Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ASM] Fix access violation exception when reading WAF addresses #6510

Merged
merged 6 commits into from
Jan 10, 2025
+55 −27
Merged

[ASM] Fix access violation exception when reading WAF addresses #6510

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
42ba83e
Add lock
NachoEchevarria Jan 8, 2025
e26f469
Add unit tests
NachoEchevarria Jan 8, 2025
22f9429
Merge branch 'master' into nacho/FixAccessViolationException
NachoEchevarria Jan 8, 2025
9530e88
Merge branch 'master' into nacho/FixAccessViolationException
NachoEchevarria Jan 8, 2025
29df674
add if statement. Remove not needed.
NachoEchevarria Jan 9, 2025
3eb9985
Move try/catch block one level up
NachoEchevarria Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 13 additions & 26 deletions tracer/src/Datadog.Trace/AppSec/Waf/NativeBindings/WafLibraryInvoker.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,37 +243,24 @@ internal void SetupLogging(bool wafDebugEnabled)

internal string[] GetKnownAddresses(IntPtr wafHandle)
{
try
{
if (!IsKnowAddressesSuported())
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We already check that in Security.UpdateActiveAddresses

{
return Array.Empty<string>();
}

uint size = 0;
var result = _getKnownAddresses(wafHandle, ref size);
uint size = 0;
var result = _getKnownAddresses(wafHandle, ref size);

if (size == 0)
{
return Array.Empty<string>();
}

string[] knownAddresses = new string[size];
if (size == 0)
{
return Array.Empty<string>();
}

for (uint i = 0; i < size; i++)
{
// Calculate the pointer to each string
var stringPtr = Marshal.ReadIntPtr(result, (int)i * IntPtr.Size);
knownAddresses[i] = Marshal.PtrToStringAnsi(stringPtr);
}
string[] knownAddresses = new string[size];

return knownAddresses;
}
catch (Exception ex)
for (uint i = 0; i < size; i++)
{
Log.Error(ex, "Error while getting known addresses");
return Array.Empty<string>();
// Calculate the pointer to each string
var stringPtr = Marshal.ReadIntPtr(result, (int)i * IntPtr.Size);
knownAddresses[i] = Marshal.PtrToStringAnsi(stringPtr);
}

return knownAddresses;
}

internal bool IsKnowAddressesSuported(string libVersion = null)
Expand Down
28 changes: 27 additions & 1 deletion tracer/src/Datadog.Trace/AppSec/Waf/Waf.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,33 @@ public bool IsKnowAddressesSuported()

public string[] GetKnownAddresses()
{
return _wafLibraryInvoker.GetKnownAddresses(_wafHandle);
bool lockAcquired = false;
try
{
if (_wafLocker.EnterWriteLock())
{
lockAcquired = true;

var result = _wafLibraryInvoker.GetKnownAddresses(_wafHandle);
return result;
}
else
{
return Array.Empty<string>();
}
}
catch (Exception ex)
{
Log.Error(ex, "Error while getting known addresses");
return Array.Empty<string>();
}
finally
{
if (lockAcquired)
{
_wafLocker.ExitWriteLock();
}
}
}

private unsafe UpdateResult UpdateWafAndDispose(IEncodeResult updateData)
Expand Down
15 changes: 15 additions & 0 deletions tracer/test/Datadog.Trace.Security.Unit.Tests/RASP/RaspWafTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Datadog.Trace.AppSec;
using Datadog.Trace.AppSec.Rcm;
using Datadog.Trace.AppSec.Waf;
Expand Down Expand Up @@ -103,6 +104,20 @@ public void GivenARaspRule_WhenInsecureAccess_ThenBlock(object value, string par
actionType);
}

[Fact]
public void GivenWafInstance_WhenGetKnownAddressesInParallel_ThenResultIsOk()
{
var args = CreateArgs("paramValue");
var context = InitWaf(true, "rasp-rule-set.json", args, out var waf);

Parallel.For(0, 100, i =>
{
var addresses = waf.GetKnownAddresses();
addresses.Should().NotBeNull();
addresses.Count().Should().BeGreaterThan(0);
});
}

private void EnableDebugInfo(bool enable)
{
if (enable)
Expand Down
Loading