serverless/appsec: fix handling of ALB headers & query string #22005
Conversation
When an AWS Application Load Balancer forwards a request to Lambda, it formats headers and query string parameters either as `map[string]string` in the `Headers` and `QueryStringParameters` properties (this is the default behavior), or as `map[string][]string` in `MultiValueHeaders` and `MultiValueQueryStringParameters` (when explicitly enabled by setting the appropriate target group attribute[^1]). We were previously only considering the multi-valued entries, since other event types (such as API Gateway) provide values in both formats all the time. This change uses the multi-valued map if present, and falls back to the single-valued map otherwise. [^1]: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html#enable-multi-value-headers
| @@ -61,6 +61,8 @@ func (lp *ProxyLifecycleProcessor) OnInvokeStart(startDetails *invocationlifecyc | |||
| eventType := trigger.GetEventType(lowercaseEventPayload) | |||
| if eventType == trigger.Unknown { | |||
| log.Debugf("appsec: proxy-lifecycle: Failed to extract event type") | |||
| } else { | |||
| log.Debugf("appsec: proxy-lifecycle: Extracted event type: %v", eventType) | |||
There was a problem hiding this comment.
This will be helpful when diagnosing future cases, as this line makes it very easy to rule out the "failed to identify payload" scenario (presence of positive evidence is easier to reason about than absence of negative evidence).
There was a problem hiding this comment.
Agreed, this is a good addition. Ideally at some point we should add a String() method to the event type. Right now, if I recall correctly, it will just print a number.
There was a problem hiding this comment.
Omg, great minds think alike, I just scrolled down and saw the String() method you added! 🎉
| @@ -294,3 +295,48 @@ func eventRecordsKeyEquals(event map[string]any, key string, val string) bool { | |||
| } | |||
| return false | |||
| } | |||
|
|
|||
| func (et AWSEventType) String() string { | |||
There was a problem hiding this comment.
This is only there to make the debug log of detection easier to read/reason about.
Bloop Bleep... Dogbot HereRegression Detector ResultsRun ID: a82e76bb-038a-488e-8f40-25fb5d12b0f4 Performance changes are noted in the perf column of each table:
No significant changes in experiment optimization goalsConfidence level: 90.00% There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.
|
| perf | experiment | goal | Δ mean % | Δ mean % CI |
|---|---|---|---|---|
| ➖ | file_to_blackhole | % cpu utilization | +0.62 | [-6.00, +7.23] |
| ➖ | idle | memory utilization | -0.02 | [-0.04, +0.01] |
| ➖ | file_tree | memory utilization | -0.75 | [-0.85, -0.64] |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI |
|---|---|---|---|---|
| ➖ | file_to_blackhole | % cpu utilization | +0.62 | [-6.00, +7.23] |
| ➖ | process_agent_real_time_mode | memory utilization | +0.42 | [+0.38, +0.45] |
| ➖ | process_agent_standard_check | memory utilization | +0.02 | [-0.03, +0.07] |
| ➖ | trace_agent_msgpack | ingress throughput | +0.01 | [-0.01, +0.02] |
| ➖ | uds_dogstatsd_to_api | ingress throughput | +0.00 | [-0.03, +0.03] |
| ➖ | tcp_dd_logs_filter_exclude | ingress throughput | +0.00 | [-0.06, +0.06] |
| ➖ | idle | memory utilization | -0.02 | [-0.04, +0.01] |
| ➖ | process_agent_standard_check_with_stats | memory utilization | -0.03 | [-0.08, +0.01] |
| ➖ | trace_agent_json | ingress throughput | -0.03 | [-0.06, -0.00] |
| ➖ | tcp_syslog_to_blackhole | ingress throughput | -0.50 | [-0.56, -0.43] |
| ➖ | file_tree | memory utilization | -0.75 | [-0.85, -0.64] |
| ➖ | otel_to_otel_logs | ingress throughput | -4.71 | [-5.42, -3.99] |
Explanation
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
|
/merge |
|
🚂 MergeQueue This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals. you can cancel this operation by commenting your pull request with |
Serverless Benchmark Results
tl;dr
What is this benchmarking?The The benchmark is run using a large variety of lambda request payloads. In the charts below, there is one row for each event payload type. How do I interpret these charts?The charts below comes from The benchstat docs explain how to interpret these charts.
Benchmark stats |
dd-devflow
bot
added
mergequeue-status: queued
and removed
mergequeue-status: waiting
labels
|
🚂 MergeQueue Added to the queue. There are 3 builds ahead of this PR! (estimated merge in less than 1h) you can cancel this operation by commenting your pull request with |
dd-devflow
bot
added
mergequeue-status: done
and removed
mergequeue-status: queued
labels
|
🚂 MergeQueue This PR is already merged |
We were previously only considering the multi-valued entries, since other event types (such as API Gateway) provide values in both formats all the time. This change uses the multi-valued map if present, and falls back to the single-valued map otherwise.
What does this PR do?
We were previously only considering the multi-valued entries, since other event types (such as API Gateway) provide values in both formats all the time. This change uses the multi-valued map if present, and falls back to the single-valued map otherwise.
Motivation
When an AWS Application Load Balancer forwards a request to Lambda, it formats headers and query string parameters either as
map[string]stringin theHeadersandQueryStringParametersproperties (this is the default behavior), or asmap[string][]stringinMultiValueHeadersandMultiValueQueryStringParameters(when explicitly enabled by setting the appropriate target group attribute1).Describe how to test/QA your changes
Send traffic to a serverless-AppSec enabled Lambda function via an ALB, with e.g: a user-agent of
Arachni/v1-- which triggers a detection rule, and should result in the trace showing up in the ASM console.Reviewer's Checklist
Triagemilestone is set.major_changelabel if your change either has a major impact on the code base, is impacting multiple teams or is changing important well-established internals of the Agent. This label will be use during QA to make sure each team pay extra attention to the changed behavior. For any customer facing change use a releasenote.changelog/no-changeloglabel has been applied.qa/skip-qalabel, with required eitherqa/doneorqa/no-code-changelabels, are applied.team/..label has been applied, indicating the team(s) that should QA this change.need-change/operatorandneed-change/helmlabels have been applied.k8s/<min-version>label, indicating the lowest Kubernetes version compatible with this feature.Footnotes
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html#enable-multi-value-headers ↩