@newrelic/security-agent 0.0.1

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -0,0 +1,171 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* eslint-disable no-unused-vars */
+const stringify = require('fast-safe-stringify');
+
+const restClient = require('../../restclient');
+const { Agent } = require('../../../agent');
+const { FuzzFailEvent } = require('../../../FuzzFailEvent');
+const { hasWorker: isWorkerSupported } = require('../../../commonUtils');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID } = require('../../../sec-agent-constants');
+const LOCALHOST = '127.0.0.1';
+const COLON_SLASH_SLASH = '://';
+const http = require('http');
+const https = require('https');
+
+const {
+    IS_LAMBDA_ENV,
+    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER,
+    CSEC_LAST_FUZZ_REQUEST_TIME
+} = require('../../../sec-agent-constants');
+const statusUtils = require('../../../statusUtils');
+
+const find = '/{{NR_CSEC_VALIDATOR_HOME_TMP}}';
+const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
+
+let logger;
+let lastFuzzEventTime = 0;
+
+// handler function to parse fuzz event and prepare fuzz request
+function handler (json) {
+    setLastFuzzEnventTime();
+    let rawFuzzRequest = json.arguments[0];
+    logger.debug('Fuzz request received::' + rawFuzzRequest);
+    rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
+    let fuzzRequest;
+    try {
+        fuzzRequest = JSON.parse(rawFuzzRequest);
+    } catch (error) {
+        logger.error('Parsing exeception in fuzz request: ', error);
+    }
+    if (!fuzzRequest) {
+        return;
+    }
+
+    logger.info('Fuzz request:: Method: ' + fuzzRequest.method);
+    logger.info('Fuzz request:: Headers: ' + stringify(fuzzRequest.headers));
+    logger.info('Fuzz request:: Data: ' + fuzzRequest.body);
+
+    const fuzzDetails = { fuzzRequest, rawFuzzRequest };
+    lastFuzzEventTime = Date.now();
+    handleFuzzRequest(fuzzDetails);
+};
+
+/**
+ * Handles the fuzz request logic after
+ * initial parsing
+ *
+ * @param {Object} fuzzDetails
+ */
+function handleFuzzRequest (fuzzDetails) {
+    const { fuzzRequest } = fuzzDetails;
+    try {
+        if (IS_LAMBDA_ENV) {
+            const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
+            const splitArn = String.prototype.split.call(qualifiedARN, ':');
+            const arn = splitArn.slice(0, splitArn.length - 1).join(':');
+            const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
+            logger.info('Invoking Lambda:: ARN: ' + arn);
+            logger.info('Invoking Lambda:: Version: ' + ver);
+            
+        } else {
+            const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
+            const type = config.headers['content-type'];
+            if (type) {
+                const splitted = type.split(';');
+                if (splitted[0]) {
+                    config.headers['content-type'] = splitted[0];
+                }
+            }
+            logger.info('Firing http request:: URL: ' + config.url);
+
+            const request = restClient.fireRequest(config);
+            handleFuzzResponse(request, fuzzDetails);
+        }
+    } catch (err) {
+        statusUtils.addErrortoBuffer(err);
+        const fuzzFailEvent = new FuzzFailEvent(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]);
+        logger.error(stringify(fuzzFailEvent));
+        try {
+            Agent.getAgent().client.dispatcher(fuzzFailEvent);
+        } catch (error) {
+            logger.debug('Error in sending fuzz request:', error.stack);
+        }
+    }
+}
+
+/**
+ * Handles the fuzz response Promise.
+ *
+ * @param {Promise} request
+ * @param {Object} fuzzDetails
+ */
+function handleFuzzResponse (request, fuzzDetails) {
+    const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
+    if (request) {
+        request.then(() => {
+            logger.info('Fuzz success: ' + rawFuzzRequest);
+        }).catch(() => {
+            logger.debug('Error occured:', fuzzRequest.url, fuzzRequest);
+        });
+    }
+}
+
+/**
+ * Parses the passed fuzz request object to
+ * Axios config.
+ *
+ * @param {JSON} requestObject
+ */
+function parseAxiosHttpRequestToFuzz (requestObject) {
+    const serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
+    return {
+        url: requestObject.protocol + COLON_SLASH_SLASH + serverName + COLON + requestObject.serverPort + requestObject.url,
+        method: requestObject.method,
+        data: requestObject.body,
+        headers: requestObject.headers,
+        timeout: 5000,
+        httpAgent: new http.Agent({ keepAlive: true }),
+        httpsAgent: new https.Agent({ keepAlive: true, rejectUnauthorized: false })
+    };
+}
+
+
+
+/**
+ * set the handler logger
+ * @param {*} l
+ */
+function setLogger (l) {
+    logger = l;
+};
+
+/**
+ * Sets the last fuzz event time epoch
+ * @param {Number} time
+ */
+function setLastFuzzEnventTime (time = Date.now()) {
+    if (isWorkerSupported()) {
+        process.env[CSEC_LAST_FUZZ_REQUEST_TIME] = time;
+    } else {
+        lastFuzzEventTime = time;
+    }
+}
+
+/**
+ * Returns last fuzz event time epoch
+ * @returns {Number} lastFuzzEventTime
+ */
+function getLastFuzzEnventTime () {
+    return isWorkerSupported() ? Number.parseInt(process.env[CSEC_LAST_FUZZ_REQUEST_TIME]) : lastFuzzEventTime;
+}
+
+module.exports = {
+    handler,
+    setLogger,
+    setLastFuzzEnventTime,
+    getLastFuzzEnventTime
+};

package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const _ = require('lodash');
+
+const { SERVER_COMMAND } = require('../../../sec-agent-constants');
+const UnsupportedAgentHandler = require('./unsupported-agent-handler');
+const StartupHandshakeHandler = require('./startup-handshake-handler');
+const FuzzRequestHandler = require('./fuzz-request-handler');
+const CollectorPolicyHandler = require('./collector-policy-handler');
+const CollectorPolicyErrorHandler = require('./collecotor-policy-error-handler');
+const NoOpHandler = require('./no-op-handler');
+const WSReconnect = require('./ws-reconnect');
+
+const commandHandlerMap = {
+    [SERVER_COMMAND.STARTUP_WELCOME_MSG]: StartupHandshakeHandler,
+    [SERVER_COMMAND.UNSUPPORTED_AGENT]: UnsupportedAgentHandler,
+    [SERVER_COMMAND.FUZZ_REQUEST]: FuzzRequestHandler,
+    [SERVER_COMMAND.COLLECTOR_CONFIG]: CollectorPolicyHandler,
+    [SERVER_COMMAND.POLICY_ERROR]: CollectorPolicyErrorHandler,
+    [SERVER_COMMAND.OBEY_WS_RECONNECT]: WSReconnect
+};
+
+const handle = function handle (json) {
+    if (json && json.controlCommand && json.arguments && commandHandlerMap[json.controlCommand]) {
+        commandHandlerMap[json.controlCommand].handler.call(this, json);
+    } else {
+        NoOpHandler.handler.call(this, json);
+    }
+};
+
+const setLogger = function setLogger (logger) {
+    _.forEach(commandHandlerMap, (handler) => {
+        handler.setLogger(logger);
+    });
+    NoOpHandler.setLogger(logger);
+};
+
+module.exports = {
+    StartupHandshakeHandler,
+    FuzzRequestHandler,
+    UnsupportedAgentHandler,
+    handle,
+    setLogger
+};

package/lib/nr-security-agent/lib/core/connections/websocket/response/no-op-handler.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+let logger;
+
+module.exports.handler = function handler (json) {
+    logger.error('unsupported control command received:', json);
+};
+
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const StartupConfig = require('../../../startup-config');
+const logs = require('../../../logging');
+let logger = logs.getLogger();
+const initLogger = logs.getInitLogger();
+const LOG_MESSAGES = require('../../../sec-agent-constants').LOG_MESSAGES;
+const applicationInfoModule = require('../../../applicationinfo');
+
+module.exports.handler = function handler(json) {
+    try {
+        const startupConfig = StartupConfig.getInstance();
+        startupConfig.config = json.data;
+      
+        initLogger.info(LOG_MESSAGES.COLLECTOR_INIT_WITH_PROP, JSON.stringify(startupConfig.config));
+        initLogger.info('Collector is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
+
+    } catch (error) {
+        logger.error(LOG_MESSAGES.PARSING_EXP_WELCOME_MSG, error);
+    }
+};
+
+// eslint-disable-next-line no-unused-vars
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/unsupported-agent-handler.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const agentStatus = require('../../../agent-status');
+
+let logger;
+module.exports.handler = function handler (json) {
+    const message = json.arguments[0];
+    logger.error(message);
+    const status = agentStatus.getInstance();
+    const statusCode = 'DISABLED';
+    status.setStatus(agentStatus.CSECAgentStatus.codes[statusCode]);
+};
+
+// eslint-disable-next-line no-unused-vars
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/ws-reconnect.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+let logger;
+module.exports.handler = function handler (json) {
+    logger.info('WS reconnect received', json);
+    const { Agent } = require('../../../agent');
+    const wsClient = Agent.getAgent().client;
+    wsClient.obeyReconnect();
+};
+
+module.exports.setLogger = l => { logger = l };