Open
Conversation
smola
force-pushed
the
smola/ai-guard-client-ip-tags
branch
from
93c0a25 to
3b41551
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 61 metrics, 10 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.068 s) : 0, 1067980
Total [baseline] (8.851 s) : 0, 8850578
Agent [candidate] (1.074 s) : 0, 1074498
Total [candidate] (8.89 s) : 0, 8890471
section iast
Agent [baseline] (1.245 s) : 0, 1245218
Total [baseline] (9.584 s) : 0, 9584278
Agent [candidate] (1.242 s) : 0, 1242039
Total [candidate] (9.474 s) : 0, 9474385
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.219 ms) : 0, 1219
crashtracking [candidate] (1.227 ms) : 0, 1227
BytebuddyAgent [baseline] (637.602 ms) : 0, 637602
BytebuddyAgent [candidate] (641.373 ms) : 0, 641373
AgentMeter [baseline] (29.49 ms) : 0, 29490
AgentMeter [candidate] (29.702 ms) : 0, 29702
GlobalTracer [baseline] (249.332 ms) : 0, 249332
GlobalTracer [candidate] (250.654 ms) : 0, 250654
AppSec [baseline] (32.898 ms) : 0, 32898
AppSec [candidate] (33.096 ms) : 0, 33096
Debugger [baseline] (61.851 ms) : 0, 61851
Debugger [candidate] (61.833 ms) : 0, 61833
Remote Config [baseline] (604.499 µs) : 0, 604
Remote Config [candidate] (2.091 ms) : 0, 2091
Telemetry [baseline] (8.415 ms) : 0, 8415
Telemetry [candidate] (10.053 ms) : 0, 10053
Flare Poller [baseline] (10.489 ms) : 0, 10489
Flare Poller [candidate] (8.406 ms) : 0, 8406
section iast
crashtracking [baseline] (1.231 ms) : 0, 1231
crashtracking [candidate] (1.226 ms) : 0, 1226
BytebuddyAgent [baseline] (824.019 ms) : 0, 824019
BytebuddyAgent [candidate] (820.913 ms) : 0, 820913
AgentMeter [baseline] (11.273 ms) : 0, 11273
AgentMeter [candidate] (11.259 ms) : 0, 11259
GlobalTracer [baseline] (237.602 ms) : 0, 237602
GlobalTracer [candidate] (237.348 ms) : 0, 237348
AppSec [baseline] (31.156 ms) : 0, 31156
AppSec [candidate] (33.935 ms) : 0, 33935
Debugger [baseline] (63.844 ms) : 0, 63844
Debugger [candidate] (63.899 ms) : 0, 63899
Remote Config [baseline] (525.393 µs) : 0, 525
Remote Config [candidate] (521.333 µs) : 0, 521
Telemetry [baseline] (7.907 ms) : 0, 7907
Telemetry [candidate] (7.846 ms) : 0, 7846
Flare Poller [baseline] (3.328 ms) : 0, 3328
Flare Poller [candidate] (3.31 ms) : 0, 3310
IAST [baseline] (28.237 ms) : 0, 28237
IAST [candidate] (25.783 ms) : 0, 25783
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.064 s) : 0, 1064464
Total [baseline] (11.016 s) : 0, 11016159
Agent [candidate] (1.071 s) : 0, 1071153
Total [candidate] (11.116 s) : 0, 11115547
section appsec
Agent [baseline] (1.268 s) : 0, 1267765
Total [baseline] (11.284 s) : 0, 11283623
Agent [candidate] (1.28 s) : 0, 1279773
Total [candidate] (11.239 s) : 0, 11238647
section iast
Agent [baseline] (1.248 s) : 0, 1247950
Total [baseline] (11.225 s) : 0, 11224804
Agent [candidate] (1.262 s) : 0, 1262055
Total [candidate] (11.26 s) : 0, 11259686
section profiling
Agent [baseline] (1.193 s) : 0, 1192887
Total [baseline] (11.024 s) : 0, 11023538
Agent [candidate] (1.196 s) : 0, 1196241
Total [candidate] (11.067 s) : 0, 11067184
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.224 ms) : 0, 1224
crashtracking [candidate] (1.227 ms) : 0, 1227
BytebuddyAgent [baseline] (635.033 ms) : 0, 635033
BytebuddyAgent [candidate] (640.138 ms) : 0, 640138
AgentMeter [baseline] (29.407 ms) : 0, 29407
AgentMeter [candidate] (29.358 ms) : 0, 29358
GlobalTracer [baseline] (248.469 ms) : 0, 248469
GlobalTracer [candidate] (250.116 ms) : 0, 250116
AppSec [baseline] (32.719 ms) : 0, 32719
AppSec [candidate] (33.073 ms) : 0, 33073
Debugger [baseline] (61.828 ms) : 0, 61828
Debugger [candidate] (62.419 ms) : 0, 62419
Remote Config [baseline] (595.954 µs) : 0, 596
Remote Config [candidate] (589.163 µs) : 0, 589
Telemetry [baseline] (9.139 ms) : 0, 9139
Telemetry [candidate] (9.219 ms) : 0, 9219
Flare Poller [baseline] (9.944 ms) : 0, 9944
Flare Poller [candidate] (8.914 ms) : 0, 8914
section appsec
crashtracking [baseline] (1.233 ms) : 0, 1233
crashtracking [candidate] (1.236 ms) : 0, 1236
BytebuddyAgent [baseline] (674.829 ms) : 0, 674829
BytebuddyAgent [candidate] (682.589 ms) : 0, 682589
AgentMeter [baseline] (12.22 ms) : 0, 12220
AgentMeter [candidate] (12.378 ms) : 0, 12378
GlobalTracer [baseline] (249.43 ms) : 0, 249430
GlobalTracer [candidate] (251.791 ms) : 0, 251791
AppSec [baseline] (185.339 ms) : 0, 185339
AppSec [candidate] (186.253 ms) : 0, 186253
Debugger [baseline] (66.663 ms) : 0, 66663
Debugger [candidate] (66.639 ms) : 0, 66639
Remote Config [baseline] (556.072 µs) : 0, 556
Remote Config [candidate] (569.804 µs) : 0, 570
Telemetry [baseline] (7.724 ms) : 0, 7724
Telemetry [candidate] (7.892 ms) : 0, 7892
Flare Poller [baseline] (8.487 ms) : 0, 8487
Flare Poller [candidate] (8.59 ms) : 0, 8590
IAST [baseline] (24.627 ms) : 0, 24627
IAST [candidate] (24.954 ms) : 0, 24954
section iast
crashtracking [baseline] (1.229 ms) : 0, 1229
crashtracking [candidate] (1.243 ms) : 0, 1243
BytebuddyAgent [baseline] (824.426 ms) : 0, 824426
BytebuddyAgent [candidate] (837.335 ms) : 0, 837335
AgentMeter [baseline] (11.307 ms) : 0, 11307
AgentMeter [candidate] (11.414 ms) : 0, 11414
GlobalTracer [baseline] (238.267 ms) : 0, 238267
GlobalTracer [candidate] (239.298 ms) : 0, 239298
AppSec [baseline] (31.502 ms) : 0, 31502
AppSec [candidate] (31.721 ms) : 0, 31721
Debugger [baseline] (64.883 ms) : 0, 64883
Debugger [candidate] (65.209 ms) : 0, 65209
Remote Config [baseline] (526.885 µs) : 0, 527
Remote Config [candidate] (520.745 µs) : 0, 521
Telemetry [baseline] (8.014 ms) : 0, 8014
Telemetry [candidate] (7.984 ms) : 0, 7984
Flare Poller [baseline] (3.437 ms) : 0, 3437
Flare Poller [candidate] (3.503 ms) : 0, 3503
IAST [baseline] (28.245 ms) : 0, 28245
IAST [candidate] (27.432 ms) : 0, 27432
section profiling
ProfilingAgent [baseline] (94.657 ms) : 0, 94657
ProfilingAgent [candidate] (93.675 ms) : 0, 93675
crashtracking [baseline] (1.173 ms) : 0, 1173
crashtracking [candidate] (1.184 ms) : 0, 1184
BytebuddyAgent [baseline] (694.065 ms) : 0, 694065
BytebuddyAgent [candidate] (698.046 ms) : 0, 698046
AgentMeter [baseline] (8.976 ms) : 0, 8976
AgentMeter [candidate] (8.982 ms) : 0, 8982
GlobalTracer [baseline] (209.172 ms) : 0, 209172
GlobalTracer [candidate] (209.12 ms) : 0, 209120
AppSec [baseline] (33.046 ms) : 0, 33046
AppSec [candidate] (33.031 ms) : 0, 33031
Debugger [baseline] (68.046 ms) : 0, 68046
Debugger [candidate] (68.055 ms) : 0, 68055
Remote Config [baseline] (576.877 µs) : 0, 577
Remote Config [candidate] (575.383 µs) : 0, 575
Telemetry [baseline] (8.205 ms) : 0, 8205
Telemetry [candidate] (8.191 ms) : 0, 8191
Flare Poller [baseline] (3.562 ms) : 0, 3562
Flare Poller [candidate] (3.556 ms) : 0, 3556
Profiling [baseline] (95.221 ms) : 0, 95221
Profiling [candidate] (94.224 ms) : 0, 94224
LoadParameters
See matching parameters
SummaryFound 1 performance improvements and 4 performance regressions! Performance is the same for 16 metrics, 15 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section baseline
no_agent (1.246 ms) : 1234, 1259
. : milestone, 1246,
iast (3.218 ms) : 3174, 3262
. : milestone, 3218,
iast_FULL (5.751 ms) : 5695, 5807
. : milestone, 5751,
iast_GLOBAL (3.648 ms) : 3586, 3711
. : milestone, 3648,
profiling (2.388 ms) : 2364, 2412
. : milestone, 2388,
tracing (1.927 ms) : 1910, 1943
. : milestone, 1927,
section candidate
no_agent (1.231 ms) : 1219, 1242
. : milestone, 1231,
iast (3.384 ms) : 3337, 3430
. : milestone, 3384,
iast_FULL (6.211 ms) : 6147, 6275
. : milestone, 6211,
iast_GLOBAL (3.673 ms) : 3618, 3729
. : milestone, 3673,
profiling (2.146 ms) : 2124, 2167
. : milestone, 2146,
tracing (1.918 ms) : 1902, 1934
. : milestone, 1918,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section baseline
no_agent (18.947 ms) : 18756, 19138
. : milestone, 18947,
appsec (18.716 ms) : 18527, 18906
. : milestone, 18716,
code_origins (17.551 ms) : 17379, 17723
. : milestone, 17551,
iast (17.777 ms) : 17603, 17951
. : milestone, 17777,
profiling (18.478 ms) : 18294, 18663
. : milestone, 18478,
tracing (17.959 ms) : 17780, 18139
. : milestone, 17959,
section candidate
no_agent (19.298 ms) : 19103, 19493
. : milestone, 19298,
appsec (18.372 ms) : 18187, 18557
. : milestone, 18372,
code_origins (17.96 ms) : 17783, 18137
. : milestone, 17960,
iast (17.833 ms) : 17656, 18010
. : milestone, 17833,
profiling (19.544 ms) : 19344, 19745
. : milestone, 19544,
tracing (17.711 ms) : 17538, 17885
. : milestone, 17711,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section baseline
no_agent (15.475 s) : 15475000, 15475000
. : milestone, 15475000,
appsec (14.539 s) : 14539000, 14539000
. : milestone, 14539000,
iast (18.501 s) : 18501000, 18501000
. : milestone, 18501000,
iast_GLOBAL (17.704 s) : 17704000, 17704000
. : milestone, 17704000,
profiling (14.799 s) : 14799000, 14799000
. : milestone, 14799000,
tracing (14.89 s) : 14890000, 14890000
. : milestone, 14890000,
section candidate
no_agent (15.4 s) : 15400000, 15400000
. : milestone, 15400000,
appsec (14.912 s) : 14912000, 14912000
. : milestone, 14912000,
iast (18.401 s) : 18401000, 18401000
. : milestone, 18401000,
iast_GLOBAL (18.041 s) : 18041000, 18041000
. : milestone, 18041000,
profiling (15.257 s) : 15257000, 15257000
. : milestone, 15257000,
tracing (14.617 s) : 14617000, 14617000
. : milestone, 14617000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~3b41551f9d, baseline=1.62.0-SNAPSHOT~c9cebadc2b
dateFormat X
axisFormat %s
section baseline
no_agent (1.487 ms) : 1475, 1498
. : milestone, 1487,
appsec (3.798 ms) : 3576, 4020
. : milestone, 3798,
iast (2.275 ms) : 2206, 2345
. : milestone, 2275,
iast_GLOBAL (2.315 ms) : 2245, 2385
. : milestone, 2315,
profiling (2.106 ms) : 2051, 2161
. : milestone, 2106,
tracing (2.085 ms) : 2032, 2139
. : milestone, 2085,
section candidate
no_agent (1.483 ms) : 1472, 1495
. : milestone, 1483,
appsec (3.839 ms) : 3617, 4061
. : milestone, 3839,
iast (2.271 ms) : 2202, 2341
. : milestone, 2271,
iast_GLOBAL (2.315 ms) : 2245, 2385
. : milestone, 2315,
profiling (2.104 ms) : 2049, 2159
. : milestone, 2104,
tracing (2.088 ms) : 2034, 2141
. : milestone, 2088,
|
When DD_AI_GUARD_ENABLED=true, resolve the client IP eagerly during HTTP server request decoration and stash it on the request context. Apply the tags (http.client_ip and network.client.ip) on the local root span only when an ai_guard span is actually created, so non-AI requests of an AI-Guard-enabled service do not get IP tags. APPSEC-62199
smola
force-pushed
the
smola/ai-guard-client-ip-tags
branch
from
3b41551 to
041ae77
Compare
smola
changed the title
smola
added
type: enhancement
smola
requested review from
a team,
daniel-romano-DD,
manuel-alvarez-alvarez and
mtoffl01
and removed request for
a team
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 041ae77c3d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+270
to
+271
| final boolean shouldStashIps = | ||
| !shouldTagIps && traceClientIpResolverEnabled && config.isAiGuardEnabled(); |
There was a problem hiding this comment.
In the AI Guard-only configuration (DD_AI_GUARD_ENABLED=true with AppSec and dd.trace.client-ip.enabled off), this branch asks the resolver to stash IPs, but the extracted context never contains the forwarding headers: ContextInterpreter.reset still sets collectIpHeaders only for clientIpWithoutAppSec || clientIpResolutionEnabled && APPSEC_ACTIVE. As a result ClientIpAddressResolver.resolve(extracted, span) sees null X-Forwarded-For/Forwarded headers and falls back to the socket peer, so http.client_ip on the ai_guard trace is wrong in the mode this change adds.
Useful? React with 👍 / 👎.
manuel-alvarez-alvarez
approved these changes
May 6, 2026
Member
manuel-alvarez-alvarez
left a comment
manuel-alvarez-alvarez
left a comment
There was a problem hiding this comment.
LGTM, to review the Codex comment
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
When DD_AI_GUARD_ENABLED=true, resolve the client IP eagerly during HTTP
server request decoration and stash it on the request context. Apply the
tags (http.client_ip and network.client.ip) on the local root span only
when an ai_guard span is actually created, so non-AI requests of an
AI-Guard-enabled service do not get IP tags.
APPSEC-62199
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.