Skip to content

Commit 6476fc5

Browse files
uuriensimon-id
authored and
tlhunter
committed
Add IAST benchmark tests (#3193)
* appsec-iast benchmark tests * writing fixes Co-authored-by: simon-id <[email protected]> * small fixes --------- Co-authored-by: simon-id <[email protected]>
1 parent a674ab6 commit 6476fc5

File tree

8 files changed

+162
-1
lines changed

8 files changed

+162
-1
lines changed

‎benchmark/sirun/appsec-iast/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
This creates 150 HTTP requests from client to server.
2+
3+
The variants are:
4+
- control tracer with non vulnerable endpoint without iast
5+
- tracer with non vulnerable endpoint with iast active and default configuration
6+
- tracer with non vulnerable endpoint with iast active and sampling 100
7+
- control tracer with vulnerable endpoint without iast
8+
- tracer with vulnerable endpoint with iast active and default configuration
9+
- tracer with vulnerable endpoint with iast active and sampling 100

‎benchmark/sirun/appsec-iast/client.js‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
'use strict'
2+
3+
const { port, reqs } = require('./common')
4+
const http = require('http')
5+
6+
let connectionsMade = 0
7+
function request (opts) {
8+
http.get(opts, (res) => {
9+
res.on('data', () => {})
10+
res.on('end', () => {
11+
if (++connectionsMade !== reqs) {
12+
request(opts)
13+
}
14+
})
15+
}).on('error', (e) => {
16+
setTimeout(() => {
17+
request(opts)
18+
}, 10)
19+
})
20+
}
21+
22+
const path = '/?param=value'
23+
const opts = {
24+
headers: {
25+
accept: 'text/html'
26+
},
27+
port,
28+
path
29+
}
30+
request(opts)

‎benchmark/sirun/appsec-iast/common.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
'use strict'
2+
3+
module.exports = {
4+
port: 3331 + parseInt(process.env.CPU_AFFINITY || '0'),
5+
reqs: 350
6+
}

‎benchmark/sirun/appsec-iast/meta.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"name": "appsec-iast",
3+
"cachegrind": false,
4+
"instructions": true,
5+
"iterations": 40,
6+
"variants": {
7+
"no-vulnerability-control": {
8+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
9+
"run": "node --require ../../../init.js server-without-vulnerability.js",
10+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
11+
"env": {
12+
"DD_IAST_ENABLED": "0"
13+
}
14+
},
15+
"no-vulnerability-iast-enabled-default-config": {
16+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
17+
"run": "node --require ../../../init.js server-without-vulnerability.js",
18+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
19+
"baseline": "no-vulnerability-control",
20+
"env": {
21+
"DD_IAST_ENABLED": "1"
22+
}
23+
},
24+
"no-vulnerability-iast-enabled-always-active": {
25+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
26+
"run": "node --require ../../../init.js server-without-vulnerability.js",
27+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
28+
"baseline": "no-vulnerability-control",
29+
"env": {
30+
"DD_IAST_ENABLED": "1",
31+
"DD_IAST_REQUEST_SAMPLING": "100",
32+
"DD_IAST_MAX_CONCURRENT_REQUESTS": "1000",
33+
"DD_IAST_MAX_CONTEXT_OPERATIONS": "100"
34+
}
35+
},
36+
"with-vulnerability-control": {
37+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
38+
"run": "node --require ../../../init.js server-with-vulnerability.js",
39+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
40+
"env": {
41+
"DD_IAST_ENABLED": "0"
42+
}
43+
},
44+
"with-vulnerability-iast-enabled-default-config": {
45+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
46+
"run": "node --require ../../../init.js server-with-vulnerability.js",
47+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
48+
"baseline": "with-vulnerability-control",
49+
"env": {
50+
"DD_IAST_ENABLED": "1"
51+
}
52+
},
53+
"with-vulnerability-iast-enabled-always-active": {
54+
"setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
55+
"run": "node --require ../../../init.js server-with-vulnerability.js",
56+
"run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
57+
"baseline": "with-vulnerability-control",
58+
"env": {
59+
"DD_IAST_ENABLED": "1",
60+
"DD_IAST_REQUEST_SAMPLING": "100",
61+
"DD_IAST_MAX_CONCURRENT_REQUESTS": "1000",
62+
"DD_IAST_MAX_CONTEXT_OPERATIONS": "100"
63+
}
64+
}
65+
}
66+
}

‎benchmark/sirun/appsec-iast/server-with-vulnerability.js‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
'use strict'
2+
3+
const { port, reqs } = require('./common')
4+
const express = require('../../../versions/express').get()
5+
const cookieParser = require('../../../versions/cookie-parser').get()
6+
const childProcess = require('child_process')
7+
8+
const app = express()
9+
app.use(cookieParser())
10+
11+
let connectionsMade = 0
12+
13+
function noop () {}
14+
15+
app.get('/', (req, res) => {
16+
childProcess.exec('echo #' + req.query.param, noop)
17+
res.writeHead(200)
18+
res.end('Hello, World!')
19+
20+
if (++connectionsMade === reqs) {
21+
server.close()
22+
}
23+
})
24+
25+
const server = app.listen(port)

‎benchmark/sirun/appsec-iast/server-without-vulnerability.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
'use strict'
2+
3+
const { port, reqs } = require('./common')
4+
const express = require('../../../versions/express').get()
5+
const cookieParser = require('../../../versions/cookie-parser').get()
6+
7+
const app = express()
8+
app.use(cookieParser())
9+
10+
let connectionsMade = 0
11+
12+
app.get('/', (req, res) => {
13+
res.writeHead(200)
14+
res.end('Hello, World!')
15+
16+
if (++connectionsMade === reqs) {
17+
server.close()
18+
}
19+
})
20+
21+
const server = app.listen(port)

‎benchmark/sirun/runall.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ nvm use 18
1919
cd ../../ &&
2020
npm install --global yarn \
2121
&& yarn install --ignore-engines \
22-
&& PLUGINS="bluebird|q|graphql" yarn services
22+
&& PLUGINS="bluebird|q|graphql|express" yarn services
2323
)
2424

2525
# run each test in parallel for a given version of Node.js

‎packages/dd-trace/test/plugins/externals.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@
3535
{
3636
"name": "loopback",
3737
"versions": [">=2.38.1"]
38+
},
39+
{
40+
"name": "cookie-parser",
41+
"versions": [">=1.4.6"]
3842
}
3943
],
4044
"fastify": [

0 commit comments

Comments
 (0)