Skip to content

IP Blocking for .NET Framework#3207

Merged
robertpi merged 24 commits into
masterfrom
robert/asm/blocking-framework
Sep 29, 2022
Merged

IP Blocking for .NET Framework#3207
robertpi merged 24 commits into
masterfrom
robert/asm/blocking-framework

Conversation

@robertpi

@robertpi robertpi commented Sep 12, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Summary of changes

This builds on #3066 to bring blocking capabilities to the .NET Framework as well as core.

This provides the ability to block a request but is not linked to any real mechanism to block requests, only test blocking rules exist for now.

Reason for change

We want to support blocking on both .NET Framework and Core.

Implementation details

Most of the blocking mechanism was put in place in #3066, this just fills in the missing parts for .NET Framework.

Test coverage

Covered by integration tests.

@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@robertpi
robertpi force-pushed the robert/asm/blocking-framework branch from a44d557 to 42de9f5 Compare September 14, 2022 13:48
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@robertpi
robertpi force-pushed the robert/asm/blocking-framework branch from 1388a27 to d9089f1 Compare September 16, 2022 07:49
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@robertpi
robertpi force-pushed the robert/asm/blocking-framework branch from 3c9e6ee to 31344f0 Compare September 16, 2022 15:18
@robertpi robertpi changed the title Robert/asm/blocking framework IP Blocking for .NET Framework Sep 16, 2022
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@robertpi
robertpi marked this pull request as ready for review September 16, 2022 17:53
@robertpi
robertpi requested review from a team as code owners September 16, 2022 17:53
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
zacharycmontoya
zacharycmontoya reviewed Sep 19, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AppSec/Transports/Http/HttpTransport.Framework.cs Outdated
zacharycmontoya
zacharycmontoya reviewed Sep 19, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AppSec/Security.cs
zacharycmontoya
zacharycmontoya approved these changes Sep 19, 2022
View reviewed changes

@zacharycmontoya zacharycmontoya left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with some very minor feedback

@andrewlock

This comment has been minimized.

Sign in to view
anna-git
anna-git reviewed Sep 20, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AppSec/Transports/Http/HttpTransport.Framework.cs Outdated
dromanol
dromanol reviewed Sep 20, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AppSec/Security.cs Outdated
dromanol
dromanol reviewed Sep 20, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AppSec/Transports/Http/HttpTransport.Framework.cs
dromanol
dromanol reviewed Sep 20, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AspNet/TracingHttpModule.cs
@andrewlock

This comment has been minimized.

Sign in to view
@robertpi
robertpi force-pushed the robert/asm/blocking-framework branch from 2d95807 to b39a559 Compare September 27, 2022 13:58
@github-actions

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
anna-git
anna-git reviewed Sep 27, 2022
View reviewed changes
Comment thread tracer/src/Datadog.Trace/AspNet/TracingHttpModule.cs Outdated
anna-git
anna-git approved these changes Sep 27, 2022
View reviewed changes

@anna-git anna-git left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just added 2 small comments, among one about Telemetry that could not happen if we block

dromanol
dromanol approved these changes Sep 27, 2022
View reviewed changes

@dromanol dromanol left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@andrewlock

This comment has been minimized.

Sign in to view
@github-actions

github-actions Bot commented Sep 28, 2022

Copy link
Copy Markdown
Contributor

Snapshots difference summary

The following differences have been observed in committed snapshots. It is meant to help the reviewer.
The diff is simplistic, so please check some files anyway while we improve it.

20 occurrences of :

+      _dd.origin: appsec

@andrewlock

andrewlock commented Sep 28, 2022

Copy link
Copy Markdown
Member

Benchmarks Report 🐌

Benchmarks for #3207 compared to master:

  • All benchmarks have the same speed
  • All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

  • Mann–Whitney U test with statistical test for significance of 5%
  • Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master WriteAndFlushEnrichedTraces net472 722μs 436ns 1.69μs 0.363 0 0 3.18 KB
master WriteAndFlushEnrichedTraces netcoreapp3.1 456μs 177ns 662ns 0 0 0 2.58 KB
#3207 WriteAndFlushEnrichedTraces net472 720μs 262ns 980ns 0.355 0 0 3.18 KB
#3207 WriteAndFlushEnrichedTraces netcoreapp3.1 459μs 121ns 469ns 0 0 0 2.58 KB
Benchmarks.Trace.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master AllCycleSimpleBody net472 197ns 0.0313ns 0.113ns 0.0726 0 0 457 B
master AllCycleSimpleBody netcoreapp3.1 253ns 0.289ns 1.12ns 0.00621 0 0 456 B
master AllCycleMoreComplexBody net472 201ns 0.0652ns 0.235ns 0.0688 0 0 433 B
master AllCycleMoreComplexBody netcoreapp3.1 255ns 0.214ns 0.83ns 0.00595 0 0 432 B
master BodyExtractorSimpleBody net472 282ns 0.556ns 2.08ns 0.0573 0 0 361 B
master BodyExtractorSimpleBody netcoreapp3.1 228ns 0.146ns 0.548ns 0.00378 0 0 272 B
master BodyExtractorMoreComplexBody net472 15.7μs 10.4ns 38.8ns 1.21 0.0156 0 7.62 KB
master BodyExtractorMoreComplexBody netcoreapp3.1 12.7μs 8.99ns 34.8ns 0.0888 0 0 6.75 KB
#3207 AllCycleSimpleBody net472 199ns 0.101ns 0.376ns 0.0726 0 0 457 B
#3207 AllCycleSimpleBody netcoreapp3.1 254ns 0.239ns 0.927ns 0.00626 0 0 456 B
#3207 AllCycleMoreComplexBody net472 196ns 0.134ns 0.501ns 0.0688 0 0 433 B
#3207 AllCycleMoreComplexBody netcoreapp3.1 252ns 0.206ns 0.771ns 0.00588 0 0 432 B
#3207 BodyExtractorSimpleBody net472 285ns 0.284ns 1.1ns 0.0573 0 0 361 B
#3207 BodyExtractorSimpleBody netcoreapp3.1 223ns 0.113ns 0.421ns 0.00368 0 0 272 B
#3207 BodyExtractorMoreComplexBody net472 16.7μs 19.6ns 76.1ns 1.21 0.0165 0 7.62 KB
#3207 BodyExtractorMoreComplexBody netcoreapp3.1 12.6μs 6.45ns 25ns 0.0878 0 0 6.75 KB
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master SendRequest net472 0ns 0ns 0ns 0 0 0 0 b
master SendRequest netcoreapp3.1 182μs 281ns 1.09μs 0.271 0 0 20.68 KB
#3207 SendRequest net472 0ns 0ns 0ns 0 0 0 0 b
#3207 SendRequest netcoreapp3.1 182μs 225ns 872ns 0.273 0 0 20.68 KB
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master ExecuteNonQuery net472 1.97μs 0.684ns 2.56ns 0.155 0.000978 0 979 B
master ExecuteNonQuery netcoreapp3.1 1.49μs 0.892ns 3.34ns 0.0134 0 0 968 B
#3207 ExecuteNonQuery net472 1.9μs 0.56ns 2.09ns 0.155 0.000946 0 979 B
#3207 ExecuteNonQuery netcoreapp3.1 1.45μs 0.873ns 3.27ns 0.013 0 0 968 B
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master CallElasticsearch net472 2.45μs 0.828ns 3.21ns 0.188 0 0 1.19 KB
master CallElasticsearch netcoreapp3.1 1.59μs 0.511ns 1.84ns 0.0151 0 0 1.13 KB
master CallElasticsearchAsync net472 2.69μs 1.12ns 4.35ns 0.209 0 0 1.32 KB
master CallElasticsearchAsync netcoreapp3.1 1.61μs 0.56ns 2.02ns 0.0164 0 0 1.25 KB
#3207 CallElasticsearch net472 2.56μs 0.515ns 1.93ns 0.189 0 0 1.19 KB
#3207 CallElasticsearch netcoreapp3.1 1.48μs 0.472ns 1.83ns 0.0156 0 0 1.13 KB
#3207 CallElasticsearchAsync net472 2.68μs 2.52ns 9.77ns 0.21 0 0 1.32 KB
#3207 CallElasticsearchAsync netcoreapp3.1 1.6μs 0.425ns 1.64ns 0.0168 0 0 1.25 KB
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master ExecuteAsync net472 2.75μs 0.693ns 2.68ns 0.231 0 0 1.45 KB
master ExecuteAsync netcoreapp3.1 1.77μs 1.08ns 4.19ns 0.0186 0 0 1.38 KB
#3207 ExecuteAsync net472 2.69μs 2.3ns 8.9ns 0.23 0 0 1.45 KB
#3207 ExecuteAsync netcoreapp3.1 1.81μs 0.614ns 2.3ns 0.019 0 0 1.38 KB
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master SendAsync net472 5.87μs 2.84ns 11ns 0.444 0 0 2.8 KB
master SendAsync netcoreapp3.1 3.59μs 2.99ns 11.2ns 0.0356 0 0 2.63 KB
#3207 SendAsync net472 6.03μs 2.69ns 10.4ns 0.443 0 0 2.8 KB
#3207 SendAsync netcoreapp3.1 3.77μs 1.51ns 5.84ns 0.0361 0 0 2.63 KB
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master EnrichedLog net472 3.14μs 2.4ns 8.64ns 0.298 0 0 1.88 KB
master EnrichedLog netcoreapp3.1 2.47μs 1.19ns 4.28ns 0.0259 0 0 1.91 KB
#3207 EnrichedLog net472 3.1μs 3.75ns 14.5ns 0.298 0 0 1.88 KB
#3207 EnrichedLog netcoreapp3.1 2.43μs 0.832ns 3.11ns 0.0257 0 0 1.91 KB
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master EnrichedLog net472 152μs 213ns 827ns 0.68 0.227 0 4.72 KB
master EnrichedLog netcoreapp3.1 119μs 134ns 501ns 0.0585 0 0 4.55 KB
#3207 EnrichedLog net472 153μs 161ns 625ns 0.684 0.228 0 4.72 KB
#3207 EnrichedLog netcoreapp3.1 119μs 144ns 557ns 0.0588 0 0 4.55 KB
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master EnrichedLog net472 5.94μs 1.94ns 7.5ns 0.579 0.00297 0 3.65 KB
master EnrichedLog netcoreapp3.1 4.37μs 1.51ns 5.66ns 0.0546 0 0 3.98 KB
#3207 EnrichedLog net472 5.97μs 1.49ns 5.57ns 0.579 0.00299 0 3.65 KB
#3207 EnrichedLog netcoreapp3.1 4.4μs 1.33ns 5.17ns 0.0531 0 0 3.98 KB
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master SendReceive net472 2.32μs 2.77ns 10.7ns 0.222 0 0 1.4 KB
master SendReceive netcoreapp3.1 1.82μs 0.955ns 3.44ns 0.0182 0 0 1.35 KB
#3207 SendReceive net472 2.28μs 2.84ns 11ns 0.222 0 0 1.4 KB
#3207 SendReceive netcoreapp3.1 1.76μs 1.64ns 6.14ns 0.018 0 0 1.35 KB
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master EnrichedLog net472 5.08μs 2.48ns 8.95ns 0.364 0 0 2.3 KB
master EnrichedLog netcoreapp3.1 4.25μs 1.52ns 5.87ns 0.0253 0 0 1.86 KB
#3207 EnrichedLog net472 5.01μs 1.48ns 5.32ns 0.365 0 0 2.3 KB
#3207 EnrichedLog netcoreapp3.1 4.44μs 0.944ns 3.53ns 0.0246 0 0 1.86 KB
Benchmarks.Trace.SpanBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master StartFinishSpan net472 1.22μs 0.501ns 1.81ns 0.134 0 0 842 B
master StartFinishSpan netcoreapp3.1 914ns 0.356ns 1.38ns 0.0105 0 0 792 B
master StartFinishScope net472 1.41μs 0.708ns 2.65ns 0.146 0 0 923 B
master StartFinishScope netcoreapp3.1 1.08μs 0.279ns 1.08ns 0.0124 0 0 912 B
#3207 StartFinishSpan net472 1.18μs 1.07ns 4.01ns 0.133 0 0 842 B
#3207 StartFinishSpan netcoreapp3.1 937ns 0.256ns 0.991ns 0.0108 0 0 792 B
#3207 StartFinishScope net472 1.41μs 0.451ns 1.69ns 0.147 0 0 923 B
#3207 StartFinishScope netcoreapp3.1 1.05μs 0.375ns 1.4ns 0.0121 0 0 912 B
Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch Method Toolchain Mean StdError StdDev Gen 0 Gen 1 Gen 2 Allocated
master RunOnMethodBegin net472 1.51μs 0.374ns 1.45ns 0.146 0 0 923 B
master RunOnMethodBegin netcoreapp3.1 1.24μs 0.335ns 1.3ns 0.0123 0 0 912 B
#3207 RunOnMethodBegin net472 1.48μs 0.584ns 2.26ns 0.146 0 0 923 B
#3207 RunOnMethodBegin netcoreapp3.1 1.12μs 0.403ns 1.56ns 0.0123 0 0 912 B

@andrewlock

andrewlock commented Sep 28, 2022

Copy link
Copy Markdown
Member

Code Coverage Report 📊

✔️ Merging #3207 into master will not change line coverage
✔️ Merging #3207 into master will not change branch coverage
✔️ Merging #3207 into master will will decrease complexity by 100

master #3207 Change
Lines 18237 / 25420 17936 / 25112
Lines % 72% 71% 0% ✔️
Branches 10551 / 15466 10488 / 15392
Branches % 68% 68% 0% ✔️
Complexity 16731 16631 -100 ✔️

View the full report for further details:

Datadog.Trace Breakdown ✔️

master #3207 Change
Lines % 72% 71% 0% ✔️
Branches % 68% 68% 0% ✔️
Complexity 16731 16631 -100 ✔️

The following classes have significant coverage changes.

File Line coverage change Branch coverage change Complexity change
Datadog.Trace.Ci.GitInfo -17% ⛔ -11% ⛔ 0 ✔️
Datadog.Trace.DataStreamsMonitoring.DataStreamsManager -11% ⛔ -1% ⚠️ -7 ✔️
Datadog.Trace.AppSec.Waf.Obj -11% ⛔ 0% ✔️ 0 ✔️
Datadog.Trace.Telemetry.TelemetrySettings 0% ✔️ 6% ✔️ -8 ✔️
Datadog.Trace.Activity.DiagnosticSourceEventListener 6% ✔️ 0% ✔️ 0 ✔️
Datadog.Trace.Telemetry.TelemetryCircuitBreaker 17% ✔️ 25% ✔️ -10 ✔️
Datadog.Trace.AppSec.Transports.Http.HttpTransport 25% ✔️ 25% ✔️ 6 ⛔

11 classes were removed from Datadog.Trace in #3207

View the full reports for further details:

@robertpi
robertpi merged commit 193292b into master Sep 29, 2022
@robertpi
robertpi deleted the robert/asm/blocking-framework branch September 29, 2022 04:52
@github-actions github-actions Bot added this to the vNext milestone Sep 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anna-git anna-git anna-git approved these changes
@zacharycmontoya zacharycmontoya zacharycmontoya approved these changes
@dromanol dromanol dromanol approved these changes

Assignees

No one assigned

Labels

area:asm

Projects

None yet

Milestone

2.16.0

Development

Successfully merging this pull request may close these issues.

5 participants

@robertpi @andrewlock @anna-git @zacharycmontoya @dromanol