Crate waf_threatintel 

Threat intelligence for Light WAF: cluster-wide IP reputation, in two halves.

• Read: ReputationModule is a detection module that runs at the connection phase, looks up the client IP in a waf_state_redis::ReputationStore and adds a severity to the request’s cumulative anomaly score (Malicious / Suspicious; Unknown adds nothing). A store outage reads as Unknown: it neither blocks nor unblocks traffic.
• Write: start_reputation_feed polls ReputationFeed sources (FileFeed, HttpListFeed) and populates the store, with a per-cycle single-writer lock and per-entry TTL so de-listed IPs age out.

Reputation stays out of the core’s API: the core datapath never reads or writes it.

Structs

FeedConfig

Runtime tunables for the feed driver (wired from [enterprise.reputation.feed]).

FileFeed

A ReputationFeed backed by a local file (one IP per line). Useful for tests, air-gapped deployments, and lists maintained out-of-band (e.g. rendered by another process).

HttpListFeed

A ReputationFeed that GETs a plaintext IP list over HTTPS. The client uses a ring-based rustls config (no aws-lc-rs/cmake) — the same crypto provider the core uses — matching CloudflareDns.

ReputationConfig

How an IP-reputation verdict maps to an anomaly-score severity. No hardcoded points: the module declares a Severity and the pipeline resolves severity -> points via [waf.severity_scores] (so the operator tunes whether reputation alone blocks).

ReputationModule

A premium WafModule that scores a request by the reputation of its client IP.

Enums

FeedError

Why a feed fetch failed. The driver treats any error as “keep the previous snapshot” (fail-to-no-opinion): a down feed must neither block nor unblock — entries just age out.

Traits

ReputationFeed

A source of IP-reputation entries. Object-safe (async via async_trait) so the driver can hold a Vec<Box<dyn ReputationFeed>> of heterogeneous sources.

Functions

start_reputation_feed

Spawn the feed driver as a background task. Each refresh_interval a single node (the lock winner) refreshes the rep:<ip> snapshot the reputation module reads. sources, writer and lock are typically all backed by the SAME RedisStore. Returns the task handle (drop to keep it running for the process lifetime).