waf/rasp.duration/_ext all in microsseconds -- span or telemetry

Author: cataphract

.claude/ci/index.md

@@ -244,6 +244,10 @@ Note that path — it is the output file for the next step.
 .claude/ci/ci-watch [--start-offset N] OUTPUT_FILE
 ```
 
+**`OUTPUT_FILE` must be the output file from a `check-ci` process** — not an
+arbitrary background task. `ci-watch` parses `check-ci`'s structured
+`FAILED:` / `SUCCESS:` lines and exits silently on anything else.
+
 `ci-watch` tails the output file and exits when there is something to
 act on. Run it with `run_in_background: true` — you will be notified
 when it completes. While it runs, you can do other work.

appsec/helper-rust/src/client/metrics.rs

@@ -265,12 +265,15 @@ impl telemetry::TelemetryMetricsGenerator for WafMetrics {
 impl telemetry::SpanMetricsGenerator for WafMetrics {
     fn generate_span_metrics(&'_ self, submitter: &mut dyn telemetry::SpanMetricsSubmitter) {
         if !self.waf_duration.is_zero() {
-            submitter.submit_metric(telemetry::WAF_DURATION, self.waf_duration.duration_ms_f64());
+            submitter.submit_metric(
+                telemetry::WAF_DURATION,
+                self.waf_duration.as_micros() as f64,
+            );
         }
         if !self.rasp_duration.is_zero() {
             submitter.submit_metric(
                 telemetry::RAST_DURATION,
-                self.rasp_duration.duration_ms_f64(),
+                self.rasp_duration.as_micros() as f64,
             );
         }
         if self.rasp_rule_evals > 0 {

appsec/src/extension/commands/request_shutdown.c

@@ -28,7 +28,8 @@ static const char *nullable _header_content_type_zend_array(
 static const dd_command_spec _spec = {
     .name = "request_shutdown",
     .name_len = sizeof("request_shutdown") - 1,
-    .num_args = 4, // a map, api sec sampling key, sidecar queue id, input_truncated
+    .num_args =
+        4, // a map, api sec sampling key, sidecar queue id, input_truncated
     .outgoing_cb = _request_pack,
     .incoming_cb = dd_command_proc_resp_verd_span_data,
     .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/commands_helpers.c

@@ -704,16 +704,17 @@ void dd_command_process_meta(mpack_node_t root, zend_object *nonnull span)
         const char *val_str = mpack_node_str(value);
         size_t val_len = mpack_node_strlen(value);
 
-        bool res = dd_trace_span_add_tag_str(span, key_str, key_len,
-            val_str, val_len);
+        bool res =
+            dd_trace_span_add_tag_str(span, key_str, key_len, val_str, val_len);
 
         if (!res) {
             mlog(dd_log_warning, "Failed to add tag %.*s", (int)key_len,
                 key_str);
             return;
         }
 
-        dd_telemetry_note_helper_string_meta(key_str, key_len, val_str, val_len);
+        dd_telemetry_note_helper_string_meta(
+            key_str, key_len, val_str, val_len);
     }
 
     if (has_schemas && !get_DD_APM_TRACING_ENABLED()) {

appsec/src/extension/duration_acc.h

@@ -1,7 +1,9 @@
 #pragma once
 
+// php_compat.h must precede attributes.h: attributes.h defines `nonnull` as _Nonnull
+// (empty on GCC), which breaks PHP 8.4+'s __has_attribute(nonnull) in zend_portability.h.
+#include "php_compat.h"  // NOLINT(llvm-include-order)
 #include "attributes.h"
-#include "php_compat.h"
 #include <time.h>
 
 static inline struct timespec dd_monotime_start(void)
@@ -17,7 +19,7 @@ void dd_duration_reset_globals(void); // call on rinit/user req begin
 void dd_duration_flush_metrics(zend_object *nonnull span); // call on rshutdown/user req shutdown
 
 // RASP round-trip time
-void dd_duration_rasp_ext_account(const struct timespec *start);
+void dd_duration_rasp_ext_account(const struct timespec *nonnull start);
 
 // Non-RASP WAF round-trip time
-void dd_duration_waf_ext_account(const struct timespec *start);
+void dd_duration_waf_ext_account(const struct timespec *nonnull start);

appsec/tests/extension/client_init_record_span_tags.phpt

@@ -110,6 +110,7 @@ Array
 (
     [%s] => %d
     [_dd.appsec.enabled] => 1
+    [_dd.appsec.waf.duration_ext] => %f
     [_sampling_priority_v1] => 1
     [metric_1] => 2
     [metric_2] => 10

appsec/tests/extension/push_params_ok_04.phpt

@@ -31,6 +31,7 @@ Array
 (
     [process_id] => %d
     [_dd.appsec.enabled] => %d
+    [_dd.appsec.waf.duration_ext] => %f
     [_dd.appsec.rasp.duration_ext] => %f
 )
 array(2) {

appsec/tests/extension/push_params_ok_05.phpt

@@ -32,6 +32,7 @@ Array
 (
     [process_id] => %d
     [_dd.appsec.enabled] => %d
+    [_dd.appsec.waf.duration_ext] => %f
 )
 array(0) {
 }

appsec/tests/extension/push_params_ok_06.phpt

@@ -31,6 +31,7 @@ Array
 (
     [process_id] => %d
     [_dd.appsec.enabled] => %d
+    [_dd.appsec.waf.duration_ext] => %f
 )
 array(0) {
 }

appsec/tests/extension/rexec_force_keep_01.phpt

@@ -34,5 +34,6 @@ Array
 (
     [%s] => %d
     [_dd.appsec.enabled] => 1
+    [_dd.appsec.waf.duration_ext] => %f
 )
 int(2)