@newrelic/security-agent 0.0.1

package/lib/instrumentation-security/hooks/mongodb/common.js

@@ -0,0 +1,239 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+"use strict";
+
+/* eslint sonarjs/cognitive-complexity: ["error", 18] -- TODO: https://issues.newrelic.com/browse/NEWRELIC-5252 */
+
+const { CURSOR_OPS, COLLECTION_OPS, DB_OPS } = require("./constants");
+const common = module.exports;
+const requestManager = require("../../core/request-manager");
+const async_hooks = require("async_hooks");
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+
+function methodChecker(data) {
+  data = data.toLowerCase();
+  if (data.includes("delete")) {
+    return "delete";
+  } else if (data.includes("update") || data.includes("replace")) {
+    return "update";
+  } else if (data.includes("insert") || data.includes("write")) {
+    return "insert";
+  } else if (data.includes("find")) {
+    return "find";
+  } else {
+    return "Unknown";
+  }
+}
+
+function payloadType(obj) {
+  if (obj) {
+    if (obj.insert) {
+      return "insert";
+    } else if (obj.update) {
+      return "update";
+    } else if (obj.delete) {
+      return "delete";
+    } else if (obj.find) {
+      return "find";
+    } else {
+      return "Unknown";
+    }
+  }
+  else{
+    return "Unknown";
+  }
+
+}
+
+function queryHook(shim, mod, method) {
+  shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    return function queryWrapper() {
+      const request = requestManager.getRequest(shim);
+      if (CURSOR_OPS.includes(method)) {
+        if (!this.mongo_sec_hooked && this.operation && this.operation.cmd) {
+          const pType = payloadType(this.operation.cmd);
+          const payloadData = {
+            payloadType: pType,
+            payload: this.operation.cmd,
+          };
+          shim.interceptedArgs = payloadData;
+        }
+      } else {
+        this.mongo_sec_hooked = true;
+
+        const pType = methodChecker(method);
+        const payloadData = {
+          payloadType: pType,
+          payload: arguments,
+        };
+        shim.interceptedArgs = payloadData;
+
+      }
+
+      try {
+        if (request) {
+          //generate event here
+          const traceObject = secUtils.getTraceObject(shim);
+          const secMetadata = securityMetaData.getSecurityMetaData(request, JSON.parse(JSON.stringify(shim.interceptedArgs)), traceObject, secUtils.getExecutionId(), EVENT_TYPE.NOSQL_DB_COMMAND, EVENT_CATEGORY.MONGO)
+          const secEvent = API.generateSecEvent(secMetadata);
+          API.sendEvent(secEvent);
+          if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+            callbackHook(shim, arguments, arguments.length - 1, secEvent);
+          }
+        }
+      } catch (error) {
+      }
+      
+
+      return fn.apply(this, arguments);
+    };
+  });
+}
+
+/**
+ * Instruments all methods from constants.CURSOR_OPS on a given
+ * cursor class
+ *
+ * @param {Shim} shim
+ * @param {Cursor} Cursor
+ */
+common.instrumentCursor = function instrumentCursor(shim, Cursor) {
+  if (Cursor && Cursor.prototype) {
+    const proto = Cursor.prototype;
+    for (let i = 0; i < CURSOR_OPS.length; i++) {
+      queryHook(shim, proto, CURSOR_OPS[i]);
+    }
+    queryHook(shim, proto, "each");
+  }
+};
+
+/**
+ * Instruments all methods from constants.COLLECTION_OPS on
+ * the Collection class
+ *
+ * @param {Shim} shim
+ * @param {Collection} Collection
+ */
+common.instrumentCollection = function instrumentCollection(shim, Collection) {
+  if (Collection && Collection.prototype) {
+    const proto = Collection.prototype;
+    for (let i = 0; i < COLLECTION_OPS.length; i++) {
+      queryHook(shim, proto, COLLECTION_OPS[i]);
+    }
+  }
+};
+
+/**
+ * Instruments the execute method on
+ * the BulkOperationBase class
+ *
+ * @param {Shim} shim
+ * @param {BulkOperationModule} bulk operation module, typically from mongodb/lib/bulk/common
+ * @param BulkOperationModule
+ */
+common.instrumentBulkOperation = function instrumentBulkOperation(
+  shim,
+  BulkOperationModule
+) {
+  const BulkOperationBase =
+    BulkOperationModule && BulkOperationModule.BulkOperationBase;
+
+  if (BulkOperationBase && BulkOperationBase.prototype) {
+    const proto = BulkOperationBase.prototype;
+    queryHook(shim, proto, "execute");
+  }
+};
+
+/**
+ * Instruments all methods from constants.DB_OPS on
+ * the Db class.
+ *
+ * @param {object} params
+ * @param {Shim} params.shim
+ * @param {Db} params.Db
+ * @param shim
+ * @param Db
+ */
+common.instrumentDb = function instrumentDb(shim, Db) {
+  if (Db && Db.prototype) {
+    const proto = Db.prototype;
+  }
+  //here need to add hooks for DB ops
+};
+
+/**
+ * Callback hook to generate exit event
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} fun 
+ * @param {*} secEvent 
+ */
+function callbackHook(shim, mod, fun, secEvent) {
+  shim.secEvent = secEvent;
+  shim.wrap(mod, fun, function callbackWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn;
+    }
+    return function wrapper() {
+      if ((arguments[0] === null || arguments[0] === undefined) && shim.secEvent) {
+        API.generateExitEvent(shim.secEvent);
+        delete shim.secEvent;
+      }
+      return fn.apply(this, arguments);
+    }
+  })
+}
+
+common.queryHookV2 = function queryHookV2(shim, mod, method) {
+  shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    return function queryWrapper() {
+      const request = requestManager.getRequest(shim);
+      if (CURSOR_OPS.includes(method)) {
+        if (!this.mongo_sec_hooked && this.cmd) {
+          const pType = payloadType(this.cmd);
+          const payloadData = {
+            payloadType: pType,
+            payload: this.cmd,
+          };
+          shim.interceptedArgs = payloadData;
+        }
+      } else {
+        this.mongo_sec_hooked = true;
+
+        const pType = methodChecker(method);
+        const payloadData = {
+          payloadType: pType,
+          payload: arguments,
+        };
+        shim.interceptedArgs = payloadData;
+
+      }
+
+      if (request && shim.interceptedArgs) {
+        //generate event here
+        const traceObject = secUtils.getTraceObject(shim);
+        const secMetadata = securityMetaData.getSecurityMetaData(request, JSON.parse(JSON.stringify(shim.interceptedArgs)), traceObject, secUtils.getExecutionId(), EVENT_TYPE.NOSQL_DB_COMMAND, EVENT_CATEGORY.MONGO)
+        const secEvent = API.generateSecEvent(secMetadata);
+        if (this.sec_executionId != secMetadata.executionId) {
+          API.sendEvent(secEvent);
+          this.sec_executionId = secMetadata.executionId;
+        }
+
+        if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+          callbackHook(shim, arguments, arguments.length - 1, secEvent);
+        }
+      }
+      return fn.apply(this, arguments);
+    };
+  });
+}
+
+

package/lib/instrumentation-security/hooks/mongodb/constants.js

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+'use strict'
+
+const DB_OPS = [
+  'addUser',
+  'authenticate',
+  'collection',
+  'collectionNames',
+  'collections',
+  'command',
+  'createCollection',
+  'createIndex',
+  'cursorInfo',
+  'dereference',
+  'dropCollection',
+  'dropDatabase',
+  'dropIndex',
+  'ensureIndex',
+  'eval',
+  'executeDbAdminCommand',
+  'indexInformation',
+  'logout',
+  'open',
+  'reIndex',
+  'removeUser',
+  'renameCollection',
+  'stats',
+  '_executeInsertCommand',
+  '_executeQueryCommand'
+]
+
+const COLLECTION_OPS = [
+  'aggregate',
+  'bulkWrite',
+  'count',
+  'countDocuments',
+  'createIndex',
+  'deleteMany',
+  'deleteOne',
+  'distinct',
+  'drop',
+  'dropAllIndexes',
+  'dropIndex',
+  'ensureIndex',
+  // 'find',
+  'findAndModify',
+  'findAndRemove',
+  // 'findOne',
+  'findOneAndDelete',
+  'findOneAndReplace',
+  'findOneAndUpdate',
+  // 'findOneAndRemove',
+  'geoHaystackSearch',
+  'geoNear',
+  'group',
+  'indexes',
+  'indexExists',
+  'indexInformation',
+  'insert',
+  'insertMany',
+  'insertOne',
+  'isCapped',
+  'mapReduce',
+  'options',
+  'parallelCollectionScan',
+  'reIndex',
+  'remove',
+  'rename',
+  'replaceOne',
+  'save',
+  'stats',
+  'update',
+  'updateMany',
+  'updateOne'
+]
+
+const GRID_OPS = ['put', 'get', 'delete']
+
+const CURSOR_OPS = ['nextObject', 'next', 'toArray', 'count', 'explain']
+
+module.exports = {
+  COLLECTION_OPS,
+  CURSOR_OPS,
+  DB_OPS,
+  GRID_OPS
+}

package/lib/instrumentation-security/hooks/mongodb/nr-mongodb.js

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+"use strict";
+
+const semver = require("semver");
+const instrument = require("./v2-mongo")
+const instrumentV3 = require("./v3-mongo");
+const instrumentV4 = require("./v4-mongo");
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+
+// XXX: When this instrumentation is modularized, update this thread
+// with a cautionary note:
+// https://discuss.newrelic.com/t/feature-idea-using-mongoose-cursors-memory-leaking-very-quickly/49270/14
+//
+// This instrumentation is deep linked against in the mongoose instrumentation
+// snippet.  The snippet will break once this file is moved from this
+// location.
+
+module.exports = initialize;
+
+/**
+ * Registers the query parser, and relevant instrumentation
+ * based on version of mongodb
+ *
+ * @param {Agent} agent
+ * @param {object} mongodb resolved package
+ * @param {string} moduleName name of module
+ * @param {Shim} shim
+ */
+function initialize(shim, mongodb, moduleName) {
+  logger.info("Instrumenting Mongodb");
+  if (!mongodb) {
+    return;
+  }
+
+  const mongoVersion = shim.require("./package.json").version;
+  logger.debug("mongoVersion:", mongoVersion);
+  if (semver.satisfies(mongoVersion, ">=4.0.0")) {
+    instrumentV4(shim, mongodb);
+  } else if (semver.satisfies(mongoVersion, ">=3.0.6")) {
+    instrumentV3(shim, mongodb);
+  }else {
+    instrument(shim, mongodb)
+  }
+}

package/lib/instrumentation-security/hooks/mongodb/v2-mongo.js

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+'use strict'
+
+const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2 } = require('./common')
+
+/**
+ * Registers relevant instrumentation for mongo <= 3.0.6
+ * and >= 2. This relies on the built-in "APM" hook points
+ * to instrument their provided objects as well as sets
+ * up a listener for when commands start to properly
+ * add necessary attributes to segments
+ *
+ * @param {Shim} shim
+ * @param {object} mongodb resolved package
+ */
+module.exports = function instrument(shim, mongodb) {
+
+  const recordDesc = {
+    Gridstore: {
+      isQuery: false,
+      makeDescFunc: function makeGridDesc(opName) {
+        return { name: 'GridFS-' + opName, callback: shim.LAST }
+      }
+    },
+    OrderedBulkOperation: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    UnorderedBulkOperation: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    CommandCursor: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    AggregationCursor: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    Cursor: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    Collection: { isQuery: true, makeDescFunc: makeQueryDescFunc },
+    Db: {
+      isQuery: false,
+      makeDescFunc: function makeDbDesc() {
+        return { callback: shim.LAST }
+      }
+    }
+  }
+
+  // instrument using the apm api
+  const instrumenter = mongodb.instrument(Object.create(null), instrumentModules)
+
+  /**
+   * Every module groups instrumentations by their
+   * promise, callback, return permutations
+   * Iterate over permutations and properly
+   * wrap depending on the `recordDesc` above
+   * See: https://github.com/mongodb/node-mongodb-native/blob/v3.0.5/lib/collection.js#L384
+   *
+   * @param _
+   * @param modules
+   */
+  function instrumentModules(_, modules) {
+    modules.forEach((module) => {
+      const { obj, instrumentations, name } = module
+      instrumentations.forEach((meta) => {
+        applyInstrumentation(name, obj, meta)
+      })
+    })
+  }
+
+  /**
+   * Iterate over methods on object and lookup in `recordDesc` to decide
+   * if it needs to be wrapped as an operation or query
+   *
+   * @param {string} objectName name of class getting instrumented
+   * @param {object} object reference to the class getting instrumented
+   * @param {Define} meta describes the methods and if they are callbacks
+   * promises, and return values
+   */
+  function applyInstrumentation(objectName, object, meta) {
+    const { methods, options } = meta
+    if (options.callback) {
+      methods.forEach((method) => {
+        const { isQuery, makeDescFunc } = recordDesc[objectName]
+        const proto = object.prototype
+        if (isQuery && method!='execute') {
+          queryHookV2(shim, proto, method);
+        } else if (isQuery === false) {
+          // could be unset
+          // shim.recordOperation(proto, method, makeDescFunc(shim, method))
+        }
+      })
+    }
+
+  }
+}

package/lib/instrumentation-security/hooks/mongodb/v3-mongo.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+"use strict";
+
+const {
+  instrumentBulkOperation,
+  instrumentCollection,
+  instrumentCursor,
+  instrumentDb,
+} = require("./common");
+
+/**
+ * Registers relevant instrumentation for mongo >= 3.0.6
+ * In 3.0.6 they refactored their "APM" module which removed
+ * a lot of niceities around instrumentation classes.
+ * see: https://github.com/mongodb/node-mongodb-native/pull/1675/files
+ * This reverts back to instrumenting pre-canned methods on classes
+ * as well as sets up a listener for when commands start to properly
+ * add necessary attributes to segments
+ *
+ * @param {Shim} shim
+ * @param {object} mongodb resolved package
+ */
+module.exports = function instrument(shim, mongodb) {
+
+  instrumentCursor(shim, mongodb.Cursor);
+  instrumentCursor(shim, shim.require("./lib/aggregation_cursor"));
+  instrumentCursor(shim, shim.require("./lib/command_cursor"));
+  instrumentBulkOperation(shim, shim.require("./lib/bulk/common"));
+  instrumentCollection(shim, mongodb.Collection);
+  instrumentDb(shim, mongodb.Db);
+};

package/lib/instrumentation-security/hooks/mongodb/v4-mongo.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+'use strict'
+
+const { instrumentCollection, instrumentCursor, instrumentDb } = require('./common')
+
+module.exports = function instrument(shim, mongodb) {
+  instrumentCursor(shim, mongodb.AbstractCursor)
+  instrumentCursor(shim, mongodb.FindCursor)
+  instrumentCursor(shim, mongodb.AggregationCursor)
+  instrumentCollection(shim, mongodb.Collection)
+  instrumentDb(shim, mongodb.Db)
+}