Skip to content

Conversation

@manuel-alvarez-alvarez
Copy link
Member

@manuel-alvarez-alvarez manuel-alvarez-alvarez commented Aug 19, 2022

What Does This Do

This PR defines a new gradle plugin to auto generate call site instrumentation advices, the code is separated in two commits:

  1. The gradle plugin call-site-instrumentation that reads classes in a format close to ByteBuddy with AspectJ notation to automatically build datadog.trace.agent.tooling.csi.CallSiteAdvice classes. The next piece of code is an example of a class defining advices:
@CallSite
public class SampleCallSite {

  @CallSite.Before(
      "java.security.MessageDigest java.security.MessageDigest.getInstance(java.lang.String)")
  public static void beforeMessageDigestGetInstance(@CallSite.Argument final String algorithm) {
    // do something with the algorithm
  }
}
  1. A sample project csi-mock-to-remove that showcases the use of the plugin and the call site instrumentation API. This module should be removed before the final merge.

Motivation

Instrumentations related to IAST often affect core parts of the JDK (String, StringBuilder...) where using callee instrumentation (by default in ByteBuddy) is not good enough for performance. Call site instrumentation focuses on the calls to the instrumented methods enabling the use of inclusion/exclusion lists to fine tune where to instrument.

Additional Notes

Real usage of this plugin is located at String builder taint tracking #3904

Performance remarks

Preliminary startup performance results from the benchmark with petclinic:

Agent Startup (ms) Request mean duration (ms)
none 4764 6.99
datadog 8477 12.99
datadog-csi 8610 13.79

@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 3 times, most recently from 1164303 to 52dd96a Compare August 24, 2022 08:21
@smola smola added the comp: asm iast Application Security Management (IAST) label Aug 24, 2022
@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 2 times, most recently from 04f4e5a to 94c6fce Compare September 6, 2022 11:51
@manuel-alvarez-alvarez manuel-alvarez-alvarez marked this pull request as ready for review September 6, 2022 11:51
@manuel-alvarez-alvarez manuel-alvarez-alvarez requested a review from a team September 6, 2022 11:51
@manuel-alvarez-alvarez manuel-alvarez-alvarez requested a review from a team as a code owner September 6, 2022 11:51
@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 11 times, most recently from 9503215 to 1cdf587 Compare September 19, 2022 07:42
@manuel-alvarez-alvarez
Copy link
Member Author

manuel-alvarez-alvarez commented Sep 19, 2022

This might be useful to troubleshoot the build issue: #3855

@smola not really, I've checked via SSH and there are no artifacts, looks like the process is killed from the outside, I'm troubleshooting the issue.

@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 11 times, most recently from b662393 to 6dd5da1 Compare September 26, 2022 08:52
@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 5 times, most recently from 094bb6c to 748af47 Compare September 30, 2022 15:28
@smola smola changed the title [IAST] Call Site Instrumentation plugin Call Site Instrumentation plugin Oct 3, 2022
@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch 2 times, most recently from 04f2040 to 7eba20f Compare October 5, 2022 16:34
@smola smola added the comp: tooling Build & Tooling label Oct 7, 2022
Copy link
Contributor

@bantonsson bantonsson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another huge PR done 😅

Really nice with the example and benchmark.

@manuel-alvarez-alvarez
Copy link
Member Author

Another huge PR done sweat_smile

Really nice with the example and benchmark.

Thank you very much for the review, I promise that this is the last PR behemoth 😄

@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/call-site-instrumentation-plugin branch from 7eba20f to b32b1c1 Compare October 10, 2022 07:33
@manuel-alvarez-alvarez manuel-alvarez-alvarez merged commit 9eb4edc into master Oct 10, 2022
@manuel-alvarez-alvarez manuel-alvarez-alvarez deleted the malvarez/call-site-instrumentation-plugin branch October 10, 2022 08:46
@github-actions github-actions bot added this to the 0.111.0 milestone Oct 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: asm iast Application Security Management (IAST) comp: tooling Build & Tooling tag: no release notes Changes to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants