libddwaf 1.3.0.1.0 → 1.3.0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66b2243d31b8a1a8c104ed2183bc4d7f86cdf3797367bd22f9f10399fe0d4084
-  data.tar.gz: c5536867034e0897a455dfe6a5e8df1fd5cd1ba85b55d0046398cad4f3e788e8
+  metadata.gz: 761413998bd5c350c78413a3b1ab14de9d7b31e5784e206d4a1e24747e84943b
+  data.tar.gz: 99f0a81a21c6e6cb78895422fc93345b2e466adc2977e97d0fb69f2ca7d4968c
 SHA512:
-  metadata.gz: 00064331055d7d5a441cab41f3e0e8da97650fd52bcf3334f7a88579cee3d1d388715b31929c6307e7aec31c02fcb102b7e365e290d90e3ab598c3490d006bbb
-  data.tar.gz: 51c25b3b55be9df332d59766444dd4839b2dc0fb99e6a9b985d9263400f611a4da7f4b7efe245132c3709182861d50fb64348010b1544b003e19ebb37ebb2c9b
+  metadata.gz: ef74395170939fb40cca96f4b93628987d980d579a05083cbf7e738e239be2bd61bfde3e3666e5a6227f57681bd3961a24d81f33140e463110f80c916b5311d0
+  data.tar.gz: 834f41db4de087c0dc8df8ba418c54ff5d530223e94a627f65f818482183678626a89dcdc07b91045b66ae0b8d75b6f6e6452ff9e5f535bad231625a7cb8b340

data/.github/workflows/package.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Bundle
         run: |
           bundle install
-      - name: Build package
+      - name: Build gem
         run: |
           bundle exec rake build
       - name: Upload gem
@@ -41,6 +41,21 @@ jobs:
           - os: ubuntu-20.04
             cpu: aarch64
             platform: aarch64-linux
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: x86_64-linux-gnu
+          - os: ubuntu-20.04
+            cpu: aarch64
+            platform: aarch64-linux-gnu
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: x86_64-linux-musl
+          - os: ubuntu-20.04
+            cpu: aarch64
+            platform: aarch64-linux-musl
+          - os: ubuntu-20.04
+            cpu: universal
+            platform: java
           - os: macos-10.15
             cpu: x86_64
             platform: x86_64-darwin
@@ -58,13 +73,7 @@ jobs:
       - name: Bundle
         run: |
           bundle install
-      - name: Fetch binary library
-        run: |
-          bundle exec rake fetch[${{ matrix.platform }}]
-      - name: Extract binary library
-        run: |
-          bundle exec rake extract[${{ matrix.platform }}]
-      - name: Build package
+      - name: Build binary gem
         run: |
           bundle exec rake binary[${{ matrix.platform }}]
       - name: Upload gem
@@ -142,7 +151,37 @@ jobs:
             image: ruby:2.6-alpine
             qemu: aarch64
             libc: musl
-    name: Test package (${{ matrix.platform }}-${{ matrix.libc }})
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: x86_64-linux-gnu
+            image: ruby:2.6
+            qemu: amd64
+            libc: gnu
+          - os: ubuntu-20.04
+            cpu: aarch64
+            platform: aarch64-linux-gnu
+            image: ruby:2.6
+            qemu: aarch64
+            libc: gnu
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: x86_64-linux-musl
+            image: ruby:2.6-alpine
+            qemu: amd64
+            libc: musl
+          - os: ubuntu-20.04
+            cpu: aarch64
+            platform: aarch64-linux-musl
+            image: ruby:2.6-alpine
+            qemu: aarch64
+            libc: musl
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: java
+            image: jruby:9.3.0.0
+            qemu: amd64
+            libc: gnu
+    name: Test package (${{ matrix.platform }}, ${{ matrix.libc }}, ${{ matrix.cpu }})
     runs-on: ${{ matrix.os }}
     steps:
       - name: Enable ${{ matrix.qemu }} platform

data/.github/workflows/test.yml

@@ -10,148 +10,148 @@ jobs:
         include:
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:3.1
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-gnu
             image: ruby:3.1
             qemu: arm64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:3.0
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-gnu
             image: ruby:3.0
             qemu: arm64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.7
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-gnu
             image: ruby:2.7
             qemu: arm64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.6
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-gnu
             image: ruby:2.6
             qemu: arm64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.5
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.4
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.3
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.2
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-gnu
             image: ruby:2.1
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-musl
             image: ruby:3.1-alpine
             qemu: amd64
             libc: musl
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-musl
             image: ruby:3.1-alpine
             qemu: arm64
             libc: musl
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-musl
             image: ruby:3.0-alpine
             qemu: amd64
             libc: musl
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-musl
             image: ruby:3.0-alpine
             qemu: arm64
             libc: musl
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-musl
             image: ruby:2.7-alpine
             qemu: amd64
             libc: musl
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-musl
             image: ruby:2.7-alpine
             qemu: arm64
             libc: musl
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux-musl
             image: ruby:2.6-alpine
             qemu: amd64
             libc: musl
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
+            platform: aarch64-linux-musl
             image: ruby:2.6-alpine
             qemu: arm64
             libc: musl
         # TODO: jruby images have no sudo so apt-get can't get a lock
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.3
+        #   platform: x86_64-linux-gnu
+        #   image: jruby:9.3.0.0
         #   qemu: amd64
         #   libc: gnu
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.2
+        #   platform: x86_64-linux-gnu
+        #   image: jruby:9.2.8.0
         #   qemu: amd64
         #   libc: gnu
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.1
-        #   qemu: amd64
+        #   platform: aarch64-linux-gnu
+        #   image: jruby:9.3.4.0
+        #   qemu: arm64
         #   libc: gnu
     name: Test (${{ matrix.image }}, ${{ matrix.cpu }})
     runs-on: ${{ matrix.os }}

data/README.md

@@ -4,3 +4,121 @@
 
 For the libddwaf implementation, see this repository:
  - [``libddwaf``: libddwaf](https://github.com/DataDog/libddwaf.git)
+
+
+
+## Rake tasks
+
+### Outline
+
+A typical workflow is as follows:
+
+```
+rake fetch    # fetch prebuilt libddwaf binaries tarball in vendor/libddwaf
+rake extract  # extract downloaded tarball in vendor/libddwaf
+rake spec     # run rspec
+rake binary   # build the gem
+```
+
+Note that each depends on the previous one, but `fetch` and `extract` are lazy, which proves useful to produce manual builds.
+
+### Platform selection
+
+By default the above will automatically use the local Ruby platform.
+
+Since libddwaf binary builds are available upstream, it's possible to build gems for any platform on any other platform. To that end `fetch`, `extract`, and `binary` can take an argument to specify the Ruby platform for which these operations should apply:
+
+```
+rake fetch[x86_64-linux-musl]
+rake extract[x86_64-linux-musl]
+rake binary[x86_64-linux-musl]
+```
+
+Of course you can't force the platform for `rspec` since that requires running code; see the Docker section below for ways to achieve that.
+
+Note that zsh gives special meaning to brackets, therefore you may need to quote the argument:
+
+```
+rake 'fetch[x86_64-linux-musl]'
+```
+
+Available platforms are:
+
+```
+x86_64-linux-musl   # Alpine build: targets musl-based Linux
+x86_64-linux-gnu    # Debian build: targets glibc-based Linux
+x86_64-linux        # Portable build: targets multiple linux libc
+x86_64-darwin       # Darwin build: targets macOS
+aarch64-linux-musl  # Same as above, for ARMv8
+aarch64-linux-gnu   # Same as above, for ARMv8
+aarch64-linux       # Same as above, for ARMv8
+arm64-darwin        # Same as above, for Apple Silicon
+java                # JRuby build, universal
+```
+
+Note: since it is not (yet) possible to package gems for the `java` Ruby platform any other way than `java`, it has to package all the native architectures.
+
+In addition, options can be specified for the portable build:
+
+```
+rake binary[x86_64-linux:gnu+musl]  # Combined build: combine musl and glibc builds, selecting one at runtime
+rake binary[x86_64-linux:llvm]      # Hybrid build: linked to llvm static libs and built against a musl sysroot
+```
+
+See upstream libddwaf for details about the [hybrid portable build](https://github.com/DataDog/libddwaf/blob/master/docker/libddwaf/README.md).
+
+## Testing with Docker
+
+Unless using Docker for Mac, remember to enable foreign CPU emulation via QEMU:
+
+```
+# aarch64 on x86_64 hardware
+docker run --privileged --rm tonistiigi/binfmt --install arm64
+# x86_64 on aarch64 hardware
+docker run --privileged --rm tonistiigi/binfmt --install amd64
+```
+
+Then you can substitute e.g `--platform linux/x86_64` with `--platform linux/aarch64` below.
+
+### GNU (Debian)
+
+```
+# this is too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.1 sh -c 'rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+# these are fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.2 sh -c 'rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.3 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.4 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.5 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.6 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.7 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.0 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```
+
+### musl (Alpine)
+
+```
+# these are too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.2-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+# these are fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.3-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.4-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.5-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.6-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.7-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.0-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```
+
+### JRuby
+
+```
+# these are too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.2.8.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.3.0.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+# this is fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.3.4.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```

data/lib/datadog/appsec/waf/version.rb

@@ -3,7 +3,7 @@ module Datadog
     module WAF
       module VERSION
         BASE_STRING = '1.3.0'
-        STRING = "#{BASE_STRING}.1.0"
+        STRING = "#{BASE_STRING}.2.0"
         MINIMUM_RUBY_VERSION = '2.1'
       end
     end

data/lib/datadog/appsec/waf.rb

@@ -32,12 +32,22 @@ module Datadog
           Gem::Platform.local.os
         end
 
+        def self.local_version
+          return nil unless local_os == 'linux'
+
+          # Old rubygems don't handle non-gnu linux correctly
+          return $1 if RUBY_PLATFORM =~ /linux-(.+)$/
+
+          'gnu'
+        end
+
         def self.local_cpu
           if RUBY_ENGINE == 'jruby'
             os_arch = java.lang.System.get_property('os.arch')
 
             cpu = case os_arch
                   when 'amd64' then 'x86_64'
+                  when 'aarch64' then 'aarch64'
                   else raise Error, "unsupported JRuby os.arch: #{os_arch.inspect}"
                   end
 
@@ -47,12 +57,28 @@ module Datadog
           Gem::Platform.local.cpu
         end
 
+        def self.vendor_dir
+          File.join(__dir__, '../../../vendor')
+        end
+
+        def self.libddwaf_vendor_dir
+          File.join(vendor_dir, 'libddwaf')
+        end
+
+        def self.shared_lib_triplet
+          local_version ? "#{local_os}-#{local_version}-#{local_cpu}" : "#{local_os}-#{local_cpu}"
+        end
+
+        def self.libddwaf_dir
+          File.join(libddwaf_vendor_dir, "libddwaf-#{Datadog::AppSec::WAF::VERSION::BASE_STRING}-#{shared_lib_triplet}")
+        end
+
         def self.shared_lib_extname
           Gem::Platform.local.os == 'darwin' ? '.dylib' : '.so'
         end
 
         def self.shared_lib_path
-          File.join(__dir__, "../../../vendor/libddwaf/libddwaf-#{Datadog::AppSec::WAF::VERSION::BASE_STRING}-#{local_os}-#{local_cpu}/lib/libddwaf#{shared_lib_extname}")
+          File.join(libddwaf_dir, 'lib', "libddwaf#{shared_lib_extname}")
         end
 
         ffi_lib [shared_lib_path]
@@ -265,7 +291,7 @@ module Datadog
           end
 
           val.each do |k, v|
-            res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.size, ruby_to_object(v))
+            res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.bytesize, ruby_to_object(v))
             unless res
               fail LibDDWAF::Error, "Could not add to map object: #{k.inspect} => #{v.inspect}"
             end
@@ -274,7 +300,7 @@ module Datadog
           obj
         when String
           obj = LibDDWAF::Object.new
-          res = LibDDWAF.ddwaf_object_stringl(obj, val, val.size)
+          res = LibDDWAF.ddwaf_object_stringl(obj, val, val.bytesize)
           if res.null?
             fail LibDDWAF::Error, "Could not convert into object: #{val}"
           end
@@ -282,7 +308,8 @@ module Datadog
           obj
         when Symbol
           obj = LibDDWAF::Object.new
-          res = LibDDWAF.ddwaf_object_stringl(obj, val.to_s, val.size)
+          str = val.to_s
+          res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
           if res.null?
             fail LibDDWAF::Error, "Could not convert into object: #{val}"
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libddwaf
 version: !ruby/object:Gem::Version
-  version: 1.3.0.1.0
+  version: 1.3.0.2.0
 platform: ruby
 authors:
 - Datadog, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-29 00:00:00.000000000 Z
+date: 2022-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi