[ASM] Suspicious attacker blocking #6057
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (72ms) : 66, 77
. : milestone, 72,
master - mean (70ms) : 68, 73
. : milestone, 70,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (1,109ms) : 1089, 1128
. : milestone, 1109,
master - mean (1,106ms) : 1084, 1127
. : milestone, 1106,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (110ms) : 107, 112
. : milestone, 110,
master - mean (109ms) : 105, 113
. : milestone, 109,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (776ms) : 759, 793
. : milestone, 776,
master - mean (775ms) : 754, 796
. : milestone, 775,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (93ms) : 90, 96
. : milestone, 93,
master - mean (93ms) : 89, 96
. : milestone, 93,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (730ms) : 710, 749
. : milestone, 730,
master - mean (728ms) : 712, 744
. : milestone, 728,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (193ms) : 177, 209
. : milestone, 193,
master - mean (190ms) : 187, 193
. : milestone, 190,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (1,201ms) : 1179, 1222
. : milestone, 1201,
master - mean (1,199ms) : 1177, 1221
. : milestone, 1199,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (276ms) : 272, 281
. : milestone, 276,
master - mean (276ms) : 270, 282
. : milestone, 276,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (942ms) : 922, 962
. : milestone, 942,
master - mean (944ms) : 919, 969
. : milestone, 944,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6057) - mean (264ms) : 261, 267
. : milestone, 264,
master - mean (264ms) : 260, 267
. : milestone, 264,
section CallTarget+Inlining+NGEN
This PR (6057) - mean (924ms) : 900, 948
. : milestone, 924,
master - mean (921ms) : 906, 937
. : milestone, 921,
|
Benchmarks Report for appsec 🐌Benchmarks for #6057 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Iast.StringAspectsBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 1.923 | 294,950.00 | 567,150.00 | bimodal |
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 252.99 KB | 316.06 KB | 63.07 KB | 24.93% |
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472 | 57.26 KB | 59.04 KB | 1.78 KB | 3.12% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StringConcatBenchmark |
net6.0 | 59.4μs | 793ns | 7.89μs | 0 | 0 | 0 | 43.44 KB |
| master | StringConcatBenchmark |
netcoreapp3.1 | 61.9μs | 721ns | 7.18μs | 0 | 0 | 0 | 42.64 KB |
| master | StringConcatBenchmark |
net472 | 38.8μs | 194ns | 911ns | 0 | 0 | 0 | 57.26 KB |
| master | StringConcatAspectBenchmark |
net6.0 | 281μs | 5.86μs | 56.8μs | 0 | 0 | 0 | 252.99 KB |
| master | StringConcatAspectBenchmark |
netcoreapp3.1 | 341μs | 1.79μs | 11.7μs | 0 | 0 | 0 | 254.22 KB |
| master | StringConcatAspectBenchmark |
net472 | 279μs | 5.71μs | 55.4μs | 0 | 0 | 0 | 278.53 KB |
| #6057 | StringConcatBenchmark |
net6.0 | 59.3μs | 744ns | 7.41μs | 0 | 0 | 0 | 43.44 KB |
| #6057 | StringConcatBenchmark |
netcoreapp3.1 | 60.8μs | 782ns | 7.74μs | 0 | 0 | 0 | 42.64 KB |
| #6057 | StringConcatBenchmark |
net472 | 37.6μs | 85.8ns | 309ns | 0 | 0 | 0 | 59.04 KB |
| #6057 | StringConcatAspectBenchmark |
net6.0 | 575μs | 3.26μs | 23μs | 0 | 0 | 0 | 316.06 KB |
| #6057 | StringConcatAspectBenchmark |
netcoreapp3.1 | 324μs | 1.61μs | 9.14μs | 0 | 0 | 0 | 252.97 KB |
| #6057 | StringConcatAspectBenchmark |
net472 | 281μs | 6.48μs | 62.8μs | 0 | 0 | 0 | 278.53 KB |
Datadog ReportBranch report: ✅ 0 Failed, 363585 Passed, 2048 Skipped, 16h 1m 9.45s Total Time ⌛ Performance Regressions vs Default Branch (1)
|
Benchmarks Report for tracer 🐌Benchmarks for #6057 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0 | 1.125 | 394.19 | 443.44 |
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishScope‑net6.0 | 1.158 | 562.50 | 485.81 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StartFinishSpan |
net6.0 | 394ns | 0.307ns | 1.19ns | 0.00809 | 0 | 0 | 576 B |
| master | StartFinishSpan |
netcoreapp3.1 | 586ns | 0.486ns | 1.82ns | 0.00781 | 0 | 0 | 576 B |
| master | StartFinishSpan |
net472 | 691ns | 0.492ns | 1.84ns | 0.0918 | 0 | 0 | 578 B |
| master | StartFinishScope |
net6.0 | 562ns | 0.32ns | 1.24ns | 0.00992 | 0 | 0 | 696 B |
| master | StartFinishScope |
netcoreapp3.1 | 711ns | 0.979ns | 3.79ns | 0.00953 | 0 | 0 | 696 B |
| master | StartFinishScope |
net472 | 887ns | 0.782ns | 3.03ns | 0.104 | 0 | 0 | 658 B |
| #6057 | StartFinishSpan |
net6.0 | 444ns | 0.207ns | 0.747ns | 0.00804 | 0 | 0 | 576 B |
| #6057 | StartFinishSpan |
netcoreapp3.1 | 558ns | 0.456ns | 1.77ns | 0.00779 | 0 | 0 | 576 B |
| #6057 | StartFinishSpan |
net472 | 651ns | 0.626ns | 2.42ns | 0.0918 | 0 | 0 | 578 B |
| #6057 | StartFinishScope |
net6.0 | 486ns | 0.255ns | 0.986ns | 0.00981 | 0 | 0 | 696 B |
| #6057 | StartFinishScope |
netcoreapp3.1 | 761ns | 0.673ns | 2.6ns | 0.00938 | 0 | 0 | 696 B |
| #6057 | StartFinishScope |
net472 | 883ns | 0.806ns | 3.12ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Slower ⚠️ Same allocations ✔️
Slower ⚠️ in #6057
Benchmark
diff/base
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0
1.193
603.30
719.90
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0 | 1.193 | 603.30 | 719.90 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunOnMethodBegin |
net6.0 | 603ns | 0.259ns | 1ns | 0.00982 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
netcoreapp3.1 | 996ns | 2.82ns | 10.6ns | 0.00945 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
net472 | 1.14μs | 1.24ns | 4.8ns | 0.105 | 0 | 0 | 658 B |
| #6057 | RunOnMethodBegin |
net6.0 | 720ns | 0.331ns | 1.28ns | 0.00969 | 0 | 0 | 696 B |
| #6057 | RunOnMethodBegin |
netcoreapp3.1 | 917ns | 0.708ns | 2.74ns | 0.00927 | 0 | 0 | 696 B |
| #6057 | RunOnMethodBegin |
net472 | 1.14μs | 0.325ns | 1.26ns | 0.104 | 0 | 0 | 658 B |
Throughput/Crank Report ⚡Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6057) (11.083M) : 0, 11082519
master (11.173M) : 0, 11173302
benchmarks/2.9.0 (11.081M) : 0, 11080577
section Automatic
This PR (6057) (7.329M) : 0, 7328882
master (7.279M) : 0, 7278664
benchmarks/2.9.0 (7.732M) : 0, 7732233
section Trace stats
master (7.532M) : 0, 7531539
section Manual
master (11.083M) : 0, 11082902
section Manual + Automatic
This PR (6057) (6.708M) : 0, 6708136
master (6.710M) : 0, 6709924
section DD_TRACE_ENABLED=0
master (10.153M) : 0, 10153208
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6057) (9.609M) : 0, 9609368
master (9.398M) : 0, 9398448
benchmarks/2.9.0 (9.798M) : 0, 9798067
section Automatic
This PR (6057) (6.475M) : 0, 6474701
master (6.529M) : 0, 6529082
section Trace stats
master (6.958M) : 0, 6957848
section Manual
master (9.566M) : 0, 9566040
section Manual + Automatic
This PR (6057) (6.156M) : 0, 6155926
master (6.221M) : 0, 6221012
section DD_TRACE_ENABLED=0
master (8.922M) : 0, 8921736
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6057) (10.251M) : 0, 10251443
master (10.147M) : 0, 10147192
benchmarks/2.9.0 (10.067M) : 0, 10067315
section Automatic
This PR (6057) (6.765M) : 0, 6765236
master (6.895M) : 0, 6894968
benchmarks/2.9.0 (7.552M) : 0, 7552193
section Trace stats
master (7.434M) : 0, 7433935
section Manual
master (10.142M) : 0, 10142136
section Manual + Automatic
This PR (6057) (6.349M) : 0, 6348925
master (6.402M) : 0, 6401740
section DD_TRACE_ENABLED=0
master (9.547M) : 0, 9547292
|
NachoEchevarria
commented
Sep 20, 2024
| @@ -333,7 +333,15 @@ protected async Task TestRateLimiter(bool enableSecurity, string url, MockTracer | |||
| { | |||
| foreach (var header in headers) | |||
| { | |||
| _httpClient.DefaultRequestHeaders.Add(header.Key, header.Value); | |||
There was a problem hiding this comment.
This is useful to have more control over the headers in tests. We can remove default headers by setting them to null or add any desired custom value without the need of adding them to the existing ones.
There was a problem hiding this comment.
Agree, please log this as a potential improvement.
NachoEchevarria
changed the title
robertpi
reviewed
Sep 20, 2024
| @@ -24,20 +24,34 @@ public void ProcessUpdates(ConfigurationStatus configurationStatus, List<RemoteC | |||
| configurationStatus.RulesDataByFile[rawFile.Path.Path] = rulesData; | |||
| configurationStatus.IncomingUpdateState.WafKeysToApply.Add(ConfigurationStatus.WafRulesDataKey); | |||
| } | |||
|
|
|||
| var exclusionsData = asmDataConfig.TypedFile!.ExclusionsData; | |||
There was a problem hiding this comment.
Minor: I know it's what the above code does, but are we sure TypedFile can never be null? It feels like ? would be safer, especially as we check if exclusionsData is null anyway.
There was a problem hiding this comment.
Agree. I have changed both statements. Thanks!
anna-git
reviewed
Oct 2, 2024
| @@ -46,6 +48,12 @@ public void ProcessUpdates(ConfigurationStatus configurationStatus, List<RemoteC | |||
|
|
|||
| if (asmConfig.Actions != null) | |||
| { | |||
| if (!actionsCleared) | |||
There was a problem hiding this comment.
this and the following could now use a rebase, actions should clear automatically with removed files or empty arrays in fles like other objects
| public AspNetCore5AsmAttackerBlocking(AspNetCoreTestFixture fixture, ITestOutputHelper outputHelper) | ||
| : base(fixture, outputHelper, enableSecurity: true, testName: nameof(AspNetCore5AsmAttackerBlocking)) | ||
| { | ||
| SetEnvironmentVariable(ConfigurationKeys.DebugEnabled, "1"); |
There was a problem hiding this comment.
do we want debug enabled on master though ?
There was a problem hiding this comment.
We should not enable debug by default, as that's a different scenario to our customers, and it can hide issues
There was a problem hiding this comment.
Yes, I will remove that. I was merging the conflicting files before testing and setting the PR as ready to review, but I promise to remove the debug flag :)
| new KeyValuePair<string, string>("User-Agent", "dd-test-scanner-log-block"), | ||
| }; | ||
|
|
||
| SetEnvironmentVariable(ConfigurationKeys.DebugEnabled, "1"); |
There was a problem hiding this comment.
No, that was only for testing. I have deleted it.
| result = SubmitRequest(url + "?a=5", null, null, headers: headersAttackerArachni); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed); | ||
| result = SubmitRequest(url + "?a=6", null, null, headers: headersRegularArachni); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.OK); |
There was a problem hiding this comment.
For this feature, I though that it would be enough to replicate what the system tests check and was failing regarding status in order to make a more simple test and avoid unnecessary snapshots usage.
NachoEchevarria
force-pushed
the
nacho/SuspiciousAttackerBlocking
branch
from
dc01738
to
6df19d8
Compare
anna-git
approved these changes
Oct 2, 2024
robertpi
approved these changes
Oct 2, 2024
agocs
pushed a commit
that referenced
this pull request
Oct 8, 2024
## Summary of changes This PR adds the required code to support the suspicious attack functionality. It has added the required code to read the exclusion data from the RC. It also has modified the existing code regarding RC actions. Previously, if a configuration was received with an action, the configuration was stored and later sent to the WAF. If new values with an empty action array would come later, the previous action configurations would be deleted, but if a new array would come with a new action different than the previous one, we would report them both to the WAF. This behavior was making the suspicious attacker system tests fail because we would keep RC changes from previous tests. This change seems to be aligned with the behavior of other libraries. The file [AspNetBase.cs](https://github.com/DataDog/dd-trace-dotnet/pull/6057/files#diff-0faff2451113067d7669566ba9199908b720a3764914b00d6f33d4b376098d74) has been updated. Now, tests have more control over the used headers by allowing them to remove headers or replace previous values with new ones. ## Reason for change ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!--⚠️ Note: where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. -->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
This PR adds the required code to support the suspicious attack functionality.
It has added the required code to read the exclusion data from the RC.
It also has modified the existing code regarding RC actions. Previously, if a configuration was received with an action, the configuration was stored and later sent to the WAF. If new values with an empty action array would come later, the previous action configurations would be deleted, but if a new array would come with a new action different than the previous one, we would report them both to the WAF. This behavior was making the suspicious attacker system tests fail because we would keep RC changes from previous tests. This change seems to be aligned with the behavior of other libraries.
The file AspNetBase.cs has been updated. Now, tests have more control over the used headers by allowing them to remove headers or replace previous values with new ones.
Reason for change
Implementation details
Test coverage
Other details