ddtrace 0.34.1 → 1.23.1

data/ext/datadog_profiling_native_extension/stack_recorder.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <datadog/profiling.h>
+#include <ruby.h>
+
+typedef struct {
+  int64_t cpu_time_ns;
+  int64_t wall_time_ns;
+  uint32_t cpu_or_wall_samples;
+  uint32_t alloc_samples;
+  int64_t timeline_wall_time_ns;
+} sample_values;
+
+typedef struct sample_labels {
+  ddog_prof_Slice_Label labels;
+
+  // This is used to allow the `Collectors::Stack` to modify the existing label, if any. This MUST be NULL or point
+  // somewhere inside the labels slice above.
+  ddog_prof_Label *state_label;
+
+  int64_t end_timestamp_ns;
+} sample_labels;
+
+void record_sample(VALUE recorder_instance, ddog_prof_Slice_Location locations, sample_values values, sample_labels labels);
+void record_endpoint(VALUE recorder_instance, uint64_t local_root_span_id, ddog_CharSlice endpoint);
+void track_object(VALUE recorder_instance, VALUE new_object, unsigned int sample_weight, ddog_CharSlice *alloc_class);
+VALUE enforce_recorder_instance(VALUE object);

data/ext/datadog_profiling_native_extension/time_helpers.c

@@ -0,0 +1,53 @@
+#include <errno.h>
+#include <time.h>
+
+#include "ruby_helpers.h"
+#include "time_helpers.h"
+
+// Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
+long retrieve_clock_as_ns(clockid_t clock_id, bool raise_on_failure) {
+  struct timespec clock_value;
+
+  if (clock_gettime(clock_id, &clock_value) != 0) {
+    if (raise_on_failure) ENFORCE_SUCCESS_GVL(errno);
+    return 0;
+  }
+
+  return clock_value.tv_nsec + SECONDS_AS_NS(clock_value.tv_sec);
+}
+
+long monotonic_wall_time_now_ns(bool raise_on_failure) { return retrieve_clock_as_ns(CLOCK_MONOTONIC, raise_on_failure); }
+long system_epoch_time_now_ns(bool raise_on_failure)   { return retrieve_clock_as_ns(CLOCK_REALTIME,  raise_on_failure); }
+
+// Design: The monotonic_to_system_epoch_state struct is kept somewhere by the caller, and MUST be initialized to
+// MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER.
+//
+// This function is used by the ThreadContext collector to convert monotonic wall time timestamps which are used
+// basically everywhere else in the codebase, into system epoch timestamps, which are needed by the timeline feature.
+//
+// There's a few ways we could have tackled this conversion, e.g. check the system clock on every call, or even
+// use system clock timestamps elsewhere in the code.
+// Using a system clock elsewhere has a few disadvantages (e.g. because it can move around if users adjust the system
+// time). I also wanted to avoid calling system_epoch_time_now_ns(...) on every conversion.
+//
+// Thus I arrived at this solution: we calculate a delta between the monotonic clock and the system clock, and use
+// that to convert the timestamps.
+//
+// To avoid the results of the system clock being off in cases where the system clock is adjusted while the profiler
+// is running, every ~60 seconds of observed monotonic wall time we recalculate the delta. This means that worst case
+// we'll have ~60 seconds of wrongly-timestamped data when the system clock jumps around, and in return we save the
+// overhead of having to look up the system clock on every call to this function.
+long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long monotonic_wall_time_ns) {
+  bool reference_needs_update =
+    (state->system_epoch_ns_reference == INVALID_TIME) ||
+    (state->delta_to_epoch_ns + monotonic_wall_time_ns > state->system_epoch_ns_reference + SECONDS_AS_NS(60));
+
+  if (reference_needs_update) {
+    state->system_epoch_ns_reference = system_epoch_time_now_ns(RAISE_ON_FAILURE);
+    long current_monotonic_wall_time_ns = monotonic_wall_time_now_ns(RAISE_ON_FAILURE);
+
+    state->delta_to_epoch_ns = state->system_epoch_ns_reference - current_monotonic_wall_time_ns;
+  }
+
+  return state->delta_to_epoch_ns + monotonic_wall_time_ns;
+}

data/ext/datadog_profiling_native_extension/time_helpers.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include <stdbool.h>
+
+#define SECONDS_AS_NS(value) (value * 1000 * 1000 * 1000L)
+#define MILLIS_AS_NS(value) (value * 1000 * 1000L)
+
+#define RAISE_ON_FAILURE true
+#define DO_NOT_RAISE_ON_FAILURE false
+
+#define INVALID_TIME -1
+
+typedef struct {
+  long system_epoch_ns_reference;
+  long delta_to_epoch_ns;
+} monotonic_to_system_epoch_state;
+
+#define MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER {.system_epoch_ns_reference = INVALID_TIME, .delta_to_epoch_ns = INVALID_TIME}
+
+// Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
+long monotonic_wall_time_now_ns(bool raise_on_failure);
+
+// Safety: This function is assumed never to raise exceptions by callers when raise_on_failure == false
+long system_epoch_time_now_ns(bool raise_on_failure);
+
+long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long monotonic_wall_time_ns);

data/lib/datadog/appsec/assets/blocked.html

@@ -0,0 +1,99 @@
+<!-- Sorry, you've been blocked -->
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>You've been blocked</title>
+    <style>
+        a,
+        body,
+        div,
+        html,
+        span {
+            margin: 0;
+            padding: 0;
+            border: 0;
+            font-size: 100%;
+            font: inherit;
+            vertical-align: baseline
+        }
+
+        body {
+            background: -webkit-radial-gradient(26% 19%, circle, #fff, #f4f7f9);
+            background: radial-gradient(circle at 26% 19%, #fff, #f4f7f9);
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-pack: center;
+            -ms-flex-pack: center;
+            justify-content: center;
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center;
+            -ms-flex-line-pack: center;
+            align-content: center;
+            width: 100%;
+            min-height: 100vh;
+            line-height: 1;
+            flex-direction: column
+        }
+
+        p {
+            display: block
+        }
+
+
+        main {
+            text-align: center;
+            flex: 1;
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-pack: center;
+            -ms-flex-pack: center;
+            justify-content: center;
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center;
+            -ms-flex-line-pack: center;
+            align-content: center;
+            flex-direction: column
+        }
+
+        p {
+            font-size: 18px;
+            line-height: normal;
+            color: #646464;
+            font-family: sans-serif;
+            font-weight: 400
+        }
+
+        a {
+            color: #4842b7
+        }
+
+        footer {
+            width: 100%;
+            text-align: center
+        }
+
+        footer p {
+            font-size: 16px
+        }
+    </style>
+</head>
+
+<body>
+    <main>
+        <p>Sorry, you cannot access this page. Please contact the customer service team.</p>
+    </main>
+    <footer>
+        <p>Security provided by <a
+                href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/"
+                target="_blank">Datadog</a></p>
+    </footer>
+</body>
+
+</html>

data/lib/datadog/appsec/assets/blocked.json

@@ -0,0 +1 @@
+{"errors": [{"title": "You've been blocked", "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}

data/lib/datadog/appsec/assets/blocked.text

@@ -0,0 +1,5 @@
+You've been blocked
+
+Sorry, you cannot access this page. Please contact the customer service team.
+
+Security provided by Datadog.

data/lib/datadog/appsec/assets/waf_rules/README.md

@@ -0,0 +1,7 @@
+Vendored WAF rules originate from https://github.com/datadog/appsec-event-rules
+
+One should check rule compatibility with libddwaf, which is the end consumer of
+these rules.
+
+There might be rules that look to be irrelevant to Ruby as they may still help
+identify bad actors.

data/lib/datadog/appsec/assets/waf_rules/processors.json

@@ -0,0 +1,92 @@
+[
+  {
+    "id": "processor-001",
+    "generator": "extract_schema",
+    "conditions": [
+      {
+        "operator": "equals",
+        "parameters": {
+          "inputs": [
+            {
+              "address": "waf.context.processor",
+              "key_path": [
+                "extract-schema"
+              ]
+            }
+          ],
+          "type": "boolean",
+          "value": true
+        }
+      }
+    ],
+    "parameters": {
+      "mappings": [
+        {
+          "inputs": [
+            {
+              "address": "server.request.body"
+            }
+          ],
+          "output": "_dd.appsec.s.req.body"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.request.headers.no_cookies"
+            }
+          ],
+          "output": "_dd.appsec.s.req.headers"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.request.query"
+            }
+          ],
+          "output": "_dd.appsec.s.req.query"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.request.path_params"
+            }
+          ],
+          "output": "_dd.appsec.s.req.params"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.request.cookies"
+            }
+          ],
+          "output": "_dd.appsec.s.req.cookies"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.response.headers.no_cookies"
+            }
+          ],
+          "output": "_dd.appsec.s.res.headers"
+        },
+        {
+          "inputs": [
+            {
+              "address": "server.response.body"
+            }
+          ],
+          "output": "_dd.appsec.s.res.body"
+        }
+      ],
+      "scanners": [
+        {
+          "tags": {
+            "category": "pii"
+          }
+        }
+      ]
+    },
+    "evaluate": false,
+    "output": true
+  }
+]