Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ASM][IAST] Configure maximum IAST Ranges #5292

Merged
merged 10 commits into from
Mar 12, 2024
Merged

Conversation

e-n-0
Copy link
Member

@e-n-0 e-n-0 commented Mar 8, 2024

Summary of changes

Add the new environment variable DD_IAST_MAX_RANGE_COUNT defined here.

Reason for change

  • Required for IAST GA.
  • Troubleshoot a client issue

Implementation details

In all source of creation of new ranges arrays, the limit is checked to prevent the creation of a larger Ranges array.
A RangeList object has been created to facilitate the addition of Ranges.

Test coverage

  • Unit tests:
    • Test against String implementation (concat, insert)
    • Test against StringBuilder implementation (append)
  • Integration tests:
    • New endpoint MaxRanges in the AspNetCore5 sample, where an arbitrary has been choose (ReflectionInjection here) to see that the evidence value parts has been correctly written corresponding to the configuration.

@datadog-ddstaging
Copy link

datadog-ddstaging bot commented Mar 8, 2024

Datadog Report

Branch report: flavien/asm/iast/dd_max_range
Commit report: fa7bbce
Test service: dd-trace-dotnet

✅ 0 Failed, 332493 Passed, 1591 Skipped, 36m 22.59s Wall Time

@andrewlock
Copy link
Member

andrewlock commented Mar 8, 2024

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

  • Welch test with statistical test for significance of 5%
  • Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (75ms)  : 65, 86
     .   : milestone, 75,
    master - mean (74ms)  : 65, 83
     .   : milestone, 74,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (990ms)  : 962, 1018
     .   : milestone, 990,
    master - mean (985ms)  : 961, 1008
     .   : milestone, 985,

Loading
gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (111ms)  : 107, 116
     .   : milestone, 111,
    master - mean (118ms)  : 96, 140
     .   : milestone, 118,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (719ms)  : 697, 741
     .   : milestone, 719,
    master - mean (713ms)  : 691, 735
     .   : milestone, 713,

Loading
gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (94ms)  : 90, 98
     .   : milestone, 94,
    master - mean (95ms)  : 91, 98
     .   : milestone, 95,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (670ms)  : 652, 687
     .   : milestone, 670,
    master - mean (671ms)  : 647, 694
     .   : milestone, 671,

Loading
gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (188ms)  : 184, 192
     .   : milestone, 188,
    master - mean (188ms)  : 182, 193
     .   : milestone, 188,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (1,069ms)  : 1044, 1094
     .   : milestone, 1069,
    master - mean (1,063ms)  : 1038, 1089
     .   : milestone, 1063,

Loading
gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (271ms)  : 267, 275
     .   : milestone, 271,
    master - mean (269ms)  : 262, 276
     .   : milestone, 269,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (874ms)  : 851, 896
     .   : milestone, 874,
    master - mean (861ms)  : 839, 884
     .   : milestone, 861,

Loading
gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (5292) - mean (261ms)  : 257, 264
     .   : milestone, 261,
    master - mean (258ms)  : 250, 265
     .   : milestone, 258,

    section CallTarget+Inlining+NGEN
    This PR (5292) - mean (856ms)  : 831, 881
     .   : milestone, 856,
    master - mean (855ms)  : 834, 876
     .   : milestone, 855,

Loading

@e-n-0 e-n-0 changed the title Flavien/asm/iast/dd max range [ASM][IAST] Configure maximum IAST Ranges Mar 11, 2024
@e-n-0 e-n-0 force-pushed the flavien/asm/iast/dd_max_range branch from 40a8b17 to bb9b801 Compare March 11, 2024 16:21
@e-n-0 e-n-0 self-assigned this Mar 11, 2024
@e-n-0 e-n-0 marked this pull request as ready for review March 11, 2024 16:22
@e-n-0 e-n-0 requested review from a team as code owners March 11, 2024 16:22
@e-n-0 e-n-0 force-pushed the flavien/asm/iast/dd_max_range branch from bb9b801 to 6435c7e Compare March 11, 2024 16:30
Copy link
Contributor

@daniel-romano-DD daniel-romano-DD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, with a minor NIT. Thanks a lot

@e-n-0 e-n-0 force-pushed the flavien/asm/iast/dd_max_range branch from 26bf069 to 3bd44a8 Compare March 12, 2024 15:08
@e-n-0 e-n-0 force-pushed the flavien/asm/iast/dd_max_range branch from 3bd44a8 to fa7bbce Compare March 12, 2024 16:08
@e-n-0 e-n-0 merged commit 832de4b into master Mar 12, 2024
53 of 56 checks passed
@e-n-0 e-n-0 deleted the flavien/asm/iast/dd_max_range branch March 12, 2024 20:24
@github-actions github-actions bot added this to the vNext milestone Mar 12, 2024
link04 added a commit that referenced this pull request Mar 12, 2024
commit 832de4b
Author: Flavien Darche <11708575+e-n-0@users.noreply.github.com>
Date:   Tue Mar 12 20:24:21 2024 +0000

    [ASM][IAST] Configure maximum IAST Ranges (#5292)

    * Add configuration key

    * Use a RangeList in some case to not exceed the max number

    * Revert some code + implem correct merge

    * Fix + Add unit and integration tests

    * Usual macos fix for snapshot

    * Fix snapshots hashs

    * Update snapshots (remove other tests as they can't apply different env var values in same run)

    * Apply comment

    * Re-integrate integration tests with multiple processes (new fixture)

    * Add test case for setting MaxRangeCount to zero

commit 83f6ab1
Author: Tony Redondo <tony.redondo@datadoghq.com>
Date:   Tue Mar 12 21:20:39 2024 +0100

    [CI Visibility] - Enable snapshot testing of current testing framework implementations (#5226)

commit 233695a
Author: Daniel Romano <108014683+daniel-romano-DD@users.noreply.github.com>
Date:   Tue Mar 12 17:06:06 2024 +0100

    [IAST] Vulnerability and Evidence truncation (#5302)

    * Initial implementation

    * Updated test bundle

    * Fix test compilation error

    * Fix snapshot (from rebase)

    * Fix typo in config value. Updated tests

    * Fix typo

    * Refactor converters initialization

commit ea31cf5
Author: Anna <anna.yafi@datadoghq.com>
Date:   Tue Mar 12 16:39:09 2024 +0100

    Deactivate benchmark for legacy encoder (#5299)

commit d0d713a
Author: NachoEchevarria <53266532+NachoEchevarria@users.noreply.github.com>
Date:   Tue Mar 12 09:25:27 2024 +0100

    Set big regex timeouts for tests (#5297)

commit d5388d6
Author: Lucas Pimentel <lucas.pimentel@datadoghq.com>
Date:   Mon Mar 11 15:20:58 2024 -0400

    [Tracing] Support configuring `DD_TRACE_ENABLED` remotely (#5181)

    * add support for remote TraceEnabled setting

    * fix unrelated typo

    * add ApmTracingEnabled capability 19

    * add missing RCM capability 18

    * add mapping

    * add unit test

    * add comments to unit test

    * rename property to match RCM constant

    * include config in integration tests

    * fix test json

    * rewrite tests to use raw values instead of strings

commit 2b95f46
Author: Flavien Darche <11708575+e-n-0@users.noreply.github.com>
Date:   Mon Mar 11 17:47:55 2024 +0100

    [ASM][IAST] Support manual JSON deserialisation (Newtonsoft.Json) (#5238)

    * Add Newtonsoft.Json (non -working yet)

    * Refactor the tainting proces + add tests

    * Add the JToken Parse aspect + test

    * Rename Aspects class + Duck orignal method call

    * Add integration test

    * Fix nullability

    * Fix compilation issue for netfx

    * Change JSON formatting in ParseTests

    * Fix a test json format

    * Refactor NewtonsoftJsonAspects to static constructor

commit 0d511f9
Author: Igor Kravchenko <21974069+kr-igor@users.noreply.github.com>
Date:   Mon Mar 11 09:35:23 2024 -0500

    [DSM] - Fixes for IbmMq instrumentation (#5271)

    * Use byte properties instead of strings

    * Fixed nullability files

    * Added some debug info

    * Fixed lint issues

    * Added a bit more logs

    * Using slow byte->sbyte conversion

    * Added noop headers adapter

    * Fixed nullability files

    * Added more logs

    * Cleaned up debug logs

    * Removed symlink

    * Update tracer/src/Datadog.Trace/ClrProfiler/AutoInstrumentation/IbmMq/IbmMqHeadersAdapter.cs

    Removed debug code

    Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>

    * Update tracer/src/Datadog.Trace/ClrProfiler/AutoInstrumentation/IbmMq/IbmMqHeadersAdapter.cs

    Using Unsafe.As instead of BlockCopy

    Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>

    * Update tracer/src/Datadog.Trace/ClrProfiler/AutoInstrumentation/IbmMq/IbmMqHeadersAdapter.cs

    Use Unsafe.As instead of BlockCopy

    Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>

    * Addressed some of the comments

    * Removed context propagation options

    ---------

    Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>

commit 5684a72
Author: Zach Montoya <zach.montoya@datadoghq.com>
Date:   Fri Mar 8 20:56:30 2024 -0800

    [Tracing] Update instrumentation point for DD_TRACE_DELAY_WCF_INSTRUMENTATION_ENABLED=true (#5206)

    Updates the instrumentation point for `DD_TRACE_DELAY_WCF_INSTRUMENTATION_ENABLED=true` so that now a server span is created immediately before IDispatchMessageInspector implementations are run, so application code can access the root span from inside a IDispatchMessageInspector.AfterReceiveRequest callback.

    This PR also does some cleanup to remove unused Wcf files and it makes the entire Wcf instrumentation use nullable reference types.

commit ca1bb6e
Author: Andrew Lock <andrew.lock@datadoghq.com>
Date:   Fri Mar 8 17:43:57 2024 +0000

    Fix errors identified from telemetry (#5279)

    * Try to avoid MongoDb exception

    We're seeing exceptions like this:
    ```
    System.FieldAccessException
       at REDACTED
       at Datadog.Trace.ClrProfiler.AutoInstrumentation.MongoDb.MongoDbIntegration.CreateScope[TConnection](Object wireProtocol, TConnection connection)
       at REDACTED
       at MongoDB.Driver.Core.WireProtocol.CommandWireProtocol`1.ExecuteAsync(IConnection connection, CancellationToken cancellationToken)
    ```

    and the only explanation I can think of is a duck-chaining issue, so stopped doing duck chaining and being explicit instead

    * Add local functions to try to isolate problems

    * Fix ArgumentNullException in AWS SQS integration
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants