Skip to content

Commit 5204747

Browse files
cataphractcataphract
committed
More accurately report whether the request was blocked
1 parent 8378163 commit 5204747

63 files changed

Lines changed: 267 additions & 52 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/blocking/BlockingServiceImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ public boolean tryCommitBlockingResponse(
8888
if (res) {
8989
TraceSegment traceSegment = reqCtx.getTraceSegment();
9090
if (traceSegment != null) {
91-
traceSegment.setTagTop("appsec.blocked", "true");
91+
traceSegment.effectivelyBlocked();
9292
}
9393
}
9494
return res;

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,6 @@ public void init() {
118118
if (traceSeg != null) {
119119
traceSeg.setTagTop("_dd.appsec.enabled", 1);
120120
traceSeg.setTagTop("_dd.runtime_family", "jvm");
121-
if (spanInfo.getRequestBlockingAction() != null) {
122-
traceSeg.setTagTop("appsec.blocked", "true");
123-
}
124121

125122
Collection<AppSecEvent100> collectedEvents = ctx.transferCollectedEvents();
126123

@@ -226,7 +223,8 @@ public void init() {
226223
DataBundle bundle =
227224
new SingletonDataBundle<>(KnownAddresses.REQUEST_PATH_PARAMS, data);
228225
try {
229-
return producerService.publishDataEvent(subInfo, ctx, bundle, false);
226+
Flow<Void> flow = producerService.publishDataEvent(subInfo, ctx, bundle, false);
227+
return flow;
230228
} catch (ExpiredSubscriberInfoException e) {
231229
pathParamsSubInfo = null;
232230
}

‎dd-java-agent/appsec/src/main/resources/default_config.json‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7074,6 +7074,32 @@
70747074
}
70757075
],
70767076
"transformers": []
7077+
},
7078+
{
7079+
"id": "__troubleshooting_rule",
7080+
"name": "troubleshooting rule for block on request body",
7081+
"tags": {
7082+
"type": "troubleshooting",
7083+
"category": "troubleshooting",
7084+
"confidence": "1"
7085+
},
7086+
"conditions": [
7087+
{
7088+
"parameters": {
7089+
"inputs": [
7090+
{
7091+
"address": "server.request.body"
7092+
}
7093+
],
7094+
"regex": "ADKMFFpndcwHNnr2MW9W"
7095+
},
7096+
"operator": "match_regex"
7097+
}
7098+
],
7099+
"transformers": [],
7100+
"on_match": [
7101+
"block"
7102+
]
70777103
}
70787104
]
7079-
}
7105+
}

‎dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/blocking/BlockingServiceImplSpecification.groovy‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ class BlockingServiceImplSpecification extends DDSpecification {
109109
then:
110110
res == true
111111
1 * brf.tryCommitBlockingResponse(405, BlockingContentType.HTML, [:]) >> true
112-
1 * mts.setTagTop('appsec.blocked', 'true')
112+
1 * mts.effectivelyBlocked()
113113
}
114114

115115
void 'tryCommitBlockingResponse without active span'() {

‎dd-java-agent/instrumentation/grizzly-2/src/main/java/datadog/trace/instrumentation/grizzly/GrizzlyHttpHandlerInstrumentation.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ public static class HandleAdvice {
8888
if (rba != null) {
8989
boolean success = GrizzlyBlockingHelper.block(request, response, rba, scope);
9090
if (success) {
91+
span.getRequestContext().getTraceSegment().effectivelyBlocked();
9192
return true; /* skip body */
9293
}
9394
}

‎dd-java-agent/instrumentation/grizzly-http-2.3.20/src/main/java/datadog/trace/instrumentation/grizzlyhttp232/GrizzlyDecorator.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ public static NextAction onHttpCodecFilterExit(
123123

124124
Flow.Action.RequestBlockingAction rba = span.getRequestBlockingAction();
125125
if (rba != null && thiz instanceof HttpServerFilter) {
126+
span.getRequestContext().getTraceSegment().effectivelyBlocked();
126127
nextAction =
127128
GrizzlyHttpBlockingHelper.block(
128129
ctx, (HttpServerFilter) thiz, httpRequest, httpResponse, rba, nextAction);

‎dd-java-agent/instrumentation/grizzly-http-2.3.20/src/main/java/datadog/trace/instrumentation/grizzlyhttp232/ParsedBodyParametersInstrumentation.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ static void after(
115115
if (t == null) {
116116
t = new BlockingException("Blocked request (for Parameters/processParameters)");
117117
}
118+
reqCtx.getTraceSegment().effectivelyBlocked();
118119
}
119120
}
120121
} finally {

‎dd-java-agent/instrumentation/jersey-2-appsec/src/main/java/datadog/trace/instrumentation/jersey2/MessageBodyReaderInstrumentation.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ static void after(
8888
blockResponseFunction.tryCommitBlockingResponse(
8989
rba.getStatusCode(), rba.getBlockingContentType(), rba.getExtraHeaders());
9090
t = new BlockingException("Blocked request (for ReaderInterceptorExecutor/proceed)");
91+
reqCtx.getTraceSegment().effectivelyBlocked();
9192
}
9293
}
9394
}

‎dd-java-agent/instrumentation/jersey-2-appsec/src/main/java/datadog/trace/instrumentation/jersey2/MultiPartReaderServerSideInstrumentation.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ static void after(
107107
blockResponseFunction.tryCommitBlockingResponse(
108108
rba.getStatusCode(), rba.getBlockingContentType(), rba.getExtraHeaders());
109109
t = new BlockingException("Blocked request (for MultiPartReaderClientSide/readFrom)");
110+
reqCtx.getTraceSegment().effectivelyBlocked();
110111
}
111112
}
112113
}

‎dd-java-agent/instrumentation/jersey-2-appsec/src/main/java/datadog/trace/instrumentation/jersey2/UriRoutingContextInstrumentation.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ static void after(
7474
t =
7575
new BlockingException(
7676
"Blocked request (for UriRoutingContextInstrumentation/getPathParameters)");
77+
reqCtx.getTraceSegment().effectivelyBlocked();
7778
}
7879
}
7980
}

0 commit comments

Comments
 (0)