diff --git a/internal/dashboard/web/index.html b/internal/dashboard/web/index.html
index 98ecc29..0639faf 100644
--- a/internal/dashboard/web/index.html
+++ b/internal/dashboard/web/index.html
@@ -684,6 +684,7 @@
Reputation Feeds
Enabled
Static Rules
+
Attack-Only Rules
@@ -770,6 +771,7 @@
Triggers
Error Rate
Latency
Blocked Rate
+
Score Boost
Window
Cooldown
Duration
diff --git a/internal/waf/decide/decide.go b/internal/waf/decide/decide.go
index 01a0ef1..3589b92 100644
--- a/internal/waf/decide/decide.go
+++ b/internal/waf/decide/decide.go
@@ -24,6 +24,7 @@ import (
type Config struct {
CaptchaThreshold float64
BlockThreshold float64
+ AttackScoreBoost float64 // additive bonus to score during Under Attack Mode
CaptchaStatusCode int
BlockStatusCode int
CaptchaToBlock int
@@ -48,9 +49,10 @@ type PlatformConfig struct {
// Metrics holds decision engine prometheus metrics.
type Metrics struct {
- DecisionTotal *prometheus.CounterVec
- Recorder *event.Recorder
- PlatformSet map[string]struct{}
+ DecisionTotal *prometheus.CounterVec
+ AttackBoostUsed *prometheus.CounterVec // labels: result (captcha|block) — fires when boost moved decision
+ Recorder *event.Recorder
+ PlatformSet map[string]struct{}
}
// Engine evaluates request score and decides pass/captcha/block.
@@ -61,6 +63,7 @@ type Engine struct {
powVerifier *challenge.PowVerifier
store storage.KVStore
alerter alerting.Sender
+ attackState waf.AttackState
embedlog.Logger
metrics Metrics
}
@@ -71,8 +74,10 @@ type scoreEntry struct {
BlockedUntil time.Time `json:"b"`
}
-// New creates a new decision engine.
-func New(cfg Config, store storage.KVStore, cache *challenge.Cache, verifier *challenge.Verifier, powVerifier *challenge.PowVerifier, alerter alerting.Sender, sl embedlog.Logger, metrics Metrics) *Engine {
+// New creates a new decision engine. attackState MUST be non-nil — it is read
+// on every request to gate AttackScoreBoost. Pass dashboard.AttackService in
+// production; a stub `IsEnabled() bool { return false }` works in tests.
+func New(cfg Config, store storage.KVStore, cache *challenge.Cache, verifier *challenge.Verifier, powVerifier *challenge.PowVerifier, alerter alerting.Sender, attackState waf.AttackState, sl embedlog.Logger, metrics Metrics) *Engine {
return &Engine{
cfg: cfg,
store: store,
@@ -80,6 +85,7 @@ func New(cfg Config, store storage.KVStore, cache *challenge.Cache, verifier *ch
verifier: verifier,
powVerifier: powVerifier,
alerter: alerter,
+ attackState: attackState,
Logger: sl,
metrics: metrics,
}
@@ -125,6 +131,24 @@ func (e *Engine) Middleware() func(http.Handler) http.Handler { //nolint:gocogni
score := rc.WAFScore
+ // Under Attack Mode: lift score by AttackScoreBoost so borderline
+ // requests fall into captcha/block buckets without changing thresholds.
+ // rc.WAFScore stays authoritative for upstream scorers; rc.AttackBoost
+ // records the applied delta so access logs can correlate boosted
+ // decisions with this request.
+ if e.cfg.AttackScoreBoost > 0 && e.attackState.IsEnabled() {
+ boosted := score + e.cfg.AttackScoreBoost
+ rc.AttackBoost = e.cfg.AttackScoreBoost
+
+ if e.metrics.AttackBoostUsed != nil {
+ if result := e.boostCrossing(score, boosted); result != "" {
+ e.metrics.AttackBoostUsed.WithLabelValues(result).Inc()
+ }
+ }
+
+ score = boosted
+ }
+
// no thresholds configured — pass through
if e.cfg.BlockThreshold == 0 && e.cfg.CaptchaThreshold == 0 {
rc.Decision = waf.ActionPass
@@ -324,6 +348,25 @@ func (e *Engine) recordCaptcha(ctx context.Context, key string) {
}
}
+// Metric label values for AttackBoostUsed.
+const (
+ boostResultBlock = "block"
+ boostResultCaptcha = "captcha"
+)
+
+// boostCrossing returns the threshold the boost pushed the score across, or ""
+// if the boost was a no-op (already above or still below thresholds).
+func (e *Engine) boostCrossing(orig, boosted float64) string {
+ switch {
+ case e.cfg.BlockThreshold > 0 && boosted >= e.cfg.BlockThreshold && orig < e.cfg.BlockThreshold:
+ return boostResultBlock
+ case e.cfg.CaptchaThreshold > 0 && boosted >= e.cfg.CaptchaThreshold && orig < e.cfg.CaptchaThreshold:
+ return boostResultCaptcha
+ default:
+ return ""
+ }
+}
+
func (e *Engine) metricPlatform(platform string) string {
if platform == "" {
return ""
diff --git a/internal/waf/decide/decide_test.go b/internal/waf/decide/decide_test.go
index 8d0c1a0..46a8311 100644
--- a/internal/waf/decide/decide_test.go
+++ b/internal/waf/decide/decide_test.go
@@ -12,6 +12,7 @@ import (
"wafsrv/internal/waf/storage"
"github.com/prometheus/client_golang/prometheus"
+ dto "github.com/prometheus/client_model/go"
"github.com/stretchr/testify/suite"
"github.com/vmkteam/embedlog"
)
@@ -24,6 +25,13 @@ func TestDecide(t *testing.T) {
suite.Run(t, new(DecideSuite))
}
+// fakeAttackState is a controllable AttackState for tests.
+type fakeAttackState struct{ on bool }
+
+func (f *fakeAttackState) IsEnabled() bool { return f.on }
+
+func attackOff() waf.AttackState { return &fakeAttackState{on: false} }
+
func (s *DecideSuite) TestPassBelowThreshold() {
e := s.newEngine(5, 8)
@@ -93,7 +101,7 @@ func (s *DecideSuite) TestCaptchaPassCacheBypass() {
BlockThreshold: 8,
CaptchaStatusCode: 499,
BlockStatusCode: http.StatusForbidden,
- }, kvStore, cache, nil, nil, nil, embedlog.NewLogger(false, false), testMetrics())
+ }, kvStore, cache, nil, nil, nil, attackOff(), embedlog.NewLogger(false, false), testMetrics())
handler := e.Middleware()(okHandler())
@@ -141,6 +149,80 @@ func (s *DecideSuite) TestZeroThresholdsPass() {
s.Equal(http.StatusOK, w.Code, "zero thresholds should pass everything")
}
+func (s *DecideSuite) TestAttackScoreBoost() {
+ cases := []struct {
+ name string
+ boost float64
+ attackOn bool
+ score float64
+ wantCode int
+ wantBoosted bool // rc.AttackBoost should be set on the request
+ wantCross string // "" or boostResultBlock/Captcha
+ }{
+ {"boost off → pass", 2, false, 3, http.StatusOK, false, ""},
+ {"boost on, lifts to captcha", 2, true, 3, 499, true, boostResultCaptcha},
+ {"boost on, lifts to block", 5, true, 4, http.StatusForbidden, true, boostResultBlock},
+ {"boost zero, on, ignored", 0, true, 3, http.StatusOK, false, ""},
+ {"boost on, score already above block", 2, true, 9, http.StatusForbidden, true, ""},
+ }
+
+ for _, tc := range cases {
+ s.Run(tc.name, func() {
+ st := &fakeAttackState{on: tc.attackOn}
+ boostMetric := prometheus.NewCounterVec(prometheus.CounterOpts{
+ Name: "test_decide_attack_boost_used_total",
+ Help: "test",
+ }, []string{"result"})
+ metrics := testMetrics()
+ metrics.AttackBoostUsed = boostMetric
+
+ e := New(Config{
+ CaptchaThreshold: 5,
+ BlockThreshold: 8,
+ AttackScoreBoost: tc.boost,
+ CaptchaStatusCode: 499,
+ BlockStatusCode: http.StatusForbidden,
+ CaptchaToBlock: 3,
+ CaptchaToBlockWindow: 10 * time.Minute,
+ SoftBlockDuration: 10 * time.Minute,
+ }, storage.NewMemoryKV(100000), nil, nil, nil, nil, st, embedlog.NewLogger(false, false), metrics)
+
+ handler := e.Middleware()(okHandler())
+ w := httptest.NewRecorder()
+ req := s.requestWithScore("9.9.9.9", tc.score)
+ handler.ServeHTTP(w, req)
+
+ s.Equal(tc.wantCode, w.Code)
+
+ rc := waf.FromContext(req.Context())
+ if tc.wantBoosted {
+ s.InDelta(tc.boost, rc.AttackBoost, 0.0001, "rc.AttackBoost should record applied delta")
+ } else {
+ s.Zero(rc.AttackBoost, "rc.AttackBoost must stay 0 when boost not applied")
+ }
+
+ if tc.wantCross != "" {
+ s.InDelta(1.0, decideCounterValue(boostMetric, tc.wantCross), 0.0001,
+ "AttackBoostUsed{result=%q} should fire once", tc.wantCross)
+ }
+ })
+ }
+}
+
+func decideCounterValue(v *prometheus.CounterVec, label string) float64 {
+ c, err := v.GetMetricWithLabelValues(label)
+ if err != nil {
+ return 0
+ }
+
+ m := &dto.Metric{}
+ if err := c.Write(m); err != nil {
+ return 0
+ }
+
+ return m.GetCounter().GetValue()
+}
+
func (s *DecideSuite) newEngine(captchaThreshold, blockThreshold float64) *Engine {
return New(Config{
CaptchaThreshold: captchaThreshold,
@@ -150,7 +232,7 @@ func (s *DecideSuite) newEngine(captchaThreshold, blockThreshold float64) *Engin
CaptchaToBlock: 3,
CaptchaToBlockWindow: 10 * time.Minute,
SoftBlockDuration: 10 * time.Minute,
- }, storage.NewMemoryKV(100000), nil, nil, nil, nil, embedlog.NewLogger(false, false), testMetrics())
+ }, storage.NewMemoryKV(100000), nil, nil, nil, nil, attackOff(), embedlog.NewLogger(false, false), testMetrics())
}
func (s *DecideSuite) requestWithScore(ipStr string, score float64) *http.Request {
@@ -187,7 +269,7 @@ func BenchmarkDecidePass(b *testing.B) {
CaptchaToBlock: 3,
CaptchaToBlockWindow: 10 * time.Minute,
SoftBlockDuration: 10 * time.Minute,
- }, storage.NewMemoryKV(100000), nil, nil, nil, nil, embedlog.NewLogger(false, false), testMetrics())
+ }, storage.NewMemoryKV(100000), nil, nil, nil, nil, attackOff(), embedlog.NewLogger(false, false), testMetrics())
handler := e.Middleware()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusOK)
@@ -225,7 +307,7 @@ func BenchmarkDecidePlatformCheck(b *testing.B) {
{Platform: "android", Captcha: true, MinVersion: [3]int{3, 0, 0}, Fallback: waf.ActionPass},
{Platform: "widget", Captcha: false, Fallback: waf.ActionPass},
},
- }, storage.NewMemoryKV(100000), nil, nil, nil, nil, embedlog.NewLogger(false, false), testMetrics())
+ }, storage.NewMemoryKV(100000), nil, nil, nil, nil, attackOff(), embedlog.NewLogger(false, false), testMetrics())
b.ResetTimer()
b.ReportAllocs()
@@ -455,7 +537,7 @@ func (s *DecideSuite) newPlatformEngine() *Engine {
{Platform: "ios", Captcha: true, MinVersion: [3]int{2, 5, 0}, Fallback: waf.ActionPass},
{Platform: "android", Captcha: true, MinVersion: [3]int{3, 0, 0}, Fallback: waf.ActionPass},
},
- }, storage.NewMemoryKV(100000), nil, nil, nil, nil, embedlog.NewLogger(false, false), testMetrics())
+ }, storage.NewMemoryKV(100000), nil, nil, nil, nil, attackOff(), embedlog.NewLogger(false, false), testMetrics())
}
func (s *DecideSuite) requestWithPlatformScore(platform, version string) *http.Request {
diff --git a/internal/waf/filter/filter.go b/internal/waf/filter/filter.go
index 8063977..988475b 100644
--- a/internal/waf/filter/filter.go
+++ b/internal/waf/filter/filter.go
@@ -20,6 +20,7 @@ const trafficFilterScore = 5.0
type TrafficRule struct {
Name string // rule identifier
Action string // "block" | "captcha" | "log"
+ AttackOnly bool // active only when Under Attack Mode is enabled
IP []string // exact IP or CIDR
UAExact []string // exact User-Agent match
UAPrefix []string // User-Agent prefix match
@@ -71,8 +72,9 @@ type RuleMatch struct {
// Metrics holds traffic filter prometheus metrics.
type Metrics struct {
- MatchedTotal *prometheus.CounterVec // labels: rule, action
- Recorder *event.Recorder
+ MatchedTotal *prometheus.CounterVec // labels: rule, action
+ AttackOnlyTotal *prometheus.CounterVec // labels: rule — fired AttackOnly rules
+ Recorder *event.Recorder
}
// MatchRequest holds extracted request fields for rule matching.
@@ -95,18 +97,23 @@ type TrafficFilter struct {
mu sync.RWMutex
staticRules []TrafficRule
dynamicRules []TrafficRule
+ attackState waf.AttackState
embedlog.Logger
metrics Metrics
}
-// New creates a new TrafficFilter with static rules from config.
-func New(rules []TrafficRule, sl embedlog.Logger, metrics Metrics) *TrafficFilter {
+// New creates a new TrafficFilter with static rules from config. attackState
+// MUST be non-nil — read on each request that has AttackOnly rules. Pass
+// dashboard.AttackService in production; a stub `IsEnabled() bool { return false }`
+// works in tests.
+func New(rules []TrafficRule, attackState waf.AttackState, sl embedlog.Logger, metrics Metrics) *TrafficFilter {
for i := range rules {
rules[i].Init()
}
return &TrafficFilter{
staticRules: rules,
+ attackState: attackState,
Logger: sl,
metrics: metrics,
}
@@ -240,11 +247,30 @@ func (f *TrafficFilter) Middleware() func(http.Handler) http.Handler {
// evalRules evaluates rules, returns true if a block action fired.
func (f *TrafficFilter) evalRules(r *http.Request, rc *waf.RequestContext, req MatchRequest, rules []TrafficRule) bool {
+ // Lazy: only query attack state if some rule actually needs it. Common
+ // case (no AttackOnly rules) avoids the dashboard.AttackService call entirely.
+ attackChecked, attackOn := false, false
+
for _, rule := range rules {
+ if rule.AttackOnly {
+ if !attackChecked {
+ attackOn = f.attackState.IsEnabled()
+ attackChecked = true
+ }
+
+ if !attackOn {
+ continue
+ }
+ }
+
if !rule.isActive(req) {
continue
}
+ if rule.AttackOnly && f.metrics.AttackOnlyTotal != nil {
+ f.metrics.AttackOnlyTotal.WithLabelValues(rule.Name).Inc()
+ }
+
f.metrics.MatchedTotal.WithLabelValues(rule.Name, rule.Action).Inc()
switch rule.Action {
diff --git a/internal/waf/filter/filter_test.go b/internal/waf/filter/filter_test.go
index 6e9eb13..a65ee36 100644
--- a/internal/waf/filter/filter_test.go
+++ b/internal/waf/filter/filter_test.go
@@ -1,9 +1,16 @@
package filter
import (
+ "net/http"
+ "net/http/httptest"
"testing"
+ "time"
+
+ "wafsrv/internal/waf"
+ "wafsrv/internal/waf/event"
"github.com/prometheus/client_golang/prometheus"
+ dto "github.com/prometheus/client_model/go"
"github.com/stretchr/testify/suite"
"github.com/vmkteam/embedlog"
)
@@ -16,6 +23,14 @@ func TestFilter(t *testing.T) {
suite.Run(t, new(FilterSuite))
}
+// fakeAttackState is a controllable AttackState for tests.
+type fakeAttackState struct{ on bool }
+
+func (f *fakeAttackState) IsEnabled() bool { return f.on }
+
+// attackOff returns an always-off AttackState (peace time).
+func attackOff() waf.AttackState { return &fakeAttackState{on: false} }
+
func (s *FilterSuite) TestSingleField_UAPrefix() {
r := TrafficRule{Name: "python", Action: "block", UAPrefix: []string{"Python/"}}
s.True(r.isActive(MatchRequest{UA: "Python/3.9 aiohttp/3.8"}))
@@ -105,6 +120,7 @@ func (s *FilterSuite) TestUAPrefix_SubstringNoMatch() {
func (s *FilterSuite) TestDynamic_AddRemoveList() {
f := New(
[]TrafficRule{{Name: "static-rule", Action: "block", UAPrefix: []string{"Python/"}}},
+ attackOff(),
embedlog.NewLogger(false, false), Metrics{MatchedTotal: prometheus.NewCounterVec(prometheus.CounterOpts{Name: "test_total", Help: "test"}, []string{"rule", "action"})},
)
@@ -140,6 +156,7 @@ func (s *FilterSuite) TestTestRequest() {
{Name: "python", Action: "block", UAPrefix: []string{"Python/"}},
{Name: "geo", Action: "captcha", Country: []string{"CN"}},
},
+ attackOff(),
embedlog.NewLogger(false, false), Metrics{MatchedTotal: prometheus.NewCounterVec(prometheus.CounterOpts{Name: "test2_total", Help: "test"}, []string{"rule", "action"})},
)
@@ -304,3 +321,72 @@ func (s *FilterSuite) TestTripleField_AND() {
s.False(r.isActive(MatchRequest{Platform: "Desktop", Version: "149bd482", Method: "GET"}))
s.False(r.isActive(MatchRequest{Platform: "Mobile", Version: "149bd482", Method: "POST"}))
}
+
+func (s *FilterSuite) TestAttackOnly_GatedByAttackState() {
+ cases := []struct {
+ name string
+ attackOn bool
+ path string
+ wantCode int
+ }{
+ {"attack off, attack-only path → pass", false, "/search/all", http.StatusOK},
+ {"attack on, attack-only path → block", true, "/search/all", http.StatusForbidden},
+ {"attack off, regular always-on rule still blocks", false, "/admin", http.StatusForbidden},
+ {"attack on, regular always-on rule still blocks", true, "/admin", http.StatusForbidden},
+ }
+
+ for _, tc := range cases {
+ s.Run(tc.name, func() {
+ st := &fakeAttackState{on: tc.attackOn}
+ attackOnlyTotal := prometheus.NewCounterVec(prometheus.CounterOpts{Name: "test_attack_only_total", Help: "t"}, []string{"rule"})
+ matched := prometheus.NewCounterVec(prometheus.CounterOpts{Name: "test_matched_" + tc.name, Help: "t"}, []string{"rule", "action"})
+
+ f := New(
+ []TrafficRule{
+ {Name: "always-admin", Action: "block", Path: []string{"/admin"}},
+ {Name: "attack-search", Action: "block", AttackOnly: true, Path: []string{"/search/"}},
+ },
+ st,
+ embedlog.NewLogger(false, false),
+ Metrics{
+ MatchedTotal: matched,
+ AttackOnlyTotal: attackOnlyTotal,
+ Recorder: event.NewRecorder(event.NewBuffer(1), event.NewSeries(time.Second, 1), event.NewTops(time.Minute, 1)),
+ },
+ )
+
+ h := f.Middleware()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+ w.WriteHeader(http.StatusOK)
+ }))
+
+ req := httptest.NewRequest(http.MethodGet, tc.path, nil)
+ req = req.WithContext(waf.NewContext(req.Context(), &waf.RequestContext{}))
+ rec := httptest.NewRecorder()
+ h.ServeHTTP(rec, req)
+
+ s.Equal(tc.wantCode, rec.Code)
+
+ // AttackOnly counter must reflect only AttackOnly fires
+ got := testutilCounterValue(attackOnlyTotal, "attack-search")
+ if tc.attackOn && tc.path == "/search/all" {
+ s.InDelta(1.0, got, 0.0001, "AttackOnlyTotal should fire for matched attack-only rule")
+ } else {
+ s.InDelta(0.0, got, 0.0001, "AttackOnlyTotal must not fire when rule does not match or attack off")
+ }
+ })
+ }
+}
+
+func testutilCounterValue(v *prometheus.CounterVec, label string) float64 {
+ c, err := v.GetMetricWithLabelValues(label)
+ if err != nil {
+ return 0
+ }
+
+ m := &dto.Metric{}
+ if err := c.Write(m); err != nil {
+ return 0
+ }
+
+ return m.GetCounter().GetValue()
+}
diff --git a/internal/waf/model.go b/internal/waf/model.go
index abfaefd..87fd910 100644
--- a/internal/waf/model.go
+++ b/internal/waf/model.go
@@ -2,6 +2,13 @@ package waf
import "net/netip"
+// AttackState exposes Under Attack Mode status to consumers (filter, decide).
+// Lives in this package to avoid filter/decide depending on the dashboard
+// package that owns the production implementation (dashboard.AttackService).
+type AttackState interface {
+ IsEnabled() bool
+}
+
// Action represents a WAF decision action.
type Action int
@@ -49,6 +56,7 @@ type RequestContext struct {
RPC *RPCCall
IP *IPInfo // filled by ip.Middleware
WAFScore float64 // filled by engine.Middleware
+ AttackBoost float64 // filled by decide.Middleware when AttackScoreBoost lifted score in attack mode
Decision Action // filled by decide.Middleware
TrafficType string // filled by sign.Middleware
Target string // filled by proxy handler (backend URL)