pub struct WafEngine { /* private fields */ }Expand description
The compiled WAF engine, held in the hot-swappable crate::proxy::Runtime.
Implementations§
Source§impl WafEngine
impl WafEngine
Sourcepub fn build(cfg: &WafCfg) -> Result<WafEngine>
pub fn build(cfg: &WafCfg) -> Result<WafEngine>
Compile the engine from config. When mode = "off" an inert engine is returned without
compiling anything (so a disabled WAF costs nothing). Otherwise every enabled built-in
ruleset and every custom pattern is compiled; an empty or invalid custom pattern, or an
unknown target, fails the build so the misconfiguration surfaces at startup/reload.
pub fn mode(&self) -> WafMode
Sourcepub fn evaluate(
&self,
path_and_query: &str,
headers: &HeaderMap,
body: &[u8],
) -> Option<WafHit>
pub fn evaluate( &self, path_and_query: &str, headers: &HeaderMap, body: &[u8], ) -> Option<WafHit>
Evaluate a request against the rules and return the first match, if any. Returns None
immediately when disabled. Each enabled location’s inspection text is assembled at most
once, then every rule that targets that location is checked against it. The path is
checked both raw and percent-decoded (so %2e%2e%2f is caught as ../); headers and
body are matched as-is.