waf_wasm/lib.rs
1// SPDX-FileCopyrightText: 2026 0x00spor3
2// SPDX-License-Identifier: Apache-2.0
3
4//! `waf-wasm` — a Proxy-Wasm plugin **runtime** that exposes a loaded `.wasm` filter as a
5//! [`waf_core::WafModule`] (BOUNDARY §1.7, B3). The runtime is OPEN; marketplace/signing is
6//! enterprise (§2.4).
7//!
8//! ## Design (see ARCHITECTURE §9 and the B3 plan)
9//! - **Engine**: `wasmi` (pure-Rust interpreter; no JIT/C). Pinned to the version the B3-0
10//! probe validated for reentrant `malloc` + fuel + memory-cap traps.
11//! - **Model**: the WAF is buffer-then-inspect on the request, so per request the host runs
12//! the Proxy-Wasm request-path callbacks in one shot (`end_of_stream = true`) and maps a
13//! captured `proxy_send_local_response` to a [`waf_core::Decision`]. The plugin never
14//! writes the response itself — the pipeline decides (detection-only safe).
15//! - **DoS posture**: fuel reset per request (latency ceiling, not just kill-switch), a
16//! memory cap, no network/filesystem host calls. Any trap fails closed (`Reject{500}`).
17//! - **Subset**: a declared set of host functions; everything else returns
18//! [`abi::Status::Unimplemented`] and is reported at boot (never a silent partial).
19//!
20//! This crate isolates the `wasmi` dependency from the rest of the workspace: it depends
21//! only on `waf-core` (no cycle), and `waf-proxy` depends on it.
22
23pub mod abi;
24pub mod host;
25pub mod marshal;
26pub mod memory;
27pub mod report;
28pub mod runtime;
29
30pub use report::ImportReport;
31pub use runtime::{WasmError, WasmModule, WasmOptions};