Web Application Firewall - rate limiting, pattern detection, honeypots, IP banning
| Tier | infrastructure |
| Role | unclassified (baselined) |
| Path | crates/infrastructure/waf |
| Edition | 2021 |
| Targets | infrastructure_waf |
| Public items | 86 across 4 modules |
| Tests | 26 |
What it is for
Web Application Firewall (WAF) for Axum.
A comprehensive security middleware providing:
- Rate limiting with token bucket algorithm
- Pattern detection (SQL injection, XSS, path traversal)
- Data leak prevention (SSN, credit cards, API keys)
- Honeypot traps for common attack paths
- IP banning with fail2ban and pf integration
# Architecture
Request → Rate Limiter → Pattern Detector → App
↓ ↓
Security Logger ← Strike Counter → Auto-Ban
↓
fail2ban / pf integration# Usage
use infrastructure_waf::{
WafConfig, WafMiddleware,
honeypot::{honeypot_routes, HoneypotConfig},
};
// Create WAF middleware
let waf = WafMiddleware::new(WafConfig::default());
// Create honeypot routes
let honeypot = honeypot_routes(HoneypotConfig::default());
let app = Router::new()
.route("/", get(home))
.layer(waf.layer())
.merge(honeypot);# fail2ban Integration
Configure fail2ban to watch the WAF log file:
# /etc/fail2ban/filter.d/waf.conf
Definition
failregex = ^\S+ \waf\ \S+ from <HOST>:.*$
^\S+ \waf\ BAN <HOST>.*$
# /etc/fail2ban/jail.local
waf
enabled = true
filter = waf
logpath = /var/log/waf/security.log
maxretry = 5
bantime = 900# pf Integration (FreeBSD/OpenBSD)
Add to /etc/pf.conf:
table <waf_blocked> persist
block in quick on egress from <waf_blocked> to anyReload: pfctl -f /etc/pf.conf
Capabilities
WafConfig
Web Application Firewall (WAF) for Axum.
| Item |
|---|
pub struct WafConfig |
WafConfig :: fn default() -> Self |
WafLayer
Web Application Firewall (WAF) for Axum.
| Item |
|---|
pub struct WafLayer |
WafLayer :: fn layer(& self, inner : S) -> Self::Service |
WafMiddleware
Web Application Firewall (WAF) for Axum.
| Item |
|---|
pub struct WafMiddleware |
WafMiddleware :: fn new(config : WafConfig) -> std::io::Result <Self> |
WafMiddleware :: fn layer(self) -> WafLayer |
WafMiddleware :: fn layer_from_arc(waf : Arc <WafMiddleware>) -> WafLayer |
WafMiddleware :: fn get_config(& self) -> & WafConfig |
WafMiddleware :: fn get_logger(& self) -> & SecurityLogger |
WafMiddleware :: fn get_rate_limiter(& self) -> & TokenBucketRateLimiter |
WafMiddleware :: async fn process(& self, req : Request <Body>, connect_info : Option <SocketAddr>, next : Next,) -> Response |
WafService
Web Application Firewall (WAF) for Axum.
| Item |
|---|
pub struct WafService<S> |
WafService<S>
Web Application Firewall (WAF) for Axum.
| Item |
|---|
WafService<S> :: fn poll_ready(& mut self, cx : & mut std::task::Context <'_>,) -> std::task::Poll <Result <(), Self::Error>> |
WafService<S> :: fn call(& mut self, req : Request <Body>) -> Self::Future |
honeypot (other)
Honeypot routes for catching malicious login attempts.
| Item |
|---|
fn mask_password(password : & str) -> String |
AdminerAuth
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct AdminerAuth |
AdminerLoginForm
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct AdminerLoginForm |
DjangoLoginForm
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct DjangoLoginForm |
HoneypotConfig
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct HoneypotConfig |
HoneypotConfig :: fn default() -> Self |
fn honeypot_routes(config : HoneypotConfig) -> Router |
PhpMyAdminLoginForm
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct PhpMyAdminLoginForm |
WpLoginForm
Honeypot routes for catching malicious login attempts.
| Item |
|---|
pub struct WpLoginForm |
DetectionResult:DetectionResult
Pattern detection for SQL injection, XSS, path traversal, and data leaks.
| Item |
|---|
pub struct DetectionResult |
DetectionResult:detect
Pattern detection for SQL injection, XSS, path traversal, and data leaks.
| Item |
|---|
fn detect_sql_injection(text : & str) -> DetectionResult |
fn detect_xss(text : & str) -> DetectionResult |
fn detect_path_traversal(text : & str) -> DetectionResult |
fn detect_all(text : & str) -> DetectionResult |
fn detect_ssn(text : & str) -> DetectionResult |
fn detect_credit_card(text : & str) -> DetectionResult |
fn detect_api_keys(text : & str) -> DetectionResult |
DetectionResult:detected
Pattern detection for SQL injection, XSS, path traversal, and data leaks.
| Item |
|---|
DetectionResult :: fn detected(pattern_type : & str, matched : & str) -> Self |
DetectionResult :: fn detected_outbound(pattern_type : & str, matched : & str) -> Self |
DetectionResult:none
Pattern detection for SQL injection, XSS, path traversal, and data leaks.
| Item |
|---|
DetectionResult :: fn none() -> Self |
DetectionResult :: fn none_outbound() -> Self |
DetectionResult:scan
Pattern detection for SQL injection, XSS, path traversal, and data leaks.
| Item |
|---|
fn scan_response(content : & str) -> DetectionResult |
RateLimitResult
Rate limiting using token bucket algorithm.
| Item |
|---|
pub struct RateLimitResult |
TokenBucketRateLimiter
Rate limiting using token bucket algorithm.
| Item |
|---|
pub struct TokenBucketRateLimiter |
TokenBucketRateLimiter :: fn new(max_requests : u32, window : Duration) -> Self |
TokenBucketRateLimiter :: fn check(& self, ip : IpAddr) -> RateLimitResult |
TokenBucketRateLimiter :: fn get_remaining(& self, ip : IpAddr) -> u32 |
TokenBucketRateLimiter :: fn reset(& self, ip : IpAddr) |
TokenBucketRateLimiter :: fn cleanup(& self) |
TokenBucketRateLimiter :: fn default() -> Self |
CapturedCredential
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct CapturedCredential |
HoneypotMode
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub enum HoneypotMode |
SecurityEvent
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct SecurityEvent |
SecurityEvent :: fn new(event_type : SecurityEventType, ip : IpAddr, path : & str) -> Self |
SecurityEvent :: fn with_method(mut self, method : & str) -> Self |
SecurityEvent :: fn with_user_agent(mut self, ua : & str) -> Self |
SecurityEvent :: fn with_details(mut self, details : & str) -> Self |
SecurityEvent :: fn with_action(mut self, action : & str) -> Self |
SecurityEventType
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub enum SecurityEventType |
SecurityEventType :: fn as_str(& self) -> & 'static str |
SecurityLogger:SecurityLogger
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct SecurityLogger |
SecurityLogger:ban
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn ban_ip(& self, ip : IpAddr, reason : & str) |
SecurityLogger:cleanup
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn cleanup_old_strikes(& self, max_age : chrono::Duration) |
SecurityLogger:fail2ban
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn fail2ban_unban(& self, ip : IpAddr, jail : & str) -> Result <(), std::io::Error> |
SecurityLogger :: fn fail2ban_ban(& self, ip : IpAddr, jail : & str) -> Result <(), std::io::Error> |
SecurityLogger :: fn fail2ban_available() -> bool |
SecurityLogger:get
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn get_watched(& self, ip : IpAddr) -> Option <WatchedIpRecord> |
SecurityLogger :: fn get_all_watched(& self) -> Vec <(IpAddr, WatchedIpRecord)> |
SecurityLogger :: fn get_blackhole_delay(& self, ip : IpAddr) -> Option <std::time::Duration> |
SecurityLogger :: fn get_strikes(& self, ip : IpAddr) -> u32 |
SecurityLogger:handle
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn handle_honeypot_hit(& self, ip : IpAddr, trap_type : & str, username : & str, password : & str, path : & str,) |
SecurityLogger:is
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn is_watched(& self, ip : IpAddr) -> bool |
SecurityLogger:log
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn log(& self, event : & SecurityEvent) |
fn log_rate_limit(logger : & SecurityLogger, ip : IpAddr, limit : u32, path : & str) |
fn log_pattern_detected(logger : & SecurityLogger, ip : IpAddr, pattern_type : & str, path : & str, matched : & str,) |
fn log_honeypot_hit(logger : & SecurityLogger, ip : IpAddr, trap_type : & str, path : & str, username : & str,) |
fn log_banned_access(logger : & SecurityLogger, ip : IpAddr, path : & str) |
SecurityLogger:new
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn new(config : SecurityLoggerConfig) -> std::io::Result <Self> |
SecurityLogger:pf
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn pf_remove_ip(& self, ip : IpAddr) |
SecurityLogger :: fn pf_available() -> bool |
SecurityLogger:record
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn record_credential(& self, ip : IpAddr, trap_type : & str, username : & str, password : & str, path : & str,) |
SecurityLogger :: fn record_visit(& self, ip : IpAddr, path : & str, method : & str, user_agent : Option <& str>) |
SecurityLogger :: fn record_strike(& self, event : & SecurityEvent) -> bool |
SecurityLogger:reset
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn reset_strikes(& self, ip : IpAddr) |
SecurityLogger:unban
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn unban_ip(& self, ip : IpAddr, reason : & str) |
SecurityLogger:unwatch
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn unwatch_ip(& self, ip : IpAddr) |
SecurityLogger:watch
Security event logging with fail2ban and pf integration.
| Item |
|---|
SecurityLogger :: fn watch_ip(& self, ip : IpAddr, reason : SecurityEventType) |
SecurityLoggerConfig
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct SecurityLoggerConfig |
SecurityLoggerConfig :: fn default() -> Self |
VisitedPath
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct VisitedPath |
WatchedIpRecord
Security event logging with fail2ban and pf integration.
| Item |
|---|
pub struct WatchedIpRecord |
How to use it
From this crate's own rustdoc:
# Usage
From this crate's own rustdoc:
# fail2ban Integration
Configure fail2ban to watch the WAF log file:
Module structure
infrastructure_waf
honeypotpattern_detectorrate_limitersecurity_logger
flowchart TD n_infrastructure_waf["infrastructure_waf"] n_infrastructure_waf --> n_honeypot["honeypot"] n_infrastructure_waf --> n_pattern_detector["pattern_detector"] n_infrastructure_waf --> n_rate_limiter["rate_limiter"] n_infrastructure_waf --> n_security_logger["security_logger"]
Public surface
`crate root`
| Item | What it is |
|---|---|
pub struct WafConfig | WAF configuration. |
WafConfig :: fn default() -> Self | — |
pub struct WafMiddleware | WAF middleware state. |
WafMiddleware :: fn new(config : WafConfig) -> std::io::Result <Self> | Create a new WAF middleware. |
WafMiddleware :: fn layer(self) -> WafLayer | Create a tower Layer for this middleware. |
WafMiddleware :: fn layer_from_arc(waf : Arc <WafMiddleware>) -> WafLayer | Create a tower Layer from an Arc of this middleware |
WafMiddleware :: fn get_config(& self) -> & WafConfig | Get the WAF configuration. |
WafMiddleware :: fn get_logger(& self) -> & SecurityLogger | Get the security logger. |
WafMiddleware :: fn get_rate_limiter(& self) -> & TokenBucketRateLimiter | Get the rate limiter. |
WafMiddleware :: async fn process(& self, req : Request <Body>, connect_info : Option <SocketAddr>, next : Next,) -> Response | Process a request through the WAF. |
pub struct WafLayer | Tower Layer for WAF middleware. |
WafLayer :: fn layer(& self, inner : S) -> Self::Service | — |
pub struct WafService<S> | Tower Service for WAF middleware. |
WafService<S> :: fn poll_ready(& mut self, cx : & mut std::task::Context <'_>,) -> std::task::Poll <Result <(), Self::Error>> | — |
WafService<S> :: fn call(& mut self, req : Request <Body>) -> Self::Future | — |
`honeypot`
| Item | What it is |
|---|---|
pub struct HoneypotConfig | Configuration for honeypot behavior. |
HoneypotConfig :: fn default() -> Self | — |
fn honeypot_routes(config : HoneypotConfig) -> Router | Create honeypot routes for common admin paths |
pub struct DjangoLoginForm | Form data for Django admin login. |
pub struct WpLoginForm | Form data for WordPress login. |
pub struct PhpMyAdminLoginForm | Form data for phpMyAdmin login. |
pub struct AdminerLoginForm | Form data for Adminer login. |
pub struct AdminerAuth | — |
fn mask_password(password : & str) -> String | Mask password for logging (show first char and length). |
`pattern_detector`
| Item | What it is |
|---|---|
pub struct DetectionResult | Result of pattern detection. |
DetectionResult :: fn none() -> Self | Create a "nothing detected" result. |
DetectionResult :: fn none_outbound() -> Self | Create a "nothing detected" result for outbound scanning. |
DetectionResult :: fn detected(pattern_type : & str, matched : & str) -> Self | Create a detection result. |
DetectionResult :: fn detected_outbound(pattern_type : & str, matched : & str) -> Self | Create a detection result for outbound (data leak). |
fn detect_sql_injection(text : & str) -> DetectionResult | Detect SQL injection patterns in text. |
fn detect_xss(text : & str) -> DetectionResult | Detect XSS patterns in text. |
fn detect_path_traversal(text : & str) -> DetectionResult | Detect path traversal patterns in text. |
fn detect_all(text : & str) -> DetectionResult | Detect all attack patterns in text. |
fn detect_ssn(text : & str) -> DetectionResult | Detect Social Security Numbers in text |
fn detect_credit_card(text : & str) -> DetectionResult | Detect credit card numbers in text |
fn detect_api_keys(text : & str) -> DetectionResult | Detect API keys and secrets in text. |
fn scan_response(content : & str) -> DetectionResult | Scan response content for data leaks. |
`rate_limiter`
| Item | What it is |
|---|---|
pub struct RateLimitResult | Result of a rate limit check. |
pub struct TokenBucketRateLimiter | Token bucket rate limiter |
TokenBucketRateLimiter :: fn new(max_requests : u32, window : Duration) -> Self | Create a new rate limiter |
TokenBucketRateLimiter :: fn check(& self, ip : IpAddr) -> RateLimitResult | Check if a request from this IP is allowed. |
TokenBucketRateLimiter :: fn get_remaining(& self, ip : IpAddr) -> u32 | Get remaining requests for an IP without consuming. |
TokenBucketRateLimiter :: fn reset(& self, ip : IpAddr) | Reset rate limit for an IP. |
TokenBucketRateLimiter :: fn cleanup(& self) | Clean up expired buckets (call periodically). |
TokenBucketRateLimiter :: fn default() -> Self | — |
`security_logger`
| Item | What it is |
|---|---|
pub enum SecurityEventType | Security event types. |
SecurityEventType :: fn as_str(& self) -> & 'static str | — |
pub struct SecurityEvent | A security event to be logged. |
SecurityEvent :: fn new(event_type : SecurityEventType, ip : IpAddr, path : & str) -> Self | — |
SecurityEvent :: fn with_method(mut self, method : & str) -> Self | — |
SecurityEvent :: fn with_user_agent(mut self, ua : & str) -> Self | — |
SecurityEvent :: fn with_details(mut self, details : & str) -> Self | — |
SecurityEvent :: fn with_action(mut self, action : & str) -> Self | — |
pub enum HoneypotMode | How to handle honeypot hits. |
pub struct SecurityLoggerConfig | Configuration for security logging. |
SecurityLoggerConfig :: fn default() -> Self | — |
pub struct WatchedIpRecord | Record for watched IPs (intelligence gathering mode). |
pub struct CapturedCredential | Captured credential attempt. |
pub struct VisitedPath | Record of a path visit. |
pub struct SecurityLogger | Security logger with fail2ban and pf integration. |
SecurityLogger :: fn new(config : SecurityLoggerConfig) -> std::io::Result <Self> | Create a new security logger. |
SecurityLogger :: fn is_watched(& self, ip : IpAddr) -> bool | Check if an IP is being watched (intel gathering mode). |
SecurityLogger :: fn get_watched(& self, ip : IpAddr) -> Option <WatchedIpRecord> | Get the watch record for an IP. |
SecurityLogger :: fn watch_ip(& self, ip : IpAddr, reason : SecurityEventType) | Add an IP to the watch list (for intel gathering). |
SecurityLogger :: fn unwatch_ip(& self, ip : IpAddr) | Remove an IP from the watch list. |
SecurityLogger :: fn record_credential(& self, ip : IpAddr, trap_type : & str, username : & str, password : & str, path : & str,) | Record a credential attempt from a watched IP. |
SecurityLogger :: fn record_visit(& self, ip : IpAddr, path : & str, method : & str, user_agent : Option <& str>) | Record a path visit from a watched IP. |
SecurityLogger :: fn get_all_watched(& self) -> Vec <(IpAddr, WatchedIpRecord)> | Get all watched IPs with their records. |
SecurityLogger :: fn handle_honeypot_hit(& self, ip : IpAddr, trap_type : & str, username : & str, password : & str, path : & str,) | Handle a honeypot hit based on configured mode. |
SecurityLogger :: fn get_blackhole_delay(& self, ip : IpAddr) -> Option <std::time::Duration> | Get the blackhole delay if this IP should be tarpitted. |
SecurityLogger :: fn log(& self, event : & SecurityEvent) | Log a security event. |
SecurityLogger :: fn record_strike(& self, event : & SecurityEvent) -> bool | Record a strike against an IP and potentially ban. |
SecurityLogger :: fn ban_ip(& self, ip : IpAddr, reason : & str) | Ban an IP address. |
SecurityLogger :: fn pf_remove_ip(& self, ip : IpAddr) | Remove IP from pf table. |
SecurityLogger :: fn get_strikes(& self, ip : IpAddr) -> u32 | Get strike count for an IP. |
SecurityLogger :: fn reset_strikes(& self, ip : IpAddr) | Reset strikes for an IP. |
SecurityLogger :: fn unban_ip(& self, ip : IpAddr, reason : & str) | Unban an IP address |
SecurityLogger :: fn fail2ban_unban(& self, ip : IpAddr, jail : & str) -> Result <(), std::io::Error> | Execute fail2ban-client to unban an IP |
SecurityLogger :: fn fail2ban_ban(& self, ip : IpAddr, jail : & str) -> Result <(), std::io::Error> | Execute fail2ban-client to ban an IP |
SecurityLogger :: fn fail2ban_available() -> bool | Check if fail2ban-client is available. |
SecurityLogger :: fn pf_available() -> bool | Check if pfctl is available. |
SecurityLogger :: fn cleanup_old_strikes(& self, max_age : chrono::Duration) | Clean up old strike records. |
fn log_rate_limit(logger : & SecurityLogger, ip : IpAddr, limit : u32, path : & str) | Helper functions for common logging patterns. |
fn log_pattern_detected(logger : & SecurityLogger, ip : IpAddr, pattern_type : & str, path : & str, matched : & str,) | — |
fn log_honeypot_hit(logger : & SecurityLogger, ip : IpAddr, trap_type : & str, path : & str, username : & str,) | — |
fn log_banned_access(logger : & SecurityLogger, ip : IpAddr, path : & str) | — |
Re-exports. Exported here, defined elsewhere.
| Export | Defined in |
|---|---|
{CapturedCredential,HoneypotMode,SecurityEvent,SecurityEventType,SecurityLogger,SecurityLoggerConfig,VisitedPath,WatchedIpRecord,} | security_logger::{CapturedCredential,HoneypotMode,SecurityEvent,SecurityEventType,SecurityLogger,SecurityLoggerConfig,VisitedPath,WatchedIpRecord,} |
{RateLimitResult,TokenBucketRateLimiter} | rate_limiter::{RateLimitResult,TokenBucketRateLimiter} |
{detect_all,detect_path_traversal,detect_sql_injection,detect_xss,scan_response,DetectionResult,} | pattern_detector::{detect_all,detect_path_traversal,detect_sql_injection,detect_xss,scan_response,DetectionResult,} |
{honeypot_routes,mask_password,HoneypotConfig} | honeypot::{honeypot_routes,mask_password,HoneypotConfig} |
Boundary
Reaches into foundation.
Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | infrastructure |
| Architectural role (taxonomy) | unclassified (baselined) |
| Location | crates/infrastructure/waf |
| Vocabulary in force (lexicon) | current |
Tier flow. Which tiers this crate's own edges cross.
flowchart LR n_infrastructure["infrastructure"] --> n_foundation["foundation"]
Dependencies
Runtime, in this workspace.
| Crate | Tier | Optional | Only on |
|---|---|---|---|
| `foundation-audit-log` | foundation | no | always |
| `infrastructure-dlp-detect` | infrastructure | no | always |
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
async-trait | ^0.1 | — | no | always |
axum | ^0.7 | multipart | no | always |
chrono | ^0.4 | serde | no | always |
http | ^1.1 | — | no | always |
once_cell | ^1 | — | no | always |
regex | ^1 | — | no | always |
serde | ^1 | derive | no | always |
serde_json | ^1 | — | no | always |
thiserror | ^2 | — | no | always |
time | ^0.3 | — | no | always |
tokio | ^1 | full | no | always |
tower | ^0.5 | — | no | always |
tower-http | ^0.6 | fs, trace, cors, request-id | no | always |
tracing | ^0.1 | — | no | always |
uuid | ^1 | v4, v7, serde, js | no | always |
Development, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
tokio-test | ^0.4 | — | no | always |
Build. None.
Depended on by. 2 workspace crates.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR n_application_security["application-security"] -->|uses| SELF n_application_waf["application-waf"] -->|uses| SELF SELF["infrastructure-waf"] SELF -->|runtime| n_foundation_audit_log["foundation-audit-log"] SELF -->|runtime| n_infrastructure_dlp_detect["infrastructure-dlp-detect"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| lib | infrastructure_waf | `src/lib.rs` |
Error model
No public error type was detected: no public item declares a type named *Error, and no public signature returns one.
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | yes |
| async runtime | yes |
| database access | none detected |
| network I/O | yes |
| unsafe code | none detected |
| environment variables | none detected |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.
Related capabilities
2 workspace crates depend on this one: application-security, application-waf.
Verification
| Kind | Count |
|---|---|
| Unit tests | 26 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 3 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
crate root | 4 | 0 | 2 |
honeypot | 8 | 0 | 0 |
pattern_detector | 9 | 0 | 0 |
rate_limiter | 2 | 0 | 0 |
security_logger | 12 | 0 | 0 |
What the tests establish, by name:
test_adminer_html_generation—src/honeypot.rstest_default_config—src/honeypot.rstest_django_html_generation—src/honeypot.rstest_mask_password—src/honeypot.rstest_phpmyadmin_html_generation—src/honeypot.rstest_wp_html_generation—src/honeypot.rsa_chain_shorter_than_the_trusted_hop_count_falls_back_to_the_peer—src/lib.rsdefault_config_ignores_forwarding_headers_entirely—src/lib.rsno_headers_at_all_uses_the_peer—src/lib.rstest_default_config—src/lib.rstest_excluded_paths—src/lib.rstrusted_proxy_count_defaults_to_zero—src/lib.rswith_one_trusted_hop_the_rightmost_entry_wins_not_the_leftmost—src/lib.rsx_real_ip_is_honoured_only_as_a_trusted_fallback—src/lib.rsx_real_ip_is_ignored_when_no_proxy_is_trusted—src/lib.rstest_credit_card_detection—src/pattern_detector.rstest_path_traversal_detection—src/pattern_detector.rstest_sql_injection_detection—src/pattern_detector.rstest_ssn_detection_behavior—src/pattern_detector.rstest_xss_detection—src/pattern_detector.rstest_rate_limiter_allows_initial_requests—src/rate_limiter.rstest_rate_limiter_blocks_after_limit—src/rate_limiter.rstest_rate_limiter_reset—src/rate_limiter.rstest_event_type_as_str—src/security_logger.rstest_security_event_creation—src/security_logger.rstest_strike_counting—src/security_logger.rs
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 69 | 86 |
Public modules with a //! block | 4 | 4 |
pie showData
title Public items with rustdoc
"Documented" : 69
"No rustdoc detected" : 17
Metrics
| Metric | Value |
|---|---|
| Rust source files | 5 |
| Source lines | 2934 |
| Code lines | 2290 |
| Public API items | 86 |
| Public modules | 4 |
| Tests | 26 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 17 |
| Workspace reverse dependencies | 2 |
pie showData
title Public API by kind
"enum" : 2
"function" : 14
"method" : 51
"struct" : 19
pie showData
title Rust source composition
"Code" : 2290
"Blank or comment" : 644
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.