[contrib] add orchestrion integration configuration #3074

RomainMuller · 2025-01-09T14:42:04Z

What does this PR do?

Moves orchestrion integrations configuration from orchestrion itself to dd-trace-go.

Motivation

This improves maintainability of automatic injection configuration, and allows orchestrion customers more fine-grained control of what gets injected automatically.

Reviewer's Checklist

Changed code has unit tests for its functionality at or near 100% coverage.
System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
There is a benchmark for any new code, or changes to existing code.
If this interacts with the agent in a new way, a system test has been added.
Add an appropriate team label so this PR gets put in the right place for the release notes.
Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.
For internal contributors, a matching PR should be created to the v2-dev branch and reviewed by @DataDog/apm-go.

Unsure? Have a question? Request a review!

datadog-datadog-prod-us1 · 2025-01-09T14:42:43Z

.github/workflows/orchestrion.yml

+      TESTCONTAINERS_RYUK_DISABLED: true
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

datadog-datadog-prod-us1 · 2025-01-09T14:42:43Z

.github/workflows/orchestrion.yml

+      - name: Checkout Code
+        uses: actions/checkout@v3
+      - name: Setup Go
+        uses: actions/setup-go@v3


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

datadog-datadog-prod-us1 · 2025-01-09T14:42:43Z

internal/orchestrion/_integration/go.mod

+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/arch v0.12.0 // indirect
+	golang.org/x/crypto v0.30.0 // indirect


⚫ Library Vulnerability

golang.org/x/crypto → 0.30.0

View all suggested fixes

Suggested change

golang.org/x/crypto v0.30.0 // indirect

golang.org/x/crypto vv0.32.0// indirect

Suggested change

golang.org/x/crypto v0.30.0 // indirect

golang.org/x/crypto vv0.31.0// indirect

Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (...read more)

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

datadog-datadog-prod-us1 · 2025-01-09T14:42:44Z

internal/orchestrion/_integration/go.mod

+	golang.org/x/arch v0.12.0 // indirect
+	golang.org/x/crypto v0.30.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/net v0.32.0 // indirect


🔴 Library Vulnerability

golang.org/x/net → 0.32.0

View all suggested fixes

Suggested change

golang.org/x/net v0.32.0 // indirect

golang.org/x/net vv0.34.1-0.20250107223440-03179ce0330f// indirect

Suggested change

golang.org/x/net v0.32.0 // indirect

golang.org/x/net vv0.33.0// indirect

Non-linear parsing of case-insensitive content in golang.org/x/net/html (...read more)

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

datadog-datadog-prod-us1 · 2025-01-09T14:42:45Z

.github/workflows/orchestrion.yml

+      - name: Checkout Code
+        uses: actions/checkout@v3
+      - name: Setup Go
+        uses: actions/setup-go@v3


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

datadog-datadog-prod-us1 · 2025-01-09T14:42:45Z

.github/workflows/orchestrion.yml

+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

datadog-datadog-prod-us1 · 2025-01-09T14:49:42Z

Datadog Report

Branch report: romain.marcadier/APPSEC-55160/orchestrion
Commit report: 9b67a0f
Test service: dd-trace-go

❌ 5 Failed (0 Known Flaky), 5114 Passed, 70 Skipped, 2m 48.34s Total Time

❌ Failed Tests (5)

TestTelemetryEnabled - gopkg.in/DataDog/dd-trace-go.v1/contrib/internal/telemetrytest - Details
Expand for error
```
 Failed
 
 === RUN   TestTelemetryEnabled
 --- FAIL: TestTelemetryEnabled (1.00s)
```
ExampleHook - gopkg.in/DataDog/dd-trace-go.v1/contrib/sirupsen/logrus - Details
Expand for error
```
 Failed
 
 === RUN   ExampleHook
 --- FAIL: ExampleHook (0.00s)
 got:
 want:
```

TestIntegrationEnabled - gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer - Details

Expand for error

 Failed
 
 === RUN   TestIntegrationEnabled
     option_test.go:351: 
         	Error Trace:	/home/runner/work/dd-trace-go/dd-trace-go/ddtrace/tracer/option_test.go:351
         	Error:      	Received unexpected error:
         	            	exit status 1
         	Test:       	TestIntegrationEnabled
         	Messages:   	grep command failed
 --- FAIL: TestIntegrationEnabled (0.62s)

TestSpanFromContext - gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer - Details
Expand for error
```
 Failed
 
 === RUN   TestSpanFromContext
 --- FAIL: TestSpanFromContext (0.00s)
```

TestSpanFromContext/no-op - gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer - Details

Expand for error

 Failed
 
 === RUN   TestSpanFromContext/no-op
     context_test.go:44: 
         	Error Trace:	/home/runner/work/dd-trace-go/dd-trace-go/ddtrace/tracer/context_test.go:44
         	Error:      	Should be true
         	Test:       	TestSpanFromContext/no-op
     context_test.go:48: 
         	Error Trace:	/home/runner/work/dd-trace-go/dd-trace-go/ddtrace/tracer/context_test.go:48
         	Error:      	Should be true
 ...

datadog-datadog-prod-us1 · 2025-01-09T15:49:15Z

.github/workflows/orchestrion.yml

+
+      # ddapm-test-agent is used to observe side effects from the tracer during integration tests.
+      - name: Set up Python
+        uses: actions/setup-python@v5


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

pr-commenter · 2025-01-09T16:30:07Z

Benchmarks

Benchmark execution time: 2025-01-10 15:51:53

Comparing candidate commit 03f1102 in PR branch romain.marcadier/APPSEC-55160/orchestrion with baseline commit 38c3f21 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 0 unstable metrics.

internal/orchestrion/_integration/internal/agent/logger.go

internal/orchestrion/_integration/net_http/base.go

… repo)

datadog-datadog-prod-us1 bot reviewed Jan 9, 2025

View reviewed changes

[contrib] add orchestrion integration configuration

4631a52

RomainMuller force-pushed the romain.marcadier/APPSEC-55160/orchestrion branch from 60deffb to ed1218e Compare January 9, 2025 14:43

RomainMuller force-pushed the romain.marcadier/APPSEC-55160/orchestrion branch 6 times, most recently from f06d0d3 to 8591beb Compare January 9, 2025 15:28

WIP: Set up orchestrion integration testing

6d487dd

RomainMuller force-pushed the romain.marcadier/APPSEC-55160/orchestrion branch from 8591beb to 6d487dd Compare January 9, 2025 15:48

datadog-datadog-prod-us1 bot reviewed Jan 9, 2025

View reviewed changes

RomainMuller added 6 commits January 9, 2025 17:56

Add CI viz integration test

4ac23cc

Add GLS integration tests

6a90e73

Add harness + gqlgen integration test

ee47a13

Add AWS.v1 tests

d60d93e

Add AWS.v2 tests

1295f26

Add the rest of integration tests

41e9732

github-advanced-security bot found potential problems Jan 10, 2025

View reviewed changes

internal/orchestrion/_integration/internal/agent/logger.go Dismissed Show dismissed Hide dismissed

internal/orchestrion/_integration/net_http/base.go Dismissed Show dismissed Hide dismissed

RomainMuller added 5 commits January 10, 2025 13:41

Fixup path to requirements-dev.txt

882c4c7

Add workflow_call trigger to orchestrion workflow

31fac3e

Add option to collect coverage

839cfba

Make workflow work when called via workflow_call (event is in foreign…

435e6ea

… repo)

Quotes around the not

03f1102

RomainMuller force-pushed the romain.marcadier/APPSEC-55160/orchestrion branch from 517580b to 03f1102 Compare January 10, 2025 15:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[contrib] add orchestrion integration configuration #3074

[contrib] add orchestrion integration configuration #3074

RomainMuller commented Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot Jan 9, 2025

datadog-datadog-prod-us1 bot commented Jan 9, 2025 •

edited

Loading

datadog-datadog-prod-us1 bot Jan 9, 2025

pr-commenter bot commented Jan 9, 2025 •

edited

Loading

	golang.org/x/crypto v0.30.0 // indirect
	golang.org/x/crypto vv0.32.0// indirect

	golang.org/x/crypto v0.30.0 // indirect
	golang.org/x/crypto vv0.31.0// indirect

	golang.org/x/net v0.32.0 // indirect
	golang.org/x/net vv0.34.1-0.20250107223440-03179ce0330f// indirect

	golang.org/x/net v0.32.0 // indirect
	golang.org/x/net vv0.33.0// indirect

[contrib] add orchestrion integration configuration #3074

Are you sure you want to change the base?

[contrib] add orchestrion integration configuration #3074

Conversation

RomainMuller commented Jan 9, 2025

What does this PR do?

Motivation

Reviewer's Checklist

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🟠 Code Vulnerability

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🟠 Code Vulnerability

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

⚫ Library Vulnerability

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🔴 Library Vulnerability

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🟠 Code Vulnerability

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🟠 Code Vulnerability

datadog-datadog-prod-us1 bot commented Jan 9, 2025 • edited Loading

Datadog Report

❌ Failed Tests (5)

datadog-datadog-prod-us1 bot Jan 9, 2025

Choose a reason for hiding this comment

🟠 Code Vulnerability

pr-commenter bot commented Jan 9, 2025 • edited Loading

Benchmarks

datadog-datadog-prod-us1 bot commented Jan 9, 2025 •

edited

Loading

pr-commenter bot commented Jan 9, 2025 •

edited

Loading