Crate waf_capture 

Request capture for Light WAF: keep the full HTTP request (method, path, query, headers, cookies, body) of every request the WAF blocks or rejects, and ship it to the control plane for the event drill-down. Optional, default off.

Three pieces, no change to the core:

1. CaptureModule — a detection module that never scores: it clones each request into a bounded CaptureRing keyed by request id (cheap: the body is a ref-counted Bytes).
2. CaptureLayer — a tracing layer that watches the request blocked / request rejected decision-log events and pulls the matching capture out of the ring.
3. CaptureShipper — a bounded queue with best-effort retry that POSTs captures to the control plane’s /ingest/captures; it drops on overflow and never puts backpressure on the datapath.

Privacy: capture is raw by default; RedactionConfig replaces header and body-field values with ***REDACTED*** on the node, and CaptureConfig::max_body_bytes caps the body. Retention and access control are enforced by the control plane.

Structs

CaptureConfig

Typed configuration for the request-capture feature. Built by the enterprise wiring from the [enterprise.capture] TOML section. Every field has a fail-safe default and the feature is OFF by default, so a config without the section behaves exactly like the plain enterprise proxy.

CaptureHandle

Handle shared between the installed CaptureLayer and main. main keeps one clone to arm after loading the config; the layer keeps another to read it.

CaptureLayer

The layer. Zero-cost while disarmed; on a denial event it does one ring take + one non-blocking enqueue.

CaptureModule

Observer module that mirrors each request into the ring. Holds an Arc to the ring it shares with the verdict-join layer; the module_factory rebuilds the module on reload but keeps the same ring, so in-flight captures survive a config reload.

CaptureRing

Bounded ring buffer of captures. Cheap to clone the Arc around it; interior-mutable so the capture module can insert through a shared &self.

CaptureShipper

Spawns and owns the background shipping task.

CaptureSink

The producer half held by the verdict-join layer: a non-blocking handle onto the shipper queue. Cloneable and cheap; dropping the last clone closes the channel and ends the shipper task.

CapturedRequest

A captured HTTP request — the full request the WAF denied, as forwarded to the control-plane drill-down. Built by CapturedRequest::from_ctx with redaction + truncation already applied.

RedactionConfig

Which header names and body field names to strip from a capture before it is stored/shipped.

Constants

REDACTED

The placeholder a redacted value is replaced with.