newrelic_rpm 3.12.0.288 → 9.10.2

data/lib/new_relic/agent/configuration/security_policy_source.rb

@@ -0,0 +1,246 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require 'new_relic/agent/configuration/dotted_hash'
+
+module NewRelic
+  module Agent
+    module Configuration
+      # The Language Security Policy Source gives customers the ability to
+      # configure high security mode settings.
+      class SecurityPolicySource < DottedHash
+        class << self
+          def enabled?(option)
+            Agent.config[option]
+          end
+
+          def record_sql_enabled?(option)
+            Agent.config[option] == 'obfuscated' ||
+              Agent.config[option] == 'raw' ||
+              false
+          end
+
+          def not_empty?(option)
+            !Agent.config[option].empty?
+          end
+
+          def change_setting(policies, option, new_value)
+            current_value = Agent.config[option]
+            unless current_value == new_value
+              NewRelic::Agent.logger.info( \
+                "Setting changed: {#{option}: from #{current_value} " \
+                "to #{new_value}}. Source: SecurityPolicySource"
+              )
+            end
+            policies[option] = new_value
+          end
+        end
+
+        # The keys of the security settings map are the names of security
+        # policies received from the server. They map to multiple configuration
+        # options in the local config. There is a hash of metadata that
+        # corresponds to each configuration option with the following keys:
+        #
+        # option: the configuration option name
+        # supported: true if the agent has one or more corresponding
+        #   configuration options
+        # enabled_fn: a callable that takes the configuration option and returns
+        #   true if the option is enabled, false otherwise
+        # disabled_value: the value of the configuration option when it is
+        #   disabled
+        # permitted_fn: a callable, that will be executed if an option is
+        #   permitted by the security policy and is also enabled by the config
+
+        SECURITY_SETTINGS_MAP = {
+          'record_sql' => [
+            {
+              option: :'transaction_tracer.record_sql',
+              supported: true,
+              enabled_fn: method(:record_sql_enabled?),
+              disabled_value: 'off',
+              permitted_fn: proc { |policies|
+                change_setting(policies, :'transaction_tracer.record_sql', 'obfuscated')
+              }
+            },
+            {
+              option: :'slow_sql.record_sql',
+              supported: true,
+              enabled_fn: method(:record_sql_enabled?),
+              disabled_value: 'off',
+              permitted_fn: proc { |policies|
+                change_setting(policies, :'slow_sql.record_sql', 'obfuscated')
+              }
+            },
+            {
+              option: :'mongo.capture_queries',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: proc { |policies|
+                change_setting(policies, :'mongo.obfuscate_queries', true)
+              }
+            },
+            {
+              option: :'elasticsearch.capture_queries',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: proc { |policies|
+                change_setting(policies, :'elasticsearch.obfuscate_queries', true)
+              }
+            },
+            {
+              option: :'transaction_tracer.record_redis_arguments',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ],
+          'attributes_include' => [
+            {
+              option: :'attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'transaction_tracer.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'transaction_events.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'error_collector.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'browser_monitoring.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'span_events.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            },
+            {
+              option: :'transaction_segments.attributes.include',
+              supported: true,
+              enabled_fn: method(:not_empty?),
+              disabled_value: [],
+              permitted_fn: nil
+            }
+          ],
+          'ai_monitoring' => [
+            {
+              option: :'ai_monitoring.enabled',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ],
+          'allow_raw_exception_messages' => [
+            {
+              option: :'strip_exception_messages.enabled',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ],
+          'custom_events' => [
+            {
+              option: :'custom_insights_events.enabled',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ],
+          'custom_parameters' => [
+            {
+              option: :'custom_attributes.enabled',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ],
+          'custom_instrumentation_editor' => [
+            {
+              option: nil,
+              supported: false,
+              enabled_fn: nil,
+              disabled_value: nil,
+              permitted_fn: nil
+            }
+          ],
+          'message_parameters' => [
+            {
+              option: :'message_tracer.segment_parameters.enabled',
+              supported: true,
+              enabled_fn: method(:enabled?),
+              disabled_value: false,
+              permitted_fn: nil
+            }
+          ]
+        }
+
+        def initialize(security_policies)
+          super(build_overrides(security_policies))
+        end
+
+        ENABLED = 'enabled'.freeze
+        COLON_COLON = '::'.freeze
+
+        def build_overrides(security_policies)
+          security_policies.inject({}) do |settings, (policy_name, policy_settings)|
+            SECURITY_SETTINGS_MAP[policy_name].each do |policy|
+              next unless policy[:supported]
+
+              if policy_settings[ENABLED]
+                if policy[:enabled_fn].call(policy[:option])
+                  if permitted_fn = policy[:permitted_fn]
+                    permitted_fn.call(settings)
+                  end
+                else
+                  config_source = Agent.config.source(policy[:option]).class.name.split(COLON_COLON).last
+                  NewRelic::Agent.logger.info( \
+                    "Setting applied: {#{policy[:option]}: #{policy[:disabled_value]}}. " \
+                    "Source: #{config_source}"
+                  )
+                end
+              else
+                settings[policy[:option]] = policy[:disabled_value]
+                NewRelic::Agent.logger.info( \
+                  "Setting applied: {#{policy[:option]}: #{policy[:disabled_value]}}. " \
+                  'Source: SecurityPolicySource'
+                )
+              end
+            end
+            settings
+          end
+        end
+      end
+    end
+  end
+end

data/lib/new_relic/agent/configuration/server_source.rb

@@ -1,6 +1,6 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 module NewRelic
   module Agent
@@ -10,30 +10,36 @@ module NewRelic
         # response, but should still be merged in as config settings to the
         # main agent configuration.
         TOP_LEVEL_KEYS = [
-          "apdex_t",
-          "application_id",
-          "beacon",
-          "browser_key",
-          "browser_monitoring.debug",
-          "browser_monitoring.loader",
-          "browser_monitoring.loader_version",
-          "collect_utilization",
-          "cross_process_id",
-          "data_report_period",
-          "data_report_periods.analytic_event_data",
-          "encoding_key",
-          "error_beacon",
-          "js_agent_file",
-          "js_agent_loader",
-          "trusted_account_ids"
+          'account_id',
+          'apdex_t',
+          'application_id',
+          'beacon',
+          'browser_key',
+          'browser_monitoring.debug',
+          'browser_monitoring.loader',
+          'browser_monitoring.loader_version',
+          'cross_process_id',
+          'data_report_period',
+          'encoding_key',
+          'entity_guid',
+          'error_beacon',
+          'js_agent_file',
+          'js_agent_loader',
+          'max_payload_size_in_bytes',
+          'primary_application_id',
+          'sampling_target',
+          'sampling_target_period_in_seconds',
+          'trusted_account_ids',
+          'trusted_account_key'
         ]
 
-        def initialize(connect_reply, existing_config={})
+        def initialize(connect_reply, existing_config = {})
           merged_settings = {}
 
           merge_top_level_keys(merged_settings, connect_reply)
           merge_agent_config_hash(merged_settings, connect_reply)
           fix_transaction_threshold(merged_settings)
+          add_event_harvest_config(merged_settings, connect_reply)
           filter_keys(merged_settings)
 
           apply_feature_gates(merged_settings, connect_reply, existing_config)
@@ -64,11 +70,46 @@ module NewRelic
 
         def fix_transaction_threshold(merged_settings)
           # when value is "apdex_f" remove the config and defer to default
-          if merged_settings['transaction_tracer.transaction_threshold'] =~ /apdex_f/i
+          if /apdex_f/i.match?(merged_settings['transaction_tracer.transaction_threshold'].to_s)
             merged_settings.delete('transaction_tracer.transaction_threshold')
           end
         end
 
+        EVENT_HARVEST_CONFIG_SUPPORTABILITY_METRIC_NAMES = {
+          :'transaction_events.max_samples_stored' => 'Supportability/EventHarvest/AnalyticEventData/HarvestLimit',
+          :'custom_insights_events.max_samples_stored' => 'Supportability/EventHarvest/CustomEventData/HarvestLimit',
+          :'error_collector.max_event_samples_stored' => 'Supportability/EventHarvest/ErrorEventData/HarvestLimit',
+          :'application_logging.forwarding.max_samples_stored' => 'Supportability/EventHarvest/LogEventData/HarvestLimit',
+          :'span_events.max_samples_stored' => 'Supportability/SpanEvent/Limit',
+          :event_report_period => 'Supportability/EventHarvest/ReportPeriod',
+          :'event_report_period.span_event_data' => 'Supportability/SpanEvent/ReportPeriod'
+        }
+
+        def add_event_harvest_config(merged_settings, connect_reply)
+          return unless event_harvest_config_is_valid(connect_reply)
+
+          event_harvest_config = EventHarvestConfig.to_config_hash(connect_reply)
+          EVENT_HARVEST_CONFIG_SUPPORTABILITY_METRIC_NAMES.each do |config_key, metric_name|
+            NewRelic::Agent.record_metric(metric_name, event_harvest_config[config_key])
+          end
+
+          merged_settings.merge!(event_harvest_config)
+        end
+
+        def event_harvest_config_is_valid(connect_reply)
+          event_harvest_config = connect_reply['event_harvest_config']
+
+          if event_harvest_config.nil? \
+              || event_harvest_config['harvest_limits'].values.min < 0 \
+              || (event_harvest_config['report_period_ms'] / 1000) <= 0
+            NewRelic::Agent.logger.warn('Invalid event harvest config found ' \
+                'in connect response; using default event report period.')
+            false
+          else
+            true
+          end
+        end
+
         def filter_keys(merged_settings)
           merged_settings.delete_if do |key, _|
             setting_spec = DEFAULTS[key.to_sym]
@@ -93,17 +134,19 @@ module NewRelic
         # do the real enforcement there.
         def apply_feature_gates(merged_settings, connect_reply, existing_config)
           gated_features = {
-            'transaction_tracer.enabled'     => 'collect_traces',
-            'slow_sql.enabled'               => 'collect_traces',
-            'error_collector.enabled'        => 'collect_errors',
-            'analytics_events.enabled'       => 'collect_analytics_events',
-            'custom_insights_events.enabled' => 'collect_custom_events'
+            'transaction_tracer.enabled' => 'collect_traces',
+            'slow_sql.enabled' => 'collect_traces',
+            'error_collector.enabled' => 'collect_errors',
+            'transaction_events.enabled' => 'collect_analytics_events',
+            'custom_insights_events.enabled' => 'collect_custom_events',
+            'error_collector.capture_events' => 'collect_error_events',
+            'span_events.enabled' => 'collect_span_events'
           }
           gated_features.each do |config_key, gate_key|
             if connect_reply.has_key?(gate_key)
               allowed_by_server = connect_reply[gate_key]
-              requested_value   = ungated_value(config_key, merged_settings, existing_config)
-              effective_value   = (allowed_by_server && requested_value)
+              requested_value = ungated_value(config_key, merged_settings, existing_config)
+              effective_value = (allowed_by_server && requested_value)
               merged_settings[config_key] = effective_value
             end
           end

data/lib/new_relic/agent/configuration/yaml_source.rb

@@ -1,17 +1,31 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
-require 'new_relic/agent/configuration'
+require 'new_relic/agent/configuration/dotted_hash'
 
 module NewRelic
   module Agent
     module Configuration
       class YamlSource < DottedHash
-        attr_accessor :file_path
+        attr_accessor :file_path, :failures
+        attr_reader :generated_for_user, :license_key
+
+        # These are configuration options that have a value of a Hash
+        # This is used in YamlSource#dot_flattened prevent flattening these values
+        CONFIG_WITH_HASH_VALUE = %w[expected_messages ignore_messages]
 
         def initialize(path, env)
+          @path = path
           config = {}
+          @failures = []
+
+          # These are needed in process_erb for populating the newrelic.yml via
+          # erb binding, necessary when using the default newrelic.yml file. They
+          # are defined as ivars instead of local variables to prevent
+          # `assigned but unused variable` warnings when running with -W
+          @generated_for_user = ''
+          @license_key = ''
 
           begin
             @file_path = validate_config_file_path(path)
@@ -20,23 +34,30 @@ module NewRelic
             ::NewRelic::Agent.logger.info("Reading configuration from #{path} (#{Dir.pwd})")
             raw_file = File.read(@file_path)
             erb_file = process_erb(raw_file)
-            config   = process_yaml(erb_file, env, config, @file_path)
+            config = process_yaml(erb_file, env, config, @file_path)
           rescue ScriptError, StandardError => e
-            ::NewRelic::Agent.logger.error("Failed to read or parse configuration file at #{path}", e)
+            log_failure("Failed to read or parse configuration file at #{path}", e)
           end
 
           substitute_transaction_threshold(config)
           booleanify_values(config, 'agent_enabled', 'enabled')
+          apply_aliases(config)
 
           super(config, true)
         end
 
+        def failed?
+          !@failures.empty?
+        end
+
         protected
 
         def validate_config_file_path(path)
+          return if NewRelic::Agent.config[:'serverless_mode.enabled']
+
           expanded_path = File.expand_path(path)
 
-          if path.empty? || !File.exists?(expanded_path)
+          if path.empty? || !File.exist?(expanded_path)
             warn_missing_config_file(expanded_path)
             return
           end
@@ -45,8 +66,8 @@ module NewRelic
         end
 
         def warn_missing_config_file(path)
-          based_on        = 'unknown'
-          source          = ::NewRelic::Agent.config.source(:config_path)
+          based_on = 'unknown'
+          source = ::NewRelic::Agent.config.source(:config_path)
           candidate_paths = [path]
 
           case source
@@ -61,9 +82,12 @@ module NewRelic
             based_on = 'API call'
           end
 
+          # This is not a failure, since we do support running without a
+          # newrelic.yml (configured with just ENV). It is, however, uncommon,
+          # so warn about it since it's very likely to be unintended.
           NewRelic::Agent.logger.warn(
             "No configuration file found. Working directory = #{Dir.pwd}",
-            "Looked in these locations (based on #{based_on}): #{candidate_paths.join(", ")}"
+            "Looked in these locations (based on #{based_on}): #{candidate_paths.join(', ')}"
           )
         end
 
@@ -73,23 +97,24 @@ module NewRelic
             # ERB template commented at the YML level is fine. Leave the line,
             # though, so ERB line numbers remain correct.
             file.gsub!(/^\s*#.*$/, '#')
-
-            # Next two are for populating the newrelic.yml via erb binding, necessary
-            # when using the default newrelic.yml file
-            generated_for_user = ''
-            license_key = ''
-
             ERB.new(file).result(binding)
           rescue ScriptError, StandardError => e
-            ::NewRelic::Agent.logger.error("Failed ERB processing configuration file. This is typically caused by a Ruby error in <% %> templating blocks in your newrelic.yml file.", e)
+            log_failure('Failed ERB processing configuration file. This is typically caused by a Ruby error in <% %> templating blocks in your newrelic.yml file.', e)
             nil
           end
         end
 
         def process_yaml(file, env, config, path)
           if file
-            confighash = with_yaml_engine { YAML.load(file) }
-            ::NewRelic::Agent.logger.error("Config file at #{path} doesn't include a '#{env}' section!") unless confighash.key?(env)
+            confighash = if YAML.respond_to?(:unsafe_load)
+              YAML.unsafe_load(file)
+            else
+              YAML.load(file)
+            end
+
+            unless confighash.key?(env)
+              log_failure("Config file at #{path} doesn't include a '#{env}' section!")
+            end
 
             config = confighash[env] || {}
           end
@@ -99,36 +124,61 @@ module NewRelic
 
         def substitute_transaction_threshold(config)
           if config['transaction_tracer'] &&
-              config['transaction_tracer']['transaction_threshold'] =~ /apdex_f/i
+              config['transaction_tracer']['transaction_threshold'].to_s =~ /apdex_f/i
             # when value is "apdex_f" remove the config and defer to default
             config['transaction_tracer'].delete('transaction_threshold')
+          elsif /apdex_f/i.match?(config['transaction_tracer.transaction_threshold'].to_s)
+            config.delete('transaction_tracer.transaction_threshold')
           end
         end
 
-        def with_yaml_engine
-          return yield unless NewRelic::LanguageSupport.needs_syck?
-
-          yamler = ::YAML::ENGINE.yamler
-          ::YAML::ENGINE.yamler = 'syck'
-          result = yield
-          ::YAML::ENGINE.yamler = yamler
-          result
-        end
-
-
         def booleanify_values(config, *keys)
-          # auto means defer ro default
+          # auto means defer to default
           keys.each do |option|
-            if config[option] == 'auto'
+            if 'auto' == config[option]
               config.delete(option)
             elsif !config[option].nil? && !is_boolean?(config[option])
-              config[option] = !!(config[option] =~ /yes|on|true/i)
+              coerced_value = config[option].to_s.match?(/yes|on|true/i)
+              if !coerced_value
+                log_failure("Unexpected value (#{config[option]}) for '#{option}' in #{@path}")
+              end
+              config[option] = coerced_value
             end
           end
         end
 
         def is_boolean?(value)
-          value == !!value
+          !!value == value
+        end
+
+        def log_failure(*messages)
+          ::NewRelic::Agent.logger.error(*messages)
+          messages.each { |message| @failures << message }
+        end
+
+        def dot_flattened(nested_hash, names = [], result = {})
+          nested_hash.each do |key, val|
+            next if val.nil?
+
+            if val.respond_to?(:has_key?) && !CONFIG_WITH_HASH_VALUE.include?(key)
+              dot_flattened(val, names + [key], result)
+            else
+              result[(names + [key]).join('.')] = val
+            end
+          end
+          result
+        end
+
+        def apply_aliases(config)
+          DEFAULTS.each do |config_setting, value|
+            next unless value[:aliases]
+
+            value[:aliases].each do |config_alias|
+              next unless config[config_setting].nil? && !config[config_alias.to_s].nil?
+
+              config[config_setting] = config[config_alias.to_s]
+            end
+          end
         end
       end
     end

data/lib/new_relic/agent/configuration.rb

@@ -1,6 +1,6 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 require 'new_relic/agent/configuration/manager'
 require 'new_relic/agent/configuration/dotted_hash'

data/lib/new_relic/agent/connect/request_builder.rb

@@ -0,0 +1,61 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require 'new_relic/environment_report'
+require 'new_relic/agent/configuration/event_harvest_config'
+
+module NewRelic
+  module Agent
+    module Connect
+      class RequestBuilder
+        def initialize(new_relic_service, config, event_harvest_config, environment_report)
+          @service = new_relic_service
+          @config = config
+          @event_harvest_config = event_harvest_config
+          @environment_report = sanitize_environment_report(environment_report)
+        end
+
+        # Initializes the hash of settings that we send to the
+        # server. Returns a literal hash containing the options
+        def connect_payload
+          {
+            :pid => $$,
+            :host => local_host,
+            :display_host => Agent.config[:'process_host.display_name'],
+            :app_name => Agent.config[:app_name],
+            :language => LANGUAGE,
+            :labels => Agent.config.parsed_labels,
+            :agent_version => NewRelic::VERSION::STRING,
+            :environment => @environment_report,
+            :metadata => environment_metadata,
+            :settings => Agent.config.to_collector_hash,
+            :high_security => Agent.config[:high_security],
+            :utilization => UtilizationData.new.to_collector_hash,
+            :identifier => "ruby:#{local_host}:#{Agent.config[:app_name].sort.join(',')}",
+            :event_harvest_config => @event_harvest_config
+          }
+        end
+
+        # We've seen objects in the environment report (Rails.env in
+        # particular) that can't serialize to JSON. Cope with that here and
+        # clear out so downstream code doesn't have to check again.
+        def sanitize_environment_report(environment_report)
+          return NewRelic::EMPTY_ARRAY unless @service.valid_to_marshal?(environment_report)
+
+          environment_report
+        end
+
+        def environment_metadata
+          env_copy = {}
+          ENV.keys.each { |k| env_copy[k] = ENV[k] if /^NEW_RELIC_METADATA_/.match?(k) }
+          env_copy
+        end
+
+        def local_host
+          NewRelic::Agent::Hostname.get
+        end
+      end
+    end
+  end
+end