Skip to content

appsec: Suspicious Attacker Blocking#2878

Merged
eliottness merged 4 commits into
mainfrom
eliott.bouhana/APPSEC-54194
Sep 23, 2024
Merged

appsec: Suspicious Attacker Blocking#2878
eliottness merged 4 commits into
mainfrom
eliott.bouhana/APPSEC-54194

Conversation

@eliottness

@eliottness eliottness commented Sep 18, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

  • Copy rules_data behaviour to exclusion_data to support exclusion lists
  • Setup a new test ruleset to test SAB feature
  • Actually test the feature
  • Fix bug where disabling appsec via RC did not reset the rules to the default ones
  • Fix missing waf.RunAddressData.Scope to RASP SSRF WAF run
  • Upgrade github.com/DataDog/datadog-agent/pkg/remoteconfig/state

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.
  • Add an appropriate team label so this PR gets put in the right place for the release notes.
  • Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

@pr-commenter

pr-commenter Bot commented Sep 18, 2024 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2024-09-18 19:43:09

Comparing candidate commit 8f88b8d in PR branch eliott.bouhana/APPSEC-54194 with baseline commit b94c2c3 in branch main.

Found 2 performance improvements and 8 performance regressions! Performance is the same for 49 metrics, 0 unstable metrics.

scenario:BenchmarkExtractW3C-24

  • 🟥 execution_time [+48.436ns; +52.964ns] or [+2.013%; +2.201%]

scenario:BenchmarkInjectW3C-24

  • 🟩 execution_time [-170.581ns; -130.819ns] or [-4.067%; -3.119%]

scenario:BenchmarkPartialFlushing/Disabled-24

  • 🟥 execution_time [+10.530ms; +12.974ms] or [+3.860%; +4.756%]

scenario:BenchmarkPartialFlushing/Enabled-24

  • 🟥 execution_time [+10.128ms; +13.010ms] or [+3.653%; +4.693%]
  • 🟩 avgHeapInUse(Mb) [-8.083MB; -2.035MB] or [-11.404%; -2.871%]

scenario:BenchmarkSingleSpanRetention/no-rules-24

  • 🟥 execution_time [+12.542µs; +13.314µs] or [+5.233%; +5.555%]

scenario:BenchmarkSingleSpanRetention/with-rules/match-all-24

  • 🟥 execution_time [+12.579µs; +14.475µs] or [+5.193%; +5.976%]

scenario:BenchmarkSingleSpanRetention/with-rules/match-half-24

  • 🟥 execution_time [+12.467µs; +13.930µs] or [+5.152%; +5.757%]

scenario:BenchmarkStartSpan-24

  • 🟥 execution_time [+106.508ns; +132.292ns] or [+4.718%; +5.860%]

scenario:BenchmarkTracerAddSpans-24

  • 🟥 execution_time [+141.775ns; +157.825ns] or [+3.576%; +3.981%]

Base automatically changed from eliott.bouhana/APPSEC-54945 to main September 18, 2024 14:37
An error occurred while trying to automatically change base from eliott.bouhana/APPSEC-54945 to main September 18, 2024 14:38
@eliottness
eliottness force-pushed the eliott.bouhana/APPSEC-54194 branch from cebd010 to b183600 Compare September 18, 2024 19:13
@eliottness

eliottness commented Sep 18, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

https://github.com/DataDog/dd-trace-go/actions/runs/10929945536

@eliottness
eliottness force-pushed the eliott.bouhana/APPSEC-54194 branch from b183600 to 8f88b8d Compare September 18, 2024 19:17
@eliottness eliottness self-assigned this Sep 18, 2024
@eliottness
eliottness marked this pull request as ready for review September 18, 2024 19:19
@eliottness
eliottness requested a review from a team as a code owner September 18, 2024 19:19
Julio-Guerra
Julio-Guerra reviewed Sep 19, 2024
View reviewed changes
Comment thread internal/appsec/remoteconfig_test.go
Julio-Guerra
Julio-Guerra reviewed Sep 19, 2024
View reviewed changes
Comment thread internal/appsec/appsec.go
RomainMuller
RomainMuller reviewed Sep 20, 2024
View reviewed changes
Comment thread internal/appsec/appsec.go
Comment thread internal/appsec/remoteconfig.go Outdated
@RomainMuller RomainMuller mentioned this pull request Sep 20, 2024
Merged
7 tasks
@RomainMuller

RomainMuller commented Sep 23, 2024

Copy link
Copy Markdown
Contributor

/merge

@dd-devflow

dd-devflow Bot commented Sep 23, 2024

Copy link
Copy Markdown

🚂 MergeQueue: pull request added to the queue

The median merge time in main is 0s.

Use /merge -c to cancel this operation!

@dd-devflow

dd-devflow Bot commented Sep 23, 2024

Copy link
Copy Markdown

🚨 MergeQueue: This merge request is in error

mergequeue build completed successfully, but the github api returned an error while merging the pr.
It's probably because:

  • repository configuration requires approval by code owners, but no code owner approved this PR
  • target branch of PR is restricted to only allow up-to-date branches, but the pr is now outdated
Details

Error: PUT https://api.github.com/repos/DataDog/dd-trace-go/pulls/2878/merge: 405 5 of 5 required status checks are expected. []

FullStacktrace:
activity error (type: github.GithubService_MergePullRequest, scheduledEventID: 41, startedEventID: 42, identity: 1@github-worker-6c87867d47-tctz5@): PUT https://api.github.com/repos/DataDog/dd-trace-go/pulls/2878/merge: 405 5 of 5 required status checks are expected. [] (type: ErrorResponse, retryable: true)

If you need support, contact us on Slack #devflow with those details!

@eliottness
internal/appsec: add exclusion_data to rules management
445787c 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
fix multiple bugs:
0efd143 
* After recieving the order to stop appsec via RC we did not reset the ruleset to the default one
* some code in http listeners where deduplicated for RASP SSRF making SSRF RASP span tags not working
* its 'exclusions' but its 'exclusion_data' without an 's'

Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
switch from a free form map to a struct
d05fcfc 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
suggestions from @RomainMuller
6c73707 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
eliottness force-pushed the eliott.bouhana/APPSEC-54194 branch from 2749f74 to 6c73707 Compare September 23, 2024 09:19
@eliottness
eliottness enabled auto-merge (squash) September 23, 2024 09:19
@eliottness
eliottness merged commit ba18110 into main Sep 23, 2024
@eliottness
eliottness deleted the eliott.bouhana/APPSEC-54194 branch September 23, 2024 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RomainMuller RomainMuller RomainMuller approved these changes
+1 more reviewer
@Julio-Guerra Julio-Guerra Julio-Guerra left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@eliottness eliottness

Labels

appsec mergequeue-status: error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eliottness @RomainMuller @Julio-Guerra