-
Notifications
You must be signed in to change notification settings - Fork 140
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ASM] Upgrade WAF to version 1.18 #5546
Conversation
Snapshots difference summaryThe following differences have been observed in committed snapshots. It is meant to help the reviewer. 2 occurrences of : - "_dd.appsec.waf.version": "1.17.0",
+ "_dd.appsec.waf.version": "1.18.0",
8 occurrences of : - _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-001-001","name":"Path traversal attack","tags":{"category":"vulnerability_trigger","type":"lfi"}},"rule_matches":[{"operator":"lfi_detector","operator_value":null,"parameters":[{"address":null,"highlight":["/etc/password"],"key_path":null,"value":null}]}]}]},
+ _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-001-001","name":"Path traversal attack","tags":{"category":"vulnerability_trigger","type":"lfi"}},"rule_matches":[{"operator":"lfi_detector","operator_value":"","parameters":[{"address":null,"highlight":["/etc/password"],"key_path":null,"value":null}]}]}]},
12 occurrences of : - _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-002-001","name":"Server-side request forgery","tags":{"category":"vulnerability_trigger","type":"ssrf"}},"rule_matches":[{"operator":"ssrf_detector","operator_value":null,"parameters":[{"address":null,"highlight":["127.0.0.1"],"key_path":null,"value":null}]}]}]},
+ _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-002-001","name":"Server-side request forgery","tags":{"category":"vulnerability_trigger","type":"ssrf"}},"rule_matches":[{"operator":"ssrf_detector","operator_value":"","parameters":[{"address":null,"highlight":["127.0.0.1"],"key_path":null,"value":null}]}]}]},
8 occurrences of : - _dd.appsec.waf.version: 1.17.0,
+ _dd.appsec.waf.version: 1.18.0,
|
Datadog ReportBranch report: ✅ 0 Failed, 334957 Passed, 1566 Skipped, 13h 19m 50.89s Total Time |
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (95ms) : 89, 101
. : milestone, 95,
master - mean (73ms) : 66, 80
. : milestone, 73,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (1,043ms) : 1019, 1067
. : milestone, 1043,
master - mean (1,017ms) : 996, 1038
. : milestone, 1017,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (114ms) : 111, 117
. : milestone, 114,
master - mean (110ms) : 106, 114
. : milestone, 110,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (738ms) : 716, 760
. : milestone, 738,
master - mean (731ms) : 702, 760
. : milestone, 731,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (94ms) : 92, 97
. : milestone, 94,
master - mean (93ms) : 91, 96
. : milestone, 93,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (689ms) : 666, 712
. : milestone, 689,
master - mean (683ms) : 658, 708
. : milestone, 683,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (191ms) : 187, 194
. : milestone, 191,
master - mean (191ms) : 188, 194
. : milestone, 191,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (1,092ms) : 1064, 1120
. : milestone, 1092,
master - mean (1,092ms) : 1065, 1119
. : milestone, 1092,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (276ms) : 272, 280
. : milestone, 276,
master - mean (277ms) : 272, 282
. : milestone, 277,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (891ms) : 865, 917
. : milestone, 891,
master - mean (888ms) : 865, 910
. : milestone, 888,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5546) - mean (266ms) : 262, 270
. : milestone, 266,
master - mean (264ms) : 260, 268
. : milestone, 264,
section CallTarget+Inlining+NGEN
This PR (5546) - mean (872ms) : 848, 896
. : milestone, 872,
master - mean (865ms) : 839, 892
. : milestone, 865,
|
Benchmarks Report for tracer 🐌Benchmarks for #5546 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Faster 🎉 Same allocations ✔️
|
Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
---|---|---|---|---|
Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch‑net6.0 | 1.124 | 1,314.72 | 1,169.30 |
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | CallElasticsearch |
net6.0 | 1.31μs | 1.04ns | 3.87ns | 0.0145 | 0 | 0 | 1.03 KB |
master | CallElasticsearch |
netcoreapp3.1 | 1.62μs | 2.83ns | 10.6ns | 0.0138 | 0 | 0 | 1.03 KB |
master | CallElasticsearch |
net472 | 2.56μs | 1.19ns | 4.44ns | 0.166 | 0 | 0 | 1.04 KB |
master | CallElasticsearchAsync |
net6.0 | 1.31μs | 0.535ns | 2ns | 0.0144 | 0 | 0 | 1.01 KB |
master | CallElasticsearchAsync |
netcoreapp3.1 | 1.67μs | 1.37ns | 5.32ns | 0.0143 | 0 | 0 | 1.08 KB |
master | CallElasticsearchAsync |
net472 | 2.58μs | 0.989ns | 3.83ns | 0.175 | 0 | 0 | 1.1 KB |
#5546 | CallElasticsearch |
net6.0 | 1.17μs | 0.519ns | 2.01ns | 0.0146 | 0 | 0 | 1.03 KB |
#5546 | CallElasticsearch |
netcoreapp3.1 | 1.59μs | 8.24ns | 38.6ns | 0.0136 | 0 | 0 | 1.03 KB |
#5546 | CallElasticsearch |
net472 | 2.48μs | 1.36ns | 5.28ns | 0.165 | 0 | 0 | 1.04 KB |
#5546 | CallElasticsearchAsync |
net6.0 | 1.44μs | 0.999ns | 3.74ns | 0.0144 | 0 | 0 | 1.01 KB |
#5546 | CallElasticsearchAsync |
netcoreapp3.1 | 1.7μs | 1.17ns | 4.39ns | 0.0143 | 0 | 0 | 1.08 KB |
#5546 | CallElasticsearchAsync |
net472 | 2.61μs | 1.09ns | 4.23ns | 0.174 | 0 | 0 | 1.1 KB |
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | ExecuteAsync |
net6.0 | 1.44μs | 0.433ns | 1.62ns | 0.0136 | 0 | 0 | 952 B |
master | ExecuteAsync |
netcoreapp3.1 | 1.73μs | 1.16ns | 4.17ns | 0.013 | 0 | 0 | 952 B |
master | ExecuteAsync |
net472 | 1.8μs | 1.53ns | 5.93ns | 0.145 | 0 | 0 | 915 B |
#5546 | ExecuteAsync |
net6.0 | 1.37μs | 0.645ns | 2.41ns | 0.0131 | 0 | 0 | 952 B |
#5546 | ExecuteAsync |
netcoreapp3.1 | 1.7μs | 1.06ns | 3.97ns | 0.0127 | 0 | 0 | 952 B |
#5546 | ExecuteAsync |
net472 | 1.84μs | 0.603ns | 2.33ns | 0.145 | 0 | 0 | 915 B |
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | SendAsync |
net6.0 | 4.29μs | 1.92ns | 6.94ns | 0.0321 | 0 | 0 | 2.27 KB |
master | SendAsync |
netcoreapp3.1 | 5.15μs | 1.97ns | 7.36ns | 0.0387 | 0 | 0 | 2.81 KB |
master | SendAsync |
net472 | 7.87μs | 2.46ns | 9.21ns | 0.504 | 0 | 0 | 3.18 KB |
#5546 | SendAsync |
net6.0 | 4.13μs | 1.59ns | 6.15ns | 0.0328 | 0 | 0 | 2.27 KB |
#5546 | SendAsync |
netcoreapp3.1 | 5.08μs | 1.48ns | 5.32ns | 0.0382 | 0 | 0 | 2.81 KB |
#5546 | SendAsync |
net472 | 7.98μs | 2.65ns | 10.3ns | 0.504 | 0 | 0 | 3.18 KB |
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | EnrichedLog |
net6.0 | 1.47μs | 0.604ns | 2.34ns | 0.0236 | 0 | 0 | 1.7 KB |
master | EnrichedLog |
netcoreapp3.1 | 2.25μs | 0.849ns | 3.29ns | 0.0224 | 0 | 0 | 1.7 KB |
master | EnrichedLog |
net472 | 2.5μs | 0.947ns | 3.67ns | 0.257 | 0 | 0 | 1.62 KB |
#5546 | EnrichedLog |
net6.0 | 1.48μs | 0.676ns | 2.53ns | 0.0236 | 0 | 0 | 1.7 KB |
#5546 | EnrichedLog |
netcoreapp3.1 | 2.15μs | 0.985ns | 3.69ns | 0.0223 | 0 | 0 | 1.7 KB |
#5546 | EnrichedLog |
net472 | 2.75μs | 2.79ns | 10.8ns | 0.257 | 0 | 0 | 1.62 KB |
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | EnrichedLog |
net6.0 | 113μs | 172ns | 666ns | 0.0563 | 0 | 0 | 4.28 KB |
master | EnrichedLog |
netcoreapp3.1 | 120μs | 128ns | 494ns | 0 | 0 | 0 | 4.28 KB |
master | EnrichedLog |
net472 | 149μs | 151ns | 586ns | 0.669 | 0.223 | 0 | 4.46 KB |
#5546 | EnrichedLog |
net6.0 | 111μs | 88.3ns | 342ns | 0.0554 | 0 | 0 | 4.28 KB |
#5546 | EnrichedLog |
netcoreapp3.1 | 117μs | 123ns | 442ns | 0 | 0 | 0 | 4.28 KB |
#5546 | EnrichedLog |
net472 | 148μs | 254ns | 984ns | 0.66 | 0.22 | 0 | 4.46 KB |
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | EnrichedLog |
net6.0 | 3.16μs | 1.23ns | 4.75ns | 0.0318 | 0 | 0 | 2.25 KB |
master | EnrichedLog |
netcoreapp3.1 | 4.17μs | 3.57ns | 13.4ns | 0.0291 | 0 | 0 | 2.25 KB |
master | EnrichedLog |
net472 | 4.8μs | 1.13ns | 4.39ns | 0.327 | 0 | 0 | 2.07 KB |
#5546 | EnrichedLog |
net6.0 | 2.95μs | 1.16ns | 4.33ns | 0.0309 | 0 | 0 | 2.25 KB |
#5546 | EnrichedLog |
netcoreapp3.1 | 4.3μs | 2.97ns | 11.1ns | 0.03 | 0 | 0 | 2.25 KB |
#5546 | EnrichedLog |
net472 | 4.72μs | 12ns | 46.6ns | 0.327 | 0 | 0 | 2.07 KB |
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | SendReceive |
net6.0 | 1.47μs | 0.966ns | 3.74ns | 0.0169 | 0 | 0 | 1.2 KB |
master | SendReceive |
netcoreapp3.1 | 1.87μs | 1ns | 3.75ns | 0.0158 | 0 | 0 | 1.2 KB |
master | SendReceive |
net472 | 2.24μs | 0.879ns | 3.41ns | 0.191 | 0 | 0 | 1.2 KB |
#5546 | SendReceive |
net6.0 | 1.45μs | 0.641ns | 2.31ns | 0.0167 | 0 | 0 | 1.2 KB |
#5546 | SendReceive |
netcoreapp3.1 | 1.81μs | 0.587ns | 2.12ns | 0.0163 | 0 | 0 | 1.2 KB |
#5546 | SendReceive |
net472 | 2.29μs | 1.05ns | 4.07ns | 0.191 | 0 | 0 | 1.2 KB |
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | EnrichedLog |
net6.0 | 2.65μs | 10.2ns | 39.4ns | 0.0222 | 0 | 0 | 1.6 KB |
master | EnrichedLog |
netcoreapp3.1 | 3.97μs | 2.41ns | 9.35ns | 0.0219 | 0 | 0 | 1.65 KB |
master | EnrichedLog |
net472 | 4.34μs | 1.78ns | 6.65ns | 0.323 | 0 | 0 | 2.04 KB |
#5546 | EnrichedLog |
net6.0 | 2.66μs | 0.711ns | 2.66ns | 0.0214 | 0 | 0 | 1.6 KB |
#5546 | EnrichedLog |
netcoreapp3.1 | 3.97μs | 2.58ns | 9.99ns | 0.0218 | 0 | 0 | 1.65 KB |
#5546 | EnrichedLog |
net472 | 4.47μs | 1.51ns | 5.87ns | 0.322 | 0 | 0 | 2.04 KB |
Benchmarks.Trace.SpanBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | StartFinishSpan |
net6.0 | 479ns | 0.18ns | 0.696ns | 0.00791 | 0 | 0 | 576 B |
master | StartFinishSpan |
netcoreapp3.1 | 763ns | 0.763ns | 2.75ns | 0.00765 | 0 | 0 | 576 B |
master | StartFinishSpan |
net472 | 784ns | 0.858ns | 3.32ns | 0.0918 | 0 | 0 | 578 B |
master | StartFinishScope |
net6.0 | 623ns | 0.149ns | 0.575ns | 0.00971 | 0 | 0 | 696 B |
master | StartFinishScope |
netcoreapp3.1 | 827ns | 0.801ns | 3.1ns | 0.00943 | 0 | 0 | 696 B |
master | StartFinishScope |
net472 | 1.04μs | 1.12ns | 4.34ns | 0.104 | 0 | 0 | 658 B |
#5546 | StartFinishSpan |
net6.0 | 489ns | 0.17ns | 0.635ns | 0.00807 | 0 | 0 | 576 B |
#5546 | StartFinishSpan |
netcoreapp3.1 | 716ns | 0.516ns | 2ns | 0.00757 | 0 | 0 | 576 B |
#5546 | StartFinishSpan |
net472 | 769ns | 0.343ns | 1.33ns | 0.0915 | 0 | 0 | 578 B |
#5546 | StartFinishScope |
net6.0 | 579ns | 0.2ns | 0.774ns | 0.00962 | 0 | 0 | 696 B |
#5546 | StartFinishScope |
netcoreapp3.1 | 884ns | 1.46ns | 5.67ns | 0.0093 | 0 | 0 | 696 B |
#5546 | StartFinishScope |
net472 | 1.01μs | 0.346ns | 1.29ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Faster 🎉 Same allocations ✔️
Faster 🎉 in #5546
Benchmark
base/diff
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0
1.130
747.91
661.63
Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
---|---|---|---|---|
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0 | 1.130 | 747.91 | 661.63 |
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | RunOnMethodBegin |
net6.0 | 748ns | 0.246ns | 0.952ns | 0.00972 | 0 | 0 | 696 B |
master | RunOnMethodBegin |
netcoreapp3.1 | 939ns | 0.294ns | 1.14ns | 0.00944 | 0 | 0 | 696 B |
master | RunOnMethodBegin |
net472 | 1.07μs | 0.507ns | 1.97ns | 0.104 | 0 | 0 | 658 B |
#5546 | RunOnMethodBegin |
net6.0 | 662ns | 0.349ns | 1.35ns | 0.00981 | 0 | 0 | 696 B |
#5546 | RunOnMethodBegin |
netcoreapp3.1 | 1.03μs | 2.42ns | 9.36ns | 0.00926 | 0 | 0 | 696 B |
#5546 | RunOnMethodBegin |
net472 | 1.11μs | 2.28ns | 8.83ns | 0.104 | 0 | 0 | 658 B |
Throughput/Crank Report:zap:Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5546) (11.743M) : 0, 11743337
master (11.827M) : 0, 11827295
benchmarks/2.9.0 (11.966M) : 0, 11965561
section Automatic
This PR (5546) (7.693M) : crit ,0, 7692778
master (8.143M) : 0, 8142788
benchmarks/2.9.0 (8.468M) : 0, 8467626
section Trace stats
master (8.466M) : 0, 8465727
section Manual
This PR (5546) (9.679M) : crit ,0, 9679030
master (10.531M) : 0, 10531228
section Manual + Automatic
This PR (5546) (7.100M) : crit ,0, 7100463
master (7.696M) : 0, 7696118
section Version Conflict
master (7.003M) : 0, 7003018
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5546) (9.535M) : 0, 9535234
master (9.609M) : 0, 9609223
benchmarks/2.9.0 (9.409M) : 0, 9409220
section Automatic
This PR (5546) (6.593M) : 0, 6592877
master (6.614M) : 0, 6613864
section Trace stats
master (6.767M) : 0, 6766934
section Manual
This PR (5546) (8.330M) : 0, 8329554
master (8.227M) : 0, 8227219
section Manual + Automatic
This PR (5546) (6.245M) : 0, 6245230
master (6.225M) : 0, 6224632
section Version Conflict
master (5.608M) : 0, 5607616
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5546) (10.021M) : 0, 10020593
master (9.705M) : 0, 9704542
benchmarks/2.9.0 (9.932M) : 0, 9931696
section Automatic
This PR (5546) (7.082M) : 0, 7082370
master (6.963M) : 0, 6962582
benchmarks/2.9.0 (7.234M) : 0, 7234153
section Trace stats
master (7.249M) : 0, 7249157
section Manual
This PR (5546) (8.705M) : 0, 8704604
master (8.547M) : 0, 8547130
section Manual + Automatic
This PR (5546) (6.914M) : 0, 6914061
master (6.668M) : 0, 6667709
section Version Conflict
master (5.985M) : 0, 5984650
|
Thank you!!! |
Summary of changes
Version 1.18 of the WAF has been released. This version does not include breaking changes.
https://github.com/DataDog/libddwaf/releases/tag/1.18.0
The snapshots that contain the WAF version have been updated.
Reason for change
Implementation details
Test coverage
Other details