Conversation
|
✨ Fix all issues with BitsAI or with Cursor
|
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (84.80%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #3581 +/- ##
==========================================
+ Coverage 62.32% 68.72% +6.40%
==========================================
Files 142 166 +24
Lines 13586 19030 +5444
Branches 1775 1797 +22
==========================================
+ Hits 8467 13079 +4612
- Misses 4311 5136 +825
- Partials 808 815 +7
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 1 file with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
cataphract
force-pushed
the
glopes/helper-rust
branch
from
f4914c3 to
2fc2654
Compare
cataphract
force-pushed
the
glopes/appsec-curl
branch
from
bbc593e to
192a4a1
Compare
Benchmarks [ appsec ]Benchmark execution time: 2026-03-13 17:35:25 Comparing candidate commit f71ed6b in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. |
Benchmarks [ tracer ]Benchmark execution time: 2026-03-04 12:25:07 Comparing candidate commit e162af9 in PR branch Found 2 performance improvements and 0 performance regressions! Performance is the same for 190 metrics, 2 unstable metrics. scenario:MessagePackSerializationBench/benchMessagePackSerialization
scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache
|
cataphract
force-pushed
the
glopes/helper-rust
branch
9 times, most recently
from
fb4432d to
8d1029e
Compare
|
This PR is so large that github will only permit me to review it one file at a time. I didn't even know that was a thing! You're going to need to break it down into a series of smaller PRs, probably. |
cataphract
force-pushed
the
glopes/helper-rust
branch
2 times, most recently
from
a218cd6 to
332fd93
Compare
|
@morrisonlevi I've had success for very big PRs with the PHPStorm/CLion github integrations in the past. Doesn't matter for small PRs, but can definitely recommend it for extra-large PRs :-) |
cataphract
force-pushed
the
glopes/helper-rust
branch
from
fc9100c to
718f800
Compare
cataphract
force-pushed
the
glopes/helper-rust
branch
2 times, most recently
from
5d247e2 to
57bcc57
Compare
cataphract
force-pushed
the
glopes/helper-rust
branch
2 times, most recently
from
d4571c9 to
dd440cb
Compare
cataphract
force-pushed
the
glopes/helper-rust
branch
5 times, most recently
from
0385bb7 to
d06640c
Compare
| @@ -0,0 +1,28 @@ | |||
| services: | |||
There was a problem hiding this comment.
I find this "installation" folder a bit dealigned with the rest of example. Is it require?
There was a problem hiding this comment.
It's there to manually test whether the packages generated from CI are installable, since what's on CI is basic and can never test fully against staging. Whether it should be here or on another repository, it's open for discussion
| @@ -0,0 +1,3 @@ | |||
| int test_add(int a, int b) { | |||
There was a problem hiding this comment.
It's used in the test test_sidecar_symbol_resolve_and_call
Benchmarks [ profiler ]Benchmark execution time: 2026-03-12 15:21:08 Comparing candidate commit 0d79129 in PR branch Found 0 performance improvements and 2 performance regressions! Performance is the same for 28 metrics, 6 unstable metrics. scenario:php-profiler-timeline-memory-control
|
cataphract
force-pushed
the
glopes/helper-rust
branch
from
150a90b to
d0a103b
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 025f3110d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This introduces a complete Rust reimplementation of the AppSec helper, a library loaded into the PHP sidecar that executes the Datadog WAF on request data, handles remote configuration, collects telemetry, and provides RASP capabilities. The Rust helper is built as a cdylib (libddappsec-helper-rust.so) and ships alongside the existing C++ helper (libddappsec-helper.so), selectable at runtime. The Rust crate lives under appsec/helper-rust/ and is structured around a Tokio async runtime exposed via a C FFI entry point (appsec_helper_main/appsec_helper_shutdown). The server module accepts PHP extension connections over a Unix socket. Each connection is handled by the client module, which implements the msgpack-based protocol codec (client_init, config_sync, request_init, request_exec, request_shutdown) matching the C++ wire format. The service module manages WAF instances per service configuration with atomic updates via arc-swap, and includes sub-modules for rate limiting, trace sampling, WAF diagnostics, and ruleset management. The rc module reads remote configuration from shared memory published by the sidecar, while rc_notify registers for push-style RC update callbacks via FFI. The telemetry module submits metrics and logs to the sidecar by resolving symbols at runtime, and integrates with the logger so error-level messages are automatically forwarded as telemetry logs. The wire protocol between the PHP extension and the helper has been revised. The request_exec command now sends data as an array followed by a map of options (rasp_rule, subctx_id, subctx_last_call) instead of sending rasp_rule as a positional field before the data. The client_init response gains a sixth field, helper_runtime, which the Rust helper sets to "rust" and the C++ helper sets to "cpp". Both helpers have been updated to speak this new protocol. In the PHP extension, helper_process.c gains a DD_APPSEC_HELPER_RUST_REDIRECTION configuration option (INI setting datadog.appsec.helper_rust_redirection). When enabled, the extension looks for libddappsec-helper-rust.so next to the configured helper path and loads it instead of the C++ binary. The extension tracks which runtime is connected via a helper_runtime enum and reports it in phpinfo() output as "Yes (Rust)" or "Yes (C++)". A new span tag _dd.appsec.helper_runtime is set when using the Rust helper. A testing function send_invalid_msg is added for protocol error testing. The binary is built against musl using nightly Rust with -Z build-std to rebuild the standard library with LLVM's libunwind, then patchelf removes the musl libc NEEDED entry so the resulting .so runs on both glibc and musl systems without modification. A glibc_compat.c shim provides ceil/ceilf/fcntl64/dlopen/dlsym/dlclose implementations for the musl build so it links without pulling in glibc symbols. CI changes in .gitlab/generate-appsec.php add four new pipeline jobs: "helper-rust build and test" (cargo test + format check), "helper-rust code coverage" (unit test coverage uploaded to codecov), "helper-rust integration coverage" (integration test coverage), and "appsec integration tests (helper-rust)" (integration tests on PHP 7.4, 8.1, 8.3, 8.4-zts, 8.5-musl). The existing integration test job template is refactored into a shared .appsec_integration_tests base. The package pipeline in generate-package.php adds a "compile appsec helper rust" job for amd64 and arm64, and the artifact scripts now include libddappsec-helper-rust.so in both glibc and musl packages. The Gradle build system (build.gradle) is extended with tasks for building, testing, and coverage-instrumenting the Rust helper, and gains musl test support via a new nginx-fpm-musl Docker image. A libddwaf-rust git submodule is added under appsec/third_party/ for the WAF Rust bindings. Codecov flags helper-rust-unit and helper-rust-integration are configured in codecov.yml.
cataphract
force-pushed
the
glopes/helper-rust
branch
from
025f311 to
f71ed6b
Compare
5 participants
Description
Passing integration and system-tests.
Further integration into sidecar and protocol changes pending.
Reviewer checklist