@newrelic/security-agent 0.0.1

package/lib/instrumentation-security/hooks/xpath/nr-xpath.js

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+module.exports = initialize
+const requestManager = require('../../core/request-manager');
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+
+/**
+ * Entry point for xpath module hook
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mod, moduleName){
+ logger.info('Instrumenting '+ moduleName)
+
+  if(moduleName==='xpath'){
+    xpathHooks(shim, mod, 'evaluate', moduleName);
+    xpathHooks(shim, mod, 'selectWithResolver', moduleName);
+    xpathHooks(shim, mod, 'useNamespaces', moduleName);
+  }
+  else if(moduleName==='xpath.js'){
+    wrappedXPathDotJS(shim, mod);
+  }
+  
+}
+/**
+ * wrapper to hook xpath module
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ * @param {*} moduleName 
+ */
+function xpathHooks(shim, mod, methodName, moduleName){
+    shim.wrap(mod, methodName, function makeWrapper(shim,fn){
+        return function wrapper(){
+          const interceptedArgs = [arguments[0]];
+          shim.interceptedArgs = interceptedArgs;
+          const request = requestManager.getRequest(shim);
+          if(request){
+            const traceObject = secUtils.getTraceObject(shim);
+            const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.XPATH, EVENT_CATEGORY.XPATH)
+            const secEvent =  API.generateSecEvent(secMetadata);
+            this.secEvent = secEvent;
+            API.sendEvent(this.secEvent);
+          }
+          const result = fn.apply(this, arguments);
+     
+          if(result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+            API.generateExitEvent(this.secEvent);
+            delete this.secEvent
+          }
+          return result;
+        }  
+    })   
+}
+
+/**
+ * Function Wrapper for xpath.js module
+ * @param {*} shim 
+ * @param {*} mod 
+ */
+function wrappedXPathDotJS(shim, mod){
+  const wrappedExport = shim.wrapExport(mod, function wrapXpathJSModule(shim, fn) {
+    return function wrappedXpathJSModule() {
+      const interceptedArgs = [arguments[1]];
+      shim.interceptedArgs = interceptedArgs;
+      const request = requestManager.getRequest(shim);
+      if(request){
+        const traceObject = secUtils.getTraceObject(shim);
+        const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.XPATH, EVENT_CATEGORY.XPATH)
+        const secEvent =  API.generateSecEvent(secMetadata);
+        this.secEvent = secEvent;
+        API.sendEvent(this.secEvent);
+      }
+      const xpathJSForWrapping = fn.apply(this, arguments);
+      if(xpathJSForWrapping && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return xpathJSForWrapping
+    }
+  })
+}

package/lib/instrumentation-security/index.js

@@ -0,0 +1,171 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const API = require('../nr-security-api');
+const newrelic = API.newrelic;
+const logger = API.getLogger();
+
+logger.info("Started instrumentation using shimmer module");
+
+
+newrelic.instrument({
+  moduleName: 'child_process',
+  onRequire: require('./hooks/native/nr-childProcess'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+newrelic.instrument({
+  moduleName: 'http',
+  onRequire: require('./hooks/http/nr-http'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  moduleName: 'https',
+  onRequire: require('./hooks/http/nr-http'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  moduleName: 'fs',
+  onRequire: require('./hooks/fs/nr-fs'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: 'express',
+  onRequire: require('./hooks/express/nr-express'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentDatastore({
+  moduleName: 'mysql',
+  onRequire: require('./hooks/mysql/nr-mysql'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentDatastore({
+  moduleName: 'mysql2',
+  onRequire: require('./hooks/mysql/nr-mysql'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentDatastore({
+  moduleName: 'mongodb',
+  onRequire: require('./hooks/mongodb/nr-mongodb'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  moduleName: 'ldapjs',
+  onRequire: require('./hooks/ldap/nr-ldap'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  moduleName: 'ldapts',
+  onRequire: require('./hooks/ldap/nr-ldap'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+
+newrelic.instrument({
+  moduleName: 'xpath',
+  onRequire: require('./hooks/xpath/nr-xpath'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+newrelic.instrument({
+  moduleName: 'xpath.js',
+  onRequire: require('./hooks/xpath/nr-xpath'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentDatastore({
+  moduleName: 'pg',
+  onRequire: require('./hooks/postgres/nr-postgres'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: 'fastify',
+  onRequire: require('./hooks/fastify/nr-fastify'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+
+newrelic.instrumentWebframework({
+  moduleName: 'restify',
+  onRequire: require('./hooks/restify/nr-restify'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: '@koa/router',
+  onRequire: require('./hooks/koa/@koa/nr-@koa-router'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: 'koa-router',
+  onRequire: require('./hooks/koa/@koa/nr-@koa-router'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: '@hapi/hapi',
+  onRequire: require('./hooks/hapi/nr-hapi'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrumentWebframework({
+  moduleName: 'director',
+  onRequire: require('./hooks/director/nr-director'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+
+
+
+
+
+
+

package/lib/nr-security-agent/index.js

@@ -0,0 +1,170 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const API = require('../nr-security-api');
+const NRAgent = API.getNRAgent();
+
+const logs = require('./lib/core/logging');
+const logger = logs.getLogger();
+const initLogger = logs.getInitLogger();
+const { Agent } = require('./lib/core/agent');
+
+const agentConfig = require('./resources/config');
+const shaSizeUtil = require('./lib/core/sha-size-util');
+const njsAgentConstants = require('./lib/core/sec-agent-constants');
+
+const {
+    IS_LAMBDA_ENV,
+    AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER,
+    LAMBDA_TASK_ROOT_ENV_IDENTIFIER,
+    LOG_MESSAGES } = njsAgentConstants;
+const commonUtils = require('./lib/core/commonUtils');
+
+const { AGENT_DIR } = agentConfig;
+// eslint-disable-next-line no-unused-vars
+const DIR_IDENTIFIER = '/';
+const SPACE_CHARACTER = ' ';
+// eslint-disable-next-line no-control-regex
+const NULL_CHAR_REGEX = /\u0000/g;
+
+const wsClient = require('./lib/core/websocket-client');
+
+
+function extractApplicationDefForLambda(applications) {
+    const application = {
+        deployedPath: process.env[LAMBDA_TASK_ROOT_ENV_IDENTIFIER],
+        appName: process.env[AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER],
+        contextPath: '/'
+    };
+    applications.push(application);
+    return true;
+}
+
+/**
+ * Extracts application path and name from exec args
+ *
+ * @param {*} execArgs
+ * @param {*} applications
+ */
+function extractApplicationDef(execArgs, applications) {
+    initLogger.info(LOG_MESSAGES.DEP_APP_GATHERING_STARTED);
+    if (IS_LAMBDA_ENV) {
+        return extractApplicationDefForLambda(applications);
+    }
+    if (!(Array.isArray(execArgs) && Array.isArray(applications))) {
+        return false;
+    }
+
+    const entryFile = process.argv[1];
+    if (entryFile) {
+        execArgs = [];
+        const absolutePath = require('path').resolve(entryFile);
+        execArgs.push(absolutePath);
+    }
+    for (const arg of execArgs) {
+        const application = {};
+        const fileList = arg.split(DIR_IDENTIFIER);
+        if (fileList.length >= 2) {
+            const scriptName = fileList.pop();
+            const appPath = fileList.join(DIR_IDENTIFIER);
+            application.deployedPath = appPath;
+            const appName = fileList.pop();
+            const finder = require('find-package-json');
+            const find = finder(appPath);
+            const obj = find.next().value;
+            if (obj && obj.__path) {
+                const onlyPath = require('path').dirname(obj.__path);
+                application.deployedPath = onlyPath;
+                application.contextPath = '/';
+            }
+
+            application.appName = appName.concat(DIR_IDENTIFIER, scriptName);
+            applications.push(application);
+            break;
+        } else {
+            return false;
+        }
+    }
+    return true;
+}
+
+/**
+ * Initialize the Agent.
+ */
+function initialize() {
+    const policyManager = require('./lib/core/Policy');
+    policyManager.setDefaultPolicy();
+    commonUtils.initialSetup();
+
+    const applicationInfoModule = require('./lib/core/applicationinfo');
+    const agentStatus = require('./lib/core/agent-status');
+    const applications = [];
+    // Initialize ApplicationInfo
+    const applicationInfo = applicationInfoModule.getInstance();
+    applicationInfoModule.setBuildDetails(AGENT_DIR, applicationInfo);
+
+    if (NRAgent) {
+        NRAgent.on('started', () => {
+            if (NRAgent.config.security.enabled) {
+                wsClient.initialize();
+                logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
+                Agent.getAgent().status.setStatus('active');
+                Agent.setNRAgent(NRAgent);
+            }
+            else {
+                logger.info("security.enabled flag is set to false")
+            }
+        });
+    }
+
+    initLogger.info(LOG_MESSAGES.APP_INFO_GATHERING_STARTED);
+
+    // Fallback extract with process.argv in case application is not detected using proc cmdline
+    if ((extractApplicationDef(getProcCMDLineSanitized(applicationInfoModule), applications) || extractApplicationDef(process.argv, applications)) &&
+        applications.length > 0) {
+
+        if (applicationInfo && applicationInfo.runCommand) {
+            const fileList = applicationInfo.runCommand.split(SPACE_CHARACTER);
+            const scriptName = fileList.pop();
+            if (scriptName.includes(AGENT_DIR)) {
+                return false;
+            }
+        }
+        initLogger.info(LOG_MESSAGES.COLLECTOR_INFO, applicationInfo.collectorVersion, applicationInfo.jsonVersion, applicationInfo.buildNumber);
+        applicationInfoModule.addProperty('serverInfo.deployedApplications', applications);
+        initLogger.info(LOG_MESSAGES.APP_INFO_DEP_APP, JSON.stringify(applications));
+
+        shaSizeUtil.setLogger(logger);
+
+        // Initialize Agent Status
+        const status = agentStatus.getInstance();
+
+        // Initialize Collector config
+
+        // Initialize
+        Agent.init(applicationInfo, logger, wsClient, status);
+        initLogger.info(LOG_MESSAGES.AGENT_INIT_SUCCESSFUL, applicationInfo.pid, applicationInfo.applicationUUID);
+        initLogger.info(LOG_MESSAGES.AGENT_INIT_SUCCESSFUL_COMPLETE, applicationInfo.pid, applicationInfo.applicationUUID);
+        logger.info('Security Agent attached with application, with applicationUUID: %s', applicationInfo.applicationUUID);
+    } else {
+        // Do not load the agent.
+        logger.error('Security Agent not loaded with this application: Skipped.');
+        initLogger.error(LOG_MESSAGES.AGENT_INIT_FAILED);
+
+        return false;
+    }
+
+    return true;
+}
+
+function getProcCMDLineSanitized(applicationInfoModule) {
+    const proc = (applicationInfoModule.getCmdLine() || '').replace(NULL_CHAR_REGEX, SPACE_CHARACTER).trim();
+    return (proc && proc.length > 0) ? proc.split(/\s/g) : process.argv;
+}
+
+(() => {
+    if (initialize()) {
+        require('../instrumentation-security');
+    }
+})();

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const API = require('../../../nr-security-api');
+const commonUtils = require('./commonUtils');
+const appInfo = require('./applicationinfo').getInstance();
+const logs = require('./logging');
+const logger = logs.getLogger();
+const initLogger = logs.getInitLogger();
+
+
+/* eslint-disable camelcase */
+let authHeaders;
+/**
+ * constructor to create Authentication Headers
+ */
+function AuthHeaders() {
+    try {
+        const NRAgent = API.getNRAgent();
+        authHeaders = {}
+        authHeaders['NR-CSEC-CONNECTION-TYPE'] = 'LANGUAGE_COLLECTOR';
+        authHeaders['NR-AGENT-RUN-TOKEN'] = process.env.agent_run_id || NRAgent.config.run_id;
+        const COLLECTOR_VERSION = process.env.collectorVersion || appInfo.collectorVersion || '';
+        authHeaders['NR-CSEC-VERSION'] = COLLECTOR_VERSION.trim();
+        authHeaders['NR-CSEC-COLLECTOR-TYPE'] = 'NODE';
+        authHeaders['NR-CSEC-MODE'] = commonUtils.getCSECmode();
+        authHeaders['NR-CSEC-APP-UUID'] = commonUtils.getUUID();
+        authHeaders['NR-CSEC-JSON-VERSION'] = process.env.jsonVersion || appInfo.jsonVersion;
+        authHeaders['NR-CSEC-BUILD-NUMBER'] = process.env.buildNumber || appInfo.buildNumber;
+        authHeaders['NR-ACCOUNT-ID'] = process.env.account_id || NRAgent.config.account_id;
+        authHeaders['NR-LICENSE-KEY'] = NRAgent ? NRAgent.config.license_key : '';
+    } catch (error) {
+        logger.error("Exception in preparing auth headers:", error);
+    }
+
+    return authHeaders;
+}
+AuthHeaders.prototype.constructor = AuthHeaders;
+
+/**
+ * Returns the current instanceof AuthHeaders,
+ * creates one if not already created.
+ *
+ * @returns {AuthHeaders} instance
+ */
+function getInstance() {
+    if (!authHeaders) {
+        authHeaders = new AuthHeaders();
+        initLogger.info("[STEP-2][BEGIN][Auth-Headers]: Authentication Headers Created Successfully");
+    }
+    return authHeaders;
+}
+
+module.exports = {
+    getInstance
+};

package/lib/nr-security-agent/lib/core/ContainerProperties.js

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+let containerProperties = undefined;
+function ContainerProperties(){
+    
+}
+ContainerProperties.prototype.constructor = ContainerProperties;
+
+/**
+ * Returns the current instanceof ContainerProperties,
+ * creates one if not already created.
+ * 
+ * @returns {ContainerProperties} instance
+ */
+function getInstance() {
+    if (!containerProperties) {
+        containerProperties = new ContainerProperties();
+        containerProperties.name = "";
+        containerProperties.isPrivileged = "";
+        containerProperties.imageId = "";
+        containerProperties.imageName = "";
+        containerProperties.entrypoint = "";
+        containerProperties.creationTimestamp = "";
+        containerProperties.portBindings = new Map();
+        containerProperties.mounts = [];
+        containerProperties.state = "";
+        containerProperties.processInfos = [];
+        containerProperties.capAdd = [];
+        containerProperties.capDrop = [];
+        containerProperties.cpuUsage = "";
+        containerProperties.ipAddress = "";
+
+    }
+    return containerProperties;
+}
+
+module.exports = {
+    getInstance
+};

package/lib/nr-security-agent/lib/core/ECSProperties.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+let ecsProperties;
+function ECSProperties () {
+
+}
+ECSProperties.prototype.constructor = ECSProperties;
+
+/**
+ * Returns the current instanceof ECSProperties,
+ * creates one if not already created.
+ *
+ * @returns {ECSProperties} instance
+ */
+function getInstance () {
+    if (!ecsProperties) {
+        ecsProperties = new ECSProperties();
+        ecsProperties.imageName = '';
+        ecsProperties.imageId = '';
+        ecsProperties.containerName = '';
+        ecsProperties.containerId = '';
+        ecsProperties.ecsTaskDefinition = '';
+        ecsProperties.ipAddress = '';
+        ecsProperties.creationTimestamp = '';
+    }
+    return ecsProperties;
+}
+
+module.exports = {
+    getInstance
+};

package/lib/nr-security-agent/lib/core/FuzzFailEvent.js

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const { BasicInfo } = require('./event');
+const applicationInfo = require('./applicationinfo').getInstance();
+/**
+ * Function Constructor to create object of FuzzFail event
+ * @param {*} fuzzHeader
+ */
+function FuzzFailEvent (fuzzHeader) {
+    BasicInfo.call(this);
+    this.jsonVersion = applicationInfo.jsonVersion;
+    this.jsonName = 'fuzzfail';
+    this.applicationUUID = applicationInfo.applicationUUID;
+    this.groupName = applicationInfo.groupName;
+    this.nodeId = applicationInfo.nodeId;
+    this.policyVersion = applicationInfo.policyVersion;
+    this.fuzzHeader = fuzzHeader;
+}
+
+FuzzFailEvent.prototype.constructor = FuzzFailEvent;
+
+module.exports = {
+    FuzzFailEvent
+};

package/lib/nr-security-agent/lib/core/LinkingMetadata.js

@@ -0,0 +1,21 @@
+
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const API = require('../../../nr-security-api');
+
+/**
+ * Returns the linkingMetadata,
+ * creates one if not already created.
+ *
+ * @returns {LinkingMetadata} instance
+ */
+function getLinkingMetadata () {
+    return API.newrelic.getLinkingMetadata();
+}
+
+module.exports = {
+    getLinkingMetadata,
+};

package/lib/nr-security-agent/lib/core/LogMessage.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const LinkingMetaData = require('./LinkingMetadata');
+const API = require('../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+
+/**
+ * constructor function to create LogMessageException object
+ * @param {*} message
+ * @param {*} cause
+ * @param {*} stacktrace
+ */
+function logMessageException (exception) {
+    this.message = exception.message;
+    this.cause = exception.cause ? exception.cause : '';
+    this.stacktrace = exception.stack;
+}
+
+/**
+  * constructor function to create logMessage object;
+  * @param {*} timestamp
+  * @param {*} level
+  * @param {*} message
+  * @param {*} caller
+  * @param {*} exception
+  * @param {*} linkingMetadata
+  */
+function logMessage (level, message, caller, exception) {
+    this.timestamp = Date.now();
+    this.level = level;
+    this.message = message;
+    this.caller = caller;
+    if (exception) {
+        this.exception = logMessageException(exception);
+    }
+    if (NRAgent) {
+        this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
+    }
+}
+
+module.exports = {
+    logMessage,
+    logMessageException
+};