Merge branch 'main' into munir/only-rate-limit-on-sampling-rules

DataDog · Oct 2, 2024 · 2fcc977 · 2fcc977
2 parents 10d1870 + b0e1d82
commit 2fcc977
Show file tree

Hide file tree

Showing 6 changed files with 82 additions and 32 deletions.
diff --git a/.gitlab/macrobenchmarks.yml b/.gitlab/macrobenchmarks.yml
@@ -220,7 +220,32 @@ appsec-enabled-iast-disabled-ep-enabled:
     DD_APPSEC_RASP_ENABLED: "true"
     DD_SERVICE: "ddtrace-mb-appsec-enabled-iast-disabled-ep-enabled"
 
-appsec-disabled-iast-worst-ep-disabled:
+vuln-baseline:
+  extends: .macrobenchmarks
+  variables:
+    DD_BENCHMARKS_CONFIGURATION: baseline
+    BP_PYTHON_SCENARIO_DIR: flask-realworld
+    BP_ENDPOINT: http://0.0.0.0:8000/iast/articles?string1=Hi&password=root1234
+    DDTRACE_INSTALL_VERSION: "git+https://github.com/Datadog/dd-trace-py@${CI_COMMIT_SHA}"
+    IAST_WORST: "true"
+    DD_SERVICE: "ddtrace-mb-vuln-baseline"
+
+vuln-appsec-disabled-iast-disabled-ep-disabled:
+  extends: .macrobenchmarks
+  variables:
+    DD_BENCHMARKS_CONFIGURATION: only-tracing
+    BP_PYTHON_SCENARIO_DIR: flask-realworld
+    BP_ENDPOINT: http://0.0.0.0:8000/iast/articles?string1=Hi&password=root1234
+    DDTRACE_INSTALL_VERSION: "git+https://github.com/Datadog/dd-trace-py@${CI_COMMIT_SHA}"
+    DD_TRACE_ENABLED: "true"
+    DD_PROFILING_ENABLED: "false"
+    DD_APPSEC_ENABLED: "false"
+    DD_IAST_ENABLED: "disabled"
+    DD_APPSEC_RASP_ENABLED: "false"
+    IAST_WORST: "true"
+    DD_SERVICE: "ddtrace-mb-vuln-appsec-disabled-iast-disabled-ep-disabled"
+
+vuln-appsec-disabled-iast-enabled-ep-disabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
@@ -233,9 +258,9 @@ appsec-disabled-iast-worst-ep-disabled:
     DD_IAST_ENABLED: "true"
     DD_APPSEC_RASP_ENABLED: "false"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-disabled-iast-worst-ep-disabled"
+    DD_SERVICE: "ddtrace-mb-vuln-appsec-disabled-iast-enabled-ep-disabled"
 
-appsec-disabled-iast-worst-ep-disabled-profiling-enabled:
+vuln-appsec-disabled-iast-enabled-ep-disabled-profiling-enabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
@@ -248,9 +273,9 @@ appsec-disabled-iast-worst-ep-disabled-profiling-enabled:
     DD_IAST_ENABLED: "true"
     DD_APPSEC_RASP_ENABLED: "false"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-disabled-iast-worst-ep-disabled-profiling-enabled"
+    DD_SERVICE: "ddtrace-mb-vuln-appsec-disabled-iast-enabled-ep-disabled-profiling-enabled"
 
-appsec-enabled-iast-worst-ep-disabled:
+vuln-appsec-enabled-iast-enabled-ep-disabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
@@ -261,9 +286,9 @@ appsec-enabled-iast-worst-ep-disabled:
     DD_IAST_ENABLED: "true"
     DD_APPSEC_RASP_ENABLED: "false"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-enabled-iast-worst-ep-disabled"
+    DD_SERVICE: "ddtrace-mb-vuln-appsec-enabled-iast-enabled-ep-disabled"
 
-appsec-worst-iast-disabled-ep-enabled:
+attack-appsec-disabled-iast-disabled-ep-disabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
@@ -274,51 +299,51 @@ appsec-worst-iast-disabled-ep-enabled:
     DD_PROFILING_ENABLED: "false"
     DD_APPSEC_ENABLED: "false"
     DD_IAST_ENABLED: "false"
-    DD_APPSEC_RASP_ENABLED: "true"
+    DD_APPSEC_RASP_ENABLED: "false"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-worst-iast-disabled-ep-enabled"
+    DD_SERVICE: "ddtrace-mb-attack-appsec-disabled-iast-disabled-ep-disabled"
 
-appsec-worst-iast-disabled-ep-enabled-profiling-enabled:
+attack-appsec-enabled-iast-disabled-ep-enabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
     BP_PYTHON_SCENARIO_DIR: flask-realworld
     BP_ENDPOINT: http://0.0.0.0:8000/api/articles?q=select%20pg_sleep
     DDTRACE_INSTALL_VERSION: "git+https://github.com/Datadog/dd-trace-py@${CI_COMMIT_SHA}"
     DD_TRACE_ENABLED: "true"
-    DD_PROFILING_ENABLED: "true"
-    DD_APPSEC_ENABLED: "false"
+    DD_PROFILING_ENABLED: "false"
+    DD_APPSEC_ENABLED: "true"
     DD_IAST_ENABLED: "false"
     DD_APPSEC_RASP_ENABLED: "true"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-worst-iast-disabled-ep-enabled-profiling-enabled"
+    DD_SERVICE: "ddtrace-mb-attack-appsec-enabled-iast-disabled-ep-enabled"
 
-appsec-worst-iast-enabled-ep-enabled:
+attack-appsec-enabled-iast-disabled-ep-enabled-profiling-enabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
     BP_PYTHON_SCENARIO_DIR: flask-realworld
     BP_ENDPOINT: http://0.0.0.0:8000/api/articles?q=select%20pg_sleep
     DDTRACE_INSTALL_VERSION: "git+https://github.com/Datadog/dd-trace-py@${CI_COMMIT_SHA}"
     DD_TRACE_ENABLED: "true"
-    DD_PROFILING_ENABLED: "false"
+    DD_PROFILING_ENABLED: "true"
     DD_APPSEC_ENABLED: "true"
-    DD_IAST_ENABLED: "true"
+    DD_IAST_ENABLED: "false"
     DD_APPSEC_RASP_ENABLED: "true"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-worst-iast-enabled-ep-enabled"
+    DD_SERVICE: "ddtrace-mb-attack-appsec-enabled-iast-disabled-ep-enabled-profiling-enabled"
 
-appsec-worst-iast-worst-ep-enabled:
+attack-appsec-enabled-iast-enabled-ep-enabled:
   extends: .macrobenchmarks
   variables:
     DD_BENCHMARKS_CONFIGURATION: only-tracing
-    BP_ENDPOINT: http://0.0.0.0:8000/iast/articles?string1=Hi&password=select%20pg_sleep
     BP_PYTHON_SCENARIO_DIR: flask-realworld
+    BP_ENDPOINT: http://0.0.0.0:8000/api/articles?q=select%20pg_sleep
     DDTRACE_INSTALL_VERSION: "git+https://github.com/Datadog/dd-trace-py@${CI_COMMIT_SHA}"
     DD_TRACE_ENABLED: "true"
     DD_PROFILING_ENABLED: "false"
     DD_APPSEC_ENABLED: "true"
     DD_IAST_ENABLED: "true"
     DD_APPSEC_RASP_ENABLED: "true"
     IAST_WORST: "true"
-    DD_SERVICE: "ddtrace-mb-appsec-worst-iast-worst-ep-enabled"
+    DD_SERVICE: "ddtrace-mb-attack-appsec-enabled-iast-enabled-ep-enabled"
diff --git a/ddtrace/appsec/_iast/_taint_tracking/tests/test_helpers.cpp b/ddtrace/appsec/_iast/_taint_tracking/tests/test_helpers.cpp
@@ -316,7 +316,9 @@ TEST_F(AsFormattedEvidenceCheck, DefaultTagMappingModeIsMapper)
     Source source("source1", "sample_value", OriginType::BODY);
     TaintRangeRefs taint_ranges = { std::make_shared<TaintRange>(5, 2, source) };
 
-    const std::string expected_result = "This :+-<3485454368>is<3485454368>-+: a test string.";
+    auto taint_range_1_hash = taint_ranges[0]->get_hash();
+    const std::string expected_result = "This :+-<" + std::to_string(taint_range_1_hash) + ">is<" +
+                                        std::to_string(taint_range_1_hash) + ">-+: a test string.";
     const std::string result = as_formatted_evidence(text, taint_ranges);
     EXPECT_STREQ(result.c_str(), expected_result.c_str());
 }
@@ -331,8 +333,11 @@ TEST_F(AsFormattedEvidenceCheck, MultipleRangesWithMapper)
         std::make_shared<TaintRange>(10, 4, source2),
     };
 
+    auto taint_range_1_hash = taint_ranges[0]->get_hash();
+    auto taint_range_2_hash = taint_ranges[1]->get_hash();
     const std::string expected_result =
-      "This :+-<3485454368>is<3485454368>-+: a :+-<891889858>test<891889858>-+: string.";
+      "This :+-<" + std::to_string(taint_range_1_hash) + ">is<" + std::to_string(taint_range_1_hash) + ">-+: a :+-<" +
+      std::to_string(taint_range_2_hash) + ">test<" + std::to_string(taint_range_2_hash) + ">-+: string.";
     const std::string result = as_formatted_evidence(text, taint_ranges);
     EXPECT_STREQ(result.c_str(), expected_result.c_str());
 }
@@ -400,7 +405,9 @@ TEST_F(AllAsFormattedEvidenceCheck, SingleTaintRangeWithMapper)
     TaintRangeRefs taint_ranges = { std::make_shared<TaintRange>(5, 2, source) };
     api_set_ranges(text, taint_ranges);
 
-    const py::str expected_result("This :+-<3485454368>is<3485454368>-+: a test string.");
+    auto taint_range_1_hash = taint_ranges[0]->get_hash();
+    const py::str expected_result("This :+-<" + std::to_string(taint_range_1_hash) + ">is<" +
+                                  std::to_string(taint_range_1_hash) + ">-+: a test string.");
     const py::str result = all_as_formatted_evidence(text, TagMappingMode::Mapper);
 
     EXPECT_STREQ(AnyTextObjectToString(result).c_str(), AnyTextObjectToString(expected_result).c_str());

diff --git a/ddtrace/settings/config.py b/ddtrace/settings/config.py
@@ -370,6 +370,14 @@ def __init__(self):
         # Must come before _integration_configs due to __setattr__
         self._config = _default_config()
 
+        sample_rate = os.getenv("DD_TRACE_SAMPLE_RATE")
+        if sample_rate is not None:
+            deprecate(
+                "DD_TRACE_SAMPLE_RATE is deprecated",
+                message="Please use DD_TRACE_SAMPLING_RULES instead.",
+                removal_version="3.0.0",
+            )
+
         # Use a dict as underlying storing mechanism for integration configs
         self._integration_configs = {}
 

diff --git a/docs/configuration.rst b/docs/configuration.rst
@@ -227,15 +227,6 @@ The following environment variables for the tracer are supported:
      default: False
      description: Enable or disable start up diagnostic logging.
 
-   DD_TRACE_SAMPLE_RATE:
-     type: Float
-     description: |
-        A float, f, 0.0 <= f <= 1.0. f*100% of traces will be sampled. By default, this configuration is unset
-        and sampling is controlled by other configuration options and/or the Datadog Agent. See
-        `this page <https://docs.datadoghq.com/tracing/trace_pipeline/ingestion_mechanisms/?tab=python#in-the-agent>`_
-        for more details about Agent-based sampling.
-
-
    DD_TRACE_RATE_LIMIT:
      type: int
      default: 100

diff --git a/releasenotes/notes/deprecate-sampling-rate-config-5af8f797b05ff5b5.yaml b/releasenotes/notes/deprecate-sampling-rate-config-5af8f797b05ff5b5.yaml
@@ -0,0 +1,4 @@
+---
+deprecations:
+  - |
+    tracing: Deprecates the ``DD_TRACE_SAMPLE_RATE`` environment variable. It will be removed in 3.0.0. Use ``DD_TRACE_SAMPLING_RULES`` to configure sampling rates instead.
diff --git a/tests/tracer/test_sampler.py b/tests/tracer/test_sampler.py
@@ -641,6 +641,21 @@ def test_sampling_rule_sample():
         )
 
 
+@pytest.mark.subprocess(env={"DD_TRACE_SAMPLE_RATE": "0.2"})
+def test_sampling_rate_config_deprecated():
+    import warnings
+
+    with warnings.catch_warnings(record=True) as ws:
+        warnings.simplefilter("always")
+
+        from ddtrace import config
+
+        assert config._trace_sample_rate == 0.2
+
+        assert len(ws) >= 1
+        assert any(w for w in ws if "DD_TRACE_SAMPLE_RATE is deprecated" in str(w.message)), [w.message for w in ws]
+
+
 def test_sampling_rule_sample_rate_1():
     rule = SamplingRule(sample_rate=1)