waf/rasp.duration/_ext all in microsseconds -- span or telemetry

Author: cataphract

.claude/ci/index.md

@@ -244,6 +244,10 @@ Note that path — it is the output file for the next step.
 .claude/ci/ci-watch [--start-offset N] OUTPUT_FILE
 ```
 
+**`OUTPUT_FILE` must be the output file from a `check-ci` process** — not an
+arbitrary background task. `ci-watch` parses `check-ci`'s structured
+`FAILED:` / `SUCCESS:` lines and exits silently on anything else.
+
 `ci-watch` tails the output file and exits when there is something to
 act on. Run it with `run_in_background: true` — you will be notified
 when it completes. While it runs, you can do other work.

appsec/helper-rust/src/client/metrics.rs

@@ -265,12 +265,12 @@ impl telemetry::TelemetryMetricsGenerator for WafMetrics {
 impl telemetry::SpanMetricsGenerator for WafMetrics {
     fn generate_span_metrics(&'_ self, submitter: &mut dyn telemetry::SpanMetricsSubmitter) {
         if !self.waf_duration.is_zero() {
-            submitter.submit_metric(telemetry::WAF_DURATION, self.waf_duration.duration_ms_f64());
+            submitter.submit_metric(telemetry::WAF_DURATION, self.waf_duration.as_micros() as f64);
         }
         if !self.rasp_duration.is_zero() {
             submitter.submit_metric(
                 telemetry::RAST_DURATION,
-                self.rasp_duration.duration_ms_f64(),
+                self.rasp_duration.as_micros() as f64,
             );
         }
         if self.rasp_rule_evals > 0 {

appsec/tests/integration/build.gradle

@@ -710,13 +710,19 @@ def runMainTask = { String phpVersion, String variant ->
         dependsOn "buildAppsec-${phpVersion}-${variant}"
         if (project.hasProperty('helperBinary')) {
             // Skip building helper-rust when explicit binary path is provided
+            dependsOn createVolumeTask('php-helper-rust')
         } else if (project.hasProperty('useHelperRustCoverage')) {
             dependsOn 'buildHelperRustWithCoverage'
         } else if (project.hasProperty('useHelperRust')) {
             dependsOn 'buildHelperRust'
         } else if (phpVersion in ['8.4', '8.5']) {
             // PHP 8.4+ uses Rust helper by default via DD_APPSEC_HELPER_RUST_REDIRECTION
             dependsOn 'buildHelperRust'
+        } else {
+            // C++ helper path: test containers still mount php-helper-rust (for
+            // the rust-redirection mechanism). Pre-create and chown the volume
+            // here so Docker doesn't auto-create it as root-owned.
+            dependsOn createVolumeTask('php-helper-rust')
         }
 
         if (phpVersion in ['7.0', '7.1']) {

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/TelemetryTests.groovy

@@ -730,19 +730,23 @@ class TelemetryTests {
         assert wafDurationExt.count >= 1.0
 
         def span = trace[0]
-        def durationMs = span.metrics.'_dd.appsec.waf.duration'
-        assert durationMs != null && durationMs > 0.0d :
+        def durationUs = span.metrics.'_dd.appsec.waf.duration'
+        assert durationUs != null && durationUs > 0.0d :
             '_dd.appsec.waf.duration span metric must be > 0'
-        def durationExtMs = span.metrics.'_dd.appsec.waf.duration_ext'
-        assert durationExtMs != null && durationExtMs > 0.0d :
+        def durationExtUs = span.metrics.'_dd.appsec.waf.duration_ext'
+        assert durationExtUs != null && durationExtUs > 0.0d :
             '_dd.appsec.waf.duration_ext span metric must be > 0'
 
-        // Distributions are in µs; span metrics are in ms.
-        assert wafDuration.countForBinContaining(durationMs * 1000.0) != null :
-            "span metric value ${durationMs} ms (${durationMs * 1000.0} µs) not found in any " +
+        assert durationExtUs >= durationUs :
+            '_dd.appsec.waf.duration_ext must be >= .duration'
+
+        // Both waf.duration span metric and distribution are in µs.
+        assert wafDuration.countForBinContaining(durationUs) != null :
+            "span metric value ${durationUs} µs not found in any " +
             "waf.duration distribution bin; distribution: ${wafDuration}"
-        assert wafDurationExt.countForBinContaining(durationExtMs * 1000.0) != null :
-            "span metric value ${durationExtMs} ms (${durationExtMs * 1000.0} µs) not found in any " +
+        // Both waf.duration_ext span metric and distribution are in µs.
+        assert wafDurationExt.countForBinContaining(durationExtUs) != null :
+            "span metric value ${durationExtUs} µs not found in any " +
             "waf.duration_ext distribution bin; distribution: ${wafDurationExt}"
     }
 
@@ -965,16 +969,19 @@ class TelemetryTests {
         assert raspDurationExt.count >= 1.0
 
         def span = trace[0]
-        def raspDurationMs = span.metrics.'_dd.appsec.rasp.duration'
-        assert raspDurationMs != null && raspDurationMs > 0.0d :
+        def raspDurationUs = span.metrics.'_dd.appsec.rasp.duration'
+        assert raspDurationUs != null && raspDurationUs > 0.0d :
             '_dd.appsec.rasp.duration span metric must be > 0'
         def raspDurationExtUs = span.metrics.'_dd.appsec.rasp.duration_ext'
         assert raspDurationExtUs != null && raspDurationExtUs > 0.0d :
             '_dd.appsec.rasp.duration_ext span metric must be > 0'
 
-        // rasp.duration distribution is in µs; the span metric is in ms.
-        assert raspDuration.countForBinContaining(raspDurationMs * 1000.0) != null :
-            "span metric value ${raspDurationMs} ms (${raspDurationMs * 1000.0} µs) not found in any " +
+        assert raspDurationExtUs >= raspDurationUs :
+           '_dd.appsec.rasp.duration_ext should be >= .duration'
+
+        // Both rasp.duration span metric and distribution are in µs.
+        assert raspDuration.countForBinContaining(raspDurationUs) != null :
+            "span metric value ${raspDurationUs} µs not found in any " +
             "rasp.duration distribution bin; distribution: ${raspDuration}"
 
         // Both the span metric and the rasp.duration_ext distribution are in µs.