Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for per-input transformers #170

Merged
merged 3 commits into from
May 16, 2023
Merged

Support for per-input transformers #170

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8ac7048
Support for per-input transformers
Anilm3 May 10, 2023
0e459d0
Tests
Anilm3 May 11, 2023
f8235da
Make data source input specific
Anilm3 May 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions src/condition.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,18 @@

namespace ddwaf {

std::optional<event::match> condition::match_object(
const ddwaf_object *object, const rule_processor::base::ptr &processor) const
std::optional<event::match> condition::match_object(const ddwaf_object *object,
const rule_processor::base::ptr &processor,
const std::vector<PW_TRANSFORM_ID> &transformers) const
{
const bool has_transform = !transformers_.empty();
const bool has_transform = !transformers.empty();
bool transform_required = false;

if (has_transform) {
// This codepath is shared with the mutable path. The structure can't be const :/
transform_required =
// NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
PWTransformer::doesNeedTransform(transformers_, const_cast<ddwaf_object *>(object));
PWTransformer::doesNeedTransform(transformers, const_cast<ddwaf_object *>(object));
}

const size_t length =
Expand All @@ -42,7 +43,7 @@ std::optional<event::match> condition::match_object(

// Transform it and pick the pointer to process
bool transformFailed = false;
for (const PW_TRANSFORM_ID &transform : transformers_) {
for (const PW_TRANSFORM_ID &transform : transformers) {
transformFailed = !PWTransformer::transform(transform, &copy);
if (transformFailed || (copy.type == DDWAF_OBJ_STRING && copy.nbEntries == 0)) {
break;
Expand All @@ -57,8 +58,9 @@ std::optional<event::match> condition::match_object(
}

template <typename T>
std::optional<event::match> condition::match_target(
T &it, const rule_processor::base::ptr &processor, ddwaf::timer &deadline) const
std::optional<event::match> condition::match_target(T &it,
const rule_processor::base::ptr &processor, const std::vector<PW_TRANSFORM_ID> &transformers,
ddwaf::timer &deadline) const
{
for (; it; ++it) {
if (deadline.expired()) {
Expand All @@ -69,7 +71,7 @@ std::optional<event::match> condition::match_target(
continue;
}

auto optional_match = match_object(*it, processor);
auto optional_match = match_object(*it, processor, transformers);
if (!optional_match.has_value()) {
continue;
}
Expand Down Expand Up @@ -108,7 +110,7 @@ std::optional<event::match> condition::match(const object_store &store,
return std::nullopt;
}

for (const auto &[target, name, key_path] : targets_) {
for (const auto &[target, name, key_path, transformers] : targets_) {
if (deadline.expired()) {
throw ddwaf::timeout_exception();
}
Expand All @@ -128,10 +130,10 @@ std::optional<event::match> condition::match(const object_store &store,
std::optional<event::match> optional_match;
if (source_ == data_source::keys) {
object::key_iterator it(object, key_path, objects_excluded, limits_);
optional_match = match_target(it, processor, deadline);
optional_match = match_target(it, processor, transformers, deadline);
} else {
object::value_iterator it(object, key_path, objects_excluded, limits_);
optional_match = match_target(it, processor, deadline);
optional_match = match_target(it, processor, transformers, deadline);
}

if (optional_match.has_value()) {
Expand Down
21 changes: 10 additions & 11 deletions src/condition.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,17 +31,16 @@ class condition {
manifest::target_type root;
std::string name;
std::vector<std::string> key_path;
std::vector<PW_TRANSFORM_ID> transformers;
};

enum class data_source : uint8_t { values, keys };

condition(std::vector<target_type> targets, std::vector<PW_TRANSFORM_ID> transformers,
std::shared_ptr<rule_processor::base> processor, std::string data_id = {},
ddwaf::object_limits limits = ddwaf::object_limits(),
condition(std::vector<target_type> targets, std::shared_ptr<rule_processor::base> processor,
std::string data_id = {}, ddwaf::object_limits limits = ddwaf::object_limits(),
data_source source = data_source::values)
: targets_(std::move(targets)), transformers_(std::move(transformers)),
processor_(std::move(processor)), data_id_(std::move(data_id)), limits_(limits),
source_(source)
: targets_(std::move(targets)), processor_(std::move(processor)),
data_id_(std::move(data_id)), limits_(limits), source_(source)
{}

~condition() = default;
Expand All @@ -62,17 +61,17 @@ class condition {
}

protected:
std::optional<event::match> match_object(
const ddwaf_object *object, const rule_processor::base::ptr &processor) const;
std::optional<event::match> match_object(const ddwaf_object *object,
const rule_processor::base::ptr &processor,
const std::vector<PW_TRANSFORM_ID> &transformers) const;

template <typename T>
std::optional<event::match> match_target(
T &it, const rule_processor::base::ptr &processor, ddwaf::timer &deadline) const;
std::optional<event::match> match_target(T &it, const rule_processor::base::ptr &processor,
const std::vector<PW_TRANSFORM_ID> &transformers, ddwaf::timer &deadline) const;

[[nodiscard]] const rule_processor::base::ptr &get_processor(
const std::unordered_map<std::string, rule_processor::base::ptr> &dynamic_processors) const;
std::vector<condition::target_type> targets_;
std::vector<PW_TRANSFORM_ID> transformers_;
std::shared_ptr<rule_processor::base> processor_;
std::string data_id_;
ddwaf::object_limits limits_;
Expand Down
3 changes: 2 additions & 1 deletion src/parser/parser_v1.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,11 +100,12 @@ condition::ptr parseCondition(parameter::map &rule, manifest &target_manifest,
if (!key_path.empty()) {
target.key_path.emplace_back(key_path);
}
target.transformers = transformers;
targets.emplace_back(std::move(target));
}

return std::make_shared<condition>(
std::move(targets), std::move(transformers), std::move(processor), std::string{}, limits);
std::move(targets), std::move(processor), std::string{}, limits);
}

void parseRule(parameter::map &rule, base_section_info &info, manifest &target_manifest,
Expand Down
64 changes: 41 additions & 23 deletions src/parser/parser_v2.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,9 +100,38 @@ std::pair<std::string, rule_processor::base::ptr> parse_processor(
return {std::move(rule_data_id), std::move(processor)};
}

std::vector<PW_TRANSFORM_ID> parse_transformers(
const parameter::vector &root, condition::data_source &source)
{
if (root.empty()) {
return {};
}

std::vector<PW_TRANSFORM_ID> transformers;
transformers.reserve(root.size());

for (const auto &transformer_param : root) {
auto transformer = static_cast<std::string_view>(transformer_param);
PW_TRANSFORM_ID transform_id = PWTransformer::getIDForString(transformer);
switch (transform_id) {
case PWT_KEYS_ONLY:
source = ddwaf::condition::data_source::keys;
break;
case PWT_VALUES_ONLY:
source = ddwaf::condition::data_source::values;
break;
case PWT_INVALID:
throw ddwaf::parsing_error("invalid transformer " + std::string(transformer));
default:
transformers.push_back(transform_id);
}
}
return transformers;
}

condition::ptr parse_rule_condition(const parameter::map &root, manifest &target_manifest,
std::unordered_map<std::string, std::string> &rule_data_ids, condition::data_source source,
std::vector<PW_TRANSFORM_ID> transformers, const object_limits &limits)
const std::vector<PW_TRANSFORM_ID> &transformers, const object_limits &limits)
{
auto operation = at<std::string_view>(root, "operator");
auto params = at<parameter::map>(root, "parameters");
Expand Down Expand Up @@ -136,12 +165,18 @@ condition::ptr parse_rule_condition(const parameter::map &root, manifest &target
target.root = target_manifest.insert(address);
target.name = address;
target.key_path = std::move(kp);
auto input_transformers = at<parameter::vector>(input, "transformers", {});
if (input_transformers.empty()) {
target.transformers = transformers;
} else {
target.transformers = parse_transformers(input_transformers, source);
Anilm3 marked this conversation as resolved.
Show resolved Hide resolved
}

targets.emplace_back(target);
}

return std::make_shared<condition>(std::move(targets), std::move(transformers),
std::move(processor), std::move(rule_data_id), limits, source);
return std::make_shared<condition>(
std::move(targets), std::move(processor), std::move(rule_data_id), limits, source);
}

rule_spec parse_rule(parameter::map &rule, manifest &target_manifest,
Expand All @@ -151,24 +186,7 @@ rule_spec parse_rule(parameter::map &rule, manifest &target_manifest,
std::vector<PW_TRANSFORM_ID> rule_transformers;
auto data_source = ddwaf::condition::data_source::values;
auto transformers = at<parameter::vector>(rule, "transformers", {});
for (const auto &transformer_param : transformers) {
auto transformer = static_cast<std::string_view>(transformer_param);
PW_TRANSFORM_ID transform_id = PWTransformer::getIDForString(transformer);
if (transform_id == PWT_INVALID) {
throw ddwaf::parsing_error("invalid transformer " + std::string(transformer));
}

if (transform_id == PWT_KEYS_ONLY) {
if (!rule_transformers.empty()) {
DDWAF_WARN("keys_only transformer should be the first one "
"in the list, all transformers will be applied to "
"keys and not values");
}
data_source = ddwaf::condition::data_source::keys;
} else {
rule_transformers.push_back(transform_id);
}
}
rule_transformers = parse_transformers(transformers, data_source);

std::vector<condition::ptr> conditions;
auto conditions_array = at<parameter::vector>(rule, "conditions");
Expand Down Expand Up @@ -301,8 +319,8 @@ condition::ptr parse_filter_condition(
targets.emplace_back(target);
}

return std::make_shared<condition>(std::move(targets), std::vector<PW_TRANSFORM_ID>{},
std::move(processor), std::string{}, limits);
return std::make_shared<condition>(
std::move(targets), std::move(processor), std::string{}, limits);
}

input_filter_spec parse_input_filter(
Expand Down
Loading