ddtrace 1.0.0 → 1.10.1

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,10 +1,9 @@
-# typed: false
-
-require 'datadog/appsec/instrumentation/gateway'
-require 'datadog/appsec/reactive/operation'
-require 'datadog/appsec/contrib/rack/reactive/request'
-require 'datadog/appsec/contrib/rack/reactive/response'
-require 'datadog/appsec/event'
+require_relative '../../../instrumentation/gateway'
+require_relative '../../../reactive/operation'
+require_relative '../reactive/request'
+require_relative '../reactive/request_body'
+require_relative '../reactive/response'
+require_relative '../../../event'
 
 module Datadog
   module AppSec
@@ -13,111 +12,162 @@ module Datadog
         module Gateway
           # Watcher for Rack gateway events
           module Watcher
-            # rubocop:disable Metrics/AbcSize
-            # rubocop:disable Metrics/CyclomaticComplexity
-            # rubocop:disable Metrics/MethodLength
-            # rubocop:disable Metrics/PerceivedComplexity
-            def self.watch
-              Instrumentation.gateway.watch('rack.request') do |stack, request|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('rack.request') do |op|
-                  # TODO: factor out
-                  if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
-                    active_trace = Datadog::Tracing.active_trace
-                    active_span = Datadog::Tracing.active_span
-
-                    Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
-
-                    if active_span
-                      active_span.set_tag('_dd.appsec.enabled', 1)
-                      active_span.set_tag('_dd.runtime_family', 'ruby')
-                    end
-                  end
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
 
-                  Rack::Reactive::Request.subscribe(op, waf_context) do |action, result, _block|
-                    record = [:block, :monitor].include?(action)
-                    if record
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: active_trace,
-                        span: active_span,
-                        request: request,
-                        action: action
-                      }
+                watch_request(gateway)
+                watch_response(gateway)
+                watch_request_body(gateway)
+              end
+
+              def watch_request(gateway = Instrumentation.gateway)
+                gateway.watch('rack.request', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('rack.request') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rack::Reactive::Request.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
                     end
+
+                    _result, block = Rack::Reactive::Request.publish(op, gateway_request)
                   end
 
-                  _action, _result, block = Rack::Reactive::Request.publish(op, request)
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(request)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
-
-                [ret, res]
               end
 
-              Instrumentation.gateway.watch('rack.response') do |stack, response|
-                block = false
-                event = nil
-                waf_context = response.instance_eval { @waf_context }
+              def watch_response(gateway = Instrumentation.gateway)
+                gateway.watch('rack.response', :appsec) do |stack, gateway_response|
+                  block = false
+                  event = nil
+                  waf_context = gateway_response.active_context
+
+                  AppSec::Reactive::Operation.new('rack.response') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rack::Reactive::Response.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          response: gateway_response,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
+                    end
 
-                AppSec::Reactive::Operation.new('rack.response') do |op|
-                  # TODO: factor out
-                  if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
-                    active_trace = Datadog::Tracing.active_trace
-                    active_span = Datadog::Tracing.active_span
+                    _result, block = Rack::Reactive::Response.publish(op, gateway_response)
+                  end
 
-                    Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
+                  next [nil, [[:block, event]]] if block
 
-                    if active_span
-                      active_span.set_tag('_dd.appsec.enabled', 1)
-                      active_span.set_tag('_dd.runtime_family', 'ruby')
-                    end
+                  ret, res = stack.call(gateway_response.response)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
                   end
 
-                  Rack::Reactive::Response.subscribe(op, waf_context) do |action, result, _block|
-                    record = [:block, :monitor].include?(action)
-                    if record
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: active_trace,
-                        span: active_span,
-                        response: response,
-                        action: action
-                      }
+                  [ret, res]
+                end
+              end
+
+              def watch_request_body(gateway = Instrumentation.gateway)
+                gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('rack.request.body') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rack::Reactive::RequestBody.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
                     end
+
+                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
-                  _action, _result, block = Rack::Reactive::Response.publish(op, response)
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(response)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
+              end
+
+              private
+
+              def active_trace
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_trace
+              end
+
+              def active_span
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
 
-                [ret, res]
+                Datadog::Tracing.active_span
               end
             end
-            # rubocop:enable Metrics/AbcSize
-            # rubocop:enable Metrics/CyclomaticComplexity
-            # rubocop:enable Metrics/MethodLength
-            # rubocop:enable Metrics/PerceivedComplexity
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -1,10 +1,9 @@
-# typed: ignore
+require_relative '../integration'
 
-require 'datadog/appsec/contrib/integration'
-
-require 'datadog/appsec/contrib/rack/configuration/settings'
-require 'datadog/appsec/contrib/rack/patcher'
-require 'datadog/appsec/contrib/rack/request_middleware'
+require_relative 'configuration/settings'
+require_relative 'patcher'
+require_relative 'request_middleware'
+require_relative 'request_body_middleware'
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -1,8 +1,6 @@
-# typed: ignore
-
-require 'datadog/appsec/contrib/patcher'
-require 'datadog/appsec/contrib/rack/integration'
-require 'datadog/appsec/contrib/rack/gateway/watcher'
+require_relative '../patcher'
+require_relative '../../monitor'
+require_relative 'gateway/watcher'
 
 module Datadog
   module AppSec
@@ -23,6 +21,7 @@ module Datadog
           end
 
           def patch
+            Monitor::Gateway::Watcher.watch
             Gateway::Watcher.watch
             Patcher.instance_variable_set(:@patched, true)
           end

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -1,6 +1,4 @@
-# typed: true
-
-require 'datadog/appsec/contrib/rack/request'
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -9,76 +7,71 @@ module Datadog
         module Reactive
           # Dispatch data from a Rack request to the WAF context
           module Request
-            def self.publish(op, request)
+            ADDRESSES = [
+              'request.headers',
+              'request.uri.raw',
+              'request.query',
+              'request.cookies',
+              'request.client_ip',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
               catch(:block) do
-                op.publish('request.query', Rack::Request.query(request))
-                op.publish('request.headers', Rack::Request.headers(request))
-                op.publish('request.uri.raw', Rack::Request.url(request))
-                op.publish('request.cookies', Rack::Request.cookies(request))
-                # op.publish('request.body.raw', Rack::Request.body(request))
-                # TODO: op.publish('request.path_params', { k: v }) # route params only?
-                # TODO: op.publish('request.path', request.script_name + request.path) # unused for now
+                op.publish('request.query', gateway_request.query)
+                op.publish('request.headers', gateway_request.headers)
+                op.publish('request.uri.raw', gateway_request.url)
+                op.publish('request.cookies', gateway_request.cookies)
+                op.publish('request.client_ip', gateway_request.client_ip)
 
                 nil
               end
             end
 
-            # rubocop:disable Metrics/MethodLength
             def self.subscribe(op, waf_context)
-              addresses = [
-                'request.headers',
-                'request.uri.raw',
-                'request.query',
-                'request.cookies',
-                # 'request.body.raw',
-                # TODO: 'request.path_params',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 headers = values[0]
                 headers_no_cookies = headers.dup.tap { |h| h.delete('cookie') }
                 uri_raw = values[1]
                 query = values[2]
                 cookies = values[3]
-                # body = values[4]
+                client_ip = values[4]
 
                 waf_args = {
                   'server.request.cookies' => cookies,
-                  # 'server.request.body.raw' => body,
                   'server.request.query' => query,
                   'server.request.uri.raw' => uri_raw,
                   'server.request.headers' => headers,
                   'server.request.headers.no_cookies' => headers_no_cookies,
-                  # TODO: 'server.request.path_params' => path_params,
+                  'http.client_ip' => client_ip,
                 }
 
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
-                action, result = waf_context.run(waf_args, waf_timeout)
+                result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
 
-                # TODO: encapsulate return array in a type
-                case action
-                when :monitor
-                  Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, false]
-                when :block
+                case result.status
+                when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, true]
-                  throw(:block, [action, result, true])
-                when :good
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule
                   Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
                 else
-                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
                 end
               end
             end
-            # rubocop:enable Metrics/MethodLength
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module RequestBody
+            ADDRESSES = [
+              'request.body',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
+              catch(:block) do
+                # params have been parsed from the request body
+                op.publish('request.body', gateway_request.form_hash)
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+                body = values[0]
+
+                waf_args = {
+                  'server.request.body' => body,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -1,6 +1,4 @@
-# typed: true
-
-require 'datadog/appsec/contrib/rack/response'
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -9,21 +7,22 @@ module Datadog
         module Reactive
           # Dispatch data from a Rack response to the WAF context
           module Response
-            def self.publish(op, response)
+            ADDRESSES = [
+              'response.status',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_response)
               catch(:block) do
-                op.publish('response.status', Rack::Response.status(response))
+                op.publish('response.status', gateway_response.status)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'response.status',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
                 response_status = values[0]
 
@@ -32,27 +31,27 @@ module Datadog
                 }
 
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
-                action, result = waf_context.run(waf_args, waf_timeout)
+                result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
 
-                # TODO: encapsulate return array in a type
-                case action
-                when :monitor
-                  Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, false]
-                when :block
+                case result.status
+                when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, true]
-                  throw(:block, [action, result, true])
-                when :good
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule
                   Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
                 else
-                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
                 end
               end
             end

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative 'gateway/request'
+require_relative '../../instrumentation/gateway'
+require_relative '../../response'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Rack request body middleware for AppSec
+        # This should be inserted just below Rack::JSONBodyParser or
+        # legacy Rack::PostBodyContentTypeParser from rack-contrib
+        class RequestBodyMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            context = env['datadog.waf.context']
+
+            return @app.call(env) unless context
+
+            # TODO: handle exceptions, except for @app.call
+
+            request_return, request_response = Instrumentation.gateway.push(
+              'rack.request.body',
+              Gateway::Request.new(env)
+            ) do
+              @app.call(env)
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env).to_rack
+            end
+
+            request_return
+          end
+        end
+      end
+    end
+  end
+end