/validate_edge_templates.py
           PYTHONPATH=tools python3 tools/test_ai_tools.py
-          python3 tools/validate_edge_templates.py --config configs/example.json
+          sudo python3 tools/validate_edge_templates.py --config configs/example.json
           python3 tools/assert_defense_bench.py \
             --audit-tracked-artifacts benchmark_results \
             --artifact-manifest benchmark_results/defense_artifacts_manifest.json

Cargo.toml

@@ -7,6 +7,7 @@ license = "MIT"
 [dependencies]
 clap = { version = "4", features = ["derive"] }
 bytes = "1"
+blake3 = "1"
 http = "1"
 http-body-util = "0.1"
 hyper = { version = "1", features = ["client", "http1", "server"] }

README.md

@@ -59,13 +59,13 @@ deterministic generator otherwise.
 
 - HTTP/1 reverse proxy with per-client prefix, per-signature, per-path-shape route-family, trusted-proxy aggregate, and global token-bucket limits.
 - Bounded rate-limiter state that evicts stale buckets but denies new active keys when a shard is full, so high-cardinality rotation cannot reset existing hot IP, signature, or path-shape buckets.
-- HTTP method allowlist, Host header validation, bounded trusted `X-Forwarded-For` parsing, forwarded-header/client-IP spoof sanitization, normalized request-signature and path-shape rate caps that collapse long dynamic tokens plus high-confidence short tokens without merging version segments such as `/api/v1` and `/api/v2`, bounded sibling-churn limiting for short lowercase token rotation under one parent route, trusted-proxy aggregate rate and in-flight caps, downstream keep-alive disabled by default, downstream write timeout for slow readers, raw initial HTTP/1 header/framing validation with incremental delimiter scanning plus hard byte, per-field, and count caps, request framing validation, request content-encoding policy, default chunked request-body rejection with opt-in, default `Expect` rejection with opt-in `100-continue`, bounded `Range` request policy, default origin `Accept-Encoding` stripping with opt-in passthrough, connection-open rate caps, active connection caps, sharded `SO_REUSEPORT` accept sockets, in-flight upstream request caps, upstream connect timeout, path-shape-scoped passive upstream failure circuit breaker, per-connection request caps, request and upstream response header byte/field/count caps and timeouts, default-stripped HTTP trailers with opt-in capped forwarding, request/upstream body recent-window minimum data-rate guards, request body guardrails, and upstream response body guardrails.
+- HTTP method allowlist, Host header validation, bounded trusted `X-Forwarded-For` parsing, forwarded-header/client-IP spoof sanitization, normalized request-signature and path-shape rate caps that collapse long dynamic tokens plus high-confidence short tokens without merging version segments such as `/api/v1` and `/api/v2`, bounded sibling-churn limiting for short lowercase token rotation under one parent route, trusted-proxy aggregate rate and in-flight caps, downstream keep-alive disabled by default, downstream write timeout for slow readers, raw initial HTTP/1 header/framing validation with incremental delimiter scanning plus hard byte, per-field, and count caps, request framing validation, request content-encoding policy, default chunked request-body rejection with opt-in, default `Expect` rejection with opt-in `100-continue`, bounded `Range` request policy, default origin `Accept-Encoding` stripping with opt-in passthrough, connection-open rate caps, active connection caps, sharded `SO_REUSEPORT` accept sockets, in-flight upstream request caps, upstream connect timeout, path-shape-scoped passive upstream failure circuit breaker, per-connection request caps, request and upstream response header byte/field/count caps, framing validation, and timeouts, default-stripped HTTP trailers with opt-in capped forwarding, request/upstream body recent-window minimum data-rate guards, request body guardrails, and upstream response body guardrails.
 - Rate-limited admin health checks and token-protected Prometheus metrics.
 - Raw TCP proxy with per-client-prefix and global connection-rate limits, global/per-client-prefix concurrent-connection caps, sharded `SO_REUSEPORT` accept sockets, outbound connect timeout, idle timeout, optional per-direction minimum data-rate guard, and max connection duration.
 - Runtime `RLIMIT_NOFILE` preflight and capacity validation so configured connection caps are backed by an explicit file-descriptor floor.
 - Config preflight that rejects oversized/non-regular/malformed config inputs and out-of-range DDoS-critical knobs (rate caps, resource ceilings, header/body/trailer/metadata caps, timeouts, connection lifetimes, event-log and adaptive-window and filter-TTL bounds, circuit settings, method/Host allowlists, trusted-proxy and admin control-plane settings) so unsafe values fail startup instead of silently disabling protection; `0` remains the explicit per-rate-bucket disable value.
 - SIGINT/SIGTERM shutdown handling so service-manager stops enter the same listener-drain path as Ctrl-C.
-- Static JSON filters for known bad HTTP patterns, plus bounded and validated static/runtime filter rules with compiled header/user-agent match data and snapshot-based rule evaluation on the request path.
+- Static JSON filters for known bad HTTP patterns, plus bounded and validated static/runtime filter rules with response-header-safe rule IDs, compiled header/user-agent match data, and snapshot-based rule evaluation on the request path.
 - Adaptive learned filters that stay dormant, activate during matching floods through rolling token-bucket counters, reclaim idle signature/path-shape windows under capacity pressure, preserve recent evidence, and stop admitting fresh detector keys when a shard is full of recent windows.
 - JSONL attack event logs for offline/nearline analysis, with bounded user-controlled fields, a bounded nonblocking queue capped at `8192` owned events, worker-side JSON serialization, bounded flush cadence, and byte/backup-count-capped rotation.
 - Optional CodexSDGate analyzer that converts attack logs into constrained adaptive filter rules using either a subscription agent CLI you already logged into (Codex, Claude, OpenCode, Cursor, Grok — wrapped the way T3 Code does) or an API key (OpenAI, Anthropic, Gemini, OpenRouter).