cfexpr

Documentation

Overview

Package cfexpr holds the small, shared interpreters for Cloudflare's rules language and action parameters. Both the classifier (which decides AUTO/ASK/ MANUAL) and the plan builder (which emits config) depend on it, so the "is this faithfully translatable?" judgement is made in exactly one place — there is no way for classification and generation to drift, which is what the 0% false-positive contract requires.

Index

• func HostEq(expr string) (string, bool)
• func IsPerIPRateLimit(chars []string) bool
• func IsSimple(expr string) bool
• func RedirectStatus(params map[string]any) int
• func StaticRedirectTarget(params map[string]any) (string, bool)
• type WAFMatch
  • func SimpleWAFMatch(expr string) (WAFMatch, bool)

Functions

func HostEq

func HostEq(expr string) (string, bool)

HostEq extracts the host from a `http.host eq "example.com"` expression. ok is false for anything more complex.

func IsPerIPRateLimit

func IsPerIPRateLimit(chars []string) bool

IsPerIPRateLimit reports whether a rate-limit's characteristics reduce to a per-client-IP counter. Cloudflare's free tier forces "cf.colo.id" into the characteristics (counting happens per-colo), which is a Cloudflare accounting detail with no bearing on the intent — so it is ignored. Any other key (headers, cookies, query) means the limit is not faithfully per-IP.

func IsSimple

func IsSimple(expr string) bool

IsSimple reports whether an expression is a single-field match that can be translated with confidence. Deliberately strict: anything with boolean composition or functions is "not simple" so it routes to ASK/MANUAL rather than a risky AUTO.

func RedirectStatus

func RedirectStatus(params map[string]any) int

RedirectStatus reads the status code (default 302) from dynamic-redirect action parameters.

func StaticRedirectTarget

func StaticRedirectTarget(params map[string]any) (string, bool)

StaticRedirectTarget extracts a constant redirect target URL from dynamic- redirect action parameters, returning ok=false when the target is expression-derived (built from request fields at runtime).

Types

type WAFMatch

type WAFMatch struct {
	Kind  string // "field" | "country" | "asn"
	Field string // the http.* field, for Kind == "field"
	Op    string // "eq" | "contains", for Kind == "field"
	Value string // matched value: field value, ISO country code, or ASN digits
}

WAFMatch describes a Cloudflare firewall expression that flareover can faithfully translate, and how.

func SimpleWAFMatch

func SimpleWAFMatch(expr string) (WAFMatch, bool)

SimpleWAFMatch is the SINGLE predicate both the classifier (AUTO decision) and the plan builder (emission) use for custom firewall rules, so a rule is only marked AUTO when config is actually generated for it — the 0% false-positive invariant. It is a deliberate allowlist of shapes flareover emits faithfully: a single-field `http.<field> eq|contains "…"` (→ caddy-waf JSON rule), a `ip.geoip.country eq "XX"` (→ block_countries), or a `ip.geoip.asnum eq N` (→ block_asns). Anything else (compound expressions, other fields/operators) returns ok=false and must route to ASK/MANUAL, never AUTO.