Modify request_exec message

Author: cataphract

appsec/src/extension/commands/request_exec.c

@@ -9,14 +9,17 @@
 #include "../ddappsec.h"
 #include "../logging.h"
 #include "../msgpack_helpers.h"
+#include <mpack.h>
 #include <php.h>
 #include <zend_hash.h>
 #include <zend_types.h>
 
 struct ctx {
     struct req_info req_info; // dd_command_proc_resp_verd_span_data expect it
     zend_string *nullable rasp_rule;
-    zval *nonnull data;
+    zend_string *nullable subctx_id;
+    bool subctx_last_call;
+    zend_array *nonnull data;
 };
 
 static dd_result _pack_command(mpack_writer_t *nonnull w, void *nonnull ctx);
@@ -30,16 +33,13 @@ static const dd_command_spec _spec = {
     .config_features_cb = dd_command_process_config_features_unexpected,
 };
 
-dd_result dd_request_exec(
-    dd_conn *nonnull conn, zval *nonnull data, zend_string *nullable rasp_rule)
+dd_result dd_request_exec(dd_conn *nonnull conn, zend_array *nonnull data,
+    const struct req_exec_opts *nonnull opts)
 {
-    if (Z_TYPE_P(data) != IS_ARRAY) {
-        mlog(dd_log_debug, "Invalid data provided to command request_exec, "
-                           "expected hash table.");
-        return dd_error;
-    }
-
-    struct ctx ctx = {.rasp_rule = rasp_rule, .data = data};
+    struct ctx ctx = {.data = data,
+        .rasp_rule = opts->rasp_rule,
+        .subctx_id = opts->subctx_id,
+        .subctx_last_call = opts->subctx_last_call};
 
     return dd_command_exec_req_info(conn, &_spec, &ctx.req_info);
 }
@@ -49,14 +49,31 @@ static dd_result _pack_command(mpack_writer_t *nonnull w, void *nonnull _ctx)
     assert(_ctx != NULL);
     struct ctx *ctx = _ctx;
 
-    dd_mpack_write_nullable_zstr(w, ctx->rasp_rule);
-
     dd_mpack_limits limits = dd_mpack_def_limits;
-    dd_mpack_write_zval_lim(w, ctx->data, &limits);
+    dd_mpack_write_array_lim(w, ctx->data, &limits);
+
+    size_t num_map_elems =
+        (ctx->rasp_rule != NULL) + (ctx->subctx_id != NULL) * 2;
+    mpack_start_map(w, num_map_elems);
 
     if (dd_mpack_limits_reached(&limits)) {
         mlog(dd_log_info, "Limits reched when serializing request exec data");
     }
 
+    if (ctx->rasp_rule != NULL) {
+        dd_mpack_write_lstr(w, "rasp_rule");
+        dd_mpack_write_zstr(w, ctx->rasp_rule);
+    }
+
+    if (ctx->subctx_id != NULL) {
+        dd_mpack_write_lstr(w, "subctx_id");
+        dd_mpack_write_nullable_zstr(w, ctx->subctx_id);
+
+        dd_mpack_write_lstr(w, "subctx_last_call");
+        mpack_write_bool(w, ctx->subctx_last_call);
+    }
+
+    mpack_finish_map(w);
+
     return dd_success;
 }

appsec/src/extension/commands/request_exec.h

@@ -9,5 +9,11 @@
 #include <SAPI.h>
 #include <php.h>
 
-dd_result dd_request_exec(
-    dd_conn *nonnull conn, zval *nonnull data, zend_string *nullable rasp_rule);
+struct req_exec_opts {
+    zend_string *nullable rasp_rule;
+    zend_string *nullable subctx_id;
+    bool subctx_last_call;
+};
+
+dd_result dd_request_exec(dd_conn *nonnull conn, zend_array *nonnull data,
+    const struct req_exec_opts *nonnull opts);

appsec/src/extension/ddappsec.c

@@ -5,7 +5,11 @@
 // (https://www.datadoghq.com/). Copyright 2021 Datadog, Inc.
 #include <SAPI.h>
 #include <Zend/zend_extensions.h>
+#include <Zend/zend_operators.h>
+#include <Zend/zend_string.h>
+#include <Zend/zend_types.h>
 #include <ext/standard/info.h>
+#include <json/json.h>
 #include <php.h>
 
 // for open(2)
@@ -37,14 +41,12 @@
 #include "php_objects.h"
 #include "request_abort.h"
 #include "request_lifecycle.h"
+#include "string_helpers.h"
 #include "tags.h"
 #include "telemetry.h"
 #include "user_tracking.h"
 #include "version.h"
 
-#include <json/json.h>
-#include <zend_string.h>
-
 #if ZTS
 static atomic_int _thread_count;
 #endif
@@ -468,8 +470,12 @@ static PHP_FUNCTION(datadog_appsec_testing_stop_for_debugger)
 
 static PHP_FUNCTION(datadog_appsec_testing_request_exec)
 {
-    zval *data = NULL;
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &data) != SUCCESS) {
+    zend_array *data;
+    zend_string *rasp_rule = NULL;
+    zend_string *subctx_id = NULL;
+    bool subctx_last_call = false;
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "h|SSb", &data, &rasp_rule,
+            &subctx_id, &subctx_last_call) != SUCCESS) {
         RETURN_FALSE;
     }
 
@@ -483,7 +489,13 @@ static PHP_FUNCTION(datadog_appsec_testing_request_exec)
         RETURN_FALSE;
     }
 
-    if (dd_request_exec(conn, data, false) != dd_success) {
+    struct req_exec_opts opts = {
+        .rasp_rule = rasp_rule,
+        .subctx_id = subctx_id,
+        .subctx_last_call = subctx_last_call,
+    };
+
+    if (dd_request_exec(conn, data, &opts) != dd_success) {
         RETURN_FALSE;
     }
 
@@ -503,18 +515,64 @@ static PHP_FUNCTION(datadog_appsec_push_addresses)
         return;
     }
 
-    zval *addresses = NULL;
-    zend_string *rasp_rule = NULL;
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "z|S", &addresses, &rasp_rule) ==
+    zend_array *addresses = NULL;
+    zval *opts_zv = NULL;
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "h|z!", &addresses, &opts_zv) ==
         FAILURE) {
         RETURN_FALSE;
     }
 
-    if (Z_TYPE_P(addresses) != IS_ARRAY) {
-        RETURN_FALSE;
+    if (opts_zv) {
+        ZVAL_DEREF(opts_zv);
+    }
+
+    struct req_exec_opts opts = {0};
+    if (opts_zv && Z_TYPE_P(opts_zv) == IS_ARRAY) {
+        zval *rasp_rule_zv =
+            zend_hash_str_find(Z_ARR_P(opts_zv), LSTRARG("rasp_rule"));
+        if (rasp_rule_zv) {
+            ZVAL_DEREF(rasp_rule_zv);
+            if (Z_TYPE_P(rasp_rule_zv) != IS_STRING) {
+                php_error_docref(
+                    NULL, E_WARNING, "Invalid type for option rasp_rule");
+                RETURN_FALSE;
+            }
+            opts.rasp_rule = Z_STR_P(rasp_rule_zv);
+        }
+
+        zval *subctx_id_zv =
+            zend_hash_str_find(Z_ARR_P(opts_zv), LSTRARG("subctx_id"));
+        if (subctx_id_zv) {
+            ZVAL_DEREF(subctx_id_zv);
+            if (Z_TYPE_P(subctx_id_zv) != IS_STRING) {
+                php_error_docref(
+                    NULL, E_WARNING, "Invalid type for option subctx_id");
+                RETURN_FALSE;
+            }
+            opts.subctx_id = Z_STR_P(subctx_id_zv);
+        }
+
+        zval *subctx_last_call_zv =
+            zend_hash_str_find(Z_ARR_P(opts_zv), LSTRARG("subctx_last_call"));
+        if (subctx_last_call_zv) {
+            ZVAL_DEREF(subctx_last_call_zv);
+            if (Z_TYPE_P(subctx_last_call_zv) != IS_TRUE &&
+                Z_TYPE_P(subctx_last_call_zv) != IS_FALSE) {
+                php_error_docref(NULL, E_WARNING,
+                    "Invalid type for option subctx_last_call");
+                RETURN_FALSE;
+            }
+            opts.subctx_last_call = Z_TYPE_P(subctx_last_call_zv) == IS_TRUE;
+        }
+    } else if (opts_zv) {
+        // legacy second string argument
+        if (!try_convert_to_string(opts_zv)) {
+            RETURN_FALSE;
+        }
+        opts.rasp_rule = Z_STR_P(opts_zv);
     }
 
-    if (rasp_rule && ZSTR_LEN(rasp_rule) > 0 &&
+    if (opts.rasp_rule && ZSTR_LEN(opts.rasp_rule) > 0 &&
         !get_global_DD_APPSEC_RASP_ENABLED()) {
         return;
     }
@@ -525,9 +583,9 @@ static PHP_FUNCTION(datadog_appsec_push_addresses)
         return;
     }
 
-    dd_result res = dd_request_exec(conn, addresses, rasp_rule);
+    dd_result res = dd_request_exec(conn, addresses, &opts);
 
-    if (rasp_rule && ZSTR_LEN(rasp_rule) > 0) {
+    if (opts.rasp_rule && ZSTR_LEN(opts.rasp_rule) > 0) {
         clock_gettime(CLOCK_MONOTONIC_RAW, &end);
         elapsed =
             ((int64_t)end.tv_sec - (int64_t)start.tv_sec) *
@@ -559,12 +617,15 @@ ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(request_exec_arginfo, 0, 1, _IS_BOOL, 0)
 ZEND_ARG_INFO(0, "data")
+ZEND_ARG_INFO_WITH_DEFAULT_VALUE(0, "rasp_rule", NULL)
+ZEND_ARG_INFO_WITH_DEFAULT_VALUE(0, "subctx_id", NULL)
+ZEND_ARG_INFO_WITH_DEFAULT_VALUE(0, "subctx_last_call", false)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(
     push_addresses_arginfo, 0, 0, IS_VOID, 1)
 ZEND_ARG_INFO(0, addresses)
-ZEND_ARG_INFO(0, rasp)
+ZEND_ARG_INFO_WITH_DEFAULT_VALUE(0, rasp_rule_or_opts, NULL)
 ZEND_END_ARG_INFO()
 
 // clang-format off

appsec/src/extension/user_tracking.c

@@ -233,44 +233,45 @@ void dd_find_and_apply_verdict_for_user(zend_string *nullable user_id,
         return;
     }
 
-    zval data_zv;
-    size_t data_size = 0;
+    zend_array *data_array;
+    uint32_t data_size = 0;
     data_size += user_login != NULL && ZSTR_LEN(user_login) > 0 ? 1 : 0;
     data_size += user_id != NULL && ZSTR_LEN(user_id) > 0 ? 1 : 0;
     data_size += event != user_event_none ? 1 : 0;
-    array_init_size(&data_zv, data_size);
+    data_array = zend_new_array(data_size);
 
     if (event == user_event_login_success) {
-        zend_hash_str_add_empty_element(Z_ARRVAL(data_zv),
-            LSTRARG("server.business_logic.users.login.success"));
+        zend_hash_str_add_empty_element(
+            data_array, LSTRARG("server.business_logic.users.login.success"));
     } else if (event == user_event_login_failure) {
-        zend_hash_str_add_empty_element(Z_ARRVAL(data_zv),
-            LSTRARG("server.business_logic.users.login.failure"));
+        zend_hash_str_add_empty_element(
+            data_array, LSTRARG("server.business_logic.users.login.failure"));
     }
 
     if (user_login != NULL && ZSTR_LEN(user_login) > 0) {
         zval user_login_zv;
         ZVAL_STR_COPY(&user_login_zv, user_login);
 
-        zend_hash_str_add_new(Z_ARRVAL(data_zv), "usr.login",
-            sizeof("usr.login") - 1, &user_login_zv);
+        zend_hash_str_add_new(
+            data_array, "usr.login", sizeof("usr.login") - 1, &user_login_zv);
     }
 
     if (user_id != NULL && ZSTR_LEN(user_id) > 0) {
         zval user_id_zv;
         ZVAL_STR_COPY(&user_id_zv, user_id);
         zend_hash_str_add_new(
-            Z_ARRVAL(data_zv), "usr.id", sizeof("usr.id") - 1, &user_id_zv);
+            data_array, "usr.id", sizeof("usr.id") - 1, &user_id_zv);
     }
 
-    dd_result res = dd_request_exec(conn, &data_zv, false);
+    dd_result res =
+        dd_request_exec(conn, data_array, &(struct req_exec_opts){0});
     if (res == dd_network) {
         mlog_g(dd_log_info, "request_exec failed with dd_network; closing "
                             "connection to helper");
         dd_helper_close_conn();
     }
 
-    zval_ptr_dtor(&data_zv);
+    zend_array_destroy(data_array);
 
     if (user_id != NULL && ZSTR_LEN(user_id) > 0) {
         dd_tags_set_event_user_id(user_id);

appsec/src/helper/client.cpp

@@ -230,14 +230,14 @@ template <typename T> bool client::service_guard()
 
 template <typename T>
 std::shared_ptr<typename T::response> client::publish(
-    typename T::request &command, const std::string &rasp_rule)
+    typename T::request &command, const network::request_exec_options &options)
 {
     SPDLOG_DEBUG("received command {}", T::name);
 
     auto response = std::make_shared<typename T::response>();
     try {
         // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
-        auto res = context_->publish(std::move(command.data), rasp_rule);
+        auto res = context_->publish(std::move(command.data), options);
         if (res) {
             bool event_action = false;
             bool stack_trace = false;
@@ -319,7 +319,7 @@ bool client::handle_command(network::request_init::request &command)
     // During request init we initialize the engine context
     context_.emplace(*service_->get_engine());
 
-    auto response = publish<network::request_init>(command);
+    auto response = publish<network::request_init>(command, {});
     if (response) {
         response->settings["auto_user_instrum"] = to_string_view(
             service_->get_service_config()->get_auto_user_intrum_mode());
@@ -338,7 +338,7 @@ bool client::handle_command(network::request_exec::request &command)
         context_.emplace(*service_->get_engine());
     }
 
-    auto response = publish<network::request_exec>(command, command.rasp_rule);
+    auto response = publish<network::request_exec>(command, command.options);
     return send_message<network::request_exec>(response);
 }
 
@@ -465,7 +465,7 @@ bool client::handle_command(network::request_shutdown::request &command)
         command.data.add("waf.context.processor", std::move(context_processor));
     }
 
-    auto response = publish<network::request_shutdown>(command);
+    auto response = publish<network::request_shutdown>(command, {});
     if (!response) {
         return false;
     }

appsec/src/helper/client.hpp

@@ -82,8 +82,8 @@ class client {
     }
 
     template <typename T>
-    std::shared_ptr<typename T::response> publish(
-        typename T::request &command, const std::string &rasp_rule = "");
+    std::shared_ptr<typename T::response> publish(typename T::request &command,
+        const network::request_exec_options &options);
     template <typename T> bool service_guard();
     template <typename T, bool actions = true>
     bool send_message(const std::shared_ptr<typename T::response> &message);

appsec/src/helper/engine.cpp

@@ -82,7 +82,7 @@ void engine::update(const rapidjson::Document &doc,
 }
 
 std::optional<engine::result> engine::context::publish(
-    parameter &&param, const std::string &rasp_rule)
+    parameter &&param, const network::request_exec_options &options)
 {
     // Once the parameter reaches this function, it is guaranteed to be
     // owned by the engine.
@@ -113,7 +113,7 @@ std::optional<engine::result> engine::context::publish(
         }
         try {
             const auto &listener = it->second;
-            listener->call(data, event, rasp_rule);
+            listener->call(data, event, options);
         } catch (std::exception &e) {
             SPDLOG_ERROR("subscriber failed: {}", e.what());
         }

appsec/src/helper/engine.hpp

@@ -7,6 +7,7 @@
 
 #include "action.hpp"
 #include "engine_settings.hpp"
+#include "network/proto.hpp"
 #include "parameter.hpp"
 #include "rate_limit.hpp"
 #include "subscriber/base.hpp"
@@ -65,7 +66,7 @@ class engine {
         ~context() = default;
 
         std::optional<result> publish(
-            parameter &&param, const std::string &rasp_rule = "");
+            parameter &&param, const network::request_exec_options &options);
         // NOLINTNEXTLINE(google-runtime-references)
         void get_metrics(telemetry::telemetry_submitter &msubmitter);