-
Notifications
You must be signed in to change notification settings - Fork 304
Alternative API Security sampling algorithm #8961
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
smola
wants to merge
4
commits into
master
Choose a base branch
from
smola/api-sec-perf
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
72 changes: 72 additions & 0 deletions
72
dd-java-agent/appsec/src/main/java/com/datadog/appsec/api/security/ApiSecurityProcessor.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| package com.datadog.appsec.api.security; | ||
|
|
||
| import com.datadog.appsec.config.TraceSegmentPostProcessor; | ||
| import com.datadog.appsec.event.EventProducerService; | ||
| import com.datadog.appsec.event.ExpiredSubscriberInfoException; | ||
| import com.datadog.appsec.event.data.DataBundle; | ||
| import com.datadog.appsec.event.data.KnownAddresses; | ||
| import com.datadog.appsec.event.data.SingletonDataBundle; | ||
| import com.datadog.appsec.gateway.AppSecRequestContext; | ||
| import com.datadog.appsec.gateway.GatewayContext; | ||
| import com.datadog.appsec.report.AppSecEvent; | ||
| import datadog.trace.api.Config; | ||
| import datadog.trace.api.ProductTraceSource; | ||
| import datadog.trace.api.internal.TraceSegment; | ||
| import datadog.trace.bootstrap.instrumentation.api.Tags; | ||
| import java.util.Collection; | ||
| import java.util.Collections; | ||
| import javax.annotation.Nonnull; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| public class ApiSecurityProcessor implements TraceSegmentPostProcessor { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(ApiSecurityProcessor.class); | ||
| private final ApiSecuritySampler sampler; | ||
| private final EventProducerService producerService; | ||
|
|
||
| public ApiSecurityProcessor(ApiSecuritySampler sampler, EventProducerService producerService) { | ||
| this.sampler = sampler; | ||
| this.producerService = producerService; | ||
| } | ||
|
|
||
| @Override | ||
| public void processTraceSegment( | ||
| TraceSegment segment, AppSecRequestContext ctx, Collection<AppSecEvent> collectedEvents) { | ||
| if (segment == null || ctx == null) { | ||
| return; | ||
| } | ||
| if (!sampler.sample(ctx)) { | ||
| log.debug("Request not sampled, skipping API security post-processing"); | ||
| return; | ||
| } | ||
| log.debug("Request sampled, processing API security post-processing"); | ||
| extractSchemas(ctx, segment); | ||
| } | ||
|
|
||
| private void extractSchemas( | ||
| final @Nonnull AppSecRequestContext ctx, final @Nonnull TraceSegment traceSegment) { | ||
| final EventProducerService.DataSubscriberInfo sub = | ||
| producerService.getDataSubscribers(KnownAddresses.WAF_CONTEXT_PROCESSOR); | ||
| if (sub == null || sub.isEmpty()) { | ||
| log.debug("No subscribers for schema extraction"); | ||
| return; | ||
| } | ||
|
|
||
| final DataBundle bundle = | ||
| new SingletonDataBundle<>( | ||
| KnownAddresses.WAF_CONTEXT_PROCESSOR, Collections.singletonMap("extract-schema", true)); | ||
| try { | ||
| GatewayContext gwCtx = new GatewayContext(false); | ||
| producerService.publishDataEvent(sub, ctx, bundle, gwCtx); | ||
| // TODO: Perhaps do this if schemas have actually been extracted (check when committing | ||
| // derivatives) | ||
| traceSegment.setTagTop(Tags.ASM_KEEP, true); | ||
| if (!Config.get().isApmTracingEnabled()) { | ||
| traceSegment.setTagTop(Tags.PROPAGATED_TRACE_SOURCE, ProductTraceSource.ASM); | ||
| } | ||
| } catch (ExpiredSubscriberInfoException e) { | ||
| log.debug("Subscriber info expired", e); | ||
| } | ||
| } | ||
| } |
223 changes: 203 additions & 20 deletions
223
dd-java-agent/appsec/src/main/java/com/datadog/appsec/api/security/ApiSecuritySampler.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,218 @@ | ||
| package com.datadog.appsec.api.security; | ||
|
|
||
| import com.datadog.appsec.gateway.AppSecRequestContext; | ||
| import javax.annotation.Nonnull; | ||
| import datadog.trace.util.AgentTaskScheduler; | ||
| import java.util.Random; | ||
| import java.util.concurrent.Executor; | ||
| import java.util.concurrent.atomic.AtomicBoolean; | ||
| import java.util.concurrent.atomic.AtomicInteger; | ||
| import java.util.concurrent.atomic.AtomicLong; | ||
| import java.util.concurrent.atomic.AtomicReference; | ||
|
|
||
| public interface ApiSecuritySampler { | ||
| /** | ||
| * Prepare a request context for later sampling decision. This method should be called at request | ||
| * end, and is thread-safe. If a request can potentially be sampled, this method will return true. | ||
| * If this method returns true, the caller MUST call {@link #releaseOne()} once the context is not | ||
| * needed anymore. | ||
| */ | ||
| boolean preSampleRequest(final @Nonnull AppSecRequestContext ctx); | ||
| /** | ||
| * Internal map for API Security sampling. See "[RFC-1021] API Security Sampling Algorithm for | ||
| * thread-based concurrency". | ||
| */ | ||
| public class ApiSecuritySampler { | ||
|
|
||
| /** Get the final sampling decision. This method is NOT required to be thread-safe. */ | ||
| boolean sampleRequest(AppSecRequestContext ctx); | ||
| private static final int DEFAULT_MAX_ITEM_COUNT = 4096; | ||
| private static final int DEFAULT_INTERVAL_SECONDS = 30; | ||
|
|
||
| /** Release one permit for the sampler. This must be called after processing a span. */ | ||
| void releaseOne(); | ||
| private final MonotonicClock clock; | ||
| private final Executor executor; | ||
| private final int intervalSeconds; | ||
| private final AtomicReference<Table> table; | ||
| private final AtomicBoolean rebuild = new AtomicBoolean(false); | ||
| private final long zero; | ||
| private final long maxItemCount; | ||
|
|
||
| final class NoOp implements ApiSecuritySampler { | ||
| @Override | ||
| public boolean preSampleRequest(@Nonnull AppSecRequestContext ctx) { | ||
| public ApiSecuritySampler() { | ||
| this( | ||
| DEFAULT_MAX_ITEM_COUNT, | ||
| DEFAULT_INTERVAL_SECONDS, | ||
| new Random().nextLong(), | ||
| new DefaultMonotonicClock(), | ||
| AgentTaskScheduler.INSTANCE); | ||
| } | ||
|
|
||
| public ApiSecuritySampler( | ||
| final int maxItemCount, | ||
| final int intervalSeconds, | ||
| final long zero, | ||
| final MonotonicClock clock, | ||
| Executor executor) { | ||
| table = new AtomicReference<>(new Table(maxItemCount)); | ||
| this.maxItemCount = maxItemCount; | ||
| this.intervalSeconds = intervalSeconds; | ||
| this.zero = zero; | ||
| this.clock = clock != null ? clock : new DefaultMonotonicClock(); | ||
| this.executor = executor != null ? executor : AgentTaskScheduler.INSTANCE; | ||
| } | ||
|
|
||
| public boolean sample(AppSecRequestContext ctx) { | ||
| final String route = ctx.getRoute(); | ||
| if (route == null) { | ||
| return false; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean sampleRequest(AppSecRequestContext ctx) { | ||
| final String method = ctx.getMethod(); | ||
| if (method == null) { | ||
| return false; | ||
| } | ||
| final int statusCode = ctx.getResponseStatus(); | ||
| if (statusCode <= 0) { | ||
| return false; | ||
| } | ||
| final long hash = computeApiHash(route, method, statusCode); | ||
| return sample(hash); | ||
| } | ||
|
|
||
| public boolean sample(long key) { | ||
| if (key == 0L) { | ||
| key = zero; | ||
| } | ||
| final int now = clock.now(); | ||
| final Table table = this.table.get(); | ||
| Table.FindSlotResult findSlotResult; | ||
| while (true) { | ||
| findSlotResult = table.findSlot(key); | ||
| if (!findSlotResult.exists) { | ||
| final int newCount = table.count.incrementAndGet(); | ||
| if (newCount > maxItemCount && rebuild.compareAndSet(false, true)) { | ||
| runRebuild(); | ||
| } | ||
| if (newCount > maxItemCount * 2) { | ||
| table.count.decrementAndGet(); | ||
| return false; | ||
| } | ||
| if (!findSlotResult.entry.key.compareAndSet(0, key)) { | ||
| if (findSlotResult.entry.key.get() == key) { | ||
| // Another thread just added this entry | ||
| return false; | ||
| } | ||
| // This entry was just claimed for another key, try another slot. | ||
| table.count.decrementAndGet(); | ||
| continue; | ||
| } | ||
| final long newEntryData = buildDataEntry(now, now); | ||
| if (findSlotResult.entry.data.compareAndSet(0, newEntryData)) { | ||
| return true; | ||
| } else { | ||
| return false; | ||
| } | ||
| } | ||
| break; | ||
| } | ||
| long curData = findSlotResult.entry.data.get(); | ||
| final int stime = getStime(curData); | ||
| final int deadline = now - intervalSeconds; | ||
| if (stime <= deadline) { | ||
| final long newData = buildDataEntry(now, now); | ||
| while (!findSlotResult.entry.data.compareAndSet(curData, newData)) { | ||
| curData = findSlotResult.entry.data.get(); | ||
| if (getStime(curData) == getAtime(curData)) { | ||
| // Another thread just issued a keep decision | ||
| return false; | ||
| } | ||
| if (getStime(curData) > now) { | ||
| // Another thread is in our fugure, but did not issue a keep decision. | ||
| return true; | ||
| } | ||
| } | ||
| return true; | ||
| } | ||
| final long newData = buildDataEntry(getStime(curData), now); | ||
| while (getAtime(curData) < now) { | ||
| if (!findSlotResult.entry.data.compareAndSet(curData, newData)) { | ||
| curData = findSlotResult.entry.data.get(); | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| private void runRebuild() { | ||
| // TODO | ||
| } | ||
|
|
||
| private static class Table { | ||
| private final Entry[] table; | ||
| private final AtomicInteger count = new AtomicInteger(0); | ||
| private final int maxItemCount; | ||
|
|
||
| public Table(int maxItemCount) { | ||
| this.maxItemCount = maxItemCount; | ||
| final int size = 2 * maxItemCount + 1; | ||
| table = new Entry[size]; | ||
| for (int i = 0; i < size; i++) { | ||
| table[i] = new Entry(); | ||
| } | ||
| } | ||
|
|
||
| public FindSlotResult findSlot(final long key) { | ||
| final int startIndex = (int) (key % (2L * maxItemCount)); | ||
| int index = startIndex; | ||
| do { | ||
| final Entry slot = table[index]; | ||
| final long slotKey = slot.key.get(); | ||
| if (slotKey == key) { | ||
| return new FindSlotResult(slot, true); | ||
| } else if (slotKey == 0L) { | ||
| return new FindSlotResult(slot, false); | ||
| } | ||
| index++; | ||
| if (index >= table.length) { | ||
| index = 0; | ||
| } | ||
| } while (index != startIndex); | ||
| return new FindSlotResult(table[(int) (maxItemCount * 2)], false); | ||
| } | ||
|
|
||
| static class FindSlotResult { | ||
| public final Entry entry; | ||
| public final boolean exists; | ||
|
|
||
| public FindSlotResult(final Entry entry, final boolean exists) { | ||
| this.entry = entry; | ||
| this.exists = exists; | ||
| } | ||
| } | ||
|
|
||
| static class Entry { | ||
| private final AtomicLong key = new AtomicLong(0L); | ||
| private final AtomicLong data = new AtomicLong(0L); | ||
| } | ||
| } | ||
|
|
||
| interface MonotonicClock { | ||
| int now(); | ||
| } | ||
|
|
||
| static class DefaultMonotonicClock implements MonotonicClock { | ||
| @Override | ||
| public void releaseOne() {} | ||
| public int now() { | ||
| return (int) (System.nanoTime() / 1_000_000); | ||
| } | ||
| } | ||
|
|
||
| long buildDataEntry(final int stime, final int atime) { | ||
| long result = stime; | ||
| result <<= 32; | ||
| result |= atime & 0xFFFFFFFFL; | ||
| return result; | ||
| } | ||
|
|
||
| int getStime(final long data) { | ||
| return (int) (data >> 32); | ||
| } | ||
|
|
||
| int getAtime(final long data) { | ||
| return (int) (data & 0xFFFFFFFFL); | ||
| } | ||
|
|
||
| private long computeApiHash(final String route, final String method, final int statusCode) { | ||
| long result = 17; | ||
| result = 31 * result + route.hashCode(); | ||
| result = 31 * result + method.hashCode(); | ||
| result = 31 * result + statusCode; | ||
| return result; | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⚪ Code Vulnerability
Use of insecure random values (...read more)
Functions as
Math.random()and objects likejava.util.Random()do not provide strong enough randomness. Consider usingjava.security.SecureRandom()instead.