datadog 2.28.0 → 2.41.0

data/lib/datadog/appsec.rb

@@ -1,35 +1,31 @@
 # frozen_string_literal: true
 
-require_relative 'appsec/configuration'
-require_relative 'appsec/extensions'
-require_relative 'appsec/context'
-require_relative 'appsec/ext'
-require_relative 'appsec/utils'
+require_relative "appsec/configuration"
+require_relative "appsec/extensions"
+require_relative "appsec/context"
+require_relative "appsec/ext"
+require_relative "appsec/utils"
 
 module Datadog
   # Namespace for Datadog AppSec instrumentation
   module AppSec
     class << self
       def enabled?
-        Datadog.configuration.appsec.enabled
+        !!components.appsec
       end
 
       def rasp_enabled?
-        Datadog.configuration.appsec.rasp_enabled
+        # TODO this should take rasp_enabled flag from the settings in
+        # the appsec component rather than reading global configuration.
+        enabled? && Datadog.configuration.appsec.rasp_enabled
       end
 
       def active_context
         Datadog::AppSec::Context.active
       end
 
-      # NOTE:  This is a temporary workaround for type checking.
-      #
-      #        We want to move from possible nil-component to the disabled-component
-      #        on an initialization error. Technically, telemetry will be never
-      #        used if AppSec was not able to initialize, so it's safe to assume
-      #        that telemetry will never be used and will be nil at the same time.
       def telemetry
-        components.appsec&.telemetry || components.telemetry
+        components.telemetry
       end
 
       def security_engine
@@ -58,14 +54,15 @@ module Datadog
 end
 
 # Integrations
-require_relative 'appsec/contrib/rack/integration'
-require_relative 'appsec/contrib/sinatra/integration'
-require_relative 'appsec/contrib/rails/integration'
-require_relative 'appsec/contrib/active_record/integration'
-require_relative 'appsec/contrib/devise/integration'
-require_relative 'appsec/contrib/graphql/integration'
-require_relative 'appsec/contrib/faraday/integration'
-require_relative 'appsec/contrib/excon/integration'
-require_relative 'appsec/contrib/rest_client/integration'
+require_relative "appsec/contrib/rack/integration"
+require_relative "appsec/contrib/sinatra/integration"
+require_relative "appsec/contrib/rails/integration"
+require_relative "appsec/contrib/active_record/integration"
+require_relative "appsec/contrib/devise/integration"
+require_relative "appsec/contrib/graphql/integration"
+require_relative "appsec/contrib/faraday/integration"
+require_relative "appsec/contrib/excon/integration"
+require_relative "appsec/contrib/rest_client/integration"
+require_relative "appsec/contrib/aws_lambda/integration"
 
-require_relative 'appsec/autoload'
+require_relative "appsec/autoload"

data/lib/datadog/auto_instrument.rb

@@ -3,8 +3,8 @@
 # Entrypoint file for auto instrumentation.
 #
 # This file's path is part of the @public_api.
-require_relative '../datadog'
-require_relative 'tracing/contrib/auto_instrument'
+require_relative "../datadog"
+require_relative "tracing/contrib/auto_instrument"
 
 # DI is not loaded on Ruby 2.5 and JRuby
 Datadog::DI::Contrib.load_now_or_later if defined?(Datadog::DI::Contrib)

data/lib/datadog/core/buffer/cruby.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/buffer/thread_safe.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/configuration/agent_settings.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'ext'
+require_relative "ext"
 
 module Datadog
   module Core

data/lib/datadog/core/configuration/agent_settings_resolver.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require 'uri'
+require "uri"
 
-require_relative 'settings'
-require_relative 'ext'
-require_relative 'agent_settings'
-require_relative '../transport/ext'
+require_relative "settings"
+require_relative "ext"
+require_relative "agent_settings"
+require_relative "../transport/ext"
 
 module Datadog
   module Core
@@ -117,7 +117,7 @@ module Datadog
             ),
             try_parsing_as_integer(
               friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS} " \
-                'environment variable',
+                "environment variable",
               value: DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS],
             )
           )
@@ -141,7 +141,7 @@ module Datadog
         def parsed_url_ssl?
           return nil if parsed_url.nil?
 
-          parsed_url.scheme == 'https'
+          parsed_url.scheme == "https"
         end
 
         def try_parsing_as_integer(value:, friendly_name:)
@@ -189,10 +189,10 @@ module Datadog
           path = parsed_url.to_s
           # Some versions of the built-in uri gem leave the original url untouched, and others remove the //, so this
           # supports both
-          if path.start_with?('unix://')
-            path.sub('unix://', '')
+          if path.start_with?("unix://")
+            path.sub("unix://", "")
           else
-            path.sub('unix:', '')
+            path.sub("unix:", "")
           end
         end
 
@@ -232,11 +232,11 @@ module Datadog
             warn_if_configuration_mismatch(
               [
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration for unix domain socket',
+                  friendly_name: "configuration for unix domain socket",
                   value: parsed_url.to_s,
                 ),
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration of hostname/port for http/https use',
+                  friendly_name: "configuration of hostname/port for http/https use",
                   value: "hostname: '#{hostname}', port: '#{port}'",
                 ),
               ]
@@ -294,7 +294,7 @@ module Datadog
           return unless detected_configurations_in_priority_order.map(&:value).uniq.size > 1
 
           log_warning(
-            'Configuration mismatch: values differ between ' \
+            "Configuration mismatch: values differ between " \
             "#{detected_configurations_in_priority_order
               .map { |config| "#{config.friendly_name} (#{config.value.inspect})" }.join(" and ")}" \
             ". Using #{detected_configurations_in_priority_order.first.value.inspect} and ignoring other configuration."
@@ -306,7 +306,7 @@ module Datadog
         end
 
         def http_scheme?(uri)
-          ['http', 'https'].include?(uri.scheme)
+          ["http", "https"].include?(uri.scheme)
         end
 
         # Expected to return nil (not false!) when it's not http
@@ -315,7 +315,7 @@ module Datadog
         end
 
         def unix_scheme?(uri)
-          uri.scheme == 'unix'
+          uri.scheme == "unix"
         end
 
         # Represents a given configuration value and where we got it from

data/lib/datadog/core/configuration/agentless_settings_resolver.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# rubocop:disable Style/*
+# rubocop:disable Style
 
 require 'uri'
 
@@ -173,4 +173,4 @@ module Datadog
   end
 end
 
-# rubocop:enable Style/*
+# rubocop:enable Style

data/lib/datadog/core/configuration/base.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'options'
+require_relative "options"
 
 module Datadog
   module Core
@@ -24,9 +24,21 @@ module Datadog
           # e.g. `settings :foo { option :bar }` --> `config.foo.bar`
           # @param [Symbol] name option name. Methods will be created based on this name.
           def settings(name, &block)
-            settings_class = new_settings_class(name, &block)
-
-            option(name) do |o|
+            nested_settings_path = settings_path ? "#{settings_path}.#{name}" : name.to_s
+            settings_class = new_settings_class(name, nested_settings_path, &block)
+            # Record the child settings class on the owning class so
+            # Options::ClassMethods#settings_path= can later propagate any path
+            # changes down to nested settings classes.
+            #
+            # Example:
+            #   settings :cache_key { option :enabled }
+            # creates a child class whose initial settings_path is "cache_key".
+            # If a contrib integration later assigns the parent path to
+            # "tracing.active_support", settings_children lets us update the
+            # nested class to "tracing.active_support.cache_key" as well.
+            settings_children[name] = settings_class
+
+            option(name, is_settings: true) do |o|
               o.default { settings_class.new }
 
               o.resetter do |value|
@@ -40,9 +52,9 @@ module Datadog
 
           private
 
-          def new_settings_class(name, &block)
+          def new_settings_class(name, settings_path, &block)
             Class.new { include Configuration::Base }.tap do |klass|
-              klass.instance_variable_set(:@settings_name, name)
+              klass.instance_variable_set(:@settings_path, settings_path)
               klass.instance_eval(&block) if block
             end
           end
@@ -74,7 +86,7 @@ module Datadog
 
           # Retrieves a nested option from a list of symbols
           def dig(*options)
-            raise ArgumentError, 'expected at least one option' if options.empty?
+            raise ArgumentError, "expected at least one option" if options.empty?
 
             options.inject(self) do |receiver, option|
               receiver.send(option)

data/lib/datadog/core/configuration/components.rb

@@ -1,33 +1,42 @@
 # frozen_string_literal: true
 
-require_relative 'agent_settings_resolver'
-require_relative 'components_state'
-require_relative 'ext'
-require_relative 'deprecations'
-require_relative '../diagnostics/environment_logger'
-require_relative '../diagnostics/health'
-require_relative '../logger'
-require_relative '../runtime/metrics'
-require_relative '../telemetry/component'
-require_relative '../workers/runtime_metrics'
-require_relative '../remote/component'
-require_relative '../../tracing/component'
-require_relative '../../profiling/component'
-require_relative '../../appsec/component'
-require_relative '../../ai_guard/component'
-require_relative '../../di/component'
-require_relative '../../open_feature/component'
-require_relative '../../error_tracking/component'
-require_relative '../crashtracking/component'
-require_relative '../environment/agent_info'
-require_relative '../process_discovery'
-require_relative '../../data_streams/processor'
+require_relative "agent_settings_resolver"
+require_relative "components_state"
+require_relative "ext"
+require_relative "deprecations"
+require_relative "../diagnostics/environment_logger"
+require_relative "../diagnostics/health"
+require_relative "../logger"
+require_relative "../runtime/metrics"
+require_relative "../telemetry/component"
+require_relative "../workers/runtime_metrics"
+require_relative "../remote/component"
+require_relative "../utils/at_fork_monkey_patch"
+require_relative "../utils/spawn_monkey_patch"
+require_relative "../utils/only_once"
+require_relative "../../tracing/component"
+require_relative "../../profiling/component"
+require_relative "../../appsec/component"
+require_relative "../../ai_guard/component"
+require_relative "../../di/component"
+require_relative "../../symbol_database"
+require_relative "../../symbol_database/component"
+require_relative "../../open_feature/component"
+require_relative "../../error_tracking/component"
+require_relative "../crashtracking/component"
+require_relative "../environment/agent_info"
+require_relative "../environment/identity"
+require_relative "../process_discovery"
+require_relative "../../data_streams/processor"
 
 module Datadog
   module Core
     module Configuration
       # Global components for the trace library.
       class Components
+        # Class-level constant to ensure fork patch is applied only once
+        PATCH_ONLY_ONCE = Utils::OnlyOnce.new
+
         class << self
           def build_health_metrics(settings, logger, telemetry)
             settings = settings.health_metrics
@@ -37,8 +46,40 @@ module Datadog
             Core::Diagnostics::Health::Metrics.new(telemetry: telemetry, logger: logger, **options)
           end
 
+          # Decides whether to build the SymbolDatabase component, for the
+          # tri-state symbol_database.enabled setting: true/false are explicit
+          # overrides; nil (the default) mirrors Dynamic Instrumentation by
+          # building whenever DI's component was built. dynamic_instrumentation
+          # is DI's build result — nil only when DI is explicitly disabled or the
+          # runtime can't support it (Rails development mode, missing C
+          # extension, remote config off, non-MRI). Under the always-build model
+          # it is non-nil even when the DI setting defaults to off, so a built
+          # SymbolDatabase component is inert until an upload is actually
+          # permitted: the component's own gate (see Component#upload_allowed?)
+          # only extracts and uploads when DI is truly active or the customer
+          # opted in explicitly. This mirrors DI advertising/building a component
+          # by default while installing no probes until it is enabled.
+          # force_upload (internal/testing) always builds, since it uploads
+          # regardless of DI or the enabled setting.
+          # @param settings [Configuration::Settings]
+          # @param dynamic_instrumentation [DI::Component, nil]
+          # @return [Boolean]
+          def enable_symbol_database?(settings, dynamic_instrumentation)
+            # The symbol_database settings group is only registered on the full
+            # library load path; a partial load (e.g. require 'datadog/di') leaves
+            # it absent, in which case the feature cannot be enabled.
+            return false unless settings.respond_to?(:symbol_database)
+
+            # force_upload uploads unconditionally, so the component must be built
+            # even when the setting is nil and DI's component was not built.
+            return true if settings.symbol_database.internal.force_upload
+
+            # nil (the default) follows whether DI's component was built.
+            Datadog::SymbolDatabase.resolve_enabled(settings.symbol_database.enabled, !dynamic_instrumentation.nil?)
+          end
+
           def build_logger(settings)
-            logger = settings.logger.instance || Core::Logger.new($stdout)
+            logger = settings.logger.instance || Core::Logger.new($stderr)
             logger.level = settings.diagnostics.debug ? ::Logger::DEBUG : settings.logger.level
 
             logger
@@ -80,17 +121,18 @@ module Datadog
             Datadog::Core::Crashtracking::Component.build(settings, agent_settings, logger: logger)
           end
 
-          def build_data_streams(settings, agent_settings, logger)
+          def build_data_streams(settings, agent_settings, logger, agent_info)
             return unless settings.data_streams.enabled
 
             Datadog::DataStreams::Processor.new(
               interval: settings.data_streams.interval,
               logger: logger,
               settings: settings,
-              agent_settings: agent_settings
+              agent_settings: agent_settings,
+              agent_info: agent_info
             )
           rescue => e
-            logger.warn("Failed to initialize Data Streams Monitoring: #{e.class}: #{e}")
+            logger.warn("Failed to initialize Data Streams Monitoring: #{e.class}: #{e.message}")
             nil
           end
         end
@@ -112,6 +154,7 @@ module Datadog
           :ai_guard,
           :agent_info,
           :data_streams,
+          :symbol_database,
           :open_feature
 
         def initialize(settings)
@@ -121,6 +164,20 @@ module Datadog
           StableConfig.log_result(@logger)
           Deprecations.log_deprecations_from_all_sources(@logger)
 
+          # Register fork handling once globally
+          self.class::PATCH_ONLY_ONCE.run do
+            Utils::AtForkMonkeyPatch.apply!
+            Utils::SpawnMonkeyPatch.apply!(
+              env_provider: Core::Environment::Identity.method(:runtime_propagation_envs),
+            )
+
+            # Register callback that calls Components.after_fork
+            Utils::AtForkMonkeyPatch.at_fork(:child) do
+              # Access via global to avoid capturing 'self'
+              Datadog.send(:components, allow_initialization: false)&.after_fork
+            end
+          end
+
           # This agent_settings is intended for use within Core. If you require
           # agent_settings within a product outside of core you should extend
           # the Core resolver from within your product/component's namespace.
@@ -149,12 +206,48 @@ module Datadog
           @ai_guard = Datadog::AIGuard::Component.build(settings, logger: @logger, telemetry: telemetry)
           @open_feature = OpenFeature::Component.build(settings, agent_settings, logger: @logger, telemetry: telemetry)
           @dynamic_instrumentation = Datadog::DI::Component.build(settings, agent_settings, @logger, telemetry: telemetry)
+          # Only build symbol database when enabled, so a disabled component is
+          # never constructed.
+          @symbol_database =
+            if self.class.enable_symbol_database?(settings, @dynamic_instrumentation)
+              # di_active is a live predicate, not a snapshot: DI may start after
+              # this component is built (implicit enablement via remote config).
+              # Symbol Database holds only this opaque proc, never a DI reference,
+              # so the two modules stay independent — the orchestration layer
+              # owns the cross-feature knowledge.
+              Datadog::SymbolDatabase::Component.build(
+                settings, agent_settings, @logger,
+                telemetry: telemetry,
+                di_active: -> { dynamic_instrumentation&.started? || false },
+              )
+            end
           @error_tracking = Datadog::ErrorTracking::Component.build(settings, @tracer, @logger)
-          @data_streams = self.class.build_data_streams(settings, agent_settings, @logger)
-          @environment_logger_extra[:dynamic_instrumentation_enabled] = !!@dynamic_instrumentation
+          @data_streams = self.class.build_data_streams(settings, agent_settings, @logger, @agent_info)
+          # Reflects "the customer configured DI to be on" — true iff the
+          # component was built AND the env-var-driven enabled flag is set.
+          # This is the post-initialize / pre-startup value visible to tests
+          # that don't call startup!. Production overwrites this in startup!
+          # below with `dynamic_instrumentation&.started?`, which also accounts
+          # for RC-driven enablement carried over via ComponentsState.
+          @environment_logger_extra[:dynamic_instrumentation_enabled] =
+            !!(@dynamic_instrumentation && settings.dynamic_instrumentation.enabled)
 
           # Configure non-privileged components.
           Datadog::Tracing::Contrib::Component.configure(settings)
+
+          # Load the core Rails Railtie when Rails is present so all products benefit from Rails-specific setup.
+          if defined?(::Rails::Railtie)
+            require_relative "../contrib/rails/railtie"
+          end
+        end
+
+        # Called when a fork is detected
+        def after_fork
+          telemetry.after_fork
+          remote&.after_fork
+          crashtracker&.update_on_fork
+          ProcessDiscovery.after_fork
+          symbol_database&.after_fork!
         end
 
         # Hot-swaps with a new sampler.
@@ -179,14 +272,29 @@ module Datadog
             end
           end
 
-          if settings.remote.enabled && old_state&.remote_started?
+          if remote && old_state&.remote_started?
             # The library was reconfigured and previously it already started
             # the remote component (i.e., it received at least one request
             # through the installed Rack middleware which started the remote).
             # If the new configuration also has remote enabled, start the
             # new remote right away.
-            # remote should always be not nil here but steep doesn't know this.
-            remote&.start
+            remote.start
+          end
+
+          # Start DI component if enabled by env var or if it was implicitly enabled
+          # (via RC) in the previous Components instance. dynamic_instrumentation is
+          # non-nil only when Component.build's preconditions passed (Ruby 2.6+ MRI,
+          # etc.), which is exactly the condition under which di/base.rb is loaded
+          # and DI.activate_tracking is defined.
+          if dynamic_instrumentation
+            if settings.dynamic_instrumentation.enabled || old_state&.di_implicitly_enabled?
+              DI.activate_tracking
+              dynamic_instrumentation.start!
+              remote&.add_products(
+                *Datadog::DI::Remote.products,
+                *Datadog::SymbolDatabase::Remote.deferred_products(settings),
+              )
+            end
           end
 
           # This should stay here, not in initialize. During reconfiguration, the order of the calls is:
@@ -194,6 +302,8 @@ module Datadog
           # Because this is a singleton, if we call it in initialize, it will be shutdown right away.
           Core::ProcessDiscovery.publish(settings)
 
+          @environment_logger_extra[:dynamic_instrumentation_enabled] = dynamic_instrumentation&.started? || false
+
           Core::Diagnostics::EnvironmentLogger.collect_and_log!(@environment_logger_extra)
         end
 
@@ -207,6 +317,9 @@ module Datadog
           # Shutdown DI after remote, since remote config triggers DI operations.
           dynamic_instrumentation&.shutdown!
 
+          # Shutdown Symbol Database
+          symbol_database&.shutdown!
+
           # Shutdown OpenFeature component
           open_feature&.shutdown!
 
@@ -239,13 +352,13 @@ module Datadog
           # have direct ownership of it.
           old_statsd = [
             runtime_metrics.metrics.statsd,
-            health_metrics.statsd
+            health_metrics.statsd,
           ].compact.uniq
 
           new_statsd = if replacement
             [
               replacement.runtime_metrics.metrics.statsd,
-              replacement.health_metrics.statsd
+              replacement.health_metrics.statsd,
             ].compact.uniq
           else
             []
@@ -254,18 +367,35 @@ module Datadog
           unused_statsd = (old_statsd - (old_statsd & new_statsd))
           unused_statsd.each(&:close)
 
-          # enqueue closing event before stopping telemetry so it will be sent out on shutdown
+          Core::ProcessDiscovery.shutdown!
+
+          # Shut down telemetry last so that all other components may
+          # report shutdown errors.
+          #
+          # Enqueue closing event before stopping telemetry so it will be
+          # sent out on shutdown.
           telemetry.emit_closing! unless replacement&.telemetry&.enabled
           telemetry.shutdown!
-
-          Core::ProcessDiscovery.shutdown!
         end
 
         # Returns the current state of various components.
         def state
+          # di_implicitly_enabled distinguishes RC-driven start from explicit
+          # start (env var or programmatic) so that an explicit
+          # `enabled = false` on reconfiguration can take effect.
+          #
+          # using_default? — not `!enabled` — because Datadog.configure has
+          # already mutated the singleton settings by the time #state runs,
+          # so `!enabled` would treat a customer's explicit
+          # `enabled = false` as "implicitly enabled" and restart DI.
+          # using_default? asks "did the customer ever touch this setting",
+          # which is the right question for RC carry-over.
+          di_implicit = dynamic_instrumentation&.started? &&
+            @settings.dynamic_instrumentation.using_default?(:enabled)
           ComponentsState.new(
             telemetry_enabled: telemetry.enabled,
             remote_started: remote&.started?,
+            di_implicitly_enabled: di_implicit || false,
           )
         end
       end

data/lib/datadog/core/configuration/components_state.rb

@@ -5,9 +5,10 @@ module Datadog
     module Configuration
       # Stores the state of component tree when replacing the tree.
       class ComponentsState
-        def initialize(telemetry_enabled:, remote_started:)
+        def initialize(telemetry_enabled:, remote_started:, di_implicitly_enabled: false)
           @telemetry_enabled = !!telemetry_enabled
           @remote_started = !!remote_started
+          @di_implicitly_enabled = !!di_implicitly_enabled
         end
 
         def telemetry_enabled?
@@ -17,6 +18,10 @@ module Datadog
         def remote_started?
           @remote_started
         end
+
+        def di_implicitly_enabled?
+          @di_implicitly_enabled
+        end
       end
     end
   end

data/lib/datadog/core/configuration/config_helper.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'supported_configurations'
-require_relative '../logger'
+require_relative "supported_configurations"
+require_relative "../logger"
 
 module Datadog
   module Core
@@ -40,6 +40,12 @@ module Datadog
           !get_environment_variable(name).nil?
         end
 
+        # Returns the source environment as a Hash. Used when the full environment
+        # must be passed through (e.g. Process.spawn child env).
+        def to_h
+          @source_env.to_h
+        end
+
         alias_method :has_key?, :key?
         alias_method :include?, :key?
         alias_method :member?, :key?
@@ -56,7 +62,7 @@ module Datadog
           # datadog-ci-rb is using dd-trace-rb config DSL, which uses this method.
           # Until we've correctly implemented support for datadog-ci-rb, we disable config inversion if ci is enabled.
           if !defined?(::Datadog::CI) &&
-              (name.start_with?('DD_', 'OTEL_') || @alias_to_canonical[name]) &&
+              (name.start_with?("DD_", "OTEL_") || @alias_to_canonical[name]) &&
               !@supported_configurations.include?(name)
             if defined?(@raise_on_unknown_env_var) && @raise_on_unknown_env_var # Only enabled for tests!
               if @alias_to_canonical[name]
@@ -97,4 +103,7 @@ module Datadog
       end
     end
   end
+  unless const_defined?(:DATADOG_ENV, false)
+    DATADOG_ENV = Core::Configuration::ConfigHelper.new
+  end
 end