ddtrace 1.1.0 → 1.9.0

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec
@@ -31,27 +31,27 @@ module Datadog
                 }
 
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
-                action, result = waf_context.run(waf_args, waf_timeout)
+                result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
 
-                # TODO: encapsulate return array in a type
-                case action
-                when :monitor
+                case result.status
+                when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, false]
-                when :block
-                  Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, true]
-                  throw(:block, [action, result, true])
-                when :good
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule
                   Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
                 else
-                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
                 end
               end
             end

data/lib/datadog/appsec/contrib/sinatra/request_middleware.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/event.rb

@@ -1,10 +1,10 @@
-# typed: false
+# typed: ignore
 
 require 'json'
 
-require 'datadog/appsec/contrib/rack/request'
-require 'datadog/appsec/contrib/rack/response'
-require 'datadog/appsec/rate_limiter'
+require_relative 'contrib/rack/request'
+require_relative 'contrib/rack/response'
+require_relative 'rate_limiter'
 
 module Datadog
   module AppSec
@@ -51,9 +51,8 @@ module Datadog
         end
       end
 
-      # rubocop:disable Metrics/AbcSize
       # rubocop:disable Metrics/MethodLength
-      def self.record_via_span(*events)
+      def self.record_via_span(*events) # rubocop:disable Metrics/AbcSize
         events.group_by { |e| e[:trace] }.each do |trace, event_group|
           unless trace
             Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
@@ -61,13 +60,13 @@ module Datadog
           end
 
           trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
 
           # prepare and gather tags to apply
           trace_tags = event_group.each_with_object({}) do |event, tags|
-            span = event[:span]
-
-            span.set_tag('appsec.event', 'true') if span
-
             # TODO: assume HTTP request context for now
 
             if (request = event[:request])
@@ -81,9 +80,7 @@ module Datadog
 
               tags['http.host'] = request.host
               tags['http.useragent'] = request.user_agent
-              tags['network.client.ip'] = request.ip
-
-              # tags['actor.ip'] = request.ip # TODO: uses client IP resolution algorithm
+              tags['network.client.ip'] = request.env['REMOTE_ADDR'] if request.env['REMOTE_ADDR']
             end
 
             if (response = event[:response])
@@ -115,7 +112,6 @@ module Datadog
         end
       end
       # rubocop:enable Metrics/MethodLength
-      # rubocop:enable Metrics/AbcSize
     end
   end
 end

data/lib/datadog/appsec/extensions.rb

@@ -1,6 +1,6 @@
-# typed: false
+# typed: ignore
 
-require 'datadog/appsec/configuration'
+require_relative 'configuration'
 
 module Datadog
   module AppSec
@@ -29,21 +29,16 @@ module Datadog
         end
 
         # Writer methods
-        def trace_rate_limit=(arg)
-          dsl = AppSec::Configuration::DSL.new
-          dsl.trace_rate_limit = arg
-          @settings.merge(dsl)
-        end
 
-        def options(arg)
+        def instrument(name, options = {})
           dsl = AppSec::Configuration::DSL.new
-          dsl.options arg
+          dsl.instrument(name, options)
           @settings.merge(dsl)
         end
 
-        def instruments(arg)
+        def enabled=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.instruments arg
+          dsl.enabled = arg
           @settings.merge(dsl)
         end
 
@@ -53,9 +48,9 @@ module Datadog
           @settings.merge(dsl)
         end
 
-        def instrument(*args)
+        def ip_denylist=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.instrument(*args)
+          dsl.ip_denylist = arg
           @settings.merge(dsl)
         end
 
@@ -65,33 +60,50 @@ module Datadog
           @settings.merge(dsl)
         end
 
-        def enabled=(arg)
+        def waf_debug=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.enabled = arg
+          dsl.waf_debug = arg
           @settings.merge(dsl)
         end
 
-        def waf_debug=(arg)
+        def trace_rate_limit=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.waf_debug = arg
+          dsl.trace_rate_limit = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_key_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_key_regex = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_value_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_value_regex = arg
           @settings.merge(dsl)
         end
 
         # Reader methods
-        def [](arg)
-          @settings[arg]
+
+        def [](key)
+          @settings[key]
+        end
+
+        def enabled
+          @settings.enabled
         end
 
         def ruleset
           @settings.ruleset
         end
 
-        def waf_timeout
-          @settings.waf_timeout
+        def ip_denylist
+          @settings.ip_denylist
         end
 
-        def enabled
-          @settings.enabled
+        def waf_timeout
+          @settings.waf_timeout
         end
 
         def waf_debug
@@ -102,6 +114,14 @@ module Datadog
           @settings.trace_rate_limit
         end
 
+        def obfuscator_key_regex
+          @settings.obfuscator_key_regex
+        end
+
+        def obfuscator_value_regex
+          @settings.obfuscator_key_regex
+        end
+
         def merge(arg)
           @settings.merge(arg)
         end

data/lib/datadog/appsec/instrumentation/gateway.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec
@@ -6,6 +6,20 @@ module Datadog
     module Instrumentation
       # Instrumentation gateway implementation
       class Gateway
+        # Instrumentation gateway middleware
+        class Middleware
+          attr_reader :key, :block
+
+          def initialize(key, &block)
+            @key = key
+            @block = block
+          end
+
+          def call(stack, env)
+            @block.call(stack, env)
+          end
+        end
+
         def initialize
           @middlewares = Hash.new { |h, k| h[k] = [] }
         end
@@ -31,8 +45,8 @@ module Datadog
           stack.call(env)
         end
 
-        def watch(name, &block)
-          @middlewares[name] << block
+        def watch(name, key, &block)
+          @middlewares[name] << Middleware.new(key, &block) unless @middlewares[name].any? { |m| m.key == key }
         end
       end
 

data/lib/datadog/appsec/processor.rb

@@ -1,21 +1,11 @@
 # typed: ignore
 
-require 'datadog/appsec/assets'
+require_relative 'assets'
 
 module Datadog
   module AppSec
     # Processor integrates libddwaf into datadog/appsec
     class Processor
-      # Interface object to check using case .. when
-      module IOLike
-        def read; end
-        def rewind; end
-
-        def self.===(other)
-          instance_methods.all? { |meth| other.respond_to?(meth) }
-        end
-      end
-
       # Context manages a sequence of runs
       class Context
         attr_reader :time_ns, :time_ext_ns, :timeouts, :events
@@ -28,10 +18,12 @@ module Datadog
           @events = []
         end
 
-        def run(*args)
+        def run(input, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
           start_ns = Core::Utils::Time.get_time(:nanosecond)
 
-          ret, res = @context.run(*args)
+          # TODO: remove multiple assignment
+          _code, res = _ = @context.run(input, timeout)
+          # @type var res: WAF::Result
 
           stop_ns = Core::Utils::Time.get_time(:nanosecond)
 
@@ -39,21 +31,27 @@ module Datadog
           @time_ext_ns += (stop_ns - start_ns)
           @timeouts += 1 if res.timeout
 
-          [ret, res]
+          res
+        end
+
+        def finalize
+          @context.finalize
         end
       end
 
       attr_reader :ruleset_info, :addresses
 
       def initialize
-        @ruleset = nil
-        @handle = nil
         @ruleset_info = nil
-        @addresses = nil
+        @addresses = []
 
         unless load_libddwaf && load_ruleset && create_waf_handle
           Datadog.logger.warn { 'AppSec is disabled, see logged errors above' }
+
+          return
         end
+
+        update_ip_denylist
       end
 
       def ready?
@@ -64,6 +62,32 @@ module Datadog
         Context.new(self)
       end
 
+      def update_rule_data(data)
+        @handle.update_rule_data(data)
+      end
+
+      def toggle_rules(map)
+        @handle.toggle_rules(map)
+      end
+
+      def update_ip_denylist(denylist = Datadog::AppSec.settings.ip_denylist, id: 'blocked_ips')
+        denylist ||= []
+
+        ruledata_setting = [
+          {
+            'id' => id,
+            'type' => 'data_with_expiration',
+            'data' => denylist.map { |ip| { 'value' => ip.to_s, 'expiration' => 2**63 } }
+          }
+        ]
+
+        update_rule_data(ruledata_setting)
+      end
+
+      def finalize
+        @handle.finalize
+      end
+
       protected
 
       attr_reader :handle
@@ -83,8 +107,8 @@ module Datadog
                        JSON.parse(Datadog::AppSec::Assets.waf_rules(ruleset_setting))
                      when String
                        JSON.parse(File.read(ruleset_setting))
-                     when IOLike
-                       JSON.parse(ruleset_setting.read).tap { ruleset_setting.rewind }
+                     when File, StringIO
+                       JSON.parse(ruleset_setting.read || '').tap { ruleset_setting.rewind }
                      when Hash
                        ruleset_setting
                      else
@@ -114,12 +138,18 @@ module Datadog
         @addresses = @handle.required_addresses
 
         true
-      rescue StandardError => e
+      rescue WAF::LibDDWAF::Error => e
         Datadog.logger.error do
           "libddwaf failed to initialize, error: #{e.inspect}"
         end
 
-        @ruleset_info = e.ruleset_info if e.respond_to?(:ruleset_info)
+        @ruleset_info = e.ruleset_info if e.ruleset_info
+
+        false
+      rescue StandardError => e
+        Datadog.logger.error do
+          "libddwaf failed to initialize, error: #{e.inspect}"
+        end
 
         false
       end

data/lib/datadog/appsec/rate_limiter.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/reactive/address_hash.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/reactive/engine.rb

@@ -1,7 +1,7 @@
-# typed: true
+# typed: ignore
 
-require 'datadog/appsec/reactive/address_hash'
-require 'datadog/appsec/reactive/subscriber'
+require_relative 'address_hash'
+require_relative 'subscriber'
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/reactive/operation.rb

@@ -1,6 +1,6 @@
-# typed: true
+# typed: ignore
 
-require 'datadog/appsec/reactive/engine'
+require_relative 'engine'
 
 module Datadog
   module AppSec
@@ -8,14 +8,14 @@ module Datadog
       # Reactive Engine nested operation tracking
       class Operation
         attr_reader :reactive,
-                    :parent,
-                    :name
+          :parent,
+          :name
 
         def initialize(name, parent = nil, reactive_engine = nil)
           Datadog.logger.debug { "operation: #{name} initialize" }
           @name = name
           @parent = parent
-          @reactive = reactive_engine || parent && parent.reactive || Reactive::Engine.new
+          @reactive = reactive_engine || (parent.reactive unless parent.nil?) || Reactive::Engine.new
 
           # TODO: concurrent store
           # TODO: constant

data/lib/datadog/appsec/reactive/subscriber.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/response.rb

@@ -0,0 +1,63 @@
+# typed: ignore
+
+require_relative 'assets'
+require_relative 'utils/http/media_range'
+
+module Datadog
+  module AppSec
+    # AppSec response
+    class Response
+      attr_reader :status, :headers, :body
+
+      def initialize(status:, headers: {}, body: [])
+        @status = status
+        @headers = headers
+        @body = body
+      end
+
+      def to_rack
+        [status, headers, body]
+      end
+
+      def to_sinatra_response
+        ::Sinatra::Response.new(body, status, headers)
+      end
+
+      def to_action_dispatch_response
+        ::ActionDispatch::Response.new(status, headers, body)
+      end
+
+      class << self
+        def negotiate(env)
+          Response.new(
+            status: 403,
+            headers: { 'Content-Type' => 'text/html' },
+            body: [Datadog::AppSec::Assets.blocked(format: format(env))]
+          )
+        end
+
+        private
+
+        FORMAT_MAP = {
+          'text/html' => :html,
+          'application/json' => :json,
+          'text/plain' => :text,
+        }.freeze
+
+        DEFAULT_FORMAT = :text
+
+        def format(env)
+          return DEFAULT_FORMAT unless env.key?('HTTP_ACCEPT')
+
+          accepted = env['HTTP_ACCEPT'].split(',').map { |m| Utils::HTTP::MediaRange.new(m) }.sort
+
+          accepted.each_with_object(DEFAULT_FORMAT) do |_default, range|
+            format = FORMAT_MAP.keys.find { |type, _format| range === type }
+
+            return FORMAT_MAP[format] if format
+          end
+        end
+      end
+    end
+  end
+end