Module waf 

Web application firewall: rws’s own rules (18.22.0). Web application firewall (18.22.0, #77): rws’s own rules, no rule language to learn and no external engine.

Every request’s path, query arguments, form / JSON / multipart field values (the first WafConfig::inspect_body_bytes), cookies and a few headers are decoded (decode::normalize) and checked against the built-in detections (detect::RULES: SQL injection, XSS, path traversal and sensitive files, file-inclusion wrappers, command injection, cloud-metadata SSRF, Log4Shell, scanners, argument limits). Each match adds its score; at WafConfig::threshold (5: one critical match) the request is refused with 403 problem+json naming the rules — or, in detect mode, only logged. paranoia (1–3) turns on stricter, noisier rules.

False positives are excluded by rule id and path prefix (exclude = ["942100@/api/search"]), and custom rules match a field with contains / prefix / equals / cidr (linear-time matching, no regular expressions) to deny, allow, log or score.

Config: [middleware.waf] (every route) or [route.middleware.waf]; code: WafLayer.

Modules

decode

Normalization before matching: what an attacker encodes, the WAF decodes. Every loop here is bounded by its input (fuzzed).

detect

The built-in detections. Each inspects one normalized value (super::decode::normalize) and reports rule ids. Ids follow the OWASP Core Rule Set’s families so they’re familiar (942 SQL injection, 941 XSS, 930 traversal, 931 remote inclusion, 932 command injection, 934 SSRF, 944 Java, 913 scanners, 920 protocol), but the rules are rws’s own.

Structs

CustomRule

A custom rule.

Exclusion

An exclusion: rule ids (942100, 942*, *) off for a path prefix.

Match

One match.

Verdict

The outcome of Waf::inspect.

Waf

The engine: config plus inspect.

WafConfig

WAF settings.

WafLayer

The WAF in front of an application. See the module docs.

Enums

Action

What a matching custom rule does.

Field

Which part of the request a custom rule looks at.

Mode

Block, only log, or do nothing.

Functions

prometheus_text

rws_waf_requests_total{action} and rws_waf_rule_matches_total{rule} (appended to /metrics; empty until the WAF has seen a match).