waf-proxy 0.4.0

[package]

name = "waf-proxy"

description = "Light WAF: a fast, modular Layer-7 Web Application Firewall reverse proxy in Rust."

readme = "README.md"

keywords = ["waf", "security", "firewall", "reverse-proxy", "proxy"]

categories = ["web-programming::http-server", "network-programming", "command-line-utilities"]

version.workspace = true

edition.workspace = true

license.workspace = true

authors.workspace = true

repository.workspace = true

homepage.workspace = true



[[bin]]

name = "waf"

path = "src/main.rs"



[lib]

name = "waf_proxy"

path = "src/lib.rs"



[dependencies]

waf-core = { workspace = true }

waf-normalizer = { workspace = true }

waf-pipeline = { workspace = true }

waf-detection = { workspace = true }

waf-wasm = { workspace = true }

tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "time", "signal"] }

hyper = { version = "1", features = ["http1", "http2", "server", "client"] }

hyper-util = { version = "0.1", features = ["tokio", "client-legacy", "http1", "http2", "server-auto"] }

http-body-util = "0.1"

tracing = "0.1"

tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }

toml = "0.8"

# Serialize the per-rule score breakdown as one JSON field in the decision-log (§7 drill-down

# data source). Only on the denied-request log path — not the hot path.

serde_json = "1"

# TLS termination (Fase 12). ring provider (no aws-lc-rs/cmake); detection stays serde-free,

# this is the ONE legitimate exception to "hand-roll the parser" — TLS is never hand-rolled.

tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }

rustls-pemfile = "2"



[dev-dependencies]

tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "time", "io-util"] }

# Self-signed certs for the TLS test matrix (Fase 12, Step 5).

rcgen = { version = "0.13", default-features = false, features = ["ring", "pem"] }