Skip to content

Commit 72f5047

Browse files
cataphractcataphract
authored
Merge branch 'master' into glopes/appsec-abstract-ns
2 parents 50f6207 + 560e003 commit 72f5047

36 files changed

Lines changed: 583 additions & 135 deletions

‎.gitlab/dockerhub-login.sh‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
export VAULT_VERSION="1.20.0"
6+
7+
echo "=== Setting up Docker Hub authentication ==="
8+
9+
# Determine architecture for binary downloads
10+
arch="$(uname -m)"
11+
case "${arch}" in
12+
x86_64)
13+
vault_arch="amd64"
14+
;;
15+
aarch64|arm64)
16+
vault_arch="arm64"
17+
;;
18+
*)
19+
echo "Warning: Unsupported architecture: ${arch}. Skipping Docker Hub authentication." >&2
20+
exit 0
21+
;;
22+
esac
23+
24+
# Install jq if not already available
25+
if ! command -v jq > /dev/null 2>&1; then
26+
echo "Installing jq..."
27+
28+
jq_path="/tmp/jq"
29+
30+
if ! curl -L --fail "https://github.com/jqlang/jq/releases/latest/download/jq-linux-${vault_arch}" \
31+
--output "${jq_path}"; then
32+
echo "Warning: Failed to download jq. Skipping Docker Hub authentication." >&2
33+
exit 0
34+
fi
35+
36+
chmod +x "${jq_path}"
37+
export PATH="/tmp:${PATH}"
38+
fi
39+
40+
# Install Vault if not already available
41+
vault_cmd="vault"
42+
if ! command -v vault > /dev/null 2>&1; then
43+
echo "Installing Vault CLI..."
44+
45+
vault_path="/tmp/vault"
46+
vault_zip="${vault_path}.zip"
47+
48+
if ! curl -L --fail "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_${vault_arch}.zip" \
49+
--output "${vault_zip}"; then
50+
echo "Warning: Failed to download Vault. Skipping Docker Hub authentication." >&2
51+
exit 0
52+
fi
53+
54+
if ! unzip -q "${vault_zip}" -d /tmp; then
55+
echo "Warning: Failed to extract Vault. Skipping Docker Hub authentication." >&2
56+
exit 0
57+
fi
58+
59+
chmod +x "${vault_path}"
60+
rm -f "${vault_zip}"
61+
62+
vault_cmd="${vault_path}"
63+
fi
64+
65+
# Fetch Docker Hub credentials from Vault
66+
echo "Fetching Docker Hub credentials from Vault..."
67+
vaultoutput="$("${vault_cmd}" kv get --format=json kv/k8s/gitlab-runner/dd-trace-php/dockerhub)" || {
68+
echo "Warning: Failed to fetch Docker Hub credentials from Vault. Skipping Docker Hub authentication." >&2
69+
exit 0
70+
}
71+
72+
user="$(echo "$vaultoutput" | jq -r '.data.data.user')"
73+
token="$(echo "$vaultoutput" | jq -r '.data.data.token')"
74+
75+
if [ -z "${user}" ] || [ -z "${token}" ] || [ "${user}" = "null" ] || [ "${token}" = "null" ]; then
76+
echo "Warning: Docker Hub credentials are empty or invalid. Skipping Docker Hub authentication." >&2
77+
exit 0
78+
fi
79+
80+
echo "Docker Hub user: ${user}"
81+
echo "Logging in to Docker Hub..."
82+
if ! echo "${token}" | docker login -u "${user}" --password-stdin docker.io; then
83+
echo "Warning: Failed to login to Docker Hub. Continuing without authentication." >&2
84+
exit 0
85+
fi
86+
87+
echo "=== Docker Hub authentication successful ==="

‎.gitlab/generate-appsec.php‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -62,20 +62,7 @@
6262
image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:24.0.4-gbi-focal
6363
before_script:
6464
<?php echo $ecrLoginSnippet, "\n"; ?>
65-
- |
66-
echo "Logging in to Docker Hub"
67-
if [ "$CI_REGISTRY_USER" = "" ]; then
68-
echo "Fetching Docker Hub credentials from vault"
69-
vaultoutput=$(vault kv get --format=json kv/k8s/gitlab-runner/dd-trace-php/dockerhub)
70-
user=$(echo "$vaultoutput" | jq -r .data.data.user)
71-
token=$(echo "$vaultoutput" | jq -r .data.data.token)
72-
else
73-
user="$CI_REGISTRY_USER"
74-
token="$CI_REGISTRY_TOKEN"
75-
fi
76-
77-
echo "Docker Hub user: $user"
78-
docker login -u "$user" -p "$token" docker.io
65+
<?php dockerhub_login() ?>
7966
- apt update && apt install -y openjdk-17-jre
8067

8168
"test appsec extension":
@@ -141,6 +128,7 @@
141128
- test8.5-release-zts
142129
before_script:
143130
<?php echo $ecrLoginSnippet, "\n"; ?>
131+
<?php dockerhub_login() ?>
144132
script:
145133
- apt update && apt install -y openjdk-17-jre
146134
- find "$CI_PROJECT_DIR"/appsec/tests/integration/build || true

‎.gitlab/generate-common.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131

3232
function unset_dd_runner_env_vars() {
3333
?>
34-
3534
# DD env vars auto-added to GitLab runners for infra purposes
3635
- unset DD_SERVICE
3736
- unset DD_ENV
@@ -40,6 +39,12 @@ function unset_dd_runner_env_vars() {
4039
<?php
4140
}
4241

42+
function dockerhub_login() {
43+
?>
44+
- if command -v docker > /dev/null 2>&1; then .gitlab/dockerhub-login.sh; fi
45+
<?php
46+
}
47+
4348
?>
4449
default:
4550
retry:

‎.gitlab/generate-package.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -753,6 +753,7 @@
753753
RUST_BACKTRACE: 1
754754
DOCKER_COMPOSE_DOWNLOAD_NAME: docker-compose-linux-x86_64
755755
before_script:
756+
<?php dockerhub_login() ?>
756757
- apt install -y php git make curl
757758
- curl -L --fail https://github.com/docker/compose/releases/download/v2.36.0/${DOCKER_COMPOSE_DOWNLOAD_NAME} -o /usr/local/bin/docker-compose
758759
- chmod +x /usr/local/bin/docker-compose
@@ -833,6 +834,7 @@
833834
KUBERNETES_MEMORY_LIMIT: 4Gi
834835
RUST_BACKTRACE: 1
835836
before_script:
837+
<?php dockerhub_login() ?>
836838
- apt install -y make
837839
- mkdir build
838840
- mv packages build
@@ -897,6 +899,7 @@
897899
# - symfony_no_ddtrace
898900
# - symfony
899901
before_script:
902+
<?php dockerhub_login() ?>
900903
- apt install -y make curl
901904
- curl -L --fail https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
902905
- chmod +x /usr/local/bin/docker-compose
@@ -959,6 +962,7 @@
959962
- job: datadog-setup.php
960963
artifacts: true
961964
before_script: &verify_alpine_before_script
965+
<?php dockerhub_login() ?>
962966
- mkdir build
963967
- mv packages build
964968
- apk add --no-cache ca-certificates # see https://support.circleci.com/hc/en-us/articles/360016505753-Resolve-Certificate-Signed-By-Unknown-Authority-error-in-Alpine-images?flash_digest=39b76521a337cecacac0cc10cb28f3747bb5fc6a
@@ -987,6 +991,7 @@
987991
- job: datadog-setup.php
988992
artifacts: true
989993
before_script:
994+
<?php dockerhub_login() ?>
990995
- mkdir build
991996
- mv packages build
992997
- '# Fix yum config, as centos 7 is EOL and mirrorlist.centos.org does not resolve anymore - https://serverfault.com/a/1161847'
@@ -1012,6 +1017,7 @@
10121017
- job: datadog-setup.php
10131018
artifacts: true
10141019
before_script:
1020+
<?php dockerhub_login() ?>
10151021
- mkdir build
10161022
- mv packages build
10171023
- apt update
@@ -1125,6 +1131,7 @@
11251131
- !reference [.services, request-replayer]
11261132
- !reference [.services, httpbin-integration]
11271133
before_script:
1134+
<?php dockerhub_login() ?>
11281135
- switch-php debug
11291136
script:
11301137
- sudo dpkg -i packages/*amd64*.deb
@@ -1161,6 +1168,7 @@
11611168
- job: "prepare code"
11621169
artifacts: true
11631170
before_script:
1171+
<?php dockerhub_login() ?>
11641172
- |
11651173
# Setup cache dirs
11661174
mkdir -p $PIP_CACHE_DIR

‎.gitlab/generate-tracer.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ function sidecar_logs() {
3333
<?php
3434
}
3535

36-
function before_script_steps() {
36+
function before_script_steps($with_docker_auth = false) {
37+
if ($with_docker_auth) dockerhub_login();
3738
unset_dd_runner_env_vars();
3839
?>
3940

@@ -211,7 +212,7 @@ function before_script_steps() {
211212
HTTPBIN_HOSTNAME: httpbin-integration
212213
HTTPBIN_PORT: 8080
213214
before_script:
214-
<?php before_script_steps() ?>
215+
<?php before_script_steps(true) ?>
215216
- .gitlab/wait-for-service-ready.sh
216217

217218
.asan_test:
@@ -498,7 +499,7 @@ function before_script_steps() {
498499
SWITCH_PHP_VERSION: debug
499500
COMPOSER_VERSION: 2
500501
before_script:
501-
<?php before_script_steps() ?>
502+
<?php before_script_steps(true) ?>
502503
- if [[ "$MAKE_TARGET" != "test_composer" ]] || ! [[ "$PHP_MAJOR_MINOR" =~ 8.[01] ]]; then sudo composer self-update --$COMPOSER_VERSION --no-interaction; fi
503504
- COMPOSER_MEMORY_LIMIT=-1 composer update --no-interaction # disable composer memory limit completely
504505
- make composer_tests_update

‎CHANGELOG.md‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,39 @@
11
Changelog for older versions can be found in our [release page](https://github.com/DataDog/dd-trace-php/releases).
22

33
## All products
4-
- Add PHP 8.5 support #3400
5-
6-
## Tracer
7-
### Added
8-
- Implement APM endpoint resource renaming #3415
9-
- Enable dynamic configuration for debugger-related products #3476
10-
11-
### Fixed
12-
- Collect incompletely fetched CurlMulti handles upon destruction #3469
13-
- Safeguard proc_get_span in case proc_assoc_span is not happening #3471
14-
- Skip SSI injector in installer for accurate ini-dir readings #3472
15-
- Make stub file compatible with php 8.4+ parser #3475
16-
- Fix function resolver on PHP 8.0 and PHP 8.1 for targets without HAVE_GCC_GLOBAL_REGS and with active JIT #3482
17-
- Support ENOENT as shm_open failure mode DataDog/libdatadog#1315
18-
- This fixes a failure mode present on some serverless runtimes.
19-
204
### Internal
21-
- Add crashtracker support for the sidecar #3453
22-
- Strip error messages from hook telemetry #3449
23-
- Collect runtime crash frames #3479
24-
- Use a dedicated endpoint for enriched logs DataDog/libdatadog#1338
5+
- bump tracing-core from 0.1.33 to 0.1.35 #3516
256

26-
## Profiling
7+
## Tracer
278
### Internal
28-
- Cleanup I/O profiling code #3406
29-
- Upgrade to libdatadog v23, profiling uses zstd now #3470
30-
- Switch panics to abort #3474
9+
- Const-ify some logging thread-local variables #3513
10+
### Fixed
11+
- Avoid curl's `getenv` calls #3528
12+
- `code_origin_for_spans_enabled` naming inconsistency #3494
13+
- Add `NULL` guard clause in sidecar reconnect callback #3499
3114

32-
## Application Security Management
15+
## Profiler
3316
### Added
34-
- Print block_id #3444
35-
17+
- Detect parallel threads #3515
3618
### Changed
37-
- Upgrade libddwaf and rules #3438
38-
- Adapt security_response_id to latest #3480
19+
- Speedup hot path in allocator #3505
20+
### Fixed
21+
- Fixed asserting length of INI #3508
22+
23+
## AppSec
24+
### Added
25+
- Minify blocking json message #3502
26+
- Add Custom Data Classification #3524
27+
- Add metrics for extension connections #3527
28+
### Fixed
29+
- Amend string on request abort #3506
30+
- Fix accessing to incorrectly hardcoded `$_GET` #3501
31+
- Amend issue where `security_response_id` is being release before displaying it #3493
32+
- AppSec helper: add send timeouts #3518
33+
- Minor fixes and improvements to file descriptor reclamation #3526
34+
- LaravelIntegration: be more defensive #3503
35+
- Fix `duration_ext` metric #3507
36+
- Fix segfault iterating mapping #3517
37+
- Fix double end hook run/segfault when blocking in PHP 7.x #3490
38+
- Fix `_iovec_writer_flush` and enforce limits on `$_POST` #3495
39+
- Clear `client_ip` on `request_init` #3496

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.14.0
1+
1.15.0

‎appsec/src/extension/configuration.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ extern bool runtime_config_first_init;
4141
SYSCFG(BOOL, DD_APPSEC_TESTING, "false") \
4242
SYSCFG(BOOL, DD_APPSEC_TESTING_ABORT_RINIT, "false") \
4343
SYSCFG(BOOL, DD_APPSEC_TESTING_RAW_BODY, "false") \
44+
SYSCFG(BOOL, DD_APPSEC_TESTING_HELPER_METRICS, "false") \
4445
CONFIG(CUSTOM(INT), DD_APPSEC_LOG_LEVEL, "warn", .parser = dd_parse_log_level) \
4546
SYSCFG(STRING, DD_APPSEC_LOG_FILE, "php_error_reporting") \
4647
SYSCFG(BOOL, DD_APPSEC_HELPER_LAUNCH, "true") \

‎appsec/src/extension/helper_process.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
#include "network.h"
2222
#include "php_compat.h"
2323
#include "php_objects.h"
24+
#include "telemetry.h"
2425
#include "version.h"
2526

2627
#define MAX_WAIT_TIME_MS (1ULL << 55)
@@ -151,11 +152,13 @@ dd_conn *nullable dd_helper_mgr_acquire_conn(
151152

152153
_mgr.connected_this_req = true;
153154
_release_shared_state_lock(&_mgr.hss);
155+
dd_telemetry_helper_conn_success(_mgr.socket_path);
154156

155157
return conn;
156158

157159
error:
158160
_inc_failed_counter(&_mgr.hss);
161+
dd_telemetry_helper_conn_error(_mgr.socket_path);
159162
return NULL;
160163
}
161164

@@ -262,6 +265,8 @@ void dd_helper_close_conn(void)
262265
mlog_err(dd_log_warning, "Error closing connection to helper");
263266
}
264267

268+
dd_telemetry_helper_conn_close(_mgr.socket_path);
269+
265270
/* we treat closing the connection on the request it was opened a failure
266271
* for the purposes of the connection backoff */
267272
if (_mgr.connected_this_req && _shared_state) {

0 commit comments

Comments
 (0)