libddwaf 1.2.1.0.0.beta1-aarch64-linux → 1.3.0.1.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfb2432bc222dbfdb31746689817e5daf2db7c33a529820a8ded0cb8562dbdfe
-  data.tar.gz: 0e9107e0a6051237816dd853b5cfd7afa06df2491056fcc4298898b1dfc579c2
+  metadata.gz: 69d980011cd3bee8b7904fcaa7292a25e19328474b20c2dd52922befaf37f6b6
+  data.tar.gz: 41ecd07d409f3b6c6943a632698383ebcf2cd01d180ce1bcd9f7161f17490c31
 SHA512:
-  metadata.gz: 21998b8bfc616220ee5a0b7a81565576bb4a8010fd8419cf617b6a9bd643630760f8b04550d66f8d148692770ef89173f1b63d7a9f609e4a8006e9fa59b54f16
-  data.tar.gz: de70ff25315ddd224985021935913d27c054af0eba5c03d6272757a028b9e42745f475198028c4efad5f77a5cb7c67c03ca62c6a9a5cc3605e2f5052089fa529
+  metadata.gz: a8e1131b68f3bfc378adf94f419e4569b5ac5747a7d9d415ec9cdb6b13382576f7d8ec4c97d9e7472453adbe9168741320bbe4ffc8366935cb4fb947b5eb65a0
+  data.tar.gz: 8e90eb2c1b959c3cbc25bc1d8891ce45cee0ef74ad8b0f3350e917eb81ba1c02fa2725991b749bda282e3ffdefaf06debca0db0cc052e6d3dad2c31c630292ae

data/lib/datadog/appsec/waf/version.rb

@@ -2,8 +2,8 @@ module Datadog
   module AppSec
     module WAF
       module VERSION
-        BASE_STRING = '1.2.1'
-        STRING = "#{BASE_STRING}.0.0.beta1"
+        BASE_STRING = '1.3.0'
+        STRING = "#{BASE_STRING}.1.0"
         MINIMUM_RUBY_VERSION = '2.1'
       end
     end

data/lib/datadog/appsec/waf.rb

@@ -6,7 +6,13 @@ module Datadog
   module AppSec
     module WAF
       module LibDDWAF
-        class Error < StandardError; end
+        class Error < StandardError
+          attr_reader :ruleset_info
+
+          def initialize(msg, ruleset_info: nil)
+            @ruleset_info = ruleset_info
+          end
+        end
 
         extend ::FFI::Library
 
@@ -151,8 +157,19 @@ module Datadog
         typedef Object.by_ref, :ddwaf_rule
 
         class Config < ::FFI::Struct
-          layout :maxArrayLength, :uint64,
-                 :maxMapDepth,    :uint64
+          class Limits < ::FFI::Struct
+            layout :max_container_size,  :uint32,
+                   :max_container_depth, :uint32,
+                   :max_string_length,   :uint32
+          end
+
+          class Obfuscator < ::FFI::Struct
+            layout :key_regex,   :pointer, # :charptr
+                   :value_regex, :pointer  # :charptr
+          end
+
+          layout :limits,     Limits,
+                 :obfuscator, Obfuscator
         end
 
         typedef Config.by_ref, :ddwaf_config
@@ -172,7 +189,7 @@ module Datadog
         attach_function :ddwaf_init, [:ddwaf_rule, :ddwaf_config, :ddwaf_ruleset_info], :ddwaf_handle
         attach_function :ddwaf_destroy, [:ddwaf_handle], :void
 
-        attach_function :ddwaf_required_addresses, [:ddwaf_handle, :uint32ptr], :charptrptr
+        attach_function :ddwaf_required_addresses, [:ddwaf_handle, UInt32Ptr], :charptrptr
 
         # running
 
@@ -339,10 +356,13 @@ module Datadog
       class Handle
         attr_reader :handle_obj
 
-        DEFAULT_MAX_ARRAY_LENGTH = 0
-        DEFAULT_MAX_MAP_DEPTH = 0
+        DEFAULT_MAX_CONTAINER_SIZE  = 0
+        DEFAULT_MAX_CONTAINER_DEPTH = 0
+        DEFAULT_MAX_STRING_LENGTH   = 0
 
-        def initialize(rule, config = {})
+        attr_reader :ruleset_info
+
+        def initialize(rule, limits: {}, obfuscator: {})
           rule_obj = Datadog::AppSec::WAF.ruby_to_object(rule)
           if rule_obj.null? || rule_obj[:type] == :ddwaf_object_invalid
             fail LibDDWAF::Error, "Could not convert object #{rule.inspect}"
@@ -353,14 +373,25 @@ module Datadog
             fail LibDDWAF::Error, 'Could not create config struct'
           end
 
-          config_obj[:maxArrayLength] = config[:max_array_length] || DEFAULT_MAX_ARRAY_LENGTH
-          config_obj[:maxMapDepth]    = config[:max_map_depth]    || DEFAULT_MAX_MAP_DEPTH
+          config_obj[:limits][:max_container_size]  = limits[:max_container_size]  || DEFAULT_MAX_CONTAINER_SIZE
+          config_obj[:limits][:max_container_depth] = limits[:max_container_depth] || DEFAULT_MAX_CONTAINER_DEPTH
+          config_obj[:limits][:max_string_length]   = limits[:max_string_length]   || DEFAULT_MAX_STRING_LENGTH
+          config_obj[:obfuscator][:key_regex]       = FFI::MemoryPointer.from_string(obfuscator[:key_regex])   if obfuscator[:key_regex]
+          config_obj[:obfuscator][:value_regex]     = FFI::MemoryPointer.from_string(obfuscator[:value_regex]) if obfuscator[:value_regex]
 
-          ruleset_info = LibDDWAF::RuleSetInfoNone
+          ruleset_info = LibDDWAF::RuleSetInfo.new
 
           @handle_obj = Datadog::AppSec::WAF::LibDDWAF.ddwaf_init(rule_obj, config_obj, ruleset_info)
+
+          @ruleset_info = {
+            loaded: ruleset_info[:loaded],
+            failed: ruleset_info[:failed],
+            errors: WAF.object_to_ruby(ruleset_info[:errors]),
+            version: ruleset_info[:version],
+          }
+
           if @handle_obj.null?
-            fail LibDDWAF::Error, 'Could not create handle'
+            fail LibDDWAF::Error.new('Could not create handle', ruleset_info: @ruleset_info)
           end
 
           ObjectSpace.define_finalizer(self, Handle.finalizer(handle_obj))
@@ -374,6 +405,15 @@ module Datadog
             Datadog::AppSec::WAF::LibDDWAF.ddwaf_destroy(handle_obj)
           end
         end
+
+        def required_addresses
+          count = Datadog::AppSec::WAF::LibDDWAF::UInt32Ptr.new
+          list = Datadog::AppSec::WAF::LibDDWAF.ddwaf_required_addresses(handle_obj, count)
+
+          return [] if count == 0 # list is null
+
+          list.get_array_of_string(0, count[:value])
+        end
       end
 
       Result = Struct.new(:action, :data, :total_runtime, :timeout)

data/vendor/libddwaf/{libddwaf-1.2.1-linux-aarch64 → libddwaf-1.3.0-linux-aarch64}/include/ddwaf.h

@@ -17,8 +17,8 @@ extern "C"
 #include <stddef.h>
 
 #define DDWAF_MAX_STRING_LENGTH 4096
-#define DDWAF_MAX_MAP_DEPTH 20
-#define DDWAF_MAX_ARRAY_LENGTH 256
+#define DDWAF_MAX_CONTAINER_DEPTH 20
+#define DDWAF_MAX_CONTAINER_SIZE 256
 #define DDWAF_RUN_TIMEOUT 5000
 
 /**
@@ -114,10 +114,22 @@ struct _ddwaf_object
  **/
 struct _ddwaf_config
 {
-    /** Maximum length of ddwaf::object arrays. */
-    uint64_t maxArrayLength;
-    /** Maximum depth of ddwaf::object maps. */
-    uint64_t maxMapDepth;
+    struct {
+        /** Maximum size of ddwaf::object containers. */
+        uint32_t max_container_size;
+        /** Maximum depth of ddwaf::object containers. */
+        uint32_t max_container_depth;
+        /** Maximum length of ddwaf::object strings. */
+        uint32_t max_string_length;
+    } limits;
+
+    /** Obfuscator regexes - the strings are owned by the caller */
+    struct {
+        /** Regular expression for key-based obfuscation */
+        const char *key_regex;
+        /** Regular expression for value-based obfuscation */
+        const char *value_regex;
+    } obfuscator;
 };
 
 /**

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libddwaf
 version: !ruby/object:Gem::Version
-  version: 1.2.1.0.0.beta1
+  version: 1.3.0.1.0
 platform: aarch64-linux
 authors:
 - Datadog, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-18 00:00:00.000000000 Z
+date: 2022-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -41,8 +41,8 @@ files:
 - lib/datadog/appsec/waf.rb
 - lib/datadog/appsec/waf/version.rb
 - lib/libddwaf.rb
-- vendor/libddwaf/libddwaf-1.2.1-linux-aarch64/include/ddwaf.h
-- vendor/libddwaf/libddwaf-1.2.1-linux-aarch64/lib/libddwaf.so
+- vendor/libddwaf/libddwaf-1.3.0-linux-aarch64/include/ddwaf.h
+- vendor/libddwaf/libddwaf-1.3.0-linux-aarch64/lib/libddwaf.so
 homepage: https://github.com/DataDog/libddwaf
 licenses:
 - BSD-3-Clause