[ASM] API Security Endpoints collection (kestrel) #6733

e-n-0 · 2025-03-03T15:24:52Z

Summary of changes

This PR introduce the collection of endpoints using ASP.NET Core in part of Api Security.
RFC.

2 new environment variables (PR on dd-go):
- DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED
- DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT
Sending a new telemetry payload asm-endpoints that includes the detected endpoints.

Implementation details

This PR adds 2 new instrumentation points:

On KestrelServerImpl just before the server starts accepting connection to collect all router endpoints
On MapExtensions (Map) and RunExtensions (Run) to fully get the endpoints configured this way

Test coverage

Unit tests for the new environment variables (checking their values and apply states).
Unit tests on the Telemetry Controller to see if the telemetry data is correctly reported
Integration tests with endpoints collection enabled/disabled and checking if the telemetry data is correctly reported.
- Also checks if special endpoints are reported

Other details

The PR for ASP.NET (framework) will come in a second part.
There is some endpoints that we can't report at the moment with the current implementation. Endpoints configured as middleware other than with .Map() needs to be instrumented (like for example UseDirectoryBrowser). The listing of them and their support will come later.

datadog-datadog-prod-us1 · 2025-03-03T15:57:11Z

Datadog Report

All test runs 7eb096b 🔗

❌ 2 Total Test Services: 1 Failed, 1 Passed

Test Services

Service Name	Failed	Known Flaky	New Flaky	Passed	Skipped	Total Time	Test Service View
`dd-trace-dotnet`	451	360	0	566128	5386	49h 26m 9.23s	Link
`exploration_tests`	0	0	0	22085	3	1h 28m 36.01s	Link

❌ Failed Tests (451)

This report shows up to 5 failed tests.

TestExceptionReplay - Datadog.Trace.Debugger.IntegrationTests.ExceptionReplay.AspNetCore5ExceptionReplayEnabledDynamicInstrumentationDisabled - ❄️ Known flaky - Details
Expand for error
```
 Expected relevantSpans to contain at least 1 item(s) because we want to ensure that we don't timeout while waiting for spans from the mock tracer agent, but found 0: {empty}.
```
TestExceptionReplay - Datadog.Trace.Debugger.IntegrationTests.ExceptionReplay.AspNetCore5ExceptionReplayEnabledDynamicInstrumentationDisabled - ❄️ Known flaky - Details
Expand for error
```
 Expected relevantSpans to contain at least 1 item(s) because we want to ensure that we don't timeout while waiting for spans from the mock tracer agent, but found 0: {empty}.
```
TestExceptionReplay - Datadog.Trace.Debugger.IntegrationTests.ExceptionReplay.AspNetCore5ExceptionReplayEnabledDynamicInstrumentationDisabled - ❄️ Known flaky - Details
Expand for error
```
 Expected relevantSpans to contain at least 1 item(s) because we want to ensure that we don't timeout while waiting for spans from the mock tracer agent, but found 0: {empty}.
```
TestExceptionReplay - Datadog.Trace.Debugger.IntegrationTests.ExceptionReplay.AspNetCore5ExceptionReplayEnabledDynamicInstrumentationDisabled - ❄️ Known flaky - Details
Expand for error
```
 Expected relevantSpans to contain at least 1 item(s) because we want to ensure that we don't timeout while waiting for spans from the mock tracer agent, but found 0: {empty}.
```
TestExceptionReplay - Datadog.Trace.Debugger.IntegrationTests.ExceptionReplay.AspNetCore5ExceptionReplayEnabledDynamicInstrumentationDisabled - ❄️ Known flaky - Details
Expand for error
```
 Expected relevantSpans to contain at least 1 item(s) because we want to ensure that we don't timeout while waiting for spans from the mock tracer agent, but found 0: {empty}.
```

andrewlock · 2025-03-03T16:10:25Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (69ms)  : 67, 71
     .   : milestone, 69,
    master - mean (69ms)  : 66, 72
     .   : milestone, 69,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (1,008ms)  : 982, 1034
     .   : milestone, 1008,
    master - mean (1,003ms)  : 979, 1027
     .   : milestone, 1003,

gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (103ms)  : 100, 105
     .   : milestone, 103,
    master - mean (102ms)  : 100, 104
     .   : milestone, 102,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (686ms)  : 669, 704
     .   : milestone, 686,
    master - mean (683ms)  : 666, 700
     .   : milestone, 683,

gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (89ms)  : 87, 91
     .   : milestone, 89,
    master - mean (89ms)  : 87, 91
     .   : milestone, 89,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (639ms)  : 618, 659
     .   : milestone, 639,
    master - mean (640ms)  : 624, 657
     .   : milestone, 640,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (191ms)  : 187, 194
     .   : milestone, 191,
    master - mean (191ms)  : 187, 195
     .   : milestone, 191,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (1,111ms)  : 1088, 1133
     .   : milestone, 1111,
    master - mean (1,108ms)  : 1084, 1131
     .   : milestone, 1108,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (271ms)  : 265, 276
     .   : milestone, 271,
    master - mean (270ms)  : 267, 273
     .   : milestone, 270,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (874ms)  : 842, 907
     .   : milestone, 874,
    master - mean (876ms)  : 850, 902
     .   : milestone, 876,

gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6733) - mean (262ms)  : 259, 265
     .   : milestone, 262,
    master - mean (264ms)  : 257, 270
     .   : milestone, 264,

    section CallTarget+Inlining+NGEN
    This PR (6733) - mean (851ms)  : 821, 881
     .   : milestone, 851,
    master - mean (858ms)  : 823, 893
     .   : milestone, 858,

andrewlock · 2025-03-03T16:30:58Z

Benchmarks Report for tracer 🐌

Benchmarks for #6733 compared to master:

3 benchmarks are slower, with geometric mean 1.195
All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`StartStopWithChild`	net6.0	8.1μs	47.4ns	452ns	0.0122	0.00406	0	5.61 KB
master	`StartStopWithChild`	netcoreapp3.1	10.9μs	62.2ns	494ns	0.0222	0.0111	0	5.8 KB
master	`StartStopWithChild`	net472	16.5μs	74.9ns	290ns	1.05	0.312	0.0959	6.22 KB
#6733	`StartStopWithChild`	net6.0	8.31μs	48.2ns	403ns	0.0166	0.00415	0	5.61 KB
#6733	`StartStopWithChild`	netcoreapp3.1	10.7μs	59.8ns	397ns	0.0218	0.0109	0	5.81 KB
#6733	`StartStopWithChild`	net472	16.5μs	54.1ns	210ns	1.03	0.289	0.0908	6.2 KB

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	553μs	603ns	2.33μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	665μs	647ns	2.51μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	net472	865μs	291ns	1.01μs	0.428	3.3 KB
#6733	`WriteAndFlushEnrichedTraces`	net6.0	498μs	76.7ns	277ns	0	2.7 KB
#6733	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	653μs	405ns	1.57μs	0	2.7 KB
#6733	`WriteAndFlushEnrichedTraces`	net472	857μs	739ns	2.76μs	0.428	3.3 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	net6.0	134μs	188ns	727ns	0.198	14.47 KB
master	`SendRequest`	netcoreapp3.1	154μs	126ns	470ns	0.153	17.27 KB
master	`SendRequest`	net472	0.000283ns	0.000181ns	0.000653ns	0	0 b
#6733	`SendRequest`	net6.0	133μs	339ns	1.31μs	0.135	14.47 KB
#6733	`SendRequest`	netcoreapp3.1	150μs	142ns	551ns	0.226	17.27 KB
#6733	`SendRequest`	net472	0.000179ns	0.000128ns	0.000478ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6733

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces‑netcoreapp3.1	1.287	735,414.00	946,293.97

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	575μs	3.15μs	17.8μs	0.573	0	0	41.63 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	746μs	4.34μs	37.3μs	0.374	0	0	41.6 KB
master	`WriteAndFlushEnrichedTraces`	net472	848μs	3.27μs	12.7μs	8.7	2.77	0.396	53.33 KB
#6733	`WriteAndFlushEnrichedTraces`	net6.0	582μs	2.97μs	13.9μs	0.619	0	0	41.6 KB
#6733	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	953μs	5.08μs	25.4μs	0.45	0	0	41.53 KB
#6733	`WriteAndFlushEnrichedTraces`	net472	882μs	3.35μs	11.6μs	8.25	2.6	0.434	53.27 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteNonQuery`	net6.0	1.4μs	1.93ns	7.46ns	0.0147	0	1.02 KB
master	`ExecuteNonQuery`	netcoreapp3.1	1.83μs	2.32ns	8.99ns	0.0136	0	1.02 KB
master	`ExecuteNonQuery`	net472	2.08μs	2.64ns	9.89ns	0.157	0.00105	987 B
#6733	`ExecuteNonQuery`	net6.0	1.39μs	0.898ns	3.48ns	0.0145	0	1.02 KB
#6733	`ExecuteNonQuery`	netcoreapp3.1	1.73μs	2.53ns	9.48ns	0.0137	0	1.02 KB
#6733	`ExecuteNonQuery`	net472	1.98μs	1.69ns	6.32ns	0.156	0.00099	987 B

Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`CallElasticsearch`	net6.0	1.27μs	0.443ns	1.66ns	0.014	976 B
master	`CallElasticsearch`	netcoreapp3.1	1.59μs	0.601ns	2.17ns	0.0131	976 B
master	`CallElasticsearch`	net472	2.42μs	1.87ns	7.25ns	0.158	995 B
master	`CallElasticsearchAsync`	net6.0	1.53μs	0.987ns	3.82ns	0.0131	952 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.73μs	0.598ns	2.31ns	0.0136	1.02 KB
master	`CallElasticsearchAsync`	net472	2.59μs	1.1ns	4.25ns	0.167	1.05 KB
#6733	`CallElasticsearch`	net6.0	1.21μs	0.563ns	2.18ns	0.0133	976 B
#6733	`CallElasticsearch`	netcoreapp3.1	1.58μs	0.976ns	3.65ns	0.0134	976 B
#6733	`CallElasticsearch`	net472	2.64μs	0.838ns	3.14ns	0.158	995 B
#6733	`CallElasticsearchAsync`	net6.0	1.42μs	0.751ns	2.81ns	0.0135	952 B
#6733	`CallElasticsearchAsync`	netcoreapp3.1	1.57μs	1.73ns	6.69ns	0.0133	1.02 KB
#6733	`CallElasticsearchAsync`	net472	2.63μs	0.904ns	3.5ns	0.167	1.05 KB

Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteAsync`	net6.0	1.29μs	0.805ns	3.01ns	0.0135	952 B
master	`ExecuteAsync`	netcoreapp3.1	1.64μs	1ns	3.61ns	0.0123	952 B
master	`ExecuteAsync`	net472	1.88μs	0.424ns	1.64ns	0.145	915 B
#6733	`ExecuteAsync`	net6.0	1.33μs	0.615ns	2.3ns	0.0134	952 B
#6733	`ExecuteAsync`	netcoreapp3.1	1.66μs	0.852ns	3.3ns	0.0133	952 B
#6733	`ExecuteAsync`	net472	1.83μs	0.66ns	2.55ns	0.145	915 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	net6.0	4.34μs	1.12ns	4.18ns	0.0327	2.31 KB
master	`SendAsync`	netcoreapp3.1	5.37μs	3.02ns	11.7ns	0.0374	2.85 KB
master	`SendAsync`	net472	7.53μs	2.15ns	8.05ns	0.494	3.12 KB
#6733	`SendAsync`	net6.0	4.46μs	0.875ns	3.28ns	0.0332	2.31 KB
#6733	`SendAsync`	netcoreapp3.1	5.38μs	2.48ns	8.95ns	0.0376	2.85 KB
#6733	`SendAsync`	net472	7.46μs	1.5ns	5.8ns	0.493	3.12 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	1.45μs	0.884ns	3.31ns	0.0232	1.64 KB
master	`EnrichedLog`	netcoreapp3.1	2.2μs	1.48ns	5.34ns	0.0226	1.64 KB
master	`EnrichedLog`	net472	2.61μs	1.21ns	4.51ns	0.249	1.57 KB
#6733	`EnrichedLog`	net6.0	1.42μs	0.716ns	2.68ns	0.0234	1.64 KB
#6733	`EnrichedLog`	netcoreapp3.1	2.11μs	0.928ns	3.35ns	0.0222	1.64 KB
#6733	`EnrichedLog`	net472	2.58μs	0.844ns	3.16ns	0.249	1.57 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	net6.0	112μs	204ns	789ns	0.0566	0	4.28 KB
master	`EnrichedLog`	netcoreapp3.1	117μs	208ns	780ns	0	0	4.28 KB
master	`EnrichedLog`	net472	148μs	206ns	770ns	0.665	0.222	4.46 KB
#6733	`EnrichedLog`	net6.0	114μs	136ns	525ns	0	0	4.28 KB
#6733	`EnrichedLog`	netcoreapp3.1	116μs	236ns	915ns	0.0577	0	4.28 KB
#6733	`EnrichedLog`	net472	150μs	73.3ns	254ns	0.672	0.224	4.46 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.97μs	1.19ns	4.59ns	0.0298	2.2 KB
master	`EnrichedLog`	netcoreapp3.1	4.17μs	1.12ns	4.34ns	0.0293	2.2 KB
master	`EnrichedLog`	net472	4.8μs	1.17ns	4.53ns	0.32	2.02 KB
#6733	`EnrichedLog`	net6.0	2.97μs	0.999ns	3.87ns	0.0312	2.2 KB
#6733	`EnrichedLog`	netcoreapp3.1	4.24μs	2.07ns	8.01ns	0.0297	2.2 KB
#6733	`EnrichedLog`	net472	4.87μs	0.894ns	3.46ns	0.321	2.02 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendReceive`	net6.0	1.35μs	0.595ns	2.31ns	0.0162	1.14 KB
master	`SendReceive`	netcoreapp3.1	1.81μs	0.881ns	3.3ns	0.0154	1.14 KB
master	`SendReceive`	net472	2.14μs	1.16ns	4.48ns	0.183	1.16 KB
#6733	`SendReceive`	net6.0	1.36μs	0.711ns	2.76ns	0.0162	1.14 KB
#6733	`SendReceive`	netcoreapp3.1	1.89μs	1.01ns	3.92ns	0.015	1.14 KB
#6733	`SendReceive`	net472	2.17μs	0.658ns	2.55ns	0.183	1.16 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.72μs	1.73ns	6.49ns	0.0218	1.6 KB
master	`EnrichedLog`	netcoreapp3.1	3.95μs	2.2ns	8.52ns	0.0217	1.65 KB
master	`EnrichedLog`	net472	4.29μs	1.29ns	4.66ns	0.324	2.04 KB
#6733	`EnrichedLog`	net6.0	2.99μs	4.58ns	17.7ns	0.0227	1.6 KB
#6733	`EnrichedLog`	netcoreapp3.1	3.95μs	3.02ns	11.7ns	0.0218	1.65 KB
#6733	`EnrichedLog`	net472	4.26μs	1.51ns	5.85ns	0.322	2.04 KB

Benchmarks.Trace.SpanBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6733

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0	1.156	417.06	482.26

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	net6.0	417ns	0.11ns	0.425ns	0.00815	576 B
master	`StartFinishSpan`	netcoreapp3.1	628ns	0.892ns	3.46ns	0.00796	576 B
master	`StartFinishSpan`	net472	603ns	0.204ns	0.791ns	0.0917	578 B
master	`StartFinishScope`	net6.0	479ns	0.113ns	0.422ns	0.00981	696 B
master	`StartFinishScope`	netcoreapp3.1	724ns	0.469ns	1.75ns	0.00937	696 B
master	`StartFinishScope`	net472	865ns	0.862ns	3.23ns	0.104	658 B
#6733	`StartFinishSpan`	net6.0	482ns	0.174ns	0.672ns	0.00817	576 B
#6733	`StartFinishSpan`	netcoreapp3.1	574ns	0.485ns	1.88ns	0.00772	576 B
#6733	`StartFinishSpan`	net472	657ns	0.109ns	0.422ns	0.0916	578 B
#6733	`StartFinishScope`	net6.0	483ns	0.13ns	0.485ns	0.00965	696 B
#6733	`StartFinishScope`	netcoreapp3.1	770ns	0.339ns	1.31ns	0.00961	696 B
#6733	`StartFinishScope`	net472	806ns	0.202ns	0.783ns	0.104	658 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6733

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0	1.146	685.19	785.55

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	net6.0	685ns	0.291ns	1.13ns	0.00995	696 B
master	`RunOnMethodBegin`	netcoreapp3.1	999ns	1.37ns	5.3ns	0.00905	696 B
master	`RunOnMethodBegin`	net472	1.01μs	0.135ns	0.506ns	0.104	658 B
#6733	`RunOnMethodBegin`	net6.0	785ns	0.173ns	0.669ns	0.00983	696 B
#6733	`RunOnMethodBegin`	netcoreapp3.1	931ns	0.299ns	1.12ns	0.00922	696 B
#6733	`RunOnMethodBegin`	net472	1.08μs	0.329ns	1.27ns	0.104	658 B

andrewlock · 2025-03-03T16:33:23Z

Benchmarks Report for appsec 🐌

Benchmarks for #6733 compared to master:

All benchmarks have the same speed
2 benchmarks have more allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.Asm.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	net6.0	194μs	142ns	491ns	2.69	0	196.14 KB
master	`AllCycleSimpleBody`	netcoreapp3.1	301μs	804ns	3.11μs	2.81	0	203.71 KB
master	`AllCycleSimpleBody`	net472	258μs	97.8ns	353ns	37.2	2.19	234.72 KB
master	`AllCycleMoreComplexBody`	net6.0	201μs	245ns	951ns	2.82	0	199.64 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	303μs	123ns	459ns	2.73	0	207.12 KB
master	`AllCycleMoreComplexBody`	net472	274μs	277ns	1.04μs	37.8	2.18	238.24 KB
master	`ObjectExtractorSimpleBody`	net6.0	138ns	0.14ns	0.522ns	0.00397	0	280 B
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	232ns	0.0928ns	0.347ns	0.00362	0	272 B
master	`ObjectExtractorSimpleBody`	net472	209ns	0.0971ns	0.376ns	0.0446	0	281 B
master	`ObjectExtractorMoreComplexBody`	net6.0	3.01μs	1.58ns	5.9ns	0.0537	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.79μs	2.8ns	10.8ns	0.0511	0	3.69 KB
master	`ObjectExtractorMoreComplexBody`	net472	4.33μs	3.8ns	14.7ns	0.602	0.00649	3.8 KB
#6733	`AllCycleSimpleBody`	net6.0	213μs	89.1ns	333ns	2.77	0	195.99 KB
#6733	`AllCycleSimpleBody`	netcoreapp3.1	325μs	105ns	408ns	2.77	0	203.56 KB
#6733	`AllCycleSimpleBody`	net472	283μs	139ns	520ns	37.2	2.12	234.56 KB
#6733	`AllCycleMoreComplexBody`	net6.0	219μs	78.2ns	293ns	2.85	0	199.5 KB
#6733	`AllCycleMoreComplexBody`	netcoreapp3.1	326μs	133ns	499ns	2.77	0	206.98 KB
#6733	`AllCycleMoreComplexBody`	net472	287μs	169ns	653ns	37.8	2.18	238.08 KB
#6733	`ObjectExtractorSimpleBody`	net6.0	139ns	0.148ns	0.574ns	0.00394	0	280 B
#6733	`ObjectExtractorSimpleBody`	netcoreapp3.1	222ns	0.162ns	0.582ns	0.0037	0	272 B
#6733	`ObjectExtractorSimpleBody`	net472	214ns	0.189ns	0.705ns	0.0446	0	281 B
#6733	`ObjectExtractorMoreComplexBody`	net6.0	2.95μs	2.14ns	8.02ns	0.0534	0	3.78 KB
#6733	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.86μs	2.81ns	10.9ns	0.0501	0	3.69 KB
#6733	`ObjectExtractorMoreComplexBody`	net472	4.28μs	2.51ns	9.71ns	0.601	0.0064	3.8 KB

Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EncodeArgs`	net6.0	37.4μs	30.6ns	118ns	0.448	0	32.4 KB
master	`EncodeArgs`	netcoreapp3.1	54.8μs	27.2ns	102ns	0.436	0	32.4 KB
master	`EncodeArgs`	net472	67μs	39ns	151ns	5.14	0.0672	32.5 KB
master	`EncodeLegacyArgs`	net6.0	74.6μs	39.9ns	149ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	netcoreapp3.1	104μs	142ns	513ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	net472	151μs	94.6ns	354ns	0.302	0	2.15 KB
#6733	`EncodeArgs`	net6.0	36.7μs	26.1ns	101ns	0.444	0	32.4 KB
#6733	`EncodeArgs`	netcoreapp3.1	53.8μs	20ns	74.7ns	0.43	0	32.4 KB
#6733	`EncodeArgs`	net472	67.3μs	39.8ns	154ns	5.14	0.0672	32.5 KB
#6733	`EncodeLegacyArgs`	net6.0	72.8μs	21.8ns	81.7ns	0	0	2.14 KB
#6733	`EncodeLegacyArgs`	netcoreapp3.1	106μs	136ns	528ns	0	0	2.14 KB
#6733	`EncodeLegacyArgs`	net472	152μs	157ns	609ns	0.304	0	2.15 KB

Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunWafRealisticBenchmark`	net6.0	176μs	57.2ns	222ns	0	2.54 KB
master	`RunWafRealisticBenchmark`	netcoreapp3.1	184μs	154ns	597ns	0	2.49 KB
master	`RunWafRealisticBenchmark`	net472	199μs	107ns	401ns	0.398	2.55 KB
master	`RunWafRealisticBenchmarkWithAttack`	net6.0	117μs	160ns	621ns	0	1.57 KB
master	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	123μs	60.1ns	225ns	0	1.55 KB
master	`RunWafRealisticBenchmarkWithAttack`	net472	133μs	60.2ns	233ns	0.199	1.58 KB
#6733	`RunWafRealisticBenchmark`	net6.0	176μs	145ns	563ns	0	2.54 KB
#6733	`RunWafRealisticBenchmark`	netcoreapp3.1	183μs	154ns	596ns	0	2.49 KB
#6733	`RunWafRealisticBenchmark`	net472	198μs	91.9ns	356ns	0.396	2.55 KB
#6733	`RunWafRealisticBenchmarkWithAttack`	net6.0	115μs	106ns	412ns	0	1.57 KB
#6733	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	124μs	85.1ns	318ns	0	1.55 KB
#6733	`RunWafRealisticBenchmarkWithAttack`	net472	132μs	117ns	455ns	0.198	1.58 KB

Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations ⚠️

More allocations ⚠️ in #6733

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472	59.07 KB	60.76 KB	1.69 KB	2.86%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0	254.31 KB	255.6 KB	1.29 KB	0.51%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Allocated
master	`StringConcatBenchmark`	net6.0	59.8μs	719ns	7.08μs	43.44 KB
master	`StringConcatBenchmark`	netcoreapp3.1	55μs	191ns	716ns	42.64 KB
master	`StringConcatBenchmark`	net472	37.4μs	59.7ns	223ns	59.07 KB
master	`StringConcatAspectBenchmark`	net6.0	315μs	1.77μs	11.3μs	254.31 KB
master	`StringConcatAspectBenchmark`	netcoreapp3.1	349μs	1.97μs	12.6μs	253.76 KB
master	`StringConcatAspectBenchmark`	net472	280μs	6.09μs	59.3μs	278.53 KB
#6733	`StringConcatBenchmark`	net6.0	55.7μs	611ns	5.9μs	43.44 KB
#6733	`StringConcatBenchmark`	netcoreapp3.1	60.1μs	828ns	8.11μs	42.64 KB
#6733	`StringConcatBenchmark`	net472	36.8μs	127ns	477ns	60.76 KB
#6733	`StringConcatAspectBenchmark`	net6.0	323μs	1.78μs	10.8μs	255.6 KB
#6733	`StringConcatAspectBenchmark`	netcoreapp3.1	349μs	2.01μs	19.1μs	254.52 KB
#6733	`StringConcatAspectBenchmark`	net472	276μs	4.47μs	43.1μs	278.53 KB

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch from 559d29b to 0cf85db Compare March 3, 2025 15:34

github-actions bot added the area:asm label Mar 3, 2025

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch from e236b88 to 2aa63e4 Compare March 3, 2025 21:57

e-n-0 added 10 commits March 4, 2025 17:27

kestrel endpoints collection + telemetry payload

56ea97d

ASP.NET Core Router endpoints collection

723ac0f

Kestrel implementation (netcore >=2.2 and support changes from 3.0)

816da2b

env vars + config + tests

c981f9a

Capture Map/Run endpoints

32d37fc

Tests

132123c

fix tests

a5f0e0b

some changes

451ad3e

add env vars to config_norm_rules

617a53b

fix ci

3f3c574

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch 3 times, most recently from c5861cc to 6dc5cc1 Compare March 7, 2025 09:46

Fix for net2.2 > net3.1

4a57c08

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch from 6dc5cc1 to 4a57c08 Compare March 7, 2025 13:40

fix with different dotnet versions

0ea74ad

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch from beb3f7a to 6b84e79 Compare March 10, 2025 15:04

update name

7eb096b

e-n-0 force-pushed the flavien/asm/api-sec-endpoints-collection branch from 6b84e79 to 7eb096b Compare March 10, 2025 15:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ASM] API Security Endpoints collection (kestrel) #6733

[ASM] API Security Endpoints collection (kestrel) #6733

e-n-0 commented Mar 3, 2025 •

edited

Loading

datadog-datadog-prod-us1 bot commented Mar 3, 2025 •

edited

Loading

andrewlock commented Mar 3, 2025 •

edited

Loading

andrewlock commented Mar 3, 2025 •

edited

Loading

Raw results

Raw results

Raw results

Slower ⚠️ in #6733

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6733

Raw results

Slower ⚠️ in #6733

Raw results

andrewlock commented Mar 3, 2025 •

edited

Loading

Raw results

Raw results

Raw results

More allocations ⚠️ in #6733

Raw results

[ASM] API Security Endpoints collection (kestrel) #6733

Are you sure you want to change the base?

[ASM] API Security Endpoints collection (kestrel) #6733

Conversation

e-n-0 commented Mar 3, 2025 • edited Loading

Summary of changes

Implementation details

Test coverage

Other details

datadog-datadog-prod-us1 bot commented Mar 3, 2025 • edited Loading

Datadog Report

❌ Failed Tests (451)

andrewlock commented Mar 3, 2025 • edited Loading

Execution-Time Benchmarks Report ⏱️

andrewlock commented Mar 3, 2025 • edited Loading

Benchmarks Report for tracer 🐌

Benchmark details

Raw results

Raw results

Raw results

Slower ⚠️ in #6733

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6733

Raw results

Slower ⚠️ in #6733

Raw results

andrewlock commented Mar 3, 2025 • edited Loading

Benchmarks Report for appsec 🐌

Benchmark details

Raw results

Raw results

Raw results

More allocations ⚠️ in #6733

Raw results

e-n-0 commented Mar 3, 2025 •

edited

Loading

datadog-datadog-prod-us1 bot commented Mar 3, 2025 •

edited

Loading

andrewlock commented Mar 3, 2025 •

edited

Loading

andrewlock commented Mar 3, 2025 •

edited

Loading

andrewlock commented Mar 3, 2025 •

edited

Loading