datadog 2.17.0 → 2.37.0

data/lib/datadog/tracing/contrib/rack/configuration/settings.rb

@@ -37,7 +37,11 @@ module Datadog
             end
 
             option :application
-            option :distributed_tracing, default: true, type: :bool
+            option :distributed_tracing do |o|
+              o.type :bool
+              o.env Ext::ENV_DISTRIBUTED_TRACING
+              o.default true
+            end
             option :headers, default: DEFAULT_HEADERS, type: :hash
             option :middleware_names, default: false, type: :bool
             option :quantize, default: {}, type: :hash
@@ -50,6 +54,12 @@ module Datadog
               o.type :string, nilable: true
             end
 
+            option :inferred_proxy_enabled do |o|
+              o.type :bool
+              o.env Ext::ENV_INFERRED_PROXY_ENABLED
+              o.default false
+            end
+
             option :web_service_name, default: Ext::DEFAULT_PEER_WEBSERVER_SERVICE_NAME, type: :string
           end
         end

data/lib/datadog/tracing/contrib/rack/ext.rb

@@ -8,6 +8,8 @@ module Datadog
         # @public_api Changing resource names, tag names, or environment variables creates breaking changes.
         module Ext
           ENV_ENABLED = 'DD_TRACE_RACK_ENABLED'
+          ENV_DISTRIBUTED_TRACING = 'DD_TRACE_RACK_DISTRIBUTED_TRACING'
+          ENV_INFERRED_PROXY_ENABLED = 'DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED'
           # @!visibility private
           ENV_ANALYTICS_ENABLED = 'DD_TRACE_RACK_ANALYTICS_ENABLED'
           ENV_ANALYTICS_SAMPLE_RATE = 'DD_TRACE_RACK_ANALYTICS_SAMPLE_RATE'
@@ -23,6 +25,32 @@ module Datadog
           TAG_OPERATION_HTTP_SERVER_QUEUE = 'queue'
           WEBSERVER_APP = 'webserver'
           DEFAULT_PEER_WEBSERVER_SERVICE_NAME = 'web-server'
+
+          # @!visibility private
+          HEADER_X_DD_PROXY = 'HTTP_X_DD_PROXY'
+          HEADER_X_DD_PROXY_REQUEST_TIME_MS = 'HTTP_X_DD_PROXY_REQUEST_TIME_MS'
+          HEADER_X_DD_PROXY_PATH = 'HTTP_X_DD_PROXY_PATH'
+          HEADER_X_DD_PROXY_RESOURCE_PATH = 'HTTP_X_DD_PROXY_RESOURCE_PATH'
+          HEADER_X_DD_PROXY_HTTPMETHOD = 'HTTP_X_DD_PROXY_HTTPMETHOD'
+          HEADER_X_DD_PROXY_DOMAIN_NAME = 'HTTP_X_DD_PROXY_DOMAIN_NAME'
+          HEADER_X_DD_PROXY_STAGE = 'HTTP_X_DD_PROXY_STAGE'
+          HEADER_X_DD_PROXY_ACCOUNT_ID = 'HTTP_X_DD_PROXY_ACCOUNT_ID'
+          HEADER_X_DD_PROXY_API_ID = 'HTTP_X_DD_PROXY_API_ID'
+          HEADER_X_DD_PROXY_REGION = 'HTTP_X_DD_PROXY_REGION'
+          HEADER_X_DD_PROXY_USER = 'HTTP_X_DD_PROXY_USER'
+
+          PROXY_AWS_APIGATEWAY = 'aws-apigateway'
+          PROXY_AWS_HTTPAPI = 'aws-httpapi'
+
+          SPAN_AWS_APIGATEWAY = 'aws.apigateway'
+          SPAN_AWS_HTTPAPI = 'aws.httpapi'
+
+          PROXY_SPAN_NAMES = {
+            PROXY_AWS_APIGATEWAY => SPAN_AWS_APIGATEWAY,
+            PROXY_AWS_HTTPAPI => SPAN_AWS_HTTPAPI,
+          }.freeze
+
+          TAG_INFERRED_SPAN = '_dd.inferred_span'
         end
       end
     end

data/lib/datadog/tracing/contrib/rack/header_collection.rb

@@ -22,7 +22,7 @@ module Datadog
             end
 
             # Allows this class to have a similar API to a {Hash}.
-            alias [] get
+            alias_method :[], :get
 
             # Tests whether a header with the given name exists in the environment.
             def key?(header_name)

data/lib/datadog/tracing/contrib/rack/header_tagging.rb

@@ -1,30 +1,38 @@
 # frozen_string_literal: true
 
+require_relative 'header_collection'
+
 module Datadog
   module Tracing
     module Contrib
       module Rack
         # Matches Rack-style headers with a matcher and sets matching headers into a span.
         module HeaderTagging
+          DATADOG_REQUEST_ATTRIBUTION_HEADERS = [
+            'x-datadog-endpoint-scan',
+            'x-datadog-security-test'
+          ].freeze
+
           def self.tag_request_headers(span, env, configuration)
             # Wrap env in a case-insensitive Rack-style accessor.
             headers = env.is_a?(Header::RequestHeaderCollection) ? env : Header::RequestHeaderCollection.new(env)
 
             # Use global DD_TRACE_HEADER_TAGS if integration-level configuration is not provided
             tags = if configuration.using_default?(:headers) && !Datadog.configuration.tracing.using_default?(:header_tags)
-                     Datadog.configuration.tracing.header_tags.request_tags(headers)
-                   else
-                     whitelist = configuration[:headers][:request] || []
-                     whitelist.each_with_object({}) do |header, result|
-                       header_value = headers.get(header)
-                       unless header_value.nil?
-                         header_tag = Tracing::Metadata::Ext::HTTP::RequestHeaders.to_tag(header)
-                         result[header_tag] = header_value
-                       end
-                     end
-                   end
+              Datadog.configuration.tracing.header_tags.request_tags(headers)
+            else
+              whitelist = configuration[:headers][:request] || []
+              whitelist.each_with_object({}) do |header, result|
+                header_value = headers.get(header)
+                unless header_value.nil?
+                  header_tag = Tracing::Metadata::Ext::HTTP::RequestHeaders.to_tag(header)
+                  result[header_tag] = header_value
+                end
+              end
+            end
 
             span.set_tags(tags)
+            tag_datadog_request_attribution_headers(span, headers)
           end
 
           def self.tag_response_headers(span, headers, configuration)
@@ -32,30 +40,45 @@ module Datadog
 
             # Use global DD_TRACE_HEADER_TAGS if integration-level configuration is not provided
             tags = if configuration.using_default?(:headers) && !Datadog.configuration.tracing.using_default?(:header_tags)
-                     Datadog.configuration.tracing.header_tags.response_tags(headers)
-                   else
-                     whitelist = configuration[:headers][:response] || []
-                     whitelist.each_with_object({}) do |header, result|
-                       header_value = headers[header]
-
-                       next if header_value.nil?
-
-                       header_tag = Tracing::Metadata::Ext::HTTP::ResponseHeaders.to_tag(header)
-
-                       # Maintain the value format between Rack 2 and 3
-                       #
-                       # Rack 2.x => { 'foo' => 'bar,baz' }
-                       # Rack 3.x => { 'foo' => ['bar', 'baz'] }
-                       result[header_tag] = if header_value.is_a? Array
-                                              header_value.join(',')
-                                            else
-                                              header_value
-                                            end
-                     end
-                   end
+              Datadog.configuration.tracing.header_tags.response_tags(headers)
+            else
+              whitelist = configuration[:headers][:response] || []
+              whitelist.each_with_object({}) do |header, result|
+                header_value = headers[header]
+
+                next if header_value.nil?
+
+                header_tag = Tracing::Metadata::Ext::HTTP::ResponseHeaders.to_tag(header)
+
+                # Maintain the value format between Rack 2 and 3
+                #
+                # Rack 2.x => { 'foo' => 'bar,baz' }
+                # Rack 3.x => { 'foo' => ['bar', 'baz'] }
+                result[header_tag] = if header_value.is_a? Array
+                  header_value.join(',')
+                else
+                  header_value
+                end
+              end
+            end
 
             span.set_tags(tags)
           end
+
+          # Datadog-originated requests use these headers for request attribution.
+          # They are tagged independently of user-configured header tagging so
+          # downstream systems can distinguish them from regular application traffic.
+          #
+          # @api private
+          private_class_method def self.tag_datadog_request_attribution_headers(span, headers)
+            DATADOG_REQUEST_ATTRIBUTION_HEADERS.each do |header|
+              header_value = headers.get(header)
+              next unless header_value
+
+              header_tag = Tracing::Metadata::Ext::HTTP::RequestHeaders.to_tag(header)
+              span.set_tag(header_tag, header_value)
+            end
+          end
         end
       end
     end

data/lib/datadog/tracing/contrib/rack/integration.rb

@@ -19,7 +19,7 @@ module Datadog
           register_as :rack, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['rack'] && Gem.loaded_specs['rack'].version
+            Gem.loaded_specs['rack']&.version
           end
 
           def self.loaded?

data/lib/datadog/tracing/contrib/rack/middlewares.rb

@@ -13,6 +13,7 @@ require_relative 'ext'
 require_relative 'header_collection'
 require_relative 'header_tagging'
 require_relative 'request_queue'
+require_relative 'route_inference'
 require_relative 'trace_proxy_middleware'
 
 module Datadog
@@ -47,7 +48,7 @@ module Datadog
             end
 
             TraceProxyMiddleware.call(env, configuration) do
-              trace_options = { type: Tracing::Metadata::Ext::HTTP::TYPE_INBOUND }
+              trace_options = {type: Tracing::Metadata::Ext::HTTP::TYPE_INBOUND}
               trace_options[:service] = configuration[:service_name] if configuration[:service_name]
 
               # start a new request span and attach it to the current Rack environment;
@@ -80,7 +81,7 @@ module Datadog
               # catch exceptions that may be raised in the middleware chain
               # Note: if a middleware catches an Exception without re raising,
               # the Exception cannot be recorded here.
-              request_span.set_error(e) unless request_span.nil?
+              request_span&.set_error(e)
               raise e
             ensure
               env[Ext::RACK_ENV_REQUEST_SPAN] = previous_request_span if previous_request_span
@@ -123,7 +124,7 @@ module Datadog
             # 4. Fallback with verb + status, eq `GET 200`
             request_span.resource ||=
               if configuration[:middleware_names] && env['RESPONSE_MIDDLEWARE']
-                "#{env['RESPONSE_MIDDLEWARE']}##{original_request_method}"
+                "#{env["RESPONSE_MIDDLEWARE"]}##{original_request_method}"
               elsif trace.resource_override?
                 trace.resource
               else
@@ -134,32 +135,12 @@ module Datadog
             # Otherwise, the getter method would delegate to its root span
             trace.resource = request_span.resource unless trace.resource_override?
 
+            request_span.set_tag(Tracing::Metadata::Ext::TAG_SVC_SRC, Ext::TAG_COMPONENT)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_COMPONENT, Ext::TAG_COMPONENT)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_OPERATION, Ext::TAG_OPERATION_REQUEST)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_KIND, Tracing::Metadata::Ext::SpanKind::TAG_SERVER)
 
-            if status != 404 && (last_route = trace.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE))
-              last_script_name = trace.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || ''
-
-              # If the last_script_name is empty but the env['SCRIPT_NAME'] is NOT empty
-              # then the current rack request was not routed and must be accounted for
-              # which only happens in pure nested rack requests i.e /rack/rack/hello/world
-              #
-              # To account for the unaccounted nested rack requests of /rack/hello/world,
-              # we use 'PATH_INFO knowing that rack cannot have named parameters
-              if last_script_name == '' && env['SCRIPT_NAME'] && env['SCRIPT_NAME'] != ''
-                last_script_name = last_route
-                last_route = env['PATH_INFO']
-              end
-
-              # Clear the route and route path tags from the request trace to avoid possibility of misplacement
-              trace.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE)
-              trace.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH)
-
-              # Ensure tags are placed in rack.request span as desired
-              request_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE, last_script_name + last_route)
-              request_span.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH)
-            end
+            set_route_and_endpoint_tags(trace: trace, request_span: request_span, status: status, env: env)
 
             # Set analytics sample rate
             if Contrib::Analytics.enabled?(configuration[:analytics_enabled])
@@ -218,16 +199,14 @@ module Datadog
               request_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_USER_AGENT, user_agent)
             end
 
-            if request_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE).nil? && status != 404
-              request_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE, env['PATH_INFO'])
-            end
-
             HeaderTagging.tag_request_headers(request_span, request_header_collection, configuration)
             HeaderTagging.tag_response_headers(request_span, headers, configuration) if headers
 
             # detect if the status code is a 5xx and flag the request span as an error
             # unless it has been already set by the underlying framework
-            request_span.status = 1 if status.to_s.start_with?('5') && request_span.status.zero?
+            if request_span.status.zero? && Datadog.configuration.tracing.http_error_statuses.server.include?(status)
+              request_span.status = Tracing::Metadata::Ext::Errors::STATUS
+            end
           end
           # rubocop:enable Metrics/AbcSize
           # rubocop:enable Metrics/CyclomaticComplexity
@@ -240,16 +219,74 @@ module Datadog
             Datadog.configuration.tracing[:rack]
           end
 
+          # rubocop:disable Metrics/AbcSize
+          # rubocop:disable Metrics/MethodLength
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/PerceivedComplexity
+          def set_route_and_endpoint_tags(trace:, request_span:, status:, env:)
+            return if status == 404
+
+            if (last_route = trace.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE))
+              last_script_name = trace.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || ''
+
+              # This happens when processing requests to a nested rack application,
+              # when parent app is instrumented, and the nested app is not instrumented
+              #
+              # When resource_renaming.always_simplified_endpoint is set to true,
+              # we infer the route from the full request path.
+              if last_script_name == '' && env['SCRIPT_NAME'] != '' &&
+                  !Datadog.configuration.tracing.resource_renaming.always_simplified_endpoint &&
+                  (inferred_route = RouteInference.infer(env['PATH_INFO']))
+                set_endpoint_tag(request_span, last_route + inferred_route)
+              end
+
+              # Clear the route and route path tags from the request trace to avoid possibility of misplacement
+              trace.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE)
+              trace.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH)
+
+              # Ensure tags are placed in rack.request span as desired
+              request_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE, last_script_name + last_route)
+              request_span.clear_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH)
+            end
+
+            if Datadog.configuration.tracing.resource_renaming.always_simplified_endpoint ||
+                request_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE).nil?
+              if (inferred_route = RouteInference.read_or_infer(env))
+                set_endpoint_tag(request_span, inferred_route) if inferred_route
+              end
+            elsif !request_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ENDPOINT)
+              set_endpoint_tag(request_span, request_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE))
+            end
+          end
+          # rubocop:enable Metrics/AbcSize
+          # rubocop:enable Metrics/MethodLength
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/PerceivedComplexity
+
+          def set_endpoint_tag(request_span, value)
+            # In the first iteration, http.endpoint must be reported in 2 cases:
+            #   1. resource renaming is enabled
+            #   2. AppSec is enabled and resource renaming is disabled (by default, not explicitly)
+            if Datadog.configuration.tracing.resource_renaming.enabled ||
+                Datadog.configuration.respond_to?(:appsec) &&
+                    Datadog.configuration.appsec&.enabled &&
+                    Datadog.configuration.tracing.resource_renaming.options[:enabled].default_precedence?
+              request_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_ENDPOINT, value)
+            end
+          end
+
+          # rubocop:disable Metrics/AbcSize
+          # rubocop:disable Metrics/MethodLength
           def parse_url(env, original_env)
             request_obj = ::Rack::Request.new(env)
 
             # scheme, host, and port
             base_url = if request_obj.respond_to?(:base_url)
-                         request_obj.base_url
-                       else
-                         # Compatibility for older Rack versions
-                         request_obj.url.chomp(request_obj.fullpath)
-                       end
+              request_obj.base_url
+            else
+              # Compatibility for older Rack versions
+              request_obj.url.chomp(request_obj.fullpath)
+            end
 
             # https://github.com/rack/rack/blob/main/SPEC.rdoc
             #
@@ -269,18 +306,20 @@ module Datadog
             # prepended to PATH_INFO to reflect the correct user visible path.
             request_uri = env['REQUEST_URI'].to_s
             fullpath = if request_uri.empty?
-                         query_string = original_env['QUERY_STRING'].to_s
-                         path = original_env['SCRIPT_NAME'].to_s + original_env['PATH_INFO'].to_s
-
-                         query_string.empty? ? path : "#{path}?#{query_string}"
-                       else
-                         # normally REQUEST_URI starts at the path, but it
-                         # might contain the full URL in some cases (e.g WEBrick)
-                         request_uri.delete_prefix(base_url)
-                       end
+              query_string = original_env['QUERY_STRING'].to_s
+              path = original_env['SCRIPT_NAME'].to_s + original_env['PATH_INFO'].to_s
+
+              query_string.empty? ? path : "#{path}?#{query_string}"
+            else
+              # normally REQUEST_URI starts at the path, but it
+              # might contain the full URL in some cases (e.g WEBrick)
+              request_uri.delete_prefix(base_url)
+            end
 
             base_url + fullpath
           end
+          # rubocop:enable Metrics/AbcSize
+          # rubocop:enable Metrics/MethodLength
 
           def parse_user_agent_header(headers)
             headers.get(Tracing::Metadata::Ext::HTTP::HEADER_USER_AGENT)

data/lib/datadog/tracing/contrib/rack/patcher.rb

@@ -41,11 +41,11 @@ module Datadog
             # context of middleware patching outside a Rails server process (eg. a
             # process that doesn't serve HTTP requests but has Rails environment
             # loaded such as a Resque master process)
-            Datadog.logger.debug("Error patching middleware stack: #{e}")
+            Datadog.logger.debug("Error patching middleware stack: #{e.class}: #{e.message}")
           end
 
           def retain_middleware_name(middleware)
-            return unless middleware && middleware.respond_to?(:call)
+            return unless middleware&.respond_to?(:call)
 
             middleware.singleton_class.class_eval do
               alias_method :__call, :call

data/lib/datadog/tracing/contrib/rack/request_queue.rb

@@ -24,6 +24,7 @@ module Datadog
             # nginx header is seconds in the format "t=1512379167.574"
             # apache header is microseconds in the format "t=1570633834463123"
             # heroku header is milliseconds in the format "1570634024294"
+            # @see https://github.com/heroku/vegur/blob/65d168f757e0ddb448f41cfb9e4b0281c747378d/README.md?plain=1#L383-L384
             time_string = header.to_s.delete('^0-9')
             return if time_string.nil?
 
@@ -34,11 +35,11 @@ module Datadog
             # return the request_start only if it's lesser than
             # current time, to avoid significant clock skew
             request_start = Time.at(time_value)
-            request_start.utc > now ? nil : request_start
-          rescue StandardError => e
+            (request_start.utc > now) ? nil : request_start
+          rescue => e
             # in case of an Exception we don't create a
             # `request.queuing` span
-            Datadog.logger.debug("[rack] unable to parse request queue headers: #{e}")
+            Datadog.logger.debug("[rack] unable to parse request queue headers: #{e.class}: #{e.message}")
             nil
           end
         end

data/lib/datadog/tracing/contrib/rack/route_inference.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative '../../../ruby_version'
+
+module Datadog
+  module Tracing
+    module Contrib
+      module Rack
+        # This module provides logic for inferring HTTP route pattern
+        # from an HTTP path.
+        module RouteInference
+          MAX_NUMBER_OF_SEGMENTS = 8
+
+          INT_PARAM_REGEX = /\A[0-9]+\z/.freeze
+          INT_ID_PARAM_REGEX = /\A(?=.*\d)[\d._-]{3,}\z/.freeze
+          HEX_PARAM_REGEX = /\A(?=.*\d)[A-Fa-f0-9]{6,}\z/.freeze
+          HEX_ID_PARAM_REGEX = /\A(?=.*\d)[A-Fa-f0-9._-]{6,}\z/.freeze
+          STRING_PARAM_REGEX = /\A.{20,}|.*[%&'()*+,:=@].*\z/.freeze
+
+          DATADOG_INFERRED_ROUTE_ENV_KEY = 'datadog.inferred_route'
+
+          module_function
+
+          def read_or_infer(request_env)
+            request_env[DATADOG_INFERRED_ROUTE_ENV_KEY] ||=
+              infer(request_env['SCRIPT_NAME'].to_s + request_env['PATH_INFO'].to_s)
+          end
+
+          def infer(path)
+            count = 0
+            result = []
+
+            split(path, '/') do |segment|
+              next if segment.empty?
+              break if count >= MAX_NUMBER_OF_SEGMENTS
+              count += 1
+
+              result << case segment
+              when INT_PARAM_REGEX then '{param:int}'
+              when INT_ID_PARAM_REGEX then '{param:int_id}'
+              when HEX_PARAM_REGEX then '{param:hex}'
+              when HEX_ID_PARAM_REGEX then '{param:hex_id}'
+              when STRING_PARAM_REGEX then '{param:str}'
+              else segment
+              end
+            end
+
+            result.empty? ? '/' : "/#{result.join('/')}"
+          rescue
+            nil
+          end
+
+          if RubyVersion.is?('>= 2.6')
+            def split(path, pattern = nil, &block)
+              path.split(pattern, &block)
+            end
+          else
+            def split(path, pattern = nil, &block)
+              path.split(pattern).each(&block)
+              path
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/tracing/contrib/rack/trace_proxy_middleware.rb

@@ -13,7 +13,11 @@ module Datadog
         module TraceProxyMiddleware
           module_function
 
-          def call(env, configuration)
+          def call(env, configuration, &block)
+            if configuration[:inferred_proxy_enabled] &&
+                (proxy_type = env[Ext::HEADER_X_DD_PROXY]) && !proxy_type.empty?
+              return call_with_inferred_proxy(env, proxy_type, &block)
+            end
             return yield unless configuration[:request_queuing]
 
             # parse the request queue time
@@ -28,12 +32,14 @@ module Datadog
 
             request_span = Tracing.trace(Ext::SPAN_HTTP_PROXY_REQUEST, **options)
 
+            request_span.set_tag(Tracing::Metadata::Ext::TAG_SVC_SRC, Ext::TAG_COMPONENT_HTTP_PROXY)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_COMPONENT, Ext::TAG_COMPONENT_HTTP_PROXY)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_OPERATION, Ext::TAG_OPERATION_HTTP_PROXY_REQUEST)
             request_span.set_tag(Tracing::Metadata::Ext::TAG_KIND, Tracing::Metadata::Ext::SpanKind::TAG_PROXY)
 
             queue_span = Tracing.trace(Ext::SPAN_HTTP_PROXY_QUEUE, **options)
 
+            queue_span.set_tag(Tracing::Metadata::Ext::TAG_SVC_SRC, Ext::TAG_COMPONENT_HTTP_PROXY)
             queue_span.set_tag(Tracing::Metadata::Ext::TAG_COMPONENT, Ext::TAG_COMPONENT_HTTP_PROXY)
             queue_span.set_tag(Tracing::Metadata::Ext::TAG_OPERATION, Ext::TAG_OPERATION_HTTP_PROXY_QUEUE)
             queue_span.set_tag(Tracing::Metadata::Ext::TAG_KIND, Tracing::Metadata::Ext::SpanKind::TAG_PROXY)
@@ -43,7 +49,125 @@ module Datadog
             # excluding the time spent processing the request itself
             queue_span.finish
 
-            yield.tap { request_span.finish }
+            yield
+          ensure
+            # Ensure that the spans are finished even if an exception is raised.
+            # **This is very important** to prevent the trace from leaking between requests,
+            # especially because `queue_span` is normally a root span.
+            queue_span&.finish
+            request_span&.finish
+          end
+
+          # Creates a virtual parent span representing the upstream proxy
+          # that wraps the actual request processing.
+          #
+          # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+          def call_with_inferred_proxy(env, proxy_type)
+            span_name = Ext::PROXY_SPAN_NAMES[proxy_type]
+            return yield unless span_name
+
+            request_time_ms = env[Ext::HEADER_X_DD_PROXY_REQUEST_TIME_MS].to_f
+            return yield unless request_time_ms.positive?
+
+            path = env[Ext::HEADER_X_DD_PROXY_PATH]
+            stage = env[Ext::HEADER_X_DD_PROXY_STAGE]
+            domain = env[Ext::HEADER_X_DD_PROXY_DOMAIN_NAME]
+            http_method = env[Ext::HEADER_X_DD_PROXY_HTTPMETHOD]
+            resource_path = env[Ext::HEADER_X_DD_PROXY_RESOURCE_PATH]
+
+            # NOTE: resource_path is the parameterized route (e.g. /users/{id}) vs literal path
+            resource = "#{http_method} #{resource_path || path}" if http_method
+
+            inferred_span = Tracing.trace(
+              span_name,
+              service: domain,
+              type: Tracing::Metadata::Ext::AppTypes::TYPE_WEB,
+              start_time: Time.at(request_time_ms / 1_000),
+            )
+            inferred_span.resource = resource if resource
+            inferred_span.set_tag(Tracing::Metadata::Ext::TAG_COMPONENT, proxy_type)
+            inferred_span.set_tag(Tracing::Metadata::Ext::TAG_KIND, Tracing::Metadata::Ext::SpanKind::TAG_SERVER)
+            inferred_span.set_tag('stage', stage) if stage
+            inferred_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_METHOD, http_method) if http_method
+            inferred_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_URL, "https://#{domain}#{path}") if domain && path
+            inferred_span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE, resource_path) if resource_path
+            inferred_span.set_metric(Ext::TAG_INFERRED_SPAN, 1)
+
+            set_optional_tags(inferred_span, env: env, proxy_type: proxy_type)
+
+            yield
+          # NOTE: The underlying {Rack::TraceMiddleware} rescues {Exception}
+          #       to tag the request span with error details.
+          #       We must propagate errors to the inferred proxy parent span.
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            inferred_span&.set_error(e)
+            raise
+          ensure
+            if inferred_span
+              propagate_request_span_tags(inferred_span, env: env)
+
+              if (trace = Tracing.active_trace) && resource
+                trace.resource = resource
+              end
+
+              inferred_span.finish
+            end
+          end
+          # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+          # Sets cloud provider metadata and constructs the resource ARN.
+          #
+          # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+          def set_optional_tags(span, env:, proxy_type:)
+            api_id = env[Ext::HEADER_X_DD_PROXY_API_ID]
+            region = env[Ext::HEADER_X_DD_PROXY_REGION]
+
+            # API Gateway v1 sends region as a single-quoted string
+            region = region.delete("'") if region
+
+            span.set_tag('apiid', api_id) if api_id
+            span.set_tag('region', region) if region
+
+            if (account_id = env[Ext::HEADER_X_DD_PROXY_ACCOUNT_ID])
+              span.set_tag('account_id', account_id)
+            end
+
+            if (user = env[Ext::HEADER_X_DD_PROXY_USER])
+              span.set_tag('aws_user', user)
+            end
+
+            if api_id && region
+              # NOTE: Update this when adding non-AWS proxy types.
+              restapi_prefix = (proxy_type == Ext::PROXY_AWS_APIGATEWAY) ? 'restapis' : 'apis'
+              span.set_tag('dd_resource_key', "arn:aws:apigateway:#{region}::/#{restapi_prefix}/#{api_id}")
+            end
+          end
+          # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+          # Propagates response-level and security tags from the request span to
+          # the inferred parent.
+          def propagate_request_span_tags(span, env:)
+            rack_span = env[Ext::RACK_ENV_REQUEST_SPAN]
+            return unless rack_span
+
+            if (status_code = rack_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_STATUS_CODE))
+              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_STATUS_CODE, status_code)
+              span.status = rack_span.status
+            end
+
+            if (user_agent = rack_span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_USER_AGENT))
+              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_USER_AGENT, user_agent)
+            end
+
+            # NOTE: Tracing shouldn't know about AppSec tags.
+            if (appsec_enabled = rack_span.get_metric('_dd.appsec.enabled'))
+              span.set_metric('_dd.appsec.enabled', appsec_enabled)
+            end
+
+            # NOTE: Tracing shouldn't know about AppSec tags.
+            if (appsec_json = rack_span.get_tag('_dd.appsec.json'))
+              span.set_tag('_dd.appsec.json', appsec_json)
+            end
           end
         end
       end