Merge pull request #3863 from DataDog/glopes/helper-rust-fix-blocked-tag

cataphract · web-flow · commit 9fe033042807 · 2026-05-07T18:00:56.000+02:00
appsec/helper-rust: fix metric tag blocked_request
diff --git a/appsec/helper-rust/src/client/metrics.rs b/appsec/helper-rust/src/client/metrics.rs
@@ -165,10 +165,12 @@ impl RunOutputExt for libddwaf::RunOutput {
     }
     fn is_blocking(&self) -> bool {
         self.actions().is_some_and(|actions| {
-            actions
-                .value()
-                .iter()
-                .any(|action| matches!(action.key().to_str(), Some("block") | Some("redirect")))
+            actions.value().iter().any(|action| {
+                matches!(
+                    action.key().to_str(),
+                    Some("block_request") | Some("redirect_request")
+                )
+            })
         })
     }
 }
diff --git a/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/TelemetryTests.groovy b/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/TelemetryTests.groovy
@@ -913,6 +913,65 @@ class TelemetryTests {
         assert 'rate_limited:false' in wafReq.tags
     }
 
+
+    /**
+     * Verifies that appsec.waf.requests is tagged request_blocked:true when the WAF
+     * returns a block_request action and false otherwise
+     */
+    @Test
+    @Order(10)
+    void 'waf requests request_blocked tag is true on blocking attack'() {
+        Assumptions.assumeTrue(System.getProperty('USE_HELPER_RUST') != null,
+                'request_blocked tag is only emitted unconditionally by the Rust helper')
+
+        Supplier<RemoteConfigRequest> requestSup = CONTAINER.applyRemoteConfig(RC_TARGET, [
+                'datadog/2/ASM_FEATURES/asm_features_activation/config': [
+                        asm: [enabled: true]
+                ]
+        ])
+
+        CONTAINER.traceFromRequest('/hello.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+        }
+        assert requestSup.get() != null
+
+        // Blocking request: 80.80.80.80 hits the recommended.json IP blocklist rule
+        // (on_match: ["block"]). The WAF returns a block_request action.
+        HttpRequest req = CONTAINER.buildReq('/hello.php')
+                .header('X-Forwarded-For', '80.80.80.80').GET().build()
+        CONTAINER.traceFromRequest(req, ofString()) { HttpResponse<String> resp ->
+            assert resp.statusCode() == 403
+        }
+
+        TelemetryHelpers.Metric wafReqBlocked
+        TelemetryHelpers.Metric wafReqNotBlocked
+
+        TelemetryHelpers.waitForMetrics(CONTAINER, 30) { List<TelemetryHelpers.GenerateMetrics> messages ->
+            def allSeries = messages.collectMany { it.series }
+            wafReqBlocked = allSeries.find {
+                it.name == 'waf.requests' &&
+                        'rule_triggered:true' in it.tags &&
+                        'request_blocked:true' in it.tags
+            }
+            // from the 1st request
+            wafReqNotBlocked = allSeries.find {
+                it.name == 'waf.requests' && 'request_blocked:false' in it.tags
+            }
+            wafReqBlocked != null && wafReqNotBlocked != null
+        }
+
+        assert wafReqBlocked != null : 'waf.requests metric with request_blocked:true not found ' +
+                '-- helper failed to detect the WAF block action'
+        assert wafReqBlocked.namespace == 'appsec'
+        assert wafReqBlocked.type == 'count'
+        assert 'rule_triggered:true' in wafReqBlocked.tags
+        assert 'request_blocked:true' in wafReqBlocked.tags
+
+        assert wafReqNotBlocked != null : 'waf.requests metric with request_blocked:false not found ' +
+                '-- rust helper must emit request_blocked:false on non-blocked requests (RFC-1012)'
+        assert 'request_blocked:false' in wafReqNotBlocked.tags
+    }
+
     /**
      * Verifies that _dd.appsec.rasp.duration (ms) and _dd.appsec.rasp.duration_ext (µs) are
      * emitted as span metrics and that appsec.rasp.duration / appsec.rasp.duration_ext are

Original file line number	Diff line number	Diff line change
`@@ -165,10 +165,12 @@ impl RunOutputExt for libddwaf::RunOutput {`
`165`	`165`	`}`
`166`	`166`	`fn is_blocking(&self) -> bool {`
`167`	`167`	`self.actions().is_some_and(\|actions\| {`
`168`		`- actions`
`169`		`- .value()`
`170`		`- .iter()`
`171`		`- .any(\|action\| matches!(action.key().to_str(), Some("block") \| Some("redirect")))`
	`168`	`+ actions.value().iter().any(\|action\| {`
	`169`	`+ matches!(`
	`170`	`+ action.key().to_str(),`
	`171`	`+ Some("block_request") \| Some("redirect_request")`
	`172`	`+ )`
	`173`	`+ })`
`172`	`174`	`})`
`173`	`175`	`}`
`174`	`176`	`}`