@newrelic/security-agent 0.0.1

package/lib/nr-security-agent/lib/core/health-check.js

@@ -0,0 +1,159 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict';
+
+const { Agent } = require('./agent');
+const { JSON_NAME } = require('./sec-agent-constants');
+const { BasicInfo } = require('./event');
+
+const NODE_JS_LITERAL = 'Node.js:';
+
+let NODE_SERVER;
+let instance;
+let logger;
+const API = require('../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+
+/**
+ * Retruns an instance of HC.
+ * Creates one if not already created.
+ *
+ * @returns {HC} instance
+ */
+module.exports.getInstance = function () {
+    const agent = Agent.getAgent();
+    if (!instance) {
+        if (agent && !NODE_SERVER) {
+            NODE_SERVER = NODE_JS_LITERAL + agent.applicationInfo.binaryVersion;
+        }
+        instance = new HC(agent.applicationInfo);
+    }
+    return instance;
+};
+
+/**
+ * Creates a new HealthCheck object.
+ *
+ * @param {ApplicationInfo} info
+ */
+function HC (info) {
+    BasicInfo.call(this);
+
+    this.applicationUUID = info.applicationUUID;
+    this.eventType = 'sec_health_check_lc';
+    if (NRAgent && NRAgent.config) {
+        this.entityGuid = NRAgent.config.entity_guid;
+    }
+    this.protectedServer = NODE_SERVER;
+    this.eventDropCount = 0;
+    this.eventProcessed = 0;
+    this.eventSentCount = 0;
+    this.httpRequestCount = 0;
+    this.isHost = info.identifier.isHost;
+    this.collectorVersion = info.collectorVersion;
+    this.jsonVersion = info.jsonVersion;
+    this.buildNumber = info.buildNumber;
+    this.jsonName = JSON_NAME.HC;
+    this.pid = info.pid;
+
+
+
+    /**
+     * registers an event drop.
+     */
+    this.registerEventDrop = function () {
+        this.eventDropCount++;
+    };
+
+    /**
+     * mark application to be running on host.
+     */
+    this.markHost = function () {
+        this.isHost = true;
+    };
+
+    /**
+     * resets the drop count.
+     */
+    this.resetDropCount = function () {
+        this.eventDropCount = 0;
+    };
+
+    /**
+     * registers a processed event.
+     */
+    this.registerEventProcessed = function () {
+        this.eventProcessed++;
+    };
+
+    /**
+     * registers a processed event.
+     */
+    this.registerEventSent = function () {
+        this.eventSentCount++;
+    };
+
+    /**
+     * registers n processed event.
+     */
+    this.registerEventsSent = function (n) {
+        this.eventSentCount += n;
+    };
+    /**
+     * resets the processed count.
+     */
+    this.resetProcessedCount = function () {
+        this.eventProcessed = 0;
+    };
+
+    /**
+     * resets the Event sent count.
+     */
+    this.resetEventSentCount = function () {
+        this.eventSentCount = 0;
+    };
+
+    /**
+     * registers a http request count
+     */
+    this.registerHttpRequestCount = function () {
+        this.httpRequestCount++;
+    };
+
+    /**
+     * resets the Event sent count.
+     */
+    this.resetHttpRequestCount = function () {
+        this.httpRequestCount = 0;
+    };
+
+
+    /**
+     * sets gerate hc timestamp.
+     */
+    this.registerGenerateTime = function () {
+        this.timestamp = Date.now();
+    };
+
+    this.get = function () {
+        this.registerGenerateTime();
+        return JSON.stringify(this);
+    };
+}
+
+HC.prototype = Object.create(BasicInfo.prototype);
+HC.prototype.constructor = HC;
+
+
+/**
+ * Sets the logger instance.
+ *
+ * @param {*} loggerInstance
+ */
+module.exports.setLogger = loggerInstance => {
+    logger = loggerInstance;
+};
+

package/lib/nr-security-agent/lib/core/json-file-handler.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ *  Entity which manages the json file.
+ * 
+ * @param {String} file 
+ * @param {String} base Takes current directory if not specified.
+ */
+function JsonHandler(file, base = ".") {
+    if (this.prototype.constructor !== JsonHandler) {
+        return new JsonHandler(file, base);
+    }
+    this.fileName = base.concat(path.sep).concat(file);
+    path.normalize(this.fileName);
+    try {
+        const readJSON = fs.readFileSync(this.fileName, { encoding: 'utf8' });
+        this.json = JSON.parse(readJSON);
+        
+    } catch (err) {
+        throw err
+    }
+
+}
+JsonHandler.prototype = Object.create(JsonHandler);
+JsonHandler.prototype.constructor = JsonHandler;
+
+/**
+     * get JSON Object
+     */
+JsonHandler.prototype.getJSON = function () {
+    return this.json;
+}
+
+
+/**
+* Update Source file synchronously
+*/
+JsonHandler.prototype.updateFileSync = function () {
+    try {
+        fs.writeFileSync(this.fileName, JSON.stringify(this.json, null, 2), { encoding: 'utf8' })
+    } catch (err) {
+        throw err
+    }
+}
+/**
+     * Update Source file asynchronously
+     */
+JsonHandler.prototype.updateFileAsync = function () {
+    fs.writeFile(this.fileName, JSON.stringify(this.json, null, 2), { encoding: 'utf8' }, function (err) {
+        if (err) {
+            throw err
+        }
+    })
+
+}
+
+
+module.exports = {
+    JsonHandler
+}

package/lib/nr-security-agent/lib/core/jsonValidator.js

@@ -0,0 +1,149 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const Validator = require('jsonschema').Validator;
+const v = new Validator();
+const schema = {
+    title: 'LCPolicy',
+    description: 'A policy for language collectors',
+    type: 'object',
+    properties: {
+        version: {
+            type: 'string',
+            minLength: 1
+        },
+        policyPull: {
+            type: 'boolean'
+        },
+        policyPullInterval: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 2678400
+        },
+        vulnerabilityScan: {
+            type: 'object',
+            properties: {
+                enabled: {
+                    type: 'boolean'
+                },
+                iastScan: {
+                    type: 'object',
+                    properties: {
+                        enabled: {
+                            type: 'boolean'
+                        },
+                        probing: {
+                            type: 'object',
+                            properties: {
+                                interval: {
+                                    type: 'integer',
+                                    minimum: 1,
+                                    maximum: 60
+                                },
+                                batchSize: {
+                                    type: 'integer',
+                                    minimum: 1,
+                                    maximum: 300
+                                }
+                            },
+                            required: [
+                                'interval',
+                                'batchSize'
+                            ]
+                        }
+                    },
+                    required: [
+                        'enabled',
+                        'probing'
+                    ]
+                }
+            },
+            required: [
+                'enabled',
+                'iastScan'
+            ]
+        },
+        protectionMode: {
+            type: 'object',
+            properties: {
+                enabled: {
+                    type: 'boolean'
+                },
+                ipBlocking: {
+                    type: 'object',
+                    properties: {
+                        enabled: {
+                            type: 'boolean'
+                        },
+                        attackerIpBlocking: {
+                            type: 'boolean'
+                        },
+                        ipDetectViaXFF: {
+                            type: 'boolean'
+                        }
+                    },
+                    required: [
+                        'enabled',
+                        'attackerIpBlocking',
+                        'ipDetectViaXFF'
+                    ]
+                },
+                apiBlocking: {
+                    type: 'object',
+                    properties: {
+                        enabled: {
+                            type: 'boolean'
+                        },
+                        protectAllApis: {
+                            type: 'boolean'
+                        },
+                        protectKnownVulnerableApis: {
+                            type: 'boolean'
+                        },
+                        protectAttackedApis: {
+                            type: 'boolean'
+                        }
+                    },
+                    required: [
+                        'enabled',
+                        'protectAllApis',
+                        'protectKnownVulnerableApis',
+                        'protectAttackedApis'
+                    ]
+                }
+            },
+            required: [
+                'enabled',
+                'ipBlocking',
+                'apiBlocking'
+            ]
+        },
+        sendCompleteStackTrace: {
+            type: 'boolean'
+        },
+        enableHTTPRequestPrinting: {
+            type: 'boolean'
+        }
+    },
+    required: [
+        'version',
+        'policyPull',
+        'policyPullInterval',
+        'vulnerabilityScan',
+        'protectionMode',
+        'sendCompleteStackTrace',
+        'enableHTTPRequestPrinting'
+    ]
+};
+
+function validate (data) {
+    const result = v.validate(data, schema);
+    return result;
+}
+
+
+module.exports = {
+    validate
+};

package/lib/nr-security-agent/lib/core/lambda-delegated-task-service.js

@@ -0,0 +1,90 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const { Agent } = require('./agent');
+const { AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('./sec-agent-constants');
+const { invokeLambda } = require('./connections/aws-lambda-client');
+const {
+    LambdaDelegatedTaskType,
+    LambdaDelegatedTaskBase,
+    LambdaDelegatedTaskShaCalculation,
+    CONST
+} = require('../models/lambda-delegated-task');
+
+const CSEC_TASK_PAYLOAD_IDENTIFIER = 'CSEC_TASK_PAYLOAD';
+
+let instance;
+function LambdaDelegatedTaskService () {}
+
+LambdaDelegatedTaskService.prototype = Object.create(null);
+LambdaDelegatedTaskService.prototype.constructor = LambdaDelegatedTaskService;
+
+/**
+ * generates a lambda delegated task object
+ * @param {LambdaDelegatedTaskType} type
+ * @param  {...any} args
+ * @returns {LambdaDelegatedTaskBase} obj
+ */
+LambdaDelegatedTaskService.prototype.generateHandler = function generateHandler (type, ...args) {
+    switch (type) {
+    case LambdaDelegatedTaskType.SHA_CALCULATION:
+        return new LambdaDelegatedTaskShaCalculation(type, ...args);
+    default:
+        return new LambdaDelegatedTaskBase(type, ...args);
+    }
+};
+
+/**
+ * Detectects if the lambda event contains a delegated task
+ * payload.
+ * @param {JSON} event
+ * @returns {LambdaDelegatedTaskBase} obj
+ */
+LambdaDelegatedTaskService.prototype.detectInEvent = function detectInEvent (event) {
+    if (event && event[CSEC_TASK_PAYLOAD_IDENTIFIER]) {
+        const { type, args } = event[CSEC_TASK_PAYLOAD_IDENTIFIER];
+        if (!Array.isArray(args)) return undefined;
+
+        return this.generateHandler(type, ...args);
+    }
+    return undefined;
+};
+
+/**
+ * invokes current lambda function with passed lambda
+ * delegated task object as the payload.
+ * @param {LambdaDelegatedTaskBase} lambdaDelegatedTaskObject
+ */
+LambdaDelegatedTaskService.prototype.delegate = function delegate (lambdaDelegatedTaskObject) {
+    const payload = lambdaDelegatedTaskObject.addToPayload();
+    const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
+    const splitArn = String.prototype.split.call(qualifiedARN, ':');
+    const arn = splitArn.slice(0, splitArn.length - 1).join(':');
+    const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
+    invokeLambda(arn, ver, payload);
+};
+
+/**
+ * Returns a singleton instance of LambdaDelegatedTaskService
+ * @returns {LambdaDelegatedTaskService} instance
+ */
+LambdaDelegatedTaskService.getInstance = function () {
+    return instance || LambdaDelegatedTaskService.createInstance();
+};
+
+/**
+ * Creates and returns a new instance of LambdaDelegatedTaskService
+ * @returns {LambdaDelegatedTaskService} instance
+ */
+LambdaDelegatedTaskService.createInstance = function () {
+    instance = new LambdaDelegatedTaskService();
+    return instance;
+};
+
+module.exports = {
+    LambdaDelegatedTaskService,
+    LambdaDelegatedTaskType,
+    CONST
+};

package/lib/nr-security-agent/lib/core/logging.js

@@ -0,0 +1,176 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+
+const log4js = require('log4js');
+const { ENV: env } = require('../../resources/config');
+const cp = require('child_process');
+
+const INFO = 'info';
+const LOG_FILE_SIZE = 50485760 * 10000;
+const LOG_PATTERN_OBJ = {
+    type: 'pattern',
+    pattern: '%[%d[%p][%c][%h][%z]%] %m'
+};
+const { LOG_MESSAGES, LOG_DIR } = require('./sec-agent-constants');
+let logger;
+const API = require('../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+
+function createLogPathIfNotExist (dir) {
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    } catch (error) {
+    }
+}
+
+/**
+ * Initializes the logger appenders.
+ * @param {v4uuid} applicationUUID
+ */
+function initialize (applicationUUID) {
+    const appenders = {};
+    appenders.NR_CSEC = {
+        type: 'file',
+        compress: false,
+        layout: LOG_PATTERN_OBJ
+    };
+    appenders.NR_CSEC_INIT = {
+        type: 'file',
+        compress: false,
+        layout: LOG_PATTERN_OBJ
+    };
+
+    const logLevel = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.level : 'info'; 
+
+    try {
+        if (!fs.existsSync(LOG_DIR)) {
+            createLogPathIfNotExist(LOG_DIR);
+        }
+    } catch (error) {
+    }
+
+    const logFileName = `${LOG_DIR}node-security-collector.log`;
+    const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
+
+    Object.assign(appenders.NR_CSEC, {
+        filename: logFileName,
+        maxLogSize: LOG_FILE_SIZE,
+        backups: 0
+    });
+
+    Object.assign(appenders.NR_CSEC_INIT, {
+        filename: initLogFileName,
+        maxLogSize: LOG_FILE_SIZE,
+        backups: 0
+    });
+
+    const categories = {
+        default: {
+            appenders: [
+                'NR_CSEC'
+            ],
+            level: logLevel
+        },
+        NR_CSEC_INIT: {
+            appenders: [
+                'NR_CSEC_INIT',
+                'NR_CSEC'
+            ],
+            level: logLevel
+        },
+    };
+
+    if (env === 'dev' || env === 'trace') {
+        appenders.STDOUT = {
+            type: 'stdout',
+            layout: LOG_PATTERN_OBJ
+        };
+        categories.default.appenders.push('STDOUT');
+        categories.NR_CSEC_INIT.appenders.push('STDOUT');
+    }
+
+    log4js.configure({
+        appenders: appenders,
+        categories: categories,
+        disableClustering: true
+    });
+    process.env.loglevel = logLevel;
+}
+
+/**
+ * sets the logging level of current instance.
+ * @param {String} level
+ */
+function setLevel (level = INFO) {
+    level = level.trim();
+    if (logger) {
+        logger.level = level;
+    } else {
+        throw new Error('CSEC-Loggers Not yet Initialized!');
+    }
+}
+
+/**
+ * get the logging level of current instance.
+ */
+function getLevel () {
+    if (logger) {
+        return logger.level;
+    } else {
+        throw new Error('CSEC-Loggers Not yet Initialized!');
+    }
+}
+
+/**
+ * Returns an instance of Loggers.
+ * Initializes an instace if not instance is
+ * already made.
+ * @param {v4uuid} applicationUUID
+ */
+function getLogger (applicationUUID = process.env.applicationUUID) {
+    if (logger) {
+        return logger;
+    }
+    if (applicationUUID) {
+        initialize(applicationUUID);
+        logger = log4js.getLogger('NR_CSEC');
+        const initLogger = getInitLogger();
+        if (NRAgent) {
+            setLevel(NRAgent.config.logging.level);
+        }
+
+        return logger;
+    } else {
+        throw new Error('applicationUUID is required to initialize loggers.');
+    }
+}
+
+function reCreateLogger (applicationUUID) {
+    initialize(applicationUUID);
+    logger = log4js.getLogger('NR_CSEC');
+    setLevel(logger.level);
+    updateModuleLoggers(logger);
+}
+
+function getInitLogger () {
+    const initLogger = log4js.getLogger('NR_CSEC_INIT');
+    return initLogger;
+}
+
+
+
+module.exports = {
+    getLogger,
+    setLevel,
+    getLevel,
+    getInitLogger,
+    reCreateLogger
+};