#[non_exhaustive]pub struct FieldToMatch {
pub single_header: Option<SingleHeader>,
pub single_query_argument: Option<SingleQueryArgument>,
pub all_query_arguments: Option<AllQueryArguments>,
pub uri_path: Option<UriPath>,
pub query_string: Option<QueryString>,
pub body: Option<Body>,
pub method: Option<Method>,
pub json_body: Option<JsonBody>,
pub headers: Option<Headers>,
pub cookies: Option<Cookies>,
pub header_order: Option<HeaderOrder>,
pub ja3_fingerprint: Option<Ja3Fingerprint>,
}
Expand description
Specifies a web request component to be used in a rule match statement or in a logging configuration.
-
In a rule statement, this is the part of the web request that you want WAF to inspect. Include the single
FieldToMatch
type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component inFieldToMatch
for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component.Example JSON for a
QueryString
field to match:"FieldToMatch": { "QueryString": {} }
Example JSON for a
Method
field to match specification:"FieldToMatch": { "Method": { "Name": "DELETE" } }
-
In a logging configuration, this is used in the
RedactedFields
property to specify a field to redact from the logging records. For this use case, note the following:-
Even though all
FieldToMatch
settings are available, the only valid settings for field redaction areUriPath
,QueryString
,SingleHeader
, andMethod
. -
In this documentation, the descriptions of the individual fields talk about specifying the web request component to inspect, but for field redaction, you are specifying the component type to redact from the logs.
-
If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling. The only way to exclude fields from request sampling is by disabling sampling in the web ACL visibility configuration.
-
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. }
syntax; cannot be matched against without a wildcard ..
; and struct update syntax will not work.single_header: Option<SingleHeader>
Inspect a single header. Provide the name of the header to inspect, for example, User-Agent
or Referer
. This setting isn't case sensitive.
Example JSON: "SingleHeader": { "Name": "haystack" }
Alternately, you can filter and inspect all headers with the Headers
FieldToMatch
setting.
single_query_argument: Option<SingleQueryArgument>
Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn't case sensitive.
Example JSON: "SingleQueryArgument": { "Name": "myArgument" }
all_query_arguments: Option<AllQueryArguments>
Inspect all query arguments.
uri_path: Option<UriPath>
Inspect the request URI path. This is the part of the web request that identifies a resource, for example, /images/daily-ad.jpg
.
query_string: Option<QueryString>
Inspect the query string. This is the part of a URL that appears after a ?
character, if any.
body: Option<Body>
Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.
WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection.
-
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes).
-
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL
AssociationConfig
, for additional processing fees.
For information about how to handle oversized request bodies, see the Body
object configuration.
method: Option<Method>
Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
json_body: Option<JsonBody>
Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.
WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection.
-
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes).
-
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL
AssociationConfig
, for additional processing fees.
For information about how to handle oversized request bodies, see the JsonBody
object configuration.
headers: Option<Headers>
Inspect the request headers. You must configure scope and pattern matching filters in the Headers
object, to define the set of headers to and the parts of the headers that WAF inspects.
Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the Headers
object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
Inspect the request cookies. You must configure scope and pattern matching filters in the Cookies
object, to define the set of cookies and the parts of the cookies that WAF inspects.
Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the Cookies
object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
header_order: Option<HeaderOrder>
Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer
.
ja3_fingerprint: Option<Ja3Fingerprint>
Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
You can use this choice only with a string match ByteMatchStatement
with the PositionalConstraint
set to EXACTLY
.
You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields in the WAF Developer Guide.
Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
Implementations§
Source§impl FieldToMatch
impl FieldToMatch
Sourcepub fn single_header(&self) -> Option<&SingleHeader>
pub fn single_header(&self) -> Option<&SingleHeader>
Inspect a single header. Provide the name of the header to inspect, for example, User-Agent
or Referer
. This setting isn't case sensitive.
Example JSON: "SingleHeader": { "Name": "haystack" }
Alternately, you can filter and inspect all headers with the Headers
FieldToMatch
setting.
Sourcepub fn single_query_argument(&self) -> Option<&SingleQueryArgument>
pub fn single_query_argument(&self) -> Option<&SingleQueryArgument>
Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn't case sensitive.
Example JSON: "SingleQueryArgument": { "Name": "myArgument" }
Sourcepub fn all_query_arguments(&self) -> Option<&AllQueryArguments>
pub fn all_query_arguments(&self) -> Option<&AllQueryArguments>
Inspect all query arguments.
Sourcepub fn uri_path(&self) -> Option<&UriPath>
pub fn uri_path(&self) -> Option<&UriPath>
Inspect the request URI path. This is the part of the web request that identifies a resource, for example, /images/daily-ad.jpg
.
Sourcepub fn query_string(&self) -> Option<&QueryString>
pub fn query_string(&self) -> Option<&QueryString>
Inspect the query string. This is the part of a URL that appears after a ?
character, if any.
Sourcepub fn body(&self) -> Option<&Body>
pub fn body(&self) -> Option<&Body>
Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.
WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection.
-
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes).
-
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL
AssociationConfig
, for additional processing fees.
For information about how to handle oversized request bodies, see the Body
object configuration.
Sourcepub fn method(&self) -> Option<&Method>
pub fn method(&self) -> Option<&Method>
Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
Sourcepub fn json_body(&self) -> Option<&JsonBody>
pub fn json_body(&self) -> Option<&JsonBody>
Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.
WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection.
-
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes).
-
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL
AssociationConfig
, for additional processing fees.
For information about how to handle oversized request bodies, see the JsonBody
object configuration.
Sourcepub fn headers(&self) -> Option<&Headers>
pub fn headers(&self) -> Option<&Headers>
Inspect the request headers. You must configure scope and pattern matching filters in the Headers
object, to define the set of headers to and the parts of the headers that WAF inspects.
Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the Headers
object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
Inspect the request cookies. You must configure scope and pattern matching filters in the Cookies
object, to define the set of cookies and the parts of the cookies that WAF inspects.
Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the Cookies
object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
Sourcepub fn header_order(&self) -> Option<&HeaderOrder>
pub fn header_order(&self) -> Option<&HeaderOrder>
Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer
.
Sourcepub fn ja3_fingerprint(&self) -> Option<&Ja3Fingerprint>
pub fn ja3_fingerprint(&self) -> Option<&Ja3Fingerprint>
Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
You can use this choice only with a string match ByteMatchStatement
with the PositionalConstraint
set to EXACTLY
.
You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields in the WAF Developer Guide.
Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
Source§impl FieldToMatch
impl FieldToMatch
Sourcepub fn builder() -> FieldToMatchBuilder
pub fn builder() -> FieldToMatchBuilder
Creates a new builder-style object to manufacture FieldToMatch
.
Trait Implementations§
Source§impl Clone for FieldToMatch
impl Clone for FieldToMatch
Source§fn clone(&self) -> FieldToMatch
fn clone(&self) -> FieldToMatch
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moreSource§impl Debug for FieldToMatch
impl Debug for FieldToMatch
Source§impl PartialEq for FieldToMatch
impl PartialEq for FieldToMatch
impl StructuralPartialEq for FieldToMatch
Auto Trait Implementations§
impl Freeze for FieldToMatch
impl RefUnwindSafe for FieldToMatch
impl Send for FieldToMatch
impl Sync for FieldToMatch
impl Unpin for FieldToMatch
impl UnwindSafe for FieldToMatch
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§unsafe fn clone_to_uninit(&self, dst: *mut T)
unsafe fn clone_to_uninit(&self, dst: *mut T)
clone_to_uninit
)Source§impl<T> Instrument for T
impl<T> Instrument for T
Source§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
Source§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self
into a Left
variant of Either<Self, Self>
if into_left
is true
.
Converts self
into a Right
variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self
into a Left
variant of Either<Self, Self>
if into_left(&self)
returns true
.
Converts self
into a Right
variant of Either<Self, Self>
otherwise. Read moreSource§impl<T> Paint for Twhere
T: ?Sized,
impl<T> Paint for Twhere
T: ?Sized,
Source§fn fg(&self, value: Color) -> Painted<&T>
fn fg(&self, value: Color) -> Painted<&T>
Returns a styled value derived from self
with the foreground set to
value
.
This method should be used rarely. Instead, prefer to use color-specific
builder methods like red()
and
green()
, which have the same functionality but are
pithier.
§Example
Set foreground color to white using fg()
:
use yansi::{Paint, Color};
painted.fg(Color::White);
Set foreground color to white using white()
.
use yansi::Paint;
painted.white();
Source§fn bright_black(&self) -> Painted<&T>
fn bright_black(&self) -> Painted<&T>
Returns self
with the
fg()
set to
Color::BrightBlack
.
§Example
println!("{}", value.bright_black());
Source§fn bright_red(&self) -> Painted<&T>
fn bright_red(&self) -> Painted<&T>
Source§fn bright_green(&self) -> Painted<&T>
fn bright_green(&self) -> Painted<&T>
Returns self
with the
fg()
set to
Color::BrightGreen
.
§Example
println!("{}", value.bright_green());
Source§fn bright_yellow(&self) -> Painted<&T>
fn bright_yellow(&self) -> Painted<&T>
Returns self
with the
fg()
set to
Color::BrightYellow
.
§Example
println!("{}", value.bright_yellow());
Source§fn bright_blue(&self) -> Painted<&T>
fn bright_blue(&self) -> Painted<&T>
Source§fn bright_magenta(&self) -> Painted<&T>
fn bright_magenta(&self) -> Painted<&T>
Returns self
with the
fg()
set to
Color::BrightMagenta
.
§Example
println!("{}", value.bright_magenta());
Source§fn bright_cyan(&self) -> Painted<&T>
fn bright_cyan(&self) -> Painted<&T>
Source§fn bright_white(&self) -> Painted<&T>
fn bright_white(&self) -> Painted<&T>
Returns self
with the
fg()
set to
Color::BrightWhite
.
§Example
println!("{}", value.bright_white());
Source§fn bg(&self, value: Color) -> Painted<&T>
fn bg(&self, value: Color) -> Painted<&T>
Returns a styled value derived from self
with the background set to
value
.
This method should be used rarely. Instead, prefer to use color-specific
builder methods like on_red()
and
on_green()
, which have the same functionality but
are pithier.
§Example
Set background color to red using fg()
:
use yansi::{Paint, Color};
painted.bg(Color::Red);
Set background color to red using on_red()
.
use yansi::Paint;
painted.on_red();
Source§fn on_primary(&self) -> Painted<&T>
fn on_primary(&self) -> Painted<&T>
Source§fn on_magenta(&self) -> Painted<&T>
fn on_magenta(&self) -> Painted<&T>
Source§fn on_bright_black(&self) -> Painted<&T>
fn on_bright_black(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightBlack
.
§Example
println!("{}", value.on_bright_black());
Source§fn on_bright_red(&self) -> Painted<&T>
fn on_bright_red(&self) -> Painted<&T>
Source§fn on_bright_green(&self) -> Painted<&T>
fn on_bright_green(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightGreen
.
§Example
println!("{}", value.on_bright_green());
Source§fn on_bright_yellow(&self) -> Painted<&T>
fn on_bright_yellow(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightYellow
.
§Example
println!("{}", value.on_bright_yellow());
Source§fn on_bright_blue(&self) -> Painted<&T>
fn on_bright_blue(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightBlue
.
§Example
println!("{}", value.on_bright_blue());
Source§fn on_bright_magenta(&self) -> Painted<&T>
fn on_bright_magenta(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightMagenta
.
§Example
println!("{}", value.on_bright_magenta());
Source§fn on_bright_cyan(&self) -> Painted<&T>
fn on_bright_cyan(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightCyan
.
§Example
println!("{}", value.on_bright_cyan());
Source§fn on_bright_white(&self) -> Painted<&T>
fn on_bright_white(&self) -> Painted<&T>
Returns self
with the
bg()
set to
Color::BrightWhite
.
§Example
println!("{}", value.on_bright_white());
Source§fn attr(&self, value: Attribute) -> Painted<&T>
fn attr(&self, value: Attribute) -> Painted<&T>
Enables the styling Attribute
value
.
This method should be used rarely. Instead, prefer to use
attribute-specific builder methods like bold()
and
underline()
, which have the same functionality
but are pithier.
§Example
Make text bold using attr()
:
use yansi::{Paint, Attribute};
painted.attr(Attribute::Bold);
Make text bold using using bold()
.
use yansi::Paint;
painted.bold();
Source§fn underline(&self) -> Painted<&T>
fn underline(&self) -> Painted<&T>
Returns self
with the
attr()
set to
Attribute::Underline
.
§Example
println!("{}", value.underline());
Source§fn rapid_blink(&self) -> Painted<&T>
fn rapid_blink(&self) -> Painted<&T>
Returns self
with the
attr()
set to
Attribute::RapidBlink
.
§Example
println!("{}", value.rapid_blink());
Source§fn quirk(&self, value: Quirk) -> Painted<&T>
fn quirk(&self, value: Quirk) -> Painted<&T>
Enables the yansi
Quirk
value
.
This method should be used rarely. Instead, prefer to use quirk-specific
builder methods like mask()
and
wrap()
, which have the same functionality but are
pithier.
§Example
Enable wrapping using .quirk()
:
use yansi::{Paint, Quirk};
painted.quirk(Quirk::Wrap);
Enable wrapping using wrap()
.
use yansi::Paint;
painted.wrap();
Source§fn clear(&self) -> Painted<&T>
👎Deprecated since 1.0.1: renamed to resetting()
due to conflicts with Vec::clear()
.
The clear()
method will be removed in a future release.
fn clear(&self) -> Painted<&T>
resetting()
due to conflicts with Vec::clear()
.
The clear()
method will be removed in a future release.Source§fn whenever(&self, value: Condition) -> Painted<&T>
fn whenever(&self, value: Condition) -> Painted<&T>
Conditionally enable styling based on whether the Condition
value
applies. Replaces any previous condition.
See the crate level docs for more details.
§Example
Enable styling painted
only when both stdout
and stderr
are TTYs:
use yansi::{Paint, Condition};
painted.red().on_yellow().whenever(Condition::STDOUTERR_ARE_TTY);