(chore): upgrade libddwaf to v1.17 (#92)

JIRA: APPSEC-52726

## Changes

- The WAF result actions are now a mapping from action type to action
parameters, instead of a slice of action IDs
- Added `skip-smoke-tests` label for such API breaking changes where
smoke-tests are expected to fail

Author: Hellzy

.github/workflows/test.yml

@@ -20,6 +20,7 @@ jobs:
     name: Containerized
     uses: ./.github/workflows/_test_containerized.yml
   smoke-tests:
+    if: "!contains(github.event.pull_request.labels.*.name, 'skip-smoke-tests')"
     name: Smoke Tests
     uses: DataDog/dd-trace-go/.github/workflows/smoke-tests.yml@main
     with:
@@ -37,10 +38,10 @@ jobs:
     if: '!cancelled()'
     steps:
       - name: Done
-        if: needs.bare-metal.result == 'success' && needs.containerized.result == 'success' && needs.smoke-tests.result == 'success'
+        if: needs.bare-metal.result == 'success' && needs.containerized.result == 'success' && (needs.smoke-tests.result == 'success' || needs.smoke-tests.result == 'skipped')
         run: echo "Done!"
       - name: Done
-        if: needs.bare-metal.result != 'success' || needs.containerized.result != 'success' || needs.smoke-tests.result != 'success'
+        if: needs.bare-metal.result != 'success' || needs.containerized.result != 'success' || (needs.smoke-tests.result != 'success' && needs.smoke-tests.result != 'skipped')
         run: |-
           echo "Failed!"
           exit 1

context.go

@@ -276,9 +276,7 @@ func unwrapWafResult(ret bindings.WafReturnCode, result *bindings.WafResult) (re
 		return res, err
 	}
 	if size := result.Actions.NbEntries; size > 0 {
-		// using ruleIdArray cause it decodes string array (I think)
-		res.Actions, err = decodeStringArray(&result.Actions)
-		// TODO: use decode array, and eventually genericize the function
+		res.Actions, err = decodeMap(&result.Actions)
 		if err != nil {
 			return res, err
 		}

internal/lib/.version

@@ -1 +1 @@
-1.16.1
+1.17.0

internal/lib/libddwaf-darwin-amd64.dylib

@@ -162,7 +162,9 @@ struct _ddwaf_result
     bool timeout;
     /** Array of events generated, this is guaranteed to be an array **/
     ddwaf_object events;
-    /** Array of actions generated, this is guaranteed to be an array **/
+    /** Map of actions generated, this is guaranteed to be a map in the format:
+     * {action type: { <parameter map> }, ...}
+     **/
     ddwaf_object actions;
     /** Map containing all derived objects in the format (address, value) **/
     ddwaf_object derivatives;

internal/lib/libddwaf-darwin-arm64.dylib

@@ -88,8 +88,8 @@ type Result struct {
 	Derivatives map[string]any
 
 	// Actions is the set of actions the WAF decided on when evaluating rules
-	// against the provided address data.
-	Actions []string
+	// against the provided address data. It maps action types to their dynamic parameter values
+	Actions map[string]any
 
 	// TimeSpent is the time the WAF self-reported as spent processing the call to ddwaf_run
 	TimeSpent time.Duration

internal/lib/libddwaf-linux-amd64.so

@@ -676,7 +676,7 @@ func TestMatchingEphemeralOnly(t *testing.T) {
 }
 
 func TestActions(t *testing.T) {
-	testActions := func(expectedActions []string) func(t *testing.T) {
+	testActions := func(expectedActions []string, expectedActionsTypes []string) func(t *testing.T) {
 		return func(t *testing.T) {
 
 			waf, err := newDefaultHandle(newArachniTestRule([]ruleInput{{Address: "my.input"}}, expectedActions))
@@ -698,13 +698,14 @@ func TestActions(t *testing.T) {
 			res, err := wafCtx.Run(RunAddressData{Persistent: values, Ephemeral: ephemeral}, time.Second)
 			require.NoError(t, err)
 			require.NotEmpty(t, res.Events)
-			// FIXME: check with libddwaf why the order of returned actions is not kept the same
-			require.ElementsMatch(t, expectedActions, res.Actions)
+			for _, aType := range expectedActionsTypes {
+				require.Contains(t, res.Actions, aType)
+			}
 		}
 	}
 
-	t.Run("single", testActions([]string{"block"}))
-	t.Run("multiple-actions", testActions([]string{"action 1", "action 2", "action 3"}))
+	t.Run("single", testActions([]string{"block"}, []string{"block_request"}))
+	t.Run("multiple-actions", testActions([]string{"block", "extract_schema"}, []string{"block_request", "generate_schema"}))
 }
 
 func TestAddresses(t *testing.T) {