Implement new directive for performance profiling

[syinwu]

Summary

I think we need to add some hooks for the rule.

Basic example

Not yet.

Motivation

If we have some hooks of the rule, we can add some custom behaviors before and after rule execution. For example, collect the execution time of each rule(because our system performance requirements are high, it is necessary to do some observable work).

[jptosso]

@fzipi was motivated with this last year, I think we should think about a profiling engine for Coraza capable of creating a detailed report of the performance of the rule. There might be a way to attach ourselves to the profiling API and hook some "tags" https://pkg.go.dev/runtime/pprof, splitting the data by rule. That way we not only get the milliseconds performance per rule, but we will get the memory allocation, processing units, and more.

[jptosso]

I was reviewing pprof documentation and it can be done, we can add a special flag to the Transaction instance like

type Transaction struct {
...
// ProfilingStrategy is the strategy used to create profile files
ProfilingStrategy types.ProfilingStrategy

// ProfilingDirectory is the directory where profiling files will be stored
ProfilingDirectory string
}

type ProfilingStrategy int
const (
// No profiling
ProfilingStrategyNone ProfilingStrategy = iota
// One profile will be created per transaction "txid.dump"
ProfilingStrategyFullTransaction
// One profile will be created by transaction and phase
ProfilingStrategyTransactionPhases = iota
// One profile will be created by rule
ProfilingStrategyByRule = iota
)

Something like this, I will create some tests because it seems super cool.

We could also use a contextual seclang approach like

SecProfilingEngine On
SecProfilingPath /some/path

SecRule REMOTE_ADDR "127.0.0.1" "id:1000,phase:1,profiling:start=phase-1"
SecRule ....
SecRule PROFILING "1" "id:1001,phase:1,profiling:stop=phase-1"
# This will store the profile to /some/path/phase-1.dump
# profiling supports macro expansion, you can use timestamps as profile name

Once the profiling files are created we can use pprof tool to build complex performance models like this:

[fzipi]

Sounds awesome!

Maybe makes sense also to have a SecProfilingEngine <On|Off>?

[jptosso]

Sounds awesome!

Maybe makes sense also to have a SecProfilingEngine <On|Off>?

It sounds consistent with other directives like SecAuditEngine and SecRuleEngine.

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[syinwu]

This is still happening.

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[github-actions]

This issue was closed because it has been inactive for 14 days since being marked as stale.

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[github-actions]

This issue was closed because it has been inactive for 14 days since being marked as stale.