-
Notifications
You must be signed in to change notification settings - Fork 293
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ensure cached subscriptions are cleared on reconfiguration via RC #8229
Merged
manuel-alvarez-alvarez
merged 2 commits into
master
from
malvarez/waf-fix-cached-subscriptions
Jan 17, 2025
Merged
Ensure cached subscriptions are cleared on reconfiguration via RC #8229
manuel-alvarez-alvarez
merged 2 commits into
master
from
malvarez/waf-fix-cached-subscriptions
Jan 17, 2025
+66
−3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
manuel-alvarez-alvarez
added
type: bug
comp: asm waf
Application Security Management (WAF)
labels
Jan 16, 2025
manuel-alvarez-alvarez
requested review from
jandro996,
sezen-datadog,
smola and
ValentinZakharov
January 16, 2025 12:57
smola
reviewed
Jan 16, 2025
dd-java-agent/appsec/src/main/java/com/datadog/appsec/AppSecSystem.java
Outdated
Show resolved
Hide resolved
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 61 metrics, 2 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1057988
Total [baseline] (8.629 s) : 0, 8628984
Agent [candidate] (1.058 s) : 0, 1057524
Total [candidate] (8.619 s) : 0, 8619471
section iast
Agent [baseline] (1.183 s) : 0, 1182588
Total [baseline] (9.171 s) : 0, 9170562
Agent [candidate] (1.183 s) : 0, 1182767
Total [candidate] (9.207 s) : 0, 9207203
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.185 s) : 0, 1184828
Total [baseline] (9.197 s) : 0, 9196761
Agent [candidate] (1.183 s) : 0, 1182788
Total [candidate] (9.22 s) : 0, 9220345
section iast_TELEMETRY_OFF
Agent [baseline] (1.185 s) : 0, 1185132
Total [baseline] (9.218 s) : 0, 9218314
Agent [candidate] (1.178 s) : 0, 1177855
Total [candidate] (9.202 s) : 0, 9202010
gantt
title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.675 ms) : 0, 714675
BytebuddyAgent [candidate] (715.051 ms) : 0, 715051
GlobalTracer [baseline] (256.406 ms) : 0, 256406
GlobalTracer [candidate] (256.103 ms) : 0, 256103
AppSec [baseline] (56.864 ms) : 0, 56864
AppSec [candidate] (56.927 ms) : 0, 56927
Remote Config [baseline] (718.247 µs) : 0, 718
Remote Config [candidate] (729.227 µs) : 0, 729
Telemetry [baseline] (14.284 ms) : 0, 14284
Telemetry [candidate] (13.696 ms) : 0, 13696
section iast
BytebuddyAgent [baseline] (831.691 ms) : 0, 831691
BytebuddyAgent [candidate] (831.832 ms) : 0, 831832
GlobalTracer [baseline] (247.054 ms) : 0, 247054
GlobalTracer [candidate] (247.006 ms) : 0, 247006
AppSec [baseline] (57.98 ms) : 0, 57980
AppSec [candidate] (57.885 ms) : 0, 57885
Remote Config [baseline] (671.763 µs) : 0, 672
Remote Config [candidate] (677.888 µs) : 0, 678
Telemetry [baseline] (8.746 ms) : 0, 8746
Telemetry [candidate] (8.793 ms) : 0, 8793
IAST [baseline] (21.441 ms) : 0, 21441
IAST [candidate] (21.527 ms) : 0, 21527
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (833.761 ms) : 0, 833761
BytebuddyAgent [candidate] (831.235 ms) : 0, 831235
GlobalTracer [baseline] (246.75 ms) : 0, 246750
GlobalTracer [candidate] (246.801 ms) : 0, 246801
AppSec [baseline] (58.299 ms) : 0, 58299
AppSec [candidate] (58.36 ms) : 0, 58360
Remote Config [baseline] (683.609 µs) : 0, 684
Remote Config [candidate] (682.078 µs) : 0, 682
Telemetry [baseline] (8.713 ms) : 0, 8713
Telemetry [candidate] (8.904 ms) : 0, 8904
IAST [baseline] (21.522 ms) : 0, 21522
IAST [candidate] (21.688 ms) : 0, 21688
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (835.498 ms) : 0, 835498
BytebuddyAgent [candidate] (828.279 ms) : 0, 828279
GlobalTracer [baseline] (246.86 ms) : 0, 246860
GlobalTracer [candidate] (246.553 ms) : 0, 246553
AppSec [baseline] (57.562 ms) : 0, 57562
AppSec [candidate] (57.757 ms) : 0, 57757
Remote Config [baseline] (661.506 µs) : 0, 662
Remote Config [candidate] (657.431 µs) : 0, 657
Telemetry [baseline] (8.689 ms) : 0, 8689
Telemetry [candidate] (8.55 ms) : 0, 8550
IAST [baseline] (20.802 ms) : 0, 20802
IAST [candidate] (20.983 ms) : 0, 20983
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.056 s) : 0, 1056263
Total [baseline] (10.486 s) : 0, 10486117
Agent [candidate] (1.064 s) : 0, 1064163
Total [candidate] (10.59 s) : 0, 10590449
section appsec
Agent [baseline] (1.194 s) : 0, 1193597
Total [baseline] (10.745 s) : 0, 10745213
Agent [candidate] (1.194 s) : 0, 1193924
Total [candidate] (10.747 s) : 0, 10747416
section iast
Agent [baseline] (1.191 s) : 0, 1191257
Total [baseline] (11.037 s) : 0, 11036935
Agent [candidate] (1.187 s) : 0, 1186567
Total [candidate] (11.072 s) : 0, 11071826
section profiling
Agent [baseline] (1.255 s) : 0, 1254948
Total [baseline] (10.884 s) : 0, 10883890
Agent [candidate] (1.255 s) : 0, 1255291
Total [candidate] (10.896 s) : 0, 10895919
gantt
title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.116 ms) : 0, 714116
BytebuddyAgent [candidate] (721.638 ms) : 0, 721638
GlobalTracer [baseline] (255.937 ms) : 0, 255937
GlobalTracer [candidate] (258.411 ms) : 0, 258411
AppSec [baseline] (56.067 ms) : 0, 56067
AppSec [candidate] (55.942 ms) : 0, 55942
Remote Config [baseline] (724.1 µs) : 0, 724
Remote Config [candidate] (749.549 µs) : 0, 750
Telemetry [baseline] (14.359 ms) : 0, 14359
Telemetry [candidate] (12.21 ms) : 0, 12210
section appsec
BytebuddyAgent [baseline] (734.219 ms) : 0, 734219
BytebuddyAgent [candidate] (734.299 ms) : 0, 734299
GlobalTracer [baseline] (253.806 ms) : 0, 253806
GlobalTracer [candidate] (254.171 ms) : 0, 254171
AppSec [baseline] (171.729 ms) : 0, 171729
AppSec [candidate] (171.629 ms) : 0, 171629
Remote Config [baseline] (667.383 µs) : 0, 667
Remote Config [candidate] (675.182 µs) : 0, 675
Telemetry [baseline] (8.245 ms) : 0, 8245
Telemetry [candidate] (8.23 ms) : 0, 8230
IAST [baseline] (19.608 ms) : 0, 19608
IAST [candidate] (19.584 ms) : 0, 19584
section iast
BytebuddyAgent [baseline] (838.568 ms) : 0, 838568
BytebuddyAgent [candidate] (834.926 ms) : 0, 834926
GlobalTracer [baseline] (248.001 ms) : 0, 248001
GlobalTracer [candidate] (247.568 ms) : 0, 247568
AppSec [baseline] (58.343 ms) : 0, 58343
AppSec [candidate] (58.027 ms) : 0, 58027
Remote Config [baseline] (675.652 µs) : 0, 676
Remote Config [candidate] (671.232 µs) : 0, 671
Telemetry [baseline] (8.902 ms) : 0, 8902
Telemetry [candidate] (8.745 ms) : 0, 8745
IAST [baseline] (21.687 ms) : 0, 21687
IAST [candidate] (21.547 ms) : 0, 21547
section profiling
BytebuddyAgent [baseline] (703.493 ms) : 0, 703493
BytebuddyAgent [candidate] (703.79 ms) : 0, 703790
GlobalTracer [baseline] (348.601 ms) : 0, 348601
GlobalTracer [candidate] (350.69 ms) : 0, 350690
AppSec [baseline] (55.845 ms) : 0, 55845
AppSec [candidate] (53.83 ms) : 0, 53830
Remote Config [baseline] (669.979 µs) : 0, 670
Remote Config [candidate] (698.842 µs) : 0, 699
Telemetry [baseline] (8.797 ms) : 0, 8797
Telemetry [candidate] (8.712 ms) : 0, 8712
ProfilingAgent [baseline] (95.605 ms) : 0, 95605
ProfilingAgent [candidate] (95.424 ms) : 0, 95424
Profiling [baseline] (95.629 ms) : 0, 95629
Profiling [candidate] (95.449 ms) : 0, 95449
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 13 metrics, 15 unstable metrics. Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section baseline
no_agent (383.195 µs) : 363, 403
. : milestone, 383,
iast (517.254 µs) : 495, 539
. : milestone, 517,
iast_FULL (747.753 µs) : 726, 770
. : milestone, 748,
iast_GLOBAL (558.357 µs) : 537, 580
. : milestone, 558,
iast_HARDCODED_SECRET_DISABLED (514.338 µs) : 493, 536
. : milestone, 514,
iast_INACTIVE (467.733 µs) : 446, 489
. : milestone, 468,
iast_TELEMETRY_OFF (501.377 µs) : 479, 523
. : milestone, 501,
tracing (459.276 µs) : 438, 480
. : milestone, 459,
section candidate
no_agent (386.653 µs) : 367, 406
. : milestone, 387,
iast (513.064 µs) : 491, 535
. : milestone, 513,
iast_FULL (749.791 µs) : 728, 772
. : milestone, 750,
iast_GLOBAL (563.517 µs) : 542, 585
. : milestone, 564,
iast_HARDCODED_SECRET_DISABLED (518.184 µs) : 496, 540
. : milestone, 518,
iast_INACTIVE (463.515 µs) : 442, 485
. : milestone, 464,
iast_TELEMETRY_OFF (506.593 µs) : 484, 529
. : milestone, 507,
tracing (453.271 µs) : 433, 474
. : milestone, 453,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section baseline
no_agent (1.358 ms) : 1338, 1378
. : milestone, 1358,
appsec (1.748 ms) : 1723, 1774
. : milestone, 1748,
appsec_no_iast (1.764 ms) : 1739, 1789
. : milestone, 1764,
iast (1.515 ms) : 1491, 1540
. : milestone, 1515,
profiling (1.582 ms) : 1557, 1607
. : milestone, 1582,
tracing (1.488 ms) : 1463, 1514
. : milestone, 1488,
section candidate
no_agent (1.363 ms) : 1343, 1382
. : milestone, 1363,
appsec (1.766 ms) : 1742, 1790
. : milestone, 1766,
appsec_no_iast (1.769 ms) : 1744, 1793
. : milestone, 1769,
iast (1.509 ms) : 1484, 1534
. : milestone, 1509,
profiling (1.556 ms) : 1532, 1581
. : milestone, 1556,
tracing (1.495 ms) : 1469, 1520
. : milestone, 1495,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section baseline
no_agent (15.561 s) : 15561000, 15561000
. : milestone, 15561000,
appsec (14.807 s) : 14807000, 14807000
. : milestone, 14807000,
iast (18.88 s) : 18880000, 18880000
. : milestone, 18880000,
iast_GLOBAL (18.01 s) : 18010000, 18010000
. : milestone, 18010000,
profiling (15.08 s) : 15080000, 15080000
. : milestone, 15080000,
tracing (14.77 s) : 14770000, 14770000
. : milestone, 14770000,
section candidate
no_agent (14.939 s) : 14939000, 14939000
. : milestone, 14939000,
appsec (14.971 s) : 14971000, 14971000
. : milestone, 14971000,
iast (18.256 s) : 18256000, 18256000
. : milestone, 18256000,
iast_GLOBAL (17.846 s) : 17846000, 17846000
. : milestone, 17846000,
profiling (15.163 s) : 15163000, 15163000
. : milestone, 15163000,
tracing (15.227 s) : 15227000, 15227000
. : milestone, 15227000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~47af939ee7, baseline=1.46.0-SNAPSHOT~ae1aa30548
dateFormat X
axisFormat %s
section baseline
no_agent (1.469 ms) : 1457, 1480
. : milestone, 1469,
appsec (2.364 ms) : 2321, 2407
. : milestone, 2364,
iast (2.111 ms) : 2056, 2165
. : milestone, 2111,
iast_GLOBAL (2.152 ms) : 2097, 2206
. : milestone, 2152,
profiling (2.465 ms) : 2278, 2652
. : milestone, 2465,
tracing (1.949 ms) : 1907, 1990
. : milestone, 1949,
section candidate
no_agent (1.469 ms) : 1458, 1481
. : milestone, 1469,
appsec (2.364 ms) : 2321, 2407
. : milestone, 2364,
iast (2.111 ms) : 2057, 2166
. : milestone, 2111,
iast_GLOBAL (2.146 ms) : 2092, 2201
. : milestone, 2146,
profiling (1.978 ms) : 1935, 2022
. : milestone, 1978,
tracing (1.942 ms) : 1900, 1984
. : milestone, 1942,
|
Mariovido
approved these changes
Jan 16, 2025
smola
approved these changes
Jan 17, 2025
manuel-alvarez-alvarez
deleted the
malvarez/waf-fix-cached-subscriptions
branch
January 17, 2025 12:36
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Clears all cached subscriptions when a new configuration is pulled from RC.
Motivation
In certain scenarios (specially in system-tests) configs might contain rules only for a subset of addresses, meanwhile a future config might change them completely. Every time we pull a new configuration from RC we must clear all cached subscriptions to ensure consistency.
Additional Notes
Contributor Checklist
type:
and (comp:
orinst:
) labels in addition to any usefull labelsclose
,fix
or any linking keywords when referencing an issue.Use
solves
instead, and assign the PR milestone to the issueJira ticket: APPSEC-56377