ddtrace 0.49.0 → 1.12.1

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -0,0 +1,158 @@
+require_relative '../../../instrumentation/gateway'
+require_relative '../../../reactive/operation'
+require_relative '../reactive/request'
+require_relative '../reactive/request_body'
+require_relative '../reactive/response'
+require_relative '../../../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Gateway
+          # Watcher for Rack gateway events
+          module Watcher
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request(gateway)
+                watch_response(gateway)
+                watch_request_body(gateway)
+              end
+
+              def watch_request(gateway = Instrumentation.gateway)
+                gateway.watch('rack.request', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
+
+                  AppSec::Reactive::Operation.new('rack.request') do |op|
+                    Rack::Reactive::Request.subscribe(op, scope.processor_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: scope.trace,
+                          span: scope.service_entry_span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        if scope.service_entry_span
+                          scope.service_entry_span.set_tag('appsec.blocked', 'true') if result.actions.include?('block')
+                          scope.service_entry_span.set_tag('appsec.event', 'true')
+                        end
+
+                        scope.processor_context.events << event
+                      end
+                    end
+
+                    _result, block = Rack::Reactive::Request.publish(op, gateway_request)
+                  end
+
+                  next [nil, [[:block, event]]] if block
+
+                  ret, res = stack.call(gateway_request.request)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
+
+                  [ret, res]
+                end
+              end
+
+              def watch_response(gateway = Instrumentation.gateway)
+                gateway.watch('rack.response', :appsec) do |stack, gateway_response|
+                  block = false
+                  event = nil
+                  scope = gateway_response.scope
+
+                  AppSec::Reactive::Operation.new('rack.response') do |op|
+                    Rack::Reactive::Response.subscribe(op, scope.processor_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: scope.trace,
+                          span: scope.service_entry_span,
+                          response: gateway_response,
+                          actions: result.actions
+                        }
+
+                        if scope.service_entry_span
+                          scope.service_entry_span.set_tag('appsec.blocked', 'true') if result.actions.include?('block')
+                          scope.service_entry_span.set_tag('appsec.event', 'true')
+                        end
+
+                        scope.processor_context.events << event
+                      end
+                    end
+
+                    _result, block = Rack::Reactive::Response.publish(op, gateway_response)
+                  end
+
+                  next [nil, [[:block, event]]] if block
+
+                  ret, res = stack.call(gateway_response.response)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
+
+                  [ret, res]
+                end
+              end
+
+              def watch_request_body(gateway = Instrumentation.gateway)
+                gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
+
+                  AppSec::Reactive::Operation.new('rack.request.body') do |op|
+                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: scope.trace,
+                          span: scope.service_entry_span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        if scope.service_entry_span
+                          scope.service_entry_span.set_tag('appsec.blocked', 'true') if result.actions.include?('block')
+                          scope.service_entry_span.set_tag('appsec.event', 'true')
+                        end
+
+                        scope.processor_context.events << event
+                      end
+                    end
+
+                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
+                  end
+
+                  next [nil, [[:block, event]]] if block
+
+                  ret, res = stack.call(gateway_request.request)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
+
+                  [ret, res]
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -0,0 +1,42 @@
+require_relative '../integration'
+
+require_relative 'patcher'
+require_relative 'request_middleware'
+require_relative 'request_body_middleware'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Description of Rack integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.1.0')
+
+          register_as :rack, auto_patch: false
+
+          def self.version
+            Gem.loaded_specs['rack'] && Gem.loaded_specs['rack'].version
+          end
+
+          def self.loaded?
+            !defined?(::Rack).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative '../patcher'
+require_relative '../../monitor'
+require_relative 'gateway/watcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Patcher for Rack integration
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched) # TODO: Patcher.flag_patched
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Monitor::Gateway::Watcher.watch
+            Gateway::Watcher.watch
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module Request
+            ADDRESSES = [
+              'request.headers',
+              'request.uri.raw',
+              'request.query',
+              'request.cookies',
+              'request.client_ip',
+              'server.request.method'
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
+              catch(:block) do
+                op.publish('request.query', gateway_request.query)
+                op.publish('request.headers', gateway_request.headers)
+                op.publish('request.uri.raw', gateway_request.fullpath)
+                op.publish('request.cookies', gateway_request.cookies)
+                op.publish('request.client_ip', gateway_request.client_ip)
+                op.publish('server.request.method', gateway_request.method)
+
+                nil
+              end
+            end
+
+            # rubocop:disable Metrics/MethodLength
+            def self.subscribe(op, waf_context)
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+                headers = values[0]
+                headers_no_cookies = headers.dup.tap { |h| h.delete('cookie') }
+                uri_raw = values[1]
+                query = values[2]
+                cookies = values[3]
+                client_ip = values[4]
+                request_method = values[5]
+
+                waf_args = {
+                  'server.request.cookies' => cookies,
+                  'server.request.query' => query,
+                  'server.request.uri.raw' => uri_raw,
+                  'server.request.headers' => headers,
+                  'server.request.headers.no_cookies' => headers_no_cookies,
+                  'http.client_ip' => client_ip,
+                  'server.request.method' => request_method,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+              # rubocop:enable Metrics/MethodLength
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module RequestBody
+            ADDRESSES = [
+              'request.body',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
+              catch(:block) do
+                # params have been parsed from the request body
+                op.publish('request.body', gateway_request.form_hash)
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+                body = values[0]
+
+                waf_args = {
+                  'server.request.body' => body,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack response to the WAF context
+          module Response
+            ADDRESSES = [
+              'response.status',
+              'response.headers',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_response)
+              catch(:block) do
+                op.publish('response.status', gateway_response.status)
+                op.publish('response.headers', gateway_response.headers)
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+
+                response_status = values[0]
+                response_headers = values[1]
+                response_headers_no_cookies = response_headers.dup.tap { |h| h.delete('set-cookie') }
+
+                waf_args = {
+                  'server.response.status' => response_status.to_s,
+                  'server.response.headers' => response_headers,
+                  'server.response.headers.no_cookies' => response_headers_no_cookies,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative 'gateway/request'
+require_relative '../../instrumentation/gateway'
+require_relative '../../response'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Rack request body middleware for AppSec
+        # This should be inserted just below Rack::JSONBodyParser or
+        # legacy Rack::PostBodyContentTypeParser from rack-contrib
+        class RequestBodyMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+
+            return @app.call(env) unless context
+
+            # TODO: handle exceptions, except for @app.call
+
+            request_return, request_response = Instrumentation.gateway.push(
+              'rack.request.body',
+              Gateway::Request.new(env)
+            ) do
+              @app.call(env)
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env).to_rack
+            end
+
+            request_return
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -0,0 +1,174 @@
+require 'json'
+
+require_relative 'gateway/request'
+require_relative 'gateway/response'
+require_relative '../../instrumentation/gateway'
+require_relative '../../processor'
+require_relative '../../response'
+
+require_relative '../../../tracing/client_ip'
+require_relative '../../../tracing/contrib/rack/header_collection'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Topmost Rack middleware for AppSec
+        # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
+        class RequestMiddleware
+          def initialize(app, opt = {})
+            @app = app
+
+            @oneshot_tags_sent = false
+          end
+
+          # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+          def call(env)
+            return @app.call(env) unless Datadog::AppSec.enabled?
+
+            Datadog::Core::Remote.active_remote.barrier(:once) unless Datadog::Core::Remote.active_remote.nil?
+
+            processor = nil
+            ready = false
+            scope = nil
+
+            # For a given request, keep using the first Rack stack scope for
+            # nested apps. Don't set `context` local variable so that on popping
+            # out of this nested stack we don't finalize the parent's context
+            return @app.call(env) if active_scope(env)
+
+            Datadog::AppSec.reconfigure_lock do
+              processor = Datadog::AppSec.processor
+
+              if !processor.nil? && processor.ready?
+                scope = Datadog::AppSec::Scope.activate_scope(active_trace, active_span, processor)
+                env[Datadog::AppSec::Ext::SCOPE_KEY] = scope
+                ready = true
+              end
+            end
+
+            # TODO: handle exceptions, except for @app.call
+
+            return @app.call(env) unless ready
+
+            gateway_request = Gateway::Request.new(env)
+
+            add_appsec_tags(processor, scope.trace, scope.service_entry_span, env)
+
+            request_return, request_response = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              Instrumentation.gateway.push('rack.request', gateway_request) do
+                @app.call(env)
+              end
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env).to_rack
+            end
+
+            gateway_response = Gateway::Response.new(
+              request_return[2],
+              request_return[0],
+              request_return[1],
+              scope: scope
+            )
+
+            _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
+
+            scope.processor_context.events.each do |e|
+              e[:response] ||= gateway_response
+              e[:request]  ||= gateway_request
+            end
+
+            AppSec::Event.record(scope.service_entry_span, *scope.processor_context.events)
+
+            if response_response && response_response.any? { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env).to_rack
+            end
+
+            request_return
+          ensure
+            if scope
+              add_waf_runtime_tags(scope.service_entry_span, scope.processor_context)
+              Datadog::AppSec::Scope.deactivate_scope
+            end
+          end
+          # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+
+          private
+
+          def active_scope(env)
+            env[Datadog::AppSec::Ext::SCOPE_KEY]
+          end
+
+          def active_trace
+            # TODO: factor out tracing availability detection
+
+            return unless defined?(Datadog::Tracing)
+
+            Datadog::Tracing.active_trace
+          end
+
+          def active_span
+            # TODO: factor out tracing availability detection
+
+            return unless defined?(Datadog::Tracing)
+
+            Datadog::Tracing.active_span
+          end
+
+          def add_appsec_tags(processor, trace, span, env)
+            return unless trace
+
+            span.set_tag('_dd.appsec.enabled', 1)
+            span.set_tag('_dd.runtime_family', 'ruby')
+            span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+
+            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
+              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+
+              # always collect client ip, as this is part of AppSec provided functionality
+              Datadog::Tracing::ClientIp.set_client_ip_tag!(
+                span,
+                headers: request_header_collection,
+                remote_ip: env['REMOTE_ADDR']
+              )
+            end
+
+            if processor.ruleset_info
+              span.set_tag('_dd.appsec.event_rules.version', processor.ruleset_info[:version])
+
+              unless @oneshot_tags_sent
+                # Small race condition, but it's inoccuous: worst case the tags
+                # are sent a couple of times more than expected
+                @oneshot_tags_sent = true
+
+                span.set_tag('_dd.appsec.event_rules.loaded', processor.ruleset_info[:loaded].to_f)
+                span.set_tag('_dd.appsec.event_rules.error_count', processor.ruleset_info[:failed].to_f)
+                span.set_tag('_dd.appsec.event_rules.errors', JSON.dump(processor.ruleset_info[:errors]))
+                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(processor.addresses))
+
+                # Ensure these tags reach the backend
+                trace.keep!
+                trace.set_tag(
+                  Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+                  Datadog::Tracing::Sampling::Ext::Decision::ASM
+                )
+              end
+            end
+          end
+
+          def add_waf_runtime_tags(span, context)
+            return unless span
+            return unless context
+
+            span.set_tag('_dd.appsec.waf.timeouts', context.timeouts)
+
+            # these tags expect time in us
+            span.set_tag('_dd.appsec.waf.duration', context.time_ns / 1000.0)
+            span.set_tag('_dd.appsec.waf.duration_ext', context.time_ext_ns / 1000.0)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -0,0 +1,12 @@
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rack integration constants
+        module Ext
+          APP = 'rails'.freeze
+        end
+      end
+    end
+  end
+end