ddtrace 1.12.1 → 1.18.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +388 -10
- data/ext/ddtrace_profiling_native_extension/NativeExtensionDesign.md +3 -5
- data/ext/ddtrace_profiling_native_extension/clock_id.h +0 -3
- data/ext/ddtrace_profiling_native_extension/clock_id_from_pthread.c +3 -22
- data/ext/ddtrace_profiling_native_extension/clock_id_noop.c +0 -1
- data/ext/ddtrace_profiling_native_extension/collectors_cpu_and_wall_time_worker.c +41 -6
- data/ext/ddtrace_profiling_native_extension/collectors_idle_sampling_helper.c +3 -0
- data/ext/ddtrace_profiling_native_extension/collectors_stack.c +76 -24
- data/ext/ddtrace_profiling_native_extension/collectors_stack.h +1 -1
- data/ext/ddtrace_profiling_native_extension/collectors_thread_context.c +292 -27
- data/ext/ddtrace_profiling_native_extension/collectors_thread_context.h +1 -1
- data/ext/ddtrace_profiling_native_extension/extconf.rb +40 -10
- data/ext/ddtrace_profiling_native_extension/http_transport.c +48 -16
- data/ext/ddtrace_profiling_native_extension/libdatadog_helpers.c +42 -0
- data/ext/ddtrace_profiling_native_extension/libdatadog_helpers.h +6 -0
- data/ext/ddtrace_profiling_native_extension/native_extension_helpers.rb +1 -1
- data/ext/ddtrace_profiling_native_extension/pid_controller.c +57 -0
- data/ext/ddtrace_profiling_native_extension/pid_controller.h +45 -0
- data/ext/ddtrace_profiling_native_extension/private_vm_api_access.c +136 -32
- data/ext/ddtrace_profiling_native_extension/private_vm_api_access.h +12 -0
- data/ext/ddtrace_profiling_native_extension/profiling.c +1 -2
- data/ext/ddtrace_profiling_native_extension/stack_recorder.c +81 -50
- data/ext/ddtrace_profiling_native_extension/stack_recorder.h +13 -3
- data/ext/ddtrace_profiling_native_extension/time_helpers.c +40 -4
- data/ext/ddtrace_profiling_native_extension/time_helpers.h +14 -0
- data/lib/datadog/appsec/assets/waf_rules/processors.json +92 -0
- data/lib/datadog/appsec/assets/waf_rules/recommended.json +698 -75
- data/lib/datadog/appsec/assets/waf_rules/scanners.json +114 -0
- data/lib/datadog/appsec/assets/waf_rules/strict.json +98 -8
- data/lib/datadog/appsec/assets.rb +8 -0
- data/lib/datadog/appsec/component.rb +21 -2
- data/lib/datadog/appsec/configuration/settings.rb +167 -189
- data/lib/datadog/appsec/configuration.rb +0 -79
- data/lib/datadog/appsec/contrib/auto_instrument.rb +2 -4
- data/lib/datadog/appsec/contrib/devise/event.rb +57 -0
- data/lib/datadog/appsec/contrib/devise/ext.rb +13 -0
- data/lib/datadog/appsec/contrib/devise/integration.rb +42 -0
- data/lib/datadog/appsec/contrib/devise/patcher/authenticatable_patch.rb +76 -0
- data/lib/datadog/appsec/contrib/devise/patcher/registration_controller_patch.rb +54 -0
- data/lib/datadog/appsec/contrib/devise/patcher.rb +45 -0
- data/lib/datadog/appsec/contrib/devise/resource.rb +35 -0
- data/lib/datadog/appsec/contrib/devise/tracking.rb +49 -0
- data/lib/datadog/appsec/contrib/rack/ext.rb +2 -1
- data/lib/datadog/appsec/contrib/rack/gateway/request.rb +6 -2
- data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb +8 -6
- data/lib/datadog/appsec/contrib/rack/reactive/request.rb +3 -8
- data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb +3 -6
- data/lib/datadog/appsec/contrib/rack/reactive/response.rb +3 -6
- data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb +3 -2
- data/lib/datadog/appsec/contrib/rack/request_middleware.rb +36 -17
- data/lib/datadog/appsec/contrib/rails/ext.rb +3 -2
- data/lib/datadog/appsec/contrib/rails/framework.rb +1 -3
- data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb +3 -2
- data/lib/datadog/appsec/contrib/rails/patcher.rb +17 -11
- data/lib/datadog/appsec/contrib/rails/reactive/action.rb +3 -6
- data/lib/datadog/appsec/contrib/sinatra/ext.rb +2 -1
- data/lib/datadog/appsec/contrib/sinatra/framework.rb +1 -3
- data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb +6 -4
- data/lib/datadog/appsec/contrib/sinatra/patcher.rb +13 -7
- data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb +3 -6
- data/lib/datadog/appsec/event.rb +106 -50
- data/lib/datadog/appsec/extensions.rb +1 -130
- data/lib/datadog/appsec/monitor/gateway/watcher.rb +3 -3
- data/lib/datadog/appsec/monitor/reactive/set_user.rb +3 -6
- data/lib/datadog/appsec/processor/actions.rb +49 -0
- data/lib/datadog/appsec/processor/rule_loader.rb +60 -0
- data/lib/datadog/appsec/processor/rule_merger.rb +22 -2
- data/lib/datadog/appsec/processor.rb +35 -7
- data/lib/datadog/appsec/rate_limiter.rb +1 -1
- data/lib/datadog/appsec/remote.rb +17 -11
- data/lib/datadog/appsec/response.rb +82 -4
- data/lib/datadog/appsec/sample_rate.rb +21 -0
- data/lib/datadog/appsec.rb +3 -4
- data/lib/datadog/core/backport.rb +51 -0
- data/lib/datadog/core/configuration/agent_settings_resolver.rb +38 -29
- data/lib/datadog/core/configuration/base.rb +6 -16
- data/lib/datadog/core/configuration/components.rb +15 -3
- data/lib/datadog/core/configuration/ext.rb +28 -5
- data/lib/datadog/core/configuration/option.rb +269 -21
- data/lib/datadog/core/configuration/option_definition.rb +73 -32
- data/lib/datadog/core/configuration/options.rb +27 -15
- data/lib/datadog/core/configuration/settings.rb +182 -102
- data/lib/datadog/core/configuration.rb +4 -0
- data/lib/datadog/core/diagnostics/environment_logger.rb +130 -234
- data/lib/datadog/core/environment/execution.rb +103 -0
- data/lib/datadog/core/environment/ext.rb +13 -11
- data/lib/datadog/core/environment/variable_helpers.rb +0 -69
- data/lib/datadog/core/environment/yjit.rb +58 -0
- data/lib/datadog/core/error.rb +1 -0
- data/lib/datadog/core/git/ext.rb +26 -22
- data/lib/datadog/core/logging/ext.rb +3 -1
- data/lib/datadog/core/metrics/ext.rb +7 -5
- data/lib/datadog/core/remote/client/capabilities.rb +6 -1
- data/lib/datadog/core/remote/client.rb +3 -0
- data/lib/datadog/core/remote/component.rb +27 -36
- data/lib/datadog/core/remote/configuration/content.rb +28 -1
- data/lib/datadog/core/remote/configuration/repository.rb +3 -1
- data/lib/datadog/core/remote/ext.rb +1 -1
- data/lib/datadog/core/remote/negotiation.rb +19 -6
- data/lib/datadog/core/remote/transport/config.rb +60 -0
- data/lib/datadog/core/remote/transport/http/api/instance.rb +39 -0
- data/lib/datadog/core/remote/transport/http/api/spec.rb +21 -0
- data/lib/datadog/core/remote/transport/http/api.rb +58 -0
- data/lib/datadog/core/remote/transport/http/builder.rb +219 -0
- data/lib/datadog/core/remote/transport/http/client.rb +48 -0
- data/lib/datadog/core/remote/transport/http/config.rb +280 -0
- data/lib/datadog/core/remote/transport/http/negotiation.rb +146 -0
- data/lib/datadog/core/remote/transport/http.rb +179 -0
- data/lib/datadog/core/{transport → remote/transport}/negotiation.rb +25 -23
- data/lib/datadog/core/remote/worker.rb +4 -1
- data/lib/datadog/core/runtime/ext.rb +22 -12
- data/lib/datadog/core/runtime/metrics.rb +43 -0
- data/lib/datadog/core/telemetry/client.rb +12 -2
- data/lib/datadog/core/telemetry/collector.rb +13 -4
- data/lib/datadog/core/telemetry/emitter.rb +4 -2
- data/lib/datadog/core/telemetry/event.rb +19 -4
- data/lib/datadog/core/telemetry/ext.rb +4 -1
- data/lib/datadog/core/telemetry/heartbeat.rb +2 -4
- data/lib/datadog/core/telemetry/http/ext.rb +10 -8
- data/lib/datadog/core/telemetry/http/transport.rb +2 -0
- data/lib/datadog/core/telemetry/v2/app_client_configuration_change.rb +41 -0
- data/lib/datadog/core/telemetry/v2/request.rb +29 -0
- data/lib/datadog/core/transport/ext.rb +47 -0
- data/lib/datadog/core/transport/http/adapters/net.rb +168 -0
- data/lib/datadog/core/transport/http/adapters/registry.rb +29 -0
- data/lib/datadog/core/transport/http/adapters/test.rb +89 -0
- data/lib/datadog/core/transport/http/adapters/unix_socket.rb +83 -0
- data/lib/datadog/core/transport/http/api/endpoint.rb +31 -0
- data/lib/datadog/core/transport/http/api/fallbacks.rb +26 -0
- data/lib/datadog/core/transport/http/api/map.rb +18 -0
- data/lib/datadog/core/transport/http/env.rb +62 -0
- data/lib/datadog/core/transport/http/response.rb +60 -0
- data/lib/datadog/core/transport/parcel.rb +22 -0
- data/lib/datadog/core/transport/request.rb +17 -0
- data/lib/datadog/core/transport/response.rb +64 -0
- data/lib/datadog/core/utils/duration.rb +52 -0
- data/lib/datadog/core/utils/hash.rb +47 -0
- data/lib/datadog/core/utils/network.rb +1 -1
- data/lib/datadog/core/utils/safe_dup.rb +27 -20
- data/lib/datadog/core/utils.rb +1 -1
- data/lib/datadog/core/workers/async.rb +3 -2
- data/lib/datadog/core/workers/polling.rb +2 -2
- data/lib/datadog/kit/appsec/events.rb +139 -89
- data/lib/datadog/kit/enable_core_dumps.rb +5 -6
- data/lib/datadog/kit/identity.rb +80 -65
- data/lib/datadog/opentelemetry/api/context.rb +10 -3
- data/lib/datadog/opentelemetry/sdk/propagator.rb +2 -1
- data/lib/datadog/opentelemetry/sdk/span_processor.rb +48 -5
- data/lib/datadog/opentelemetry/sdk/trace/span.rb +167 -0
- data/lib/datadog/opentelemetry/trace.rb +58 -0
- data/lib/datadog/opentelemetry.rb +1 -0
- data/lib/datadog/opentracer/text_map_propagator.rb +2 -1
- data/lib/datadog/opentracer.rb +9 -0
- data/lib/datadog/profiling/collectors/cpu_and_wall_time_worker.rb +16 -17
- data/lib/datadog/profiling/collectors/idle_sampling_helper.rb +3 -1
- data/lib/datadog/profiling/collectors/thread_context.rb +17 -2
- data/lib/datadog/profiling/component.rb +69 -94
- data/lib/datadog/profiling/diagnostics/environment_logger.rb +39 -0
- data/lib/datadog/profiling/exporter.rb +5 -1
- data/lib/datadog/profiling/ext.rb +0 -12
- data/lib/datadog/profiling/flush.rb +7 -5
- data/lib/datadog/profiling/http_transport.rb +19 -6
- data/lib/datadog/profiling/load_native_extension.rb +7 -1
- data/lib/datadog/profiling/native_extension.rb +0 -21
- data/lib/datadog/profiling/profiler.rb +36 -13
- data/lib/datadog/profiling/scheduler.rb +16 -9
- data/lib/datadog/profiling.rb +16 -78
- data/lib/datadog/tracing/component.rb +70 -11
- data/lib/datadog/tracing/configuration/agent_settings_resolver.rb +13 -0
- data/lib/datadog/tracing/configuration/dynamic/option.rb +71 -0
- data/lib/datadog/tracing/configuration/dynamic.rb +64 -0
- data/lib/datadog/tracing/configuration/ext.rb +40 -32
- data/lib/datadog/tracing/configuration/http.rb +74 -0
- data/lib/datadog/tracing/configuration/settings.rb +134 -98
- data/lib/datadog/tracing/contrib/action_cable/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/action_cable/ext.rb +20 -18
- data/lib/datadog/tracing/contrib/action_mailer/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/action_mailer/ext.rb +20 -18
- data/lib/datadog/tracing/contrib/action_pack/configuration/settings.rb +9 -7
- data/lib/datadog/tracing/contrib/action_pack/ext.rb +10 -8
- data/lib/datadog/tracing/contrib/action_view/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/action_view/ext.rb +12 -10
- data/lib/datadog/tracing/contrib/active_job/configuration/settings.rb +13 -7
- data/lib/datadog/tracing/contrib/active_job/ext.rb +25 -23
- data/lib/datadog/tracing/contrib/active_job/log_injection.rb +1 -1
- data/lib/datadog/tracing/contrib/active_job/patcher.rb +1 -1
- data/lib/datadog/tracing/contrib/active_model_serializers/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/active_model_serializers/ext.rb +12 -10
- data/lib/datadog/tracing/contrib/active_record/configuration/resolver.rb +18 -11
- data/lib/datadog/tracing/contrib/active_record/configuration/settings.rb +9 -7
- data/lib/datadog/tracing/contrib/active_record/events/sql.rb +2 -6
- data/lib/datadog/tracing/contrib/active_record/ext.rb +17 -15
- data/lib/datadog/tracing/contrib/active_record/utils.rb +1 -1
- data/lib/datadog/tracing/contrib/active_support/cache/instrumentation.rb +106 -202
- data/lib/datadog/tracing/contrib/active_support/cache/patcher.rb +3 -0
- data/lib/datadog/tracing/contrib/active_support/configuration/settings.rb +9 -7
- data/lib/datadog/tracing/contrib/active_support/ext.rb +18 -16
- data/lib/datadog/tracing/contrib/aws/configuration/settings.rb +14 -7
- data/lib/datadog/tracing/contrib/aws/ext.rb +37 -24
- data/lib/datadog/tracing/contrib/aws/instrumentation.rb +16 -5
- data/lib/datadog/tracing/contrib/concurrent_ruby/configuration/settings.rb +3 -2
- data/lib/datadog/tracing/contrib/concurrent_ruby/context_composite_executor_service.rb +14 -14
- data/lib/datadog/tracing/contrib/concurrent_ruby/ext.rb +4 -2
- data/lib/datadog/tracing/contrib/concurrent_ruby/future_patch.rb +3 -10
- data/lib/datadog/tracing/contrib/concurrent_ruby/integration.rb +2 -1
- data/lib/datadog/tracing/contrib/concurrent_ruby/patcher.rb +8 -1
- data/lib/datadog/tracing/contrib/concurrent_ruby/promises_future_patch.rb +22 -0
- data/lib/datadog/tracing/contrib/configuration/settings.rb +1 -1
- data/lib/datadog/tracing/contrib/dalli/configuration/settings.rb +20 -7
- data/lib/datadog/tracing/contrib/dalli/ext.rb +26 -11
- data/lib/datadog/tracing/contrib/dalli/instrumentation.rb +17 -8
- data/lib/datadog/tracing/contrib/delayed_job/configuration/settings.rb +13 -7
- data/lib/datadog/tracing/contrib/delayed_job/ext.rb +16 -14
- data/lib/datadog/tracing/contrib/elasticsearch/configuration/settings.rb +14 -7
- data/lib/datadog/tracing/contrib/elasticsearch/ext.rb +21 -15
- data/lib/datadog/tracing/contrib/elasticsearch/patcher.rb +104 -99
- data/lib/datadog/tracing/contrib/ethon/configuration/settings.rb +16 -9
- data/lib/datadog/tracing/contrib/ethon/easy_patch.rb +48 -3
- data/lib/datadog/tracing/contrib/ethon/ext.rb +19 -11
- data/lib/datadog/tracing/contrib/ethon/multi_patch.rb +6 -3
- data/lib/datadog/tracing/contrib/excon/configuration/settings.rb +19 -10
- data/lib/datadog/tracing/contrib/excon/ext.rb +16 -8
- data/lib/datadog/tracing/contrib/excon/middleware.rb +25 -5
- data/lib/datadog/tracing/contrib/ext.rb +26 -1
- data/lib/datadog/tracing/contrib/extensions.rb +32 -0
- data/lib/datadog/tracing/contrib/faraday/configuration/settings.rb +20 -10
- data/lib/datadog/tracing/contrib/faraday/ext.rb +16 -8
- data/lib/datadog/tracing/contrib/faraday/middleware.rb +21 -5
- data/lib/datadog/tracing/contrib/grape/configuration/settings.rb +8 -6
- data/lib/datadog/tracing/contrib/grape/ext.rb +16 -14
- data/lib/datadog/tracing/contrib/graphql/configuration/settings.rb +8 -6
- data/lib/datadog/tracing/contrib/graphql/ext.rb +7 -5
- data/lib/datadog/tracing/contrib/grpc/configuration/settings.rb +39 -9
- data/lib/datadog/tracing/contrib/grpc/datadog_interceptor/client.rb +39 -20
- data/lib/datadog/tracing/contrib/grpc/datadog_interceptor/server.rb +37 -18
- data/lib/datadog/tracing/contrib/grpc/datadog_interceptor.rb +0 -4
- data/lib/datadog/tracing/contrib/grpc/ext.rb +16 -13
- data/lib/datadog/tracing/contrib/grpc/formatting.rb +127 -0
- data/lib/datadog/tracing/contrib/hanami/configuration/settings.rb +3 -2
- data/lib/datadog/tracing/contrib/hanami/ext.rb +10 -8
- data/lib/datadog/tracing/contrib/http/circuit_breaker.rb +5 -8
- data/lib/datadog/tracing/contrib/http/configuration/settings.rb +33 -11
- data/lib/datadog/tracing/contrib/http/ext.rb +16 -9
- data/lib/datadog/tracing/contrib/http/instrumentation.rb +27 -7
- data/lib/datadog/tracing/contrib/httpclient/configuration/settings.rb +33 -11
- data/lib/datadog/tracing/contrib/httpclient/ext.rb +17 -9
- data/lib/datadog/tracing/contrib/httpclient/instrumentation.rb +22 -5
- data/lib/datadog/tracing/contrib/httprb/configuration/settings.rb +33 -11
- data/lib/datadog/tracing/contrib/httprb/ext.rb +16 -9
- data/lib/datadog/tracing/contrib/httprb/instrumentation.rb +22 -5
- data/lib/datadog/tracing/contrib/kafka/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/kafka/ext.rb +42 -39
- data/lib/datadog/tracing/contrib/lograge/configuration/settings.rb +3 -2
- data/lib/datadog/tracing/contrib/lograge/ext.rb +3 -1
- data/lib/datadog/tracing/contrib/lograge/instrumentation.rb +2 -17
- data/lib/datadog/tracing/contrib/mongodb/configuration/settings.rb +14 -7
- data/lib/datadog/tracing/contrib/mongodb/ext.rb +20 -16
- data/lib/datadog/tracing/contrib/mongodb/subscribers.rb +16 -5
- data/lib/datadog/tracing/contrib/mysql2/configuration/settings.rb +17 -14
- data/lib/datadog/tracing/contrib/mysql2/ext.rb +15 -10
- data/lib/datadog/tracing/contrib/mysql2/instrumentation.rb +20 -6
- data/lib/datadog/tracing/contrib/opensearch/configuration/settings.rb +52 -0
- data/lib/datadog/tracing/contrib/opensearch/ext.rb +37 -0
- data/lib/datadog/tracing/contrib/opensearch/integration.rb +44 -0
- data/lib/datadog/tracing/contrib/opensearch/patcher.rb +135 -0
- data/lib/datadog/tracing/contrib/opensearch/quantize.rb +81 -0
- data/lib/datadog/tracing/contrib/pg/configuration/settings.rb +22 -14
- data/lib/datadog/tracing/contrib/pg/ext.rb +22 -19
- data/lib/datadog/tracing/contrib/pg/instrumentation.rb +38 -5
- data/lib/datadog/tracing/contrib/presto/configuration/settings.rb +14 -7
- data/lib/datadog/tracing/contrib/presto/ext.rb +25 -20
- data/lib/datadog/tracing/contrib/presto/instrumentation.rb +14 -5
- data/lib/datadog/tracing/contrib/propagation/sql_comment/ext.rb +12 -10
- data/lib/datadog/tracing/contrib/propagation/sql_comment.rb +1 -1
- data/lib/datadog/tracing/contrib/qless/configuration/settings.rb +12 -8
- data/lib/datadog/tracing/contrib/qless/ext.rb +14 -12
- data/lib/datadog/tracing/contrib/que/configuration/settings.rb +21 -12
- data/lib/datadog/tracing/contrib/racecar/configuration/settings.rb +9 -7
- data/lib/datadog/tracing/contrib/racecar/event.rb +5 -5
- data/lib/datadog/tracing/contrib/racecar/ext.rb +20 -18
- data/lib/datadog/tracing/contrib/rack/configuration/settings.rb +16 -12
- data/lib/datadog/tracing/contrib/rack/ext.rb +18 -16
- data/lib/datadog/tracing/contrib/rack/header_collection.rb +3 -0
- data/lib/datadog/tracing/contrib/rack/header_tagging.rb +63 -0
- data/lib/datadog/tracing/contrib/rack/middlewares.rb +8 -49
- data/lib/datadog/tracing/contrib/rails/configuration/settings.rb +19 -15
- data/lib/datadog/tracing/contrib/rails/ext.rb +7 -5
- data/lib/datadog/tracing/contrib/rails/log_injection.rb +7 -10
- data/lib/datadog/tracing/contrib/rails/patcher.rb +10 -41
- data/lib/datadog/tracing/contrib/rails/railtie.rb +3 -3
- data/lib/datadog/tracing/contrib/rake/configuration/settings.rb +13 -10
- data/lib/datadog/tracing/contrib/rake/ext.rb +14 -12
- data/lib/datadog/tracing/contrib/redis/configuration/settings.rb +17 -9
- data/lib/datadog/tracing/contrib/redis/ext.rb +22 -15
- data/lib/datadog/tracing/contrib/redis/instrumentation.rb +3 -38
- data/lib/datadog/tracing/contrib/redis/tags.rb +16 -7
- data/lib/datadog/tracing/contrib/redis/trace_middleware.rb +46 -33
- data/lib/datadog/tracing/contrib/resque/configuration/settings.rb +13 -7
- data/lib/datadog/tracing/contrib/resque/ext.rb +9 -7
- data/lib/datadog/tracing/contrib/rest_client/configuration/settings.rb +16 -9
- data/lib/datadog/tracing/contrib/rest_client/ext.rb +15 -8
- data/lib/datadog/tracing/contrib/rest_client/request_patch.rb +25 -5
- data/lib/datadog/tracing/contrib/roda/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/semantic_logger/configuration/settings.rb +3 -2
- data/lib/datadog/tracing/contrib/semantic_logger/ext.rb +3 -1
- data/lib/datadog/tracing/contrib/semantic_logger/instrumentation.rb +4 -20
- data/lib/datadog/tracing/contrib/sequel/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/sequel/ext.rb +10 -8
- data/lib/datadog/tracing/contrib/sequel/utils.rb +7 -7
- data/lib/datadog/tracing/contrib/shoryuken/configuration/settings.rb +14 -8
- data/lib/datadog/tracing/contrib/shoryuken/ext.rb +14 -12
- data/lib/datadog/tracing/contrib/sidekiq/configuration/settings.rb +18 -11
- data/lib/datadog/tracing/contrib/sidekiq/ext.rb +32 -30
- data/lib/datadog/tracing/contrib/sinatra/configuration/settings.rb +11 -9
- data/lib/datadog/tracing/contrib/sinatra/env.rb +0 -17
- data/lib/datadog/tracing/contrib/sinatra/ext.rb +21 -19
- data/lib/datadog/tracing/contrib/sinatra/tracer_middleware.rb +3 -14
- data/lib/datadog/tracing/contrib/sneakers/configuration/settings.rb +14 -8
- data/lib/datadog/tracing/contrib/sneakers/ext.rb +1 -0
- data/lib/datadog/tracing/contrib/sneakers/tracer.rb +1 -1
- data/lib/datadog/tracing/contrib/span_attribute_schema.rb +74 -10
- data/lib/datadog/tracing/contrib/stripe/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/sucker_punch/configuration/settings.rb +9 -6
- data/lib/datadog/tracing/contrib/sucker_punch/ext.rb +15 -13
- data/lib/datadog/tracing/contrib/utils/database.rb +5 -3
- data/lib/datadog/tracing/contrib/utils/quantization/http.rb +11 -11
- data/lib/datadog/tracing/contrib.rb +1 -0
- data/lib/datadog/tracing/correlation.rb +29 -12
- data/lib/datadog/tracing/diagnostics/environment_logger.rb +165 -0
- data/lib/datadog/tracing/diagnostics/ext.rb +21 -19
- data/lib/datadog/tracing/distributed/b3_multi.rb +2 -2
- data/lib/datadog/tracing/distributed/b3_single.rb +1 -1
- data/lib/datadog/tracing/distributed/datadog.rb +0 -1
- data/lib/datadog/tracing/distributed/propagation.rb +35 -34
- data/lib/datadog/tracing/distributed/trace_context.rb +52 -17
- data/lib/datadog/tracing/metadata/ext.rb +9 -6
- data/lib/datadog/tracing/metadata/tagging.rb +3 -3
- data/lib/datadog/tracing/remote.rb +78 -0
- data/lib/datadog/tracing/sampling/rule_sampler.rb +29 -0
- data/lib/datadog/tracing/span_operation.rb +3 -15
- data/lib/datadog/tracing/sync_writer.rb +3 -3
- data/lib/datadog/tracing/trace_digest.rb +31 -0
- data/lib/datadog/tracing/trace_operation.rb +16 -3
- data/lib/datadog/tracing/trace_segment.rb +5 -2
- data/lib/datadog/tracing/tracer.rb +12 -1
- data/lib/datadog/{core → tracing}/transport/http/api/instance.rb +1 -1
- data/lib/datadog/{core → tracing}/transport/http/api/spec.rb +1 -1
- data/lib/datadog/tracing/transport/http/api.rb +43 -0
- data/lib/datadog/{core → tracing}/transport/http/builder.rb +13 -68
- data/lib/datadog/tracing/transport/http/client.rb +57 -0
- data/lib/datadog/tracing/transport/http/statistics.rb +47 -0
- data/lib/datadog/tracing/transport/http/traces.rb +152 -0
- data/lib/datadog/tracing/transport/http.rb +124 -0
- data/lib/datadog/tracing/transport/io/client.rb +89 -0
- data/lib/datadog/tracing/transport/io/response.rb +27 -0
- data/lib/datadog/tracing/transport/io/traces.rb +101 -0
- data/lib/datadog/tracing/transport/io.rb +30 -0
- data/lib/datadog/tracing/transport/serializable_trace.rb +126 -0
- data/lib/datadog/tracing/transport/statistics.rb +77 -0
- data/lib/datadog/tracing/transport/trace_formatter.rb +209 -0
- data/lib/datadog/tracing/transport/traces.rb +224 -0
- data/lib/datadog/tracing/workers/trace_writer.rb +6 -4
- data/lib/datadog/tracing/workers.rb +4 -2
- data/lib/datadog/tracing/writer.rb +5 -2
- data/lib/ddtrace/transport/ext.rb +22 -14
- data/lib/ddtrace/version.rb +9 -12
- data/lib/ddtrace.rb +1 -1
- metadata +101 -93
- data/lib/datadog/ci/configuration/components.rb +0 -32
- data/lib/datadog/ci/configuration/settings.rb +0 -53
- data/lib/datadog/ci/contrib/cucumber/configuration/settings.rb +0 -33
- data/lib/datadog/ci/contrib/cucumber/ext.rb +0 -20
- data/lib/datadog/ci/contrib/cucumber/formatter.rb +0 -94
- data/lib/datadog/ci/contrib/cucumber/instrumentation.rb +0 -28
- data/lib/datadog/ci/contrib/cucumber/integration.rb +0 -47
- data/lib/datadog/ci/contrib/cucumber/patcher.rb +0 -27
- data/lib/datadog/ci/contrib/rspec/configuration/settings.rb +0 -33
- data/lib/datadog/ci/contrib/rspec/example.rb +0 -68
- data/lib/datadog/ci/contrib/rspec/ext.rb +0 -19
- data/lib/datadog/ci/contrib/rspec/integration.rb +0 -48
- data/lib/datadog/ci/contrib/rspec/patcher.rb +0 -27
- data/lib/datadog/ci/ext/app_types.rb +0 -9
- data/lib/datadog/ci/ext/environment.rb +0 -575
- data/lib/datadog/ci/ext/settings.rb +0 -10
- data/lib/datadog/ci/ext/test.rb +0 -35
- data/lib/datadog/ci/extensions.rb +0 -19
- data/lib/datadog/ci/flush.rb +0 -38
- data/lib/datadog/ci/test.rb +0 -81
- data/lib/datadog/ci.rb +0 -20
- data/lib/datadog/core/configuration/dependency_resolver.rb +0 -28
- data/lib/datadog/core/configuration/option_definition_set.rb +0 -22
- data/lib/datadog/core/configuration/option_set.rb +0 -10
- data/lib/datadog/core/transport/config.rb +0 -58
- data/lib/datadog/core/transport/http/api.rb +0 -57
- data/lib/datadog/core/transport/http/client.rb +0 -45
- data/lib/datadog/core/transport/http/config.rb +0 -268
- data/lib/datadog/core/transport/http/negotiation.rb +0 -144
- data/lib/datadog/core/transport/http.rb +0 -169
- data/lib/datadog/core/utils/object_set.rb +0 -43
- data/lib/datadog/core/utils/string_table.rb +0 -47
- data/lib/datadog/profiling/backtrace_location.rb +0 -34
- data/lib/datadog/profiling/buffer.rb +0 -43
- data/lib/datadog/profiling/collectors/old_stack.rb +0 -301
- data/lib/datadog/profiling/encoding/profile.rb +0 -41
- data/lib/datadog/profiling/event.rb +0 -15
- data/lib/datadog/profiling/events/stack.rb +0 -82
- data/lib/datadog/profiling/old_recorder.rb +0 -107
- data/lib/datadog/profiling/pprof/builder.rb +0 -125
- data/lib/datadog/profiling/pprof/converter.rb +0 -102
- data/lib/datadog/profiling/pprof/message_set.rb +0 -16
- data/lib/datadog/profiling/pprof/payload.rb +0 -20
- data/lib/datadog/profiling/pprof/pprof.proto +0 -212
- data/lib/datadog/profiling/pprof/pprof_pb.rb +0 -81
- data/lib/datadog/profiling/pprof/stack_sample.rb +0 -139
- data/lib/datadog/profiling/pprof/string_table.rb +0 -12
- data/lib/datadog/profiling/pprof/template.rb +0 -118
- data/lib/datadog/profiling/trace_identifiers/ddtrace.rb +0 -43
- data/lib/datadog/profiling/trace_identifiers/helper.rb +0 -45
- data/lib/datadog/tracing/contrib/sinatra/headers.rb +0 -35
- data/lib/ddtrace/transport/http/adapters/net.rb +0 -168
- data/lib/ddtrace/transport/http/adapters/registry.rb +0 -27
- data/lib/ddtrace/transport/http/adapters/test.rb +0 -85
- data/lib/ddtrace/transport/http/adapters/unix_socket.rb +0 -77
- data/lib/ddtrace/transport/http/api/endpoint.rb +0 -29
- data/lib/ddtrace/transport/http/api/fallbacks.rb +0 -24
- data/lib/ddtrace/transport/http/api/instance.rb +0 -35
- data/lib/ddtrace/transport/http/api/map.rb +0 -16
- data/lib/ddtrace/transport/http/api/spec.rb +0 -17
- data/lib/ddtrace/transport/http/api.rb +0 -39
- data/lib/ddtrace/transport/http/builder.rb +0 -176
- data/lib/ddtrace/transport/http/client.rb +0 -52
- data/lib/ddtrace/transport/http/env.rb +0 -58
- data/lib/ddtrace/transport/http/response.rb +0 -58
- data/lib/ddtrace/transport/http/statistics.rb +0 -43
- data/lib/ddtrace/transport/http/traces.rb +0 -144
- data/lib/ddtrace/transport/http.rb +0 -117
- data/lib/ddtrace/transport/io/client.rb +0 -85
- data/lib/ddtrace/transport/io/response.rb +0 -25
- data/lib/ddtrace/transport/io/traces.rb +0 -99
- data/lib/ddtrace/transport/io.rb +0 -28
- data/lib/ddtrace/transport/parcel.rb +0 -20
- data/lib/ddtrace/transport/request.rb +0 -15
- data/lib/ddtrace/transport/response.rb +0 -60
- data/lib/ddtrace/transport/serializable_trace.rb +0 -122
- data/lib/ddtrace/transport/statistics.rb +0 -75
- data/lib/ddtrace/transport/trace_formatter.rb +0 -198
- data/lib/ddtrace/transport/traces.rb +0 -216
@@ -22,11 +22,12 @@ module Datadog
|
|
22
22
|
def watch_request_dispatch(gateway = Instrumentation.gateway)
|
23
23
|
gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
|
24
24
|
block = false
|
25
|
+
|
25
26
|
event = nil
|
26
27
|
scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
|
27
28
|
|
28
29
|
AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
|
29
|
-
Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result
|
30
|
+
Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
|
30
31
|
if result.status == :match
|
31
32
|
# TODO: should this hash be an Event instance instead?
|
32
33
|
event = {
|
@@ -46,7 +47,7 @@ module Datadog
|
|
46
47
|
end
|
47
48
|
end
|
48
49
|
|
49
|
-
|
50
|
+
block = Rack::Reactive::RequestBody.publish(op, gateway_request)
|
50
51
|
end
|
51
52
|
|
52
53
|
next [nil, [[:block, event]]] if block
|
@@ -65,11 +66,12 @@ module Datadog
|
|
65
66
|
def watch_request_routed(gateway = Instrumentation.gateway)
|
66
67
|
gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
|
67
68
|
block = false
|
69
|
+
|
68
70
|
event = nil
|
69
71
|
scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
|
70
72
|
|
71
73
|
AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
|
72
|
-
Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result
|
74
|
+
Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result|
|
73
75
|
if result.status == :match
|
74
76
|
# TODO: should this hash be an Event instance instead?
|
75
77
|
event = {
|
@@ -89,7 +91,7 @@ module Datadog
|
|
89
91
|
end
|
90
92
|
end
|
91
93
|
|
92
|
-
|
94
|
+
block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
|
93
95
|
end
|
94
96
|
|
95
97
|
next [nil, [[:block, event]]] if block
|
@@ -65,9 +65,12 @@ module Datadog
|
|
65
65
|
catch(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT) { super }
|
66
66
|
end
|
67
67
|
|
68
|
-
if request_response
|
69
|
-
|
70
|
-
|
68
|
+
if request_response
|
69
|
+
blocked_event = request_response.find { |action, _options| action == :block }
|
70
|
+
if blocked_event
|
71
|
+
self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
|
72
|
+
request_return = nil
|
73
|
+
end
|
71
74
|
end
|
72
75
|
|
73
76
|
request_return
|
@@ -103,11 +106,14 @@ module Datadog
|
|
103
106
|
[gateway_request, gateway_route_params]
|
104
107
|
)
|
105
108
|
|
106
|
-
if request_response
|
107
|
-
|
109
|
+
if request_response
|
110
|
+
blocked_event = request_response.find { |action, _options| action == :block }
|
111
|
+
if blocked_event
|
112
|
+
self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
|
108
113
|
|
109
|
-
|
110
|
-
|
114
|
+
# interrupt request and return response to dispatch! for consistency
|
115
|
+
throw(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT, response)
|
116
|
+
end
|
111
117
|
end
|
112
118
|
|
113
119
|
yield(*args)
|
@@ -31,7 +31,7 @@ module Datadog
|
|
31
31
|
'server.request.path_params' => path_params,
|
32
32
|
}
|
33
33
|
|
34
|
-
waf_timeout = Datadog
|
34
|
+
waf_timeout = Datadog.configuration.appsec.waf_timeout
|
35
35
|
result = waf_context.run(waf_args, waf_timeout)
|
36
36
|
|
37
37
|
Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
|
@@ -40,11 +40,8 @@ module Datadog
|
|
40
40
|
when :match
|
41
41
|
Datadog.logger.debug { "WAF: #{result.inspect}" }
|
42
42
|
|
43
|
-
|
44
|
-
|
45
|
-
yield [result, block]
|
46
|
-
|
47
|
-
throw(:block, [result, true]) if block
|
43
|
+
yield result
|
44
|
+
throw(:block, true) unless result.actions.empty?
|
48
45
|
when :ok
|
49
46
|
Datadog.logger.debug { "WAF OK: #{result.inspect}" }
|
50
47
|
when :invalid_call
|
data/lib/datadog/appsec/event.rb
CHANGED
@@ -1,4 +1,6 @@
|
|
1
1
|
require 'json'
|
2
|
+
require 'zlib'
|
3
|
+
require 'base64'
|
2
4
|
|
3
5
|
require_relative 'rate_limiter'
|
4
6
|
|
@@ -34,78 +36,132 @@ module Datadog
|
|
34
36
|
Content-Language
|
35
37
|
].map!(&:downcase).freeze
|
36
38
|
|
39
|
+
MAX_ENCODED_SCHEMA_SIZE = 25000
|
40
|
+
# For more information about this number
|
41
|
+
# please check https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747221082
|
42
|
+
MIN_SCHEMA_SIZE_FOR_COMPRESSION = 260
|
43
|
+
|
37
44
|
# Record events for a trace
|
38
45
|
#
|
39
46
|
# This is expected to be called only once per trace for the rate limiter
|
40
47
|
# to properly apply
|
41
|
-
|
42
|
-
|
43
|
-
|
48
|
+
class << self
|
49
|
+
def record(span, *events)
|
50
|
+
# ensure rate limiter is called only when there are events to record
|
51
|
+
return if events.empty? || span.nil?
|
44
52
|
|
45
|
-
|
46
|
-
|
53
|
+
Datadog::AppSec::RateLimiter.limit(:traces) do
|
54
|
+
record_via_span(span, *events)
|
55
|
+
end
|
47
56
|
end
|
48
|
-
end
|
49
57
|
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
58
|
+
def record_via_span(span, *events)
|
59
|
+
events.group_by { |e| e[:trace] }.each do |trace, event_group|
|
60
|
+
unless trace
|
61
|
+
Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
|
62
|
+
next
|
63
|
+
end
|
64
|
+
|
65
|
+
trace.keep!
|
66
|
+
trace.set_tag(
|
67
|
+
Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
|
68
|
+
Datadog::Tracing::Sampling::Ext::Decision::ASM
|
69
|
+
)
|
56
70
|
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
service_entry_tags = build_service_entry_tags(event_group)
|
65
|
-
# complex types are unsupported, we need to serialize to a string
|
66
|
-
triggers = service_entry_tags.delete('_dd.appsec.triggers')
|
67
|
-
span.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
|
68
|
-
|
69
|
-
# apply tags to service entry span
|
70
|
-
service_entry_tags.each do |key, value|
|
71
|
-
span.set_tag(key, value)
|
71
|
+
# prepare and gather tags to apply
|
72
|
+
service_entry_tags = build_service_entry_tags(event_group)
|
73
|
+
|
74
|
+
# apply tags to service entry span
|
75
|
+
service_entry_tags.each do |key, value|
|
76
|
+
span.set_tag(key, value)
|
77
|
+
end
|
72
78
|
end
|
73
79
|
end
|
74
|
-
end
|
75
80
|
|
76
|
-
|
77
|
-
event_group
|
78
|
-
|
81
|
+
# rubocop:disable Metrics/MethodLength
|
82
|
+
def build_service_entry_tags(event_group)
|
83
|
+
waf_events = []
|
84
|
+
entry_tags = event_group.each_with_object({ '_dd.origin' => 'appsec' }) do |event, tags|
|
85
|
+
# TODO: assume HTTP request context for now
|
86
|
+
if (request = event[:request])
|
87
|
+
request.headers.each do |header, value|
|
88
|
+
tags["http.request.headers.#{header}"] = value if ALLOWED_REQUEST_HEADERS.include?(header.downcase)
|
89
|
+
end
|
90
|
+
|
91
|
+
tags['http.host'] = request.host
|
92
|
+
tags['http.useragent'] = request.user_agent
|
93
|
+
tags['network.client.ip'] = request.remote_addr
|
94
|
+
end
|
79
95
|
|
80
|
-
|
81
|
-
|
82
|
-
|
96
|
+
if (response = event[:response])
|
97
|
+
response.headers.each do |header, value|
|
98
|
+
tags["http.response.headers.#{header}"] = value if ALLOWED_RESPONSE_HEADERS.include?(header.downcase)
|
99
|
+
end
|
83
100
|
end
|
84
101
|
|
85
|
-
|
86
|
-
|
102
|
+
waf_result = event[:waf_result]
|
103
|
+
# accumulate triggers
|
104
|
+
waf_events += waf_result.events
|
105
|
+
|
106
|
+
waf_result.derivatives.each do |key, value|
|
107
|
+
parsed_value = json_parse(value)
|
108
|
+
next unless parsed_value
|
109
|
+
|
110
|
+
parsed_value_size = parsed_value.size
|
111
|
+
|
112
|
+
schema_value = if parsed_value_size >= MIN_SCHEMA_SIZE_FOR_COMPRESSION
|
113
|
+
compressed_and_base64_encoded(parsed_value)
|
114
|
+
else
|
115
|
+
parsed_value
|
116
|
+
end
|
117
|
+
next unless schema_value
|
118
|
+
|
119
|
+
if schema_value.size >= MAX_ENCODED_SCHEMA_SIZE
|
120
|
+
Datadog.logger.debug do
|
121
|
+
"Schema key: #{key} exceeds the max size value. It will not be included as part of the span tags"
|
122
|
+
end
|
123
|
+
next
|
124
|
+
end
|
125
|
+
|
126
|
+
tags[key] = schema_value
|
87
127
|
end
|
88
128
|
|
89
|
-
tags
|
90
|
-
tags['http.useragent'] = request.user_agent
|
91
|
-
tags['network.client.ip'] = request.remote_addr
|
129
|
+
tags
|
92
130
|
end
|
93
131
|
|
94
|
-
|
95
|
-
|
96
|
-
|
97
|
-
|
132
|
+
appsec_events = json_parse({ triggers: waf_events })
|
133
|
+
entry_tags['_dd.appsec.json'] = appsec_events if appsec_events
|
134
|
+
entry_tags
|
135
|
+
end
|
136
|
+
# rubocop:enable Metrics/MethodLength
|
98
137
|
|
99
|
-
|
100
|
-
|
101
|
-
|
138
|
+
private
|
139
|
+
|
140
|
+
def compressed_and_base64_encoded(value)
|
141
|
+
Base64.encode64(gzip(value))
|
142
|
+
rescue TypeError => e
|
143
|
+
Datadog.logger.debug do
|
144
|
+
"Failed to compress and encode value when populating AppSec::Event. Error: #{e.message}"
|
102
145
|
end
|
146
|
+
nil
|
147
|
+
end
|
103
148
|
|
104
|
-
|
149
|
+
def json_parse(value)
|
150
|
+
JSON.dump(value)
|
151
|
+
rescue ArgumentError => e
|
152
|
+
Datadog.logger.debug do
|
153
|
+
"Failed to parse value to JSON when populating AppSec::Event. Error: #{e.message}"
|
154
|
+
end
|
155
|
+
nil
|
156
|
+
end
|
105
157
|
|
106
|
-
|
107
|
-
|
108
|
-
|
158
|
+
def gzip(value)
|
159
|
+
sio = StringIO.new
|
160
|
+
# For an in depth comparison of Zlib options check https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747215473
|
161
|
+
gz = Zlib::GzipWriter.new(sio, Zlib::BEST_SPEED, Zlib::DEFAULT_STRATEGY)
|
162
|
+
gz.write(value)
|
163
|
+
gz.close
|
164
|
+
sio.string
|
109
165
|
end
|
110
166
|
end
|
111
167
|
end
|
@@ -8,136 +8,7 @@ module Datadog
|
|
8
8
|
module Extensions
|
9
9
|
# Inject AppSec into global objects.
|
10
10
|
def self.activate!
|
11
|
-
Core::Configuration::Settings.
|
12
|
-
end
|
13
|
-
|
14
|
-
# Global Datadog configuration mixin
|
15
|
-
module Settings
|
16
|
-
# Exposes AppSec settings through the
|
17
|
-
# `Datadog.configure {|c| c.appsec._option_ }`
|
18
|
-
# configuration path.
|
19
|
-
def appsec
|
20
|
-
@appsec ||= AppSecAdapter.new(AppSec.settings)
|
21
|
-
end
|
22
|
-
end
|
23
|
-
|
24
|
-
# Merges {Datadog::AppSec::Configuration::Settings} and {Datadog::AppSec::Configuration::DSL}
|
25
|
-
# into a single read/write object.
|
26
|
-
class AppSecAdapter
|
27
|
-
def initialize(settings)
|
28
|
-
@settings = settings
|
29
|
-
end
|
30
|
-
|
31
|
-
# Writer methods
|
32
|
-
|
33
|
-
def instrument(name, _unused = {})
|
34
|
-
dsl = AppSec::Configuration::DSL.new
|
35
|
-
dsl.instrument(name)
|
36
|
-
@settings.merge(dsl)
|
37
|
-
end
|
38
|
-
|
39
|
-
def enabled=(arg)
|
40
|
-
dsl = AppSec::Configuration::DSL.new
|
41
|
-
dsl.enabled = arg
|
42
|
-
@settings.merge(dsl)
|
43
|
-
end
|
44
|
-
|
45
|
-
def ruleset=(arg)
|
46
|
-
dsl = AppSec::Configuration::DSL.new
|
47
|
-
dsl.ruleset = arg
|
48
|
-
@settings.merge(dsl)
|
49
|
-
end
|
50
|
-
|
51
|
-
def ip_denylist=(arg)
|
52
|
-
dsl = AppSec::Configuration::DSL.new
|
53
|
-
dsl.ip_denylist = arg
|
54
|
-
@settings.merge(dsl)
|
55
|
-
end
|
56
|
-
|
57
|
-
def user_id_denylist=(arg)
|
58
|
-
dsl = AppSec::Configuration::DSL.new
|
59
|
-
dsl.user_id_denylist = arg
|
60
|
-
@settings.merge(dsl)
|
61
|
-
end
|
62
|
-
|
63
|
-
def waf_timeout=(arg)
|
64
|
-
dsl = AppSec::Configuration::DSL.new
|
65
|
-
dsl.waf_timeout = arg
|
66
|
-
@settings.merge(dsl)
|
67
|
-
end
|
68
|
-
|
69
|
-
def waf_debug=(arg)
|
70
|
-
dsl = AppSec::Configuration::DSL.new
|
71
|
-
dsl.waf_debug = arg
|
72
|
-
@settings.merge(dsl)
|
73
|
-
end
|
74
|
-
|
75
|
-
def trace_rate_limit=(arg)
|
76
|
-
dsl = AppSec::Configuration::DSL.new
|
77
|
-
dsl.trace_rate_limit = arg
|
78
|
-
@settings.merge(dsl)
|
79
|
-
end
|
80
|
-
|
81
|
-
def obfuscator_key_regex=(arg)
|
82
|
-
dsl = AppSec::Configuration::DSL.new
|
83
|
-
dsl.obfuscator_key_regex = arg
|
84
|
-
@settings.merge(dsl)
|
85
|
-
end
|
86
|
-
|
87
|
-
def obfuscator_value_regex=(arg)
|
88
|
-
dsl = AppSec::Configuration::DSL.new
|
89
|
-
dsl.obfuscator_value_regex = arg
|
90
|
-
@settings.merge(dsl)
|
91
|
-
end
|
92
|
-
|
93
|
-
# Reader methods
|
94
|
-
|
95
|
-
def enabled
|
96
|
-
@settings.enabled
|
97
|
-
end
|
98
|
-
|
99
|
-
def ruleset
|
100
|
-
@settings.ruleset
|
101
|
-
end
|
102
|
-
|
103
|
-
def ip_denylist
|
104
|
-
@settings.ip_denylist
|
105
|
-
end
|
106
|
-
|
107
|
-
def user_id_denylist
|
108
|
-
@settings.user_id_denylist
|
109
|
-
end
|
110
|
-
|
111
|
-
def waf_timeout
|
112
|
-
@settings.waf_timeout
|
113
|
-
end
|
114
|
-
|
115
|
-
def waf_debug
|
116
|
-
@settings.waf_debug
|
117
|
-
end
|
118
|
-
|
119
|
-
def trace_rate_limit
|
120
|
-
@settings.trace_rate_limit
|
121
|
-
end
|
122
|
-
|
123
|
-
def obfuscator_key_regex
|
124
|
-
@settings.obfuscator_key_regex
|
125
|
-
end
|
126
|
-
|
127
|
-
def obfuscator_value_regex
|
128
|
-
@settings.obfuscator_key_regex
|
129
|
-
end
|
130
|
-
|
131
|
-
def merge(arg)
|
132
|
-
@settings.merge(arg)
|
133
|
-
end
|
134
|
-
|
135
|
-
private
|
136
|
-
|
137
|
-
# Restore to original state, for testing only.
|
138
|
-
def reset!
|
139
|
-
@settings.send(:reset!)
|
140
|
-
end
|
11
|
+
Core::Configuration::Settings.extend(Configuration::Settings)
|
141
12
|
end
|
142
13
|
end
|
143
14
|
end
|
@@ -24,7 +24,7 @@ module Datadog
|
|
24
24
|
scope = Datadog::AppSec.active_scope
|
25
25
|
|
26
26
|
AppSec::Reactive::Operation.new('identity.set_user') do |op|
|
27
|
-
Monitor::Reactive::SetUser.subscribe(op, scope.processor_context) do |result
|
27
|
+
Monitor::Reactive::SetUser.subscribe(op, scope.processor_context) do |result|
|
28
28
|
if result.status == :match
|
29
29
|
# TODO: should this hash be an Event instance instead?
|
30
30
|
event = {
|
@@ -44,10 +44,10 @@ module Datadog
|
|
44
44
|
end
|
45
45
|
end
|
46
46
|
|
47
|
-
|
47
|
+
block = Monitor::Reactive::SetUser.publish(op, user)
|
48
48
|
end
|
49
49
|
|
50
|
-
throw(Datadog::AppSec::Ext::INTERRUPT, [nil, [:block, event]]) if block
|
50
|
+
throw(Datadog::AppSec::Ext::INTERRUPT, [nil, [[:block, event]]]) if block
|
51
51
|
|
52
52
|
ret, res = stack.call(user)
|
53
53
|
|
@@ -29,7 +29,7 @@ module Datadog
|
|
29
29
|
'usr.id' => user_id,
|
30
30
|
}
|
31
31
|
|
32
|
-
waf_timeout = Datadog
|
32
|
+
waf_timeout = Datadog.configuration.appsec.waf_timeout
|
33
33
|
result = waf_context.run(waf_args, waf_timeout)
|
34
34
|
|
35
35
|
Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
|
@@ -38,11 +38,8 @@ module Datadog
|
|
38
38
|
when :match
|
39
39
|
Datadog.logger.debug { "WAF: #{result.inspect}" }
|
40
40
|
|
41
|
-
|
42
|
-
|
43
|
-
yield [result, block]
|
44
|
-
|
45
|
-
throw(:block, [result, true]) if block
|
41
|
+
yield result
|
42
|
+
throw(:block, true) unless result.actions.empty?
|
46
43
|
when :ok
|
47
44
|
Datadog.logger.debug { "WAF OK: #{result.inspect}" }
|
48
45
|
when :invalid_call
|
@@ -0,0 +1,49 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Datadog
|
4
|
+
module AppSec
|
5
|
+
class Processor
|
6
|
+
# Actions store the actions information in memory
|
7
|
+
# Also, takes care of merging when RC send new information
|
8
|
+
module Actions
|
9
|
+
class << self
|
10
|
+
def actions
|
11
|
+
@actions ||= []
|
12
|
+
end
|
13
|
+
|
14
|
+
def fecth_configuration(action)
|
15
|
+
actions.find { |action_configuration| action_configuration['id'] == action }
|
16
|
+
end
|
17
|
+
|
18
|
+
def merge(actions_to_merge)
|
19
|
+
return if actions_to_merge.empty?
|
20
|
+
|
21
|
+
if actions.empty?
|
22
|
+
@actions = actions_to_merge
|
23
|
+
else
|
24
|
+
merged_actions = []
|
25
|
+
actions_dup = actions.dup
|
26
|
+
|
27
|
+
actions_to_merge.each do |new_action|
|
28
|
+
existing_action = actions_dup.find { |action| new_action['id'] == action['id'] }
|
29
|
+
|
30
|
+
# the old action is discard and the new kept
|
31
|
+
actions_dup.delete(existing_action) if existing_action
|
32
|
+
merged_actions << new_action
|
33
|
+
end
|
34
|
+
|
35
|
+
@actions = merged_actions.concat(actions_dup)
|
36
|
+
end
|
37
|
+
end
|
38
|
+
|
39
|
+
private
|
40
|
+
|
41
|
+
# Used in tests
|
42
|
+
def reset
|
43
|
+
@actions = []
|
44
|
+
end
|
45
|
+
end
|
46
|
+
end
|
47
|
+
end
|
48
|
+
end
|
49
|
+
end
|
@@ -47,6 +47,13 @@ module Datadog
|
|
47
47
|
data
|
48
48
|
end
|
49
49
|
|
50
|
+
def load_exclusions(ip_passlist: [])
|
51
|
+
exclusions = []
|
52
|
+
exclusions << [passlist_exclusions(ip_passlist)] if ip_passlist.any?
|
53
|
+
|
54
|
+
exclusions
|
55
|
+
end
|
56
|
+
|
50
57
|
private
|
51
58
|
|
52
59
|
def denylist_data(id, denylist)
|
@@ -56,6 +63,59 @@ module Datadog
|
|
56
63
|
'data' => denylist.map { |v| { 'value' => v.to_s, 'expiration' => 2**63 } }
|
57
64
|
}
|
58
65
|
end
|
66
|
+
|
67
|
+
def passlist_exclusions(ip_passlist) # rubocop:disable Metrics/MethodLength
|
68
|
+
case ip_passlist
|
69
|
+
when Array
|
70
|
+
pass = ip_passlist
|
71
|
+
monitor = []
|
72
|
+
when Hash
|
73
|
+
pass = ip_passlist[:pass]
|
74
|
+
monitor = ip_passlist[:monitor]
|
75
|
+
else
|
76
|
+
pass = []
|
77
|
+
monitor = []
|
78
|
+
end
|
79
|
+
|
80
|
+
exclusions = []
|
81
|
+
|
82
|
+
exclusions << {
|
83
|
+
'conditions' => [
|
84
|
+
{
|
85
|
+
'operator' => 'ip_match',
|
86
|
+
'parameters' => {
|
87
|
+
'inputs' => [
|
88
|
+
{
|
89
|
+
'address' => 'http.client_ip'
|
90
|
+
}
|
91
|
+
],
|
92
|
+
'list' => pass
|
93
|
+
}
|
94
|
+
}
|
95
|
+
],
|
96
|
+
'id' => SecureRandom.uuid,
|
97
|
+
}
|
98
|
+
|
99
|
+
exclusions << {
|
100
|
+
'conditions' => [
|
101
|
+
{
|
102
|
+
'operator' => 'ip_match',
|
103
|
+
'parameters' => {
|
104
|
+
'inputs' => [
|
105
|
+
{
|
106
|
+
'address' => 'http.client_ip'
|
107
|
+
}
|
108
|
+
],
|
109
|
+
'list' => monitor
|
110
|
+
}
|
111
|
+
}
|
112
|
+
],
|
113
|
+
'id' => SecureRandom.uuid,
|
114
|
+
'on_match' => 'monitor'
|
115
|
+
}
|
116
|
+
|
117
|
+
exclusions
|
118
|
+
end
|
59
119
|
end
|
60
120
|
end
|
61
121
|
end
|
@@ -1,5 +1,7 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
+
require_relative '../assets'
|
4
|
+
|
3
5
|
module Datadog
|
4
6
|
module AppSec
|
5
7
|
class Processor
|
@@ -16,8 +18,25 @@ module Datadog
|
|
16
18
|
end
|
17
19
|
end
|
18
20
|
|
21
|
+
DEFAULT_WAF_PROCESSORS = begin
|
22
|
+
JSON.parse(Datadog::AppSec::Assets.waf_processors)
|
23
|
+
rescue StandardError => e
|
24
|
+
Datadog.logger.error { "libddwaf rulemerger failed to parse default waf processors. Error: #{e.inspect}" }
|
25
|
+
[]
|
26
|
+
end
|
27
|
+
|
28
|
+
DEFAULT_WAF_SCANNERS = begin
|
29
|
+
JSON.parse(Datadog::AppSec::Assets.waf_scanners)
|
30
|
+
rescue StandardError => e
|
31
|
+
Datadog.logger.error { "libddwaf rulemerger failed to parse default waf scanners. Error: #{e.inspect}" }
|
32
|
+
[]
|
33
|
+
end
|
34
|
+
|
19
35
|
class << self
|
20
|
-
def merge(
|
36
|
+
def merge(
|
37
|
+
rules:, data: [], overrides: [], exclusions: [], custom_rules: [],
|
38
|
+
processors: DEFAULT_WAF_PROCESSORS, scanners: DEFAULT_WAF_SCANNERS
|
39
|
+
)
|
21
40
|
combined_rules = combine_rules(rules)
|
22
41
|
|
23
42
|
combined_data = combine_data(data) if data.any?
|
@@ -29,7 +48,8 @@ module Datadog
|
|
29
48
|
combined_rules['rules_override'] = combined_overrides if combined_overrides
|
30
49
|
combined_rules['exclusions'] = combined_exclusions if combined_exclusions
|
31
50
|
combined_rules['custom_rules'] = combined_custom_rules if combined_custom_rules
|
32
|
-
|
51
|
+
combined_rules['processors'] = processors
|
52
|
+
combined_rules['scanners'] = scanners
|
33
53
|
combined_rules
|
34
54
|
end
|
35
55
|
|