@newrelic/security-agent 0.0.8 → 0.1.0

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+### v0.1.0
+* Handling to use OS specific path separator.
+* Functionality to create directories in windows environment.
+* IAST support for windows.
+* Log file permission fix.
 ### v0.0.8
 * Handling for IP resolving to IPV4 as Node.js v17 and above no longer re-sorts results of IP address lookups and returns them as-is.
 * Third Party Notices update

package/lib/instrumentation-security/core/constants.js

@@ -8,6 +8,7 @@
 
 const AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER = /^AWS_Lambda_nodejs.*$/g;
 const AWS_EXECUTION_ENV_VAR = 'AWS_EXECUTION_ENV';
+const sep = require('path').sep;
 
 module.exports = {
 
@@ -33,7 +34,7 @@ module.exports = {
     COLON: ':',
     OPEN_PARANTHESIS: '(',
     CLOSE_PARANTHESIS: ')',
-    SLASH: '/',
+    SLASH: sep,
     INCOMING_MSG: 'IncomingMessage',
     OBJECT: 'object',
     STRING: 'string',
@@ -59,7 +60,6 @@ module.exports = {
     SLASHDOTDOT: '/..',
     UNDEFINED: 'undefined',
     SELF_FD_PATH: '/proc/self/fd/',
-    SLASH: '/',
     CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
 

package/lib/instrumentation-security/core/sec-trace.js

@@ -6,7 +6,10 @@
 const path = require('path');
 const API = require("../../nr-security-api");
 const NRAgent = API.getNRAgent();
-const AGENT_DIR = path.join(__dirname, '../../');
+let AGENT_DIR = path.join(__dirname, '../../');
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
+}
 const NR_LIB = '/newrelic/lib';
 let LOAD_LIST;
 const { IS_LAMBDA_ENV, LAMBDA_RUNTIME_DIR_VAR } = require('./constants');

package/lib/instrumentation-security/core/sec-utils.js

@@ -10,8 +10,11 @@ const requestManager = require('./request-manager');
 const routeManager = require('./route-manager');
 const async_hooks = require('async_hooks');
 
-const AGENT_DIR = path.join(__dirname, '../../');
+let  AGENT_DIR = path.join(__dirname, '../../');
 
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\");
+}
 const NR_LIB = '/newrelic/lib';
 
 const ANONYMOUS_FUNCTION = '<anonymous>';

package/lib/nr-security-agent/index.js

@@ -18,12 +18,12 @@ const {
     IS_LAMBDA_ENV,
     AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER,
     LAMBDA_TASK_ROOT_ENV_IDENTIFIER,
-    LOG_MESSAGES } = njsAgentConstants;
+    LOG_MESSAGES, SLASH } = njsAgentConstants;
 const commonUtils = require('./lib/core/commonUtils');
 
 const { AGENT_DIR } = agentConfig;
 // eslint-disable-next-line no-unused-vars
-const DIR_IDENTIFIER = '/';
+const DIR_IDENTIFIER = SLASH;
 const SPACE_CHARACTER = ' ';
 // eslint-disable-next-line no-control-regex
 const NULL_CHAR_REGEX = /\u0000/g;

package/lib/nr-security-agent/lib/core/Policy.js

@@ -61,7 +61,10 @@ function setPolicyData(data) {
 
 // function to setup default policy provided in resources directory
 function setDefaultPolicy() {
-    const default_policy_file = path.resolve(__dirname, '../../resources/default-policy.yaml');
+    let default_policy_file = path.resolve(__dirname, '../../resources/default-policy.yaml');
+    if(process.platform == 'win32'){
+        default_policy_file = path.resolve(__dirname, '..\\..\\resources\\default-policy.yaml');
+    }
     // Get document, or throw exception on error
     try {
         const default_policy = yaml.load(fs.readFileSync(default_policy_file, 'utf8'));

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -34,7 +34,7 @@ const SELF_PROC_DIR = '/proc/self';
 const CGROUP_FILE_NAME = '/proc/self/cgroup';
 const STAT = '/stat';
 const CMD_LINE_FILE = '/cmdline';
-const DIR_IDENTIFIER = '/';
+const DIR_IDENTIFIER = SLASH;
 const NEW_LINE_SEPERATOR = '\n';
 const CGROUP_FILE = '/cgroup';
 const ESCAPED_DOT = '.';
@@ -440,8 +440,6 @@ function isK8S () {
 
 function getHostName () {
     try {
-        // const hostFile = fs.readFileSync("/etc/hostname");
-        // return hostFile.toString().trim();
         return OS.hostname();
     } catch (err) {
         return EMPTY_STRING;

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -13,7 +13,7 @@ const OS = require('os');
 const path = require('path');
 const checkDiskSpace = require('check-disk-space').default;
 const AgentStatus = require('../core/agent-status');
-const { LOG_MESSAGES, CSEC_HOME } = require('./sec-agent-constants');
+const { LOG_MESSAGES, CSEC_HOME, SLASH } = require('./sec-agent-constants');
 
 const prettyBytes = require('pretty-bytes');
 const njsAgentConstants = require('./sec-agent-constants');
@@ -120,15 +120,15 @@ function getOS () {
  * Utility to create directories
  */
 function createDirectories () {
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/logs`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/logs/snapshots`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent/${getUUID()}`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent/${getUUID()}/ds-tmp`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs${SLASH}snapshots`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}${SLASH}ds-tmp`);
     try {
-        fs.chmodSync(`${CSEC_HOME}/nr-security-home`, 0o777);
+        fs.chmodSync(`${CSEC_HOME}${SLASH}nr-security-home`, 0o777);
     } catch (error) {
     }
 }
@@ -254,14 +254,14 @@ function iastRestClientStatus () {
  */
 function removeOlderSnapshots () {
     try {
-        const basePath = njsAgentConstants.LOG_DIR + 'snapshots/';
+        const basePath = njsAgentConstants.LOG_DIR + 'snapshots'+ SLASH;
         const directoryContent = fs.readdirSync(basePath);
         const files = directoryContent.filter((filename) => {
-            return fs.statSync(`${basePath}/${filename}`).isFile();
+            return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
         });
         const sorted = files.sort((a, b) => {
-            const firstStat = fs.statSync(`${basePath}/${a}`);
-            const secondStat = fs.statSync(`${basePath}/${b}`);
+            const firstStat = fs.statSync(`${basePath}${SLASH}${a}`);
+            const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
         for (let i = 99; i < sorted.length; i++) {
@@ -292,12 +292,12 @@ function removeOlderlogfiles () {
         // eslint-disable-next-line array-callback-return
         const files = directoryContent.filter((filename) => {
             if (filename.match(backupLogFileRegex)) {
-                return fs.statSync(`${basePath}/${filename}`).isFile();
+                return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
             }
         });
         const sorted = files.sort((a, b) => {
-            const firstStat = fs.statSync(`${basePath}/${a}`);
-            const secondStat = fs.statSync(`${basePath}/${b}`);
+            const firstStat = fs.statSync(`${basePath}${SLASH}${a}`);
+            const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
 
@@ -384,7 +384,11 @@ function getCSECmode(){
  * @returns 
  */
 function getPathOfCACert(){
-    const certPath = NRAgent && NRAgent.config.security.ca_bundle_path ? NRAgent.config.security.ca_bundle_path : path.resolve(__dirname, '../../resources/cert.pem');
+    let relativePath = path.resolve(__dirname, '../../resources/cert.pem');
+    if(process.platform == 'win32'){
+        relativePath = path.resolve(__dirname, '..\\..\\resources\\cert.pem');
+    }
+    const certPath = NRAgent && NRAgent.config.security.ca_bundle_path ? NRAgent.config.security.ca_bundle_path : relativePath;
     return certPath
 }
 

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -10,7 +10,7 @@ const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { hasWorker: isWorkerSupported } = require('../../../commonUtils');
-const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID } = require('../../../sec-agent-constants');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
@@ -24,7 +24,7 @@ const {
 } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
-const find = '/{{NR_CSEC_VALIDATOR_HOME_TMP}}';
+const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 
 let logger;

package/lib/nr-security-agent/lib/core/logging.js

@@ -9,7 +9,6 @@ const fs = require('fs');
 
 const log4js = require('log4js');
 const { ENV: env } = require('../../resources/config');
-const cp = require('child_process');
 
 const INFO = 'info';
 const LOG_FILE_SIZE = 50485760 * 10000;
@@ -17,11 +16,14 @@ const LOG_PATTERN_OBJ = {
     type: 'pattern',
     pattern: '%[%d[%p][%c][%h][%z]%] %m'
 };
-const { LOG_MESSAGES, LOG_DIR } = require('./sec-agent-constants');
+const { LOG_DIR } = require('./sec-agent-constants');
 let logger;
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 
+const logFileName = `${LOG_DIR}node-security-collector.log`;
+const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
+
 function createLogPathIfNotExist (dir) {
     try {
         if (!fs.existsSync(dir)) {
@@ -57,9 +59,6 @@ function initialize (applicationUUID) {
     } catch (error) {
     }
 
-    const logFileName = `${LOG_DIR}node-security-collector.log`;
-    const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
-
     Object.assign(appenders.NR_CSEC, {
         filename: logFileName,
         maxLogSize: LOG_FILE_SIZE,
@@ -143,6 +142,12 @@ function getLogger (applicationUUID = process.env.applicationUUID) {
         initialize(applicationUUID);
         logger = log4js.getLogger('NR_CSEC');
         const initLogger = getInitLogger();
+        try {
+            fs.chmodSync(`${logFileName}`, 0o777);
+            fs.chmodSync(`${initLogFileName}`, 0o777);
+        } catch (error) {
+            logger.error("Error while setting up permissions on log files", error);
+        }
         initLogger.info("[STEP-2] => Generating unique identifier:",applicationUUID )
         if (NRAgent) {
             setLevel(NRAgent.config.logging.level);

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -10,6 +10,7 @@ const AWS_EXECUTION_ENV_VAR = 'AWS_EXECUTION_ENV';
 const path = require('path');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
+const sep = require('path').sep;
 
 let CSEC_HOME = NRAgent &&  NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home  : require('path').join(process.cwd());
 const CSEC_GROUP_NAME = NRAgent ? NRAgent.config.security.mode : 'IAST';
@@ -19,11 +20,11 @@ const agentStartTime = new Date().toString();
 module.exports = {
     CSEC_HOME: CSEC_HOME,
     CSEC_GROUP_NAME: CSEC_GROUP_NAME,
-    LOG_DIR: `${CSEC_HOME}/nr-security-home/logs/`,
-    CSEC_HOME_TMP: `${CSEC_HOME}/nr-security-home/tmp/language-agent/${process.env.applicationUUID}`,
+    LOG_DIR: `${CSEC_HOME}${sep}nr-security-home${sep}logs${sep}`,
+    CSEC_HOME_TMP: `${CSEC_HOME}${sep}nr-security-home${sep}tmp${sep}language-agent${sep}${process.env.applicationUUID}`,
     AGENT_START_TIME: agentStartTime,
     FRAMEWORK: '',
-    STATUS_LOG_FILE: `${CSEC_HOME}/nr-security-home/logs/snapshots/node-security-collector-status-${process.env.applicationUUID}.log`,
+    STATUS_LOG_FILE: `${CSEC_HOME}${sep}nr-security-home${sep}logs${sep}snapshots${sep}node-security-collector-status-${process.env.applicationUUID}.log`,
 
     DB_LIST: {
         MYSQL: 'MYSQL',
@@ -83,7 +84,7 @@ module.exports = {
     COLON: ':',
     OPEN_PARANTHESIS: '(',
     CLOSE_PARANTHESIS: ')',
-    SLASH: '/',
+    SLASH: sep,
     INCOMING_MSG: 'IncomingMessage',
     OBJECT: 'object',
     STRING: 'string',

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -6,7 +6,8 @@
 /* eslint-disable new-cap */
 
 const njsAgentConstants = require('./sec-agent-constants');
-const path = require('path').resolve(__dirname, '../../');
+const agentConfig = require('../../resources/config');
+const { AGENT_DIR } = agentConfig;
 const lodash = require('lodash');
 
 let errors = [];
@@ -26,7 +27,7 @@ const statusFile = njsAgentConstants.STATUS_LOG_FILE;
 const statusTemplate = 'Snapshot timestamp: : %s\n' +
 `CSEC Agent start timestamp: ${njsAgentConstants.AGENT_START_TIME} with application uuid:${commonUtils.getUUID()}\n` +
 `SEC_HOME: ${njsAgentConstants.CSEC_HOME}\n` +
-`Agent location: ${path}\n` +
+`Agent location: ${AGENT_DIR}\n` +
 `Using CSEC Agent for Node.js, Node version:${process.version}, PID:${process.pid}\n` +
 `Process title: ${process.title}\n` +
 `Process binary: ${process.execPath}\n` +

package/lib/nr-security-agent/resources/config.js

@@ -2,9 +2,15 @@
  * Copyright 2023 New Relic Corporation. All rights reserved.
  * SPDX-License-Identifier: New Relic Pre-Release
  */
+const { platform } = require('os');
 const path = require('path');
 
-const AGENT_DIR = path.join(__dirname, '../../../');
+let AGENT_DIR = path.join(__dirname, '../../../');
+
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
+}
+
 const uuidv4 = require('uuid/v4');
 process.env.applicationUUID = process.env.applicationUUID || uuidv4();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.0.8",
+  "version": "0.1.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "collectorVersion": "1.0.3-limited-preview",