Refactoring and hardening of security coordinator #6143
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (70ms) : 67, 72
. : milestone, 70,
master - mean (70ms) : 67, 72
. : milestone, 70,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (1,112ms) : 1093, 1131
. : milestone, 1112,
master - mean (1,110ms) : 1085, 1135
. : milestone, 1110,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (109ms) : 106, 112
. : milestone, 109,
master - mean (109ms) : 105, 112
. : milestone, 109,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (766ms) : 749, 783
. : milestone, 766,
master - mean (771ms) : 757, 786
. : milestone, 771,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (92ms) : 89, 94
. : milestone, 92,
master - mean (92ms) : 89, 95
. : milestone, 92,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (724ms) : 708, 741
. : milestone, 724,
master - mean (727ms) : 710, 744
. : milestone, 727,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (189ms) : 185, 193
. : milestone, 189,
master - mean (189ms) : 186, 192
. : milestone, 189,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (1,196ms) : 1175, 1217
. : milestone, 1196,
master - mean (1,201ms) : 1179, 1222
. : milestone, 1201,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (274ms) : 270, 279
. : milestone, 274,
master - mean (274ms) : 269, 278
. : milestone, 274,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (938ms) : 920, 955
. : milestone, 938,
master - mean (943ms) : 926, 960
. : milestone, 943,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6143) - mean (262ms) : 258, 266
. : milestone, 262,
master - mean (263ms) : 259, 267
. : milestone, 263,
section CallTarget+Inlining+NGEN
This PR (6143) - mean (921ms) : 906, 937
. : milestone, 921,
master - mean (924ms) : 908, 940
. : milestone, 924,
|
Datadog ReportBranch report: ✅ 0 Failed, 368856 Passed, 2114 Skipped, 16h 6m 48.71s Total Time |
Throughput/Crank Report ⚡Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6143) (11.177M) : 0, 11177351
master (11.252M) : 0, 11251784
benchmarks/2.9.0 (11.081M) : 0, 11080577
section Automatic
This PR (6143) (7.498M) : 0, 7498175
master (7.466M) : 0, 7465753
benchmarks/2.9.0 (7.732M) : 0, 7732233
section Trace stats
master (7.766M) : 0, 7765791
section Manual
master (11.114M) : 0, 11114354
section Manual + Automatic
This PR (6143) (6.959M) : 0, 6959133
master (6.846M) : 0, 6845872
section DD_TRACE_ENABLED=0
master (10.389M) : 0, 10388612
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6143) (9.419M) : 0, 9418736
master (9.539M) : 0, 9539093
benchmarks/2.9.0 (9.798M) : 0, 9798067
section Automatic
This PR (6143) (6.704M) : 0, 6703737
master (6.648M) : 0, 6647799
section Trace stats
master (6.855M) : 0, 6855301
section Manual
master (9.525M) : 0, 9525425
section Manual + Automatic
This PR (6143) (6.113M) : 0, 6113305
master (6.161M) : 0, 6160600
section DD_TRACE_ENABLED=0
master (8.832M) : 0, 8832117
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6143) (10.140M) : 0, 10140105
master (10.064M) : 0, 10064242
benchmarks/2.9.0 (10.067M) : 0, 10067315
section Automatic
This PR (6143) (6.506M) : 0, 6506058
master (6.841M) : 0, 6841333
benchmarks/2.9.0 (7.552M) : 0, 7552193
section Trace stats
master (7.427M) : 0, 7426854
section Manual
master (10.084M) : 0, 10084210
section Manual + Automatic
This PR (6143) (6.075M) : 0, 6074832
master (6.348M) : 0, 6347556
section DD_TRACE_ENABLED=0
master (9.577M) : 0, 9576577
|
Benchmarks Report for appsec 🐌Benchmarks for #6143 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations
|
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 253.47 KB | 266.42 KB | 12.95 KB | 5.11% |
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1 | 252.25 KB | 254.41 KB | 2.16 KB | 0.86% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StringConcatBenchmark |
net6.0 | 54.8μs | 538ns | 5.35μs | 0 | 0 | 0 | 43.44 KB |
| master | StringConcatBenchmark |
netcoreapp3.1 | 62.4μs | 857ns | 8.26μs | 0 | 0 | 0 | 42.64 KB |
| master | StringConcatBenchmark |
net472 | 36.6μs | 123ns | 427ns | 0 | 0 | 0 | 59.01 KB |
| master | StringConcatAspectBenchmark |
net6.0 | 306μs | 1.76μs | 13.3μs | 0 | 0 | 0 | 253.47 KB |
| master | StringConcatAspectBenchmark |
netcoreapp3.1 | 330μs | 1.73μs | 9.63μs | 0 | 0 | 0 | 252.25 KB |
| master | StringConcatAspectBenchmark |
net472 | 271μs | 6μs | 56.9μs | 0 | 0 | 0 | 278.53 KB |
| #6143 | StringConcatBenchmark |
net6.0 | 60μs | 812ns | 7.99μs | 0 | 0 | 0 | 43.44 KB |
| #6143 | StringConcatBenchmark |
netcoreapp3.1 | 56μs | 425ns | 4.06μs | 0 | 0 | 0 | 42.64 KB |
| #6143 | StringConcatBenchmark |
net472 | 37.3μs | 152ns | 608ns | 0 | 0 | 0 | 58.84 KB |
| #6143 | StringConcatAspectBenchmark |
net6.0 | 329μs | 6.76μs | 66.9μs | 0 | 0 | 0 | 266.42 KB |
| #6143 | StringConcatAspectBenchmark |
netcoreapp3.1 | 347μs | 1.85μs | 10.3μs | 0 | 0 | 0 | 254.41 KB |
| #6143 | StringConcatAspectBenchmark |
net472 | 277μs | 5.44μs | 51μs | 0 | 0 | 0 | 278.53 KB |
Benchmarks Report for tracer 🐌Benchmarks for #6143 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️Raw results
|
anna-git
force-pushed
the
anna/asm/harden-security-coordinator
branch
from
3ef9ad5
to
7701b11
Compare
|
|
||
| // We need a context for RASP | ||
| if (!securityCoordinator.HasContext() || securityCoordinator.IsAdditiveContextDisposed()) |
There was a problem hiding this comment.
Should we still check for securityCoordinator.IsAdditiveContextDisposed() as we do in fingerprints?
There was a problem hiding this comment.
so it is still checked here:
public IResult? RunWaf(Dictionary<string, object> args, bool lastWafCall = false, bool runWithEphemeral = false, bool isRasp = false)
{
LogAddressIfDebugEnabled(args);
IResult? result = null;
try
{
var additiveContext = _httpTransport.GetAdditiveContext();
if (additiveContext == null)
{
additiveContext = _security.CreateAdditiveContext();
// prevent very cases where waf has been disposed between here and has been passed as argument until the 2nd line of constructor..
if (additiveContext != null)
{
_httpTransport.SetAdditiveContext(additiveContext);
}
}
else if (_httpTransport.IsAdditiveContextDisposed())
{
Log.Warning("Waf could not run as waf additive context is disposed");
return null;
}
There was a problem hiding this comment.
also because if the context is disposed, in all cases, we never want to run the waf
remove trimming fix tests fix tests fix tests fix test
anna-git
force-pushed
the
anna/asm/harden-security-coordinator
branch
from
7701b11
to
d81a16a
Compare
daniel-romano-DD
approved these changes
Oct 11, 2024
andrewlock
approved these changes
Oct 11, 2024
|
|
||
| if (securityCoordinator is null) | ||
| { | ||
| Log.Warning("Security coordinator could not be instantiated, probably because of httpcontext null. AttackerFingerprintHelper.AddSpanTags won't be run"); |
There was a problem hiding this comment.
Note that you're already logging a warning in this scenario when you call TryGet - it's probably unnecessary to do both?
There was a problem hiding this comment.
fixed in 2acfc80 thank you
tracer/src/Datadog.Trace/AppSec/Coordinator/SecurityCoordinator.Framework.cs
Outdated
Show resolved
Hide resolved
…r.Framework.cs Commit Andrew's suggestion Co-authored-by: Andrew Lock <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
Security coordinator should NEVER be able to be instantiated if http context is null
Reason for change
Refering to several errors at customers with NullReferenceException or waf additive contexts disposed
Implementation details
Test coverage
Other details