ddtrace 1.1.0 → 1.9.0

data/lib/datadog/tracing/contrib/utils/quantization/http.rb

@@ -14,12 +14,28 @@ module Datadog
 
             PLACEHOLDER = '?'.freeze
 
+            # taken from Ruby https://github.com/ruby/uri/blob/ffbab83de6d8748c9454414e02db5317609166eb/lib/uri/rfc3986_parser.rb
+            # but adjusted to parse only <scheme>://<host>:<port>/ components
+            # and stop there, since we don't care about the path, query string,
+            # and fragment components
+            RFC3986_URL_BASE = /\A(?<URI>(?<scheme>[A-Za-z][+\-.0-9A-Za-z]*):(?<hier-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h+\.[!$&-.0-;=A-Z_a-z~]+))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])*))(?::(?<port>\d*))?)))(?:\/|\z)/.freeze # rubocop:disable Style/RegexpLiteral, Layout/LineLength
+
             module_function
 
             def url(url, options = {})
               url!(url, options)
             rescue StandardError
-              options[:placeholder] || PLACEHOLDER
+              placeholder = options[:placeholder] || PLACEHOLDER
+
+              options[:base] == :exclude ? placeholder : "#{base_url(url)}/#{placeholder}"
+            end
+
+            def base_url(url, options = {})
+              if (m = RFC3986_URL_BASE.match(url))
+                m[1]
+              else
+                ''
+              end
             end
 
             def url!(url, options = {})
@@ -32,8 +48,14 @@ module Datadog
                   uri.query = (!query.nil? && query.empty? ? nil : query)
                 end
 
-                # Remove any URI framents
+                # Remove any URI fragments
                 uri.fragment = nil unless options[:fragment] == :show
+
+                if options[:base] == :exclude
+                  uri.host = nil
+                  uri.port = nil
+                  uri.scheme = nil
+                end
               end.to_s
             end
 
@@ -45,22 +67,26 @@ module Datadog
 
             def query!(query, options = {})
               options ||= {}
-              options[:show] = options[:show] || []
+              options[:obfuscate] = {} if options[:obfuscate] == :internal
+              options[:show] = options[:show] || (options[:obfuscate] ? :all : [])
               options[:exclude] = options[:exclude] || []
 
               # Short circuit if query string is meant to exclude everything
               # or if the query string is meant to include everything
               return '' if options[:exclude] == :all
-              return query if options[:show] == :all
 
-              collect_query(query, uniq: true) do |key, value|
-                if options[:exclude].include?(key)
-                  [nil, nil]
-                else
-                  value = options[:show].include?(key) ? value : nil
-                  [key, value]
+              unless options[:show] == :all && !(options[:obfuscate] && options[:exclude])
+                query = collect_query(query, uniq: true) do |key, value|
+                  if options[:exclude].include?(key)
+                    [nil, nil]
+                  else
+                    value = options[:show] == :all || options[:show].include?(key) ? value : nil
+                    [key, value]
+                  end
                 end
               end
+
+              options[:obfuscate] ? obfuscate_query(query, options[:obfuscate]) : query
             end
 
             # Iterate over each key value pair, yielding to the block given.
@@ -91,6 +117,62 @@ module Datadog
             end
 
             private_class_method :collect_query
+
+            # Scans over the query string and obfuscates sensitive data by
+            # replacing matches with an opaque value
+            def obfuscate_query(query, options = {})
+              options[:regex] = nil if options[:regex] == :internal
+              re = options[:regex] || OBFUSCATOR_REGEX
+              with = options[:with] || OBFUSCATOR_WITH
+
+              query.gsub(re, with)
+            end
+
+            private_class_method :obfuscate_query
+
+            OBFUSCATOR_WITH = '<redacted>'.freeze
+
+            # rubocop:disable Layout/LineLength
+            OBFUSCATOR_REGEX = %r{
+              (?: # JSON-ish leading quote
+                 (?:"|%22)?
+              )
+              (?: # common keys
+                 (?:old_?|new_?)?p(?:ass)?w(?:or)?d(?:1|2)? # pw, password variants
+                |pass(?:_?phrase)?  # pass, passphrase variants
+                |secret
+                |(?: # key, key_id variants
+                     api_?
+                    |private_?
+                    |public_?
+                    |access_?
+                    |secret_?
+                 )key(?:_?id)?
+                |token
+                |consumer_?(?:id|key|secret)
+                |sign(?:ed|ature)?
+                |auth(?:entication|orization)?
+              )
+              (?:
+                 # '=' query string separator, plus value til next '&' separator
+                 (?:\s|%20)*(?:=|%3D)[^&]+
+                 # JSON-ish '": "somevalue"', key being handled with case above, without the opening '"'
+                |(?:"|%22)                                     # closing '"' at end of key
+                 (?:\s|%20)*(?::|%3A)(?:\s|%20)*               # ':' key-value spearator, with surrounding spaces
+                 (?:"|%22)                                     # opening '"' at start of value
+                 (?:%2[^2]|%[^2]|[^"%])+                       # value
+                 (?:"|%22)                                     # closing '"' at end of value
+              )
+             |(?: # other common secret values
+                 bearer(?:\s|%20)+[a-z0-9._\-]+
+                |token(?::|%3A)[a-z0-9]{13}
+                |gh[opsu]_[0-9a-zA-Z]{36}
+                |ey[I-L](?:[\w=-]|%3D)+\.ey[I-L](?:[\w=-]|%3D)+(?:\.(?:[\w.+/=-]|%3D|%2F|%2B)+)?
+                |-{5}BEGIN(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY-{5}[^\-]+-{5}END(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY(?:-{5})?(?:\n|%0A)?
+                |(?:ssh-(?:rsa|dss)|ecdsa-[a-z0-9]+-[a-z0-9]+)(?:\s|%20)*(?:[a-z0-9/.+]|%2F|%5C|%2B){100,}(?:=|%3D)*(?:(?:\s+)[a-z0-9._-]+)?
+              )
+            }ix.freeze
+            # rubocop:enable Layout/LineLength
           end
         end
       end

data/lib/datadog/tracing/contrib.rb

@@ -1,8 +1,8 @@
 # typed: true
 
-require 'datadog/tracing'
-require 'datadog/tracing/contrib/registry'
-require 'datadog/tracing/contrib/extensions'
+require_relative '../tracing'
+require_relative 'contrib/registry'
+require_relative 'contrib/extensions'
 
 module Datadog
   module Tracing
@@ -30,47 +30,50 @@ module Datadog
   end
 end
 
-require 'datadog/tracing/contrib/action_cable/integration'
-require 'datadog/tracing/contrib/action_mailer/integration'
-require 'datadog/tracing/contrib/action_pack/integration'
-require 'datadog/tracing/contrib/action_view/integration'
-require 'datadog/tracing/contrib/active_model_serializers/integration'
-require 'datadog/tracing/contrib/active_job/integration'
-require 'datadog/tracing/contrib/active_record/integration'
-require 'datadog/tracing/contrib/active_support/integration'
-require 'datadog/tracing/contrib/aws/integration'
-require 'datadog/tracing/contrib/concurrent_ruby/integration'
-require 'datadog/tracing/contrib/dalli/integration'
-require 'datadog/tracing/contrib/delayed_job/integration'
-require 'datadog/tracing/contrib/elasticsearch/integration'
-require 'datadog/tracing/contrib/ethon/integration'
-require 'datadog/tracing/contrib/excon/integration'
-require 'datadog/tracing/contrib/faraday/integration'
-require 'datadog/tracing/contrib/grape/integration'
-require 'datadog/tracing/contrib/graphql/integration'
-require 'datadog/tracing/contrib/grpc/integration'
-require 'datadog/tracing/contrib/http/integration'
-require 'datadog/tracing/contrib/httpclient/integration'
-require 'datadog/tracing/contrib/httprb/integration'
-require 'datadog/tracing/contrib/integration'
-require 'datadog/tracing/contrib/kafka/integration'
-require 'datadog/tracing/contrib/lograge/integration'
-require 'datadog/tracing/contrib/mongodb/integration'
-require 'datadog/tracing/contrib/mysql2/integration'
-require 'datadog/tracing/contrib/presto/integration'
-require 'datadog/tracing/contrib/qless/integration'
-require 'datadog/tracing/contrib/que/integration'
-require 'datadog/tracing/contrib/racecar/integration'
-require 'datadog/tracing/contrib/rack/integration'
-require 'datadog/tracing/contrib/rails/integration'
-require 'datadog/tracing/contrib/rake/integration'
-require 'datadog/tracing/contrib/redis/integration'
-require 'datadog/tracing/contrib/resque/integration'
-require 'datadog/tracing/contrib/rest_client/integration'
-require 'datadog/tracing/contrib/semantic_logger/integration'
-require 'datadog/tracing/contrib/sequel/integration'
-require 'datadog/tracing/contrib/shoryuken/integration'
-require 'datadog/tracing/contrib/sidekiq/integration'
-require 'datadog/tracing/contrib/sinatra/integration'
-require 'datadog/tracing/contrib/sneakers/integration'
-require 'datadog/tracing/contrib/sucker_punch/integration'
+require_relative 'contrib/action_cable/integration'
+require_relative 'contrib/action_mailer/integration'
+require_relative 'contrib/action_pack/integration'
+require_relative 'contrib/action_view/integration'
+require_relative 'contrib/active_model_serializers/integration'
+require_relative 'contrib/active_job/integration'
+require_relative 'contrib/active_record/integration'
+require_relative 'contrib/active_support/integration'
+require_relative 'contrib/aws/integration'
+require_relative 'contrib/concurrent_ruby/integration'
+require_relative 'contrib/dalli/integration'
+require_relative 'contrib/delayed_job/integration'
+require_relative 'contrib/elasticsearch/integration'
+require_relative 'contrib/ethon/integration'
+require_relative 'contrib/excon/integration'
+require_relative 'contrib/faraday/integration'
+require_relative 'contrib/grape/integration'
+require_relative 'contrib/graphql/integration'
+require_relative 'contrib/grpc/integration'
+require_relative 'contrib/hanami/integration'
+require_relative 'contrib/http/integration'
+require_relative 'contrib/httpclient/integration'
+require_relative 'contrib/httprb/integration'
+require_relative 'contrib/integration'
+require_relative 'contrib/kafka/integration'
+require_relative 'contrib/lograge/integration'
+require_relative 'contrib/mongodb/integration'
+require_relative 'contrib/mysql2/integration'
+require_relative 'contrib/pg/integration'
+require_relative 'contrib/presto/integration'
+require_relative 'contrib/qless/integration'
+require_relative 'contrib/que/integration'
+require_relative 'contrib/racecar/integration'
+require_relative 'contrib/rack/integration'
+require_relative 'contrib/rails/integration'
+require_relative 'contrib/rake/integration'
+require_relative 'contrib/redis/integration'
+require_relative 'contrib/resque/integration'
+require_relative 'contrib/rest_client/integration'
+require_relative 'contrib/semantic_logger/integration'
+require_relative 'contrib/sequel/integration'
+require_relative 'contrib/shoryuken/integration'
+require_relative 'contrib/sidekiq/integration'
+require_relative 'contrib/sinatra/integration'
+require_relative 'contrib/sneakers/integration'
+require_relative 'contrib/stripe/integration'
+require_relative 'contrib/sucker_punch/integration'

data/lib/datadog/tracing/correlation.rb

@@ -1,6 +1,6 @@
 # typed: true
 
-require 'datadog/core'
+require_relative '../core'
 
 module Datadog
   module Tracing

data/lib/datadog/{core → tracing}/diagnostics/ext.rb

@@ -1,19 +1,14 @@
 # typed: true
 
 module Datadog
-  module Core
+  module Tracing
     module Diagnostics
       # @public_api
       module Ext
-        DD_TRACE_STARTUP_LOGS = 'DD_TRACE_STARTUP_LOGS'.freeze
-        DD_TRACE_DEBUG = 'DD_TRACE_DEBUG'.freeze
-        DD_TRACE_ENABLED = 'DD_TRACE_ENABLED'.freeze
         # Health
         module Health
           # Metrics
           module Metrics
-            ENV_ENABLED = 'DD_HEALTH_METRICS_ENABLED'.freeze
-
             METRIC_API_ERRORS = 'datadog.tracer.api.errors'.freeze
             METRIC_API_REQUESTS = 'datadog.tracer.api.requests'.freeze
             METRIC_API_RESPONSES = 'datadog.tracer.api.responses'.freeze

data/lib/datadog/tracing/diagnostics/health.rb

@@ -0,0 +1,40 @@
+# typed: ignore
+
+require_relative 'ext'
+
+module Datadog
+  module Tracing
+    module Diagnostics
+      # Health-related diagnostics
+      module Health
+        # Health metrics for diagnostics
+        module Metrics
+          def self.extended(base)
+            base.class_eval do
+              count :api_errors, Ext::Health::Metrics::METRIC_API_ERRORS
+              count :api_requests, Ext::Health::Metrics::METRIC_API_REQUESTS
+              count :api_responses, Ext::Health::Metrics::METRIC_API_RESPONSES
+              count :error_context_overflow, Ext::Health::Metrics::METRIC_ERROR_CONTEXT_OVERFLOW
+              count :error_instrumentation_patch, Ext::Health::Metrics::METRIC_ERROR_INSTRUMENTATION_PATCH
+              count :error_span_finish, Ext::Health::Metrics::METRIC_ERROR_SPAN_FINISH
+              count :error_unfinished_spans, Ext::Health::Metrics::METRIC_ERROR_UNFINISHED_SPANS
+              count :instrumentation_patched, Ext::Health::Metrics::METRIC_INSTRUMENTATION_PATCHED
+              count :queue_accepted, Ext::Health::Metrics::METRIC_QUEUE_ACCEPTED
+              count :queue_accepted_lengths, Ext::Health::Metrics::METRIC_QUEUE_ACCEPTED_LENGTHS
+              count :queue_dropped, Ext::Health::Metrics::METRIC_QUEUE_DROPPED
+              count :traces_filtered, Ext::Health::Metrics::METRIC_TRACES_FILTERED
+              count :transport_trace_too_large, Ext::Health::Metrics::METRIC_TRANSPORT_TRACE_TOO_LARGE
+              count :transport_chunked, Ext::Health::Metrics::METRIC_TRANSPORT_CHUNKED
+              count :writer_cpu_time, Ext::Health::Metrics::METRIC_WRITER_CPU_TIME
+
+              gauge :queue_length, Ext::Health::Metrics::METRIC_QUEUE_LENGTH
+              gauge :queue_max_length, Ext::Health::Metrics::METRIC_QUEUE_MAX_LENGTH
+              gauge :queue_spans, Ext::Health::Metrics::METRIC_QUEUE_SPANS
+              gauge :sampling_service_cache_length, Ext::Health::Metrics::METRIC_SAMPLING_SERVICE_CACHE_LENGTH
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/tracing/distributed/b3_multi.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+# typed: true
+
+require_relative 'helpers'
+require_relative '../trace_digest'
+
+module Datadog
+  module Tracing
+    module Distributed
+      # B3 multi header-style trace propagation.
+      # @see https://github.com/openzipkin/b3-propagation#multiple-headers
+      class B3Multi
+        B3_TRACE_ID_KEY = 'x-b3-traceid'
+        B3_SPAN_ID_KEY = 'x-b3-spanid'
+        B3_SAMPLED_KEY = 'x-b3-sampled'
+
+        def initialize(
+          fetcher:,
+          trace_id_key: B3_TRACE_ID_KEY,
+          span_id_key: B3_SPAN_ID_KEY,
+          sampled_key: B3_SAMPLED_KEY
+        )
+          @trace_id_key = trace_id_key
+          @span_id_key = span_id_key
+          @sampled_key = sampled_key
+          @fetcher = fetcher
+        end
+
+        def inject!(digest, data = {})
+          return if digest.nil?
+
+          # DEV: We need these to be hex encoded
+          data[@trace_id_key] = digest.trace_id.to_s(16)
+          data[@span_id_key] = digest.span_id.to_s(16)
+
+          if digest.trace_sampling_priority
+            sampling_priority = Helpers.clamp_sampling_priority(
+              digest.trace_sampling_priority
+            )
+            data[@sampled_key] = sampling_priority.to_s
+          end
+
+          data
+        end
+
+        def extract(data)
+          # DEV: B3 doesn't have "origin"
+          fetcher = @fetcher.new(data)
+          trace_id = fetcher.id(@trace_id_key, base: 16)
+          span_id = fetcher.id(@span_id_key, base: 16)
+          # We don't need to try and convert sampled since B3 supports 0/1 (AUTO_REJECT/AUTO_KEEP)
+          sampling_priority = fetcher.number(@sampled_key)
+
+          # Return early if this propagation is not valid
+          return unless trace_id && span_id
+
+          TraceDigest.new(
+            trace_id: trace_id,
+            span_id: span_id,
+            trace_sampling_priority: sampling_priority
+          )
+        end
+      end
+    end
+  end
+end

data/lib/datadog/tracing/distributed/b3_single.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+# typed: true
+
+require_relative 'helpers'
+require_relative '../trace_digest'
+
+module Datadog
+  module Tracing
+    module Distributed
+      # B3 single header-style trace propagation.
+      #
+      # DEV: Format:
+      # DEV:   b3: {TraceId}-{SpanId}-{SamplingState}-{ParentSpanId}
+      # DEV: https://github.com/apache/incubator-zipkin-b3-propagation/tree/7c6e9f14d6627832bd80baa87ac7dabee7be23cf#single-header
+      # DEV: `{SamplingState}` and `{ParentSpanId}` are optional
+      #
+      # @see https://github.com/openzipkin/b3-propagation#single-header
+      class B3Single
+        B3_SINGLE_HEADER_KEY = 'b3'
+
+        def initialize(fetcher:, key: B3_SINGLE_HEADER_KEY)
+          @key = key
+          @fetcher = fetcher
+        end
+
+        def inject!(digest, env)
+          return if digest.nil?
+
+          # DEV: We need these to be hex encoded
+          value = "#{digest.trace_id.to_s(16)}-#{digest.span_id.to_s(16)}"
+
+          if digest.trace_sampling_priority
+            sampling_priority = Helpers.clamp_sampling_priority(
+              digest.trace_sampling_priority
+            )
+            value += "-#{sampling_priority}"
+          end
+
+          env[@key] = value
+          env
+        end
+
+        def extract(env)
+          fetcher = @fetcher.new(env)
+          value = fetcher[@key]
+
+          return unless value
+
+          parts = value.split('-')
+          trace_id = Helpers.value_to_id(parts[0], 16) unless parts.empty?
+          span_id = Helpers.value_to_id(parts[1], 16) if parts.length > 1
+          sampling_priority = Helpers.value_to_number(parts[2]) if parts.length > 2
+
+          # Return if this propagation is not valid
+          return unless trace_id && span_id
+
+          TraceDigest.new(
+            span_id: span_id,
+            trace_id: trace_id,
+            trace_sampling_priority: sampling_priority
+          )
+        end
+      end
+    end
+  end
+end

data/lib/datadog/tracing/distributed/datadog.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+# typed: true
+
+require_relative '../metadata/ext'
+require_relative '../trace_digest'
+require_relative 'datadog_tags_codec'
+
+module Datadog
+  module Tracing
+    module Distributed
+      # Datadog-style trace propagation.
+      class Datadog
+        TRACE_ID_KEY = 'x-datadog-trace-id'
+        PARENT_ID_KEY = 'x-datadog-parent-id'
+        SAMPLING_PRIORITY_KEY = 'x-datadog-sampling-priority'
+        ORIGIN_KEY = 'x-datadog-origin'
+        # Distributed trace-level tags
+        TAGS_KEY = 'x-datadog-tags'
+
+        # Prefix used by all Datadog-specific distributed tags
+        TAGS_PREFIX = 'x-datadog-'
+
+        def initialize(
+          fetcher:,
+          trace_id_key: TRACE_ID_KEY,
+          parent_id_key: PARENT_ID_KEY,
+          sampling_priority_key: SAMPLING_PRIORITY_KEY,
+          origin_key: ORIGIN_KEY,
+          tags_key: TAGS_KEY
+        )
+          @trace_id_key = trace_id_key
+          @parent_id_key = parent_id_key
+          @sampling_priority_key = sampling_priority_key
+          @origin_key = origin_key
+          @tags_key = tags_key
+          @fetcher = fetcher
+        end
+
+        def inject!(digest, data)
+          return if digest.nil?
+
+          data[@trace_id_key] = digest.trace_id.to_s
+          data[@parent_id_key] = digest.span_id.to_s
+          data[@sampling_priority_key] = digest.trace_sampling_priority.to_s if digest.trace_sampling_priority
+          data[@origin_key] = digest.trace_origin.to_s if digest.trace_origin
+
+          inject_tags(digest, data)
+
+          data
+        end
+
+        def extract(data)
+          fetcher = @fetcher.new(data)
+          trace_id = fetcher.id(@trace_id_key)
+          parent_id = fetcher.id(@parent_id_key)
+          sampling_priority = fetcher.number(@sampling_priority_key)
+          origin = fetcher[@origin_key]
+
+          # Return early if this propagation is not valid
+          # DEV: To be valid we need to have a trace id and a parent id
+          #      or when it is a synthetics trace, just the trace id.
+          # DEV: `Fetcher#id` will not return 0
+          return unless (trace_id && parent_id) || (origin && trace_id)
+
+          trace_distributed_tags = extract_tags(fetcher)
+
+          TraceDigest.new(
+            span_id: parent_id,
+            trace_id: trace_id,
+            trace_origin: origin,
+            trace_sampling_priority: sampling_priority,
+            trace_distributed_tags: trace_distributed_tags,
+          )
+        end
+
+        private
+
+        # Export trace distributed tags through the `x-datadog-tags` key.
+        #
+        # DEV: This method accesses global state (the active trace) to record its error state as a trace tag.
+        # DEV: This means errors cannot be reported if there's not active span.
+        # DEV: Ideally, we'd have a dedicated error reporting stream for all of ddtrace.
+        def inject_tags(digest, data)
+          return if digest.trace_distributed_tags.nil? || digest.trace_distributed_tags.empty?
+          return set_tags_propagation_error(reason: 'disabled') if tags_disabled?
+
+          tags = DatadogTagsCodec.encode(digest.trace_distributed_tags)
+
+          return set_tags_propagation_error(reason: 'inject_max_size') if tags_too_large?(tags.size, scenario: 'inject')
+
+          data[@tags_key] = tags
+        rescue => e
+          set_tags_propagation_error(reason: 'encoding_error')
+          ::Datadog.logger.warn(
+            "Failed to inject x-datadog-tags: #{e.class.name} #{e.message} at #{Array(e.backtrace).first}"
+          )
+        end
+
+        # Import `x-datadog-tags` tags as trace distributed tags.
+        # Only tags that have the `_dd.p.` prefix are processed.
+        #
+        # DEV: This method accesses global state (the active trace) to record its error state as a trace tag.
+        # DEV: This means errors cannot be reported if there's not active span.
+        # DEV: Ideally, we'd have a dedicated error reporting stream for all of ddtrace.
+        def extract_tags(fetcher)
+          tags = fetcher[@tags_key]
+
+          return if !tags || tags.empty?
+          return set_tags_propagation_error(reason: 'disabled') if tags_disabled?
+          return set_tags_propagation_error(reason: 'extract_max_size') if tags_too_large?(tags.size, scenario: 'extract')
+
+          tags_hash = DatadogTagsCodec.decode(tags)
+          # Only extract keys with the expected Datadog prefix
+          tags_hash.select! do |key, _|
+            key.start_with?(Tracing::Metadata::Ext::Distributed::TAGS_PREFIX) && key != EXCLUDED_TAG
+          end
+          tags_hash
+        rescue => e
+          set_tags_propagation_error(reason: 'decoding_error')
+          ::Datadog.logger.warn(
+            "Failed to extract x-datadog-tags: #{e.class.name} #{e.message} at #{Array(e.backtrace).first}"
+          )
+        end
+
+        def set_tags_propagation_error(reason:)
+          active_trace = Tracing.active_trace
+          active_trace.set_tag('_dd.propagation_error', reason) if active_trace
+          nil
+        end
+
+        def tags_disabled?
+          ::Datadog.configuration.tracing.x_datadog_tags_max_length <= 0
+        end
+
+        def tags_too_large?(size, scenario:)
+          return false if size <= ::Datadog.configuration.tracing.x_datadog_tags_max_length
+
+          ::Datadog.logger.warn(
+            "Failed to #{scenario} x-datadog-tags: tags are too large for configured limit (size:#{size} >= " \
+              "limit:#{::Datadog.configuration.tracing.x_datadog_tags_max_length}). This limit can be configured " \
+              'through the DD_TRACE_X_DATADOG_TAGS_MAX_LENGTH environment variable.'
+          )
+
+          true
+        end
+
+        # We want to exclude tags that we don't want to propagate downstream.
+        EXCLUDED_TAG = '_dd.p.upstream_services'
+        private_constant :EXCLUDED_TAG
+      end
+    end
+  end
+end