[AAP] Trace tagging rules#8581
Merged
Merged
Conversation
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8581) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (76ms) : 71, 80
master - mean (73ms) : 69, 77
section Bailout
This PR (8581) - mean (79ms) : 75, 83
master - mean (78ms) : 75, 81
section CallTarget+Inlining+NGEN
This PR (8581) - mean (1,112ms) : 1028, 1195
master - mean (1,098ms) : 1055, 1142
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (118ms) : 111, 125
master - mean (113ms) : 109, 118
section Bailout
This PR (8581) - mean (118ms) : 113, 123
master - mean (118ms) : 112, 124
section CallTarget+Inlining+NGEN
This PR (8581) - mean (792ms) : 766, 817
master - mean (784ms) : 758, 810
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (105ms) : 98, 111
master - mean (105ms) : 99, 111
section Bailout
This PR (8581) - mean (103ms) : 99, 107
master - mean (103ms) : 98, 109
section CallTarget+Inlining+NGEN
This PR (8581) - mean (948ms) : 909, 987
master - mean (945ms) : 903, 987
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (104ms) : 98, 109
master - mean (101ms) : 97, 105
section Bailout
This PR (8581) - mean (105ms) : 100, 111
master - mean (104ms) : 98, 109
section CallTarget+Inlining+NGEN
This PR (8581) - mean (825ms) : 783, 867
master - mean (824ms) : 779, 869
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (190ms) : 186, 194
master - mean (190ms) : 187, 193
section Bailout
This PR (8581) - mean (193ms) : 191, 195
master - mean (193ms) : 192, 195
section CallTarget+Inlining+NGEN
This PR (8581) - mean (1,164ms) : 1120, 1209
master - mean (1,160ms) : 1122, 1199
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (273ms) : 269, 276
master - mean (277ms) : 270, 283
section Bailout
This PR (8581) - mean (273ms) : 271, 276
master - mean (279ms) : 274, 285
section CallTarget+Inlining+NGEN
This PR (8581) - mean (931ms) : 909, 952
master - mean (941ms) : 920, 961
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (272ms) : 266, 278
master - mean (273ms) : 266, 280
section Bailout
This PR (8581) - mean (269ms) : 265, 274
master - mean (274ms) : 268, 280
section CallTarget+Inlining+NGEN
This PR (8581) - mean (1,141ms) : 1104, 1179
master - mean (1,152ms) : 1101, 1202
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8581) - mean (270ms) : 267, 274
master - mean (283ms) : 276, 290
section Bailout
This PR (8581) - mean (265ms) : 263, 268
master - mean (279ms) : 271, 288
section CallTarget+Inlining+NGEN
This PR (8581) - mean (1,022ms) : 977, 1066
master - mean (1,044ms) : 994, 1094
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
BenchmarksBenchmark execution time: 2026-05-12 13:10:16 Comparing candidate commit 8e5d062 in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 26 metrics, 0 unstable metrics, 58 known flaky benchmarks, 29 flaky benchmarks without significant changes.
|
e-n-0
marked this pull request as ready for review
May 8, 2026 12:57
| case JValue: | ||
| ddwafObjectStruct = GetStringObject(ref context, o?.ToString() ?? string.Empty); | ||
| case JValue jValue: | ||
| ddwafObjectStruct = Encode(ref context, remainingDepth, key, jValue.Value); |
Collaborator
There was a problem hiding this comment.
jValue.Value is always a primitive, right? Just to make sure that no inifinite recurssion is possible
Member
Author
There was a problem hiding this comment.
JValue holds a single JSON/Json.NET primitive/leaf value, not an object, array, property, or arbitrary CLR object.
NachoEchevarria
approved these changes
May 12, 2026
NachoEchevarria
left a comment
NachoEchevarria
left a comment
Collaborator
There was a problem hiding this comment.
While not familiar with the RFC especifics, LGTM from a tracing POV.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Add support for AAP trace-tagging rules from WAF and ASM_DD config.
Reason for change
RFC-1034 lets AppSec rules attach trace attributes and request trace retention without creating an AppSec event. The tracer needs to preserve those WAF outputs and report them on the span with the right tag/metric types and sampling priority.
Follow up of #7332 and #7331 (incorrectly reporting the capabilities as they missed the implementation).
Implementation details
keepandattributesresults, splitting schema attributes, fingerprint attributes, and trace-tagging span attributes.JValuescalar types when encoding WAF inputs.rules_compatsupport for ASM_DD configs and advertise the ASM_DD multiconfig / trace-tagging capabilities.keep:false, whilekeep:falsefor plain trace-tagging rules does not forceUSER_KEEP.Test coverage
keep/HasKeep, schema sampling,JValueencoding, RCM capabilities, andrules_compat.https://datadoghq.atlassian.net/browse/APPSEC-63122