Appsec on sidecar thread

Author: cataphract

Cargo.lock

@@ -0,0 +1,66 @@
+package com.datadog.appsec.php.integration
+
+import com.datadog.appsec.php.docker.AppSecContainer
+import com.datadog.appsec.php.docker.FailOnUnmatchedTraces
+import com.datadog.appsec.php.docker.InspectContainerHelper
+import org.junit.jupiter.api.Test
+import org.testcontainers.junit.jupiter.Container
+import org.testcontainers.junit.jupiter.Testcontainers
+
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+
+import static com.datadog.appsec.php.integration.TestParams.getPhpVersion
+import static com.datadog.appsec.php.integration.TestParams.getVariant
+import static java.net.http.HttpResponse.BodyHandlers.ofString
+
+/**
+ * Exercises AppSec with the sidecar hosted by an in-process master-listener
+ * thread. This must remain a separate container from the default-mode suites:
+ * the connection mode is read during PHP MINIT and cannot be changed safely
+ * after the web server has started.
+ */
+@Testcontainers
+class SidecarThreadModeTests {
+    @Container
+    @FailOnUnmatchedTraces
+    public static final AppSecContainer CONTAINER =
+            new AppSecContainer(
+                    workVolume: this.name,
+                    baseTag: 'apache2-mod-php',
+                    phpVersion: phpVersion,
+                    phpVariant: variant,
+                    www: 'base',
+            ) {
+                @Override
+                void configure() {
+                    super.configure()
+                    withEnv('DD_TRACE_SIDECAR_CONNECTION_MODE', 'thread')
+                }
+            }
+
+    static void main(String[] args) {
+        InspectContainerHelper.run(CONTAINER)
+    }
+
+    @Test
+    void 'appsec blocks requests in forced sidecar thread mode'() {
+        HttpRequest request = CONTAINER.buildReq('/phpinfo.php')
+                .header('Content-type', 'application/json')
+                .header('Accept', 'application/json')
+                .header('X-Forwarded-For', '80.80.80.80')
+                .GET()
+                .build()
+
+        def trace = CONTAINER.traceFromRequest(request, ofString()) {
+            HttpResponse<String> response ->
+                assert response.statusCode() == 403
+        }
+
+        def span = trace.first()
+        assert span.metrics.'_dd.appsec.enabled' == 1.0d
+        assert span.metrics.'_dd.appsec.waf.duration' > 0.0d
+        assert span.meta.'appsec.blocked' == 'true'
+        assert span.meta.'_dd.appsec.json'
+    }
+}

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/SidecarThreadModeTests.groovy

@@ -235,6 +235,18 @@ ddog_MaybeError ddog_send_debugger_diagnostics(const struct ddog_RemoteConfigSta
 void ddog_sidecar_enable_appsec(ddog_CharSlice log_file_path,
                                 ddog_CharSlice log_level);
 
+/**
+ * Starts a thread-mode master listener with the PHP-linked AppSec backend
+ * registered in the listener's process.
+ */
+ddog_MaybeError ddog_sidecar_connect_master_php(int32_t pid);
+
+/**
+ * Ensures the connected sidecar's AppSec backend is started using the
+ * configuration captured from the PHP extension.
+ */
+ddog_MaybeError ddog_sidecar_ensure_appsec_started(struct ddog_SidecarTransport **transport);
+
 ddog_MaybeError ddog_sidecar_connect_php(struct ddog_SidecarTransport **connection,
                                          const char *error_path,
                                          ddog_CharSlice log_level,

components-rs/datadog.h

@@ -156,6 +156,48 @@ pub extern "C" fn ddog_sidecar_enable_appsec(log_file_path: CharSlice, log_level
     });
 }
 
+/// Starts a thread-mode master listener with the PHP-linked AppSec backend
+/// registered in the listener's process.
+#[no_mangle]
+pub extern "C" fn ddog_sidecar_connect_master_php(pid: i32) -> MaybeError {
+    #[cfg(unix)]
+    ddtrace_sidecar::register_appsec_backend();
+
+    datadog_sidecar_ffi::ddog_sidecar_connect_master(pid)
+}
+
+/// Ensures the connected sidecar's AppSec backend is started using the
+/// configuration captured from the PHP extension.
+#[no_mangle]
+pub extern "C" fn ddog_sidecar_ensure_appsec_started(
+    transport: &mut Box<SidecarTransport>,
+) -> MaybeError {
+    let Some(appsec_config) = APPSEC_CONFIG.lock().unwrap().clone() else {
+        return MaybeError::None;
+    };
+
+    #[cfg(unix)]
+    {
+        let started = try_c!(datadog_sidecar::service::blocking::ensure_appsec_started(
+            transport,
+            appsec_config.log_file_path.as_os_str().as_bytes().to_vec(),
+            appsec_config.log_level,
+        ));
+        if !started {
+            return MaybeError::Some(libdd_common_ffi::Error::from(
+                "AppSec backend failed to initialize",
+            ));
+        }
+    }
+
+    #[cfg(windows)]
+    {
+        _ = (transport, appsec_config);
+    }
+
+    MaybeError::None
+}
+
 fn sidecar_connect(cfg: config::Config) -> anyhow::Result<Box<SidecarTransport>> {
     let mut stream = Box::new(run_sidecar(cfg)?);
     // Generally the Send buffer ought to be big enough for instantaneous transmission

components-rs/sidecar.rs

@@ -118,6 +118,11 @@ DATADOG_PUBLIC ddog_SidecarTransport **ddtrace_get_sidecar_transport(void) {
 #endif
 
 static void dd_sidecar_post_connect(ddog_SidecarTransport **transport, bool is_fork, const char *logpath) {
+    if (!datadog_ffi_try("Failed starting AppSec in sidecar",
+            ddog_sidecar_ensure_appsec_started(transport))) {
+        LOG(WARN, "AppSec sidecar backend is unavailable");
+    }
+
     ddog_CharSlice session_id = (ddog_CharSlice) {.ptr = (char *) datadog_formatted_session_id, .len = sizeof(datadog_formatted_session_id)};
     ddog_CharSlice root_session_id = datadog_is_empty_session_id(datadog_formatted_root_session_id) ? DDOG_CHARSLICE_C("") : (ddog_CharSlice) {.ptr = (char *) datadog_formatted_root_session_id, .len = sizeof(datadog_formatted_root_session_id)};
     ddog_CharSlice parent_session_id = datadog_is_empty_session_id(datadog_formatted_parent_session_id) ? DDOG_CHARSLICE_C("") : (ddog_CharSlice) {.ptr = (char *) datadog_formatted_parent_session_id, .len = sizeof(datadog_formatted_parent_session_id)};
@@ -266,7 +271,7 @@ static ddog_SidecarTransport *dd_sidecar_connect(bool as_worker, bool is_fork) {
                     current_pid, datadog_sidecar_master_pid);
                 datadog_sidecar_master_pid = current_pid;
                 if (!datadog_ffi_try("Failed starting sidecar master listener as orphaned child",
-                        ddog_sidecar_connect_master((int32_t)datadog_sidecar_master_pid)) ||
+                        ddog_sidecar_connect_master_php((int32_t)datadog_sidecar_master_pid)) ||
                     !datadog_ffi_try("Failed connecting to new sidecar master as orphaned child",
                         ddog_sidecar_connect_worker((int32_t)datadog_sidecar_master_pid, &sidecar_transport))) {
                     dd_free_endpoints();
@@ -326,7 +331,8 @@ static void datadog_sidecar_setup_thread_mode() {
         return;
     }
 
-    if (!datadog_ffi_try("Failed starting sidecar master listener", ddog_sidecar_connect_master((int32_t)datadog_sidecar_master_pid))) {
+    if (!datadog_ffi_try("Failed starting sidecar master listener",
+            ddog_sidecar_connect_master_php((int32_t)datadog_sidecar_master_pid))) {
         LOG(WARN, "Failed to start sidecar master listener");
         if (datadog_endpoint) {
             dd_free_endpoints();
@@ -474,7 +480,7 @@ void datadog_sidecar_minit(void) {
 
     if (mode == DD_TRACE_SIDECAR_CONNECTION_MODE_THREAD) {
         datadog_ffi_try("Starting sidecar master listener in MINIT",
-                       ddog_sidecar_connect_master(datadog_sidecar_master_pid));
+                       ddog_sidecar_connect_master_php(datadog_sidecar_master_pid));
     }
 }
 
@@ -511,7 +517,7 @@ void datadog_sidecar_handle_fork(void) {
 
             datadog_sidecar_master_pid = (int32_t)getpid();
             if (!datadog_ffi_try("Failed starting sidecar master listener in child process",
-                    ddog_sidecar_connect_master((int32_t)datadog_sidecar_master_pid))) {
+                    ddog_sidecar_connect_master_php((int32_t)datadog_sidecar_master_pid))) {
                 if (datadog_endpoint) {
                     dd_free_endpoints();
                 }

ext/sidecar.c

@@ -62,12 +62,21 @@ pub fn start_or_connect_to_sidecar(config: Config) -> anyhow::Result<SidecarTran
     )
 }
 
+/// Registers the AppSec backend linked into the PHP extension.
+///
+/// Registration is process-local and idempotent. Thread-mode listeners need
+/// this to run in the master process before their listener thread starts;
+/// subprocess-mode sidecars call it again from their entrypoint.
+pub fn register_appsec_backend() {
+    datadog_sidecar::appsec::register_backend_factory(create_backend);
+}
+
 #[no_mangle]
 pub extern "C" fn ddtrace_sidecar_entry_point(trampoline_data: &TrampolineData) {
     #[cfg(feature = "helper-rust-coverage")]
     ddappsec_helper::initialize_coverage();
 
-    datadog_sidecar::appsec::register_backend_factory(create_backend);
+    register_appsec_backend();
     datadog_sidecar::ddog_daemon_entry_point(trampoline_data);
 }