Added AppSec smoke test to validate WAF

Author: ValentinZakharov

dd-java-agent/appsec/src/main/java/com/datadog/appsec/report/ReportServiceImpl.java

@@ -3,6 +3,7 @@
 import com.datadog.appsec.report.raw.dtos.intake.IntakeBatch;
 import com.datadog.appsec.report.raw.events.AppSecEvent100;
 import com.datadog.appsec.util.StandardizedLogging;
+import datadog.trace.api.Config;
 import datadog.trace.util.AgentTaskScheduler;
 import java.util.ArrayList;
 import java.util.List;
@@ -88,9 +89,12 @@ private void lazyStartTask() {
       return;
     }
 
+    int initialDelay = Config.get().getAppSecReportMinTimeout();
+    int period = Config.get().getAppSecReportMaxTimeout();
+
     scheduledTask =
         taskScheduler.scheduleAtFixedRate(
-            PeriodicFlush.INSTANCE, this, 5 /* initial delay */, 30 /* period */, TimeUnit.SECONDS);
+            PeriodicFlush.INSTANCE, this, initialDelay, period, TimeUnit.SECONDS);
   }
 
   @Override

dd-java-agent/appsec/src/main/java/com/datadog/appsec/report/ReportStrategy.java

@@ -2,6 +2,8 @@
 
 import com.datadog.appsec.report.raw.events.AppSecEvent100;
 import com.datadog.appsec.util.JvmTime;
+import datadog.trace.api.Config;
+import java.util.concurrent.TimeUnit;
 import javax.annotation.Nonnull;
 
 public interface ReportStrategy {
@@ -10,8 +12,10 @@ public interface ReportStrategy {
   boolean shouldFlush(@Nonnull AppSecEvent100 event);
 
   class Default implements ReportStrategy {
-    private static final long MIN_INTERVAL_NANOS = 5L * 1000L * 1000L * 1000L;
-    private static final long MAX_INTERVAL_NANOS = 60L * 1000L * 1000L * 1000L;
+    private static final long MIN_INTERVAL_NANOS =
+        TimeUnit.SECONDS.toNanos(Config.get().getAppSecReportMinTimeout());
+    private static final long MAX_INTERVAL_NANOS =
+        TimeUnit.SECONDS.toNanos(Config.get().getAppSecReportMaxTimeout());
     private static final int MAX_QUEUED_ITEMS = 50;
 
     private final JvmTime jvmTime;

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/report/ReportServiceImplTests.groovy

@@ -47,7 +47,7 @@ class ReportServiceImplTests extends DDSpecification {
     testee.reportEvent(event)
 
     then:
-    1 * scheduler.scheduleAtFixedRate(_, testee, 5, 30, TimeUnit.SECONDS) >>
+    1 * scheduler.scheduleAtFixedRate(_, testee, 5, 60, TimeUnit.SECONDS) >>
       new AgentTaskScheduler.Scheduled(new Object())
     1 * api.sendIntakeBatch(
       _ as IntakeBatch,
@@ -89,7 +89,7 @@ class ReportServiceImplTests extends DDSpecification {
     testee.reportEvent(event)
 
     then:
-    1 * scheduler.scheduleAtFixedRate(_, { it.is(testee) }, 5, 30, TimeUnit.SECONDS) >>
+    1 * scheduler.scheduleAtFixedRate(_, { it.is(testee) }, 5, 60, TimeUnit.SECONDS) >>
     { task = it[0]; scheduled }
     0 * api._(*_)
 

dd-smoke-tests/appsec/appsec.gradle

@@ -0,0 +1,7 @@
+apply from: "$rootDir/gradle/java.gradle"
+
+description = 'appsec-smoke-tests'
+
+dependencies {
+  api project(':dd-smoke-tests')
+}

dd-smoke-tests/appsec/springboot/springboot.gradle

@@ -0,0 +1,30 @@
+plugins {
+  id "com.github.johnrengelman.shadow"
+}
+
+ext {
+  minJavaVersionForTests = JavaVersion.VERSION_1_8
+}
+
+apply from: "$rootDir/gradle/java.gradle"
+description = 'SpringBoot Smoke Tests.'
+
+// The standard spring-boot plugin doesn't play nice with our project
+// so we'll build a fat jar instead
+jar {
+  manifest {
+    attributes('Main-Class': 'datadog.smoketest.appsec.springboot.SpringbootApplication')
+  }
+}
+
+dependencies {
+  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: '2.6.0'
+
+  testImplementation project(':dd-smoke-tests:appsec')
+}
+
+tasks.withType(Test).configureEach {
+  dependsOn "shadowJar"
+
+  jvmArgs "-Ddatadog.smoketest.appsec.springboot.shadowJar.path=${tasks.shadowJar.archivePath}"
+}

dd-smoke-tests/appsec/springboot/src/main/java/datadog/smoketest/appsec/springboot/SpringbootApplication.java

@@ -0,0 +1,14 @@
+package datadog.smoketest.appsec.springboot;
+
+import java.lang.management.ManagementFactory;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SpringbootApplication {
+
+  public static void main(final String[] args) {
+    SpringApplication.run(SpringbootApplication.class, args);
+    System.out.println("Started in " + ManagementFactory.getRuntimeMXBean().getUptime() + "ms");
+  }
+}

dd-smoke-tests/appsec/springboot/src/main/java/datadog/smoketest/appsec/springboot/controller/WebController.java

@@ -0,0 +1,12 @@
+package datadog.smoketest.appsec.springboot.controller;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class WebController {
+  @RequestMapping("/greeting")
+  public String greeting() {
+    return "Sup AppSec Dawg";
+  }
+}

dd-smoke-tests/appsec/springboot/src/main/resources/application.properties

@@ -0,0 +1 @@
+logging.level.root=WARN

dd-smoke-tests/appsec/springboot/src/test/groovy/datadog/smoketest/appsec/SpringBootSmokeTest.groovy

@@ -0,0 +1,54 @@
+package datadog.smoketest.appsec
+
+import okhttp3.Request
+import spock.util.concurrent.PollingConditions
+
+import java.util.concurrent.TimeUnit
+
+class SpringBootSmokeTest extends AbstractAppSecServerSmokeTest {
+
+  // Timeout for individual requests
+  public static final int REQUEST_TIMEOUT = 5
+
+  @Override
+  ProcessBuilder createProcessBuilder() {
+    String springBootShadowJar = System.getProperty("datadog.smoketest.appsec.springboot.shadowJar.path")
+
+    List<String> command = new ArrayList<>()
+    command.add(javaPath())
+    command.addAll(defaultJavaProperties)
+    command.addAll(defaultAppSecProperties)
+    command.addAll((String[]) ["-jar", springBootShadowJar, "--server.port=${httpPort}"])
+
+    ProcessBuilder processBuilder = new ProcessBuilder(command)
+    processBuilder.directory(new File(buildDirectory))
+  }
+
+  def "malicious WAF request #n th time"() {
+    setup:
+    String url = "http://localhost:${httpPort}/greeting"
+    def request = new Request.Builder()
+      .url(url)
+      . addHeader("User-Agent", "Arachni/v1")
+      .build()
+
+    when:
+    def response = client.newCall(request).execute()
+    def conditions = new PollingConditions()
+
+    then:
+    def responseBodyStr = response.body().string()
+    responseBodyStr != null
+    responseBodyStr.contains("Sup AppSec Dawg")
+    response.body().contentType().toString().contains("text/plain")
+    response.code() == 200
+
+    conditions.eventually {
+      // Expect reported WAF attack event
+      appSecEvents.poll(REQUEST_TIMEOUT, TimeUnit.SECONDS)?.get("event_type") == "security_scanner"
+    }
+
+    where:
+    n << (1..200)
+  }
+}

dd-smoke-tests/appsec/src/main/groovy/datadog/smoketest/appsec/AbstractAppSecServerSmokeTest.groovy

@@ -0,0 +1,64 @@
+package datadog.smoketest.appsec
+
+import datadog.smoketest.AbstractServerSmokeTest
+import datadog.trace.agent.test.server.http.TestHttpServer
+import groovy.json.JsonSlurper
+import spock.lang.AutoCleanup
+import spock.lang.Shared
+
+import java.util.concurrent.BlockingQueue
+import java.util.concurrent.LinkedBlockingQueue
+
+import static datadog.trace.agent.test.server.http.TestHttpServer.httpServer
+
+abstract class AbstractAppSecServerSmokeTest extends AbstractServerSmokeTest {
+
+  @Shared
+  protected BlockingQueue<Map<String, Object>> appSecEvents = new LinkedBlockingQueue<>()
+
+  @AutoCleanup
+  @Shared
+  protected TestHttpServer appSecServer = httpServer {
+    handlers {
+      prefix("/appsec/proxy/api/v2/appsecevts") {
+        JsonSlurper jsonParser = new JsonSlurper()
+        Map<String, Object> attack = jsonParser.parse(request.body) as Map
+
+        if (attack.containsKey("events")) {
+          appSecEvents.addAll(attack.get("events"))
+        }
+
+        response.status(200).send("hello")
+      }
+    }
+  }
+
+  @Shared
+  protected String[] defaultAppSecProperties = [
+    "-Ddd.appsec.enabled=true",
+    "-Ddd.appsec.report.timeout=0",
+    // immediately commit event
+    "-Ddd.profiling.enabled=false",
+    "-Ddd.trace.agent.port=${appSecServer.address.port}"
+  ]
+
+  def setup() {
+    appSecEvents.clear()
+  }
+
+  def setupSpec() {
+    startServer()
+  }
+
+  def cleanupSpec() {
+    stopServer()
+  }
+
+  def startServer() {
+    appSecServer.start()
+  }
+
+  def stopServer() {
+    // do nothing; 'server' is autocleanup
+  }
+}