Add DD_APPSEC_SCA_ENABLED new configuration variable

ext/configuration.c

@@ -147,6 +147,8 @@ static void dd_ini_env_to_ini_name(const zai_str env_name, zai_config_name *ini_
 
         if (env_name.ptr == strstr(env_name.ptr, "DD_TRACE_")) {
             ini_name->ptr[sizeof("datadog.trace") - 1] = '.';
+        } else if (env_name.ptr == strstr(env_name.ptr, "DD_APPSEC_")) {
+            ini_name->ptr[sizeof("datadog.appsec") - 1] = '.';
         }
     } else {
         ini_name->len = 0;
@@ -196,6 +198,10 @@ void ddtrace_config_first_rinit() {
     }
     zend_string_release(internal_functions_old);
 
+    if (!get_global_DD_INSTRUMENTATION_TELEMETRY_ENABLED() && get_DD_APPSEC_SCA_ENABLED()) {
+        LOG(WARN, "DD_APPSEC_SCA_ENABLED requires DD_INSTRUMENTATION_TELEMETRY_ENABLED in order to work");
+    }
+
     runtime_config_first_init = true;
 }
 

ext/configuration.h

@@ -190,6 +190,7 @@ enum ddtrace_sampling_rules_format {
     CONFIG(BOOL, DD_TRACE_OTEL_ENABLED, "false")                                                               \
     CONFIG(STRING, DD_TRACE_LOG_FILE, "", .ini_change = zai_config_system_ini_change)                          \
     CONFIG(STRING, DD_TRACE_LOG_LEVEL, "error", .ini_change = ddtrace_alter_dd_trace_log_level)                \
+    CONFIG(BOOL, DD_APPSEC_SCA_ENABLED, "false", .ini_change = zai_config_system_ini_change)                   \
     DD_INTEGRATIONS
 
 #ifndef _WIN32

ext/telemetry.c

@@ -50,7 +50,7 @@ void ddtrace_telemetry_finalize(void) {
         ini = zend_hash_find_ptr(EG(ini_directives), ini->name);
 #endif
         if (!zend_string_equals_literal(ini->name, "datadog.trace.enabled")) { // datadog.trace.enabled is meaningless: always off at rshutdown
-            ddog_ConfigurationOrigin origin = DDOG_CONFIGURATION_ORIGIN_DEFAULT;
+            ddog_ConfigurationOrigin origin = cfg->name_index == -1 ? DDOG_CONFIGURATION_ORIGIN_DEFAULT : DDOG_CONFIGURATION_ORIGIN_ENV_VAR;
             if (!zend_string_equals_cstr(ini->value, cfg->default_encoded_value.ptr, cfg->default_encoded_value.len)) {
                 origin = cfg->name_index >= 0 ? DDOG_CONFIGURATION_ORIGIN_ENV_VAR : DDOG_CONFIGURATION_ORIGIN_CODE;
             }

tests/ext/appsec/sca_flag_is_sent_01.phpt

@@ -0,0 +1,30 @@
+--TEST--
+DD_APPSEC_SCA_ENABLED flag is sent to via telemetry with default value
+--DESCRIPTION--
+This configuration is used by the backend to display/charge customers
+--SKIPIF--
+<?php
+if (getenv('PHP_PEAR_RUNTESTS') === '1') die("skip: pecl run-tests does not support {PWD}");
+if (getenv('USE_ZEND_ALLOC') === '0' && !getenv("SKIP_ASAN")) die('skip timing sensitive test - valgrind is too slow');
+?>
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_INSTRUMENTATION_TELEMETRY_ENABLED=1
+--INI--
+datadog.trace.agent_url="file://{PWD}/sca_flag_is_sent_01-telemetry.out"
+--FILE_EXTERNAL--
+sca_test.inc
+--EXPECT--
+array(3) {
+  ["name"]=>
+  string(18) "appsec.sca_enabled"
+  ["value"]=>
+  string(5) "false"
+  ["origin"]=>
+  string(7) "Default"
+}
+string(4) "Sent"
+--CLEAN--
+<?php
+
+@unlink(__DIR__ . '/sca_flag_is_sent_01-telemetry.out');

tests/ext/appsec/sca_flag_is_sent_02.phpt

@@ -0,0 +1,31 @@
+--TEST--
+DD_APPSEC_SCA_ENABLED flag is sent to via telemetry with true
+--DESCRIPTION--
+This configuration is used by the backend to display/charge customers
+--SKIPIF--
+<?php
+if (getenv('PHP_PEAR_RUNTESTS') === '1') die("skip: pecl run-tests does not support {PWD}");
+if (getenv('USE_ZEND_ALLOC') === '0' && !getenv("SKIP_ASAN")) die('skip timing sensitive test - valgrind is too slow');
+?>
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_INSTRUMENTATION_TELEMETRY_ENABLED=1
+DD_APPSEC_SCA_ENABLED=true
+--INI--
+datadog.trace.agent_url="file://{PWD}/sca_flag_is_sent_02-telemetry.out"
+--FILE_EXTERNAL--
+sca_test.inc
+--EXPECT--
+array(3) {
+  ["name"]=>
+  string(18) "appsec.sca_enabled"
+  ["value"]=>
+  string(4) "true"
+  ["origin"]=>
+  string(6) "EnvVar"
+}
+string(4) "Sent"
+--CLEAN--
+<?php
+
+@unlink(__DIR__ . '/sca_flag_is_sent_02-telemetry.out');

tests/ext/appsec/sca_flag_is_sent_03.phpt

@@ -0,0 +1,31 @@
+--TEST--
+DD_APPSEC_SCA_ENABLED flag is sent to via telemetry with false
+--DESCRIPTION--
+This configuration is used by the backend to display/charge customers
+--SKIPIF--
+<?php
+if (getenv('PHP_PEAR_RUNTESTS') === '1') die("skip: pecl run-tests does not support {PWD}");
+if (getenv('USE_ZEND_ALLOC') === '0' && !getenv("SKIP_ASAN")) die('skip timing sensitive test - valgrind is too slow');
+?>
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_INSTRUMENTATION_TELEMETRY_ENABLED=1
+DD_APPSEC_SCA_ENABLED=false
+--INI--
+datadog.trace.agent_url="file://{PWD}/sca_flag_is_sent_03-telemetry.out"
+--FILE_EXTERNAL--
+sca_test.inc
+--EXPECT--
+array(3) {
+  ["name"]=>
+  string(18) "appsec.sca_enabled"
+  ["value"]=>
+  string(5) "false"
+  ["origin"]=>
+  string(6) "EnvVar"
+}
+string(4) "Sent"
+--CLEAN--
+<?php
+
+@unlink(__DIR__ . '/sca_flag_is_sent_03-telemetry.out');

tests/ext/appsec/sca_flag_is_sent_04.phpt

@@ -0,0 +1,31 @@
+--TEST--
+DD_APPSEC_SCA_ENABLED is set by INI
+--DESCRIPTION--
+This configuration is used by the backend to display/charge customers
+--SKIPIF--
+<?php
+if (getenv('PHP_PEAR_RUNTESTS') === '1') die("skip: pecl run-tests does not support {PWD}");
+if (getenv('USE_ZEND_ALLOC') === '0' && !getenv("SKIP_ASAN")) die('skip timing sensitive test - valgrind is too slow');
+?>
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_INSTRUMENTATION_TELEMETRY_ENABLED=1
+--INI--
+datadog.trace.agent_url="file://{PWD}/sca_flag_is_sent_04-telemetry.out"
+datadog.appsec.sca_enabled=1
+--FILE_EXTERNAL--
+sca_test.inc
+--EXPECT--
+array(3) {
+  ["name"]=>
+  string(18) "appsec.sca_enabled"
+  ["value"]=>
+  string(1) "1"
+  ["origin"]=>
+  string(6) "EnvVar"
+}
+string(4) "Sent"
+--CLEAN--
+<?php
+
+@unlink(__DIR__ . '/sca_flag_is_sent_04-telemetry.out');

tests/ext/appsec/sca_flag_is_sent_05.phpt

@@ -0,0 +1,31 @@
+--TEST--
+DD_APPSEC_SCA_ENABLED is set by INI
+--DESCRIPTION--
+This configuration is used by the backend to display/charge customers
+--SKIPIF--
+<?php
+if (getenv('PHP_PEAR_RUNTESTS') === '1') die("skip: pecl run-tests does not support {PWD}");
+if (getenv('USE_ZEND_ALLOC') === '0' && !getenv("SKIP_ASAN")) die('skip timing sensitive test - valgrind is too slow');
+?>
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_INSTRUMENTATION_TELEMETRY_ENABLED=1
+--INI--
+datadog.trace.agent_url="file://{PWD}/sca_flag_is_sent_05-telemetry.out"
+datadog.appsec.sca_enabled=0
+--FILE_EXTERNAL--
+sca_test.inc
+--EXPECT--
+array(3) {
+  ["name"]=>
+  string(18) "appsec.sca_enabled"
+  ["value"]=>
+  string(1) "0"
+  ["origin"]=>
+  string(6) "EnvVar"
+}
+string(4) "Sent"
+--CLEAN--
+<?php
+
+@unlink(__DIR__ . '/sca_flag_is_sent_05-telemetry.out');

tests/ext/appsec/sca_test.inc

@@ -0,0 +1,46 @@
+<?php
+DDTrace\start_span();
+$root = DDTrace\root_span();
+
+$id = basename(__FILE__, ".php");
+
+$root->service = $id.'-telemetry-app';
+$root->meta['env'] = 'test-env';
+
+DDTrace\close_span();
+
+// At this stage, the service and env are stored to be used by telemetry
+dd_trace_serialize_closed_spans();
+
+dd_trace_internal_fn("finalize_telemetry");
+
+for ($i = 0; $i < 100; ++$i) {
+    usleep(100000);
+    if (file_exists(__DIR__ . '/'.$id.'-telemetry.out')) {
+        $batches = [];
+        foreach (file(__DIR__ . '/'.$id.'-telemetry.out') as $l) {
+            if ($l) {
+                $json = json_decode($l, true);
+                array_push($batches, ...($json["request_type"] == "message-batch" ? $json["payload"] : [$json]));
+            }
+        }
+        $found = array_filter($batches, function ($json) {
+            if ($json["request_type"] !== "app-started") {
+                return false;
+            }
+            foreach($json["payload"]["configuration"] as $configuration) {
+                if (strpos($configuration["name"], "sca_enabled") !== false) {
+                    var_dump($configuration);
+                    return true;
+                }
+            }
+            return false;
+        });
+        if (count($found) == 1) {
+            var_dump("Sent");
+            break;
+        }
+    }
+}
+
+?>