Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protect Processor::Context#run with a mutex #2773

Merged
merged 3 commits into from
Apr 13, 2023
Merged

Protect Processor::Context#run with a mutex #2773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
38b0b85
Protect Processor::Context#run with a mutex
lloeki Apr 11, 2023
2994528
Fix run return value typing
lloeki Apr 12, 2023
e0c9ba1
Clarify mutex protection
lloeki Apr 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions lib/datadog/appsec/processor.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,22 +14,28 @@ def initialize(processor)
@time_ext_ns = 0.0
@timeouts = 0
@events = []
@run_mutex = Mutex.new
end

def run(input, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
@run_mutex.lock

start_ns = Core::Utils::Time.get_time(:nanosecond)
Comment on lines +21 to 23
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: Consider using @run_mutex.synchronize -- I think that one's a bit easier to maintain and "break" with future changes.

Copy link
Member Author

@lloeki lloeki Apr 12, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rationale:

  • blocks carry a cost: def/ensure/end is faster
  • it makes the function return value less explicit (you have to konw/remember/lookup that synchronize does return the block value)
  • it creates whitespace churn on the code change
  • maybe I'm doing too much Go but def/ensure/end is a common pattern that matches Go's defer ;)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a comment to clarify the intent!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!


# this WAF::Context#run call is not thread safe as it mutates the context
# TODO: remove multiple assignment
_code, res = _ = @context.run(input, timeout)
# @type var res: WAF::Result
_code, res = @context.run(input, timeout)

stop_ns = Core::Utils::Time.get_time(:nanosecond)

# these updates are not thread safe and should be protected
@time_ns += res.total_runtime
@time_ext_ns += (stop_ns - start_ns)
@timeouts += 1 if res.timeout

res
ensure
@run_mutex.unlock
end

def finalize
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a final question -- does @context.finalize not need protecting too?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, that one is fine.

Context initialization and finalization happen on the same thread and should outlive any transient thread that would theoretically use the same context (you'd get much bigger problems otherwise, that a simple synchronize would not solve). It's all theoretical anyway because no code is currently allowing getting the context from another thread, so this is mostly bulletproofing following a discussion around run.

Expand Down
2 changes: 2 additions & 0 deletions sig/datadog/appsec/processor.rbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ module Datadog

@context: WAF::Context

@run_mutex: ::Thread::Mutex

def initialize: (Processor processor) -> void
def run: (data input, ?::Integer timeout) -> WAF::Result
def finalize: () -> void
Expand Down
2 changes: 1 addition & 1 deletion vendor/rbs/libddwaf/0/datadog/appsec/waf.rbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,7 @@ module Datadog
def initialize: (Handle handle) -> void
def finalize: () -> void

def run: (data input, ?::Integer timeout) -> ::Array[top]
def run: (data input, ?::Integer timeout) -> [::Symbol, Result]

private

Expand Down