Module waf 

Baseline web application firewall: request rules matched before a request is routed or served.

A WafPolicy holds WafRules, each a case-insensitive regular expression over one part of the request (WafTarget). The request target is checked both as received and percent-decoded, so %2e%2e%2f matches a rule written for ../. The first rule that matches decides:

• in WafMode::Block the request gets 403 Forbidden;
• in WafMode::ReportOnly it is served as usual.

Either way a WafEvent is logged at warn level through the log crate with the rule id, the target, the action and the request line, and counted in stats and on /metrics.

WafPolicy::baseline gives a starting rule set for path traversal, null bytes, VCS and environment files, script injection, SQL injection and shell command injection. It is a coarse filter, not a substitute for validating input where it is used.

Examples

use http_handle::waf::{WafMode, WafPolicy, WafRule, WafTarget};
use http_handle::Server;

let mut rules = WafPolicy::baseline_rules();
rules.push(WafRule::new("no-admin", WafTarget::Uri, r"^/admin(/|$)"));
let waf = WafPolicy::new(WafMode::Block, rules).expect("valid rules");

let server = Server::builder()
    .address("127.0.0.1:0")
    .document_root(".")
    .waf(waf)
    .build()
    .expect("server");
assert!(server.waf().is_some());

Structs

WafConfig

Configuration form of a WafPolicy, used for serde.

WafEvent

A rule match, as logged.

WafPolicy

A validated rule set and its mode.

WafRule

One rule definition.

WafStats

Counts of WAF matches since the process started.

Enums

WafAction

The action taken for a matched rule.

WafError

Why a rule set was rejected.

WafMode

What happens when a rule matches.

WafTarget

The part of the request a rule inspects.

Functions

stats

Returns the WAF counters.