datadog 2.32.0 → 2.33.0

data/lib/datadog/appsec/contrib/aws_lambda/integration.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require_relative 'patcher'
+require_relative '../integration'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          register_as :aws_lambda, auto_patch: false
+
+          # NOTE: AWS Lambda is a runtime environment, not an installable gem
+          def self.version
+            nil
+          end
+
+          def self.loaded?
+            true
+          end
+
+          def self.compatible?
+            super
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/patcher.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative '../../monitor'
+require_relative 'gateway/watcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Monitor::Gateway::Watcher.watch
+            Gateway::Watcher.watch
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+require_relative '../../utils/http/media_type'
+require_relative '../../utils/http/body'
+require_relative '../../../core/utils/base64'
+require_relative '../../../core/header_collection'
+require_relative '../../../tracing/client_ip'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        # Extracts WAF input addresses from normalized AWS Lambda API Gateway event payloads.
+        # @api private
+        module WAFAddresses
+          module_function
+
+          def from_request(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              'server.request.cookies' => parse_cookies(payload, headers),
+              'server.request.query' => payload['query'],
+              'server.request.uri.raw' => build_fullpath(payload),
+              'server.request.headers' => headers,
+              'server.request.headers.no_cookies' => headers.dup.tap { |h| h.delete('cookie') },
+              'http.client_ip' => extract_client_ip(payload['source_ip'], headers),
+              'server.request.method' => payload['method'],
+              'server.request.body' => parse_body(payload, headers),
+              'server.request.path_params' => payload['path_params']
+            }
+
+            data.compact!
+            data
+          end
+
+          def from_response(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              'server.response.status' => payload['statusCode']&.to_s,
+              'server.response.headers' => headers,
+              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') }
+            }
+
+            data.compact!
+            data
+          end
+
+          def parse_headers(payload)
+            (payload['headers'] || {}).each_with_object({}) do |(key, value), hash|
+              hash[key.downcase] = value
+            end
+          end
+
+          def parse_cookies(payload, headers)
+            raw_pairs = payload['cookies'] || headers['cookie']&.split(';')
+            return unless raw_pairs
+
+            raw_pairs.each_with_object({}) do |pair, hash|
+              name, value = pair.strip.split('=', 2)
+              hash[name] = value if name
+            end
+          end
+
+          def build_fullpath(payload)
+            path = payload['path']
+            return unless path
+
+            query_string = build_query_string(payload)
+            query_string ? "#{path}?#{query_string}" : path
+          end
+
+          def build_query_string(payload)
+            query_string = payload['query_string']
+            return query_string if query_string && !query_string.empty?
+
+            query = payload['query']
+            return if query.nil? || query.empty?
+
+            URI.encode_www_form(query)
+          end
+
+          def extract_client_ip(remote_ip, headers)
+            header_collection = Datadog::Core::HeaderCollection.from_hash(headers)
+            Datadog::Tracing::ClientIp.extract_client_ip(header_collection, remote_ip)
+          end
+
+          def parse_body(payload, headers)
+            body = payload['body']
+            return unless body
+
+            body = Core::Utils::Base64.strict_decode64(body) if payload['base64_encoded']
+
+            content_type = headers['content-type']
+            return unless content_type
+
+            media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
+            return unless media_type
+
+            AppSec::Utils::HTTP::Body.parse(body, media_type: media_type)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec.rb

@@ -63,5 +63,6 @@ require_relative 'appsec/contrib/graphql/integration'
 require_relative 'appsec/contrib/faraday/integration'
 require_relative 'appsec/contrib/excon/integration'
 require_relative 'appsec/contrib/rest_client/integration'
+require_relative 'appsec/contrib/aws_lambda/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/core/configuration/settings.rb

@@ -171,6 +171,16 @@ module Datadog
           o.env Core::Environment::Ext::ENV_ENVIRONMENT
         end
 
+        # Override the hostname reported by this process.
+        # When `report_hostname` is enabled, sets the hostname on traces and
+        # the `host.name` resource attribute in OpenTelemetry.
+        # @default `DD_HOSTNAME` environment variable, otherwise `nil`
+        # @return [String,nil]
+        option :hostname do |o|
+          o.type :string, nilable: true
+          o.env Core::Environment::Ext::ENV_HOSTNAME
+        end
+
         # Configuration for container environments. For internal use only.
         # @!visibility private
         settings :container do

data/lib/datadog/core/configuration/supported_configurations.rb

@@ -61,6 +61,7 @@ module Datadog
           "DD_GIT_COMMIT_SHA",
           "DD_GIT_REPOSITORY_URL",
           "DD_HEALTH_METRICS_ENABLED",
+          "DD_HOSTNAME",
           "DD_INJECTION_ENABLED",
           "DD_INJECT_FORCE",
           "DD_INSTRUMENTATION_INSTALL_ID",
@@ -228,6 +229,7 @@ module Datadog
           "DD_TRACE_HTTP_ENABLED",
           "DD_TRACE_HTTP_ERROR_STATUS_CODES",
           "DD_TRACE_HTTP_SERVER_ERROR_STATUSES",
+          "DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED",
           "DD_TRACE_KAFKA_ANALYTICS_ENABLED",
           "DD_TRACE_KAFKA_ANALYTICS_SAMPLE_RATE",
           "DD_TRACE_KAFKA_ENABLED",

data/lib/datadog/core/environment/ext.rb

@@ -18,6 +18,7 @@ module Datadog
         ENV_API_KEY = 'DD_API_KEY'
         ENV_ENVIRONMENT = 'DD_ENV'
         ENV_EXTERNAL_ENV = 'DD_EXTERNAL_ENV'
+        ENV_HOSTNAME = 'DD_HOSTNAME'
         ENV_SERVICE = 'DD_SERVICE'
         ENV_SITE = 'DD_SITE'
         ENV_TAGS = 'DD_TAGS'

data/lib/datadog/core/environment/socket.rb

@@ -18,6 +18,19 @@ module Datadog
 
           @hostname ||= ::Socket.gethostname.freeze
         end
+
+        # Returns the resolved hostname when `report_hostname` is enabled:
+        # the configured DD_HOSTNAME if set, otherwise the system hostname.
+        # Returns nil when `report_hostname` is disabled or no hostname is available.
+        def resolved_hostname(settings)
+          return nil unless settings.tracing.report_hostname
+
+          configured = settings.hostname
+          return configured if configured && !configured.empty?
+
+          resolved_hostname = hostname
+          resolved_hostname if resolved_hostname && !resolved_hostname.empty?
+        end
       end
     end
   end

data/lib/datadog/opentelemetry/metrics.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../core/configuration/ext'
+require_relative '../core/environment/socket'
 
 module Datadog
   module OpenTelemetry
@@ -42,7 +43,6 @@ module Datadog
 
       def create_resource
         resource_attributes = {}
-        resource_attributes['host.name'] = Datadog::Core::Environment::Socket.hostname if @settings.tracing.report_hostname
 
         @settings.tags&.each do |key, value|
           otel_key = case key
@@ -58,6 +58,15 @@ module Datadog
         resource_attributes['deployment.environment'] = @settings.env if @settings.env
         resource_attributes['service.version'] = @settings.version if @settings.version
 
+        hostname = Datadog::Core::Environment::Socket.resolved_hostname(@settings)
+        if hostname
+          if hostname == @settings.hostname
+            resource_attributes['host.name'] = hostname
+          elsif !resource_attributes.key?('host.name')
+            resource_attributes['host.name'] = hostname
+          end
+        end
+
         ::OpenTelemetry::SDK::Resources::Resource.create(resource_attributes)
       end
 

data/lib/datadog/opentelemetry/sdk/id_generator.rb

@@ -1,23 +1,29 @@
 # frozen_string_literal: true
 
+require_relative '../../tracing/utils'
+
 module Datadog
   module OpenTelemetry
     module SDK
-      # Generates Datadog-compatible IDs for OpenTelemetry traces.
-      # OpenTelemetry traces already produce Datadog-compatible IDs.
+      # Generates Datadog-compatible trace IDs for OpenTelemetry spans.
+      #
+      # Reuses the same 128-bit ID format as non-OTel Datadog tracing:
+      #   [32-bit seconds since Epoch | 32 zero bits | 64 random bits]
+      #
+      # When DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED is false the high 64
+      # bits are zero, preserving the OTel 16-byte wire format while keeping
+      # backward compatibility with 64-bit Datadog trace IDs.
       class IdGenerator
         class << self
           include ::OpenTelemetry::Trace
 
-          # Generates a valid trace identifier, a 16-byte string with at least one
-          # non-zero byte.
-          #
-          # @return [String] a valid trace ID.
+          # @return [String] a valid 16-byte trace ID.
           def generate_trace_id
-            loop do
-              id = Random.bytes(8) # DEV: Change to 16 (16*8-byte) when 128-bit trace_id is supported.
-              return id unless id == ::OpenTelemetry::Trace::INVALID_SPAN_ID
-            end
+            trace_id = Tracing::Utils::TraceId.next_id
+            [
+              Tracing::Utils::TraceId.to_high_order(trace_id),
+              Tracing::Utils::TraceId.to_low_order(trace_id),
+            ].pack('Q>Q>')
           end
         end
       end

data/lib/datadog/profiling/component.rb

@@ -49,7 +49,6 @@ module Datadog
           valid_cpu_sampling_interval(settings.profiling.advanced.experimental_cpu_sampling_interval_ms, logger)
 
         recorder = Datadog::Profiling::StackRecorder.new(
-          cpu_time_enabled: RUBY_PLATFORM.include?("linux"), # Only supported on Linux currently
           alloc_samples_enabled: allocation_profiling_enabled,
           heap_samples_enabled: heap_profiling_enabled,
           heap_size_enabled: heap_size_profiling_enabled,

data/lib/datadog/profiling/stack_recorder.rb

@@ -9,7 +9,6 @@ module Datadog
     # Methods prefixed with _native_ are implemented in `stack_recorder.c`
     class StackRecorder
       def initialize(
-        cpu_time_enabled:,
         alloc_samples_enabled:,
         heap_samples_enabled:,
         heap_size_enabled:,
@@ -27,7 +26,6 @@ module Datadog
 
         self.class._native_initialize(
           self_instance: self,
-          cpu_time_enabled: cpu_time_enabled,
           alloc_samples_enabled: alloc_samples_enabled,
           heap_samples_enabled: heap_samples_enabled,
           heap_size_enabled: heap_size_enabled,
@@ -38,7 +36,6 @@ module Datadog
       end
 
       def self.for_testing(
-        cpu_time_enabled: true,
         alloc_samples_enabled: false,
         heap_samples_enabled: false,
         heap_size_enabled: false,
@@ -48,7 +45,6 @@ module Datadog
         **options
       )
         new(
-          cpu_time_enabled: cpu_time_enabled,
           alloc_samples_enabled: alloc_samples_enabled,
           heap_samples_enabled: heap_samples_enabled,
           heap_size_enabled: heap_size_enabled,

data/lib/datadog/symbol_database/extractor.rb

@@ -9,10 +9,6 @@ module Datadog
   module SymbolDatabase
     # Extracts symbol metadata from loaded Ruby modules and classes via introspection.
     #
-    # Instance created by Component with injected dependencies (logger, settings,
-    # telemetry). All methods are instance methods accessing @logger, @settings,
-    # @telemetry directly — no parameter threading needed.
-    #
     # Uses Ruby's reflection APIs (Module#constants, Class#instance_methods, Method#parameters)
     # to build hierarchical Scope structures representing code organization.
     # Filters to user code only (excludes gems, stdlib, test files).
@@ -46,10 +42,9 @@ module Datadog
     #    for post-hoc diagnosis, return nil or empty array. One bad method/module
     #    doesn't kill the entire class extraction.
     #
-    # 3. **Top-level entry rescues** (`rescue => e` with logging + telemetry):
+    # 3. **Top-level entry rescues** (`rescue => e` with logging):
     #    extract() and extract_all() are the error boundaries. Any exception that
-    #    escapes layers 1-2 is caught here, logged, and tracked via telemetry.
-    #    These are the only rescue blocks that increment telemetry counters.
+    #    escapes layers 1-2 is caught here and logged.
     #
     # @api private
     class Extractor
@@ -71,11 +66,11 @@ module Datadog
       EXCLUDED_COMMON_MODULES = ['Kernel', 'PP::', 'JSON::', 'Enumerable', 'Comparable'].freeze
 
       # RubyVM::InstructionSequence#trace_points event types included when
-      # computing injectable lines on METHOD scopes.
+      # computing targetable lines on METHOD scopes.
       # :line — any line with executable bytecode (primary line probe target)
       # :return — last expression before method returns (DI instruments return events)
       # :call excluded — method entry is handled by method probes, not line probes
-      INJECTABLE_LINE_EVENTS = [:line, :return].freeze
+      TARGETABLE_LINE_EVENTS = [:line, :return].freeze
 
       # Cached unbound Module#singleton_class? — dispatched explicitly so user classes
       # that define their own `singleton_class?` (e.g. with required arguments) cannot
@@ -87,11 +82,9 @@ module Datadog
 
       # @param logger [Logger] Logger instance (SymbolDatabase::Logger facade or compatible)
       # @param settings [Configuration::Settings] Tracer settings
-      # @param telemetry [Telemetry, nil] Optional telemetry for metrics
-      def initialize(logger:, settings:, telemetry: nil)
+      def initialize(logger:, settings:)
         @logger = logger
         @settings = settings
-        @telemetry = telemetry
       end
 
       # Extract symbols from a single module or class.
@@ -125,7 +118,6 @@ module Datadog
         wrap_in_file_scope(source_file, [inner_scope])
       rescue => e
         @logger.debug { "symdb: failed to extract #{mod_name || '<unknown>'}: #{e.class}: #{e.message}" }
-        @telemetry&.inc('tracers', 'symbol_database.extract_error', 1)
         nil
       end
 
@@ -147,7 +139,6 @@ module Datadog
         convert_trees_to_scopes(file_trees)
       rescue => e
         @logger.debug { "symdb: error in extract_all: #{e.class}: #{e.message}" }
-        @telemetry&.inc('tracers', 'symbol_database.extract_all_error', 1)
         []
       end
 
@@ -399,7 +390,7 @@ module Datadog
           location = method.source_location
           next unless location && location[0]
           starts << location[1]
-          _ranges, method_end = extract_injectable_lines(method, location[1])
+          _ranges, method_end = extract_targetable_lines(method, location[1])
           ends << method_end
         end
 
@@ -491,7 +482,7 @@ module Datadog
         source_file, line = location
         return nil unless user_code_path?(source_file)  # Skip gem/stdlib methods
 
-        injectable_lines, end_line = extract_injectable_lines(method, line)
+        targetable_lines, end_line = extract_targetable_lines(method, line)
 
         Scope.new(
           scope_type: 'METHOD',
@@ -499,7 +490,7 @@ module Datadog
           source_file: source_file,
           start_line: line,
           end_line: end_line,
-          injectible_lines: injectable_lines,
+          targetable_lines: targetable_lines,
           language_specifics: {
             visibility: method_visibility(klass, method_name),
             method_type: method_type.to_s,
@@ -526,29 +517,29 @@ module Datadog
         end
       end
 
-      # Extract injectable lines and end_line from a method's bytecode.
+      # Extract targetable lines and end_line from a method's bytecode.
       # Returns [ranges, end_line] where ranges is an array of {start:, end:} hashes
       # or nil if iseq is unavailable (C-extension methods).
       # @param method [Method, UnboundMethod] The method
       # @param start_line [Integer] Fallback end_line if iseq unavailable
       # @return [Array(Array<Hash>, Integer), Array(nil, Integer)]
-      def extract_injectable_lines(method, start_line)
+      def extract_targetable_lines(method, start_line)
         iseq = RubyVM::InstructionSequence.of(method) # steep:ignore
         unless iseq
-          @logger.debug { "symdb: no iseq for #{method.name} (C extension or native), skipping injectable lines" }
+          @logger.debug { "symdb: no iseq for #{method.name} (C extension or native), skipping targetable lines" }
           return [nil, start_line]
         end
 
         lines = iseq.trace_points
-          .select { |_, event| INJECTABLE_LINE_EVENTS.include?(event) }
+          .select { |_, event| TARGETABLE_LINE_EVENTS.include?(event) }
           .map(&:first)
           .uniq
           .sort
 
         end_line = lines.max || start_line
-        ranges = build_injectable_ranges(lines)
+        ranges = build_targetable_ranges(lines)
         result = ranges.empty? ? nil : ranges
-        @logger.debug { "symdb: #{method.name} injectable lines: #{result ? "#{ranges.size} range(s), lines #{lines.first}..#{lines.last}" : 'none (no matching events)'}" }
+        @logger.debug { "symdb: #{method.name} targetable lines: #{result ? "#{ranges.size} range(s), lines #{lines.first}..#{lines.last}" : 'none (no matching events)'}" }
         [result, end_line]
       end
 
@@ -556,7 +547,7 @@ module Datadog
       # [4, 5, 6, 8, 10, 11] => [{start: 4, end: 6}, {start: 8, end: 8}, {start: 10, end: 11}]
       # @param lines [Array<Integer>] Sorted, deduplicated line numbers
       # @return [Array<Hash>] Array of {start:, end:} range hashes
-      def build_injectable_ranges(lines)
+      def build_targetable_ranges(lines)
         return [] if lines.empty?
 
         ranges = []
@@ -840,7 +831,7 @@ module Datadog
 
         source_file, line = location
 
-        injectable_lines, end_line = extract_injectable_lines(method, line)
+        targetable_lines, end_line = extract_targetable_lines(method, line)
 
         Scope.new(
           scope_type: 'METHOD',
@@ -848,7 +839,7 @@ module Datadog
           source_file: source_file,
           start_line: line,
           end_line: end_line,
-          injectible_lines: injectable_lines,
+          targetable_lines: targetable_lines,
           language_specifics: {
             visibility: klass ? method_visibility(klass, method_name) : 'public', # steep:ignore
             method_type: 'instance',

data/lib/datadog/symbol_database/scope.rb

@@ -22,9 +22,11 @@ module Datadog
         # - nil: not computed (source unreadable, native/C-extension method)
         # - []: computed but no executable lines found (comments/whitespace only)
         # - non-empty: computed, contains executable line ranges
-        # nil and [] both serialize as injectible_lines?: false on METHOD
-        # scopes. Key is absent on non-METHOD scopes.
-        :injectible_lines,
+        # nil and [] both serialize as has_injectible_lines: false on METHOD
+        # scopes. Key is absent on non-METHOD scopes. The wire format key
+        # name keeps the historical spelling +injectible+ for backend
+        # compatibility; the Ruby identifier is +targetable_lines+.
+        :targetable_lines,
         :language_specifics, :symbols, :scopes
 
       # Initialize a new Scope
@@ -33,7 +35,7 @@ module Datadog
       # @param source_file [String, nil] Path to source file
       # @param start_line [Integer, nil] Starting line number (UNKNOWN_MIN_LINE for unknown)
       # @param end_line [Integer, nil] Ending line number (UNKNOWN_MAX_LINE for entire file)
-      # @param injectible_lines [Array<Hash>, nil] Ranges of executable lines [{start:, end:}]
+      # @param targetable_lines [Array<Hash>, nil] Ranges of executable lines [{start:, end:}]
       # @param language_specifics [Hash, nil] Ruby-specific metadata
       # @param symbols [Array<Symbol>, nil] Symbols defined in this scope
       # @param scopes [Array<Scope>, nil] Nested child scopes
@@ -43,7 +45,7 @@ module Datadog
         source_file: nil,
         start_line: nil,
         end_line: nil,
-        injectible_lines: nil,
+        targetable_lines: nil,
         language_specifics: nil,
         symbols: nil,
         scopes: nil
@@ -53,15 +55,15 @@ module Datadog
         @source_file = source_file
         @start_line = start_line
         @end_line = end_line
-        @injectible_lines = injectible_lines
+        @targetable_lines = targetable_lines
         @language_specifics = language_specifics || {}
         @symbols = symbols || []
         @scopes = scopes || []
       end
 
-      # @return [Boolean] true when injectible_lines is non-nil and non-empty
-      def injectible_lines?
-        !injectible_lines.nil? && !injectible_lines.empty?
+      # @return [Boolean] true when targetable_lines is non-nil and non-empty
+      def targetable_lines?
+        !targetable_lines.nil? && !targetable_lines.empty?
       end
 
       # Convert scope to Hash for JSON serialization.
@@ -79,11 +81,13 @@ module Datadog
           scopes: scopes.empty? ? nil : scopes.map(&:to_h),
         }
         h.compact!
-        # Injectable lines only on METHOD scopes (per spec — not on CLASS/MODULE/FILE).
+        # Targetable lines only on METHOD scopes (per spec — not on CLASS/MODULE/FILE).
         # Always emit has_injectible_lines (even when false) on METHOD scopes.
+        # Wire format keeps the historical spelling +injectible+; Ruby identifier
+        # is +targetable_lines+.
         if scope_type == 'METHOD'
-          h[:has_injectible_lines] = injectible_lines? # steep:ignore ArgumentTypeMismatch
-          h[:injectible_lines] = injectible_lines if injectible_lines && !injectible_lines.empty?
+          h[:has_injectible_lines] = targetable_lines? # steep:ignore ArgumentTypeMismatch
+          h[:injectible_lines] = targetable_lines if targetable_lines && !targetable_lines.empty?
         end
         h
       end