Closed NachoEchevarria closed 2 months ago
The following differences have been observed in committed snapshots. It is meant to help the reviewer. The diff is simplistic, so please check some files anyway while we improve it.
101 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000000--1-4740ae63,
+ _dd.appsec.fp.http.network: net-0-1000000000,
28 occurrences of :
+ http.request.headers.accept-language: en_UK,
6 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0100000001--3-bf93958a,
+ _dd.appsec.fp.http.network: net-0-1000000000,
17 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0100000100--2-da57b738,
+ _dd.appsec.fp.http.network: net-0-1000000000,
14 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000001--3-bf93958a,
+ _dd.appsec.fp.http.network: net-0-1000000000,
17 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000100--2-da57b738,
+ _dd.appsec.fp.http.network: net-0-1000000000,
2 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-a13f66cb--6f45fc03,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
8 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000001--5-6cdcf2fe,
+ _dd.appsec.fp.http.network: net-0-1000000000,
2 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-a13f66cb--6f45fc03,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
8 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0100000000--1-4740ae63,
+ _dd.appsec.fp.http.network: net-0-1000000000,
35 occurrences of :
+ _dd.appsec.fp.http.header: <HeaderPrint>
+ _dd.appsec.fp.http.network: net-0-1000000000,
1 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000010--1-4740ae63,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-c4e91668--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
1 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-a1fd7e2d--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0100000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
4 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-a1fd7e2d--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-3c2db0bd--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
74 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0000000000--3-98425651,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-c4e91668--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-a1fd7e2d--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
1 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-3c2db0bd--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0100000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
4 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-3c2db0bd--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
2 occurrences of :
+ _dd.appsec.fp.http.header: hdr-0100000000--3-98425651,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
5 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-0587c50e--8a8abefe,
+ _dd.appsec.fp.http.header: hdr-0000000100--3-4d739311,
+ _dd.appsec.fp.http.network: net-0-1000000000,
1 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-0587c50e--8a8abefe,
+ _dd.appsec.fp.http.header: hdr-0100000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
4 occurrences of :
+ _dd.appsec.fp.http.endpoint: http-post-0587c50e--8a8abefe,
+ _dd.appsec.fp.http.header: hdr-0000000100--5-07490af2,
+ _dd.appsec.fp.http.network: net-0-1000000000,
Branch report: nacho/AttackerFingerprint
Commit report: 3472074
Test service: dd-trace-dotnet
:white_check_mark: 0 Failed, 468238 Passed, 3234 Skipped, 31h 44m 43.02s Total Time
Execution-time results for samples comparing the following branches/commits:
Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.
Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).
gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (69ms) : 67, 72
. : milestone, 69,
master - mean (69ms) : 67, 72
. : milestone, 69,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (1,115ms) : 1093, 1137
. : milestone, 1115,
master - mean (1,117ms) : 1090, 1144
. : milestone, 1117,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (108ms) : 105, 111
. : milestone, 108,
master - mean (109ms) : 105, 114
. : milestone, 109,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (812ms) : 794, 830
. : milestone, 812,
master - mean (812ms) : 784, 840
. : milestone, 812,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (91ms) : 90, 93
. : milestone, 91,
master - mean (93ms) : 88, 99
. : milestone, 93,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (765ms) : 744, 787
. : milestone, 765,
master - mean (764ms) : 739, 788
. : milestone, 764,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (190ms) : 187, 194
. : milestone, 190,
master - mean (190ms) : 187, 194
. : milestone, 190,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (1,198ms) : 1170, 1226
. : milestone, 1198,
master - mean (1,194ms) : 1172, 1217
. : milestone, 1194,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (276ms) : 272, 281
. : milestone, 276,
master - mean (277ms) : 272, 283
. : milestone, 277,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (964ms) : 943, 985
. : milestone, 964,
master - mean (969ms) : 949, 989
. : milestone, 969,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (5982) - mean (265ms) : 261, 268
. : milestone, 265,
master - mean (265ms) : 260, 269
. : milestone, 265,
section CallTarget+Inlining+NGEN
This PR (5982) - mean (950ms) : 928, 972
. : milestone, 950,
master - mean (946ms) : 922, 970
. : milestone, 946,
Benchmarks for #5982 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored.
Benchmarks for #5982 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored.
Throughput results for AspNetCoreSimpleController comparing the following branches/commits:
Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red.
Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards!
gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5982) (10.952M) : 0, 10952357
master (10.867M) : 0, 10866655
benchmarks/2.9.0 (11.081M) : 0, 11080577
section Automatic
This PR (5982) (7.259M) : 0, 7258635
master (7.063M) : 0, 7062638
benchmarks/2.9.0 (7.732M) : 0, 7732233
section Trace stats
master (7.364M) : 0, 7364303
section Manual
master (10.824M) : 0, 10823898
section Manual + Automatic
This PR (5982) (6.728M) : 0, 6727852
master (6.575M) : 0, 6575042
section DD_TRACE_ENABLED=0
master (9.990M) : 0, 9989817
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5982) (9.646M) : 0, 9646079
master (9.746M) : 0, 9746139
benchmarks/2.9.0 (9.798M) : 0, 9798067
section Automatic
This PR (5982) (6.469M) : 0, 6468793
master (6.518M) : 0, 6518443
section Trace stats
master (6.791M) : 0, 6791013
section Manual
master (9.554M) : 0, 9554347
section Manual + Automatic
This PR (5982) (6.171M) : 0, 6170797
master (6.054M) : 0, 6053863
section DD_TRACE_ENABLED=0
master (8.868M) : 0, 8868379
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (5982) (10.175M) : 0, 10175228
master (10.125M) : 0, 10125159
benchmarks/2.9.0 (10.067M) : 0, 10067315
section Automatic
This PR (5982) (6.753M) : 0, 6752766
master (6.789M) : 0, 6788744
benchmarks/2.9.0 (7.552M) : 0, 7552193
section Trace stats
master (7.427M) : 0, 7426998
section Manual
master (10.349M) : 0, 10348694
section Manual + Automatic
This PR (5982) (6.128M) : 0, 6127914
master (6.321M) : 0, 6321226
section DD_TRACE_ENABLED=0
master (9.558M) : 0, 9557791
Thanks you for the reviews!
Summary of changes
Fingerprinting is a technique used to identify and track users through the use of available data which, when combined through a certain set of algorithms, can provide a unique fingerprint for said user. Fingerprinting can be performed on many contexts with different data sets, such as the browser, which can provide the algorithm with specific data about the user’s software and hardware stack, or the server, which typically provides data at the different levels of the network stack.
This PR contains the implementation of the attacker fingerprint feature described in this RFC.
Reason for change
Implementation details
There are two small issues detected that seem related to the WAF: If we don't send the request body, no endpoint fingerprint (_dd.appsec.fp.http.endpoint) is generated. The agent header fingerprint is not generated if we send a value in a dictionary instead of a regular string.
These issues will be discussed with the libdwaf team.
Test coverage
Some unit tests have been added.
Since this feature will be enabled by default and, in order to cover different situations while not impacting the CI performance, the ASM integration tests have been modified to include the fingerprint in the snapshots.
Other details