[IAST] Support for specifying aspect min version (#5931) [-> V2]#5932
Conversation
## Summary of changes
Added a mechanism by which an aspect or aspect class can define a
minimum native version in order to be applied.
## Reason for change
Some aspects defined under new features (like aspects for struct
methods, or aspects with generics) can break old native implementations,
so, we need a way to avoid those to be sent or applied.
## Implementation details
Created `FromVersionAttribute` versions of all Aspect attributes. These
inherit from the original attribute adding a **minimum version of the
native library** from which the aspect will be applied. This version is
then added in the end of the aspect line, in a way that makes old native
tracers ignore those lines, as it breaks the old specification.
For new tracers who are able to read that version info, a version
comparison will determine if that line is accepted or dumped, allowing
us to fine tune the aspects set applied.
This aspect attribute which states that this aspect will be only applied
if a native tracer with version `3.2.0` or bigger is found
`[AspectMethodReplaceFromVersion("3.2.0",
"System.String::Concat(System.Collections.Generic.IEnumerable)")]`
will generate this aspect line
`[AspectMethodReplace(\"System.String::Concat(System.Collections.Generic.IEnumerable)\",\"\",[0],[False],[None],Default,[]);V3.2.0]
Concat(System.Collections.Generic.IEnumerable)`
Notice that the version goes in the end, and that's because old tracers
while parsing the line were looking for the text `)] `
This will make old unprepared tracers to automatically ditch the line,
whereas the new one implemented from this PR, will be able to retrieve,
parse and decide what to do with that version info.
## Test coverage
Source generator tests have been written to ensure the correct use and
aspect generation of version flavor aspect attributes.
## Other details
<!-- ⚠️ Note: where possible, please obtain 2 approvals prior to
merging. Unless CODEOWNERS specifies otherwise, for external teams it is
typically best to have one review from a team member, and one review
from apm-dotnet. Trivial changes do not require 2 reviews. -->
There was a problem hiding this comment.
I assume you regenerated these files as I expect things have changed between v2/v3, but if not the checks will tell us 😄
Datadog ReportBranch report: ✅ 0 Failed, 434140 Passed, 3177 Skipped, 34h 20m 20.15s Total Time |
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (75ms) : 66, 84
. : milestone, 75,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (1,031ms) : 1008, 1053
. : milestone, 1031,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (112ms) : 107, 116
. : milestone, 112,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (709ms) : 691, 727
. : milestone, 709,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (95ms) : 90, 101
. : milestone, 95,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (668ms) : 647, 689
. : milestone, 668,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (190ms) : 187, 193
. : milestone, 190,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (1,113ms) : 1089, 1138
. : milestone, 1113,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (276ms) : 271, 280
. : milestone, 276,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (880ms) : 864, 897
. : milestone, 880,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5932) - mean (264ms) : 259, 269
. : milestone, 264,
section CallTarget+Inlining+NGEN
This PR (5932) - mean (866ms) : 840, 891
. : milestone, 866,
|
Benchmarks Report for appsec 🐌Benchmarks for #5932 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑netcoreapp3.1 | 1.230 | 203.57 | 250.40 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | AllCycleSimpleBody |
net6.0 | 73.2μs | 83.9ns | 325ns | 0.0733 | 0 | 0 | 6.01 KB |
| master | AllCycleSimpleBody |
netcoreapp3.1 | 62.7μs | 70.1ns | 272ns | 0.0935 | 0 | 0 | 6.95 KB |
| master | AllCycleSimpleBody |
net472 | 48.8μs | 51ns | 197ns | 1.31 | 0 | 0 | 8.34 KB |
| master | AllCycleMoreComplexBody |
net6.0 | 80.3μs | 99.5ns | 385ns | 0.121 | 0 | 0 | 9.51 KB |
| master | AllCycleMoreComplexBody |
netcoreapp3.1 | 70.4μs | 94.1ns | 364ns | 0.14 | 0 | 0 | 10.36 KB |
| master | AllCycleMoreComplexBody |
net472 | 56.6μs | 61.4ns | 230ns | 1.86 | 0.0282 | 0 | 11.85 KB |
| master | ObjectExtractorSimpleBody |
net6.0 | 147ns | 0.116ns | 0.45ns | 0.00391 | 0 | 0 | 280 B |
| master | ObjectExtractorSimpleBody |
netcoreapp3.1 | 204ns | 0.189ns | 0.708ns | 0.00379 | 0 | 0 | 272 B |
| master | ObjectExtractorSimpleBody |
net472 | 167ns | 0.165ns | 0.638ns | 0.0446 | 0 | 0 | 281 B |
| master | ObjectExtractorMoreComplexBody |
net6.0 | 3.06μs | 1.64ns | 6.15ns | 0.0531 | 0 | 0 | 3.78 KB |
| master | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 4.02μs | 2.24ns | 8.37ns | 0.0502 | 0 | 0 | 3.69 KB |
| master | ObjectExtractorMoreComplexBody |
net472 | 3.81μs | 3.14ns | 12.2ns | 0.602 | 0.00571 | 0 | 3.8 KB |
| #5932 | AllCycleSimpleBody |
net6.0 | 71.9μs | 87.8ns | 340ns | 0.0718 | 0 | 0 | 6 KB |
| #5932 | AllCycleSimpleBody |
netcoreapp3.1 | 62.5μs | 95.7ns | 371ns | 0.0933 | 0 | 0 | 6.95 KB |
| #5932 | AllCycleSimpleBody |
net472 | 48.8μs | 44.6ns | 167ns | 1.31 | 0 | 0 | 8.34 KB |
| #5932 | AllCycleMoreComplexBody |
net6.0 | 76.7μs | 86.7ns | 324ns | 0.114 | 0 | 0 | 9.51 KB |
| #5932 | AllCycleMoreComplexBody |
netcoreapp3.1 | 70.4μs | 97.8ns | 379ns | 0.106 | 0 | 0 | 10.37 KB |
| #5932 | AllCycleMoreComplexBody |
net472 | 56.2μs | 46.8ns | 175ns | 1.88 | 0.0281 | 0 | 11.85 KB |
| #5932 | ObjectExtractorSimpleBody |
net6.0 | 151ns | 0.107ns | 0.415ns | 0.00393 | 0 | 0 | 280 B |
| #5932 | ObjectExtractorSimpleBody |
netcoreapp3.1 | 251ns | 0.207ns | 0.773ns | 0.00378 | 0 | 0 | 272 B |
| #5932 | ObjectExtractorSimpleBody |
net472 | 163ns | 0.245ns | 0.95ns | 0.0446 | 0 | 0 | 281 B |
| #5932 | ObjectExtractorMoreComplexBody |
net6.0 | 3.13μs | 1.54ns | 5.77ns | 0.0533 | 0 | 0 | 3.78 KB |
| #5932 | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 3.85μs | 3.1ns | 12ns | 0.0502 | 0 | 0 | 3.69 KB |
| #5932 | ObjectExtractorMoreComplexBody |
net472 | 3.85μs | 3.17ns | 11.9ns | 0.603 | 0.00578 | 0 | 3.8 KB |
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EncodeArgs |
net6.0 | 37.4μs | 17.2ns | 66.7ns | 0.446 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
netcoreapp3.1 | 54.3μs | 43.7ns | 169ns | 0.432 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
net472 | 65.3μs | 82.1ns | 318ns | 5.15 | 0.0648 | 0 | 32.5 KB |
| master | EncodeLegacyArgs |
net6.0 | 71.3μs | 30.1ns | 113ns | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
netcoreapp3.1 | 104μs | 70.9ns | 265ns | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
net472 | 152μs | 61.2ns | 237ns | 0.304 | 0 | 0 | 2.15 KB |
| #5932 | EncodeArgs |
net6.0 | 36.9μs | 19.9ns | 77.1ns | 0.462 | 0 | 0 | 32.4 KB |
| #5932 | EncodeArgs |
netcoreapp3.1 | 54.1μs | 24.9ns | 96.5ns | 0.433 | 0 | 0 | 32.4 KB |
| #5932 | EncodeArgs |
net472 | 67.4μs | 40.9ns | 158ns | 5.16 | 0.067 | 0 | 32.5 KB |
| #5932 | EncodeLegacyArgs |
net6.0 | 71.7μs | 15.6ns | 54.1ns | 0 | 0 | 0 | 2.14 KB |
| #5932 | EncodeLegacyArgs |
netcoreapp3.1 | 106μs | 355ns | 1.38μs | 0 | 0 | 0 | 2.14 KB |
| #5932 | EncodeLegacyArgs |
net472 | 152μs | 109ns | 423ns | 0.302 | 0 | 0 | 2.15 KB |
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunWafRealisticBenchmark |
net6.0 | 185μs | 52.9ns | 205ns | 0 | 0 | 0 | 2.42 KB |
| master | RunWafRealisticBenchmark |
netcoreapp3.1 | 197μs | 220ns | 852ns | 0 | 0 | 0 | 2.37 KB |
| master | RunWafRealisticBenchmark |
net472 | 208μs | 55.9ns | 209ns | 0.311 | 0 | 0 | 2.43 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net6.0 | 123μs | 153ns | 592ns | 0 | 0 | 0 | 1.46 KB |
| master | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 130μs | 89.1ns | 345ns | 0 | 0 | 0 | 1.45 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net472 | 139μs | 102ns | 396ns | 0.208 | 0 | 0 | 1.48 KB |
| #5932 | RunWafRealisticBenchmark |
net6.0 | 181μs | 173ns | 672ns | 0 | 0 | 0 | 2.42 KB |
| #5932 | RunWafRealisticBenchmark |
netcoreapp3.1 | 198μs | 266ns | 1.03μs | 0 | 0 | 0 | 2.37 KB |
| #5932 | RunWafRealisticBenchmark |
net472 | 204μs | 113ns | 437ns | 0.306 | 0 | 0 | 2.43 KB |
| #5932 | RunWafRealisticBenchmarkWithAttack |
net6.0 | 121μs | 143ns | 537ns | 0 | 0 | 0 | 1.46 KB |
| #5932 | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 130μs | 117ns | 452ns | 0 | 0 | 0 | 1.45 KB |
| #5932 | RunWafRealisticBenchmarkWithAttack |
net472 | 138μs | 48.1ns | 180ns | 0.206 | 0 | 0 | 1.48 KB |
Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations ⚠️
More allocations ⚠️ in #5932
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0
254.75 KB
263.26 KB
8.5 KB
3.34%
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 254.75 KB | 263.26 KB | 8.5 KB | 3.34% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StringConcatBenchmark |
net6.0 | 60.5μs | 823ns | 8.02μs | 0 | 0 | 0 | 43.44 KB |
| master | StringConcatBenchmark |
netcoreapp3.1 | 53.4μs | 285ns | 1.48μs | 0 | 0 | 0 | 42.64 KB |
| master | StringConcatBenchmark |
net472 | 37.3μs | 44.7ns | 161ns | 0 | 0 | 0 | 59.26 KB |
| master | StringConcatAspectBenchmark |
net6.0 | 314μs | 1.77μs | 13μs | 0 | 0 | 0 | 254.75 KB |
| master | StringConcatAspectBenchmark |
netcoreapp3.1 | 321μs | 1.4μs | 6.11μs | 0 | 0 | 0 | 252.93 KB |
| master | StringConcatAspectBenchmark |
net472 | 281μs | 5.53μs | 53.1μs | 0 | 0 | 0 | 278.53 KB |
| #5932 | StringConcatBenchmark |
net6.0 | 59.4μs | 886ns | 8.77μs | 0 | 0 | 0 | 43.44 KB |
| #5932 | StringConcatBenchmark |
netcoreapp3.1 | 54.4μs | 296ns | 2.5μs | 0 | 0 | 0 | 42.64 KB |
| #5932 | StringConcatBenchmark |
net472 | 37.1μs | 131ns | 472ns | 0 | 0 | 0 | 59.22 KB |
| #5932 | StringConcatAspectBenchmark |
net6.0 | 313μs | 1.64μs | 8.51μs | 0 | 0 | 0 | 263.26 KB |
| #5932 | StringConcatAspectBenchmark |
netcoreapp3.1 | 346μs | 1.73μs | 7.95μs | 0 | 0 | 0 | 253.26 KB |
| #5932 | StringConcatAspectBenchmark |
net472 | 287μs | 6.34μs | 62.2μs | 0 | 0 | 0 | 278.53 KB |
Benchmarks Report for tracer 🐌Benchmarks for #5932 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net472 | 1.177 | 566.36 | 666.63 | |
| Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0 | 1.173 | 397.05 | 465.58 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StartFinishSpan |
net6.0 | 397ns | 0.213ns | 0.825ns | 0.00801 | 0 | 0 | 576 B |
| master | StartFinishSpan |
netcoreapp3.1 | 666ns | 0.438ns | 1.7ns | 0.00774 | 0 | 0 | 576 B |
| master | StartFinishSpan |
net472 | 567ns | 0.285ns | 1.1ns | 0.0918 | 0 | 0 | 578 B |
| master | StartFinishScope |
net6.0 | 490ns | 0.149ns | 0.578ns | 0.00974 | 0 | 0 | 696 B |
| master | StartFinishScope |
netcoreapp3.1 | 697ns | 0.358ns | 1.39ns | 0.00942 | 0 | 0 | 696 B |
| master | StartFinishScope |
net472 | 913ns | 0.876ns | 3.39ns | 0.104 | 0 | 0 | 658 B |
| #5932 | StartFinishSpan |
net6.0 | 466ns | 0.32ns | 1.24ns | 0.00818 | 0 | 0 | 576 B |
| #5932 | StartFinishSpan |
netcoreapp3.1 | 608ns | 1.07ns | 4.16ns | 0.0076 | 0 | 0 | 576 B |
| #5932 | StartFinishSpan |
net472 | 666ns | 0.966ns | 3.74ns | 0.0915 | 0 | 0 | 578 B |
| #5932 | StartFinishScope |
net6.0 | 468ns | 0.181ns | 0.703ns | 0.00985 | 0 | 0 | 696 B |
| #5932 | StartFinishScope |
netcoreapp3.1 | 769ns | 0.553ns | 2.14ns | 0.00925 | 0 | 0 | 696 B |
| #5932 | StartFinishScope |
net472 | 847ns | 1.29ns | 5.01ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunOnMethodBegin |
net6.0 | 678ns | 0.279ns | 1.08ns | 0.00987 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
netcoreapp3.1 | 945ns | 0.656ns | 2.54ns | 0.00948 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
net472 | 1.11μs | 0.407ns | 1.58ns | 0.104 | 0 | 0 | 658 B |
| #5932 | RunOnMethodBegin |
net6.0 | 696ns | 0.595ns | 2.3ns | 0.00988 | 0 | 0 | 696 B |
| #5932 | RunOnMethodBegin |
netcoreapp3.1 | 938ns | 0.846ns | 3.28ns | 0.00942 | 0 | 0 | 696 B |
| #5932 | RunOnMethodBegin |
net472 | 1.07μs | 1.09ns | 4.09ns | 0.104 | 0 | 0 | 658 B |
Summary of changes
Added a mechanism by which an aspect or aspect class can define a minimum native version in order to be applied.
Reason for change
Some aspects defined under new features (like aspects for struct methods, or aspects with generics) can break old native implementations, so, we need a way to avoid those to be sent or applied.
Implementation details
Created
FromVersionAttributeversions of all Aspect attributes. These inherit from the original attribute adding a minimum version of the native library from which the aspect will be applied. This version is then added in the end of the aspect line, in a way that makes old native tracers ignore those lines, as it breaks the old specification. For new tracers who are able to read that version info, a version comparison will determine if that line is accepted or dumped, allowing us to fine tune the aspects set applied.This aspect attribute which states that this aspect will be only applied if a native tracer with version
3.2.0or bigger is found[AspectMethodReplaceFromVersion("3.2.0", "System.String::Concat(System.Collections.Generic.IEnumerable)")]will generate this aspect line[AspectMethodReplace(\"System.String::Concat(System.Collections.Generic.IEnumerable)\",\"\",[0],[False],[None],Default,[]);V3.2.0] Concat(System.Collections.Generic.IEnumerable)Notice that the version goes in the end, and that's because old tracers while parsing the line were looking for the text
)]This will make old unprepared tracers to automatically ditch the line, whereas the new one implemented from this PR, will be able to retrieve, parse and decide what to do with that version info.Test coverage
Source generator tests have been written to ensure the correct use and aspect generation of version flavor aspect attributes.
Other details
Summary of changes
Reason for change
Implementation details
Test coverage
Other details