The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0)
after the rule files, with the six changes and the default
SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response.
SWWAF_WAF_MODE, SWWAF_WAF_PARANOIA_LEVEL, SWWAF_WAF_ANOMALY_THRESHOLD and
SWWAF_WAF_EXEMPT_PATHS as specified; SWWAF_WAF_DISABLED_RULES refuses
900000 to 900999, smallwebwaf's own rules among them. A request with more
query parameters than Coraza reads, 1000, adds 5 (rule 900300). In block
mode a match is refused with 403, an offence counted toward the error
burst; in detect mode it is let through. Both log waf_rule_ids, waf_score
and duration_waf, raise waf_block, and count
smallwebwaf_waf_matches_total.

Judgement call: waf_block is raised in block mode too.
Deviation: no engine-error path; with no body read, Coraza cannot fail.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -36,6 +36,9 @@ const (
 	// ActionRuleBlocked is a request refused because it matched a block
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
+	// ActionWAFBlocked is a request refused because the Core Rule Set
+	// scored it at or over SWWAF_WAF_ANOMALY_THRESHOLD.
+	ActionWAFBlocked = "waf_blocked"
 	// ActionDenied is a request refused because its client is in
 	// SWWAF_DENY_NETS, in a blocklist while SWWAF_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
@@ -123,8 +126,8 @@ type Line struct {
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
-	// ActionBanned, ActionCountryDenied, ActionRateLimited or
-	// ActionRuleBlocked.
+	// ActionBanned, ActionCountryDenied, ActionRateLimited,
+	// ActionRuleBlocked or ActionWAFBlocked.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
@@ -142,6 +145,11 @@ type Line struct {
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
+	// WAFRuleIDs are the ids of the Core Rule Set's rules the request
+	// matched, and WAFScore its anomaly score, nil for a request the Core
+	// Rule Set did not inspect.
+	WAFRuleIDs []int `json:"waf_rule_ids,omitempty"`
+	WAFScore   *int  `json:"waf_score,omitempty"`
 	// LimitHit is the window whose limit the request went over, named as
 	// Counts names its count: minute, hour or day for a rate limit, and
 	// minute_bytes, hour_bytes or day_bytes for a byte limit; or
@@ -159,13 +167,15 @@ type Line struct {
 	BanExpires string `json:"ban_expires,omitempty"`
 
 	// The timings, in milliseconds. DurationChecks is the time until the
-	// checks were done. DurationUpstreamConnect, DurationUpstreamFirstByte
-	// and DurationUpstreamTotal run from when the request was handed to the
+	// checks were done, and DurationWAF the part of it the Core Rule Set
+	// took. DurationUpstreamConnect, DurationUpstreamFirstByte and
+	// DurationUpstreamTotal run from when the request was handed to the
 	// app: until there was a connection to it, until the first byte of its
 	// answer arrived, and until the end. Each but DurationTotal is nil for
 	// a request that did not get that far.
 	DurationTotal             float64  `json:"duration_total"`
 	DurationChecks            *float64 `json:"duration_checks,omitempty"`
+	DurationWAF               *float64 `json:"duration_waf,omitempty"`
 	DurationUpstreamConnect   *float64 `json:"duration_upstream_connect,omitempty"`
 	DurationUpstreamFirstByte *float64 `json:"duration_upstream_first_byte,omitempty"`
 	DurationUpstreamTotal     *float64 `json:"duration_upstream_total,omitempty"`