libddwaf 1.0.12.0.0.beta1-x86_64-linux

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: dab12980ca6c95ec58d821288140619a2d17f84b433fb497ab796ec0ef04f021
+  data.tar.gz: e14881741eddcb4a472c8ce8642158b5ff0efaa37e9b74dd986f2473a467d301
+SHA512:
+  metadata.gz: 8c3193bbaa560bece066b05fb549c1715b0a15305e298baf00fb1cf916d1c5324fc4c9d68e1c20d3361013eab0538d99754c747eac2262cd6ce5dba7120eb485
+  data.tar.gz: d9f44ab78c539a7cd3a33d9e5ab04f26b3146f7adbdd81316cc7c2653a8a1dc2f50db53c0817be2d079eb41724243f1fe959fb3ed0ae38fe0d48f943a9d85cbe

data/LICENSE

@@ -0,0 +1,6 @@
+## License
+
+This work is dual-licensed under Apache 2.0 or BSD3.
+You may select, at your option, one of the above-listed licenses.
+
+`SPDX-License-Identifier: Apache-2.0 OR BSD-3-Clause`

data/LICENSE-3rdparty.csv

@@ -0,0 +1,2 @@
+Component,Origin,License,Copyright
+core,https://github.com/ffi/ffi,BSD-3-Clause,"Copyright (c) 2008-2016, Ruby FFI project contributors"

data/LICENSE.Apache

@@ -0,0 +1,200 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2021 Datadog, Inc.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/LICENSE.BSD3

@@ -0,0 +1,24 @@
+Copyright (c) 2021, Datadog <info@datadoghq.com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of Datadog nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/NOTICE

@@ -0,0 +1,4 @@
+Datadog libddwaf-rb
+Copyright 2021-Present Datadog, Inc.
+
+This product includes software developed at Datadog, Inc. (https://www.datadoghq.com/).

data/lib/datadog/security/waf/version.rb

@@ -0,0 +1,12 @@
+module Datadog
+  module Security
+    module WAF
+      module VERSION
+        BASE_STRING = '1.0.12'
+        STRING = "#{BASE_STRING}.0.0.beta1"
+        MINIMUM_RUBY_VERSION = '2.1'
+        MAXIMUM_RUBY_VERSION = '3.1'
+      end
+    end
+  end
+end

data/lib/datadog/security/waf.rb

@@ -0,0 +1,402 @@
+require 'ffi'
+require 'json'
+require 'datadog/security/waf/version'
+
+module Datadog
+  module Security
+    module WAF
+      module LibDDWAF
+        class Error < StandardError; end
+
+        extend ::FFI::Library
+
+        def self.local_os
+          if RUBY_ENGINE == 'jruby'
+            os_name = java.lang.System.get_property('os.name')
+
+            os = case os_name
+                when /linux/i then 'linux'
+                when /mac/i   then 'darwin'
+                else raise Error, "unsupported JRuby os.name: #{os_name.inspect}"
+                end
+
+            return os
+          end
+
+          Gem::Platform.local.os
+        end
+
+        def self.local_cpu
+          if RUBY_ENGINE == 'jruby'
+            os_arch = java.lang.System.get_property('os.arch')
+
+            cpu = case os_arch
+                  when 'amd64' then 'x86_64'
+                  else raise Error, "unsupported JRuby os.arch: #{os_arch.inspect}"
+                  end
+
+            return cpu
+          end
+
+          Gem::Platform.local.cpu
+        end
+
+        def self.shared_lib_extname
+          Gem::Platform.local.os == 'darwin' ? '.dylib' : '.so'
+        end
+
+        def self.shared_lib_path
+          File.join(__dir__, "../../../vendor/libddwaf/libddwaf-#{Datadog::Security::WAF::VERSION::BASE_STRING}-#{local_os}-#{local_cpu}/lib/libddwaf#{shared_lib_extname}")
+        end
+
+        ffi_lib [shared_lib_path]
+
+        # version
+
+        class Version < ::FFI::Struct
+          layout :major, :uint16,
+                :minor, :uint16,
+                :patch, :uint16
+        end
+
+        typedef Version.by_ref, :ddwaf_version
+
+        attach_function :ddwaf_get_version, [:ddwaf_version], :void
+
+        # ddwaf::object data structure
+
+        DDWAF_OBJ_TYPE = enum :ddwaf_obj_invalid,  0,
+                              :ddwaf_obj_signed,   1 << 0,
+                              :ddwaf_obj_unsigned, 1 << 1,
+                              :ddwaf_obj_string,   1 << 2,
+                              :ddwaf_obj_array,    1 << 3,
+                              :ddwaf_obj_map,      1 << 4
+
+        typedef :pointer, :charptr
+
+        class ObjectValueUnion < ::FFI::Union
+          layout :stringValue, :charptr,
+                :uintValue,   :uint64,
+                :intValue,    :int64,
+                :array,       :pointer
+        end
+
+        class Object < ::FFI::Struct
+          layout :parameterName,       :charptr,
+                :parameterNameLength, :uint64,
+                :valueUnion,          ObjectValueUnion,
+                :nbEntries,           :uint64,
+                :type,                DDWAF_OBJ_TYPE
+        end
+
+        typedef Object.by_ref, :ddwaf_object
+
+        attach_function :ddwaf_object_invalid, [:ddwaf_object], :ddwaf_object
+        attach_function :ddwaf_object_string, [:ddwaf_object, :string], :ddwaf_object
+        attach_function :ddwaf_object_stringl, [:ddwaf_object, :charptr, :size_t], :ddwaf_object
+        attach_function :ddwaf_object_stringl_nc, [:ddwaf_object, :charptr, :size_t], :ddwaf_object
+        attach_function :ddwaf_object_unsigned, [:ddwaf_object, :uint64], :ddwaf_object
+        attach_function :ddwaf_object_signed, [:ddwaf_object, :int64], :ddwaf_object
+        attach_function :ddwaf_object_unsigned_force, [:ddwaf_object, :uint64], :ddwaf_object
+        attach_function :ddwaf_object_signed_force, [:ddwaf_object, :int64], :ddwaf_object
+
+        attach_function :ddwaf_object_array, [:ddwaf_object], :ddwaf_object
+        attach_function :ddwaf_object_array_add, [:ddwaf_object, :ddwaf_object], :bool
+
+        attach_function :ddwaf_object_map, [:ddwaf_object], :ddwaf_object
+        attach_function :ddwaf_object_map_add, [:ddwaf_object, :string, :pointer], :bool
+        attach_function :ddwaf_object_map_addl, [:ddwaf_object, :charptr, :size_t, :pointer], :bool
+        attach_function :ddwaf_object_map_addl_nc, [:ddwaf_object, :charptr, :size_t, :pointer], :bool
+
+        ObjectFree = attach_function :ddwaf_object_free, [:ddwaf_object], :void
+        ObjectNoFree = ::FFI::Pointer::NULL
+
+        # main handle
+
+        typedef :pointer, :ddwaf_handle
+        typedef Object.by_ref, :ddwaf_rule
+
+        class Config < ::FFI::Struct
+          layout :maxArrayLength, :uint64,
+                :maxMapDepth,    :uint64,
+                :maxTimeStore,   :uint64
+        end
+
+        typedef Config.by_ref, :ddwaf_config
+
+        attach_function :ddwaf_init, [:ddwaf_rule, :ddwaf_config], :ddwaf_handle
+        attach_function :ddwaf_destroy, [:ddwaf_handle], :void
+
+        # running
+
+        typedef :pointer, :ddwaf_context
+
+        callback :ddwaf_object_free_fn, [:ddwaf_object], :void
+
+        attach_function :ddwaf_context_init, [:ddwaf_handle, :ddwaf_object_free_fn], :ddwaf_context
+        attach_function :ddwaf_context_destroy, [:ddwaf_context], :void
+
+
+        DDWAF_RET_CODE = enum :ddwaf_err_internal,         -4,
+                              :ddwaf_err_invalid_object,   -3,
+                              :ddwaf_err_invalid_argument, -2,
+                              :ddwaf_err_timeout,          -1,
+                              :ddwaf_good,                  0,
+                              :ddwaf_monitor,               1,
+                              :ddwaf_block,                 2
+
+        class Result < ::FFI::Struct
+          layout :action,           DDWAF_RET_CODE,
+                :data,             :string,
+                :perfData,         :string,
+                :perfTotalRuntime, :uint32 # in us
+        end
+
+        typedef Result.by_ref, :ddwaf_result
+        typedef :uint64, :timeout_us
+
+        attach_function :ddwaf_run, [:ddwaf_context, :ddwaf_object, :ddwaf_result, :timeout_us], DDWAF_RET_CODE, blocking: true
+        attach_function :ddwaf_result_free, [:ddwaf_result], :void
+
+        # logging
+
+        DDWAF_LOG_LEVEL = enum :ddwaf_log_trace,
+                              :ddwaf_log_debug,
+                              :ddwaf_log_info,
+                              :ddwaf_log_warn,
+                              :ddwaf_log_error,
+                              :ddwaf_log_off
+
+        callback :ddwaf_log_cb, [DDWAF_LOG_LEVEL, :string, :string, :uint, :charptr, :uint64], :void
+
+        attach_function :ddwaf_set_log_cb, [:ddwaf_log_cb, DDWAF_LOG_LEVEL], :bool
+      end
+
+      def self.version
+        version = LibDDWAF::Version.new
+        LibDDWAF.ddwaf_get_version(version.pointer)
+
+        [version[:major], version[:minor], version[:patch]]
+      end
+
+      def self.ruby_to_object(val)
+        case val
+        when Array
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_array(obj)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          val.each do |e|
+            res = LibDDWAF.ddwaf_object_array_add(obj, ruby_to_object(e))
+            unless res
+              fail LibDDWAF::Error, "Could not add to map object: #{k.inspect} => #{v.inspect}"
+            end
+          end
+
+          obj
+        when Hash
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_map(obj)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          val.each do |k, v|
+            res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.size, ruby_to_object(v))
+            unless res
+              fail LibDDWAF::Error, "Could not add to map object: #{k.inspect} => #{v.inspect}"
+            end
+          end
+
+          obj
+        when String
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_stringl(obj, val, val.size)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        when Symbol
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_stringl(obj, val.to_s, val.size)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        when Integer
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_string(obj, val.to_s)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        when Float
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_string(obj, val.to_s)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        when TrueClass, FalseClass
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_string(obj, val.to_s)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        else
+          obj = LibDDWAF::Object.new
+          res = LibDDWAF.ddwaf_object_invalid(obj)
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val}"
+          end
+
+          obj
+        end
+      end
+
+      def self.object_to_ruby(obj)
+        case obj[:type]
+        when :ddwaf_obj_invalid
+          nil
+        when :ddwaf_obj_string
+          obj[:valueUnion][:stringValue].read_bytes(obj[:nbEntries])
+        when :ddwaf_obj_signed
+          obj[:valueUnion][:intValue]
+        when :ddwaf_obj_unsigned
+          obj[:valueUnion][:uintValue]
+        when :ddwaf_obj_array
+          (0...obj[:nbEntries]).each.with_object([]) do |i, a|
+            ptr = obj[:valueUnion][:array] + i * LibDDWAF::Object.size
+            e = object_to_ruby(LibDDWAF::Object.new(ptr))
+            a << e
+          end
+        when :ddwaf_obj_map
+          (0...obj[:nbEntries]).each.with_object({}) do |i, h|
+            ptr = obj[:valueUnion][:array] + i * Datadog::Security::WAF::LibDDWAF::Object.size
+            o = Datadog::Security::WAF::LibDDWAF::Object.new(ptr)
+            l = o[:parameterNameLength]
+            k = o[:parameterName].read_bytes(l)
+            v = object_to_ruby(LibDDWAF::Object.new(ptr))
+            h[k] = v
+          end
+        end
+      end
+
+      def self.logger=(logger)
+        @log_cb = proc do |level, func, file, line, message, len|
+          logger.debug { { level: level, func: func, file: file, message: message.read_bytes(len) }.inspect }
+        end
+
+        Datadog::Security::WAF::LibDDWAF.ddwaf_set_log_cb(@log_cb, :ddwaf_log_trace)
+      end
+
+      class Handle
+        attr_reader :handle_obj
+
+        DEFAULT_MAX_ARRAY_LENGTH = 0
+        DEFAULT_MAX_MAP_DEPTH = 0
+        DEFAULT_MAX_TIME_STORE = 0
+
+        def initialize(rule, config = {})
+          rule_obj = Datadog::Security::WAF.ruby_to_object(rule)
+          if rule_obj.null? || rule_obj[:type] == :ddwaf_object_invalid
+            fail LibDDWAF::Error, "Could not convert object #{rule.inspect}"
+          end
+
+          config_obj = Datadog::Security::WAF::LibDDWAF::Config.new
+          if config_obj.null?
+            fail LibDDWAF::Error, 'Could not create config struct'
+          end
+
+          config_obj[:maxArrayLength] = config[:max_array_length] || DEFAULT_MAX_ARRAY_LENGTH
+          config_obj[:maxMapDepth]    = config[:max_map_depth]    || DEFAULT_MAX_MAP_DEPTH
+          config_obj[:maxTimeStore]   = config[:max_time_store]   || DEFAULT_MAX_TIME_STORE
+
+          @handle_obj = Datadog::Security::WAF::LibDDWAF.ddwaf_init(rule_obj, config_obj)
+          if @handle_obj.null?
+            fail LibDDWAF::Error, 'Could not create handle'
+          end
+
+          ObjectSpace.define_finalizer(self, Handle.finalizer(handle_obj))
+        ensure
+          Datadog::Security::WAF::LibDDWAF.ddwaf_object_free(rule_obj) if rule_obj
+        end
+
+        def self.finalizer(handle_obj)
+          proc do |object_id|
+            Datadog::Security::WAF::LibDDWAF.ddwaf_destroy(handle_obj)
+          end
+        end
+      end
+
+      Result = Struct.new(:action, :data, :perf_data, :perf_total_runtime)
+
+      class Context
+        attr_reader :context_obj
+
+        def initialize(handle)
+          handle_obj = handle.handle_obj
+          free_func = Datadog::Security::WAF::LibDDWAF::ObjectNoFree
+
+          @context_obj = Datadog::Security::WAF::LibDDWAF.ddwaf_context_init(handle_obj, free_func)
+          if @context_obj.null?
+            fail LibDDWAF::Error, 'Could not create context'
+          end
+
+          ObjectSpace.define_finalizer(self, Context.finalizer(context_obj))
+        end
+
+        def self.finalizer(context_obj)
+          proc do |object_id|
+            Datadog::Security::WAF::LibDDWAF.ddwaf_context_destroy(context_obj)
+          end
+        end
+
+        DEFAULT_TIMEOUT_US = 10_0000
+        ACTION_MAP_OUT = {
+          ddwaf_err_internal:         :err_internal,
+          ddwaf_err_invalid_object:   :err_invalid_object,
+          ddwaf_err_invalid_argument: :err_invalid_argument,
+          ddwaf_err_timeout:          :err_invalid_object,
+          ddwaf_good:                 :good,
+          ddwaf_monitor:              :monitor,
+          ddwaf_block:                :block,
+        }
+
+        def run(input, timeout = DEFAULT_TIMEOUT_US)
+          input_obj = Datadog::Security::WAF.ruby_to_object(input)
+          if input_obj.null?
+            fail LibDDWAF::Error, "Could not convert input: #{input.inspect}"
+          end
+
+          result_obj = Datadog::Security::WAF::LibDDWAF::Result.new
+          if result_obj.null?
+            fail LibDDWAF::Error, "Could not create result object"
+          end
+
+          code = Datadog::Security::WAF::LibDDWAF.ddwaf_run(@context_obj, input_obj, result_obj, timeout)
+
+          result = Result.new(
+            ACTION_MAP_OUT[result_obj[:action]],
+            (JSON.parse(result_obj[:data]) if result_obj[:data] != nil),
+            (JSON.parse(result_obj[:perfData]) if result_obj[:perfData] != nil),
+            result_obj[:perfTotalRuntime],
+          )
+
+          [ACTION_MAP_OUT[code], result]
+        ensure
+          Datadog::Security::WAF::LibDDWAF.ddwaf_object_free(input_obj) if input_obj
+          Datadog::Security::WAF::LibDDWAF.ddwaf_result_free(result_obj) if result_obj
+        end
+      end
+    end
+  end
+end

data/lib/libddwaf.rb

@@ -0,0 +1 @@
+require 'datadog/security/waf'

data/vendor/libddwaf/libddwaf-1.0.12-linux-x86_64/include/ddwaf.h

@@ -0,0 +1,486 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#ifndef pw_h
+#define pw_h
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stddef.h>
+
+#define DDWAF_MAX_STRING_LENGTH 4096
+#define DDWAF_MAX_MAP_DEPTH 20
+#define DDWAF_MAX_ARRAY_LENGTH 256
+#define DDWAF_RUN_TIMEOUT 5000
+
+/**
+ * @enum DDWAF_OBJ_TYPE
+ *
+ * Specifies the type of a ddwaf::object.
+ **/
+typedef enum
+{
+    DDWAF_OBJ_INVALID     = 0,
+    /** Value shall be decoded as a int64_t (or int32_t on 32bits platforms). **/
+    DDWAF_OBJ_SIGNED   = 1 << 0,
+    /** Value shall be decoded as a uint64_t (or uint32_t on 32bits platforms). **/
+    DDWAF_OBJ_UNSIGNED = 1 << 1,
+    /** Value shall be decoded as a UTF-8 string of length nbEntries. **/
+    DDWAF_OBJ_STRING   = 1 << 2,
+    /** Value shall be decoded as an array of ddwaf_object of length nbEntries, each item having no parameterName. **/
+    DDWAF_OBJ_ARRAY    = 1 << 3,
+    /** Value shall be decoded as an array of ddwaf_object of length nbEntries, each item having a parameterName. **/
+    DDWAF_OBJ_MAP      = 1 << 4,
+} DDWAF_OBJ_TYPE;
+
+/**
+ * @enum DDWAF_RET_CODE
+ *
+ * Codes returned by ddwaf_run.
+ **/
+typedef enum
+{
+    DDWAF_ERR_INTERNAL     = -4,
+    DDWAF_ERR_INVALID_OBJECT = -3,
+    DDWAF_ERR_INVALID_ARGUMENT = -2,
+    DDWAF_ERR_TIMEOUT      = -1,
+    DDWAF_GOOD             = 0,
+    DDWAF_MONITOR          = 1,
+    DDWAF_BLOCK            = 2
+} DDWAF_RET_CODE;
+
+/**
+ * @enum DDWAF_LOG_LEVEL
+ *
+ * Internal WAF log levels, to be used when setting the minimum log level and cb.
+ **/
+typedef enum
+{
+    DDWAF_LOG_TRACE,
+    DDWAF_LOG_DEBUG,
+    DDWAF_LOG_INFO,
+    DDWAF_LOG_WARN,
+    DDWAF_LOG_ERROR,
+    DDWAF_LOG_OFF,
+} DDWAF_LOG_LEVEL;
+
+typedef struct _ddwaf_handle* ddwaf_handle;
+typedef struct _ddwaf_context* ddwaf_context;
+typedef struct _ddwaf_object ddwaf_object;
+typedef struct _ddwaf_config ddwaf_config;
+typedef struct _ddwaf_result ddwaf_result;
+typedef struct _ddwaf_version ddwaf_version;
+
+/**
+ * @struct ddwaf_object
+ *
+ * Generic object used to pass data and rules to the WAF.
+ **/
+struct _ddwaf_object
+{
+    const char* parameterName;
+    uint64_t parameterNameLength;
+    // uintValue should be at least as wide as the widest type on the platform.
+    union
+    {
+        const char* stringValue;
+        uint64_t uintValue;
+        int64_t intValue;
+        const ddwaf_object* array;
+    };
+    uint64_t nbEntries;
+    DDWAF_OBJ_TYPE type;
+};
+
+/**
+ * @struct ddwaf_config
+ *
+ * Configuration to be provided to the WAF
+ **/
+struct _ddwaf_config
+{
+    /** Maximum length of ddwaf::object arrays. */
+    uint64_t maxArrayLength;
+    /** Maximum depth of ddwaf::object maps. */
+    uint64_t maxMapDepth;
+    /** Maximum size of the rule run time store. **/
+    int32_t maxTimeStore;
+};
+
+/**
+ * @struct ddwaf_result
+ *
+ * Structure containing the result of a WAF run.
+ **/
+struct _ddwaf_result
+{
+    /** Run result action **/
+    DDWAF_RET_CODE action;
+    /** Run result in JSON format **/
+    const char* data;
+    /** Performance data in JSON format **/
+    const char* perfData;
+    /** Total run time in microseconds **/
+    uint32_t perfTotalRuntime;
+};
+
+/**
+ * @ddwaf_version
+ *
+ * Structure containing the version of the WAF following semver.
+ **/
+struct _ddwaf_version
+{
+    uint16_t major;
+    uint16_t minor;
+    uint16_t patch;
+};
+
+/**
+ * @typedef ddwaf_object_free_fn
+ *
+ * Type of the function to free ddwaf::objects.
+ **/
+typedef void (*ddwaf_object_free_fn)(ddwaf_object *object);
+
+/**
+ * @typedef ddwaf_log_cb
+ *
+ * Callback that powerwaf will call to relay messages to the binding.
+ *
+ * @param level The logging level.
+ * @param function The native function that emitted the message. (nonnull)
+ * @param file The file of the native function that emmitted the message. (nonnull)
+ * @param line The line where the message was emmitted.
+ * @param message The size of the logging message. NUL-terminated
+ * @param message_len The length of the logging message (excluding NUL terminator).
+ */
+typedef void (*ddwaf_log_cb)(
+    DDWAF_LOG_LEVEL level, const char* function, const char* file, unsigned line,
+    const char* message, uint64_t message_len);
+
+/**
+ * ddwaf_init
+ *
+ * Initialize a ddwaf instance
+ *
+ * @param rule ddwaf::object containing the patterns to be used by the WAF. (nonnull)
+ * @param config Optional configuration of the WAF. (nullable)
+ *
+ * @return Handle to the WAF instance.
+ **/
+ddwaf_handle ddwaf_init(const ddwaf_object *rule, const ddwaf_config* config);
+
+/**
+ * ddwaf_destroy
+ *
+ * Destroy a WAF instance.
+ *
+ * @param Handle to the WAF instance.
+ */
+void ddwaf_destroy(ddwaf_handle handle);
+
+/**
+ * ddwaf_required_addresses
+ *
+ * Get a list of required (root) addresses. The memory is owned by the WAF and
+ * should not be freed.
+ *
+ * @param Handle to the WAF instance.
+ * @param size Output parameter in which the size will be returned. The value of
+ *             size will be 0 if the return value is nullptr.
+ * @return NULL if error, otherwise a pointer to an array with size elements.
+ **/
+const char* const* ddwaf_required_addresses(const ddwaf_handle handle, uint32_t *size);
+/**
+ * ddwaf_context_init
+ *
+ * Context object to perform matching using the provided WAF instance.
+ *
+ * @param handle Handle of the WAF instance containing the ruleset definition. (nonnull)
+ * @param obj_free Function to free the ddwaf::object provided to the context
+ *                 during calls to ddwaf_run. If the value of this function is
+ *                 NULL, the objects will not be freed. By default the value of
+ *                 this parameter should be ddwaf_object_free.
+ *
+ * @return Handle to the context instance.
+ *
+ * @note The WAF instance needs to be valid for the lifetime of the context.
+ **/
+ddwaf_context ddwaf_context_init(const ddwaf_handle handle, ddwaf_object_free_fn obj_free);
+
+/**
+ * ddwaf_run
+ *
+ * Perform a matching operation on the provided data
+ *
+ * @param context WAF context to be used in this run, this will determine the
+ *                ruleset which will be used and it will also ensure that
+ *                parameters are taken into account across runs (nonnull)
+ * @param data Data on which to perform the pattern matching. This data will be
+ *             stored by the context and used across multiple calls to this
+ *             function. Once the context is destroyed, the used-defined free
+ *             function will be used to free the data provided. Note that the
+ *             data passed must be valid until the destruction of the context.
+ *             (nonull)
+ * @param result Structure containing the result of the operation. (nullable)
+ * @param timeout Maximum time budget in microseconds.
+ *
+ * @return Return code of the operation, also contained in the result structure.
+ * @error DDWAF_ERR_INVALID_ARGUMENT The context is invalid, the data will not
+ *                                   be freed.
+ * @error DDWAF_ERR_INVALID_OBJECT The data provided didn't match the desired
+ *                                 structure or contained invalid objects, the
+ *                                 data will be freed by this function.
+ * @error DDWAF_ERR_TIMEOUT The operation timed out, the data will be owned by
+ *                          the context and freed during destruction.
+ * @error DDWAF_ERR_INTERNAL There was an unexpected error and the operation did
+ *                           not succeed. The state of the WAF is undefined if
+ *                           this error is produced and the ownership of the
+ *                           data is unknown. The result structure will not be
+ *                           filled if this error occurs.
+ **/
+DDWAF_RET_CODE ddwaf_run(ddwaf_context context, ddwaf_object *data, ddwaf_result *result, uint64_t timeout);
+
+/**
+ * ddwaf_context_destroy
+ *
+ * Performs the destruction of the context, freeing the data passed to it through
+ * ddwaf_run using the used-defined free function.
+ *
+ * @param context Context to destroy. (nonnull)
+ **/
+void ddwaf_context_destroy(ddwaf_context context);
+
+/**
+ * ddwaf_result_free
+ *
+ * Free a ddwaf_result structure.
+ *
+ * @param result Structure to free. (nonnull)
+ **/
+void ddwaf_result_free(ddwaf_result *result);
+
+/**
+ * ddwaf_object_invalid
+ *
+ * Creates an invalid object.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_invalid(ddwaf_object *object);
+
+/**
+ * ddwaf_object_string
+ *
+ * Creates an object from a string.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param string String to initialise the object with, this string will be copied
+ *               and its length will be calculated using strlen(string). (nonnull)
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_string(ddwaf_object *object, const char *string);
+
+/**
+ * ddwaf_object_stringl
+ *
+ * Creates an object from a string and its length.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param string String to initialise the object with, this string will be
+ *               copied. (nonnull)
+ * @param length Length of the string.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_stringl(ddwaf_object *object, const char *string, size_t length);
+
+/**
+ * ddwaf_object_stringl_nc
+ *
+ * Creates an object with the string pointer and length provided.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param string String pointer to initialise the object with.
+ * @param length Length of the string.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_stringl_nc(ddwaf_object *object, const char *string, size_t length);
+
+/**
+ * ddwaf_object_unsigned
+ *
+ * Creates an object using an unsigned integer (64-bit). The resulting object
+ * will contain a string created using the integer provided. This is the
+ * preferred method for passing an unsigned integer to the WAF.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param value Integer to initialise the object with.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_unsigned(ddwaf_object *object, uint64_t value);
+
+/**
+ * ddwaf_object_signed
+ *
+ * Creates an object using a signed integer (64-bit). The resulting object
+ * will contain a string created using the integer provided. This is the
+ * preferred method for passing a signed integer to the WAF.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param value Integer to initialise the object with.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_signed(ddwaf_object *object, int64_t value);
+
+/**
+ * ddwaf_object_unsigned_force
+ *
+ * Creates an object using an unsigned integer (64-bit). The resulting object
+ * will contain an unsigned integer as opposed to a string.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param value Integer to initialise the object with.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_unsigned_force(ddwaf_object *object, uint64_t value);
+
+/**
+ * ddwaf_object_signed_force
+ *
+ * Creates an object using a signed integer (64-bit). The resulting object
+ * will contain a signed integer as opposed to a string.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ * @param value Integer to initialise the object with.
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_signed_force(ddwaf_object *object, int64_t value);
+
+/**
+ * ddwaf_object_array
+ *
+ * Creates an array object, for sequential storage.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_array(ddwaf_object *object);
+
+/**
+ * ddwaf_object_map
+ *
+ * Creates a map object, for key-value storage.
+ *
+ * @param object Object to perform the operation on. (nonnull)
+ *
+ * @return A pointer to the passed object or NULL if the operation failed.
+ **/
+ddwaf_object* ddwaf_object_map(ddwaf_object *object);
+
+/**
+ * ddwaf_object_array_add
+ *
+ * Inserts an object into an array object.
+ *
+ * @param array Array in which to insert the object. (nonnull)
+ * @param object Object to insert into the array. (nonnull)
+ *
+ * @return The success or failure of the operation.
+ **/
+bool ddwaf_object_array_add(ddwaf_object *array, ddwaf_object *object);
+
+/**
+ * ddwaf_object_map_add
+ *
+ * Inserts an object into an map object, using a key.
+ *
+ * @param map Map in which to insert the object. (nonnull)
+ * @param key The key for indexing purposes, this string will be copied and its
+ *            length will be calcualted using strlen(key). (nonnull)
+ * @param object Object to insert into the array. (nonnull)
+ *
+ * @return The success or failure of the operation.
+ **/
+bool ddwaf_object_map_add(ddwaf_object *map, const char *key, ddwaf_object *object);
+
+/**
+ * ddwaf_object_map_addl
+ *
+ * Inserts an object into an map object, using a key and its length.
+ *
+ * @param map Map in which to insert the object. (nonnull)
+ * @param key The key for indexing purposes, this string will be copied (nonnull)
+ * @param length Length of the key.
+ * @param object Object to insert into the array. (nonnull)
+ *
+ * @return The success or failure of the operation.
+ **/
+bool ddwaf_object_map_addl(ddwaf_object *map, const char *key, size_t length, ddwaf_object *object);
+
+/**
+ * ddwaf_object_map_addl_nc
+ *
+ * Inserts an object into an map object, using a key and its length, but without
+ * creating a copy of the key.
+ *
+ * @param map Map in which to insert the object. (nonnull)
+ * @param key The key for indexing purposes, this string will be copied (nonnull)
+ * @param length Length of the key.
+ * @param object Object to insert into the array. (nonnull)
+ *
+ * @return The success or failure of the operation.
+ **/
+bool ddwaf_object_map_addl_nc(ddwaf_object *map, const char *key, size_t length, ddwaf_object *object);
+
+/**
+ * ddwaf_object_free
+ *
+ * @param object Object to free. (nonnull)
+ **/
+void ddwaf_object_free(ddwaf_object *object);
+
+/**
+ * ddwaf_get_version
+ *
+ * Return the version of the library
+ *
+ * @param version Version structure following semver
+ **/
+void ddwaf_get_version(ddwaf_version *version);
+
+/**
+ * ddwaf_set_log_cb
+ *
+ * Sets the callback to relay logging messages to the binding
+ *
+ * @param cb The callback to call, or NULL to stop relaying messages
+ * @param min_level The minimum logging level for which to relay messages
+ *
+ * @return whether the operation succeeded or not
+ **/
+bool ddwaf_set_log_cb(ddwaf_log_cb cb, DDWAF_LOG_LEVEL min_level);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* pw_h */

metadata

@@ -0,0 +1,73 @@
+--- !ruby/object:Gem::Specification
+name: libddwaf
+version: !ruby/object:Gem::Version
+  version: 1.0.12.0.0.beta1
+platform: x86_64-linux
+authors:
+- Datadog, Inc.
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2021-10-13 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 'libddwaf packages a WAF implementation in C++, exposed to Ruby
+
+  '
+email:
+- dev@datadoghq.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- LICENSE-3rdparty.csv
+- LICENSE.Apache
+- LICENSE.BSD3
+- NOTICE
+- lib/datadog/security/waf.rb
+- lib/datadog/security/waf/version.rb
+- lib/libddwaf.rb
+- vendor/libddwaf/libddwaf-1.0.12-linux-x86_64/include/ddwaf.h
+- vendor/libddwaf/libddwaf-1.0.12-linux-x86_64/lib/libddwaf.so
+homepage: https://github.com/DataDog/libddwaf
+licenses:
+- BSD-3-Clause
+metadata:
+  allowed_push_host: https://rubygems.org
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.1'
+  - - "<"
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.0.0
+requirements: []
+rubygems_version: 3.1.2
+signing_key: 
+specification_version: 4
+summary: Datadog WAF
+test_files: []