Optimize full default CRS rule dispatch

Author: fffonion

rules/engine.rss

@@ -155,6 +155,16 @@ pub fn record_rule_match(state: map<string>, matched: [string]) -> map<string> {
     s
 }
 
+pub fn apply_detection_paranoia_skip(state: map<string>, id: int, threshold: int, marker: string) -> map<string> {
+    let mut s = state;
+    if engine_context::ctx_get(&s, "blocked") != "1"
+        && engine_context::ctx_get(&s, "skip") == ""
+        && engine_text::number(engine_context::ctx_get(&s, "tx.detection_paranoia_level"), 1) < threshold {
+        s = record_rule_match(s, [id + "", "0", "0", "403", marker, ""]);
+    }
+    s
+}
+
 pub fn apply_rule(state: map<string>, id: int, chain_index: int, has_chain: bool, text: [string], target_count: int, transform_plan: int, score: int, disruptive: bool, status: int) -> map<string> {
     let mut s = state;
     let operator: int = (target_count % 16384) / 64;

rules/engine_bundle.rss

@@ -229,6 +229,10 @@ pub fn new_state(method: string, path: string, query: string, protocol: string,
     }
 }
 
+pub fn apply_action(state: map<string>, phase: int) -> map<string> {
+    state
+}
+
 pub fn apply_marker(state: map<string>, marker: string) -> map<string> {
     let mut s = state;
     if ctx_get(&s, "skip") == marker {
@@ -237,37 +241,6 @@ pub fn apply_marker(state: map<string>, marker: string) -> map<string> {
     s
 }
 
-pub fn apply_rule_blob(state: map<string>, blob: string) -> map<string> {
-    let mut s = state;
-    if blob != "" {
-    let rows: [string] = string_split_literal(blob, "\r");
-    for row_index in 0..rows.length {
-        let fields: [string] = string_split_literal((&rows)[row_index], "\t");
-        if fields.length >= 13 && (&fields)[0] == "R" && category_enabled(&s, (&fields)[1]) {
-            let mut text: [string] = [(&fields)[10], (&fields)[11], (&fields)[12]];
-            for field_index in 13..fields.length {
-                text[text.length] = (&fields)[field_index];
-            }
-            s = apply_rule(
-                s,
-                number((&fields)[2], -1),
-                number((&fields)[3], 0),
-                (&fields)[4] == "1",
-                text,
-                number((&fields)[5], 0),
-                number((&fields)[6], 0),
-                number((&fields)[7], 0),
-                (&fields)[8] == "1",
-                number((&fields)[9], 403)
-            );
-        } else if fields.length >= 3 && (&fields)[0] == "M" && category_enabled(&s, (&fields)[1]) {
-            s = apply_marker(s, (&fields)[2]);
-        }
-    }
-    }
-    s
-}
-
 pub fn update_target(state: map<string>, id: int, base: string, selector: string) -> map<string> {
     ctx_update(state, id, base, selector)
 }
@@ -305,6 +278,16 @@ pub fn record_rule_match(state: map<string>, matched: [string]) -> map<string> {
     s
 }
 
+pub fn apply_detection_paranoia_skip(state: map<string>, id: int, threshold: int, marker: string) -> map<string> {
+    let mut s = state;
+    if ctx_get(&s, "blocked") != "1"
+        && ctx_get(&s, "skip") == ""
+        && number(ctx_get(&s, "tx.detection_paranoia_level"), 1) < threshold {
+        s = record_rule_match(s, [id + "", "0", "0", "403", marker, ""]);
+    }
+    s
+}
+
 pub fn apply_rule(state: map<string>, id: int, chain_index: int, has_chain: bool, text: [string], target_count: int, transform_plan: int, score: int, disruptive: bool, status: int) -> map<string> {
     let mut s = state;
     let operator: int = (target_count % 16384) / 64;

rules/pd_edge_waf.rss

@@ -201,10 +201,11 @@ fn default_ruleset_uses_generated_rules_without_synthetic_attack_probes() {
         .expect("ruleset source should be readable");
     let engine = std::fs::read_to_string(root.join("rules/engine_bundle.rss"))
         .expect("engine bundle should be readable");
-    assert!(ruleset.contains("apply_rule_blob"));
-    assert!(ruleset.contains("\\t911100\\t"));
-    assert!(ruleset.contains("\\t942100\\t"));
-    assert!(ruleset.contains("\\t949110\\t"));
+    assert!(!ruleset.contains("apply_rule_blob"));
+    assert!(!engine.contains("apply_rule_blob"));
+    assert!(ruleset.contains("apply_rule(next, 911100, 0, false"));
+    assert!(ruleset.contains("apply_rule(next, 942100, 0, false"));
+    assert!(ruleset.contains("apply_rule(next, 949110, 0, false"));
     assert!(!ruleset.contains("sqli_category_prefilter"));
     assert!(!ruleset.contains("sqli_query_rule_match"));
     assert!(!engine.contains("sqli_category_prefilter"));
@@ -248,8 +249,8 @@ fn enabled_ruleset_folds_common_exception_updates_into_rule_payloads() {
     assert!(!source.contains("fn evaluate_request_999_common_exceptions_after"));
     assert!(!source.contains("engine_bundle::update_target(next,"));
     assert!(!source.contains("update_target(next, 941100"));
-    assert!(source.contains("\\t942290\\t"));
-    assert!(source.contains("\\t409674\\t619\\t"));
-    assert!(source.contains("\\tREQUEST_COOKIES\\t__gads"));
-    assert!(!source.contains("\\t!REQUEST_COOKIES\\t"));
+    assert!(source.contains("apply_rule(next, 942290, 0, false"));
+    assert!(source.contains("], 409674, 619, 5, false, 403);"));
+    assert!(source.contains("\"REQUEST_COOKIES\", \"__gads\""));
+    assert!(!source.contains("\"!REQUEST_COOKIES\""));
 }

rules/ruleset.rss

@@ -52,7 +52,12 @@ def remove_function(source: str, name: str) -> str:
 ruleset = (rules / "ruleset.rss").read_text(encoding="utf-8")
 ruleset_lines = [line for line in ruleset.splitlines() if not line.startswith("use ")]
 ruleset_body = "\n".join(ruleset_lines).replace("engine_bundle::", "")
-for helper in ("set_phase", "apply_action", "component_signature"):
+for helper in (
+    "set_phase",
+    "apply_action",
+    "component_signature",
+    "apply_rule_blob",
+):
     if re.search(rf"\b{helper}\(", ruleset_body) is None:
         engine_bundle = remove_function(engine_bundle, helper)
 (rules / "engine_bundle.rss").write_text(engine_bundle, encoding="utf-8")

rules/ruleset_bundle.rss

@@ -481,11 +481,19 @@ def render_directive_call(
     return f"next = engine_bundle::component_signature(next, {rss_string(directive.value)});"
 
 
-def guard_rule_call(call: str) -> str:
+def is_detection_paranoia_skip(directive: Directive) -> bool:
     return (
-        'if engine_bundle::ctx_get(&next, "blocked") != "1" '
-        '&& engine_bundle::ctx_get(&next, "skip") == "" { '
-        f"{call} }}"
+        directive.kind == "SecRule"
+        and directive.chain_index == 0
+        and directive.targets.upper() == "TX:DETECTION_PARANOIA_LEVEL"
+        and directive.operator == "@lt"
+        and directive.pattern in {"1", "2", "3", "4"}
+        and not action_values(directive.actions, "t")
+        and anomaly_score(directive.actions) == 0
+        and not has_action(directive.actions, "chain")
+        and not has_action(directive.actions, "deny")
+        and directive.message == ""
+        and action_value(directive.actions, "skipAfter") != ""
     )
 
 
@@ -494,8 +502,49 @@ def render_entry_directive_call(
     data_contents: dict[str, str],
     target_updates: dict[int, list[str]],
 ) -> str:
-    call = render_directive_call(directive, data_contents, target_updates)
-    return guard_rule_call(call) if directive.kind == "SecRule" else call
+    if is_detection_paranoia_skip(directive):
+        return (
+            "next = engine_bundle::apply_detection_paranoia_skip("
+            f"next, {directive.rule_id}, {directive.pattern}, "
+            f"{rss_string(action_value(directive.actions, 'skipAfter'))});"
+        )
+    # apply_rule owns the blocked/skip checks. Repeating them around every
+    # generated call only adds map lookups and branches to the hot path.
+    return render_directive_call(directive, data_contents, target_updates)
+
+
+def render_entry_phase_calls(
+    directives: list[tuple[Directive, int]],
+    markers: list[Directive],
+    data_contents: dict[str, str],
+    target_updates: dict[int, list[str]],
+) -> list[str]:
+    """Render a phase while collapsing skipAfter no-op call tails."""
+    lines: list[str] = []
+    open_skip_guards = 0
+    for directive, _ in directives:
+        lines.append(
+            "    " * open_skip_guards
+            + render_entry_directive_call(
+                directive, data_contents, target_updates
+            )
+        )
+        if directive.kind == "SecRule" and action_value(
+            directive.actions, "skipAfter"
+        ):
+            lines.append(
+                "    " * open_skip_guards
+                + 'if engine_bundle::ctx_get(&next, "skip") == "" {'
+            )
+            open_skip_guards += 1
+    while open_skip_guards > 0:
+        open_skip_guards -= 1
+        lines.append("    " * open_skip_guards + "}")
+    lines.extend(
+        render_directive_call(marker, data_contents, target_updates)
+        for marker in markers
+    )
+    return lines
 
 
 def render_module(
@@ -578,10 +627,10 @@ def render_entry(
         if module_name(directive.source) in enabled_categories:
             grouped.setdefault(directive.source, []).append(directive)
 
-    phase_records: dict[int, list[str]] = {}
+    phase_sections: dict[int, list[tuple[str, list[str]]]] = {}
     lines = [
         f"// Executable OWASP CRS {version} ruleset.",
-        "// Default ModSecurity and CRS rules execute from phase rule blobs.",
+        "// Default ModSecurity and CRS rules execute as generated phase-specific calls.",
         "use engine_bundle;",
         "",
     ]
@@ -611,79 +660,31 @@ def render_entry(
                 phased_directives.setdefault(effective_phase, []).append(
                     (directive, effective_paranoia)
                 )
-        def encoded_rule_records(
-            body_directives: list[tuple[Directive, int]], body_markers: list[Directive]
-        ) -> list[str]:
-            field_separator = "\t"
-            record_separator = "\r"
-            rows: list[str] = []
-            for directive, _ in body_directives:
-                if directive.kind == "SecRule":
-                    arguments = rule_arguments(
-                        directive, data_contents, target_updates
-                    )
-                    text = json.loads(arguments[3])
-                    fields = [
-                        "R",
-                        category,
-                        arguments[0],
-                        arguments[1],
-                        "1" if arguments[2] == "true" else "0",
-                        arguments[4],
-                        arguments[5],
-                        arguments[6],
-                        "1" if arguments[7] == "true" else "0",
-                        arguments[8],
-                        *text,
-                    ]
-                    if any(
-                        field_separator in field or record_separator in field
-                        for field in fields
-                    ):
-                        raise ValueError(
-                            f"rule {directive.rule_id} contains reserved blob separator"
-                        )
-                    rows.append(field_separator.join(fields))
-            for marker in body_markers:
-                fields = ("M", category, marker.marker)
-                if any(
-                    field_separator in field or record_separator in field
-                    for field in fields
-                ):
-                    raise ValueError(
-                        f"marker {marker.marker} contains reserved blob separator"
-                    )
-                rows.append(field_separator.join(fields))
-            return rows
 
         for phase, phase_directives in phased_directives.items():
-            phase_records.setdefault(phase, []).extend(
-                encoded_rule_records(phase_directives, markers)
+            calls = render_entry_phase_calls(
+                phase_directives, markers, data_contents, target_updates
             )
+            phase_sections.setdefault(phase, []).append((category, calls))
 
-    def phase_blob(phase: int) -> str:
-        return "\r".join(phase_records.get(phase, []))
-
-    lines.append("pub fn inspect_request(next: map<string>) -> map<string> {")
-    for phase in (1, 2):
+    def append_phase(phase: int) -> None:
         lines.append(f"    next = engine_bundle::ctx_set_phase(next, {phase});")
-        blob = phase_blob(phase)
-        if blob:
+        for category, calls in phase_sections.get(phase, []):
             lines.append(
-                "    next = engine_bundle::apply_rule_blob("
-                f"next, {rss_string(blob)});"
+                "    if engine_bundle::category_enabled("
+                f'&next, "{category}") {{'
             )
+            lines.extend(f"        {call}" for call in calls)
+            lines.append("    }")
+
+    lines.append("pub fn inspect_request(next: map<string>) -> map<string> {")
+    for phase in (1, 2):
+        append_phase(phase)
     lines.extend(["    next", "}", ""])
 
     lines.append("pub fn inspect_response(next: map<string>) -> map<string> {")
     for phase in (3, 4, 5):
-        lines.append(f"    next = engine_bundle::ctx_set_phase(next, {phase});")
-        blob = phase_blob(phase)
-        if blob:
-            lines.append(
-                "    next = engine_bundle::apply_rule_blob("
-                f"next, {rss_string(blob)});"
-            )
+        append_phase(phase)
     lines.extend(
         [
             "    next",