Skip to content

Commit d51336d

Browse files
committed
pr
1 parent a1cc80a commit d51336d

File tree

3 files changed

+28
-12
lines changed

3 files changed

+28
-12
lines changed

dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
import java.lang.reflect.Method;
5555
import java.lang.reflect.Proxy;
5656
import java.lang.reflect.UndeclaredThrowableException;
57+
import java.util.ArrayList;
5758
import java.util.Collection;
5859
import java.util.Collections;
5960
import java.util.HashMap;
@@ -213,9 +214,10 @@ private void applyConfig(Object config_, AppSecModuleConfigurer.Reconfiguration
213214
}
214215

215216
boolean success = false;
217+
List<String> errors = new ArrayList<>();
216218
try {
217219
// ddwaf_init/update
218-
success = initializeNewWafCtx(reconf, config, curCtxAndAddresses);
220+
success = initializeNewWafCtx(reconf, config, curCtxAndAddresses, errors);
219221
} catch (Exception e) {
220222
throw new AppSecModuleActivationException("Could not initialize/update waf", e);
221223
} finally {
@@ -224,13 +226,18 @@ private void applyConfig(Object config_, AppSecModuleConfigurer.Reconfiguration
224226
} else {
225227
WafMetricCollector.get().wafUpdates(currentRulesVersion, success);
226228
}
229+
if (!errors.isEmpty()) {
230+
log.error("Errors during WAF initialization: {}", errors);
231+
WafMetricCollector.get().addWafConfigError(errors.size());
232+
}
227233
}
228234
}
229235

230236
private boolean initializeNewWafCtx(
231237
AppSecModuleConfigurer.Reconfiguration reconf,
232238
CurrentAppSecConfig config,
233-
CtxAndAddresses prevContextAndAddresses)
239+
CtxAndAddresses prevContextAndAddresses,
240+
List<String> errors)
234241
throws AppSecModuleActivationException, IOException {
235242
CtxAndAddresses newContextAndAddresses;
236243
RuleSetInfo initReport = null;
@@ -254,16 +261,6 @@ private boolean initializeNewWafCtx(
254261
if (initReport != null && initReport.rulesetVersion != null) {
255262
currentRulesVersion = initReport.rulesetVersion;
256263
}
257-
if (initReport != null
258-
&& initReport.getErrors() != null
259-
&& !initReport.getErrors().isEmpty()
260-
&& initReport.getErrors().values().stream().mapToLong(List::size).sum() > 0) {
261-
for (int i = 0;
262-
i < initReport.getErrors().values().stream().mapToLong(List::size).sum();
263-
i++) {
264-
WafMetricCollector.get().wafConfigError();
265-
}
266-
}
267264

268265
if (initReport != null) {
269266
log.info(
@@ -285,6 +282,14 @@ private boolean initializeNewWafCtx(
285282
if (initReport != null) {
286283
this.statsReporter.rulesVersion = initReport.rulesetVersion;
287284
}
285+
if (initReport != null
286+
&& initReport.getErrors() != null
287+
&& !initReport.getErrors().isEmpty()) {
288+
errors.addAll(
289+
initReport.getErrors().values().stream()
290+
.flatMap(List::stream)
291+
.collect(Collectors.toList()));
292+
}
288293
} catch (InvalidRuleSetException irse) {
289294
initReport = irse.ruleSetInfo;
290295
throw new AppSecModuleActivationException("Error creating WAF rules", irse);

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/powerwaf/PowerWAFModuleSpecification.groovy

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -449,6 +449,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
449449

450450
then:
451451
1 * wafMetricCollector.wafInit(Powerwaf.LIB_VERSION, _, true)
452+
2 * wafMetricCollector.addWafConfigError(1)
452453
1 * wafMetricCollector.wafUpdates(_, true)
453454
1 * reconf.reloadSubscriptions()
454455
0 * _
@@ -534,6 +535,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
534535

535536
then:
536537
1 * wafMetricCollector.wafInit(Powerwaf.LIB_VERSION, _, true)
538+
2 * wafMetricCollector.addWafConfigError(1)
537539
1 * wafMetricCollector.wafUpdates(_, true)
538540
1 * reconf.reloadSubscriptions()
539541
0 * _
@@ -612,6 +614,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
612614

613615
then:
614616
1 * wafMetricCollector.wafInit(Powerwaf.LIB_VERSION, _, true)
617+
2 * wafMetricCollector.addWafConfigError(1)
615618
2 * wafMetricCollector.wafUpdates(_, true)
616619
2 * reconf.reloadSubscriptions()
617620
0 * _
@@ -1089,6 +1092,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
10891092
1 * ctx.closeAdditive()
10901093
2 * tracer.activeSpan()
10911094
1 * wafMetricCollector.wafInit(Powerwaf.LIB_VERSION, _, true)
1095+
1 * wafMetricCollector.addWafConfigError(1)
10921096
1 * reconf.reloadSubscriptions()
10931097
0 * _
10941098
}
@@ -1136,6 +1140,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
11361140
11371141
then:
11381142
1 * wafMetricCollector.wafUpdates(_, true)
1143+
1 * wafMetricCollector.addWafConfigError(1)
11391144
1 * reconf.reloadSubscriptions()
11401145
1 * ctx.getOrCreateAdditive(_, true, false) >> { pwafAdditive = it[0].openAdditive() }
11411146
2 * tracer.activeSpan()
@@ -1194,6 +1199,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
11941199
11951200
then: 'no match; rule is disabled'
11961201
1 * wafMetricCollector.wafUpdates(_, true)
1202+
1 * wafMetricCollector.addWafConfigError(1)
11971203
1 * reconf.reloadSubscriptions()
11981204
1 * ctx.getOrCreateAdditive(_, true, false) >> {
11991205
pwafAdditive = it[0].openAdditive() }
@@ -1304,6 +1310,7 @@ class PowerWAFModuleSpecification extends DDSpecification {
13041310
13051311
then:
13061312
1 * wafMetricCollector.wafUpdates(_, true)
1313+
1 * wafMetricCollector.addWafConfigError(1)
13071314
1 * reconf.reloadSubscriptions()
13081315
// no attack
13091316
1 * ctx.getOrCreateAdditive(_, true, false) >> { pwafAdditive = it[0].openAdditive() }

internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ public void wafConfigError() {
8585
wafConfigErrorCounter.incrementAndGet();
8686
}
8787

88+
public void addWafConfigError(int nbErrors) {
89+
wafConfigErrorCounter.addAndGet(nbErrors);
90+
}
91+
8892
public void wafRequestTriggered() {
8993
wafTriggeredRequestCounter.increment();
9094
}

0 commit comments

Comments
 (0)