Revert Policy.id back to UUID struct

c/src/schema/policy_builder.h

@@ -23,6 +23,29 @@
 #define flatbuffers_extension "bin"
 #endif
 
+#define __dd_wls_UUID_formal_args , uint64_t v0, uint64_t v1
+#define __dd_wls_UUID_call_args , v0, v1
+static inline dd_wls_UUID_t *dd_wls_UUID_assign(dd_wls_UUID_t *p, uint64_t v0, uint64_t v1)
+{ p->hi = v0; p->lo = v1;
+  return p; }
+static inline dd_wls_UUID_t *dd_wls_UUID_copy(dd_wls_UUID_t *p, const dd_wls_UUID_t *p2)
+{ p->hi = p2->hi; p->lo = p2->lo;
+  return p; }
+static inline dd_wls_UUID_t *dd_wls_UUID_assign_to_pe(dd_wls_UUID_t *p, uint64_t v0, uint64_t v1)
+{ flatbuffers_uint64_assign_to_pe(&p->hi, v0); flatbuffers_uint64_assign_to_pe(&p->lo, v1);
+  return p; }
+static inline dd_wls_UUID_t *dd_wls_UUID_copy_to_pe(dd_wls_UUID_t *p, const dd_wls_UUID_t *p2)
+{ flatbuffers_uint64_copy_to_pe(&p->hi, &p2->hi); flatbuffers_uint64_copy_to_pe(&p->lo, &p2->lo);
+  return p; }
+static inline dd_wls_UUID_t *dd_wls_UUID_assign_from_pe(dd_wls_UUID_t *p, uint64_t v0, uint64_t v1)
+{ flatbuffers_uint64_assign_from_pe(&p->hi, v0); flatbuffers_uint64_assign_from_pe(&p->lo, v1);
+  return p; }
+static inline dd_wls_UUID_t *dd_wls_UUID_copy_from_pe(dd_wls_UUID_t *p, const dd_wls_UUID_t *p2)
+{ flatbuffers_uint64_copy_from_pe(&p->hi, &p2->hi); flatbuffers_uint64_copy_from_pe(&p->lo, &p2->lo);
+  return p; }
+__flatbuffers_build_struct(flatbuffers_, dd_wls_UUID, 16, 8, dd_wls_UUID_file_identifier, dd_wls_UUID_type_identifier)
+__flatbuffers_define_fixed_array_primitives(flatbuffers_, dd_wls_UUID, dd_wls_UUID_t)
+
 static const flatbuffers_voffset_t __dd_wls_Policy_required[] = { 0 };
 typedef flatbuffers_ref_t dd_wls_Policy_ref_t;
 static dd_wls_Policy_ref_t dd_wls_Policy_clone(flatbuffers_builder_t *B, dd_wls_Policy_table_t t);
@@ -34,7 +57,7 @@ static dd_wls_Policies_ref_t dd_wls_Policies_clone(flatbuffers_builder_t *B, dd_
 __flatbuffers_build_table(flatbuffers_, dd_wls_Policies, 1)
 
 #define __dd_wls_Policy_formal_args ,\
-  flatbuffers_string_ref_t v0, dd_wls_NodeTypeWrapper_ref_t v1, dd_wls_Action_vec_ref_t v2, flatbuffers_string_ref_t v3, int64_t v4
+  flatbuffers_string_ref_t v0, dd_wls_NodeTypeWrapper_ref_t v1, dd_wls_Action_vec_ref_t v2, dd_wls_UUID_t *v3, int64_t v4
 #define __dd_wls_Policy_call_args ,\
   v0, v1, v2, v3, v4
 static inline dd_wls_Policy_ref_t dd_wls_Policy_create(flatbuffers_builder_t *B __dd_wls_Policy_formal_args);
@@ -48,17 +71,17 @@ __flatbuffers_build_table_prolog(flatbuffers_, dd_wls_Policies, dd_wls_Policies_
 __flatbuffers_build_string_field(0, flatbuffers_, dd_wls_Policy_description, dd_wls_Policy)
 __flatbuffers_build_table_field(1, flatbuffers_, dd_wls_Policy_rules, dd_wls_NodeTypeWrapper, dd_wls_Policy)
 __flatbuffers_build_table_vector_field(2, flatbuffers_, dd_wls_Policy_actions, dd_wls_Action, dd_wls_Policy)
-__flatbuffers_build_string_field(3, flatbuffers_, dd_wls_Policy_id, dd_wls_Policy)
+__flatbuffers_build_struct_field(3, flatbuffers_, dd_wls_Policy_id, dd_wls_UUID, 16, 8, dd_wls_Policy)
 __flatbuffers_build_scalar_field(4, flatbuffers_, dd_wls_Policy_version, flatbuffers_int64, int64_t, 8, 8, INT64_C(0), dd_wls_Policy)
 
 static inline dd_wls_Policy_ref_t dd_wls_Policy_create(flatbuffers_builder_t *B __dd_wls_Policy_formal_args)
 {
     if (dd_wls_Policy_start(B)
+        || dd_wls_Policy_id_add(B, v3)
         || dd_wls_Policy_version_add(B, v4)
         || dd_wls_Policy_description_add(B, v0)
         || dd_wls_Policy_rules_add(B, v1)
-        || dd_wls_Policy_actions_add(B, v2)
-        || dd_wls_Policy_id_add(B, v3)) {
+        || dd_wls_Policy_actions_add(B, v2)) {
         return 0;
     }
     return dd_wls_Policy_end(B);
@@ -68,11 +91,11 @@ static dd_wls_Policy_ref_t dd_wls_Policy_clone(flatbuffers_builder_t *B, dd_wls_
 {
     __flatbuffers_memoize_begin(B, t);
     if (dd_wls_Policy_start(B)
+        || dd_wls_Policy_id_pick(B, t)
         || dd_wls_Policy_version_pick(B, t)
         || dd_wls_Policy_description_pick(B, t)
         || dd_wls_Policy_rules_pick(B, t)
-        || dd_wls_Policy_actions_pick(B, t)
-        || dd_wls_Policy_id_pick(B, t)) {
+        || dd_wls_Policy_actions_pick(B, t)) {
         return 0;
     }
     __flatbuffers_memoize_end(B, t, dd_wls_Policy_end(B));

c/src/schema/policy_reader.h

@@ -24,6 +24,11 @@
 #define flatbuffers_extension "bin"
 #endif
 
+typedef struct dd_wls_UUID dd_wls_UUID_t;
+typedef const dd_wls_UUID_t *dd_wls_UUID_struct_t;
+typedef dd_wls_UUID_t *dd_wls_UUID_mutable_struct_t;
+typedef const dd_wls_UUID_t *dd_wls_UUID_vec_t;
+typedef dd_wls_UUID_t *dd_wls_UUID_mutable_vec_t;
 
 typedef const struct dd_wls_Policy_table *dd_wls_Policy_table_t;
 typedef struct dd_wls_Policy_table *dd_wls_Policy_mutable_table_t;
@@ -33,6 +38,18 @@ typedef const struct dd_wls_Policies_table *dd_wls_Policies_table_t;
 typedef struct dd_wls_Policies_table *dd_wls_Policies_mutable_table_t;
 typedef const flatbuffers_uoffset_t *dd_wls_Policies_vec_t;
 typedef flatbuffers_uoffset_t *dd_wls_Policies_mutable_vec_t;
+#ifndef dd_wls_UUID_file_identifier
+#define dd_wls_UUID_file_identifier 0
+#endif
+/* deprecated, use dd_wls_UUID_file_identifier */
+#ifndef dd_wls_UUID_identifier
+#define dd_wls_UUID_identifier 0
+#endif
+#define dd_wls_UUID_type_hash ((flatbuffers_thash_t)0x23726554)
+#define dd_wls_UUID_type_identifier "\x54\x65\x72\x23"
+#ifndef dd_wls_UUID_file_extension
+#define dd_wls_UUID_file_extension "bin"
+#endif
 #ifndef dd_wls_Policy_file_identifier
 #define dd_wls_Policy_file_identifier 0
 #endif
@@ -59,6 +76,27 @@ typedef flatbuffers_uoffset_t *dd_wls_Policies_mutable_vec_t;
 #endif
 
 
+/**  unfortunetly flatbuffers doesnt support fixed size arrays in go so we can't use it
+ *  the solution is to split it into two unsigned longs :(
+ *  this should be populate after caculation, and removed prior to verification. */
+struct dd_wls_UUID {
+    alignas(8) uint64_t hi;
+    alignas(8) uint64_t lo;
+};
+static_assert(sizeof(dd_wls_UUID_t) == 16, "struct size mismatch");
+
+static inline const dd_wls_UUID_t *dd_wls_UUID__const_ptr_add(const dd_wls_UUID_t *p, size_t i) { return p + i; }
+static inline dd_wls_UUID_t *dd_wls_UUID__ptr_add(dd_wls_UUID_t *p, size_t i) { return p + i; }
+static inline dd_wls_UUID_struct_t dd_wls_UUID_vec_at(dd_wls_UUID_vec_t vec, size_t i)
+__flatbuffers_struct_vec_at(vec, i)
+static inline size_t dd_wls_UUID__size(void) { return 16; }
+static inline size_t dd_wls_UUID_vec_len(dd_wls_UUID_vec_t vec)
+__flatbuffers_vec_len(vec)
+__flatbuffers_struct_as_root(dd_wls_UUID)
+
+__flatbuffers_define_struct_scalar_field(dd_wls_UUID, hi, flatbuffers_uint64, uint64_t)
+__flatbuffers_define_struct_scalar_field(dd_wls_UUID, lo, flatbuffers_uint64, uint64_t)
+
 
 /**  Represents a policy that contains rules and actions.
  *  The rules are represented as a tree structure where each node can be a leaf (with an evaluator) or a root (with child nodes). */
@@ -76,10 +114,9 @@ __flatbuffers_define_string_field(0, dd_wls_Policy, description, 0)
 __flatbuffers_define_table_field(1, dd_wls_Policy, rules, dd_wls_NodeTypeWrapper_table_t, 0)
 /**  The actions are taken post evaluation of the policy. */
 __flatbuffers_define_vector_field(2, dd_wls_Policy, actions, dd_wls_Action_vec_t, 0)
-/**  Stable identifier for this policy, used to attribute an evaluation outcome
- *  back to its source. For Remote Config policies this is the rule's UUID;
- *  for hardcoded/built-in policies it is the sentinel "hardcoded". */
-__flatbuffers_define_string_field(3, dd_wls_Policy, id, 0)
+/**  128 bit UUID represented as 16 raw bytes
+ *  this can be used to verify integrity (but NOT origin - this is not a signature!) */
+__flatbuffers_define_struct_field(3, dd_wls_Policy, id, dd_wls_UUID_struct_t, 0)
 /**  used to track the version number of this policy */
 __flatbuffers_define_scalar_field(4, dd_wls_Policy, version, flatbuffers_int64, int64_t, INT64_C(0))
 

c/src/schema/policy_verifier.h

@@ -18,13 +18,53 @@
 static int dd_wls_Policy_verify_table(flatcc_table_verifier_descriptor_t *td);
 static int dd_wls_Policies_verify_table(flatcc_table_verifier_descriptor_t *td);
 
+static inline int dd_wls_UUID_verify_as_root(const void *buf, size_t bufsiz)
+{
+    return flatcc_verify_struct_as_root(buf, bufsiz, dd_wls_UUID_identifier, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_root_with_size(const void *buf, size_t bufsiz)
+{
+    return flatcc_verify_struct_as_root_with_size(buf, bufsiz, dd_wls_UUID_identifier, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_typed_root(const void *buf, size_t bufsiz)
+{
+    return flatcc_verify_struct_as_typed_root(buf, bufsiz, dd_wls_UUID_type_hash, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_typed_root_with_size(const void *buf, size_t bufsiz)
+{
+    return flatcc_verify_struct_as_typed_root_with_size(buf, bufsiz, dd_wls_UUID_type_hash, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_root_with_type_hash(const void *buf, size_t bufsiz, flatbuffers_thash_t thash)
+{
+    return flatcc_verify_struct_as_typed_root(buf, bufsiz, thash, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_root_with_type_hash_and_size(const void *buf, size_t bufsiz, flatbuffers_thash_t thash)
+{
+    return flatcc_verify_struct_as_typed_root_with_size(buf, bufsiz, thash, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_root_with_identifier(const void *buf, size_t bufsiz, const char *fid)
+{
+    return flatcc_verify_struct_as_root(buf, bufsiz, fid, 16, 8);
+}
+
+static inline int dd_wls_UUID_verify_as_root_with_identifier_and_size(const void *buf, size_t bufsiz, const char *fid)
+{
+    return flatcc_verify_struct_as_root_with_size(buf, bufsiz, fid, 16, 8);
+}
+
 static int dd_wls_Policy_verify_table(flatcc_table_verifier_descriptor_t *td)
 {
     int ret;
     if ((ret = flatcc_verify_string_field(td, 0, 0) /* description */)) return ret;
     if ((ret = flatcc_verify_table_field(td, 1, 0, &dd_wls_NodeTypeWrapper_verify_table) /* rules */)) return ret;
     if ((ret = flatcc_verify_table_vector_field(td, 2, 0, &dd_wls_Action_verify_table) /* actions */)) return ret;
-    if ((ret = flatcc_verify_string_field(td, 3, 0) /* id */)) return ret;
+    if ((ret = flatcc_verify_field(td, 3, 16, 8) /* id */)) return ret;
     if ((ret = flatcc_verify_field(td, 4, 8, 8) /* version */)) return ret;
     return flatcc_verify_ok;
 }

fbs-schema/policy.fbs

@@ -9,6 +9,11 @@ include "nodes.fbs";
 
 namespace dd.wls;
 
+/// unfortunetly flatbuffers doesnt support fixed size arrays in go so we can't use it
+/// the solution is to split it into two unsigned longs :(
+/// this should be populate after caculation, and removed prior to verification.
+struct UUID { hi:ulong; lo:ulong; }
+
 /// Represents a policy that contains rules and actions.
 /// The rules are represented as a tree structure where each node can be a leaf (with an evaluator) or a root (with child nodes).
 table Policy {
@@ -18,10 +23,9 @@ table Policy {
   rules: NodeTypeWrapper; // this is a tree
   /// The actions are taken post evaluation of the policy.
   actions: [Action];
-  /// Stable identifier for this policy, used to attribute an evaluation outcome
-  /// back to its source. For Remote Config policies this is the rule's UUID;
-  /// for hardcoded/built-in policies it is the sentinel "hardcoded".
-  id:string;
+  /// 128 bit UUID represented as 16 raw bytes
+  /// this can be used to verify integrity (but NOT origin - this is not a signature!)
+  id:UUID;
   /// used to track the version number of this policy
   version: long=0;
 }

go/cmd/dd-requirements-converter/converter/requirements.go

@@ -59,6 +59,6 @@ func (r JSONRequirements) ConvertToWLS(builder *flatbuffers.Builder) (flatbuffer
 	compositeNode := schema.NodeTypeWrapperCreate(builder, composite, wls.NodeTypeCompositeNode)
 
 	action := schema.ActionCreate(builder, wls.ActionIdINJECT_DENY, "requirements", nil)
-	policy := schema.PolicyCreate(builder, "All requirements", compositeNode, []flatbuffers.UOffsetT{action}, "hardcoded")
+	policy := schema.PolicyCreate(builder, "All requirements", compositeNode, []flatbuffers.UOffsetT{action})
 	return schema.PoliciesCreate(builder, []flatbuffers.UOffsetT{policy}), nil
 }

go/examples/example_generate_c_header_buffer/main.go

@@ -38,7 +38,7 @@ func createDenyByRuntimePolicy(builder *flatbuffers.Builder, runtime string) fla
 	// Start by creating the leaf evaluator (StrEvaluator for runtime language check)
 	node := createStrEvaluatorNode(builder, wls.StringEvaluatorsRUNTIME_LANGUAGE, runtime, wls.CmpTypeSTRCMP_EXACT, "Validate runtime is "+runtime)
 	action := schema.ActionCreate(builder, wls.ActionIdINJECT_DENY, "Deny "+runtime+" runtime!", []string{"value_1", "value_2", "value_3"})
-	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", node, []flatbuffers.UOffsetT{action}, "")
+	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", node, []flatbuffers.UOffsetT{action})
 }
 
 func generateCHeader(varName string, data []byte) string {

go/examples/example_json_to_hardcoded_injector_policies/converter/policy.go

@@ -75,5 +75,5 @@ func (p JSONPolicy) ConvertToWLS(builder *flatbuffers.Builder) (flatbuffers.UOff
 
 	action := schema.ActionCreate(builder, GetActionId(p.Skip), p.Description, []string{p.Runtime})
 
-	return schema.PolicyCreate(builder, p.Description, root, []flatbuffers.UOffsetT{action}, "hardcoded"), nil
+	return schema.PolicyCreate(builder, p.Description, root, []flatbuffers.UOffsetT{action}), nil
 }

go/examples/example_writer/main.go

@@ -45,7 +45,7 @@ func createDenyByRuntimePolicy(builder *flatbuffers.Builder, runtime string) fla
 	// Start by creating the leaf evaluator (StrEvaluator for runtime language check)
 	node := createStrEvaluatorNode(builder, wls.StringEvaluatorsRUNTIME_LANGUAGE, runtime, wls.CmpTypeSTRCMP_EXACT, "Validate runtime is "+runtime)
 	action := schema.ActionCreate(builder, wls.ActionIdINJECT_DENY, "Deny "+runtime+" runtime!", []string{"value_1", "value_2", "value_3"})
-	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", node, []flatbuffers.UOffsetT{action}, "")
+	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", node, []flatbuffers.UOffsetT{action})
 }
 
 func createRoot(builder *flatbuffers.Builder, oper wls.BoolOperation, description string, nodes []flatbuffers.UOffsetT) flatbuffers.UOffsetT {
@@ -63,7 +63,7 @@ func createDenyByMultipleEvaluatorsPolicy(builder *flatbuffers.Builder, runtime
 	nodeRoot := createRoot(builder, wls.BoolOperationBOOL_AND, "evaluate if runtime and exe prefix equal to something :)", []flatbuffers.UOffsetT{nodeRuntime, nodeExePrefix})
 
 	action := schema.ActionCreate(builder, wls.ActionIdINJECT_DENY, "Deny "+runtime+" runtime!", []string{"value_1", "value_2", "value_3"})
-	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", nodeRoot, []flatbuffers.UOffsetT{action}, "")
+	return schema.PolicyCreate(builder, "DenyByRuntimePolicy("+runtime+")", nodeRoot, []flatbuffers.UOffsetT{action})
 
 }
 
@@ -109,7 +109,7 @@ func createFlatPolicyNoEvaluators() string {
 	fileName := "FlatPolicyNoEvaluators.bin"
 	builder := flatbuffers.NewBuilder(1024)
 	action := schema.ActionCreate(builder, wls.ActionIdINJECT_ALLOW, "These actions will execute without executing any evaluators", []string{"value_1", "value_2", "value_3", "value_4", "value_5"})
-	policy := schema.PolicyCreate(builder, "AllowAllPolicy", 0, []flatbuffers.UOffsetT{action}, "")
+	policy := schema.PolicyCreate(builder, "AllowAllPolicy", 0, []flatbuffers.UOffsetT{action})
 	policies := schema.PoliciesCreate(builder, []flatbuffers.UOffsetT{policy})
 
 	builder.Finish(policies)
@@ -121,7 +121,7 @@ func createFlatPolicyNoEvaluators() string {
 func createEmptyPolicies() string {
 	fileName := "EmptyPolicies.bin"
 	builder := flatbuffers.NewBuilder(1024)
-	policy := schema.PolicyCreate(builder, "EmptyPolicy", 0, []flatbuffers.UOffsetT{}, "")
+	policy := schema.PolicyCreate(builder, "EmptyPolicy", 0, []flatbuffers.UOffsetT{})
 	policies := schema.PoliciesCreate(builder, []flatbuffers.UOffsetT{policy})
 
 	builder.Finish(policies)
@@ -134,7 +134,7 @@ func createFlatPolicyNoActions() string {
 	fileName := "FlatPolicyNoActions.bin"
 	builder := flatbuffers.NewBuilder(1024)
 	node := createStrEvaluatorNode(builder, wls.StringEvaluatorsRUNTIME_LANGUAGE, "some runtime", wls.CmpTypeSTRCMP_EXACT, "Validate runtime is some runtime")
-	policy := schema.PolicyCreate(builder, "PolicyWithoutActions", node, []flatbuffers.UOffsetT{}, "")
+	policy := schema.PolicyCreate(builder, "PolicyWithoutActions", node, []flatbuffers.UOffsetT{})
 	policies := schema.PoliciesCreate(builder, []flatbuffers.UOffsetT{policy})
 
 	builder.Finish(policies)
@@ -146,7 +146,7 @@ func createFlatPolicyNoActions() string {
 func createZeropPolicies() string {
 	fileName := "ZeropPolicies.bin"
 	builder := flatbuffers.NewBuilder(1024)
-	policy := schema.PolicyCreate(builder, "EmptyPolicy", 0, []flatbuffers.UOffsetT{}, "")
+	policy := schema.PolicyCreate(builder, "EmptyPolicy", 0, []flatbuffers.UOffsetT{})
 	policies := schema.PoliciesCreate(builder, []flatbuffers.UOffsetT{policy})
 
 	builder.Finish(policies)

go/schema/Creators.go

@@ -83,21 +83,14 @@ func NodeTypeWrapperCreate(builder *flatbuffers.Builder, nodeOffset flatbuffers.
 	return wls.NodeTypeWrapperEnd(builder)
 }
 
-func PolicyCreate(builder *flatbuffers.Builder, description string, rulesRoot flatbuffers.UOffsetT, actions []flatbuffers.UOffsetT, id string) flatbuffers.UOffsetT {
+func PolicyCreate(builder *flatbuffers.Builder, description string, rulesRoot flatbuffers.UOffsetT, actions []flatbuffers.UOffsetT) flatbuffers.UOffsetT {
 	fbDescription := builder.CreateString(description)
 	actionsVector := builder.CreateVectorOfTables(actions)
-	var fbID flatbuffers.UOffsetT
-	if id != "" {
-		fbID = builder.CreateString(id)
-	}
 
 	wls.PolicyStart(builder)
 	wls.PolicyAddDescription(builder, fbDescription)
 	wls.PolicyAddRules(builder, rulesRoot)
 	wls.PolicyAddActions(builder, actionsVector)
-	if id != "" {
-		wls.PolicyAddId(builder, fbID)
-	}
 
 	return wls.PolicyEnd(builder)
 }