dd-trace 6.12.0 → 6.14.0

package/packages/dd-trace/src/proxy.js

@@ -1,5 +1,7 @@
 'use strict'
 
+const { channel } = require('dc-polyfill')
+const uuid = require('../../../vendor/dist/crypto-randomuuid')
 const NoopProxy = require('./noop/proxy')
 const DatadogTracer = require('./tracer')
 const getConfig = require('./config')
@@ -7,12 +9,18 @@ const { getEnvironmentVariable } = require('./config/helper')
 const runtimeMetrics = require('./runtime_metrics')
 const log = require('./log')
 const { setStartupLogPluginManager, startupLog } = require('./startup-log')
-const DynamicInstrumentation = require('./debugger')
 const telemetry = require('./telemetry')
 const nomenclature = require('./service-naming')
 const PluginManager = require('./plugin_manager')
 const NoopDogStatsDClient = require('./noop/dogstatsd')
-const { IS_SERVERLESS } = require('./serverless')
+const {
+  IS_AWS_LAMBDA_MICROVM,
+  IS_SERVERLESS,
+  NODE_BUNDLES_OPENSSL,
+  initializeServerlessTelemetry,
+  supportsServerlessTelemetryRetention,
+} = require('./serverless')
+const { flushServerlessTelemetry, registerTelemetryFlusher } = require('./flush')
 const processTags = require('./process-tags')
 const { isTrue } = require('./util')
 const {
@@ -41,6 +49,20 @@ const OPENFEATURE_STATE_NOOP = 0
 const OPENFEATURE_STATE_LAZY = 1
 const OPENFEATURE_STATE_ACTIVE = 2
 
+let dynamicInstrumentation
+
+function getDynamicInstrumentation () {
+  dynamicInstrumentation ??= require('./debugger')
+  return dynamicInstrumentation
+}
+
+const UUID_POOL_SIZE = 128
+
+const BUNDLED_OPENSSL_WARNING = 'This Node.js build bundles its own OpenSSL, so its random number ' +
+  'generator is not reseeded when a MicroVM clone resumes and trace IDs may repeat across clones. ' +
+  'Install Node.js from the Amazon Linux 2023 repositories (for example `dnf install nodejs22`) so it ' +
+  'links the base image\'s snapsafe OpenSSL.'
+
 class LazyModule {
   constructor (provider) {
     this.provider = provider
@@ -100,6 +122,15 @@ class Tracer extends NoopProxy {
     this._pluginManager = new PluginManager(this)
     this.dogstatsd = new NoopDogStatsDClient()
     this._tracingInitialized = false
+    // Logs and metrics can need retention even when tracing is disabled.
+    if (supportsServerlessTelemetryRetention()) {
+      this._serverlessTelemetry = {
+        flushAll: (done, options) => {
+          if (typeof this._tracer?.flushAll === 'function') this._tracer.flushAll(done, options)
+          else flushServerlessTelemetry(done, options)
+        },
+      }
+    }
     this._flare = new LazyModule(() => require('./flare'))
     this.setBaggageItem = setBaggageItem
     this.getBaggageItem = getBaggageItem
@@ -134,6 +165,10 @@ class Tracer extends NoopProxy {
     try {
       const config = getConfig(options) // TODO: support dynamic code config
 
+      if (IS_AWS_LAMBDA_MICROVM) {
+        this.#registerMicroVmRunHook(config)
+      }
+
       // Add config dependent process tags
       processTags.initialize(config)
 
@@ -155,7 +190,7 @@ class Tracer extends NoopProxy {
 
       telemetry.start(config, this._pluginManager)
 
-      if (config.dogstatsd && !isOfflineTestOptimizationValidation()) {
+      if (config.dogstatsd && !config.DD_AGENTLESS_ENABLED && !isOfflineTestOptimizationValidation()) {
         // Custom Metrics
         lazyProxy(this, 'dogstatsd', () => require('./dogstatsd').CustomMetrics, config)
       }
@@ -205,7 +240,7 @@ class Tracer extends NoopProxy {
         }
 
         if (config.dynamicInstrumentation.enabled) {
-          DynamicInstrumentation.start(config, rc)
+          getDynamicInstrumentation().start(config, rc)
         }
 
         const openfeatureRemoteConfig = require('./openfeature/remote_config')
@@ -255,13 +290,20 @@ class Tracer extends NoopProxy {
 
       if (config.runtimeMetrics.enabled) {
         runtimeMetrics.start(config)
+        // Agent trace response metrics are recorded asynchronously, so drain
+        // runtime metrics after the trace export has completed.
+        registerTelemetryFlusher(done => runtimeMetrics.flush(done), { afterTrace: true })
       }
 
       this.#updateTracing(config)
 
-      this._modules.rewriter.enable(config)
+      if (config.iast.enabled) {
+        this._modules.rewriter.enable(config)
+      }
 
-      if (config.DD_TRACE_ENABLED && config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
+      if (config.isCiVisibility &&
+        config.DD_TRACE_ENABLED &&
+        config.testOptimization.DD_CIVISIBILITY_MANUAL_API_ENABLED) {
         const TestApiManualPlugin = require('./ci-visibility/test-api-manual/test-api-manual-plugin')
         this._testApiManualPlugin = new TestApiManualPlugin(this)
         // `shouldGetEnvironmentData` is passed as false so that we only lazily calculate it
@@ -271,8 +313,8 @@ class Tracer extends NoopProxy {
       }
       if (config.DD_AGENTLESS_LOG_SUBMISSION_ENABLED) {
         if (config.DD_API_KEY) {
-          const LogSubmissionPlugin = require('./ci-visibility/log-submission/log-submission-plugin')
-          const automaticLogPlugin = new LogSubmissionPlugin(this)
+          const LogSubmissionPlugin = require('./log-submission/log-submission-plugin')
+          const automaticLogPlugin = new LogSubmissionPlugin(this, config)
           automaticLogPlugin.configure({ ...config, enabled: true })
         } else {
           log.warn(
@@ -282,7 +324,7 @@ class Tracer extends NoopProxy {
         }
       }
 
-      if (config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
+      if (config.isCiVisibility && config.testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
         const getDynamicInstrumentationClient = require('./ci-visibility/dynamic-instrumentation')
         // We instantiate the client but do not start the Worker here. The worker is started lazily
         getDynamicInstrumentationClient(config)
@@ -295,6 +337,42 @@ class Tracer extends NoopProxy {
     return this
   }
 
+  /**
+   * Listens for the MicroVM /run lifecycle event and triggers a one-time
+   * identity reset on first fire.
+   *
+   * @param {import('./config/config-base')} config
+   */
+  #registerMicroVmRunHook (config) {
+    // Node reseeds its CSPRNG from the kernel on clone resume only when it links the base image's
+    // snapsafe libcrypto; a bundled OpenSSL keeps the snapshot's DRBG state, so the refresh below
+    // cannot produce distinct IDs. Logged at registration, during the image build, where the
+    // Dockerfile can still be fixed — not once per clone.
+    if (NODE_BUNDLES_OPENSSL) {
+      log.error(BUNDLED_OPENSSL_WARNING)
+    }
+
+    const ch = channel('http.server.request.start')
+
+    const onHttpRequest = ({ request }) => {
+      if (request.method === 'POST' && request.url === '/aws/lambda-microvms/runtime/v1/run') {
+        ch.unsubscribe(onHttpRequest)
+        drainUuidPool()
+        channel('datadog:identity:update').publish(config)
+        if (this._tracingInitialized) {
+          const storeTracerMetadata = require('./tracer_metadata')
+          const metadata = storeTracerMetadata(config)
+          if (metadata === undefined) {
+            log.warn('Could not store tracer configuration for service discovery')
+          }
+        }
+        channel('datadog:identity:refresh').publish(config)
+      }
+    }
+
+    ch.subscribe(onHttpRequest)
+  }
+
   /**
    * @param {import('./config/config-base')} config - Tracer configuration
    */
@@ -389,10 +467,12 @@ class Tracer extends NoopProxy {
     if (this._tracingInitialized) {
       this._tracer.configure(config)
       this._pluginManager.configure(config)
-      DynamicInstrumentation.configure(config)
+      dynamicInstrumentation?.configure(config)
       setStartupLogPluginManager(this._pluginManager)
       startupLog()
     }
+
+    initializeServerlessTelemetry(this._serverlessTelemetry)
   }
 
   /**
@@ -404,6 +484,9 @@ class Tracer extends NoopProxy {
    */
   #updateDebugger (config, rc) {
     const shouldBeEnabled = config.dynamicInstrumentation.enabled
+    if (!shouldBeEnabled && dynamicInstrumentation === undefined) return
+
+    const DynamicInstrumentation = getDynamicInstrumentation()
     const isCurrentlyStarted = DynamicInstrumentation.isStarted()
 
     if (shouldBeEnabled) {
@@ -487,4 +570,19 @@ function isOfflineValidationExporter (options) {
   return OFFLINE_VALIDATION_EXPORTERS.has(options?.experimental?.exporter)
 }
 
+/**
+ * Discards Node's buffered UUID entropy, so the identity subscribers draw from bytes generated
+ * after the clone resumed.
+ *
+ * `crypto.randomUUID()` serves `kBatchSize` (128, see `lib/internal/crypto/random.js`) UUIDs from one
+ * process-wide pool and refills it only when its cursor wraps back to 0. A full cycle crosses the
+ * cursor exactly once from any starting position, and the position is not observable, so the count
+ * has to be the batch size rather than the number of UUIDs we need.
+ */
+function drainUuidPool () {
+  for (let index = 0; index < UUID_POOL_SIZE; index++) {
+    uuid()
+  }
+}
+
 module.exports = Tracer