datadog 2.32.0 → 2.34.0

data/lib/datadog/ai_guard/contrib/rails/patcher.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require_relative "../../../core/utils/only_once"
+require_relative "../rack/request_middleware"
+require_relative "../../../tracing/contrib"
+require_relative "../../../tracing/contrib/rack/middlewares"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module Rails
+        # Patcher for AI Guard on Rails. Inserts the AI Guard Rack middleware
+        # right after the Tracing Rack middleware so the request span is
+        # already active when AI Guard tags the client IP.
+        module Patcher
+          BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+
+          module_function
+
+          def patched?
+            !!Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            patch_before_initialize
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_before_initialize
+            ::ActiveSupport.on_load(:before_initialize) do
+              Datadog::AIGuard::Contrib::Rails::Patcher.before_initialize(self)
+            end
+          end
+
+          def before_initialize(app)
+            BEFORE_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Middleware must be added before the application is initialized.
+              # Otherwise the middleware stack will be frozen.
+              add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
+            end
+          end
+
+          def add_middleware(app)
+            if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
+              app.middleware.insert_after(
+                Datadog::Tracing::Contrib::Rack::TraceMiddleware,
+                Datadog::AIGuard::Contrib::Rack::RequestMiddleware
+              )
+            else
+              app.middleware.insert_before(0, Datadog::AIGuard::Contrib::Rack::RequestMiddleware)
+            end
+          end
+
+          def include_middleware?(middleware, app)
+            found = false
+
+            # find tracer middleware reference in Rails::Configuration::MiddlewareStackProxy
+            app.middleware.instance_variable_get(:@operations).each do |operation|
+              args = case operation
+              when Array
+                # rails 5.2
+                _op, args = operation
+                args
+              when Proc
+                if operation.binding.local_variables.include?(:args)
+                  # rails 6.0, 6.1
+                  operation.binding.local_variable_get(:args)
+                else
+                  # rails 7.0 uses ... to pass args
+                  # steep:ignore:start
+                  args_getter = Class.new do
+                    def method_missing(_op, *args) # standard:disable Style/MissingRespondToMissing
+                      args
+                    end
+                  end.new
+                  # steep:ignore:end
+                  operation.call(args_getter)
+                end
+              else
+                # unknown, pass through
+                []
+              end
+
+              found = true if args.include?(middleware)
+            end
+
+            found
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation.rb

@@ -16,6 +16,7 @@ module Datadog
               Tracing::Sampling::Ext::Decision::AI_GUARD
             )
             trace.set_tag(Ext::EVENT_TAG, true)
+            trace.set_tag(Ext::SERVICE_ENTRY_EXECUTED_TAG, "1")
 
             if (last_message = messages.last)
               if last_message.tool_call

data/lib/datadog/ai_guard/ext.rb

@@ -11,6 +11,7 @@ module Datadog
       REASON_TAG = "ai_guard.reason"
       BLOCKED_TAG = "ai_guard.blocked"
       EVENT_TAG = "ai_guard.event"
+      SERVICE_ENTRY_EXECUTED_TAG = "_dd.ai_guard.executed"
       METASTRUCT_TAG = "ai_guard"
     end
   end

data/lib/datadog/ai_guard.rb

@@ -3,6 +3,8 @@
 require_relative "core/configuration"
 require_relative "ai_guard/configuration"
 
+require_relative "ai_guard/contrib/rack/integration"
+require_relative "ai_guard/contrib/rails/integration"
 require_relative "ai_guard/contrib/ruby_llm/integration"
 
 module Datadog
@@ -50,6 +52,10 @@ module Datadog
         Datadog.send(:components).ai_guard&.logger
       end
 
+      def telemetry
+        Datadog.send(:components).ai_guard&.telemetry
+      end
+
       # Evaluates one or more messages using AI Guard API.
       #
       # Example:
@@ -171,3 +177,5 @@ module Datadog
     end
   end
 end
+
+require_relative "ai_guard/autoload"

data/lib/datadog/appsec/component.rb

@@ -46,7 +46,10 @@ module Datadog
 
           security_engine = SecurityEngine::Engine.new(appsec_settings: settings.appsec, telemetry: telemetry)
           new(security_engine: security_engine)
-        rescue => e
+        # NOTE: At this point we should capture all possible exceptions and
+        #       gracefully fail component initialization, preventing propagation
+        #       into the host application code.
+        rescue Exception => e # standard:disable Lint/RescueException
           Datadog.logger.warn("AppSec is disabled: #{e.class}: #{e.message}; there may be additional logged errors above")
 
           # Not reporting to telemetry here because some of the rescued exceptions

data/lib/datadog/appsec/compressed_json.rb

@@ -4,7 +4,7 @@ require 'json'
 require 'zlib'
 require 'stringio'
 
-require_relative '../core/utils/base64'
+require_relative '../core/utils/base64_codec'
 
 module Datadog
   module AppSec
@@ -27,7 +27,7 @@ module Datadog
       end
 
       private_class_method def self.compress_and_encode(payload)
-        Core::Utils::Base64.strict_encode64(
+        Core::Utils::Base64Codec.strict_encode64(
           Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
         )
       rescue Zlib::Error, TypeError => e

data/lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative '../waf_addresses'
+require_relative '../../../event'
+require_relative '../../../trace_keeper'
+require_relative '../../../security_event'
+require_relative '../../../instrumentation/gateway'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        module Gateway
+          module Watcher
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request(gateway)
+                watch_response(gateway)
+              end
+
+              def watch_request(gateway = Instrumentation.gateway)
+                gateway.watch('aws_lambda.request.start') do |stack, payload|
+                  context = payload.context
+                  next stack.call(payload) unless context
+
+                  persistent_data = WAFAddresses.from_request(payload.data)
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match? || !result.attributes.empty?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+                  end
+
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(payload)
+                end
+              end
+
+              def watch_response(gateway = Instrumentation.gateway)
+                gateway.watch('aws_lambda.response.start') do |stack, payload|
+                  context = payload.context
+                  next stack.call(payload) unless context
+
+                  persistent_data = WAFAddresses.from_response(payload.data)
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(payload)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/integration.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require_relative 'patcher'
+require_relative '../integration'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          register_as :aws_lambda, auto_patch: false
+
+          # NOTE: AWS Lambda is a runtime environment, not an installable gem
+          def self.version
+            nil
+          end
+
+          def self.loaded?
+            true
+          end
+
+          def self.compatible?
+            super
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/patcher.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative '../../monitor'
+require_relative 'gateway/watcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Monitor::Gateway::Watcher.watch
+            Gateway::Watcher.watch
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+require_relative '../../utils/http/media_type'
+require_relative '../../utils/http/body'
+require_relative '../../../core/utils/base64_codec'
+require_relative '../../../core/header_collection'
+require_relative '../../../tracing/client_ip'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module AwsLambda
+        # Extracts WAF input addresses from normalized AWS Lambda API Gateway event payloads.
+        # @api private
+        module WAFAddresses
+          module_function
+
+          def from_request(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              'server.request.cookies' => parse_cookies(payload, headers),
+              'server.request.query' => payload['query'],
+              'server.request.uri.raw' => build_fullpath(payload),
+              'server.request.headers' => headers,
+              'server.request.headers.no_cookies' => headers.dup.tap { |h| h.delete('cookie') },
+              'http.client_ip' => extract_client_ip(payload['source_ip'], headers),
+              'server.request.method' => payload['method'],
+              'server.request.body' => parse_body(payload, headers),
+              'server.request.path_params' => payload['path_params']
+            }
+
+            data.compact!
+            data
+          end
+
+          def from_response(payload)
+            return {} if payload.nil? || payload.empty?
+
+            headers = parse_headers(payload)
+            data = {
+              'server.response.status' => payload['status_code']&.to_s,
+              'server.response.headers' => headers,
+              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') }
+            }
+
+            data.compact!
+            data
+          end
+
+          def parse_headers(payload)
+            (payload['headers'] || {}).each_with_object({}) do |(key, value), hash|
+              hash[key.downcase] = value
+            end
+          end
+
+          def parse_cookies(payload, headers)
+            raw_pairs = payload['cookies'] || headers['cookie']&.split(';')
+            return unless raw_pairs
+
+            raw_pairs.each_with_object({}) do |pair, hash|
+              name, value = pair.strip.split('=', 2)
+              hash[name] = value if name
+            end
+          end
+
+          def build_fullpath(payload)
+            path = payload['path']
+            return unless path
+
+            query_string = build_query_string(payload)
+            query_string ? "#{path}?#{query_string}" : path
+          end
+
+          def build_query_string(payload)
+            query_string = payload['query_string']
+            return query_string if query_string && !query_string.empty?
+
+            query = payload['query']
+            return if query.nil? || query.empty?
+
+            URI.encode_www_form(query)
+          end
+
+          def extract_client_ip(remote_ip, headers)
+            header_collection = Datadog::Core::HeaderCollection.from_hash(headers)
+            Datadog::Tracing::ClientIp.extract_client_ip(header_collection, remote_ip)
+          end
+
+          def parse_body(payload, headers)
+            body = payload['body']
+            return unless body
+
+            body = Core::Utils::Base64Codec.strict_decode64(body) if payload['base64_encoded']
+
+            content_type = headers['content-type']
+            return unless content_type
+
+            media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
+            return unless media_type
+
+            AppSec::Utils::HTTP::Body.parse(body, media_type: media_type)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -13,7 +13,7 @@ module Datadog
             'cloudfront-viewer-ja3-fingerprint',
             'content-type',
             'user-agent',
-            'x-amzn-trace-Id',
+            'x-amzn-trace-id',
             'x-appgw-trace-id',
             'x-cloud-trace-context',
             'x-sigsci-requestid',

data/lib/datadog/appsec.rb

@@ -63,5 +63,6 @@ require_relative 'appsec/contrib/graphql/integration'
 require_relative 'appsec/contrib/faraday/integration'
 require_relative 'appsec/contrib/excon/integration'
 require_relative 'appsec/contrib/rest_client/integration'
+require_relative 'appsec/contrib/aws_lambda/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/core/configuration/components.rb

@@ -19,6 +19,8 @@ require_relative '../../profiling/component'
 require_relative '../../appsec/component'
 require_relative '../../ai_guard/component'
 require_relative '../../di/component'
+require_relative '../../symbol_database'
+require_relative '../../symbol_database/component'
 require_relative '../../open_feature/component'
 require_relative '../../error_tracking/component'
 require_relative '../crashtracking/component'
@@ -120,6 +122,7 @@ module Datadog
           :ai_guard,
           :agent_info,
           :data_streams,
+          :symbol_database,
           :open_feature
 
         def initialize(settings)
@@ -133,7 +136,7 @@ module Datadog
           self.class::PATCH_ONLY_ONCE.run do
             Utils::AtForkMonkeyPatch.apply!
             Utils::SpawnMonkeyPatch.apply!(
-              lineage_envs_provider: Core::Environment::Identity.method(:runtime_propagation_envs),
+              env_provider: Core::Environment::Identity.method(:runtime_propagation_envs),
             )
 
             # Register callback that calls Components.after_fork
@@ -171,6 +174,7 @@ module Datadog
           @ai_guard = Datadog::AIGuard::Component.build(settings, logger: @logger, telemetry: telemetry)
           @open_feature = OpenFeature::Component.build(settings, agent_settings, logger: @logger, telemetry: telemetry)
           @dynamic_instrumentation = Datadog::DI::Component.build(settings, agent_settings, @logger, telemetry: telemetry)
+          @symbol_database = Datadog::SymbolDatabase::Component.build(settings, agent_settings, @logger, telemetry: telemetry)
           @error_tracking = Datadog::ErrorTracking::Component.build(settings, @tracer, @logger)
           @data_streams = self.class.build_data_streams(settings, agent_settings, @logger, @agent_info)
           @environment_logger_extra[:dynamic_instrumentation_enabled] = !!@dynamic_instrumentation
@@ -241,6 +245,9 @@ module Datadog
           # Shutdown DI after remote, since remote config triggers DI operations.
           dynamic_instrumentation&.shutdown!
 
+          # Shutdown Symbol Database
+          symbol_database&.shutdown!
+
           # Shutdown OpenFeature component
           open_feature&.shutdown!
 

data/lib/datadog/core/configuration/settings.rb

@@ -6,6 +6,7 @@ require_relative 'base'
 require_relative 'ext'
 require_relative '../environment/execution'
 require_relative '../environment/ext'
+require_relative '../environment/process'
 require_relative '../runtime/ext'
 require_relative '../telemetry/ext'
 require_relative '../remote/ext'
@@ -171,6 +172,16 @@ module Datadog
           o.env Core::Environment::Ext::ENV_ENVIRONMENT
         end
 
+        # Override the hostname reported by this process.
+        # When `report_hostname` is enabled, sets the hostname on traces and
+        # the `host.name` resource attribute in OpenTelemetry.
+        # @default `DD_HOSTNAME` environment variable, otherwise `nil`
+        # @return [String,nil]
+        option :hostname do |o|
+          o.type :string, nilable: true
+          o.env Core::Environment::Ext::ENV_HOSTNAME
+        end
+
         # Configuration for container environments. For internal use only.
         # @!visibility private
         settings :container do
@@ -682,12 +693,16 @@ module Datadog
           o.env Core::Environment::Ext::ENV_SERVICE
           o.default Core::Environment::Ext::FALLBACK_SERVICE_NAME
 
+          o.after_set do |service_name|
+            Core::Environment::Process.set_service(service_name, user_configured: !using_default?(:service))
+          end
+
           # There's a few cases where we don't want to use the fallback service name, so this helper allows us to get a
           # nil instead so that one can do
           # nice_service_name = Datadog.configuration.service_without_fallback || nice_service_name_default
           o.helper(:service_without_fallback) do
             service_name = service
-            service_name unless service_name.equal?(Core::Environment::Ext::FALLBACK_SERVICE_NAME)
+            service_name unless using_default?(:service)
           end
         end
 

data/lib/datadog/core/configuration/supported_configurations.rb

@@ -61,6 +61,7 @@ module Datadog
           "DD_GIT_COMMIT_SHA",
           "DD_GIT_REPOSITORY_URL",
           "DD_HEALTH_METRICS_ENABLED",
+          "DD_HOSTNAME",
           "DD_INJECTION_ENABLED",
           "DD_INJECT_FORCE",
           "DD_INSTRUMENTATION_INSTALL_ID",
@@ -69,6 +70,7 @@ module Datadog
           "DD_INSTRUMENTATION_TELEMETRY_ENABLED",
           "DD_INTERNAL_FORCE_SYMBOL_DATABASE_UPLOAD",
           "DD_LOGS_INJECTION",
+          "DD_LOGS_OTEL_ENABLED",
           "DD_METRICS_OTEL_ENABLED",
           "DD_METRIC_AGENT_PORT",
           "DD_PROFILING_ALLOCATION_ENABLED",
@@ -228,6 +230,7 @@ module Datadog
           "DD_TRACE_HTTP_ENABLED",
           "DD_TRACE_HTTP_ERROR_STATUS_CODES",
           "DD_TRACE_HTTP_SERVER_ERROR_STATUSES",
+          "DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED",
           "DD_TRACE_KAFKA_ANALYTICS_ENABLED",
           "DD_TRACE_KAFKA_ANALYTICS_SAMPLE_RATE",
           "DD_TRACE_KAFKA_ENABLED",
@@ -348,8 +351,16 @@ module Datadog
           "DD_TRACE_WATERDROP_ENABLED",
           "DD_TRACE_X_DATADOG_TAGS_MAX_LENGTH",
           "DD_VERSION",
+          "OTEL_BLRP_EXPORT_TIMEOUT",
+          "OTEL_BLRP_MAX_EXPORT_BATCH_SIZE",
+          "OTEL_BLRP_MAX_QUEUE_SIZE",
+          "OTEL_BLRP_SCHEDULE_DELAY",
           "OTEL_EXPORTER_OTLP_ENDPOINT",
           "OTEL_EXPORTER_OTLP_HEADERS",
+          "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT",
+          "OTEL_EXPORTER_OTLP_LOGS_HEADERS",
+          "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
+          "OTEL_EXPORTER_OTLP_LOGS_TIMEOUT",
           "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
           "OTEL_EXPORTER_OTLP_METRICS_HEADERS",
           "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL",
@@ -357,6 +368,7 @@ module Datadog
           "OTEL_EXPORTER_OTLP_METRICS_TIMEOUT",
           "OTEL_EXPORTER_OTLP_PROTOCOL",
           "OTEL_EXPORTER_OTLP_TIMEOUT",
+          "OTEL_LOGS_EXPORTER",
           "OTEL_LOG_LEVEL",
           "OTEL_METRICS_EXPORTER",
           "OTEL_METRIC_EXPORT_INTERVAL",

data/lib/datadog/core/environment/ext.rb

@@ -18,6 +18,7 @@ module Datadog
         ENV_API_KEY = 'DD_API_KEY'
         ENV_ENVIRONMENT = 'DD_ENV'
         ENV_EXTERNAL_ENV = 'DD_EXTERNAL_ENV'
+        ENV_HOSTNAME = 'DD_HOSTNAME'
         ENV_SERVICE = 'DD_SERVICE'
         ENV_SITE = 'DD_SITE'
         ENV_TAGS = 'DD_TAGS'
@@ -44,6 +45,10 @@ module Datadog
         TAG_RAILS_APPLICATION = "rails.application"
         TAG_PROCESS_TAGS = "_dd.tags.process"
         TAG_SERVICE = 'service'
+        # Service name was automatically populated by this library
+        TAG_SVC_AUTO = 'svc.auto'
+        # Service name was explicitly configured by the library user
+        TAG_SVC_USER = 'svc.user'
         TAG_VERSION = 'version'
 
         GEM_DATADOG_VERSION = Datadog::VERSION::STRING

data/lib/datadog/core/environment/identity.rb

@@ -76,7 +76,21 @@ module Datadog
           Core::Environment::Ext::GEM_DATADOG_VERSION
         end
 
-        # Returns tracer version, comforming to https://semver.org/spec/v2.0.0.html
+        # Returns the tracer version in SemVer-2 form (https://semver.org/spec/v2.0.0.html).
+        #
+        # Converts the RubyGems-style version returned by {.gem_datadog_version}
+        # (dot-separated prerelease/build segments, e.g. "2.34.0.dev") into the
+        # SemVer-2 form expected by cross-language Datadog consumers (hyphen-separated
+        # prerelease, "+" build metadata, e.g. "2.34.0-dev").
+        #
+        # Called by reporters that emit a tracer version on the wire and must match
+        # the format used by other-language tracers:
+        # - process discovery memfd (`Core::ProcessDiscovery.get_metadata` → `tracer_version`)
+        # - telemetry payloads (`Core::Telemetry::Request#application`)
+        # - remote configuration client identification (`Core::Remote::Client#tracer_version`)
+        #
+        # Use {.gem_datadog_version} (not this method) when a RubyGems-style string is
+        # required (e.g. gem-internal contexts, gemspec interop).
         def gem_datadog_version_semver2
           major, minor, patch, rest = gem_datadog_version.split('.', 4)