Skip to content

Commit ed1d22c

Browse files
MariovidoMariovido
committed
Add tag block_failure
1 parent 2ad2645 commit ed1d22c

File tree

4 files changed

+35
-0
lines changed

4 files changed

+35
-0
lines changed

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java

+3
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,7 @@ public void onDataAvailable(
490490
}
491491
} else {
492492
log.info("Ignoring action with type {}", actionInfo.type);
493+
WafMetricCollector.get().wafRequestBlockFailure();
493494
}
494495
}
495496
Collection<AppSecEvent> events = buildEvents(resultWithData);
@@ -549,6 +550,7 @@ private Flow.Action.RequestBlockingAction createBlockRequestAction(ActionInfo ac
549550
return new Flow.Action.RequestBlockingAction(statusCode, blockingContentType);
550551
} catch (RuntimeException cce) {
551552
log.warn("Invalid blocking action data", cce);
553+
WafMetricCollector.get().wafRequestBlockFailure();
552554
return null;
553555
}
554556
}
@@ -574,6 +576,7 @@ private Flow.Action.RequestBlockingAction createRedirectRequestAction(ActionInfo
574576
return Flow.Action.RequestBlockingAction.forRedirect(statusCode, location);
575577
} catch (RuntimeException cce) {
576578
log.warn("Invalid blocking action data", cce);
579+
WafMetricCollector.get().wafRequestBlockFailure();
577580
return null;
578581
}
579582
}

‎internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java

+14
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ private WafMetricCollector() {
3737
private static final AtomicRequestCounter wafErrorRequestCounter = new AtomicRequestCounter();
3838
private static final AtomicRequestCounter wafRateLimitedRequestCounter =
3939
new AtomicRequestCounter();
40+
private static final AtomicRequestCounter wafBlockFailureRequestCounter =
41+
new AtomicRequestCounter();
4042
private static final AtomicLongArray raspRuleEvalCounter =
4143
new AtomicLongArray(RuleType.getNumValues());
4244
private static final AtomicLongArray raspRuleMatchCounter =
@@ -103,6 +105,10 @@ public void wafRequestRateLimited() {
103105
wafRateLimitedRequestCounter.increment();
104106
}
105107

108+
public void wafRequestBlockFailure() {
109+
wafBlockFailureRequestCounter.increment();
110+
}
111+
106112
public void raspRuleEval(final RuleType ruleType) {
107113
raspRuleEvalCounter.incrementAndGet(ruleType.ordinal());
108114
}
@@ -139,6 +145,7 @@ public Collection<WafMetric> drain() {
139145
@Override
140146
public void prepareMetrics() {
141147
final boolean isRateLimited = wafRateLimitedRequestCounter.getAndReset() > 0;
148+
final boolean isBlockFailure = wafBlockFailureRequestCounter.getAndReset() > 0;
142149

143150
// Requests
144151
if (wafRequestCounter.get() > 0) {
@@ -151,6 +158,7 @@ public void prepareMetrics() {
151158
false,
152159
false,
153160
false,
161+
isBlockFailure,
154162
isRateLimited))) {
155163
return;
156164
}
@@ -167,6 +175,7 @@ public void prepareMetrics() {
167175
false,
168176
false,
169177
false,
178+
isBlockFailure,
170179
isRateLimited))) {
171180
return;
172181
}
@@ -183,6 +192,7 @@ public void prepareMetrics() {
183192
true,
184193
false,
185194
false,
195+
isBlockFailure,
186196
isRateLimited))) {
187197
return;
188198
}
@@ -199,6 +209,7 @@ public void prepareMetrics() {
199209
false,
200210
false,
201211
true,
212+
isBlockFailure,
202213
isRateLimited))) {
203214
return;
204215
}
@@ -215,6 +226,7 @@ public void prepareMetrics() {
215226
false,
216227
true,
217228
false,
229+
isBlockFailure,
218230
isRateLimited))) {
219231
return;
220232
}
@@ -346,6 +358,7 @@ public WafRequestsRawMetric(
346358
final boolean blocked,
347359
final boolean wafError,
348360
final boolean wafTimeout,
361+
final boolean blockFailure,
349362
final boolean rateLimited) {
350363
super(
351364
"waf.requests",
@@ -356,6 +369,7 @@ public WafRequestsRawMetric(
356369
"request_blocked:" + blocked,
357370
"waf_error:" + wafError,
358371
"waf_timeout:" + wafTimeout,
372+
"block_failure:" + blockFailure,
359373
"rate_limited:" + rateLimited);
360374
}
361375
}

‎internal-api/src/test/groovy/datadog/trace/api/telemetry/WafMetricCollectorTest.groovy

+6
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ class WafMetricCollectorTest extends DDSpecification {
2929
WafMetricCollector.get().wafRequestTimeout()
3030
WafMetricCollector.get().wafRequestError()
3131
WafMetricCollector.get().wafRequestRateLimited()
32+
WafMetricCollector.get().wafRequestBlockFailure()
3233
WafMetricCollector.get().raspRuleEval(RuleType.SQL_INJECTION)
3334
WafMetricCollector.get().raspRuleEval(RuleType.SQL_INJECTION)
3435
WafMetricCollector.get().raspRuleMatch(RuleType.SQL_INJECTION)
@@ -73,6 +74,7 @@ class WafMetricCollectorTest extends DDSpecification {
7374
'request_blocked:false',
7475
'waf_error:false',
7576
'waf_timeout:false',
77+
'block_failure:true',
7678
'rate_limited:true'
7779
].toSet()
7880

@@ -87,6 +89,7 @@ class WafMetricCollectorTest extends DDSpecification {
8789
'request_blocked:false',
8890
'waf_error:false',
8991
'waf_timeout:false',
92+
'block_failure:true',
9093
'rate_limited:true'
9194
].toSet()
9295

@@ -103,6 +106,7 @@ class WafMetricCollectorTest extends DDSpecification {
103106
'request_blocked:true',
104107
'waf_error:false',
105108
'waf_timeout:false',
109+
'block_failure:true',
106110
'rate_limited:true'
107111
].toSet()
108112

@@ -118,6 +122,7 @@ class WafMetricCollectorTest extends DDSpecification {
118122
'request_blocked:false',
119123
'waf_error:false',
120124
'waf_timeout:true',
125+
'block_failure:true',
121126
'rate_limited:true'
122127
].toSet()
123128

@@ -133,6 +138,7 @@ class WafMetricCollectorTest extends DDSpecification {
133138
'request_blocked:false',
134139
'waf_error:true',
135140
'waf_timeout:false',
141+
'block_failure:true',
136142
'rate_limited:true'
137143
].toSet()
138144

‎telemetry/src/test/groovy/datadog/telemetry/metric/WafMetricPeriodicActionSpecification.groovy

+12
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
5151
WafMetricCollector.get().wafRequestTimeout()
5252
WafMetricCollector.get().wafRequestError()
5353
WafMetricCollector.get().wafRequestRateLimited()
54+
WafMetricCollector.get().wafRequestBlockFailure()
5455
WafMetricCollector.get().prepareMetrics()
5556
periodicAction.doIteration(telemetryService)
5657

@@ -70,6 +71,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
7071
'request_blocked:false',
7172
'waf_error:false',
7273
'waf_timeout:false',
74+
'block_failure:true',
7375
'rate_limited:true'
7476
]
7577
} )
@@ -84,6 +86,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
8486
'request_blocked:false',
8587
'waf_error:false',
8688
'waf_timeout:false',
89+
'block_failure:true',
8790
'rate_limited:true'
8891
]
8992
} )
@@ -98,6 +101,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
98101
'request_blocked:true',
99102
'waf_error:false',
100103
'waf_timeout:false',
104+
'block_failure:true',
101105
'rate_limited:true'
102106
]
103107
} )
@@ -112,6 +116,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
112116
'request_blocked:false',
113117
'waf_error:false',
114118
'waf_timeout:true',
119+
'block_failure:true',
115120
'rate_limited:true'
116121
]
117122
} )
@@ -126,6 +131,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
126131
'request_blocked:false',
127132
'waf_error:true',
128133
'waf_timeout:false',
134+
'block_failure:true',
129135
'rate_limited:true'
130136
]
131137
} )
@@ -139,6 +145,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
139145
WafMetricCollector.get().wafRequestTimeout()
140146
WafMetricCollector.get().wafRequestError()
141147
WafMetricCollector.get().wafRequestRateLimited()
148+
WafMetricCollector.get().wafRequestBlockFailure()
142149
WafMetricCollector.get().prepareMetrics()
143150
periodicAction.doIteration(telemetryService)
144151

@@ -158,6 +165,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
158165
'request_blocked:false',
159166
'waf_error:false',
160167
'waf_timeout:false',
168+
'block_failure:true',
161169
'rate_limited:true'
162170
]
163171
} )
@@ -172,6 +180,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
172180
'request_blocked:false',
173181
'waf_error:false',
174182
'waf_timeout:false',
183+
'block_failure:true',
175184
'rate_limited:true'
176185
]
177186
} )
@@ -186,6 +195,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
186195
'request_blocked:true',
187196
'waf_error:false',
188197
'waf_timeout:false',
198+
'block_failure:true',
189199
'rate_limited:true'
190200
]
191201
} )
@@ -200,6 +210,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
200210
'request_blocked:false',
201211
'waf_error:false',
202212
'waf_timeout:true',
213+
'block_failure:true',
203214
'rate_limited:true'
204215
]
205216
} )
@@ -214,6 +225,7 @@ class WafMetricPeriodicActionSpecification extends DDSpecification {
214225
'request_blocked:false',
215226
'waf_error:true',
216227
'waf_timeout:false',
228+
'block_failure:true',
217229
'rate_limited:true'
218230
]
219231
} )

0 commit comments

Comments
 (0)