waf

package
v1.1.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 20, 2026 License: MIT Imports: 17 Imported by: 0

README

WAF

Parity grade: A · SDK aws-sdk-go-v2/service/waf@v1.30.24 · last audited 2026-07-13 (d9aee9cb)

Coverage

Metric Value
Operations audited 4 (2 ok, 2 partial)
Feature families 16 (16 ok)
Known gaps 2
Deferred items 0
Resource leaks clean
Known gaps
  • WAFNonEmptyEntityException not modeled (DeleteWebACL/DeleteRule/DeleteByteMatchSet/etc. with real AWS reject deletion of an object that still contains children -- e.g. a WebACL that still has Rules, a Rule that still has Predicates, a ByteMatchSet that still has ByteMatchTuples). Only the separate WAFReferencedItemException (deleting an object still referenced BY another object) was fixed this pass; the "still contains children" check is a distinct, real gap left for a follow-up (bd: file on session close).
  • GetSampledRequests/GetRateBasedRuleManagedKeys return empty data (traffic-inspection stub) since gopherstack does not proxy real HTTP requests through WAF rule evaluation -- architectural limitation, not a quick fix.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	// ErrNotFound is returned when a resource does not exist.
	ErrNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrStaleToken is returned when the change token is stale.
	ErrStaleToken = awserr.New(errStaleData, awserr.ErrConflict)
	// ErrInvalidParameter is returned on invalid input.
	ErrInvalidParameter = awserr.New(errInvalidParameter, awserr.ErrInvalidParameter)
	// ErrReferencedItem is returned when a resource is still referenced.
	ErrReferencedItem = awserr.New(errReferencedItem, awserr.ErrConflict)
)
View Source
var ErrNilAppContext = errors.New("waf: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ActivatedRule

type ActivatedRule struct {
	Action         *WafAction         `json:"Action,omitempty"`
	OverrideAction *WafOverrideAction `json:"OverrideAction,omitempty"`
	RuleId         string             `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
	Type           string             `json:"Type,omitempty"`
	ExcludedRules  []ExcludedRule     `json:"ExcludedRules,omitempty"`
	Priority       int32              `json:"Priority"`
}

ActivatedRule represents a rule activated in a WebACL.

type ActivatedRuleUpdate

type ActivatedRuleUpdate struct {
	Action        string        `json:"Action"`
	ActivatedRule ActivatedRule `json:"ActivatedRule"`
}

ActivatedRuleUpdate specifies a rule to insert into or delete from a RuleGroup.

type ByteMatchSet

type ByteMatchSet struct {
	ByteMatchSetId  string           `json:"ByteMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name            string           `json:"Name"`
	ByteMatchTuples []ByteMatchTuple `json:"ByteMatchTuples"`
}

ByteMatchSet is a WAF Classic byte match set.

type ByteMatchSetSummary

type ByteMatchSetSummary struct {
	ByteMatchSetId string `json:"ByteMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name           string `json:"Name"`
}

ByteMatchSetSummary is a summary of a ByteMatchSet.

type ByteMatchSetUpdate

type ByteMatchSetUpdate struct {
	Action         string         `json:"Action"`
	ByteMatchTuple ByteMatchTuple `json:"ByteMatchTuple"`
}

ByteMatchSetUpdate specifies a tuple to insert into or delete from a ByteMatchSet.

type ByteMatchTuple

type ByteMatchTuple struct {
	FieldToMatch         FieldToMatch `json:"FieldToMatch"`
	PositionalConstraint string       `json:"PositionalConstraint"`
	TargetString         string       `json:"TargetString"` // base64-encoded in AWS, plain string here
	TextTransformation   string       `json:"TextTransformation"`
}

ByteMatchTuple specifies a match in a byte match set.

type ExcludedRule

type ExcludedRule struct {
	RuleId string `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
}

ExcludedRule specifies a rule to exclude from a rule group.

type FieldToMatch

type FieldToMatch struct {
	Type string `json:"Type"`
	Data string `json:"Data,omitempty"`
}

FieldToMatch specifies where in a web request to look.

type GeoMatchConstraint

type GeoMatchConstraint struct {
	Type  string `json:"Type"`
	Value string `json:"Value"`
}

GeoMatchConstraint specifies a geo match constraint.

type GeoMatchSet

type GeoMatchSet struct {
	GeoMatchSetId       string               `json:"GeoMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name                string               `json:"Name"`
	GeoMatchConstraints []GeoMatchConstraint `json:"GeoMatchConstraints"`
}

GeoMatchSet is a WAF Classic geo match set.

type GeoMatchSetSummary

type GeoMatchSetSummary struct {
	GeoMatchSetId string `json:"GeoMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name          string `json:"Name"`
}

GeoMatchSetSummary is a summary of a GeoMatchSet.

type GeoMatchSetUpdate

type GeoMatchSetUpdate struct {
	Action             string             `json:"Action"`
	GeoMatchConstraint GeoMatchConstraint `json:"GeoMatchConstraint"`
}

GeoMatchSetUpdate specifies a constraint to insert or delete.

type Handler

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler serves WAF Classic JSON operations.

func NewHandler

func NewHandler(b StorageBackend) *Handler

NewHandler creates a WAF Classic handler backed by b.

func (*Handler) ExtractOperation

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the WAF Classic action from the X-Amz-Target header.

func (*Handler) ExtractResource

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource extracts a resource identifier from the JSON body.

func (*Handler) GetSupportedOperations

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns all implemented operation names.

func (*Handler) Handler

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority

func (h *Handler) MatchPriority() int

MatchPriority returns header matching priority.

func (*Handler) Name

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset

func (h *Handler) Reset()

Reset clears backend state.

func (*Handler) Restore

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore restores the backend state from a snapshot.

func (*Handler) RouteMatcher

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches WAF Classic X-Amz-Target headers.

func (*Handler) Snapshot

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot returns a serialized snapshot of the backend state.

type IPSet

type IPSet struct {
	IPSetId          string            `json:"IPSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name             string            `json:"Name"`
	IPSetDescriptors []IPSetDescriptor `json:"IPSetDescriptors"`
}

IPSet is a WAF Classic IP set.

type IPSetDescriptor

type IPSetDescriptor struct {
	Type  string `json:"Type"`
	Value string `json:"Value"`
}

IPSetDescriptor is an IP address type and CIDR range.

type IPSetSummary

type IPSetSummary struct {
	IPSetId string `json:"IPSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name    string `json:"Name"`
}

IPSetSummary is a summary of an IPSet.

type IPSetUpdate

type IPSetUpdate struct {
	Action          string          `json:"Action"`
	IPSetDescriptor IPSetDescriptor `json:"IPSetDescriptor"`
}

IPSetUpdate specifies a descriptor to insert into or delete from an IPSet.

type InMemoryBackend

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory implementation of StorageBackend for WAF Classic.

func NewInMemoryBackend

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AccountID

func (b *InMemoryBackend) AccountID() string

AccountID returns the configured account ID.

func (*InMemoryBackend) CreateByteMatchSet

func (b *InMemoryBackend) CreateByteMatchSet(name, changeToken string) (*ByteMatchSet, error)

CreateByteMatchSet creates a new ByteMatchSet.

func (*InMemoryBackend) CreateGeoMatchSet

func (b *InMemoryBackend) CreateGeoMatchSet(name, changeToken string) (*GeoMatchSet, error)

CreateGeoMatchSet creates a new GeoMatchSet.

func (*InMemoryBackend) CreateIPSet

func (b *InMemoryBackend) CreateIPSet(name, changeToken string, tags map[string]string) (*IPSet, error)

CreateIPSet creates a new IPSet.

func (*InMemoryBackend) CreateRateBasedRule

func (b *InMemoryBackend) CreateRateBasedRule(
	name, metricName, rateKey string,
	rateLimit int64,
	changeToken string,
	tags map[string]string,
) (*RateBasedRule, error)

CreateRateBasedRule creates a new RateBasedRule.

func (*InMemoryBackend) CreateRegexMatchSet

func (b *InMemoryBackend) CreateRegexMatchSet(name, changeToken string) (*RegexMatchSet, error)

CreateRegexMatchSet creates a new RegexMatchSet.

func (*InMemoryBackend) CreateRegexPatternSet

func (b *InMemoryBackend) CreateRegexPatternSet(name, changeToken string) (*RegexPatternSet, error)

CreateRegexPatternSet creates a new RegexPatternSet.

func (*InMemoryBackend) CreateRule

func (b *InMemoryBackend) CreateRule(
	name, metricName, changeToken string,
	tags map[string]string,
) (*Rule, error)

CreateRule creates a new Rule.

func (*InMemoryBackend) CreateRuleGroup

func (b *InMemoryBackend) CreateRuleGroup(
	name, metricName, changeToken string,
	tags map[string]string,
) (*RuleGroup, error)

CreateRuleGroup creates a new RuleGroup.

func (*InMemoryBackend) CreateSizeConstraintSet

func (b *InMemoryBackend) CreateSizeConstraintSet(name, changeToken string) (*SizeConstraintSet, error)

CreateSizeConstraintSet creates a new SizeConstraintSet.

func (*InMemoryBackend) CreateSqlInjectionMatchSet

func (b *InMemoryBackend) CreateSqlInjectionMatchSet(
	name, changeToken string,
) (*SqlInjectionMatchSet, error)

CreateSqlInjectionMatchSet creates a new SqlInjectionMatchSet.

func (*InMemoryBackend) CreateWebACL

func (b *InMemoryBackend) CreateWebACL(
	name, metricName string,
	defaultAction WafAction,
	changeToken string,
	tags map[string]string,
) (*WebACL, error)

CreateWebACL creates a new WebACL.

func (*InMemoryBackend) CreateXssMatchSet

func (b *InMemoryBackend) CreateXssMatchSet(name, changeToken string) (*XssMatchSet, error)

CreateXssMatchSet creates a new XssMatchSet.

func (*InMemoryBackend) DeleteByteMatchSet

func (b *InMemoryBackend) DeleteByteMatchSet(id, changeToken string) error

DeleteByteMatchSet deletes a ByteMatchSet.

func (*InMemoryBackend) DeleteGeoMatchSet

func (b *InMemoryBackend) DeleteGeoMatchSet(id, changeToken string) error

DeleteGeoMatchSet deletes a GeoMatchSet.

func (*InMemoryBackend) DeleteIPSet

func (b *InMemoryBackend) DeleteIPSet(id, changeToken string) error

DeleteIPSet deletes an IPSet.

func (*InMemoryBackend) DeleteLoggingConfiguration

func (b *InMemoryBackend) DeleteLoggingConfiguration(resourceArn string) error

DeleteLoggingConfiguration removes the logging configuration for a WebACL ARN.

func (*InMemoryBackend) DeletePermissionPolicy

func (b *InMemoryBackend) DeletePermissionPolicy(resourceArn string) error

DeletePermissionPolicy removes the permission policy for a resource ARN.

func (*InMemoryBackend) DeleteRateBasedRule

func (b *InMemoryBackend) DeleteRateBasedRule(id, changeToken string) error

DeleteRateBasedRule deletes a RateBasedRule.

func (*InMemoryBackend) DeleteRegexMatchSet

func (b *InMemoryBackend) DeleteRegexMatchSet(id, changeToken string) error

DeleteRegexMatchSet deletes a RegexMatchSet.

func (*InMemoryBackend) DeleteRegexPatternSet

func (b *InMemoryBackend) DeleteRegexPatternSet(id, changeToken string) error

DeleteRegexPatternSet deletes a RegexPatternSet.

func (*InMemoryBackend) DeleteRule

func (b *InMemoryBackend) DeleteRule(id, changeToken string) error

DeleteRule deletes a Rule.

func (*InMemoryBackend) DeleteRuleGroup

func (b *InMemoryBackend) DeleteRuleGroup(id, changeToken string) error

DeleteRuleGroup deletes a RuleGroup.

func (*InMemoryBackend) DeleteSizeConstraintSet

func (b *InMemoryBackend) DeleteSizeConstraintSet(id, changeToken string) error

DeleteSizeConstraintSet deletes a SizeConstraintSet.

func (*InMemoryBackend) DeleteSqlInjectionMatchSet

func (b *InMemoryBackend) DeleteSqlInjectionMatchSet(id, changeToken string) error

DeleteSqlInjectionMatchSet deletes a SqlInjectionMatchSet.

func (*InMemoryBackend) DeleteWebACL

func (b *InMemoryBackend) DeleteWebACL(id, changeToken string) error

DeleteWebACL deletes a WebACL.

func (*InMemoryBackend) DeleteXssMatchSet

func (b *InMemoryBackend) DeleteXssMatchSet(id, changeToken string) error

DeleteXssMatchSet deletes an XssMatchSet.

func (*InMemoryBackend) GetByteMatchSet

func (b *InMemoryBackend) GetByteMatchSet(id string) (*ByteMatchSet, error)

GetByteMatchSet retrieves a ByteMatchSet by ID.

func (*InMemoryBackend) GetChangeToken

func (b *InMemoryBackend) GetChangeToken() string

GetChangeToken returns a new change token in PROVISIONED state.

func (*InMemoryBackend) GetChangeTokenStatus

func (b *InMemoryBackend) GetChangeTokenStatus(token string) string

GetChangeTokenStatus returns the status of a change token. Unknown tokens return INSYNC, matching real AWS WAF Classic behavior.

func (*InMemoryBackend) GetGeoMatchSet

func (b *InMemoryBackend) GetGeoMatchSet(id string) (*GeoMatchSet, error)

GetGeoMatchSet retrieves a GeoMatchSet by ID.

func (*InMemoryBackend) GetIPSet

func (b *InMemoryBackend) GetIPSet(id string) (*IPSet, error)

GetIPSet retrieves an IPSet by ID.

func (*InMemoryBackend) GetLoggingConfiguration

func (b *InMemoryBackend) GetLoggingConfiguration(resourceArn string) (*LoggingConfiguration, error)

GetLoggingConfiguration retrieves the logging configuration for a WebACL ARN.

func (*InMemoryBackend) GetPermissionPolicy

func (b *InMemoryBackend) GetPermissionPolicy(resourceArn string) (string, error)

GetPermissionPolicy retrieves the permission policy for a resource ARN.

func (*InMemoryBackend) GetRateBasedRule

func (b *InMemoryBackend) GetRateBasedRule(id string) (*RateBasedRule, error)

GetRateBasedRule retrieves a RateBasedRule by ID.

func (*InMemoryBackend) GetRateBasedRuleManagedKeys

func (b *InMemoryBackend) GetRateBasedRuleManagedKeys(id string) ([]string, error)

GetRateBasedRuleManagedKeys returns the IP addresses currently blocked by a rate-based rule (stub).

func (*InMemoryBackend) GetRegexMatchSet

func (b *InMemoryBackend) GetRegexMatchSet(id string) (*RegexMatchSet, error)

GetRegexMatchSet retrieves a RegexMatchSet by ID.

func (*InMemoryBackend) GetRegexPatternSet

func (b *InMemoryBackend) GetRegexPatternSet(id string) (*RegexPatternSet, error)

GetRegexPatternSet retrieves a RegexPatternSet by ID.

func (*InMemoryBackend) GetRule

func (b *InMemoryBackend) GetRule(id string) (*Rule, error)

GetRule retrieves a Rule by ID.

func (*InMemoryBackend) GetRuleGroup

func (b *InMemoryBackend) GetRuleGroup(id string) (*RuleGroup, error)

GetRuleGroup retrieves a RuleGroup by ID.

func (*InMemoryBackend) GetSampledRequests

func (b *InMemoryBackend) GetSampledRequests(_, _ string, _ int64) []SampledHTTPRequest

GetSampledRequests returns an empty sample (stub).

func (*InMemoryBackend) GetSizeConstraintSet

func (b *InMemoryBackend) GetSizeConstraintSet(id string) (*SizeConstraintSet, error)

GetSizeConstraintSet retrieves a SizeConstraintSet by ID.

func (*InMemoryBackend) GetSqlInjectionMatchSet

func (b *InMemoryBackend) GetSqlInjectionMatchSet(id string) (*SqlInjectionMatchSet, error)

GetSqlInjectionMatchSet retrieves a SqlInjectionMatchSet by ID.

func (*InMemoryBackend) GetWebACL

func (b *InMemoryBackend) GetWebACL(id string) (*WebACL, error)

GetWebACL retrieves a WebACL by ID.

func (*InMemoryBackend) GetXssMatchSet

func (b *InMemoryBackend) GetXssMatchSet(id string) (*XssMatchSet, error)

GetXssMatchSet retrieves an XssMatchSet by ID.

func (*InMemoryBackend) ListActivatedRulesInRuleGroup

func (b *InMemoryBackend) ListActivatedRulesInRuleGroup(id string) ([]ActivatedRule, error)

ListActivatedRulesInRuleGroup returns the activated rules for a RuleGroup.

func (*InMemoryBackend) ListByteMatchSets

func (b *InMemoryBackend) ListByteMatchSets() []ByteMatchSetSummary

ListByteMatchSets returns summaries of all ByteMatchSets.

func (*InMemoryBackend) ListGeoMatchSets

func (b *InMemoryBackend) ListGeoMatchSets() []GeoMatchSetSummary

ListGeoMatchSets returns summaries of all GeoMatchSets.

func (*InMemoryBackend) ListIPSets

func (b *InMemoryBackend) ListIPSets() []IPSetSummary

ListIPSets returns summaries of all IPSets.

func (*InMemoryBackend) ListLoggingConfigurations

func (b *InMemoryBackend) ListLoggingConfigurations() []LoggingConfiguration

ListLoggingConfigurations returns all logging configurations.

func (*InMemoryBackend) ListRateBasedRules

func (b *InMemoryBackend) ListRateBasedRules() []RateBasedRuleSummary

ListRateBasedRules returns summaries of all RateBasedRules.

func (*InMemoryBackend) ListRegexMatchSets

func (b *InMemoryBackend) ListRegexMatchSets() []RegexMatchSetSummary

ListRegexMatchSets returns summaries of all RegexMatchSets.

func (*InMemoryBackend) ListRegexPatternSets

func (b *InMemoryBackend) ListRegexPatternSets() []RegexPatternSetSummary

ListRegexPatternSets returns summaries of all RegexPatternSets.

func (*InMemoryBackend) ListRuleGroups

func (b *InMemoryBackend) ListRuleGroups() []RuleGroupSummary

ListRuleGroups returns summaries of all RuleGroups.

func (*InMemoryBackend) ListRules

func (b *InMemoryBackend) ListRules() []RuleSummary

ListRules returns summaries of all Rules.

func (*InMemoryBackend) ListSizeConstraintSets

func (b *InMemoryBackend) ListSizeConstraintSets() []SizeConstraintSetSummary

ListSizeConstraintSets returns summaries of all SizeConstraintSets.

func (*InMemoryBackend) ListSqlInjectionMatchSets

func (b *InMemoryBackend) ListSqlInjectionMatchSets() []SqlInjectionMatchSetSummary

ListSqlInjectionMatchSets returns summaries of all SqlInjectionMatchSets.

func (*InMemoryBackend) ListSubscribedRuleGroups

func (b *InMemoryBackend) ListSubscribedRuleGroups() []SubscribedRuleGroupSummary

ListSubscribedRuleGroups returns subscribed rule groups (always empty in mock).

func (*InMemoryBackend) ListTagsForResource

func (b *InMemoryBackend) ListTagsForResource(arn string) ([]Tag, error)

ListTagsForResource returns the tags for a resource ARN.

func (*InMemoryBackend) ListWebACLs

func (b *InMemoryBackend) ListWebACLs() []WebACLSummary

ListWebACLs returns summaries of all WebACLs.

func (*InMemoryBackend) ListXssMatchSets

func (b *InMemoryBackend) ListXssMatchSets() []XssMatchSetSummary

ListXssMatchSets returns summaries of all XssMatchSets.

func (*InMemoryBackend) MarkChangeTokenUsed

func (b *InMemoryBackend) MarkChangeTokenUsed(token string)

MarkChangeTokenUsed transitions a change token from PROVISIONED to INSYNC.

func (*InMemoryBackend) PutLoggingConfiguration

func (b *InMemoryBackend) PutLoggingConfiguration(config LoggingConfiguration) (*LoggingConfiguration, error)

PutLoggingConfiguration stores a logging configuration for a WebACL.

func (*InMemoryBackend) PutPermissionPolicy

func (b *InMemoryBackend) PutPermissionPolicy(resourceArn, policy string) error

PutPermissionPolicy stores a permission policy for a resource ARN.

func (*InMemoryBackend) Region

func (b *InMemoryBackend) Region() string

Region returns the configured region.

func (*InMemoryBackend) Reset

func (b *InMemoryBackend) Reset()

Reset clears all backend state.

func (*InMemoryBackend) Restore

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON.

func (*InMemoryBackend) Snapshot

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON.

func (*InMemoryBackend) TagResource

func (b *InMemoryBackend) TagResource(arn string, tags map[string]string) error

TagResource adds tags to a resource identified by ARN.

func (*InMemoryBackend) UntagResource

func (b *InMemoryBackend) UntagResource(arn string, keys []string) error

UntagResource removes tags from a resource identified by ARN.

func (*InMemoryBackend) UpdateByteMatchSet

func (b *InMemoryBackend) UpdateByteMatchSet(id, changeToken string, updates []ByteMatchSetUpdate) error

UpdateByteMatchSet updates a ByteMatchSet's tuples.

func (*InMemoryBackend) UpdateGeoMatchSet

func (b *InMemoryBackend) UpdateGeoMatchSet(id, changeToken string, updates []GeoMatchSetUpdate) error

UpdateGeoMatchSet updates a GeoMatchSet's constraints.

func (*InMemoryBackend) UpdateIPSet

func (b *InMemoryBackend) UpdateIPSet(id, changeToken string, updates []IPSetUpdate) error

UpdateIPSet updates an IPSet's descriptors.

func (*InMemoryBackend) UpdateRateBasedRule

func (b *InMemoryBackend) UpdateRateBasedRule(
	id, changeToken string,
	rateLimit int64,
	updates []RuleUpdate,
) error

UpdateRateBasedRule updates a RateBasedRule's predicates and rate limit.

func (*InMemoryBackend) UpdateRegexMatchSet

func (b *InMemoryBackend) UpdateRegexMatchSet(id, changeToken string, updates []RegexMatchSetUpdate) error

UpdateRegexMatchSet updates a RegexMatchSet's tuples.

func (*InMemoryBackend) UpdateRegexPatternSet

func (b *InMemoryBackend) UpdateRegexPatternSet(id, changeToken string, updates []RegexPatternSetUpdate) error

UpdateRegexPatternSet updates a RegexPatternSet's pattern strings.

func (*InMemoryBackend) UpdateRule

func (b *InMemoryBackend) UpdateRule(id, changeToken string, updates []RuleUpdate) error

UpdateRule updates a Rule's predicates.

func (*InMemoryBackend) UpdateRuleGroup

func (b *InMemoryBackend) UpdateRuleGroup(id, changeToken string, updates []ActivatedRuleUpdate) error

UpdateRuleGroup updates a RuleGroup's activated rules.

func (*InMemoryBackend) UpdateSizeConstraintSet

func (b *InMemoryBackend) UpdateSizeConstraintSet(
	id, changeToken string,
	updates []SizeConstraintSetUpdate,
) error

UpdateSizeConstraintSet updates a SizeConstraintSet's constraints.

func (*InMemoryBackend) UpdateSqlInjectionMatchSet

func (b *InMemoryBackend) UpdateSqlInjectionMatchSet(
	id, changeToken string,
	updates []SqlInjectionMatchSetUpdate,
) error

UpdateSqlInjectionMatchSet updates a SqlInjectionMatchSet's tuples.

func (*InMemoryBackend) UpdateWebACL

func (b *InMemoryBackend) UpdateWebACL(
	id, changeToken string,
	defaultAction *WafAction,
	updates []WebACLUpdate,
) error

UpdateWebACL updates a WebACL's default action and rules.

func (*InMemoryBackend) UpdateXssMatchSet

func (b *InMemoryBackend) UpdateXssMatchSet(id, changeToken string, updates []XssMatchSetUpdate) error

UpdateXssMatchSet updates an XssMatchSet's tuples.

type LoggingConfiguration

type LoggingConfiguration struct {
	ResourceArn           string         `json:"ResourceArn"`
	LogDestinationConfigs []string       `json:"LogDestinationConfigs"`
	RedactedFields        []FieldToMatch `json:"RedactedFields,omitempty"`
}

LoggingConfiguration is a WAF Classic logging configuration.

type Predicate

type Predicate struct {
	DataId  string `json:"DataId"` //nolint:revive,staticcheck // AWS SDK field name
	Type    string `json:"Type"`
	Negated bool   `json:"Negated"`
}

Predicate represents a condition in a Rule.

type Provider

type Provider struct{}

Provider implements service.Provider for AWS WAF Classic.

func (*Provider) Init

Init initializes the WAF Classic service backend and handler.

func (*Provider) Name

func (p *Provider) Name() string

Name returns the provider name.

type RateBasedRule

type RateBasedRule struct {
	RuleId          string      `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
	Name            string      `json:"Name"`
	MetricName      string      `json:"MetricName"`
	RateKey         string      `json:"RateKey"`
	MatchPredicates []Predicate `json:"MatchPredicates"`
	RateLimit       int64       `json:"RateLimit"`
}

RateBasedRule is a WAF Classic rate-based rule.

type RateBasedRuleSummary

type RateBasedRuleSummary struct {
	RuleId string `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
	Name   string `json:"Name"`
}

RateBasedRuleSummary is a summary of a RateBasedRule.

type RegexMatchSet

type RegexMatchSet struct {
	RegexMatchSetId  string            `json:"RegexMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name             string            `json:"Name"`
	RegexMatchTuples []RegexMatchTuple `json:"RegexMatchTuples"`
}

RegexMatchSet is a WAF Classic regex match set.

type RegexMatchSetSummary

type RegexMatchSetSummary struct {
	RegexMatchSetId string `json:"RegexMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name            string `json:"Name"`
}

RegexMatchSetSummary is a summary of a RegexMatchSet.

type RegexMatchSetUpdate

type RegexMatchSetUpdate struct {
	Action          string          `json:"Action"`
	RegexMatchTuple RegexMatchTuple `json:"RegexMatchTuple"`
}

RegexMatchSetUpdate specifies a tuple to insert or delete.

type RegexMatchTuple

type RegexMatchTuple struct {
	FieldToMatch       FieldToMatch `json:"FieldToMatch"`
	TextTransformation string       `json:"TextTransformation"`
	RegexPatternSetId  string       `json:"RegexPatternSetId"` //nolint:revive,staticcheck // AWS SDK field name
}

RegexMatchTuple specifies a regex match tuple.

type RegexPatternSet

type RegexPatternSet struct {
	RegexPatternSetId   string   `json:"RegexPatternSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name                string   `json:"Name"`
	RegexPatternStrings []string `json:"RegexPatternStrings"`
}

RegexPatternSet is a WAF Classic regex pattern set.

type RegexPatternSetSummary

type RegexPatternSetSummary struct {
	RegexPatternSetId string `json:"RegexPatternSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name              string `json:"Name"`
}

RegexPatternSetSummary is a summary of a RegexPatternSet.

type RegexPatternSetUpdate

type RegexPatternSetUpdate struct {
	Action             string `json:"Action"`
	RegexPatternString string `json:"RegexPatternString"`
}

RegexPatternSetUpdate specifies a pattern string to insert or delete.

type Rule

type Rule struct {
	RuleId     string      `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
	Name       string      `json:"Name"`
	MetricName string      `json:"MetricName"`
	Predicates []Predicate `json:"Predicates"`
}

Rule is a WAF Classic rule.

type RuleGroup

type RuleGroup struct {
	RuleGroupId string `json:"RuleGroupId"` //nolint:revive,staticcheck // AWS SDK field name
	Name        string `json:"Name"`
	MetricName  string `json:"MetricName"`
}

RuleGroup is a WAF Classic rule group.

type RuleGroupSummary

type RuleGroupSummary struct {
	RuleGroupId string `json:"RuleGroupId"` //nolint:revive,staticcheck // AWS SDK field name
	Name        string `json:"Name"`
}

RuleGroupSummary is a summary of a RuleGroup.

type RuleSummary

type RuleSummary struct {
	RuleId string `json:"RuleId"` //nolint:revive,staticcheck // AWS SDK field name
	Name   string `json:"Name"`
}

RuleSummary is a summary of a Rule.

type RuleUpdate

type RuleUpdate struct {
	Action    string    `json:"Action"`
	Predicate Predicate `json:"Predicate"`
}

RuleUpdate specifies a predicate to insert into or delete from a Rule.

type SampledHTTPRequest

type SampledHTTPRequest struct {
	RuleId string `json:"RuleWithinRuleGroup,omitempty"` //nolint:revive,staticcheck // AWS SDK field name
	Action string `json:"Action,omitempty"`
	Weight int64  `json:"Weight"`
}

SampledHTTPRequest is a sampled HTTP request.

type SizeConstraint

type SizeConstraint struct {
	FieldToMatch       FieldToMatch `json:"FieldToMatch"`
	ComparisonOperator string       `json:"ComparisonOperator"`
	TextTransformation string       `json:"TextTransformation"`
	Size               int64        `json:"Size"`
}

SizeConstraint specifies a size constraint.

type SizeConstraintSet

type SizeConstraintSet struct {
	SizeConstraintSetId string           `json:"SizeConstraintSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name                string           `json:"Name"`
	SizeConstraints     []SizeConstraint `json:"SizeConstraints"`
}

SizeConstraintSet is a WAF Classic size constraint set.

type SizeConstraintSetSummary

type SizeConstraintSetSummary struct {
	SizeConstraintSetId string `json:"SizeConstraintSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name                string `json:"Name"`
}

SizeConstraintSetSummary is a summary of a SizeConstraintSet.

type SizeConstraintSetUpdate

type SizeConstraintSetUpdate struct {
	Action         string         `json:"Action"`
	SizeConstraint SizeConstraint `json:"SizeConstraint"`
}

SizeConstraintSetUpdate specifies a constraint to insert or delete.

type SqlInjectionMatchSet

type SqlInjectionMatchSet struct {
	//nolint:revive,staticcheck // AWS SDK naming
	SqlInjectionMatchSetId string `json:"SqlInjectionMatchSetId"`
	Name                   string `json:"Name"`
	//nolint:revive,staticcheck // AWS SDK naming
	SqlInjectionMatchTuples []SqlInjectionMatchTuple `json:"SqlInjectionMatchTuples"`
}

SqlInjectionMatchSet is a WAF Classic SQL injection match set.

type SqlInjectionMatchSetSummary

type SqlInjectionMatchSetSummary struct {
	SqlInjectionMatchSetId string `json:"SqlInjectionMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name                   string `json:"Name"`
}

SqlInjectionMatchSetSummary is a summary of a SqlInjectionMatchSet.

type SqlInjectionMatchSetUpdate

type SqlInjectionMatchSetUpdate struct {
	Action string `json:"Action"`
	//nolint:revive,staticcheck // AWS SDK naming
	SqlInjectionMatchTuple SqlInjectionMatchTuple `json:"SqlInjectionMatchTuple"`
}

SqlInjectionMatchSetUpdate specifies a tuple to insert or delete.

type SqlInjectionMatchTuple

type SqlInjectionMatchTuple struct {
	FieldToMatch       FieldToMatch `json:"FieldToMatch"`
	TextTransformation string       `json:"TextTransformation"`
}

SqlInjectionMatchTuple specifies a SQL injection match tuple.

type StorageBackend

type StorageBackend interface {
	// Change tokens
	GetChangeToken() string
	GetChangeTokenStatus(token string) string
	MarkChangeTokenUsed(token string)

	// WebACL
	CreateWebACL(
		name, metricName string,
		defaultAction WafAction,
		changeToken string,
		tags map[string]string,
	) (*WebACL, error)
	GetWebACL(id string) (*WebACL, error)
	UpdateWebACL(id, changeToken string, defaultAction *WafAction, updates []WebACLUpdate) error
	DeleteWebACL(id, changeToken string) error
	ListWebACLs() []WebACLSummary

	// Rule
	CreateRule(name, metricName, changeToken string, tags map[string]string) (*Rule, error)
	GetRule(id string) (*Rule, error)
	UpdateRule(id, changeToken string, updates []RuleUpdate) error
	DeleteRule(id, changeToken string) error
	ListRules() []RuleSummary

	// IPSet
	CreateIPSet(name, changeToken string, tags map[string]string) (*IPSet, error)
	GetIPSet(id string) (*IPSet, error)
	UpdateIPSet(id, changeToken string, updates []IPSetUpdate) error
	DeleteIPSet(id, changeToken string) error
	ListIPSets() []IPSetSummary

	// ByteMatchSet
	CreateByteMatchSet(name, changeToken string) (*ByteMatchSet, error)
	GetByteMatchSet(id string) (*ByteMatchSet, error)
	UpdateByteMatchSet(id, changeToken string, updates []ByteMatchSetUpdate) error
	DeleteByteMatchSet(id, changeToken string) error
	ListByteMatchSets() []ByteMatchSetSummary

	// SizeConstraintSet
	CreateSizeConstraintSet(name, changeToken string) (*SizeConstraintSet, error)
	GetSizeConstraintSet(id string) (*SizeConstraintSet, error)
	UpdateSizeConstraintSet(id, changeToken string, updates []SizeConstraintSetUpdate) error
	DeleteSizeConstraintSet(id, changeToken string) error
	ListSizeConstraintSets() []SizeConstraintSetSummary

	// SqlInjectionMatchSet
	CreateSqlInjectionMatchSet(name, changeToken string) (*SqlInjectionMatchSet, error)
	GetSqlInjectionMatchSet(id string) (*SqlInjectionMatchSet, error)
	UpdateSqlInjectionMatchSet(id, changeToken string, updates []SqlInjectionMatchSetUpdate) error
	DeleteSqlInjectionMatchSet(id, changeToken string) error
	ListSqlInjectionMatchSets() []SqlInjectionMatchSetSummary

	// XssMatchSet
	CreateXssMatchSet(name, changeToken string) (*XssMatchSet, error)
	GetXssMatchSet(id string) (*XssMatchSet, error)
	UpdateXssMatchSet(id, changeToken string, updates []XssMatchSetUpdate) error
	DeleteXssMatchSet(id, changeToken string) error
	ListXssMatchSets() []XssMatchSetSummary

	// GeoMatchSet
	CreateGeoMatchSet(name, changeToken string) (*GeoMatchSet, error)
	GetGeoMatchSet(id string) (*GeoMatchSet, error)
	UpdateGeoMatchSet(id, changeToken string, updates []GeoMatchSetUpdate) error
	DeleteGeoMatchSet(id, changeToken string) error
	ListGeoMatchSets() []GeoMatchSetSummary

	// RateBasedRule
	CreateRateBasedRule(
		name, metricName, rateKey string, rateLimit int64, changeToken string, tags map[string]string,
	) (*RateBasedRule, error)
	GetRateBasedRule(id string) (*RateBasedRule, error)
	UpdateRateBasedRule(id, changeToken string, rateLimit int64, updates []RuleUpdate) error
	DeleteRateBasedRule(id, changeToken string) error
	ListRateBasedRules() []RateBasedRuleSummary
	GetRateBasedRuleManagedKeys(id string) ([]string, error)

	// RegexPatternSet
	CreateRegexPatternSet(name, changeToken string) (*RegexPatternSet, error)
	GetRegexPatternSet(id string) (*RegexPatternSet, error)
	UpdateRegexPatternSet(id, changeToken string, updates []RegexPatternSetUpdate) error
	DeleteRegexPatternSet(id, changeToken string) error
	ListRegexPatternSets() []RegexPatternSetSummary

	// RegexMatchSet
	CreateRegexMatchSet(name, changeToken string) (*RegexMatchSet, error)
	GetRegexMatchSet(id string) (*RegexMatchSet, error)
	UpdateRegexMatchSet(id, changeToken string, updates []RegexMatchSetUpdate) error
	DeleteRegexMatchSet(id, changeToken string) error
	ListRegexMatchSets() []RegexMatchSetSummary

	// RuleGroup
	CreateRuleGroup(name, metricName, changeToken string, tags map[string]string) (*RuleGroup, error)
	GetRuleGroup(id string) (*RuleGroup, error)
	UpdateRuleGroup(id, changeToken string, updates []ActivatedRuleUpdate) error
	DeleteRuleGroup(id, changeToken string) error
	ListRuleGroups() []RuleGroupSummary
	ListActivatedRulesInRuleGroup(id string) ([]ActivatedRule, error)
	ListSubscribedRuleGroups() []SubscribedRuleGroupSummary

	// Logging
	PutLoggingConfiguration(config LoggingConfiguration) (*LoggingConfiguration, error)
	GetLoggingConfiguration(resourceArn string) (*LoggingConfiguration, error)
	DeleteLoggingConfiguration(resourceArn string) error
	ListLoggingConfigurations() []LoggingConfiguration

	// Permission policy
	PutPermissionPolicy(resourceArn, policy string) error
	GetPermissionPolicy(resourceArn string) (string, error)
	DeletePermissionPolicy(resourceArn string) error

	// Tags
	TagResource(arn string, tags map[string]string) error
	UntagResource(arn string, keys []string) error
	ListTagsForResource(arn string) ([]Tag, error)

	// Sampled requests (stub)
	GetSampledRequests(webACLID, ruleID string, maxItems int64) []SampledHTTPRequest

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for WAF Classic storage operations.

type SubscribedRuleGroupSummary

type SubscribedRuleGroupSummary struct {
	RuleGroupId string `json:"RuleGroupId"` //nolint:revive,staticcheck // AWS SDK field name
	Name        string `json:"Name"`
	MetricName  string `json:"MetricName"`
}

SubscribedRuleGroupSummary is a summary of a subscribed rule group.

type Tag

type Tag struct {
	Key   string `json:"Key"`
	Value string `json:"Value"`
}

Tag is a key-value tag.

type WafAction

type WafAction struct {
	Type string `json:"Type"`
}

WafAction represents the action AWS WAF should take on a matching request.

type WafOverrideAction

type WafOverrideAction struct {
	Type string `json:"Type"`
}

WafOverrideAction overrides the action in a rule group.

type WebACL

type WebACL struct {
	WebACLId      string          `json:"WebACLId"`
	Name          string          `json:"Name"`
	MetricName    string          `json:"MetricName"`
	DefaultAction WafAction       `json:"DefaultAction"`
	WebACLArn     string          `json:"WebACLArn"`
	Rules         []ActivatedRule `json:"Rules"`
}

WebACL is a WAF Classic web access control list.

type WebACLSummary

type WebACLSummary struct {
	WebACLId string `json:"WebACLId"`
	Name     string `json:"Name"`
}

WebACLSummary is a summary of a WebACL.

type WebACLUpdate

type WebACLUpdate struct {
	Action        string        `json:"Action"`
	ActivatedRule ActivatedRule `json:"ActivatedRule"`
}

WebACLUpdate specifies a rule to insert into or delete from a WebACL.

type XssMatchSet

type XssMatchSet struct {
	XssMatchSetId  string          `json:"XssMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name           string          `json:"Name"`
	XssMatchTuples []XssMatchTuple `json:"XssMatchTuples"` //nolint:revive,staticcheck // AWS SDK field name
}

XssMatchSet is a WAF Classic XSS match set.

type XssMatchSetSummary

type XssMatchSetSummary struct {
	XssMatchSetId string `json:"XssMatchSetId"` //nolint:revive,staticcheck // AWS SDK field name
	Name          string `json:"Name"`
}

XssMatchSetSummary is a summary of an XssMatchSet.

type XssMatchSetUpdate

type XssMatchSetUpdate struct {
	Action        string        `json:"Action"`
	XssMatchTuple XssMatchTuple `json:"XssMatchTuple"` //nolint:revive,staticcheck // AWS SDK field name
}

XssMatchSetUpdate specifies a tuple to insert or delete.

type XssMatchTuple

type XssMatchTuple struct {
	FieldToMatch       FieldToMatch `json:"FieldToMatch"`
	TextTransformation string       `json:"TextTransformation"`
}

XssMatchTuple specifies an XSS match tuple.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL