appsec: implement rasp.rule.duration

Author: cataphract

appsec/helper-rust/src/client/metrics.rs

@@ -101,6 +101,11 @@ pub struct RaspRuleMetrics {
 
     /// Total number of RASP rule timeouts
     pub timeouts: u32,
+
+    /// Duration of each individual libddwaf call, for the rasp.rule.duration
+    /// distribution. Unlike rasp.duration, which is the per-request cumulative
+    /// sum, this metric records one observation per call.
+    pub durations: Vec<Duration>,
 }
 
 impl WafMetrics {
@@ -180,6 +185,7 @@ impl WafMetrics {
             .entry((rule_type.to_string(), rule_variant.to_string()))
             .or_default();
         entry.evals += 1;
+        entry.durations.push(run_output.duration());
         if run_output.has_events() {
             if run_output.is_blocking() {
                 entry.matches_blocked += 1;
@@ -309,6 +315,15 @@ impl telemetry::TelemetryMetricsGenerator for WafMetrics {
                 );
             }
 
+            // rasp.rule.duration distribution: one observation per libddwaf call, in microseconds
+            for duration in &metrics.durations {
+                submitter.submit_metric(
+                    telemetry::RASP_RULE_DURATION_DIST,
+                    duration.as_micros() as f64,
+                    tags.clone(),
+                );
+            }
+
             // tests expect this to always be sent, even if 0
             submitter.submit_metric(telemetry::RASP_TIMEOUT, metrics.timeouts as f64, tags);
         }

appsec/helper-rust/src/telemetry.rs

@@ -97,6 +97,7 @@ pub const WAF_ERROR: MetricName = MetricName("waf.error");
 pub const WAF_DURATION_DIST: MetricName = MetricName("waf.duration");
 pub const RASP_DURATION_DIST: MetricName = MetricName("rasp.duration");
 pub const RASP_RULE_EVAL: MetricName = MetricName("rasp.rule.eval");
+pub const RASP_RULE_DURATION_DIST: MetricName = MetricName("rasp.rule.duration");
 pub const RASP_RULE_MATCH: MetricName = MetricName("rasp.rule.match");
 pub const RASP_TIMEOUT: MetricName = MetricName("rasp.timeout");
 pub const RASP_ERROR: MetricName = MetricName("rasp.error");
@@ -136,6 +137,10 @@ pub const KNOWN_METRICS: &[KnownMetric] = &[
         name: RASP_DURATION_DIST,
         metric_type: ddog_MetricType_DDOG_METRIC_TYPE_DISTRIBUTION,
     },
+    KnownMetric {
+        name: RASP_RULE_DURATION_DIST,
+        metric_type: ddog_MetricType_DDOG_METRIC_TYPE_DISTRIBUTION,
+    },
     KnownMetric {
         name: RASP_TIMEOUT,
         metric_type: ddog_MetricType_DDOG_METRIC_TYPE_COUNT,

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/TelemetryTests.groovy

@@ -993,6 +993,9 @@ class TelemetryTests {
      *  - rasp.duration: span metric ms × 1000 → µs must fall inside a populated bin
      *  - rasp.duration_ext: span metric µs falls directly inside a populated bin (no conversion)
      *
+     * Also covers appsec.rasp.rule.duration, the per-libddwaf-call counterpart of
+     * appsec.rasp.duration, which is tagged per rule type and variant.
+     *
      * This test only applies to the Rust helper (distributions not implemented elsewhere).
      */
     @Test
@@ -1020,12 +1023,21 @@ class TelemetryTests {
 
         TelemetryHelpers.DistributionMetric raspDuration
         TelemetryHelpers.DistributionMetric raspDurationExt
+        TelemetryHelpers.DistributionMetric lfiRuleDuration
+        TelemetryHelpers.DistributionMetric ssrfRuleDuration
 
         TelemetryHelpers.waitForDistributions(CONTAINER, 30) { List<TelemetryHelpers.GenerateDistributions> messages ->
             def allSeries = messages.collectMany { it.series }
             raspDuration = raspDuration ?: allSeries.find { it.name == 'rasp.duration' }
             raspDurationExt = raspDurationExt ?: allSeries.find { it.name == 'rasp.duration_ext' }
-            raspDuration != null && raspDurationExt != null
+            lfiRuleDuration = lfiRuleDuration ?: allSeries.find {
+                it.name == 'rasp.rule.duration' && 'rule_type:lfi' in it.tags
+            }
+            ssrfRuleDuration = ssrfRuleDuration ?: allSeries.find {
+                it.name == 'rasp.rule.duration' && 'rule_type:ssrf' in it.tags
+            }
+            raspDuration != null && raspDurationExt != null &&
+                    lfiRuleDuration != null && ssrfRuleDuration != null
         }
 
         assert raspDuration != null : 'rasp.duration distribution metric not found'
@@ -1060,6 +1072,26 @@ class TelemetryTests {
         assert raspDurationExt.countForBinContaining(raspDurationExtUs) != null :
             "span metric value ${raspDurationExtUs} µs not found in any rasp.duration_ext " +
             "distribution bin; distribution: ${raspDurationExt}"
+
+        // RFC-1012 appsec.rasp.rule.duration: unlike rasp.duration, which contributes one
+        // cumulative observation per request, this records one observation per libddwaf call.
+        // /multiple_rasp.php evaluates lfi 3× and ssrf 2×, so those are the per-request minima.
+        assert lfiRuleDuration != null : 'rasp.rule.duration for lfi not found'
+        assert lfiRuleDuration.namespace == 'appsec'
+        assert lfiRuleDuration.tags.find { it.startsWith('waf_version:') } != null
+        assert lfiRuleDuration.tags.find { it.startsWith('event_rules_version:') } != null
+        assert lfiRuleDuration.count >= 3.0 :
+            "expected >= 3 lfi observations, got ${lfiRuleDuration}"
+        // LFI has no variant — tag must be absent (sidecar rejects empty tag values)
+        assert !lfiRuleDuration.tags.any { it.startsWith('rule_variant:') }
+
+        assert ssrfRuleDuration != null : 'rasp.rule.duration for ssrf not found'
+        assert ssrfRuleDuration.namespace == 'appsec'
+        assert ssrfRuleDuration.tags.find { it.startsWith('waf_version:') } != null
+        assert ssrfRuleDuration.tags.find { it.startsWith('event_rules_version:') } != null
+        assert ssrfRuleDuration.count >= 2.0 :
+            "expected >= 2 ssrf observations, got ${ssrfRuleDuration}"
+        assert 'rule_variant:request' in ssrfRuleDuration.tags
     }
 
     /**