datadog 2.11.0 → 2.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae1f5db840520c849d4a21b02232137e5272619ddd7fb46126f263c71c8a5849
-  data.tar.gz: bd1b16b752c9e457722965ee29cf8af770ba1dcf3b42cac412c206f6245dd333
+  metadata.gz: 5687b95de2487329c4b7e6d6eab86704f8eb2cdcedd5588bcf11af0fdc266f7e
+  data.tar.gz: 837992da8e2c14754b6eb12eb6b26de83a20b68d2bdc369ba925ddd404c2d91b
 SHA512:
-  metadata.gz: 072e88d7ba0698a8ef6b080b6b1ab6a5be18b4a69fdb142b42494bc0afc6184aadbe7c4f52e54e2373a37f40fe439215a8a9a4594653d4d6453ef614142ca8e7
-  data.tar.gz: 88cb6087f42bc450a517d53338772b4fb10b00fe40024843fec3df3849bbc14f6efd25defaf1dcadb9224c9513878c75e2ee33fb0d3d24bb063ca1d2dd36dcb6
+  metadata.gz: de9312020663a01030298e462fa5b86e12b151203c6c2a555fc091954c39ecebb36c49a6dee31f9b337c35d3cad7df24c93a883f0d7da426f78d62581200d272
+  data.tar.gz: 26b49b0f342521eccdafe2390ab13c2762abfb1791cf27faf68c75be5727a949f888ccfc8ebff39ae69de267563ea38c1abea1faaafcfef166dd25226b340c9d

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [2.12.0] - 2025-02-27
+
+### Added
+
+* AppSec: Add detection of Server-Side Request Forgery attacks for `rest-client` ([#4424][])
+* Dynamic Instrumentation: Add support for unix domain sockets ([#4426][])
+
 ## [2.11.0] - 2025-02-24
 
 ### Added
@@ -3126,7 +3133,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.11.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.12.0...master
+[2.12.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.11.0...v2.12.0
 [2.11.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.10.0...v2.11.0
 [2.10.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.9.0...v2.10.0
 [2.9.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.8.0...v2.9.0
@@ -4624,7 +4632,9 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4406]: https://github.com/DataDog/dd-trace-rb/issues/4406
 [#4411]: https://github.com/DataDog/dd-trace-rb/issues/4411
 [#4422]: https://github.com/DataDog/dd-trace-rb/issues/4422
+[#4424]: https://github.com/DataDog/dd-trace-rb/issues/4424
 [#4425]: https://github.com/DataDog/dd-trace-rb/issues/4425
+[#4426]: https://github.com/DataDog/dd-trace-rb/issues/4426
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/lib/datadog/appsec/contrib/rest_client/integration.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+require_relative 'patcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # This class defines properties of rest-client AppSec integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.8')
+
+          register_as :rest_client
+
+          def self.gem_name
+            'rest-client'
+          end
+
+          def self.version
+            Gem.loaded_specs['rest-client'] && Gem.loaded_specs['rest-client'].version
+          end
+
+          def self.loaded?
+            !defined?(::RestClient::Request).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/patcher.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Patcher for RestClient gem
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            require_relative 'request_ssrf_detection_patch'
+
+            ::RestClient::Request.prepend(RequestSSRFDetectionPatch)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -0,0 +1,39 @@
+# rubocop:disable Naming/FileName
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Module that adds SSRF detection to RestClient::Request#execute
+        module RequestSSRFDetectionPatch
+          def execute(&block)
+            return super unless AppSec.rasp_enabled? && AppSec.active_context
+
+            context = AppSec.active_context
+
+            ephemeral_data = { 'server.io.net.url' => url }
+            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, Datadog.configuration.appsec.waf_timeout)
+
+            if result.match?
+              Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+              context.events << {
+                waf_result: result,
+                trace: context.trace,
+                span: context.span,
+                request_url: url,
+                actions: result.actions
+              }
+
+              ActionsHandler.handle(result.actions)
+            end
+
+            super(&block)
+          end
+        end
+      end
+    end
+  end
+end
+# rubocop:enable Naming/FileName

data/lib/datadog/appsec.rb

@@ -70,5 +70,6 @@ require_relative 'appsec/contrib/devise/integration'
 require_relative 'appsec/contrib/graphql/integration'
 require_relative 'appsec/contrib/faraday/integration'
 require_relative 'appsec/contrib/excon/integration'
+require_relative 'appsec/contrib/rest_client/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/core/configuration/components.rb

@@ -104,7 +104,7 @@ module Datadog
 
           @telemetry = self.class.build_telemetry(settings, agent_settings, @logger)
 
-          @remote = Remote::Component.build(settings, agent_settings, telemetry: telemetry)
+          @remote = Remote::Component.build(settings, agent_settings, logger: @logger, telemetry: telemetry)
           @tracer = self.class.build_tracer(settings, agent_settings, logger: @logger)
           @crashtracker = self.class.build_crashtracker(settings, agent_settings, logger: @logger)
 

data/lib/datadog/core/remote/component.rb

@@ -13,9 +13,11 @@ module Datadog
       # Configures the HTTP transport to communicate with the agent
       # to fetch and sync the remote configuration
       class Component
-        attr_reader :client, :healthy
+        attr_reader :logger, :client, :healthy
+
+        def initialize(settings, capabilities, agent_settings, logger:)
+          @logger = logger
 
-        def initialize(settings, capabilities, agent_settings)
           transport_options = {}
           transport_options[:agent_settings] = agent_settings if agent_settings
 
@@ -26,9 +28,9 @@ module Datadog
 
           @client = Client.new(transport_v7, capabilities)
           @healthy = false
-          Datadog.logger.debug { "new remote configuration client: #{@client.id}" }
+          logger.debug { "new remote configuration client: #{@client.id}" }
 
-          @worker = Worker.new(interval: settings.remote.poll_interval_seconds) do
+          @worker = Worker.new(interval: settings.remote.poll_interval_seconds, logger: logger) do
             unless @healthy || negotiation.endpoint?('/v0.7/config')
               @barrier.lift
 
@@ -40,7 +42,7 @@ module Datadog
               @healthy ||= true
             rescue Client::SyncError => e
               # Transient errors due to network or agent. Logged the error but not via telemetry
-              Datadog.logger.error do
+              logger.error do
                 "remote worker client sync error: #{e.message} location: #{Array(e.backtrace).first}. skipping sync"
               end
             rescue StandardError => e
@@ -50,7 +52,7 @@ module Datadog
               negotiation = Negotiation.new(settings, agent_settings)
 
               # Transient errors due to network or agent. Logged the error but not via telemetry
-              Datadog.logger.error do
+              logger.error do
                 "remote worker error: #{e.class.name} #{e.message} location: #{Array(e.backtrace).first}. "\
                 'reseting client state'
               end
@@ -58,7 +60,7 @@ module Datadog
               # client state is unknown, state might be corrupted
               @client = Client.new(transport_v7, capabilities)
               @healthy = false
-              Datadog.logger.debug { "new remote configuration client: #{@client.id}" }
+              logger.debug { "new remote configuration client: #{@client.id}" }
 
               # TODO: bail out if too many errors?
             end
@@ -152,10 +154,10 @@ module Datadog
           #
           # Those checks are instead performed inside the worker loop.
           # This allows users to upgrade their agent while keeping their application running.
-          def build(settings, agent_settings, telemetry:)
+          def build(settings, agent_settings, logger:, telemetry:)
             return unless settings.remote.enabled
 
-            new(settings, Client::Capabilities.new(settings, telemetry), agent_settings)
+            new(settings, Client::Capabilities.new(settings, telemetry), agent_settings, logger: logger)
           end
         end
       end

data/lib/datadog/core/remote/worker.rb

@@ -5,7 +5,7 @@ module Datadog
     module Remote
       # Worker executes a block every interval on a separate Thread
       class Worker
-        def initialize(interval:, &block)
+        def initialize(interval:, logger:, &block)
           @mutex = Mutex.new
           @thr = nil
 
@@ -14,18 +14,21 @@ module Datadog
           @stopped = false
 
           @interval = interval
+          @logger = logger
           raise ArgumentError, 'can not initialize a worker without a block' unless block
 
           @block = block
         end
 
+        attr_reader :logger
+
         def start
-          Datadog.logger.debug { 'remote worker starting' }
+          logger.debug { 'remote worker starting' }
 
           acquire_lock
 
           if @stopped
-            Datadog.logger.debug('remote worker: refusing to restart after previous stop')
+            logger.debug('remote worker: refusing to restart after previous stop')
             return
           end
 
@@ -41,13 +44,13 @@ module Datadog
           @started = true
           @starting = false
 
-          Datadog.logger.debug { 'remote worker started' }
+          logger.debug { 'remote worker started' }
         ensure
           release_lock
         end
 
         def stop
-          Datadog.logger.debug { 'remote worker stopping' }
+          logger.debug { 'remote worker stopping' }
 
           acquire_lock
 
@@ -62,7 +65,7 @@ module Datadog
           @thr = nil
           @stopped = true
 
-          Datadog.logger.debug { 'remote worker stopped' }
+          logger.debug { 'remote worker stopped' }
         ensure
           release_lock
         end
@@ -92,7 +95,7 @@ module Datadog
         end
 
         def call
-          Datadog.logger.debug { 'remote worker perform' }
+          logger.debug { 'remote worker perform' }
 
           @block.call
         end

data/lib/datadog/core/telemetry/component.rb

@@ -16,7 +16,7 @@ module Datadog
       # Telemetry entrypoint, coordinates sending telemetry events at various points in app lifecycle.
       # Note: Telemetry does not spawn its worker thread in fork processes, thus no telemetry is sent in forked processes.
       class Component
-        attr_reader :enabled
+        attr_reader :enabled, :logger
 
         include Core::Utils::Forking
         include Telemetry::Logging
@@ -52,6 +52,7 @@ module Datadog
             heartbeat_interval_seconds: settings.telemetry.heartbeat_interval_seconds,
             metrics_aggregation_interval_seconds: settings.telemetry.metrics_aggregation_interval_seconds,
             dependency_collection: settings.telemetry.dependency_collection,
+            logger: logger,
             shutdown_timeout_seconds: settings.telemetry.shutdown_timeout_seconds,
             log_collection_enabled: settings.telemetry.log_collection_enabled
           )
@@ -66,6 +67,7 @@ module Datadog
           heartbeat_interval_seconds:,
           metrics_aggregation_interval_seconds:,
           dependency_collection:,
+          logger:,
           http_transport:,
           shutdown_timeout_seconds:,
           enabled: true,
@@ -74,6 +76,7 @@ module Datadog
         )
           @enabled = enabled
           @log_collection_enabled = log_collection_enabled
+          @logger = logger
 
           @metrics_manager = MetricsManager.new(
             enabled: enabled && metrics_enabled,
@@ -87,6 +90,7 @@ module Datadog
             emitter: Emitter.new(http_transport: http_transport),
             metrics_manager: @metrics_manager,
             dependency_collection: dependency_collection,
+            logger: logger,
             shutdown_timeout: shutdown_timeout_seconds
           )
 

data/lib/datadog/core/telemetry/worker.rb

@@ -25,6 +25,7 @@ module Datadog
           emitter:,
           metrics_manager:,
           dependency_collection:,
+          logger:,
           enabled: true,
           shutdown_timeout: Workers::Polling::DEFAULT_SHUTDOWN_TIMEOUT,
           buffer_size: DEFAULT_BUFFER_MAX_SIZE
@@ -32,6 +33,7 @@ module Datadog
           @emitter = emitter
           @metrics_manager = metrics_manager
           @dependency_collection = dependency_collection
+          @logger = logger
 
           @ticks_per_heartbeat = (heartbeat_interval_seconds / metrics_aggregation_interval_seconds).to_i
           @current_ticks = 0
@@ -48,6 +50,8 @@ module Datadog
           self.buffer = buffer_klass.new(@buffer_size)
         end
 
+        attr_reader :logger
+
         def start
           return if !enabled? || forked?
 
@@ -99,7 +103,7 @@ module Datadog
 
           events = deduplicate_logs(events)
 
-          Datadog.logger.debug { "Sending #{events&.count} telemetry events" }
+          logger.debug { "Sending #{events&.count} telemetry events" }
           send_event(Event::MessageBatch.new(events))
         end
 
@@ -113,7 +117,7 @@ module Datadog
           return unless enabled?
 
           if failed_to_start?
-            Datadog.logger.debug('Telemetry app-started event exhausted retries, disabling telemetry worker')
+            logger.debug('Telemetry app-started event exhausted retries, disabling telemetry worker')
             disable!
             return
           end
@@ -122,13 +126,13 @@ module Datadog
             res = send_event(Event::AppStarted.new)
 
             if res.ok?
-              Datadog.logger.debug('Telemetry app-started event is successfully sent')
+              logger.debug('Telemetry app-started event is successfully sent')
 
               send_event(Event::AppDependenciesLoaded.new) if @dependency_collection
 
               true
             else
-              Datadog.logger.debug('Error sending telemetry app-started event, retry after heartbeat interval...')
+              logger.debug('Error sending telemetry app-started event, retry after heartbeat interval...')
               false
             end
           end
@@ -166,7 +170,7 @@ module Datadog
         def disable_on_not_found!(response)
           return unless response.not_found?
 
-          Datadog.logger.debug('Agent does not support telemetry; disabling future telemetry events.')
+          logger.debug('Agent does not support telemetry; disabling future telemetry events.')
           disable!
         end
 

data/lib/datadog/di/component.rb

@@ -81,8 +81,7 @@ module Datadog
         @redactor = Redactor.new(settings)
         @serializer = Serializer.new(settings, redactor, telemetry: telemetry)
         @instrumenter = Instrumenter.new(settings, serializer, logger, code_tracker: code_tracker, telemetry: telemetry)
-        @transport = Transport.new(agent_settings)
-        @probe_notifier_worker = ProbeNotifierWorker.new(settings, transport, logger, telemetry: telemetry)
+        @probe_notifier_worker = ProbeNotifierWorker.new(settings, logger, agent_settings: agent_settings, telemetry: telemetry)
         @probe_notification_builder = ProbeNotificationBuilder.new(settings, serializer)
         @probe_manager = ProbeManager.new(settings, instrumenter, probe_notification_builder, probe_notifier_worker, logger, telemetry: telemetry)
         probe_notifier_worker.start
@@ -94,7 +93,6 @@ module Datadog
       attr_reader :telemetry
       attr_reader :code_tracker
       attr_reader :instrumenter
-      attr_reader :transport
       attr_reader :probe_notifier_worker
       attr_reader :probe_notification_builder
       attr_reader :probe_manager

data/lib/datadog/di/probe_notifier_worker.rb

@@ -23,12 +23,12 @@ module Datadog
     #
     # @api private
     class ProbeNotifierWorker
-      def initialize(settings, transport, logger, telemetry: nil)
+      def initialize(settings, logger, agent_settings:, telemetry: nil)
         @settings = settings
         @telemetry = telemetry
         @status_queue = []
         @snapshot_queue = []
-        @transport = transport
+        @agent_settings = agent_settings
         @logger = logger
         @lock = Mutex.new
         @wake = Core::Semaphore.new
@@ -43,6 +43,7 @@ module Datadog
       attr_reader :settings
       attr_reader :logger
       attr_reader :telemetry
+      attr_reader :agent_settings
 
       def start
         return if @thread && @pid == Process.pid
@@ -154,7 +155,6 @@ module Datadog
 
       private
 
-      attr_reader :transport
       attr_reader :wake
       attr_reader :thread
 
@@ -170,6 +170,22 @@ module Datadog
 
       attr_reader :last_sent
 
+      def status_transport
+        @status_transport ||= DI::Transport::HTTP.diagnostics(agent_settings: agent_settings)
+      end
+
+      def do_send_status(batch)
+        status_transport.send_diagnostics(batch)
+      end
+
+      def snapshot_transport
+        @snapshot_transport ||= DI::Transport::HTTP.input(agent_settings: agent_settings)
+      end
+
+      def do_send_snapshot(batch)
+        snapshot_transport.send_input(batch)
+      end
+
       [
         [:status, 'probe status'],
         [:snapshot, 'snapshot'],
@@ -245,7 +261,7 @@ module Datadog
           if batch.any? # steep:ignore
             begin
               logger.trace { "di: sending #{batch.length} #{event_type} event(s) to agent" } # steep:ignore
-              transport.public_send("send_#{event_type}", batch)
+              send("do_send_#{event_type}", batch)
               time = Core::Utils::Time.get_time
               @lock.synchronize do
                 @last_sent = time

data/lib/datadog/di/transport/diagnostics.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative '../../core/transport/parcel'
+require_relative 'http/client'
+
+module Datadog
+  module DI
+    module Transport
+      module Diagnostics
+        class EncodedParcel
+          include Datadog::Core::Transport::Parcel
+        end
+
+        class Request < Datadog::Core::Transport::Request
+        end
+
+        class Transport
+          attr_reader :client, :apis, :default_api, :current_api_id
+
+          def initialize(apis, default_api)
+            @apis = apis
+
+            @client = HTTP::Client.new(current_api)
+          end
+
+          def current_api
+            @apis[HTTP::API::DIAGNOSTICS]
+          end
+
+          def send_diagnostics(payload)
+            json = JSON.dump(payload)
+            parcel = EncodedParcel.new(json)
+            request = Request.new(parcel)
+
+            response = @client.send_diagnostics_payload(request)
+            unless response.ok?
+              # TODO Datadog::Core::Transport::InternalErrorResponse
+              # does not have +code+ method, what is the actual API of
+              # these response objects?
+              raise Error::AgentCommunicationError, "send_diagnostics failed: #{begin
+                response.code
+              rescue
+                "???"
+              end}: #{response.payload}"
+            end
+          rescue Error::AgentCommunicationError
+            raise
+          # Datadog::Core::Transport does not perform any exception mapping,
+          # therefore we could have any exception here from failure to parse
+          # agent URI for example.
+          # If we ever implement retries for network errors, we should distinguish
+          # actual network errors from non-network errors that are raised by
+          # transport code.
+          rescue => exc
+            raise Error::AgentCommunicationError, "send_diagnostics failed: #{exc.class}: #{exc}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/di/transport/http/api.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative '../../../core/encoding'
+require_relative '../../../core/transport/http/api/map'
+require_relative '../../../core/transport/http/api/instance'
+require_relative '../../../core/transport/http/api/spec'
+require_relative 'diagnostics'
+require_relative 'input'
+
+module Datadog
+  module DI
+    module Transport
+      module HTTP
+        # Namespace for API components
+        module API
+          # Default API versions
+          DIAGNOSTICS = 'diagnostics'
+          INPUT = 'input'
+
+          module_function
+
+          def defaults
+            Datadog::Core::Transport::HTTP::API::Map[
+              DIAGNOSTICS => Spec.new do |s|
+                s.diagnostics = Diagnostics::API::Endpoint.new(
+                  '/debugger/v1/diagnostics',
+                  Core::Encoding::JSONEncoder,
+                )
+              end,
+              INPUT => Spec.new do |s|
+                s.input = Input::API::Endpoint.new(
+                  '/debugger/v1/input',
+                  Core::Encoding::JSONEncoder,
+                )
+              end,
+            ]
+          end
+
+          class Instance < Core::Transport::HTTP::API::Instance
+            include Diagnostics::API::Instance
+            include Input::API::Instance
+          end
+
+          class Spec < Core::Transport::HTTP::API::Spec
+            include Diagnostics::API::Spec
+            include Input::API::Spec
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/di/transport/http/client.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative '../../../core/transport/http/env'
+require_relative '../../../core/transport/http/response'
+
+# TODO: Decouple transport/http/client
+#
+# The standard one does `include Transport::HTTP::Statistics` and performs
+# stats updates, which may or may not be desirable in general.
+
+module Datadog
+  module DI
+    module Transport
+      module HTTP
+        # Routes, encodes, and sends DI data to the trace agent via HTTP.
+        class Client
+          attr_reader :api
+
+          def initialize(api)
+            @api = api
+          end
+
+          def send_request(request, &block)
+            # Build request into env
+            env = build_env(request)
+
+            # Get responses from API
+            yield(api, env)
+          rescue => e
+            message =
+              "Internal error during #{self.class.name} request. Cause: #{e.class.name} #{e.message} " \
+                "Location: #{Array(e.backtrace).first}"
+
+            Datadog.logger.debug(message)
+
+            Datadog::Core::Transport::InternalErrorResponse.new(e)
+          end
+
+          def build_env(request)
+            Datadog::Core::Transport::HTTP::Env.new(request)
+          end
+        end
+      end
+    end
+  end
+end