Fix SidecarFeaturesDisabledTests regression from sidecar appsec integration

Cargo.toml

@@ -51,8 +51,8 @@ libdd-common = { path = "libdatadog/libdd-common", features = ["cgroup_testing"]
 libdd-common-ffi = { path = "libdatadog/libdd-common-ffi", default-features = false }
 libdd-telemetry = { path = "libdatadog/libdd-telemetry" }
 libdd-telemetry-ffi = { path = "libdatadog/libdd-telemetry-ffi", default-features = false }
-datadog-live-debugger = { path = "libdatadog/datadog-live-debugger" }
-datadog-live-debugger-ffi = { path = "libdatadog/datadog-live-debugger-ffi", default-features = false }
+datadog-live-debugger = { package = "libdd-live-debugger", path = "libdatadog/libdd-live-debugger" }
+datadog-live-debugger-ffi = { package = "libdd-live-debugger-ffi", path = "libdatadog/libdd-live-debugger-ffi", default-features = false }
 libdd-ipc = { path = "libdatadog/libdd-ipc" }
 datadog-ffe = { package = "libdd-ffe", path = "libdatadog/libdd-ffe" }
 libdd-remote-config = { path = "libdatadog/libdd-remote-config" }

appsec/src/extension/commands/client_init.c

@@ -29,6 +29,7 @@ static const dd_command_spec _spec = {
     .name = "client_init",
     .name_len = sizeof("client_init") - 1,
     .num_args = 8,
+    .reconnect_sidecar = true,
     .outgoing_cb = _pack_command,
     .incoming_cb = _process_response,
     .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/commands/client_shutdown.c

@@ -19,6 +19,7 @@ static const dd_command_spec _spec = {
     .name = "client_shutdown",
     .name_len = sizeof("client_shutdown") - 1,
     .num_args = 1,
+    .reconnect_sidecar = false,
     .outgoing_cb = _pack_command,
     .incoming_cb = _process_response,
     .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/commands/config_sync.c

@@ -21,6 +21,7 @@ static const dd_command_spec _spec = {
     .name = "config_sync",
     .name_len = sizeof("config_sync") - 1,
     .num_args = 2,
+    .reconnect_sidecar = true,
     .outgoing_cb = _request_pack,
     .incoming_cb = dd_command_process_config_sync,
     .config_features_cb = dd_command_process_config_features,

appsec/src/extension/commands/request_exec.c

@@ -29,6 +29,7 @@ static const dd_command_spec _spec = {
     .name = "request_exec",
     .name_len = sizeof("request_exec") - 1,
     .num_args = 2,
+    .reconnect_sidecar = true,
     .outgoing_cb = _pack_command,
     .incoming_cb = dd_command_proc_resp_verd_span_data,
     .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/commands/request_init.c

@@ -37,6 +37,7 @@ static const dd_command_spec _spec = {
     .name = "request_init",
     .name_len = sizeof("request_init") - 1,
     .num_args = 1, // a single map
+    .reconnect_sidecar = true,
     .outgoing_cb = _request_pack,
     .incoming_cb = dd_command_proc_resp_verd_span_data,
     .config_features_cb = dd_command_process_config_features,

appsec/src/extension/commands/request_shutdown.c

@@ -31,6 +31,7 @@ static const dd_command_spec _spec = {
     .name_len = sizeof("request_shutdown") - 1,
     .num_args =
         4, // a map, api sec sampling key, sidecar queue id, input_truncated
+    .reconnect_sidecar = false,
     .outgoing_cb = _request_pack,
     .incoming_cb = dd_command_proc_resp_verd_span_data,
     .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/commands_helpers.c

@@ -41,7 +41,8 @@ typedef struct _dd_imsg {
 
 // if and only if this returns success, _imsg_destroy must be called
 static dd_result ATTR_WARN_UNUSED _imsg_recv(dd_imsg *nonnull imsg,
-    dd_conn *nonnull conn, dd_mpack_buffer *nonnull buffer);
+    dd_conn *nonnull conn, dd_mpack_buffer *nonnull buffer,
+    bool reconnect_sidecar);
 
 static inline ATTR_WARN_UNUSED mpack_error_t _imsg_destroy(
     dd_imsg *nonnull imsg);
@@ -84,7 +85,7 @@ static dd_result _dd_command_exec(dd_conn *nonnull conn,
     }
 
     dd_imsg imsg = {0};
-    res = _imsg_recv(&imsg, conn, &omsg.buffer);
+    res = _imsg_recv(&imsg, conn, &omsg.buffer, spec->reconnect_sidecar);
     _dump_out_msg(dd_log_trace, &omsg.buffer);
     _omsg_destroy(&omsg);
     if (res) {
@@ -240,12 +241,13 @@ static inline void _omsg_destroy(dd_omsg *nonnull omsg)
 
 // incoming
 static ATTR_WARN_UNUSED dd_result _imsg_recv(dd_imsg *nonnull imsg,
-    dd_conn *nonnull conn, dd_mpack_buffer *nonnull buffer)
+    dd_conn *nonnull conn, dd_mpack_buffer *nonnull buffer,
+    bool reconnect_sidecar)
 {
     mlog(dd_log_debug, "Will exchange message with helper");
 
-    dd_result res = dd_conn_roundtrip(
-        conn, buffer->data, buffer->final_msg_size, &imsg->_response);
+    dd_result res = dd_conn_roundtrip(conn, buffer->data,
+        buffer->final_msg_size, reconnect_sidecar, &imsg->_response);
     if (res) {
         return res;
     }

appsec/src/extension/commands_helpers.h

@@ -15,6 +15,8 @@ typedef struct _dd_command_spec {
     const char *nonnull name;
     size_t name_len;
     size_t num_args; // outgoing args
+    // Whether a failed exchange may reconnect to the sidecar and try again.
+    bool reconnect_sidecar;
     dd_result (*nonnull outgoing_cb)(
         mpack_writer_t *nonnull writer, void *unspecnull ctx);
     dd_result (*nonnull incoming_cb)(mpack_node_t root, void *unspecnull ctx);

appsec/src/extension/ddappsec.c

@@ -605,6 +605,7 @@ static PHP_FUNCTION(datadog_appsec_testing_send_invalid_command)
         .name = "invalid_command",
         .name_len = sizeof("invalid_command") - 1,
         .num_args = 1,
+        .reconnect_sidecar = true,
         .outgoing_cb = _pack_invalid_command,
         .incoming_cb = _process_invalid_response,
         .config_features_cb = dd_command_process_config_features_unexpected,

appsec/src/extension/ddtrace.c

@@ -77,6 +77,10 @@ static zend_string *(*nullable _ddtrace_guess_endpoint_from_url)(
 static ddog_AppsecCResponse (*nullable _ddog_sidecar_send_appsec_message)(
     ddog_SidecarTransport *nonnull *nonnull transport, uint64_t client_id,
     ddog_CharSlice data);
+static ddog_AppsecCResponse (
+    *nullable _datadog_sidecar_send_appsec_message_without_reconnect)(
+    ddog_SidecarTransport *nonnull *nonnull transport, uint64_t client_id,
+    ddog_CharSlice data);
 static void (*nullable _ddog_sidecar_appsec_response_drop)(
     ddog_AppsecCResponse response);
 
@@ -132,6 +136,8 @@ static void dd_trace_load_symbols(zend_module_entry *module)
         _ddtrace_guess_endpoint_from_url, "ddtrace_guess_endpoint_from_url");
     ASSIGN_DLSYM(
         _ddog_sidecar_send_appsec_message, "ddog_sidecar_send_appsec_message");
+    ASSIGN_DLSYM(_datadog_sidecar_send_appsec_message_without_reconnect,
+        "datadog_sidecar_send_appsec_message_without_reconnect");
     ASSIGN_DLSYM(_ddog_sidecar_appsec_response_drop,
         "ddog_sidecar_appsec_response_drop");
 }
@@ -395,10 +401,11 @@ uint64_t dd_trace_get_sidecar_queue_id(void)
 
 #ifdef ZTS
 ddog_AppsecCResponse dd_trace_send_appsec_message(uint64_t client_id,
-    void *nullable tsrm_ls, const uint8_t *nonnull request, size_t request_len)
+    void *nullable tsrm_ls, const uint8_t *nonnull request, size_t request_len,
+    bool reconnect_sidecar)
 #else
-ddog_AppsecCResponse dd_trace_send_appsec_message(
-    uint64_t client_id, const uint8_t *nonnull request, size_t request_len)
+ddog_AppsecCResponse dd_trace_send_appsec_message(uint64_t client_id,
+    const uint8_t *nonnull request, size_t request_len, bool reconnect_sidecar)
 #endif
 {
 #ifdef TESTING
@@ -412,6 +419,7 @@ ddog_AppsecCResponse dd_trace_send_appsec_message(
 #endif
 
     if (!_ddtrace_get_sidecar_transport || !_ddog_sidecar_send_appsec_message ||
+        !_datadog_sidecar_send_appsec_message_without_reconnect ||
         !_ddog_sidecar_appsec_response_drop) {
         mlog_once(dd_log_error,
             "Could not communicate with the helper. Some symbols are missing");
@@ -436,7 +444,11 @@ ddog_AppsecCResponse dd_trace_send_appsec_message(
         .len = request_len,
     };
 
-    return _ddog_sidecar_send_appsec_message(
+    if (reconnect_sidecar) {
+        return _ddog_sidecar_send_appsec_message(
+            &sidecar, client_id, request_slice);
+    }
+    return _datadog_sidecar_send_appsec_message_without_reconnect(
         &sidecar, client_id, request_slice);
 }
 

appsec/src/extension/ddtrace.h

@@ -68,12 +68,12 @@ zend_string *nullable dd_trace_get_formatted_runtime_id(bool persistent);
 uint64_t dd_trace_get_sidecar_queue_id(void);
 
 #ifdef ZTS
-ddog_AppsecCResponse dd_trace_send_appsec_message(
-    uint64_t client_id, void *nullable tsrm_ls,
-    const uint8_t *nonnull request, size_t request_len);
+ddog_AppsecCResponse dd_trace_send_appsec_message(uint64_t client_id,
+    void *nullable tsrm_ls, const uint8_t *nonnull request, size_t request_len,
+    bool reconnect_sidecar);
 #else
-ddog_AppsecCResponse dd_trace_send_appsec_message(
-    uint64_t client_id, const uint8_t *nonnull request, size_t request_len);
+ddog_AppsecCResponse dd_trace_send_appsec_message(uint64_t client_id,
+    const uint8_t *nonnull request, size_t request_len, bool reconnect_sidecar);
 #endif
 void dd_trace_free_appsec_message_response(ddog_AppsecCResponse response);
 

appsec/src/extension/network.c

@@ -37,7 +37,8 @@ void dd_conn_init(dd_conn *nonnull conn)
 }
 
 dd_result dd_conn_roundtrip(dd_conn *nonnull conn, char *nonnull request,
-    size_t request_len, dd_helper_response *nonnull response_out)
+    size_t request_len, bool reconnect_sidecar,
+    dd_helper_response *nonnull response_out)
 {
     if (conn == NULL) {
         return dd_error;
@@ -65,10 +66,11 @@ dd_result dd_conn_roundtrip(dd_conn *nonnull conn, char *nonnull request,
 #ifdef ZTS
     ddog_AppsecCResponse response =
         dd_trace_send_appsec_message(conn->client_id, DDAPPSEC_G(ts_ls_cache),
-            (const uint8_t *)request, request_len);
+            (const uint8_t *)request, request_len, reconnect_sidecar);
 #else
-    ddog_AppsecCResponse response = dd_trace_send_appsec_message(
-        conn->client_id, (const uint8_t *)request, request_len);
+    ddog_AppsecCResponse response =
+        dd_trace_send_appsec_message(conn->client_id, (const uint8_t *)request,
+            request_len, reconnect_sidecar);
 #endif
 
     dd_result ret;

appsec/src/extension/network.h

@@ -30,7 +30,8 @@ typedef struct _dd_helper_response {
 enum { DD_CONN_REQUEST_HEADER_SIZE = 8 };
 
 dd_result dd_conn_roundtrip(dd_conn *nonnull conn, char *nonnull request,
-    size_t request_len, dd_helper_response *nonnull response_out);
+    size_t request_len, bool reconnect_sidecar,
+    dd_helper_response *nonnull response_out);
 void dd_helper_response_destroy(dd_helper_response *nonnull response);
 
 // for helper_process

components-rs/common.h

@@ -1374,7 +1374,7 @@ typedef struct ddog_SenderParameters {
 } ddog_SenderParameters;
 
 /**
- * Raw AppSec response returned by `ddog_sidecar_send_appsec_message`.
+ * Raw AppSec response returned by the AppSec message functions.
  *
  * When `ptr` is non-null, the response must be freed by calling
  * `ddog_sidecar_appsec_response_drop`.

components-rs/datadog.h

@@ -271,6 +271,8 @@ bool datadog_sidecar_reconnect(struct ddog_SidecarTransport **transport,
 void datadog_sidecar_set_reconnect_fn(struct ddog_SidecarTransport **transport,
                                       struct ddog_SidecarTransport *(*factory)(void));
 
+void datadog_sidecar_clear_reconnect_fn(struct ddog_SidecarTransport **transport);
+
 bool ddog_shm_limiter_inc(const struct ddog_MaybeShmLimiter *limiter, uint32_t limit);
 
 bool ddog_exception_hash_limiter_inc(struct ddog_SidecarTransport *connection,

components-rs/libdatadog-php-unix.sym

@@ -1,4 +1,5 @@
 ddog_crashtracker_entry_point
 ddtrace_sidecar_entry_point
 ddog_sidecar_send_appsec_message
+datadog_sidecar_send_appsec_message_without_reconnect
 ddog_sidecar_appsec_response_drop

components-rs/sidecar.h

@@ -517,7 +517,19 @@ struct ddog_AppsecCResponse ddog_sidecar_send_appsec_message(struct ddog_Sidecar
                                                              ddog_CharSlice data);
 
 /**
- * Frees an `AppsecCResponse` that was returned by `ddog_sidecar_send_appsec_message`.
+ * Sends an AppSec message once, without reconnecting the sidecar on failure.
+ *
+ * The response is allocated by the sidecar and must be freed with
+ * `ddog_sidecar_appsec_response_drop` when the caller is done with it.
+ *
+ * Returns a zeroed `ddog_AppsecCResponse` (null ptr) on transport errors.
+ */
+struct ddog_AppsecCResponse datadog_sidecar_send_appsec_message_without_reconnect(struct ddog_SidecarTransport **transport,
+                                                                                  uint64_t client_id,
+                                                                                  ddog_CharSlice data);
+
+/**
+ * Frees an `AppsecCResponse` returned by an AppSec message function.
  */
 void ddog_sidecar_appsec_response_drop(struct ddog_AppsecCResponse response);
 

components-rs/sidecar.rs

@@ -285,6 +285,11 @@ pub extern "C" fn datadog_sidecar_set_reconnect_fn(
     transport.reconnect_fn = Some(Box::new(move || unsafe { factory() }));
 }
 
+#[no_mangle]
+pub extern "C" fn datadog_sidecar_clear_reconnect_fn(transport: &mut Box<SidecarTransport>) {
+    transport.reconnect_fn = None;
+}
+
 lazy_static! {
     pub static ref SHM_LIMITER: Option<ShmLimiterMemory<()>> =
         ShmLimiterMemory::open(&shm_limiter_path()).map_or_else(

ext/sidecar.c

@@ -549,8 +549,28 @@ void datadog_sidecar_handle_fork(void) {
 #endif
 }
 
+// Reconnect factory for subprocess mode: creates a fresh transport and immediately
+// re-registers per-request state (service tags, env, etc.) via dd_sidecar_on_reconnect,
+// which ddog_sidecar_connect_php alone would not do for a caller-initiated reconnect.
+static ddog_SidecarTransport *dd_sidecar_subprocess_reconnect(void) {
+    ddog_SidecarTransport *transport = datadog_sidecar_connect(false);
+    if (transport) {
+        dd_sidecar_on_reconnect(transport);
+    }
+    return transport;
+}
+
 void datadog_sidecar_ensure_active(void) {
     if (DATADOG_G(sidecar)) {
+        // Restore reconnect_fn cleared during the previous RSHUTDOWN so that automatic
+        // reconnects work again for this request.
+        if (datadog_sidecar_active_mode == DD_SIDECAR_CONNECTION_SUBPROCESS) {
+            // Subprocess mode: the reconnect_fn must call dd_sidecar_on_reconnect to
+            // re-register per-request universal service tags on the new transport.
+            datadog_sidecar_set_reconnect_fn(&DATADOG_G(sidecar), dd_sidecar_subprocess_reconnect);
+        } else {
+            datadog_sidecar_set_reconnect_fn(&DATADOG_G(sidecar), datadog_sidecar_connect_callback);
+        }
         datadog_sidecar_reconnect(&DATADOG_G(sidecar), datadog_sidecar_connect_callback);
     } else if (datadog_endpoint) {
         // First RINIT on this thread: the process-level setup already ran (endpoint is
@@ -567,6 +587,10 @@ void datadog_sidecar_finalize(bool clear_id) {
         return;
     }
 
+    // Prevent reconnect during shutdown: avoid spawning a new sidecar just to deliver
+    // goodbye messages. Reconnect is restored at the start of the next RINIT.
+    datadog_sidecar_clear_reconnect_fn(&DATADOG_G(sidecar));
+
     if (get_global_DD_INSTRUMENTATION_TELEMETRY_ENABLED()) {
         datadog_telemetry_finalize();
     }
@@ -583,6 +607,10 @@ void datadog_sidecar_finalize(bool clear_id) {
 }
 
 void datadog_sidecar_shutdown(void) {
+    // Prevent reconnect from firing during shutdown-phase sidecar calls.
+    if (DATADOG_G(sidecar)) {
+        datadog_sidecar_clear_reconnect_fn(&DATADOG_G(sidecar));
+    }
     datadog_sidecar_for_signal = NULL;
 
     // In thread mode, drop the main thread's connection before shutting down the
@@ -870,6 +898,8 @@ void datadog_sidecar_rshutdown(void) {
 
 void datadog_sidecar_gshutdown(zend_datadog_globals *datadog_globals) {
     if (datadog_globals->sidecar) {
+        datadog_sidecar_clear_reconnect_fn(&datadog_globals->sidecar);
+
         if (datadog_globals->sidecar == datadog_sidecar_for_signal) {
             datadog_sidecar_for_signal = NULL;
         }