Skip to content

Create metric: appsec.waf.input_truncated #8375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Create metric: appsec.waf.input_truncated #8375

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aba526c
Upgrade libddwaf and add InputTruncated metric
Mariovido Feb 12, 2025
5a94e18
Add tests
Mariovido Feb 12, 2025
d3cbc7e
Adapt to new version of libddwaf-java
Mariovido Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dd-java-agent/appsec/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ dependencies {
implementation project(':internal-api')
implementation project(':communication')
implementation project(':telemetry')
implementation group: 'io.sqreen', name: 'libsqreen', version: '11.2.0'
implementation group: 'io.sqreen', name: 'libsqreen', version: '11.3.0'
implementation libs.moshi

testImplementation libs.bytebuddy
Expand Down
18 changes: 18 additions & 0 deletions dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,14 @@
import datadog.trace.api.internal.TraceSegment;
import datadog.trace.api.telemetry.LoginEvent;
import datadog.trace.api.telemetry.RuleType;
import datadog.trace.api.telemetry.TruncatedType;
import datadog.trace.api.telemetry.WafMetricCollector;
import datadog.trace.bootstrap.instrumentation.api.Tags;
import datadog.trace.bootstrap.instrumentation.api.URIDataAdapter;
import datadog.trace.util.stacktrace.StackTraceEvent;
import datadog.trace.util.stacktrace.StackUtils;
import io.sqreen.powerwaf.PowerwafMetrics;
import io.sqreen.powerwaf.metrics.InputTruncatedType;
import java.net.URI;
import java.net.URISyntaxException;
import java.nio.charset.Charset;
Expand Down Expand Up @@ -822,6 +825,21 @@ private NoopFlow onRequestEnded(RequestContext ctx_, IGSpanInfo spanInfo) {
log.debug("Unable to commit, derivatives will be skipped {}", ctx.getDerivativeKeys());
}

PowerwafMetrics wafMetrics = ctx.getWafMetrics();
if (wafMetrics != null) {
final long stringTooLong =
wafMetrics.getWafInputsTruncatedCount(InputTruncatedType.STRING_TOO_LONG);
final long listMapTooLarge =
wafMetrics.getWafInputsTruncatedCount(InputTruncatedType.LIST_MAP_TOO_LARGE);
final long objectTooDeep =
wafMetrics.getWafInputsTruncatedCount(InputTruncatedType.OBJECT_TOO_DEEP);

WafMetricCollector.get().wafInputTruncated(TruncatedType.STRING_TOO_LONG, stringTooLong);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't call these when the counters are 0. It'll try to increment the atomic counters by 0 and it's all pointless.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed to only add when is greater than 0

WafMetricCollector.get()
.wafInputTruncated(TruncatedType.LIST_MAP_TOO_LARGE, listMapTooLarge);
WafMetricCollector.get().wafInputTruncated(TruncatedType.OBJECT_TOO_DEEP, objectTooDeep);
}

if (ctx.isBlocked()) {
WafMetricCollector.get().wafRequestBlocked();
} else if (!collectedEvents.isEmpty()) {
Expand Down
15 changes: 12 additions & 3 deletions ...ent/appsec/src/test/groovy/com/datadog/appsec/powerwaf/PowerWAFModuleSpecification.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ import spock.lang.Shared
import spock.lang.Unroll

import java.util.concurrent.CountDownLatch
import java.util.concurrent.atomic.AtomicLong

import static datadog.trace.api.config.AppSecConfig.APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP
import static datadog.trace.api.config.AppSecConfig.APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP
Expand Down Expand Up @@ -546,9 +547,9 @@ class PowerWAFModuleSpecification extends DDSpecification {
1 * ctx.getOrCreateAdditive(_, true, false) >> {
pwafAdditive = it[0].openAdditive()
}
3 * tracer.activeSpan()
2 * tracer.activeSpan()
// we get two events: one for origin rule, and one for the custom one
1 * ctx.reportEvents(hasSize(2))
1 * ctx.reportEvents(hasSize(1))
1 * ctx.getWafMetrics()
1 * ctx.isAdditiveClosed() >> false
1 * ctx.closeAdditive()
Expand Down Expand Up @@ -777,7 +778,15 @@ class PowerWAFModuleSpecification extends DDSpecification {
pwafAdditive
}
1 * ctx.closeAdditive()
2 * ctx.getWafMetrics() >> { metrics.with { totalDdwafRunTimeNs = 1000; totalRunTimeNs = 2000; it} }
2 * ctx.getWafMetrics() >> {
metrics.with {
totalDdwafRunTimeNs = new AtomicLong(1000)
totalRunTimeNs = new AtomicLong(2000)
wafInputsTruncatedStringTooLongCount = new AtomicLong(0)
wafInputsTruncatedListMapTooLargeCount = new AtomicLong(0)
wafInputsTruncatedObjectTooDeepCount = new AtomicLong(0)
it
} }

1 * segment.setTagTop('_dd.appsec.waf.duration', 1)
1 * segment.setTagTop('_dd.appsec.waf.duration_ext', 2)
Expand Down
22 changes: 22 additions & 0 deletions internal-api/src/main/java/datadog/trace/api/telemetry/TruncatedType.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package datadog.trace.api.telemetry;

public enum TruncatedType {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed offline, this is pretty much redundant with InputTruncatedType.

Copy link
Contributor Author

@Mariovido Mariovido Feb 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The final decision has been the removal of InputTruncatedType from libddwaf-java and keep this type in the dd-trace-java.
For reference this is the PR where the removal is done: DataDog/libddwaf-java#146

STRING_TOO_LONG(1),
LIST_MAP_TOO_LARGE(2),
OBJECT_TOO_DEEP(4);

private final int value;
private static final int numValues = RuleType.values().length;

TruncatedType(int value) {
this.value = value;
}

public int getValue() {
return this.value;
}

public static int getNumValues() {
return numValues;
}
}
23 changes: 23 additions & 0 deletions internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ private WafMetricCollector() {
private static final AtomicRequestCounter wafTriggeredRequestCounter = new AtomicRequestCounter();
private static final AtomicRequestCounter wafBlockedRequestCounter = new AtomicRequestCounter();
private static final AtomicRequestCounter wafTimeoutRequestCounter = new AtomicRequestCounter();
private static final AtomicLongArray wafInputTruncatedCounter =
new AtomicLongArray(TruncatedType.getNumValues());
private static final AtomicLongArray raspRuleEvalCounter =
new AtomicLongArray(RuleType.getNumValues());
private static final AtomicLongArray raspRuleMatchCounter =
Expand Down Expand Up @@ -92,6 +94,10 @@ public void wafRequestTimeout() {
wafTimeoutRequestCounter.increment();
}

public void wafInputTruncated(final TruncatedType truncatedType, long increment) {
wafInputTruncatedCounter.addAndGet(truncatedType.ordinal(), increment);
}

public void raspRuleEval(final RuleType ruleType) {
raspRuleEvalCounter.incrementAndGet(ruleType.ordinal());
}
Expand Down Expand Up @@ -183,6 +189,17 @@ public void prepareMetrics() {
}
}

// Input Truncated Type metric
for (TruncatedType truncatedType : TruncatedType.values()) {
long counter = wafInputTruncatedCounter.getAndSet(truncatedType.ordinal(), 0);
if (counter > 0) {
if (!rawMetricsQueue.offer(
new WafInputTruncatedRawMetric(counter, truncatedType.getValue()))) {
return;
}
}
}

// RASP rule eval per rule type
for (RuleType ruleType : RuleType.values()) {
long counter = raspRuleEvalCounter.getAndSet(ruleType.ordinal(), 0);
Expand Down Expand Up @@ -319,6 +336,12 @@ public WafRequestsRawMetric(
}
}

public static class WafInputTruncatedRawMetric extends WafMetric {
public WafInputTruncatedRawMetric(final long counter, final int truncationReason) {
super("waf.input_truncated", counter, "truncation_reason:" + truncationReason);
}
}

public static class RaspRuleEval extends WafMetric {
public RaspRuleEval(final long counter, final RuleType ruleType, final String wafVersion) {
super(
Expand Down
34 changes: 31 additions & 3 deletions internal-api/src/test/groovy/datadog/trace/api/telemetry/WafMetricCollectorTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ class WafMetricCollectorTest extends DDSpecification {
WafMetricCollector.get().wafRequestTriggered()
WafMetricCollector.get().wafRequestBlocked()
WafMetricCollector.get().wafRequestTimeout()
WafMetricCollector.get().wafInputTruncated(TruncatedType.STRING_TOO_LONG, 5)
WafMetricCollector.get().raspRuleEval(RuleType.SQL_INJECTION)
WafMetricCollector.get().raspRuleEval(RuleType.SQL_INJECTION)
WafMetricCollector.get().raspRuleMatch(RuleType.SQL_INJECTION)
Expand Down Expand Up @@ -111,21 +112,28 @@ class WafMetricCollectorTest extends DDSpecification {
'waf_timeout:true'
].toSet()

def raspRuleEvalSqli = (WafMetricCollector.RaspRuleEval)metrics[7]
def inputTruncatedStringTooLong = (WafMetricCollector.WafInputTruncatedRawMetric)metrics[7]
inputTruncatedStringTooLong.type == 'count'
inputTruncatedStringTooLong.value == 5
inputTruncatedStringTooLong.namespace == 'appsec'
inputTruncatedStringTooLong.metricName == 'waf.input_truncated'
inputTruncatedStringTooLong.tags.toSet() == ['truncation_reason:1'].toSet()

def raspRuleEvalSqli = (WafMetricCollector.RaspRuleEval)metrics[8]
raspRuleEvalSqli.type == 'count'
raspRuleEvalSqli.value == 3
raspRuleEvalSqli.namespace == 'appsec'
raspRuleEvalSqli.metricName == 'rasp.rule.eval'
raspRuleEvalSqli.tags.toSet() == ['rule_type:sql_injection', 'waf_version:waf_ver1'].toSet()

def raspRuleMatch = (WafMetricCollector.RaspRuleMatch)metrics[8]
def raspRuleMatch = (WafMetricCollector.RaspRuleMatch)metrics[9]
raspRuleMatch.type == 'count'
raspRuleMatch.value == 1
raspRuleMatch.namespace == 'appsec'
raspRuleMatch.metricName == 'rasp.rule.match'
raspRuleMatch.tags.toSet() == ['rule_type:sql_injection', 'waf_version:waf_ver1'].toSet()

def raspTimeout = (WafMetricCollector.RaspTimeout)metrics[9]
def raspTimeout = (WafMetricCollector.RaspTimeout)metrics[10]
raspTimeout.type == 'count'
raspTimeout.value == 1
raspTimeout.namespace == 'appsec'
Expand Down Expand Up @@ -296,6 +304,26 @@ class WafMetricCollectorTest extends DDSpecification {
}
}

def "test WAF #inputTruncated metrics"() {
when:
WafMetricCollector.get().wafInit('waf_ver1', 'rules.1', true)
WafMetricCollector.get().wafInputTruncated(truncatedType, 5)
WafMetricCollector.get().prepareMetrics()

then:
def metrics = WafMetricCollector.get().drain()

def inputTruncated = (WafMetricCollector.WafInputTruncatedRawMetric)metrics[1]
inputTruncated.type == 'count'
inputTruncated.value == 5
inputTruncated.namespace == 'appsec'
inputTruncated.metricName == 'waf.input_truncated'
inputTruncated.tags.toSet() == ['truncation_reason:' + truncatedType.value].toSet()

where:
truncatedType << [TruncatedType.STRING_TOO_LONG, TruncatedType.LIST_MAP_TOO_LARGE, TruncatedType.OBJECT_TOO_DEEP]
}

def "test Rasp #ruleType metrics"() {
when:
WafMetricCollector.get().wafInit('waf_ver1', 'rules.1', true)
Expand Down
Loading