pub struct GlobalWaf {
pub enabled: bool,
pub dry_run: bool,
pub paranoia_level: u8,
pub anomaly_threshold: u32,
pub max_body_inspect_bytes: u64,
pub rules: Vec<CrsRule>,
pub exclude_rule_ids: Vec<u32>,
pub exclude_tags: Vec<String>,
}Expand description
SEC-08 (#212): Global WAF policy with CRS-compatible rules. When enabled, the rules are evaluated on every request (regardless of route-level WAF config). The anomaly score is accumulated across all matching rules; the request is blocked when the score exceeds the threshold. Rule exclusions can disable specific rules by ID or tag. The paranoia level controls which rules are active (1 = default, 2 = more aggressive, 3 = paranoid, 4 = very paranoid).
Fields§
§enabled: boolMaster switch. Default false.
dry_run: boolAudit-log-only mode (same semantics as RouteWaf::dry_run).
paranoia_level: u8Paranoia level (1-4). Rules with a higher paranoia level than this are skipped. Default 1.
anomaly_threshold: u32Anomaly score threshold for blocking. A request is blocked when the sum of matching rule severities reaches this value. Default 5 (critical rules block immediately, warnings need multiple hits).
max_body_inspect_bytes: u64Maximum body bytes to inspect (same semantics as RouteWaf::max_body_inspect_bytes). Default 131072.
rules: Vec<CrsRule>CRS-compatible rules to evaluate.
exclude_rule_ids: Vec<u32>Rule IDs to exclude (skip even if the rule is in the rules list). Useful for tuning false positives.
Tags to exclude (skip all rules carrying any of these tags).
Trait Implementations§
Source§impl<'de> Deserialize<'de> for GlobalWaf
impl<'de> Deserialize<'de> for GlobalWaf
Source§fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
Source§impl JsonSchema for GlobalWaf
impl JsonSchema for GlobalWaf
Source§fn schema_id() -> Cow<'static, str>
fn schema_id() -> Cow<'static, str>
Source§fn json_schema(generator: &mut SchemaGenerator) -> Schema
fn json_schema(generator: &mut SchemaGenerator) -> Schema
Source§fn inline_schema() -> bool
fn inline_schema() -> bool
$ref keyword. Read moreimpl StructuralPartialEq for GlobalWaf
Auto Trait Implementations§
impl Freeze for GlobalWaf
impl RefUnwindSafe for GlobalWaf
impl Send for GlobalWaf
impl Sync for GlobalWaf
impl Unpin for GlobalWaf
impl UnwindSafe for GlobalWaf
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more