Skip to content

Commit 40a8587

Browse files
morrisonlevimorrisonlevi
committed
Merge branch 'master' into levi/prof-rust-1.76
2 parents 273ff03 + b23438e commit 40a8587

143 files changed

Lines changed: 2403 additions & 6503 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.circleci/continue_config.yml‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -650,7 +650,9 @@ commands:
650650
steps:
651651
- run:
652652
name: Build Profiler NTS
653+
shell: /bin/bash -ieo pipefail
653654
command: |
655+
source "$BASH_ENV"
654656
if [ -d '/opt/rh/devtoolset-7' ] ; then
655657
set +eo pipefail
656658
source scl_source enable devtoolset-7
@@ -659,7 +661,7 @@ commands:
659661
set -u
660662
prefix="<< parameters.prefix >>"
661663
mkdir -vp "${prefix}"
662-
command -v switch-php && switch-php "${PHP_VERSION}"
664+
switch-php "${PHP_VERSION}"
663665
cd profiling
664666
echo "${CARGO_TARGET_DIR}"
665667
cargo build --release
@@ -668,7 +670,9 @@ commands:
668670
objcopy --compress-debug-sections "${prefix}/datadog-profiling.so"
669671
- run:
670672
name: Build Profiler ZTS
673+
shell: /bin/bash -ieo pipefail
671674
command: |
675+
source "$BASH_ENV"
672676
if [ -d '/opt/rh/devtoolset-7' ] ; then
673677
set +eo pipefail
674678
source scl_source enable devtoolset-7
@@ -677,7 +681,7 @@ commands:
677681
set -u
678682
prefix="<< parameters.prefix >>"
679683
mkdir -vp "${prefix}"
680-
command -v switch-php && switch-php "${PHP_VERSION}-zts"
684+
switch-php "${PHP_VERSION}-zts"
681685
cd profiling
682686
echo "${CARGO_TARGET_DIR}"
683687
touch build.rs #make sure `build.rs` gets executed after `switch-php` call
@@ -1411,7 +1415,14 @@ jobs:
14111415
command: |
14121416
export DEBIAN_FRONTEND=noninteractive
14131417
apt update
1414-
apt install -y wget sudo git g++ gcc gcovr cmake make curl libcurl4-gnutls-dev clang clang-tidy clang-format git php-dev php8.2-xml php-cgi cargo
1418+
apt install -y wget sudo git g++ gcc gcovr cmake make curl libcurl4-gnutls-dev clang clang-tidy clang-format git php-dev php8.2-xml php-cgi
1419+
- run:
1420+
name: Install rust
1421+
command: |
1422+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /tmp/rustup.sh
1423+
chmod +x /tmp/rustup.sh
1424+
/tmp/rustup.sh -y --default-toolchain 1.76
1425+
sudo ln -s $HOME/.cargo/bin/* /usr/bin/
14151426
- run: git config --global --add safe.directory /home/circleci/datadog/appsec/third_party/libddwaf
14161427
- run:
14171428
name: CMake
@@ -1422,7 +1433,7 @@ jobs:
14221433
- run:
14231434
name: Test
14241435
command: |
1425-
make -C appsec/build -j $(nproc) xtest ddappsec_helper_test
1436+
PATH=$PATH:$HOME/.cargo/bin make -C appsec/build -j $(nproc) xtest ddappsec_helper_test
14261437
./appsec/build/tests/helper/ddappsec_helper_test
14271438
- run:
14281439
name: Generate XML coverage
@@ -3855,7 +3866,7 @@ jobs:
38553866
php datadog-setup.php --file "${installable_bundle}" --php-bin php --enable-profiling
38563867
# run phpize just to get run-tests.php
38573868
phpize
3858-
php run-tests.php -p $(which php) --show-diff -g "FAIL,XFAIL,BORK,WARN,LEAK,XLEAK,SKIP" tests/ext/profiling
3869+
php run-tests.php -p $(which php) -d datadog.remote_config_enabled=false --show-diff -g "FAIL,XFAIL,BORK,WARN,LEAK,XLEAK,SKIP" tests/ext/profiling
38593870
38603871
"cbindgen up-to-date":
38613872
working_directory: ~/datadog

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.3.0
1+
1.4.0

‎appsec/cmake/helper.cmake‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ set_target_properties(helper_objects PROPERTIES
2020
CXX_STANDARD 20
2121
CXX_STANDARD_REQUIRED YES
2222
POSITION_INDEPENDENT_CODE 1)
23-
target_include_directories(helper_objects PUBLIC ${HELPER_INCLUDE_DIR})
23+
target_include_directories(helper_objects INTERFACE ${HELPER_INCLUDE_DIR})
2424
target_compile_definitions(helper_objects PUBLIC SPDLOG_ACTIVE_LEVEL=SPDLOG_LEVEL_TRACE)
2525
target_compile_options(helper_objects PRIVATE -ftls-model=global-dynamic)
2626
target_link_libraries(helper_objects PUBLIC libddwaf_objects pthread spdlog cpp-base64 msgpack_c RapidJSON::rapidjson Boost::system zlibstatic)
@@ -35,6 +35,8 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
3535
# Bind symbols lookup of symbols defined in the library to the library itself
3636
# also avoids relocation problems with libc++.a on linux/aarch64
3737
target_link_options(ddappsec-helper PRIVATE -Wl,-Bsymbolic)
38+
elseif(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
39+
target_link_options(ddappsec-helper PRIVATE -undefined dynamic_lookup)
3840
endif()
3941
set_target_properties(ddappsec-helper PROPERTIES
4042
CXX_VISIBILITY_PRESET hidden

‎appsec/src/extension/backtrace.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ php_backtrace_frame_to_datadog_backtrace_frame( // NOLINTNEXTLINE(bugprone-easil
4848
if (file) {
4949
// In order to be able to test full path encoded everywhere lets set
5050
// only the file name without path
51-
char *file_name = memrchr(Z_STRVAL_P(file), '/', Z_STRLEN_P(file));
51+
const char *file_name =
52+
zend_memrchr(Z_STRVAL_P(file), '/', Z_STRLEN_P(file));
5253
if (file_name) {
5354
zend_string *new_file = zend_string_init(file_name + 1,
5455
Z_STRLEN_P(file) - (file_name + 1 - Z_STRVAL_P(file)), 0);

‎appsec/src/extension/commands/client_init.c‎

Lines changed: 4 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -17,68 +17,20 @@
1717
#include "../version.h"
1818
#include "client_init.h"
1919

20-
static const unsigned int DEFAULT_AGENT_PORT = 8126;
21-
static const char *DEFAULT_AGENT_HOST = "127.0.0.1";
22-
static const unsigned int MAX_TCP_PORT_ALLOWED = UINT16_MAX;
23-
2420
static dd_result _pack_command(mpack_writer_t *nonnull w, void *nullable ctx);
2521
static dd_result _process_response(mpack_node_t root, void *nullable ctx);
2622
static void _process_meta_and_metrics(
2723
mpack_node_t root, struct req_info *nonnull ctx);
28-
static void _pack_agent_details(mpack_writer_t *nonnull w);
2924

3025
static const dd_command_spec _spec = {
3126
.name = "client_init",
3227
.name_len = sizeof("client_init") - 1,
33-
.num_args = 7,
28+
.num_args = 6,
3429
.outgoing_cb = _pack_command,
3530
.incoming_cb = _process_response,
3631
.config_features_cb = dd_command_process_config_features_unexpected,
3732
};
3833

39-
static void _pack_agent_details(mpack_writer_t *nonnull w)
40-
{
41-
zend_string *agent_host = get_global_DD_AGENT_HOST();
42-
zend_string *agent_url = get_global_DD_TRACE_AGENT_URL();
43-
unsigned int port = get_global_DD_TRACE_AGENT_PORT();
44-
char *host = NULL;
45-
php_url *parsed_url = NULL;
46-
47-
if (agent_host && ZSTR_LEN(agent_host) > 0) {
48-
host = ZSTR_VAL(agent_host);
49-
} else if (agent_url && ZSTR_LEN(agent_url) > 0) {
50-
parsed_url = php_url_parse(ZSTR_VAL(agent_url));
51-
if (parsed_url) {
52-
#if PHP_VERSION_ID < 70300
53-
if (parsed_url->host && strlen(parsed_url->host) > 0) {
54-
host = parsed_url->host;
55-
}
56-
#else
57-
if (parsed_url->host && ZSTR_LEN(parsed_url->host) > 0) {
58-
host = ZSTR_VAL(parsed_url->host);
59-
}
60-
#endif
61-
port = parsed_url->port;
62-
}
63-
}
64-
65-
if (!host) {
66-
host = (char *)DEFAULT_AGENT_HOST;
67-
}
68-
if (port <= 0 || port > MAX_TCP_PORT_ALLOWED) {
69-
port = DEFAULT_AGENT_PORT;
70-
}
71-
72-
dd_mpack_write_lstr(w, "host");
73-
dd_mpack_write_nullable_cstr(w, host);
74-
dd_mpack_write_lstr(w, "port");
75-
mpack_write_uint(w, port);
76-
77-
if (parsed_url) {
78-
php_url_free(parsed_url);
79-
}
80-
}
81-
8234
dd_result dd_client_init(dd_conn *nonnull conn, struct req_info *nonnull ctx)
8335
{
8436
return dd_command_exec_cred(conn, &_spec, ctx);
@@ -97,39 +49,6 @@ static dd_result _pack_command(
9749
mpack_write_bool(w, DDAPPSEC_G(active));
9850
}
9951

100-
// Service details
101-
// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers,readability-magic-numbers)
102-
mpack_start_map(w, 6);
103-
104-
dd_mpack_write_lstr(w, "service");
105-
dd_mpack_write_nullable_cstr(w, ZSTR_VAL(get_DD_SERVICE()));
106-
107-
dd_mpack_write_lstr(w, "extra_services");
108-
zval extra_services;
109-
ZVAL_ARR(&extra_services, get_global_DD_EXTRA_SERVICES());
110-
dd_mpack_write_zval(w, &extra_services);
111-
112-
dd_mpack_write_lstr(w, "env");
113-
dd_mpack_write_nullable_cstr(w, ZSTR_VAL(get_DD_ENV()));
114-
115-
dd_mpack_write_lstr(w, "tracer_version");
116-
dd_mpack_write_nullable_cstr(w, dd_trace_version());
117-
118-
dd_mpack_write_lstr(w, "app_version");
119-
dd_mpack_write_nullable_cstr(w, ZSTR_VAL(get_DD_VERSION()));
120-
121-
// We send this empty for now. The helper will check for empty and if so it
122-
// will generate it
123-
dd_mpack_write_lstr(w, "runtime_id");
124-
zend_string *runtime_id = dd_trace_get_formatted_runtime_id(false);
125-
if (runtime_id == NULL) {
126-
dd_mpack_write_nullable_cstr(w, "");
127-
} else {
128-
dd_mpack_write_nullable_zstr(w, runtime_id);
129-
zend_string_free(runtime_id);
130-
}
131-
mpack_finish_map(w);
132-
13352
// Engine settings
13453
// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers,readability-magic-numbers)
13554
mpack_start_map(w, 6);
@@ -180,15 +99,13 @@ static dd_result _pack_command(
18099

181100
// Remote config settings
182101
// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers,readability-magic-numbers)
183-
mpack_start_map(w, 4);
102+
mpack_start_map(w, 2);
184103

185104
dd_mpack_write_lstr(w, "enabled");
186105
mpack_write_bool(w, get_DD_REMOTE_CONFIG_ENABLED());
187106

188-
_pack_agent_details(w);
189-
190-
dd_mpack_write_lstr(w, "poll_interval");
191-
mpack_write_u32(w, get_DD_REMOTE_CONFIG_POLL_INTERVAL());
107+
dd_mpack_write_lstr(w, "shmem_path");
108+
dd_mpack_write_nullable_cstr(w, dd_trace_remote_config_get_path());
192109

193110
mpack_finish_map(w);
194111

‎appsec/src/extension/commands/config_sync.c‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,36 @@
88
#include <php.h>
99

1010
#include "../commands_helpers.h"
11+
#include "../ddtrace.h"
12+
#include "../msgpack_helpers.h"
13+
#include "config_sync.h"
1114
#include <mpack.h>
1215

13-
static dd_result _request_pack(
14-
mpack_writer_t *nonnull w, void *nullable ATTR_UNUSED ctx);
16+
static dd_result _request_pack(mpack_writer_t *nonnull w, void *nonnull ctx);
1517
dd_result dd_command_process_config_sync(
1618
mpack_node_t root, ATTR_UNUSED void *unspecnull ctx);
1719

1820
static const dd_command_spec _spec = {
1921
.name = "config_sync",
2022
.name_len = sizeof("config_sync") - 1,
21-
.num_args = 0, // a single map
23+
.num_args = 1,
2224
.outgoing_cb = _request_pack,
2325
.incoming_cb = dd_command_process_config_sync,
2426
.config_features_cb = dd_command_process_config_features,
2527
};
2628

27-
dd_result dd_config_sync(dd_conn *nonnull conn)
29+
dd_result dd_config_sync(
30+
dd_conn *nonnull conn, const struct config_sync_data *nonnull data)
2831
{
29-
return dd_command_exec(conn, &_spec, NULL);
32+
return dd_command_exec(conn, &_spec, (void *)data);
3033
}
3134

32-
static dd_result _request_pack(
33-
mpack_writer_t *nonnull w, void *nullable ATTR_UNUSED ctx)
35+
static dd_result _request_pack(mpack_writer_t *nonnull w, void *nonnull ctx_)
3436
{
35-
UNUSED(ctx);
36-
UNUSED(w);
37+
const struct config_sync_data *nonnull data =
38+
(struct config_sync_data *)ctx_;
39+
40+
dd_mpack_write_nullable_cstr(w, data->rem_cfg_path);
3741

3842
return dd_success;
3943
}

‎appsec/src/extension/commands/config_sync.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,9 @@
77

88
#include "../network.h"
99

10-
dd_result dd_config_sync(dd_conn *nonnull conn);
10+
struct config_sync_data {
11+
char *nullable rem_cfg_path;
12+
};
13+
14+
dd_result dd_config_sync(
15+
dd_conn *nonnull conn, const struct config_sync_data *nonnull data);

‎appsec/src/extension/ddappsec.c‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
#include "user_tracking.h"
4646

4747
#include <json/json.h>
48+
#include <zend_string.h>
4849

4950
#if ZTS
5051
static atomic_int _thread_count;
@@ -100,7 +101,7 @@ static zend_extension ddappsec_extension_entry = {
100101
PHP_DDAPPSEC_EXTNAME,
101102
PHP_DDAPPSEC_VERSION,
102103
"Datadog",
103-
"https://github.com/DataDog/dd-appsec-php",
104+
"https://github.com/DataDog/dd-trace-php",
104105
"Copyright Datadog",
105106
ddappsec_startup,
106107
NULL,
@@ -253,6 +254,21 @@ void dd_appsec_rinit_once()
253254
pthread_once(&_rinit_once_control, _rinit_once);
254255
}
255256

257+
static void _warn_on_empty_service_or_env()
258+
{
259+
if (!get_global_DD_APPSEC_TESTING() && get_DD_REMOTE_CONFIG_ENABLED() &&
260+
DDAPPSEC_G(enabled) != APPSEC_FULLY_DISABLED &&
261+
(zend_string_equals_literal(get_DD_ENV(), "") ||
262+
zend_string_equals_literal(get_DD_SERVICE(), ""))) {
263+
mlog(dd_log_warning,
264+
"AppSec is not disabled and Datadog service or env is empty. "
265+
"Please set DD_SERVICE and DD_ENV rather than setting the "
266+
"corresponding properties on the root span. Otherwise, remote "
267+
"configuration for AppSec will use service=unnamed-php-service and "
268+
"env=none");
269+
}
270+
}
271+
256272
// NOLINTNEXTLINE
257273
static PHP_RINIT_FUNCTION(ddappsec)
258274
{
@@ -265,6 +281,7 @@ static PHP_RINIT_FUNCTION(ddappsec)
265281
dd_appsec_rinit_once();
266282
zai_config_rinit();
267283
_check_enabled();
284+
_warn_on_empty_service_or_env();
268285

269286
if (DDAPPSEC_G(enabled) == APPSEC_FULLY_DISABLED) {
270287
return SUCCESS;
@@ -378,6 +395,23 @@ static void _check_enabled()
378395
};
379396
}
380397

398+
__attribute__((visibility("default"))) void dd_appsec_rc_conf(
399+
bool *nonnull appsec_features, bool *nonnull appsec_conf) // NOLINT
400+
{
401+
bool prev_enabled = DDAPPSEC_G(enabled);
402+
bool prev_active = DDAPPSEC_G(active);
403+
bool prev_to_be_configured = DDAPPSEC_G(to_be_configured);
404+
_check_enabled();
405+
406+
*appsec_features = DDAPPSEC_G(enabled) == APPSEC_ENABLED_VIA_REMCFG;
407+
// only enable ASM / ASM_DD / ASM_DATA if no rules file is specified
408+
*appsec_conf = get_global_DD_APPSEC_RULES()->len == 0;
409+
410+
DDAPPSEC_G(enabled) = prev_enabled;
411+
DDAPPSEC_G(active) = prev_active;
412+
DDAPPSEC_G(to_be_configured) = prev_to_be_configured;
413+
}
414+
381415
static PHP_FUNCTION(datadog_appsec_is_enabled)
382416
{
383417
if (zend_parse_parameters_none() == FAILURE) {

‎appsec/src/extension/ddappsec.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ extern __thread void *unspecnull ATTR_TLS_LOCAL_DYNAMIC TSRMLS_CACHE;
5656
void dd_appsec_rinit_once(void);
5757
int dd_appsec_rshutdown(bool ignore_verdict);
5858

59+
__attribute__((visibility("default"))) void dd_appsec_rc_conf(
60+
bool *nonnull appsec_features, bool *nonnull appsec_conf); // NOLINT
61+
5962
// Add a NO_CACHE version.
6063
// Use tsrm_get_ls_cache() instead of thread-local _tsrmls_ls_cache
6164
#ifdef ZTS

‎appsec/src/extension/ddappsec.version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,6 @@
22
global:
33
get_module;
44
dd_appsec_maybe_enable_helper;
5+
dd_appsec_rc_conf;
56
local: *;
67
};

0 commit comments

Comments
 (0)