Move _dd.apm.enabled tag in tracing root span

.github/forced-tests-list.json

@@ -1,3 +1,6 @@
 {
-
+  "SCA_STANDALONE":
+    [
+      "tests/appsec/test_asm_standalone.py::Test_SCAStandalone_Telemetry"
+    ]
 }

.github/workflows/system-tests.yml

@@ -282,6 +282,9 @@ jobs:
           - library: ruby
             app: rails70
             scenario: DEBUGGER_PII_REDACTION
+          - library: ruby
+            app: rails70            
+            scenario: SCA_STANDALONE
           - library: ruby
             app: rack
             scenario: SAMPLING

lib/datadog/appsec/configuration/settings.rb

@@ -197,14 +197,6 @@ def self.add_settings!(base)
                 o.type :bool, nilable: true
                 o.env 'DD_APPSEC_SCA_ENABLED'
               end
-
-              settings :standalone do
-                option :enabled do |o|
-                  o.type :bool
-                  o.env 'DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED'
-                  o.default false
-                end
-              end
             end
           end
         end

lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -151,8 +151,6 @@ def add_appsec_tags(processor, scope)
             return unless trace && span
 
             span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
-            # We add this tag when ASM standalone is enabled to make sure we don't bill APM
-            span.set_metric(Datadog::AppSec::Ext::TAG_APM_ENABLED, 0) if Datadog.configuration.appsec.standalone.enabled
             span.set_tag('_dd.runtime_family', 'ruby')
             span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
 

lib/datadog/appsec/ext.rb

@@ -7,7 +7,6 @@ module Ext
       SCOPE_KEY = 'datadog.appsec.scope'
 
       TAG_APPSEC_ENABLED = '_dd.appsec.enabled'
-      TAG_APM_ENABLED = '_dd.apm.enabled'
       TAG_DISTRIBUTED_APPSEC_EVENT = '_dd.p.appsec'
     end
   end

lib/datadog/appsec/utils.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative 'utils/trace_operation'
-
 module Datadog
   module AppSec
     # Utilities for AppSec

lib/datadog/core/remote/transport/http.rb

@@ -122,7 +122,7 @@ def default_headers
               headers[Datadog::Core::Transport::Ext::HTTP::HEADER_CONTAINER_ID] = container_id unless container_id.nil?
               # Sending this header to the agent will disable metrics computation (and billing) on the agent side
               # by pretending it has already been done on the library side.
-              if Datadog.configuration.appsec.standalone.enabled
+              if Datadog.configuration.tracing.non_billing.enabled
                 headers[Datadog::Core::Transport::Ext::HTTP::HEADER_CLIENT_COMPUTED_STATS] = 'yes'
               end
             end

lib/datadog/tracing/component.rb

@@ -73,12 +73,11 @@ def build_sampler(settings)
           return sampler
         end
 
-        # AppSec events are sent to the backend using traces.
-        # Standalone ASM billing means that we don't want to charge clients for APM traces,
-        # so we want to send the minimum amount of traces possible (idealy only traces that contains security events),
-        # but for features such as API Security, we need to send at least one trace per minute,
+        # This sampler sends the minimum amount of traces possible,
+        # but to show the service on the service catalog, we need to send at least one trace per minute,
         # to keep the service alive on the backend side.
-        if settings.appsec.standalone.enabled
+        # Traces can still be force-kept (e.g. those containing AppSec events).
+        if settings.tracing.non_billing.enabled
           post_sampler = Tracing::Sampling::RuleSampler.new(
             [Tracing::Sampling::SimpleRule.new(sample_rate: 1.0)],
             rate_limiter: Datadog::Core::TokenBucket.new(1.0 / 60, 1.0),

lib/datadog/tracing/configuration/ext.rb

@@ -12,6 +12,7 @@ module Ext
         ENV_OTEL_TRACES_EXPORTER = 'OTEL_TRACES_EXPORTER'
         ENV_HEADER_TAGS = 'DD_TRACE_HEADER_TAGS'
         ENV_TRACE_ID_128_BIT_GENERATION_ENABLED = 'DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED'
+        ENV_APM_ENABLED = 'DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED' # Temporary until RFC decides final name
 
         # @public_api
         module SpanAttributeSchema

lib/datadog/tracing/configuration/settings.rb

@@ -150,6 +150,45 @@ def self.extended(base)
                 end
               end
 
+              # Configures tracing non-billing mode configuration
+              #
+              # This rate-limit traces to 1 per minute, to keep the service alive without billing it.
+              # The RFC defines the environment variable as DD_TRACE_APM_ENABLED, we are following a similar name.
+              # As of late November, the RFC is not approved yet but should be soon, hence why we are still
+              # using DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED. DD_TRACE_APM_ENABLED will most likely change.
+              # As we already have a way to completely disable traces, we are using 'non_billing' terminology to
+              # make it clear that this is a non-billing mode, which does NOT completely disables tracing.
+              #
+              # Currently, the env var is DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED
+              # which enables non-billing mode when set to `true`. But the future env var will
+              # enables non-billing mode when set to `false`. so we will have to invert the values
+              # returned by the env_parser block.
+              #
+              # @public_api
+              settings :non_billing do
+                # When set to true (or env var set to false)
+                # sets the rate limit to 1 trace per minute, and prevents billing by adding tags
+                #
+                # @default `DD_TRACE_APM_ENABLED` environment variable, otherwise `true`
+                # @return [Boolean]
+                option :enabled do |o|
+                  o.env Tracing::Configuration::Ext::ENV_APM_ENABLED
+                  o.default false
+                  o.type :bool
+                  o.env_parser do |value|
+                    value = value&.downcase
+                    if ['false', '0'].include?(value)
+                      false
+                    elsif ['true', '1'].include?(value)
+                      true
+                    else
+                      Datadog.logger.warn("Unsupported value for 'non-billing' mode: #{value}. Traces will be sent to Datadog.")
+                      nil
+                    end
+                  end
+                end
+              end
+
               # Comma-separated, case-insensitive list of header names that are reported in incoming and outgoing HTTP requests.
               #
               # Each header in the list can either be:

lib/datadog/tracing/contrib/ethon/easy_patch.rb

@@ -110,11 +110,14 @@ def datadog_before_request(continue_from: nil)
 
               datadog_tag_request
 
-              if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(datadog_trace)
+              if datadog_trace.non_billing_reject?
                 datadog_trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
               end
 
-              if datadog_configuration[:distributed_tracing]
+              unless Tracing::Distributed::Helpers.should_skip_distributed_tracing?(
+                datadog_configuration,
+                trace: datadog_trace
+              )
                 @datadog_original_headers ||= {}
                 Contrib::HTTP.inject(datadog_trace, @datadog_original_headers)
                 self.headers = @datadog_original_headers

lib/datadog/tracing/contrib/excon/middleware.rb

@@ -30,10 +30,11 @@ def request_call(datum)
                 trace = Tracing.active_trace
                 datum[:datadog_span] = span
                 annotate!(span, datum)
-                if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                  trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
+                trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+                if Tracing.enabled? &&
+                    !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(@options, trace: trace)
+                  propagate!(trace, span, datum)
                 end
-                propagate!(trace, span, datum) if distributed_tracing?
 
                 span
               end

lib/datadog/tracing/contrib/faraday/middleware.rb

@@ -29,10 +29,11 @@ def call(env)
 
             Tracing.trace(Ext::SPAN_REQUEST, on_error: request_options[:on_error]) do |span, trace|
               annotate!(span, env, request_options)
-              if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
+              trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+              if Tracing.enabled? &&
+                  !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(request_options, trace: trace)
+                propagate!(trace, span, env)
               end
-              propagate!(trace, span, env) if request_options[:distributed_tracing] && Tracing.enabled?
               app.call(env).on_complete { |resp| handle_response(span, resp, request_options) }
             end
           end

lib/datadog/tracing/contrib/grpc/datadog_interceptor.rb

@@ -52,10 +52,6 @@ def analytics_enabled?
               Contrib::Analytics.enabled?(datadog_configuration[:analytics_enabled])
             end
 
-            def distributed_tracing?
-              Datadog.configuration_for(self, :distributed_tracing) || datadog_configuration[:distributed_tracing]
-            end
-
             def analytics_sample_rate
               datadog_configuration[:analytics_sample_rate]
             end

lib/datadog/tracing/contrib/grpc/datadog_interceptor/client.rb

@@ -81,7 +81,14 @@ def annotate!(trace, span, keywords, formatter)
               # Set analytics sample rate
               Contrib::Analytics.set_sample_rate(span, analytics_sample_rate) if analytics_enabled?
 
-              GRPC.inject(trace, metadata) if distributed_tracing?
+              trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+
+              unless Tracing::Distributed::Helpers.should_skip_distributed_tracing?(
+                datadog_configuration,
+                client_config: Datadog.configuration_for(self)
+              )
+                GRPC.inject(trace, metadata)
+              end
               Contrib::SpanAttributeSchema.set_peer_service!(span, Ext::PEER_SERVICE_SOURCES)
             rescue StandardError => e
               Datadog.logger.debug("GRPC client trace failed: #{e}")

lib/datadog/tracing/contrib/http/circuit_breaker.rb

@@ -27,21 +27,6 @@ def internal_request?(request)
             !!(request[Datadog::Core::Transport::Ext::HTTP::HEADER_META_TRACER_VERSION] ||
               request[Datadog::Core::Transport::Ext::HTTP::HEADER_DD_INTERNAL_UNTRACED_REQUEST])
           end
-
-          def should_skip_distributed_tracing?(client_config)
-            if Datadog.configuration.appsec.standalone.enabled
-              # Skip distributed tracing so that we don't bill distributed traces in case of absence of
-              # upstream ASM event (_dd.p.appsec:1) and no local security event (which sets _dd.p.appsec:1 locally).
-              # If there is an ASM event, we still have to check if distributed tracing is enabled or not
-              return true unless Tracing.active_trace
-
-              return true if Tracing.active_trace.get_tag(Datadog::AppSec::Ext::TAG_DISTRIBUTED_APPSEC_EVENT) != '1'
-            end
-
-            return !client_config[:distributed_tracing] if client_config && client_config.key?(:distributed_tracing)
-
-            !Datadog.configuration.tracing[:http][:distributed_tracing]
-          end
         end
       end
     end

lib/datadog/tracing/contrib/http/instrumentation.rb

@@ -35,11 +35,15 @@ def request(req, body = nil, &block)
                 span.type = Tracing::Metadata::Ext::HTTP::TYPE_OUTBOUND
                 span.resource = req.method
 
-                if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                  trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
-                end
-
-                if Tracing.enabled? && !Contrib::HTTP.should_skip_distributed_tracing?(client_config)
+                trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+
+                app_config = Datadog.configuration.tracing[:http]
+                if Tracing.enabled? &&
+                    !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(
+                      app_config,
+                      client_config: client_config,
+                      trace: trace
+                    )
                   Contrib::HTTP.inject(trace, req)
                 end
 

lib/datadog/tracing/contrib/httpclient/instrumentation.rb

@@ -30,11 +30,15 @@ def do_get_block(req, proxy, conn, &block)
                   span.service = service_name(host, request_options, client_config)
                   span.type = Tracing::Metadata::Ext::HTTP::TYPE_OUTBOUND
 
-                  if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                    trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
-                  end
-
-                  if Tracing.enabled? && !should_skip_distributed_tracing?(client_config)
+                  trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+
+                  app_config = Datadog.configuration.tracing[:httpclient]
+                  if Tracing.enabled? &&
+                      !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(
+                        app_config,
+                        client_config: client_config,
+                        trace: trace
+                      )
                     Contrib::HTTP.inject(trace, req.header)
                   end
 
@@ -123,12 +127,6 @@ def analytics_enabled?(request_options)
               Contrib::Analytics.enabled?(request_options[:analytics_enabled])
             end
 
-            def should_skip_distributed_tracing?(client_config)
-              return !client_config[:distributed_tracing] if client_config && client_config.key?(:distributed_tracing)
-
-              !Datadog.configuration.tracing[:httpclient][:distributed_tracing]
-            end
-
             def set_analytics_sample_rate(span, request_options)
               return unless analytics_enabled?(request_options)
 

lib/datadog/tracing/contrib/httprb/instrumentation.rb

@@ -30,12 +30,18 @@ def perform(req, options)
                   span.service = service_name(host, request_options, client_config)
                   span.type = Tracing::Metadata::Ext::HTTP::TYPE_OUTBOUND
 
-                  if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                    trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
+                  trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+
+                  app_config = Datadog.configuration.tracing[:httprb]
+                  if Tracing.enabled? &&
+                      !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(
+                        app_config,
+                        client_config: client_config,
+                        trace: trace
+                      )
+                    Contrib::HTTP.inject(trace, req)
                   end
 
-                  Contrib::HTTP.inject(trace, req) if Tracing.enabled? && !should_skip_distributed_tracing?(client_config)
-
                   # Add additional request specific tags to the span.
                   annotate_span_with_request!(span, req, request_options)
                 rescue StandardError => e
@@ -135,12 +141,6 @@ def logger
               Datadog.logger
             end
 
-            def should_skip_distributed_tracing?(client_config)
-              return !client_config[:distributed_tracing] if client_config && client_config.key?(:distributed_tracing)
-
-              !Datadog.configuration.tracing[:httprb][:distributed_tracing]
-            end
-
             def set_analytics_sample_rate(span, request_options)
               return unless analytics_enabled?(request_options)
 

lib/datadog/tracing/contrib/rest_client/request_patch.rb

@@ -25,10 +25,11 @@ def execute(&block)
               return super(&block) unless Tracing.enabled?
 
               datadog_trace_request(uri) do |_span, trace|
-                if Datadog::AppSec::Utils::TraceOperation.appsec_standalone_reject?(trace)
-                  trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT
+                trace.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace.non_billing_reject?
+
+                unless Tracing::Distributed::Helpers.should_skip_distributed_tracing?(datadog_configuration, trace: trace)
+                  Contrib::HTTP.inject(trace, processed_headers)
                 end
-                Contrib::HTTP.inject(trace, processed_headers) if datadog_configuration[:distributed_tracing]
 
                 super(&block)
               end

lib/datadog/tracing/contrib/sidekiq/client_tracer.rb

@@ -24,7 +24,12 @@ def call(worker_class, job, queue, redis_pool)
             resource = job_resource(job)
 
             Datadog::Tracing.trace(Ext::SPAN_PUSH, service: @sidekiq_service) do |span, trace_op|
-              Sidekiq.inject(trace_op, job) if configuration[:distributed_tracing]
+              trace_op.sampling_priority = Tracing::Sampling::Ext::Priority::AUTO_REJECT if trace_op.non_billing_reject?
+
+              if Tracing.enabled? &&
+                  !Tracing::Distributed::Helpers.should_skip_distributed_tracing?(configuration, trace: trace_op)
+                Sidekiq.inject(trace_op, job)
+              end
 
               span.resource = resource
 

lib/datadog/tracing/distributed/helpers.rb

@@ -59,6 +59,17 @@ def self.parse_hex_id(value)
 
           num
         end
+
+        def self.should_skip_distributed_tracing?(app_config, client_config: nil, trace: nil)
+          if ::Datadog.configuration.tracing.non_billing.enabled
+            return true unless trace
+            return true if trace.non_billing_reject?
+          end
+
+          return !client_config[:distributed_tracing] if client_config && client_config.key?(:distributed_tracing)
+
+          !app_config[:distributed_tracing]
+        end
       end
     end
   end

lib/datadog/tracing/metadata/ext.rb

@@ -31,6 +31,9 @@ module Ext
         # See Datadog-internal "RFC: Identifying which spans have profiling enabled " for details
         TAG_PROFILING_ENABLED = '_dd.profiling.enabled'
 
+        # Set to '0' if 'non-billing' mode is enabled, not present otherwise.
+        TAG_APM_ENABLED = '_dd.apm.enabled'
+
         # Defines constants for trace analytics
         # @public_api
         module Analytics