WolfSentry: WolfSSL's Embedded Intrusion Detection and Prevention System (IDPS)

wolfSentry is an embedded intrusion detection and prevention engine that functions as both a static and fully dynamic firewall, offering prefix-based and wildcard-capable lookups of hosts and netblocks qualified by interface, address family, protocol, port and other traffic attributes. It can act as a configurable logic hub, mapping user-defined events to actions in the context of connection attributes so client-server relationships are tracked and expected traffic is allowed while abusive traffic is rejected. Integration exists for lwIP (patchset included) and basic wolfSSL-level filtering; callbacks enable transport-agnostic remote logging (for example MQTT, syslog or DDS). Reconfiguration uses transactional semantics and internal locks to provide atomic policy transitions and deterministic throughput suitable for realtime and resource-constrained environments.

Documentation includes JSON configuration details, FreeRTOS-lwIP integration examples, and a pregenerated PDF API reference. The default build depends on a POSIX runtime, but build-time options and a platform interface let the library run with minimal dependencies; for example, a STATIC=1 SINGLETHREADED=1 NO_STDIO=1 build with allocator/time callbacks can produce a tiny static library. Many feature macros control functionality (LWIP, NO_JSON, NO_IPV6, NO_ADDR_BITMASK_MATCHING, etc.). Designed for portability and C89/non-POSIX targets, wolfSentry supports common RTOSes and embedded CPUs, requires modern Gnu make (v4+), and provides build flags to tune size, threading, and feature set.