o
    i"                  	   @   s  d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ eeZe
j e
j!e
j"e
j#hZ$d$ddZ%d$ddZ&G dd deZ'e' Z(dee de)e*e)e*ef f de)e*ef fddZ+i fde,e de)e*e)e*ef f ddfddZ-d$d d!Z.d$d"d#Z/dS )%    N)Any)Optional)Sequence)_asm_feature_is_required)_rc_capabilities)APPSEC)PRODUCTS)core)
get_logger)Payload)PayloadType)
RCCallback)remoteconfig_poller)config)telemetry_writer)TELEMETRY_APM_PRODUCT)tracerreturnc                  C   s   t dt t  t rtjtj	t
t gd ttj	 tjrNtjdu rNttjt
 ttj ttjt
 ttj ttjt
 ttj tjrZddlm}  |   ttjd tjjt_dS )ah  Remote config will be used by ASM libraries to receive four different updates from the backend.
    Each update has it's own product:
    - ASM_FEATURES product - To allow users enable or disable ASM remotely
    - ASM product - To allow clients to activate or deactivate rules
    - ASM_DD product - To allow the library to receive rules updates
    - ASM_DATA product - To allow the library to receive list of blocked IPs and users

    If environment variable `DD_APPSEC_ENABLED` is not set, registering ASM_FEATURE can enable ASM remotely.
    If it's set to true, we will register the rest of the products.
    z/[%s][P: %s] Register ASM Remote Config Callback)capabilitiesNr   load_common_appsec_modulesT)logdebugosgetpidgetppidr   r   register_callbackr   ASM_FEATURES_appsec_callbackr   enable_product
asm_config_asm_enabled_asm_static_rule_fileASM_DATAASMASM_DDddtrace.appsec._listenersr   r   product_activatedr   r   _clientid_rc_client_idr    r+   W/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_remoteconfiguration.pyenable_appsec_rc   s(   r-   c                  C   s0   t D ]} t|  t|  qttjd d S )NF)APPSEC_PRODUCTSr   unregister_callbackdisable_productr   r'   r   r   )product_namer+   r+   r,   disable_appsec_rcD   s   
r2   c                   @   s0   e Zd ZdZd	ddZdee ddfddZdS )
AppSecCallbackz+Remote config callback for AppSec products.r   Nc                 C   s
   i | _ dS )zInitialize the AppSec callback.N)_cache)selfr+   r+   r,   __init__P   s   
zAppSecCallback.__init__payloadsc                 C   s  |sdS t || j}d|v rgtjdu rg|d ddrCttj|  t	tj ttj
|  t	tj
 ttj|  t	tj n$ttj ttj ttj
 ttj
 ttj ttj dtdd |D  dt  d	t  d
}t| g }g }g }|D ]*}|jjdkr|| q|jdu r||jj|jf q||jj|j|jf qt| |s|rtjrtd||f dS dS dS )zProcess AppSec configuration payloads.

        Args:
            payloads: Sequence of configuration payloads to process
        NasmenabledFz:appsec._remoteconfiguration.deb::_appsec_callback::payloadc                 s   s    | ]}|j V  qd S )N)path).0pr+   r+   r,   	<genexpr>p   s    z*AppSecCallback.__call__.<locals>.<genexpr>[z][P: ]r   z
waf.update)_update_asm_featuresr4   r    r"   getr   r   r   r#   r   r$   r%   r/   r0   tupler   r   r   r   r   metadatar1   appendcontentr:   _process_asm_featuresr!   r	   dispatch)r5   r7   result
debug_infofor_the_waf_updatesfor_the_waf_removalsfor_the_tracerpayloadr+   r+   r,   __call__T   sP   


zAppSecCallback.__call__r   N)__name__
__module____qualname____doc__r6   r   r   rN   r+   r+   r+   r,   r3   M   s    
r3   payload_listcachec                 C   s   i }| D ]A}|j jdkrE|j}|d u r;|j|v r3d||j v r&ddi|d< nd||j v r3dd i|d< ||jd  q|| |||j< q|S )Nr   r8   r9   Fauto_user_instrummode)rC   r1   rE   r:   popupdate)rT   rU   resrM   payload_contentr+   r+   r,   r@      s   


r@   c                 C   sX   t | |}d|v rtjr|d ddrt  nt  d|v r*|d ddt_dS dS )a0  This callback updates appsec enabled in tracer and config instances following this logic:
    ```
    | DD_APPSEC_ENABLED | RC Enabled | Result   |
    |-------------------|------------|----------|
    | <not set>         | <not set>  | Disabled |
    | <not set>         | false      | Disabled |
    | <not set>         | true       | Enabled  |
    | false             | <not set>  | Disabled |
    | true              | <not set>  | Enabled  |
    | false             | true       | Disabled |
    | true              | true       | Enabled  |
    ```
    r8   r9   FrV   rW   N)r@   r    _asm_can_be_enabledrA   
enable_asmdisable_asm"_auto_user_instrumentation_rc_mode)rT   rU   rH   r+   r+   r,   rF      s   
rF   c                  C   sN   t jr%ddlm}  |   dt _t jrddlm} |  tj	dd d S d S )Nr   )AppSecSpanProcessorF
APIManager)appsec_enabled)
r    r!   ddtrace.appsec._processorr`   disable_api_security_active(ddtrace.appsec._api_security.api_managerrb   r   	configure)r`   rb   r+   r+   r,   r^      s   r^   c                  C   sZ   t jr)t js+ddlm}  dt _t jrddlm} |  |   t	j
dtjd d S d S d S )Nr   )load_appsecTra   )rc   appsec_enabled_origin)r    r\   r!   r&   ri   _api_security_enabledrg   rb   enabler   rh   r   ENABLED_ORIGIN_RC)ri   rb   r+   r+   r,   r]      s   r]   rO   )0r   typingr   r   r   ddtrace.appsec._capabilitiesr   r   ddtrace.appsec._constantsr   r   ddtrace.internalr	   ddtrace.internal.loggerr
   ddtrace.internal.remoteconfigr   r   r   $ddtrace.internal.remoteconfig.workerr   ddtrace.internal.settings.asmr   r    ddtrace.internal.telemetryr   $ddtrace.internal.telemetry.constantsr   ddtrace.tracer   rP   r   r   r$   r#   r%   r.   r-   r2   r3   r   dictstrr@   listrF   r^   r]   r+   r+   r+   r,   <module>   s8   

(	72.
