-
Notifications
You must be signed in to change notification settings - Fork 314
Blocking Response Unique Identifier (block_id) #9720
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Blocking Response Unique Identifier (block_id) #9720
Conversation
|
🎯 Code Coverage 🔗 Commit SHA: 507a444 | Docs | Was this helpful? Give us feedback! |
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 6 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.018 s) : 0, 1017527
Total [baseline] (10.711 s) : 0, 10711261
Agent [candidate] (1.017 s) : 0, 1016760
Total [candidate] (10.747 s) : 0, 10746979
section appsec
Agent [baseline] (1.201 s) : 0, 1201380
Total [baseline] (11.031 s) : 0, 11031245
Agent [candidate] (1.2 s) : 0, 1199835
Total [candidate] (11.066 s) : 0, 11065632
section iast
Agent [baseline] (1.149 s) : 0, 1148875
Total [baseline] (11.074 s) : 0, 11074085
Agent [candidate] (1.152 s) : 0, 1151645
Total [candidate] (10.998 s) : 0, 10998416
section profiling
Agent [baseline] (1.17 s) : 0, 1170110
Total [baseline] (11.055 s) : 0, 11054627
Agent [candidate] (1.158 s) : 0, 1158411
Total [candidate] (11.036 s) : 0, 11035766
gantt
title petclinic - break down per module: candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.471 ms) : 0, 1471
crashtracking [candidate] (1.464 ms) : 0, 1464
BytebuddyAgent [baseline] (692.913 ms) : 0, 692913
BytebuddyAgent [candidate] (693.441 ms) : 0, 693441
GlobalTracer [baseline] (241.633 ms) : 0, 241633
GlobalTracer [candidate] (242.179 ms) : 0, 242179
AppSec [baseline] (32.46 ms) : 0, 32460
AppSec [candidate] (32.708 ms) : 0, 32708
Debugger [baseline] (6.39 ms) : 0, 6390
Debugger [candidate] (6.429 ms) : 0, 6429
Remote Config [baseline] (705.114 µs) : 0, 705
Remote Config [candidate] (706.318 µs) : 0, 706
Telemetry [baseline] (9.3 ms) : 0, 9300
Telemetry [candidate] (9.373 ms) : 0, 9373
Flare Poller [baseline] (11.542 ms) : 0, 11542
Flare Poller [candidate] (9.375 ms) : 0, 9375
section appsec
crashtracking [baseline] (1.479 ms) : 0, 1479
crashtracking [candidate] (1.465 ms) : 0, 1465
BytebuddyAgent [baseline] (721.63 ms) : 0, 721630
BytebuddyAgent [candidate] (721.382 ms) : 0, 721382
GlobalTracer [baseline] (235.98 ms) : 0, 235980
GlobalTracer [candidate] (235.654 ms) : 0, 235654
AppSec [baseline] (176.655 ms) : 0, 176655
AppSec [candidate] (176.04 ms) : 0, 176040
Debugger [baseline] (6.181 ms) : 0, 6181
Debugger [candidate] (6.138 ms) : 0, 6138
Remote Config [baseline] (640.883 µs) : 0, 641
Remote Config [candidate] (636.12 µs) : 0, 636
Telemetry [baseline] (8.613 ms) : 0, 8613
Telemetry [candidate] (8.531 ms) : 0, 8531
Flare Poller [baseline] (3.973 ms) : 0, 3973
Flare Poller [candidate] (3.943 ms) : 0, 3943
IAST [baseline] (25.035 ms) : 0, 25035
IAST [candidate] (24.954 ms) : 0, 24954
section iast
crashtracking [baseline] (1.467 ms) : 0, 1467
crashtracking [candidate] (1.453 ms) : 0, 1453
BytebuddyAgent [baseline] (813.575 ms) : 0, 813575
BytebuddyAgent [candidate] (815.822 ms) : 0, 815822
GlobalTracer [baseline] (231.29 ms) : 0, 231290
GlobalTracer [candidate] (231.734 ms) : 0, 231734
AppSec [baseline] (34.981 ms) : 0, 34981
AppSec [candidate] (35.206 ms) : 0, 35206
Debugger [baseline] (6.129 ms) : 0, 6129
Debugger [candidate] (6.077 ms) : 0, 6077
Remote Config [baseline] (623.032 µs) : 0, 623
Remote Config [candidate] (600.594 µs) : 0, 601
Telemetry [baseline] (8.671 ms) : 0, 8671
Telemetry [candidate] (8.633 ms) : 0, 8633
Flare Poller [baseline] (4.202 ms) : 0, 4202
Flare Poller [candidate] (4.241 ms) : 0, 4241
IAST [baseline] (26.477 ms) : 0, 26477
IAST [candidate] (26.323 ms) : 0, 26323
section profiling
crashtracking [baseline] (1.445 ms) : 0, 1445
crashtracking [candidate] (1.432 ms) : 0, 1432
BytebuddyAgent [baseline] (727.165 ms) : 0, 727165
BytebuddyAgent [candidate] (718.802 ms) : 0, 718802
GlobalTracer [baseline] (219.425 ms) : 0, 219425
GlobalTracer [candidate] (217.437 ms) : 0, 217437
AppSec [baseline] (32.735 ms) : 0, 32735
AppSec [candidate] (32.304 ms) : 0, 32304
Debugger [baseline] (8.859 ms) : 0, 8859
Debugger [candidate] (6.426 ms) : 0, 6426
Remote Config [baseline] (773.093 µs) : 0, 773
Remote Config [candidate] (801.63 µs) : 0, 802
Telemetry [baseline] (13.648 ms) : 0, 13648
Telemetry [candidate] (15.986 ms) : 0, 15986
Flare Poller [baseline] (4.115 ms) : 0, 4115
Flare Poller [candidate] (4.062 ms) : 0, 4062
ProfilingAgent [baseline] (107.901 ms) : 0, 107901
ProfilingAgent [candidate] (107.933 ms) : 0, 107933
Profiling [baseline] (109.497 ms) : 0, 109497
Profiling [candidate] (109.197 ms) : 0, 109197
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.015 s) : 0, 1015360
Total [baseline] (8.664 s) : 0, 8664189
Agent [candidate] (1.024 s) : 0, 1023863
Total [candidate] (8.674 s) : 0, 8674409
section iast
Agent [baseline] (1.161 s) : 0, 1160671
Total [baseline] (9.356 s) : 0, 9356159
Agent [candidate] (1.158 s) : 0, 1158193
Total [candidate] (9.371 s) : 0, 9370627
gantt
title insecure-bank - break down per module: candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.466 ms) : 0, 1466
crashtracking [candidate] (1.482 ms) : 0, 1482
BytebuddyAgent [baseline] (692.855 ms) : 0, 692855
BytebuddyAgent [candidate] (697.865 ms) : 0, 697865
GlobalTracer [baseline] (241.594 ms) : 0, 241594
GlobalTracer [candidate] (243.538 ms) : 0, 243538
AppSec [baseline] (32.475 ms) : 0, 32475
AppSec [candidate] (32.953 ms) : 0, 32953
Debugger [baseline] (6.414 ms) : 0, 6414
Debugger [candidate] (6.522 ms) : 0, 6522
Remote Config [baseline] (702.17 µs) : 0, 702
Remote Config [candidate] (704.508 µs) : 0, 705
Telemetry [baseline] (9.151 ms) : 0, 9151
Telemetry [candidate] (9.343 ms) : 0, 9343
Flare Poller [baseline] (9.63 ms) : 0, 9630
Flare Poller [candidate] (10.24 ms) : 0, 10240
section iast
crashtracking [baseline] (1.487 ms) : 0, 1487
crashtracking [candidate] (1.492 ms) : 0, 1492
BytebuddyAgent [baseline] (821.117 ms) : 0, 821117
BytebuddyAgent [candidate] (820.335 ms) : 0, 820335
GlobalTracer [baseline] (234.364 ms) : 0, 234364
GlobalTracer [candidate] (232.901 ms) : 0, 232901
AppSec [baseline] (35.261 ms) : 0, 35261
AppSec [candidate] (35.347 ms) : 0, 35347
Debugger [baseline] (6.217 ms) : 0, 6217
Debugger [candidate] (6.176 ms) : 0, 6176
Remote Config [baseline] (623.767 µs) : 0, 624
Remote Config [candidate] (621.645 µs) : 0, 622
Telemetry [baseline] (8.887 ms) : 0, 8887
Telemetry [candidate] (8.771 ms) : 0, 8771
Flare Poller [baseline] (4.152 ms) : 0, 4152
Flare Poller [candidate] (4.269 ms) : 0, 4269
IAST [baseline] (26.986 ms) : 0, 26986
IAST [candidate] (26.767 ms) : 0, 26767
LoadParameters
See matching parameters
SummaryFound 1 performance improvements and 3 performance regressions! Performance is the same for 8 metrics, 12 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section baseline
no_agent (4.216 ms) : 4167, 4266
. : milestone, 4216,
iast (9.889 ms) : 9721, 10058
. : milestone, 9889,
iast_FULL (15.818 ms) : 15494, 16141
. : milestone, 15818,
iast_GLOBAL (10.567 ms) : 10378, 10756
. : milestone, 10567,
profiling (8.826 ms) : 8676, 8977
. : milestone, 8826,
tracing (7.699 ms) : 7589, 7809
. : milestone, 7699,
section candidate
no_agent (4.37 ms) : 4315, 4425
. : milestone, 4370,
iast (9.935 ms) : 9766, 10105
. : milestone, 9935,
iast_FULL (15.463 ms) : 15153, 15774
. : milestone, 15463,
iast_GLOBAL (10.733 ms) : 10540, 10926
. : milestone, 10733,
profiling (9.364 ms) : 9216, 9512
. : milestone, 9364,
tracing (7.598 ms) : 7491, 7705
. : milestone, 7598,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section baseline
no_agent (38.209 ms) : 37902, 38517
. : milestone, 38209,
appsec (48.908 ms) : 48490, 49326
. : milestone, 48908,
code_origins (45.418 ms) : 45036, 45801
. : milestone, 45418,
iast (45.258 ms) : 44861, 45655
. : milestone, 45258,
profiling (49.155 ms) : 48685, 49624
. : milestone, 49155,
tracing (43.688 ms) : 43304, 44071
. : milestone, 43688,
section candidate
no_agent (36.779 ms) : 36480, 37078
. : milestone, 36779,
appsec (49.219 ms) : 48785, 49654
. : milestone, 49219,
code_origins (44.612 ms) : 44245, 44980
. : milestone, 44612,
iast (45.281 ms) : 44896, 45665
. : milestone, 45281,
profiling (50.506 ms) : 50065, 50948
. : milestone, 50506,
tracing (45.032 ms) : 44641, 45423
. : milestone, 45032,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section baseline
no_agent (1.478 ms) : 1467, 1490
. : milestone, 1478,
appsec (3.725 ms) : 3506, 3943
. : milestone, 3725,
iast (2.209 ms) : 2146, 2272
. : milestone, 2209,
iast_GLOBAL (2.245 ms) : 2182, 2308
. : milestone, 2245,
profiling (2.056 ms) : 2005, 2107
. : milestone, 2056,
tracing (2.038 ms) : 1989, 2088
. : milestone, 2038,
section candidate
no_agent (1.478 ms) : 1467, 1490
. : milestone, 1478,
appsec (3.725 ms) : 3508, 3942
. : milestone, 3725,
iast (2.207 ms) : 2144, 2271
. : milestone, 2207,
iast_GLOBAL (2.247 ms) : 2183, 2311
. : milestone, 2247,
profiling (2.062 ms) : 2011, 2114
. : milestone, 2062,
tracing (2.039 ms) : 1989, 2089
. : milestone, 2039,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.55.0-SNAPSHOT~507a444c65, baseline=1.55.0-SNAPSHOT~4f6f6b0d56
dateFormat X
axisFormat %s
section baseline
no_agent (14.972 s) : 14972000, 14972000
. : milestone, 14972000,
appsec (15.234 s) : 15234000, 15234000
. : milestone, 15234000,
iast (18.373 s) : 18373000, 18373000
. : milestone, 18373000,
iast_GLOBAL (18.076 s) : 18076000, 18076000
. : milestone, 18076000,
profiling (15.014 s) : 15014000, 15014000
. : milestone, 15014000,
tracing (15.113 s) : 15113000, 15113000
. : milestone, 15113000,
section candidate
no_agent (14.835 s) : 14835000, 14835000
. : milestone, 14835000,
appsec (14.985 s) : 14985000, 14985000
. : milestone, 14985000,
iast (18.701 s) : 18701000, 18701000
. : milestone, 18701000,
iast_GLOBAL (17.965 s) : 17965000, 17965000
. : milestone, 17965000,
profiling (15.576 s) : 15576000, 15576000
. : milestone, 15576000,
tracing (14.988 s) : 14988000, 14988000
. : milestone, 14988000,
|
What Does This Do
This PR adds support for extracting and emitting a unique block_id (UUIDv4 format) in AppSec blocking responses, generated by libddwaf
v17.2.0Implementation flow:
WAFModule.java): When libddwaf triggers a blocking action, extract the block_id from actionInfo.parameters and pass it to RequestBlockingAction constructorFlow.java): Add blockId field to RequestBlockingAction class with getter method and update all constructors (includingforRedirect()factory method)-
JakartaServletBlockingHelper.java-
ServletBlockingHelper.java (javax-servlet)-
TomcatBlockingHelper.java-
UndertowBlockingHandler.javaBlockingActionHelper.java):- Add blockId parameter to
getTemplate()method- Replace
{block_id}placeholder in HTML template- Add
block_idfield in JSON template- Append
?block_id=<uuid>to redirect URLsResult: Blocking responses now include the unique identifier in all response types (JSON, HTML, redirect), enabling customers to track and debug specific blocking events.
Motivation
Per RFC-1070, libddwaf v17.2.0 generates a UUIDv4 as block_id in action parameters to provide unique identifiers for each blocking event. This PR implements the required changes:
This enables customers to uniquely identify and track specific blocking events for debugging and analysis.
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any useful labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]