Skip to content

Commit 5119473

Browse files
jandro996jandro996
committed
rework metric
1 parent 1776ef8 commit 5119473

File tree

6 files changed

+220
-289
lines changed

6 files changed

+220
-289
lines changed

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java‎

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -119,8 +119,13 @@ public class AppSecRequestContext implements DataBundle, Closeable {
119119
private volatile PowerwafMetrics wafMetrics;
120120
private volatile PowerwafMetrics raspMetrics;
121121
private final AtomicInteger raspMetricsCounter = new AtomicInteger(0);
122-
private volatile boolean blocked;
123-
private volatile boolean errors;
122+
123+
private volatile boolean wafBlocked;
124+
private volatile boolean wafErrors;
125+
private volatile boolean wafTruncated;
126+
private volatile boolean wafRequestBlockFailure;
127+
private volatile boolean wafRateLimited;
128+
124129
private volatile int wafTimeouts;
125130
private volatile int raspTimeouts;
126131

@@ -175,20 +180,44 @@ public AtomicInteger getRaspMetricsCounter() {
175180
return raspMetricsCounter;
176181
}
177182

178-
public void setBlocked() {
179-
this.blocked = true;
183+
public void setWafBlocked() {
184+
this.wafBlocked = true;
185+
}
186+
187+
public boolean isWafBlocked() {
188+
return wafBlocked;
189+
}
190+
191+
public void setWafErrors() {
192+
this.wafErrors = true;
193+
}
194+
195+
public boolean hasWafErrors() {
196+
return wafErrors;
197+
}
198+
199+
public void setWafTruncated() {
200+
this.wafTruncated = true;
201+
}
202+
203+
public boolean isWafTruncated() {
204+
return wafTruncated;
205+
}
206+
207+
public void setWafRequestBlockFailure() {
208+
this.wafRequestBlockFailure = true;
180209
}
181210

182-
public boolean isBlocked() {
183-
return blocked;
211+
public boolean isWafRequestBlockFailure() {
212+
return wafRequestBlockFailure;
184213
}
185214

186-
public void setErrors() {
187-
this.errors = true;
215+
public void setWafRateLimited() {
216+
this.wafRateLimited = true;
188217
}
189218

190-
public boolean hasErrors() {
191-
return errors;
219+
public boolean isWafRateLimited() {
220+
return wafRateLimited;
192221
}
193222

194223
public void increaseWafTimeouts() {

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -724,15 +724,16 @@ private NoopFlow onRequestEnded(RequestContext ctx_, IGSpanInfo spanInfo) {
724724
log.debug("Unable to commit, derivatives will be skipped {}", ctx.getDerivativeKeys());
725725
}
726726

727-
if (ctx.hasErrors()) {
728-
WafMetricCollector.get().wafRequestError();
729-
} else if (ctx.isBlocked()) {
730-
WafMetricCollector.get().wafRequestBlocked();
731-
} else if (!collectedEvents.isEmpty()) {
732-
WafMetricCollector.get().wafRequestTriggered();
733-
} else {
734-
WafMetricCollector.get().wafRequest();
735-
}
727+
WafMetricCollector.get()
728+
.wafRequest(
729+
!collectedEvents.isEmpty(), // ruleTriggered
730+
ctx.isWafBlocked(), // requestBlocked
731+
ctx.hasWafErrors(), // wafError
732+
ctx.getWafTimeouts() > 0, // wafTimeout,
733+
ctx.isWafRequestBlockFailure(), // blockFailure,
734+
ctx.isWafRateLimited(), // rateLimited,
735+
ctx.isWafTruncated() // inputTruncated
736+
);
736737
}
737738

738739
ctx.close();

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java‎

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import datadog.trace.api.gateway.Flow;
3131
import datadog.trace.api.telemetry.LogCollector;
3232
import datadog.trace.api.telemetry.WafMetricCollector;
33-
import datadog.trace.api.telemetry.WafTruncatedType;
3433
import datadog.trace.api.time.SystemTimeSource;
3534
import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
3635
import datadog.trace.bootstrap.instrumentation.api.AgentTracer;
@@ -441,7 +440,6 @@ public void onDataAvailable(
441440
WafMetricCollector.get().raspTimeout(gwCtx.raspRuleType);
442441
} else {
443442
reqCtx.increaseWafTimeouts();
444-
WafMetricCollector.get().wafRequestTimeout();
445443
log.debug(LogCollector.EXCLUDE_TELEMETRY, "Timeout calling the WAF", tpe);
446444
}
447445
return;
@@ -467,17 +465,8 @@ public void onDataAvailable(
467465
final long listMapTooLarge = wafMetrics.getTruncatedListMapTooLargeCount();
468466
final long objectTooDeep = wafMetrics.getTruncatedObjectTooDeepCount();
469467

470-
if (stringTooLong > 0) {
471-
WafMetricCollector.get()
472-
.wafInputTruncated(WafTruncatedType.STRING_TOO_LONG, stringTooLong);
473-
}
474-
if (listMapTooLarge > 0) {
475-
WafMetricCollector.get()
476-
.wafInputTruncated(WafTruncatedType.LIST_MAP_TOO_LARGE, listMapTooLarge);
477-
}
478-
if (objectTooDeep > 0) {
479-
WafMetricCollector.get()
480-
.wafInputTruncated(WafTruncatedType.OBJECT_TOO_DEEP, objectTooDeep);
468+
if (stringTooLong > 0 || listMapTooLarge > 0 || objectTooDeep > 0) {
469+
reqCtx.setWafTruncated();
481470
}
482471
}
483472
}
@@ -501,10 +490,12 @@ public void onDataAvailable(
501490
ActionInfo actionInfo = new ActionInfo(actionType, actionParams);
502491

503492
if ("block_request".equals(actionInfo.type)) {
504-
Flow.Action.RequestBlockingAction rba = createBlockRequestAction(actionInfo);
493+
Flow.Action.RequestBlockingAction rba =
494+
createBlockRequestAction(actionInfo, reqCtx, gwCtx.isRasp);
505495
flow.setAction(rba);
506496
} else if ("redirect_request".equals(actionInfo.type)) {
507-
Flow.Action.RequestBlockingAction rba = createRedirectRequestAction(actionInfo);
497+
Flow.Action.RequestBlockingAction rba =
498+
createRedirectRequestAction(actionInfo, reqCtx, gwCtx.isRasp);
508499
flow.setAction(rba);
509500
} else if ("generate_stack".equals(actionInfo.type)) {
510501
if (Config.get().isAppSecStackTraceEnabled()) {
@@ -516,7 +507,9 @@ public void onDataAvailable(
516507
}
517508
} else {
518509
log.info("Ignoring action with type {}", actionInfo.type);
519-
WafMetricCollector.get().wafRequestBlockFailure();
510+
if (!gwCtx.isRasp) {
511+
reqCtx.setWafRequestBlockFailure();
512+
}
520513
}
521514
}
522515
Collection<AppSecEvent> events = buildEvents(resultWithData);
@@ -543,13 +536,15 @@ public void onDataAvailable(
543536
reqCtx.reportEvents(events);
544537
} else {
545538
log.debug("Rate limited WAF events");
546-
WafMetricCollector.get().wafRequestRateLimited();
539+
if (!gwCtx.isRasp) {
540+
reqCtx.setWafRateLimited();
541+
}
547542
}
548543
}
549544

550545
if (flow.isBlocking()) {
551546
if (!gwCtx.isRasp) {
552-
reqCtx.setBlocked();
547+
reqCtx.setWafBlocked();
553548
}
554549
}
555550
}
@@ -559,7 +554,8 @@ public void onDataAvailable(
559554
}
560555
}
561556

562-
private Flow.Action.RequestBlockingAction createBlockRequestAction(ActionInfo actionInfo) {
557+
private Flow.Action.RequestBlockingAction createBlockRequestAction(
558+
final ActionInfo actionInfo, final AppSecRequestContext reqCtx, final boolean isRasp) {
563559
try {
564560
int statusCode;
565561
Object statusCodeObj = actionInfo.parameters.get("status_code");
@@ -580,12 +576,15 @@ private Flow.Action.RequestBlockingAction createBlockRequestAction(ActionInfo ac
580576
return new Flow.Action.RequestBlockingAction(statusCode, blockingContentType);
581577
} catch (RuntimeException cce) {
582578
log.warn("Invalid blocking action data", cce);
583-
WafMetricCollector.get().wafRequestBlockFailure();
579+
if (!isRasp) {
580+
reqCtx.setWafRequestBlockFailure();
581+
}
584582
return null;
585583
}
586584
}
587585

588-
private Flow.Action.RequestBlockingAction createRedirectRequestAction(ActionInfo actionInfo) {
586+
private Flow.Action.RequestBlockingAction createRedirectRequestAction(
587+
final ActionInfo actionInfo, final AppSecRequestContext reqCtx, final boolean isRasp) {
589588
try {
590589
int statusCode;
591590
Object statusCodeObj = actionInfo.parameters.get("status_code");
@@ -606,7 +605,9 @@ private Flow.Action.RequestBlockingAction createRedirectRequestAction(ActionInfo
606605
return Flow.Action.RequestBlockingAction.forRedirect(statusCode, location);
607606
} catch (RuntimeException cce) {
608607
log.warn("Invalid blocking action data", cce);
609-
WafMetricCollector.get().wafRequestBlockFailure();
608+
if (!isRasp) {
609+
reqCtx.setWafRequestBlockFailure();
610+
}
610611
return null;
611612
}
612613
}
@@ -657,7 +658,7 @@ private static void incrementErrorCodeMetric(
657658
WafMetricCollector.get().raspErrorCode(gwCtx.raspRuleType, code);
658659
} else {
659660
WafMetricCollector.get().wafErrorCode(code);
660-
reqCtx.setErrors();
661+
reqCtx.setWafErrors();
661662
}
662663
}
663664

‎dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/powerwaf/PowerWAFModuleSpecification.groovy‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -467,7 +467,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
467467
2 * ctx.getWafMetrics()
468468
1 * ctx.isAdditiveClosed() >> false
469469
1 * ctx.closeAdditive() >> { pwafAdditive.close() }
470-
1 * ctx.setBlocked()
470+
1 * ctx.setWafBlocked()
471471
1 * ctx.isThrottled(null)
472472
0 * _
473473

@@ -552,7 +552,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
552552
2 * ctx.getWafMetrics()
553553
1 * ctx.isAdditiveClosed() >> false
554554
1 * ctx.closeAdditive()
555-
1 * ctx.setBlocked()
555+
1 * ctx.setWafBlocked()
556556
1 * ctx.isThrottled(null)
557557
0 * _
558558
}
@@ -657,7 +657,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
657657
1 * ctx.isAdditiveClosed() >> false
658658
1 * ctx.closeAdditive()
659659
1 * ctx.reportEvents(_)
660-
1 * ctx.setBlocked()
660+
1 * ctx.setWafBlocked()
661661
1 * ctx.isThrottled(null)
662662
0 * ctx._(*_)
663663
flow.blocking == true
@@ -723,7 +723,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
723723
1 * ctx.isAdditiveClosed() >> false
724724
1 * ctx.closeAdditive()
725725
1 * ctx.reportEvents(_)
726-
1 * ctx.setBlocked()
726+
1 * ctx.setWafBlocked()
727727
1 * ctx.isThrottled(null)
728728
0 * ctx._(*_)
729729
flow.blocking == true
@@ -750,7 +750,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
750750
1 * ctx.isAdditiveClosed() >> false
751751
1 * ctx.closeAdditive()
752752
1 * ctx.reportEvents(_)
753-
1 * ctx.setBlocked()
753+
1 * ctx.setWafBlocked()
754754
1 * ctx.isThrottled(null)
755755
0 * ctx._(*_)
756756
metrics == null
@@ -809,7 +809,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
809809
}
810810
2 * ctx.getWafMetrics() >> metrics
811811
1 * ctx.reportEvents(*_)
812-
1 * ctx.setBlocked()
812+
1 * ctx.setWafBlocked()
813813
1 * ctx.isThrottled(null)
814814
1 * ctx.isAdditiveClosed() >> false
815815
0 * ctx._(*_)
@@ -1008,7 +1008,6 @@ class PowerWAFModuleSpecification extends DDSpecification {
10081008
pwafAdditive = it[0].openAdditive() }
10091009
2 * ctx.getWafMetrics()
10101010
1 * ctx.increaseWafTimeouts()
1011-
1 * wafMetricCollector.get().wafRequestTimeout()
10121011
0 * _
10131012
10141013
when:

0 commit comments

Comments
 (0)