@newrelic/security-agent 0.0.1

package/lib/nr-security-agent/lib/core/startup-config.js

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+let startupConfig = undefined;
+function StartupConfig(){
+    
+}
+StartupConfig.prototype.constructor = StartupConfig;
+
+/**
+ * Returns the current instanceof CollectorConfig,
+ * creates one if not already created.
+ * 
+ * @returns {StartupConfig} instance
+ */
+function getInstance() {
+    if (!startupConfig) {
+        startupConfig = new StartupConfig();
+        startupConfig.config = {};
+        
+    }
+    return startupConfig;
+}
+
+module.exports = {
+    getInstance
+};

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -0,0 +1,157 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* eslint-disable new-cap */
+
+const njsAgentConstants = require('./sec-agent-constants');
+const path = require('path').resolve(__dirname, '../../');
+const lodash = require('lodash');
+
+let errors = [];
+
+const ringBuffer = require('ringbufferjs');
+const bufferedHC = new ringBuffer(5);
+const bufferedErrors = new ringBuffer(5);
+const fs = require('fs');
+const util = require('util');
+let HC = [];
+let lastHC = {};
+const logs = require('./logging');
+const commonUtils = require('./commonUtils');
+const logger = logs.getLogger();
+const statusFile = njsAgentConstants.STATUS_LOG_FILE;
+
+const statusTemplate = 'Snapshot timestamp: : %s\n' +
+`CSEC Agent start timestamp: ${njsAgentConstants.AGENT_START_TIME} with application uuid:${commonUtils.getUUID()}\n` +
+`SEC_HOME: ${njsAgentConstants.CSEC_HOME}\n` +
+`Agent location: ${path}\n` +
+`Using CSEC Agent for Node.js, Node version:${process.version}, PID:${process.pid}\n` +
+`Process title: ${process.title}\n` +
+`Process binary: ${process.execPath}\n` +
+'Application location: %s\n' +
+`Current working directory: ${process.cwd()}\n` +
+`Agent mode: ${commonUtils.getCSECmode()}\n` +
+'Application server: %s\n' +
+'Application Framework: %s\n' +
+`Websocket connection to Prevent Web: ${commonUtils.getValidatorServiceEndpointURL()}, Status: %s\n` +
+'Instrumentation successful:\n' +
+'Tracking loaded modules in the application:\n' +
+'Policy applied successfully. Policy version is: %s\n' +
+'Started Health Check for Agent\n' +
+'Started Inbound and Outbound monitoring \n' +
+'\nProcess stats:\n%s\n' +
+'\nService stats:\n%s\n' +
+'\nLast 5 errors: \n%s\n' +
+'\nLast 5 Health Checks are:\n %s \n';
+
+/**
+ * Utility to add hc in hc buffer
+ * @param {*} healthCheck
+ */
+function addHCtoBuffer (healthCheck) {
+    try {
+        bufferedHC.enq(healthCheck);
+        lastHC = healthCheck;
+    } catch (error) {
+        logger.debug(error);
+    }
+}
+
+/**
+ * Utility to add error object in error buffer
+ * @param {*} error
+ */
+function addErrortoBuffer (error) {
+    try {
+        bufferedErrors.enq(error);
+    } catch (error) {
+        logger.debug(error);
+    }
+}
+
+/**
+ * utility to format status template with dynamic values
+ */
+function getFormattedData () {
+    const Agent = require('./agent').Agent.getAgent();
+    const appInfo = Agent.applicationInfo;
+    const deployedApplications = appInfo && appInfo.serverInfo && appInfo.serverInfo.deployedApplications;
+    const appLoc = deployedApplications[0].deployedPath;
+    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK, process.env.WS_HEALTH, appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
+    return formattedSnapshot;
+}
+
+/**
+ * utility to write snapshot in snapshot file
+ */
+function writeSnapshot () {
+    const snapshot = getFormattedData();
+    commonUtils.removeOlderSnapshots();
+    fs.writeFile(statusFile, snapshot, { mode: 0o777 }, function (err) {
+        if (err) {
+            logger.error(err);
+        } else {
+            logger.info('Snapshot updated to file: %s', statusFile);
+            fs.chmod(statusFile, 0o777, (err) => {
+                if (err) {
+                    addErrortoBuffer(err);
+                }
+            });
+        }
+    });
+}
+/**
+ * return buffered error instance.
+ */
+function getRingBufferedErrors () {
+    return bufferedErrors;
+}
+
+/**
+ * return buffered HC list without null, undefined
+ */
+function getBufferedHC () {
+    try {
+        HC = lodash.compact(bufferedHC._elements);
+    } catch (error) {
+        logger.debug(error);
+    }
+
+    return HC;
+}
+/**
+ * returns buffered error list without null, undefined
+ */
+function getBufferedErrors () {
+    try {
+        errors = lodash.compact(bufferedErrors._elements);
+    } catch (error) {
+        logger.debug(error);
+    }
+    return errors;
+}
+
+/**
+ * Utility to get key val pairs from json object
+ * @param {*} jsonObject
+ */
+function getKeyValPairs (jsonObject) {
+    let statStr = njsAgentConstants.EMPTY_STR;
+    for (const key in jsonObject) {
+        statStr = statStr + key + ': ' + jsonObject[key] + '\n';
+    }
+    return statStr;
+}
+
+module.exports = {
+    statusTemplate,
+    addHCtoBuffer,
+    getFormattedData,
+    writeSnapshot,
+    addErrortoBuffer,
+    getRingBufferedErrors,
+    getBufferedHC,
+    getBufferedErrors
+};

package/lib/nr-security-agent/lib/core/timeunit.js

@@ -0,0 +1,44 @@
+
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+/**
+ * Creates TimeUnit Instance with milliseconds
+ * as the base unit. 
+ */
+function TimeUnit() {
+    this.MILLISECONDS = 1;
+    this.NANOSECONDS = 0.000001
+    this.MICROSECONDS = 0.001;
+    this.SECONDS = 1000;
+    this.MINUTES = 60000;
+    this.HOURS = 3600000;
+    this.DAY = 86400000;
+
+    /**
+     * converts time value from given unit.
+     * 
+     * @param {Number} value
+     * @param {String} timeunit
+     * 
+     * @returns milliseconds
+     * 
+     */
+    this.getMillis = function (value, unit, valueOnFail) {
+        const UNIT = unit.toString().toUpperCase();
+        if (this[UNIT]) {
+            try {
+                return value * this[UNIT];
+            } catch (e) {
+
+            }
+        }
+        return valueOnFail;
+    }
+}
+
+module.exports = new TimeUnit();
+

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -0,0 +1,335 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict';
+const path = require('path');
+const RingBuffer = require('ringbufferjs');
+const LOG_MESSAGES = require('./sec-agent-constants').LOG_MESSAGES;
+
+const { Agent } = require('./agent');
+const AgentStatus = require('./agent-status');
+const hc = require('./health-check');
+const applicationInfo = require('./applicationinfo').getInstance();
+const logger = require('./logging').getLogger(applicationInfo.applicationUUID);
+const initLogger = require('./logging').getInitLogger();
+const { WorkerMessage, WORKER_STATUS } = require('./worker-entities');
+const commonUtils = require('./commonUtils');
+const API = require('../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+const {
+    SecWebSocket,
+    setWebSocketConn,
+    aquireWebSocket,
+    ResponseHandler: {
+        handle: handleServerResponse,
+        setLogger: setResponseHandlerLogger
+    }
+} = require('./connections/websocket');
+const { HC_INTERVAL_MS } = require('../../resources/config');
+const { IS_LAMBDA_ENV, LAMBDA_ENABLE_RESPONSE_BLOCKING, LOG_DIR } = require('./sec-agent-constants');
+const statusUtils = require('./statusUtils');
+const njsAgentConstants = require('./sec-agent-constants');
+
+const MAX_BUSY_WAIT_TIME = 5000; // ms
+const workerSupported = commonUtils.hasWorker();;
+const filePath = path.join(__dirname, 'worker.js');
+const localQueue = new RingBuffer(1000);
+
+let busy = false;
+let wsWorker;
+let wsInstance;
+let dispatcher;
+
+const DEFAULT_EVENT_SEND_CB = err => {
+    if (err) {
+        hc.getInstance().registerEventDrop();
+        logger.debug(err);
+    }
+};
+
+/**
+ * Initializes the Websocket connection to Validator.
+ */
+const initialize = function () {
+    // we would want that the websocket be
+    // initialized once only. All ws reconnection
+    // and recovery mechanisms must be handled by
+    // the SecWebSocket internally.
+    if (dispatcher) {
+        logger.warn("Websocket must be initialized only once");
+        obeyReconnect();
+        return;
+    }
+
+    setResponseHandlerLogger(logger);
+
+    if (workerSupported) {
+        initiateInWorkerThread();
+    } else {
+        initializeInMainThread();
+    }
+    // we'll dispatch the application info if it is updated
+    Agent.eventEmitter.on(Agent.EVENTS.APPLICATION_INFO_UPDATE_EVENT, (applicationInfo) => {
+        if (!NRAgent || (NRAgent && applicationInfo.entityGuid)) {
+            dispatcher(applicationInfo);
+        }
+    });
+    Agent.eventEmitter.on(Agent.EVENTS.RECONNECT_WS_EVENT, () => {
+        setWebSocketConn();
+        if (workerSupported) {
+            const reConnectMsg = new WorkerMessage(WorkerMessage.TYPE.RECONNECT, {});
+            wsWorker.postMessage(reConnectMsg);
+        } else {
+            wsInstance.reconnect();
+        }
+    });
+    // Initiate HC send routine in the provided hcInterval.
+    initLogger.info(LOG_MESSAGES.SCHED_SERVICE_START);
+    initLogger.info(LOG_MESSAGES.START_HC);
+
+    setTimeout(() => {
+        setInterval(sendHC, HC_INTERVAL_MS);
+        initLogger.info(LOG_MESSAGES.END_HC);
+        sendHC();
+    }, 30000);
+
+    setInterval(commonUtils.logRollOver, 30000);
+};
+
+/**
+ * This initiates the ws in main thread
+ */
+function initializeInMainThread() {
+    logger.info(LOG_MESSAGES.NODE_VERSION_MSG, process.version);
+    if (!wsInstance) {
+        const validatorService = commonUtils.getValidatorServiceEndpointURL();
+        wsInstance = new SecWebSocket(validatorService, {}, logger);
+        dispatcher = function dispatcher(message) {
+            wsInstance.dispatch(message);
+        };
+
+        // Setup the event listeners
+        wsInstance.event.on(SecWebSocket.Events.BUSY, function () {
+            busy = true;
+        });
+        wsInstance.event.on(SecWebSocket.Events.INACTIVE, function () {
+            busy = false;
+        });
+    } else {
+        return wsInstance;
+    }
+}
+
+/**
+ * This initiates the ws in worker thread
+ */
+function initiateInWorkerThread() {
+    if (workerSupported) {
+        process.env.WS_WORKER_STATUS = WORKER_STATUS.INITIALIZING;
+        try {
+            setWebSocketConn();
+            const { Worker, SHARE_ENV } = require('worker_threads');
+            wsWorker = new Worker(filePath, {
+                workerData: {
+                    applicationInfo
+                },
+                env: SHARE_ENV
+            });
+            wsWorker.on('message', handleWorkerMessage);
+            wsWorker.on('error', (err) => {
+                logger.error('Exception in web socket worker:', err.message);
+                wsWorker = new Worker(filePath, {
+                    workerData: {
+                        applicationInfo
+                    }, env: SHARE_ENV
+                });
+            });
+            dispatcher = function dispatcher(message) {
+                if (process.env.WS_WORKER_STATUS !== WORKER_STATUS.RUNNING) {
+                    localQueue.enq(message);
+                    return;
+                }
+                // websocket is aquired here and then
+                // released in worker thread when the
+                // handoff to websocket is confirmed
+                aquireWebSocket();
+                const msg = new WorkerMessage(WorkerMessage.TYPE.MESSAGE, message);
+                wsWorker.postMessage(msg);
+            };
+            logger.info(LOG_MESSAGES.NODE_VERSION_MSG_WORKER, process.version);
+        } catch (error) {
+            logger.debug('error is:', error);
+        }
+    }
+}
+
+/**
+ * This handles any messages received from worker
+ * if websocket worker is initialized
+ *
+ * @param {JSON} json
+ */
+function handleWorkerMessage(json) {
+    const msg = WorkerMessage.parseFromObject(json);
+    switch (msg.type) {
+        case WorkerMessage.TYPE.MESSAGE: {
+            logger.debug(LOG_MESSAGES.MSG_FROM_WORKKER, msg.getPayload());
+            handleServerResponse(msg.getPayload());
+            break;
+        }
+        case WorkerMessage.TYPE.FLUSH: {
+            const { status } = msg.getPayload();
+            if (status === 'flushed') {
+                logger.debug('Message from worker thread: Flush Completed');
+            }
+            break;
+        }
+        case WorkerMessage.TYPE.IC_READY_FOR_EVENTS: {
+            break;
+        }
+        case WorkerMessage.TYPE.BUSY: {
+            busy = true;
+            break;
+        }
+        case WorkerMessage.TYPE.INACTIVE: {
+            busy = false;
+            break;
+        }
+        case WorkerMessage.TYPE.ERROR: {
+            statusUtils.addErrortoBuffer(msg.getPayload().stack);
+            break;
+        }
+        default:
+    }
+}
+
+/**
+ * Sends Agent HelthCheck to Validator.
+ */
+const sendHC = async function () {
+    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true)) {
+        let json = hc.getInstance().get();
+        json = JSON.parse(json);
+        json.policyVersion = applicationInfo.policyVersion;
+        json.entityGuid = applicationInfo.entityGuid;
+        try {
+            json.stats = await commonUtils.getHCStats();
+        } catch (error) {
+            logger.error(error);
+        }
+
+        json.serviceStatus = {};
+        json.serviceStatus.websocket = process.env.WS_HEALTH;
+        json.serviceStatus.logWriter = await commonUtils.isLogAccessible(`${LOG_DIR}node-security-collector.log`);
+        json.serviceStatus.initLogWriter = await commonUtils.isLogAccessible(`${LOG_DIR}node-security-collector-init.log`);
+        json.serviceStatus.statusLogWriter = await commonUtils.isLogAccessible(njsAgentConstants.STATUS_LOG_FILE);
+        json.serviceStatus.agentActiveStat = commonUtils.isAgentActiveState();
+        json.serviceStatus.iastRestClient = commonUtils.iastRestClientStatus();
+
+        hc.getInstance().resetDropCount();
+        hc.getInstance().resetProcessedCount();
+        hc.getInstance().resetEventSentCount();
+        hc.getInstance().resetHttpRequestCount();
+
+        logger.info('Health Check Status:', JSON.stringify(json));
+        statusUtils.addHCtoBuffer(json);
+        statusUtils.writeSnapshot();
+        getDispatcherAndSendEvent(json);
+    }
+};
+
+/**
+ * Will send event asyncronously.
+ *
+ * @param {JSON} eventJson
+ */
+function getDispatcherAndSendEvent(eventJson) {
+    const eventType = eventJson.jsonName;
+    if(eventType==='Event'){
+        hc.getInstance().registerEventProcessed();
+    }
+   
+    dispatcher(eventJson);
+
+    if(eventType==='Event'){
+        hc.getInstance().registerEventSent();
+    }
+
+}
+
+/**
+ * Sends passed Event to Validator.
+ *
+ * @param {Event} event
+ * @param {Function} callback (optional)
+ */
+function sendEvent(event, callback = DEFAULT_EVENT_SEND_CB) {
+    dispatcher(event);
+    callback();
+};
+
+/**
+ * Flushes local queue to the worker
+ */
+function flushLocalQueue() {
+    if (!workerSupported) return;
+
+    while (!localQueue.isEmpty()) {
+        dispatcher(localQueue.deq());
+    }
+}
+
+/**
+ * Waits for websocket to get idel before
+ * exiting the lambda function
+ * @param {Number} startTime
+ */
+function busyWaitOnWorkerThread(startTime = Date.now()) {
+    if (!workerSupported) return;
+
+    const workerInitiatedOnWait = process.env.WS_WORKER_STATUS === WORKER_STATUS.RUNNING;
+    const enableWait = !IS_LAMBDA_ENV || process.env[LAMBDA_ENABLE_RESPONSE_BLOCKING] === 'true';
+
+    let flushed = false;
+    let wait = (
+        process.env.CSEC_WS_STATE === SecWebSocket.States.CONNECTING ||
+        (
+            enableWait &&
+            process.env.CSEC_WS_STATE === SecWebSocket.States.BUSY
+        )
+    ) && (startTime + MAX_BUSY_WAIT_TIME > Date.now());
+    while (wait) {
+        wait = (
+            process.env.CSEC_WS_STATE === SecWebSocket.States.CONNECTING ||
+            (
+                enableWait &&
+                process.env.CSEC_WS_STATE === SecWebSocket.States.BUSY
+            )
+        ) && (startTime + MAX_BUSY_WAIT_TIME > Date.now());
+
+        if (!flushed && !workerInitiatedOnWait && process.env.WS_WORKER_STATUS === WORKER_STATUS.RUNNING) {
+            flushed = true;
+            flushLocalQueue();
+        }
+    }
+}
+
+function obeyReconnect(){
+    if (workerSupported) {
+        const reConnectMsg = new WorkerMessage(WorkerMessage.TYPE.OBEY_RECONNECT, {});
+        wsWorker.postMessage(reConnectMsg);
+    } else {
+        wsInstance.obeyReconnect();
+    }
+}
+
+module.exports = {
+    initialize,
+    write: sendEvent,
+    dispatcher: getDispatcherAndSendEvent,
+    flushLocalQueue,
+    busyWaitOnWorkerThread,
+    obeyReconnect
+};

package/lib/nr-security-agent/lib/core/worker-entities.js

@@ -0,0 +1,82 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const MESSAGE = 'MESSAGE';
+const FLUSH = 'FLUSH';
+const BUSY = 'BUSY';
+const INACTIVE = 'INACTIVE';
+const RECONNECT = 'RECONNECT';
+const UPDATE_APPLICATION_INFO = 'UPDATE APPLICATION INFO';
+const IC_READY_FOR_EVENTS = 'IC READY FOR EVENTS';
+const INITIALIZING_STATUS = 'initializing';
+const NONE_STATUS = '';
+const RUNNING_STATUS = 'running';
+const ENDED_STATUS = 'ended';
+const ERROR = 'ERROR';
+const OBEY_RECONNECT = 'obey-reconnect';
+
+/**
+ * This defines and constructs a worker message.
+ * @param {String} type
+ * @param {Object} payload
+ */
+function WorkerMessage (type, payload) {
+    this.type = type;
+    this.payload = payload;
+}
+
+WorkerMessage.prototype = {};
+WorkerMessage.prototype.constructor = WorkerMessage;
+
+/**
+ * Returns the type of worker message
+ */
+WorkerMessage.prototype.getType = function getType () {
+    return this.type;
+};
+
+/**
+ * returns the actual payload of message
+ */
+WorkerMessage.prototype.getPayload = function getPayload () {
+    return this.payload;
+};
+
+WorkerMessage.TYPE = {
+    MESSAGE,
+    FLUSH,
+    BUSY,
+    INACTIVE,
+    RECONNECT,
+    UPDATE_APPLICATION_INFO,
+    IC_READY_FOR_EVENTS,
+    ERROR, 
+    OBEY_RECONNECT
+
+};
+
+/**
+ * parses a Worker thread from simple object
+ * @param {Object} obj
+ */
+WorkerMessage.parseFromObject = function parseFromObject (obj) {
+    if (obj && obj.type && obj.payload) {
+        return new WorkerMessage(obj.type, obj.payload);
+    }
+
+    return false;
+};
+
+const WORKER_STATUS = {
+    NONE: NONE_STATUS,
+    INITIALIZING: INITIALIZING_STATUS,
+    RUNNING: RUNNING_STATUS,
+    ENDED: ENDED_STATUS
+};
+
+module.exports = {
+    WorkerMessage,
+    WORKER_STATUS
+};