@newrelic/security-agent 0.0.8 → 0.1.1

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+###v0.1.1
+* Fix in mysql instrumentation on getConnection to check if callback is wrapped
+* NR-123832: Support for fire and forget vulnerability detection
+* Fixes for snapshot file.
+* Handling for high_security config.
+### v0.1.0
+* Handling to use OS specific path separator.
+* Functionality to create directories in windows environment.
+* IAST support for windows.
+* Log file permission fix.
 ### v0.0.8
 * Handling for IP resolving to IPV4 as Node.js v17 and above no longer re-sorts results of IP address lookups and returns them as-is.
 * Third Party Notices update

package/index.js

@@ -13,7 +13,7 @@ function start(NRAgentObject) {
     const agent = NRAgentObject.agent;
     API.newrelic = NRAgentObject;
     API.setNRAgent(agent);
-    if (!agent.config.security.agent.enabled || agent.config.security.enabled == null) {
+    if (agent.config.high_security) {
         return;
     }
     require('./lib/nr-security-agent');

package/lib/instrumentation-security/core/constants.js

@@ -8,6 +8,7 @@
 
 const AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER = /^AWS_Lambda_nodejs.*$/g;
 const AWS_EXECUTION_ENV_VAR = 'AWS_EXECUTION_ENV';
+const sep = require('path').sep;
 
 module.exports = {
 
@@ -33,7 +34,7 @@ module.exports = {
     COLON: ':',
     OPEN_PARANTHESIS: '(',
     CLOSE_PARANTHESIS: ')',
-    SLASH: '/',
+    SLASH: sep,
     INCOMING_MSG: 'IncomingMessage',
     OBJECT: 'object',
     STRING: 'string',
@@ -59,7 +60,6 @@ module.exports = {
     SLASHDOTDOT: '/..',
     UNDEFINED: 'undefined',
     SELF_FD_PATH: '/proc/self/fd/',
-    SLASH: '/',
     CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
 

package/lib/instrumentation-security/core/request-manager.js

@@ -34,6 +34,13 @@ function getRequest(shim) {
         const transactionId = segment.transaction.id;
         return getRequestFromId(transactionId);
     }
+    else if (shim.agent.getLinkingMetadata()) {
+        let linkingMetadata = shim.agent.getLinkingMetadata();
+        if (linkingMetadata['trace.id']) {
+            let traceId = linkingMetadata['trace.id'];
+            return getRequestFromId(traceId);
+        }
+    }
 }
 
 /**
@@ -51,16 +58,32 @@ function updateRequestBody(shim, data) {
             setRequest(transactionId, requestData);
         }
     }
+    if (shim.agent.getLinkingMetadata()) {
+        let linkingMetadata = shim.agent.getLinkingMetadata();
+        if (linkingMetadata['trace.id']) {
+            let traceId = linkingMetadata['trace.id'];
+            const requestData = getRequestFromId(traceId);
+            if (requestData) {
+                requestData.body = data;
+                setRequest(traceId, requestData)
+            }
+        }
+    }
 }
 
 /**
  * Utility to clear data based on transaction Id 
  * @param {*} transactionId 
  */
-function gcRequestMap(transactionId) {
+function gcRequestMap(transaction) {
+    let transactionId = transaction.id;
+    let traceId = transaction._traceId;
     if (requestMap.has(transactionId)) {
         requestMap.delete(transactionId);
     }
+    if (requestMap.has(traceId)) {
+        requestMap.delete(traceId);
+    }
 }
 
 module.exports = {

package/lib/instrumentation-security/core/sec-trace.js

@@ -6,7 +6,10 @@
 const path = require('path');
 const API = require("../../nr-security-api");
 const NRAgent = API.getNRAgent();
-const AGENT_DIR = path.join(__dirname, '../../');
+let AGENT_DIR = path.join(__dirname, '../../');
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
+}
 const NR_LIB = '/newrelic/lib';
 let LOAD_LIST;
 const { IS_LAMBDA_ENV, LAMBDA_RUNTIME_DIR_VAR } = require('./constants');

package/lib/instrumentation-security/core/sec-utils.js

@@ -10,8 +10,11 @@ const requestManager = require('./request-manager');
 const routeManager = require('./route-manager');
 const async_hooks = require('async_hooks');
 
-const AGENT_DIR = path.join(__dirname, '../../');
+let  AGENT_DIR = path.join(__dirname, '../../');
 
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\");
+}
 const NR_LIB = '/newrelic/lib';
 
 const ANONYMOUS_FUNCTION = '<anonymous>';
@@ -123,7 +126,7 @@ function traceElementForRoute () {
     const trace = stackTraceModule.get();
     let methodName = null;
 
-    for (let i = 0; i < trace.length - 1; i++) {
+    for (let i = 0; i <= trace.length - 1; i++) {
         const funcName = trace[i].getFunctionName();
         const fileName = trace[i].getFileName();
         const lineNumber = trace[i].getLineNumber();
@@ -195,6 +198,13 @@ function addRequestData(shim, request) {
           data.parameterMap = storedRequest.parameterMap;
         }
         requestManager.setRequest(transactionId, data);
+        if(shim.agent.getLinkingMetadata()){
+            let linkingMetadata = shim.agent.getLinkingMetadata();
+            if(linkingMetadata['trace.id']){
+              let traceId = linkingMetadata['trace.id'];
+              requestManager.setRequest(traceId, data)
+            }
+          }
       }
     } catch (error) {
       logger.debug("Error while preparing incoming request:", error);

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -72,7 +72,9 @@ function setupRequestMapCleanup() {
         }
       }
       // Here removing request data corresponding to transactionId
-      requestManager.gcRequestMap(transaction.id)
+      setTimeout(() => {
+        requestManager.gcRequestMap(transaction);
+      }, 5000);
     })
   }
 }
@@ -88,7 +90,6 @@ function outboundHook(shim, mod, method, moduleName) {
   shim.wrap(mod, method, function makeRequestWrapper(shim, fn) {
     return function requestWrapper() {
       const request = requestManager.getRequest(shim);
-
       const data = {};
       data.headers = {};
       data.method = arguments[0].method;
@@ -96,7 +97,6 @@ function outboundHook(shim, mod, method, moduleName) {
       data.protocol = arguments[0].protocol ? arguments[0].protocol : 'http:';
       data.headers.host = arguments[0].hostname ? arguments[0].hostname : arguments[0].host;
       data.port = arguments[0].port;
-
       if (method === 'get') {
         data.method = 'GET';
         data.path = '/';
@@ -107,13 +107,11 @@ function outboundHook(shim, mod, method, moduleName) {
 
         }
       }
-
       let completeURL = data.protocol + '//' + data.headers.host + (data.port ? (':' + data.port) : '') + data.path;
       completeURL = completeURL.split(QUESTION_MARK)[0];
 
       if (request && !lodash.isEmpty(data.headers.host) && !lodash.isEmpty(data.path)) {
         const appUUID = API.getSecAgent().applicationInfo.applicationUUID;
-
         const id = secUtils.getExecutionId().toString();
         let generateFlag = false;
         if (arguments[0] && arguments[0].headers && arguments[0].headers.SECHOOK === id) {
@@ -130,7 +128,6 @@ function outboundHook(shim, mod, method, moduleName) {
         }
 
         let traceHeader = EMPTY_STRING;
-
         if (request.headers['nr-csec-tracing-data']) {
           traceHeader = request.headers['nr-csec-tracing-data'];
         }
@@ -235,6 +232,13 @@ function addRequestData(shim, request) {
         data.parameterMap = storedRequest.parameterMap;
       }
       requestManager.setRequest(transactionId, data);
+      if (shim.agent.getLinkingMetadata()) {
+        let linkingMetadata = shim.agent.getLinkingMetadata();
+        if (linkingMetadata['trace.id']) {
+          let traceId = linkingMetadata['trace.id'];
+          requestManager.setRequest(traceId, data)
+        }
+      }
       parseFuzzheaders(data, transactionId);
     }
   } catch (error) {

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -5,13 +5,19 @@
 
 const requestManager = require("../../core/request-manager");
 
-const async_hooks = require("async_hooks");
 const secUtils = require('../../core/sec-utils');
 const API = require("../../../nr-security-api");
 const securityMetaData = require('../../core/security-metadata');
 const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
 const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 const logger = API.getLogger();
+const symbols = {
+  unwrapConnection: Symbol('unwrapConnection'),
+  unwrapPool: Symbol('unwrapPool'),
+  clusterOf: Symbol('clusterOf'),
+  createPoolCluster: Symbol('createPoolCluster'),
+  wrappedPoolConnection: Symbol('wrappedPoolConnection')
+}
 
 module.exports = initialize;
 
@@ -34,37 +40,53 @@ function initialize(shim, mysql, moduleName) {
  * Wrapper for mysql module hooks
  * @param {*} shim 
  * @param {*} mysql 
- * @param {*} moduleName 
  */
-function callbackInitialize(shim, mysql, moduleName) {
-  shim.__wrappedPoolConnection = false;
+function callbackInitialize(shim, mysql) {
+  shim[symbols.wrappedPoolConnection] = false
 
   shim.wrapReturn(mysql, "createConnection", wrapCreateConnection);
   function wrapCreateConnection(shim, fn, fnName, connection) {
+    if (shim[symbols.unwrapConnection]) {
+      return
+    }
+
     if (wrapQueryable(shim, connection, false)) {
       const connProto = Object.getPrototypeOf(connection);
-      shim.unwrap(mysql, "createConnection");
+      shim[symbols.unwrapConnection] = true
     }
   }
 
   shim.wrapReturn(mysql, "createPool", wrapCreatePool);
   function wrapCreatePool(shim, fn, fnName, pool) {
+    if (shim[symbols.unwrapPool]) {
+      return
+    }
+
     if (wrapQueryable(shim, pool, true) && wrapGetConnection(shim, pool)) {
-      shim.unwrap(mysql, "createPool");
+      shim[symbols.unwrapPool] = true
     }
   }
 
   shim.wrapReturn(mysql, "createPoolCluster", wrapCreatePoolCluster);
   function wrapCreatePoolCluster(shim, fn, fnName, poolCluster) {
+    if (shim[symbols.createPoolCluster]) {
+      return
+    }
+
     const proto = Object.getPrototypeOf(poolCluster);
     shim.wrapReturn(proto, "of", wrapPoolClusterOf);
     function wrapPoolClusterOf(shim, of, _n, poolNamespace) {
-      if (wrapGetConnection(shim, poolNamespace)) {
-        shim.unwrap(proto, "of");
+      if (poolNamespace[symbols.clusterOf]) {
+        return
+      }
+
+      if (wrapGetConnection(shim, poolNamespace) && wrapQueryable(shim, poolNamespace, false)) {
+        poolNamespace[symbols.clusterOf] = true
       }
+
     }
     if (wrapGetConnection(shim, poolCluster)) {
-      shim.unwrap(mysql, "createPoolCluster");
+      shim[symbols.createPoolCluster] = true
     }
   }
 }
@@ -101,9 +123,12 @@ function wrapGetConnection(shim, connectable) {
       const args = shim.toArray(arguments);
       const cbIdx = args.length - 1;
 
-      if (shim.isFunction(args[cbIdx]) && !shim.isWrapped(args[cbIdx])) {
+      // avoid an infinite loop and check both the cb and the "original" cb before re-wrapping
+      // this is only applicable now with the security agent + us doing the same thing
+      const original = shim.getOriginalOnce(args[cbIdx])
+      if (shim.isFunction(args[cbIdx]) && !(shim.isWrapped(args[cbIdx]) || shim.isWrapped(original))) {
         let cb = args[cbIdx];
-        if (!shim.__wrappedPoolConnection) {
+        if (!shim[symbols.wrappedPoolConnection]) {
           cb = shim.wrap(cb, wrapGetConnectionCallback);
         }
         args[cbIdx] = shim.bindSegment(cb);
@@ -121,7 +146,7 @@ function wrapGetConnectionCallback(shim, cb) {
       if (!err && wrapQueryable(shim, conn, false)) {
         // Leave getConnection wrapped in order to maintain TX state, but we can
         // simplify the wrapping of its callback in future calls.
-        shim.__wrappedPoolConnection = true;
+        shim[symbols.wrappedPoolConnection] = true
       }
     } catch (_err) { }
     return cb.apply(this, arguments);
@@ -186,7 +211,6 @@ function extractQueryArgs(shim, args) {
  * @param {*} method 
  */
 function queryHook(shim, mod, method, isPoolQuery) {
-
   shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
     return function queryWrapper() {
       const parameters = extractQueryArgs(shim, arguments);
@@ -229,4 +253,4 @@ function callbackHook(shim, mod, fun, secEvent) {
       return fn.apply(this, arguments);
     }
   })
-}
+}

package/lib/nr-security-agent/index.js

@@ -18,12 +18,12 @@ const {
     IS_LAMBDA_ENV,
     AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER,
     LAMBDA_TASK_ROOT_ENV_IDENTIFIER,
-    LOG_MESSAGES } = njsAgentConstants;
+    LOG_MESSAGES, SLASH } = njsAgentConstants;
 const commonUtils = require('./lib/core/commonUtils');
 
 const { AGENT_DIR } = agentConfig;
 // eslint-disable-next-line no-unused-vars
-const DIR_IDENTIFIER = '/';
+const DIR_IDENTIFIER = SLASH;
 const SPACE_CHARACTER = ' ';
 // eslint-disable-next-line no-control-regex
 const NULL_CHAR_REGEX = /\u0000/g;
@@ -106,10 +106,10 @@ function initialize() {
     initLogger.info("[STEP-3] => Gathering information about the application :", JSON.stringify(applicationInfo));
     if (NRAgent) {
         NRAgent.on('started', () => {
-            if (NRAgent.config.security.enabled) {
+            if (NRAgent.config.security.enabled || !NRAgent.config.high_security) {
                 wsClient.initialize();
                 logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
-                Agent.getAgent().status.setStatus('active');
+                Agent.getAgent().status.setStatus('connecting');
                 Agent.setNRAgent(NRAgent);
             }
             else {

package/lib/nr-security-agent/lib/core/Policy.js

@@ -61,7 +61,10 @@ function setPolicyData(data) {
 
 // function to setup default policy provided in resources directory
 function setDefaultPolicy() {
-    const default_policy_file = path.resolve(__dirname, '../../resources/default-policy.yaml');
+    let default_policy_file = path.resolve(__dirname, '../../resources/default-policy.yaml');
+    if(process.platform == 'win32'){
+        default_policy_file = path.resolve(__dirname, '..\\..\\resources\\default-policy.yaml');
+    }
     // Get document, or throw exception on error
     try {
         const default_policy = yaml.load(fs.readFileSync(default_policy_file, 'utf8'));

package/lib/nr-security-agent/lib/core/agent-status.js

@@ -36,7 +36,8 @@ SecAgentStatus.codes = {
     CONNECTING: 'connecting',
     ACTIVE: "active",
     DISABLED: "disabled",
-    DETACHED: "detached"
+    DETACHED: "detached",
+    INACTIVE:'inactive'
 }
 
 /**

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -34,7 +34,7 @@ const SELF_PROC_DIR = '/proc/self';
 const CGROUP_FILE_NAME = '/proc/self/cgroup';
 const STAT = '/stat';
 const CMD_LINE_FILE = '/cmdline';
-const DIR_IDENTIFIER = '/';
+const DIR_IDENTIFIER = SLASH;
 const NEW_LINE_SEPERATOR = '\n';
 const CGROUP_FILE = '/cgroup';
 const ESCAPED_DOT = '.';
@@ -425,7 +425,7 @@ function getProcStartTime () {
 function setBuildDetails (agentDir, applicationInfo) {
     const jsonFileHandler = new JsonHandler(PACKAGE_JSON_FILE, agentDir);
     const pkg = jsonFileHandler.getJSON();
-    applicationInfo.collectorVersion = pkg.collectorVersion;
+    applicationInfo.collectorVersion = pkg.version;
     applicationInfo.jsonVersion = pkg.jsonVersion;
     applicationInfo.buildNumber = pkg.version;
 }
@@ -440,8 +440,6 @@ function isK8S () {
 
 function getHostName () {
     try {
-        // const hostFile = fs.readFileSync("/etc/hostname");
-        // return hostFile.toString().trim();
         return OS.hostname();
     } catch (err) {
         return EMPTY_STRING;

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -8,12 +8,11 @@ const fs = require('fs');
 const uuidv4 = require('uuid/v4');
 const logs = require('./logging');
 const logger = logs.getLogger();
-const cp = require('child_process');
 const OS = require('os');
 const path = require('path');
 const checkDiskSpace = require('check-disk-space').default;
 const AgentStatus = require('../core/agent-status');
-const { LOG_MESSAGES, CSEC_HOME } = require('./sec-agent-constants');
+const { LOG_MESSAGES, CSEC_HOME, SLASH } = require('./sec-agent-constants');
 
 const prettyBytes = require('pretty-bytes');
 const njsAgentConstants = require('./sec-agent-constants');
@@ -22,7 +21,7 @@ const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const lodash = require('lodash')
 const backupLogFileRegex = /.log.\d/gm;
-
+let websocketHealth;
 /**
  * Utility to generate UUID
  * @returns UUID
@@ -120,15 +119,15 @@ function getOS () {
  * Utility to create directories
  */
 function createDirectories () {
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/logs`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/logs/snapshots`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent/${getUUID()}`);
-    createPathIfNotExist(`${CSEC_HOME}/nr-security-home/tmp/language-agent/${getUUID()}/ds-tmp`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs${SLASH}snapshots`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}`);
+    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}${SLASH}ds-tmp`);
     try {
-        fs.chmodSync(`${CSEC_HOME}/nr-security-home`, 0o777);
+        fs.chmodSync(`${CSEC_HOME}${SLASH}nr-security-home`, 0o777);
     } catch (error) {
     }
 }
@@ -238,8 +237,7 @@ async function getHCStats () {
  * Utility to check Agent status
  */
 function isAgentActiveState () {
-    const linkingMetaData = LinkingMetaData.getLinkingMetadata();
-    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true)) {
+    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true) && getWSHealthStatus()=='OK') {
         return 'OK';
     } else {
         return 'Error';
@@ -254,14 +252,14 @@ function iastRestClientStatus () {
  */
 function removeOlderSnapshots () {
     try {
-        const basePath = njsAgentConstants.LOG_DIR + 'snapshots/';
+        const basePath = njsAgentConstants.LOG_DIR + 'snapshots'+ SLASH;
         const directoryContent = fs.readdirSync(basePath);
         const files = directoryContent.filter((filename) => {
-            return fs.statSync(`${basePath}/${filename}`).isFile();
+            return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
         });
         const sorted = files.sort((a, b) => {
-            const firstStat = fs.statSync(`${basePath}/${a}`);
-            const secondStat = fs.statSync(`${basePath}/${b}`);
+            const firstStat = fs.statSync(`${basePath}${SLASH}${a}`);
+            const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
         for (let i = 99; i < sorted.length; i++) {
@@ -292,12 +290,12 @@ function removeOlderlogfiles () {
         // eslint-disable-next-line array-callback-return
         const files = directoryContent.filter((filename) => {
             if (filename.match(backupLogFileRegex)) {
-                return fs.statSync(`${basePath}/${filename}`).isFile();
+                return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
             }
         });
         const sorted = files.sort((a, b) => {
-            const firstStat = fs.statSync(`${basePath}/${a}`);
-            const secondStat = fs.statSync(`${basePath}/${b}`);
+            const firstStat = fs.statSync(`${basePath}${SLASH}${a}`);
+            const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
 
@@ -384,9 +382,33 @@ function getCSECmode(){
  * @returns 
  */
 function getPathOfCACert(){
-    const certPath = NRAgent && NRAgent.config.security.ca_bundle_path ? NRAgent.config.security.ca_bundle_path : path.resolve(__dirname, '../../resources/cert.pem');
+    let relativePath = path.resolve(__dirname, '../../resources/cert.pem');
+    if(process.platform == 'win32'){
+        relativePath = path.resolve(__dirname, '..\\..\\resources\\cert.pem');
+    }
+    const certPath = NRAgent && NRAgent.config.security.ca_bundle_path ? NRAgent.config.security.ca_bundle_path : relativePath;
     return certPath
 }
+/**
+ * Setting ws health status
+ * @param {*} status 
+ */
+function setWSHealthStatus(status){
+    websocketHealth = status;
+}
+
+/**
+ * Returns value of websocketHealth
+ * @returns websocketHealth
+ */
+function getWSHealthStatus(){
+    if(!websocketHealth){
+        return 'Error';
+    }
+    else{
+        return websocketHealth;
+    }
+}
 
 module.exports = {
     getUUID,
@@ -407,5 +429,7 @@ module.exports = {
     logRollOver,
     getValidatorServiceEndpointURL,
     getCSECmode,
-    getPathOfCACert
+    getPathOfCACert,
+    getWSHealthStatus,
+    setWSHealthStatus
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -10,7 +10,7 @@ const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { hasWorker: isWorkerSupported } = require('../../../commonUtils');
-const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID } = require('../../../sec-agent-constants');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
@@ -24,7 +24,7 @@ const {
 } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
-const find = '/{{NR_CSEC_VALIDATOR_HOME_TMP}}';
+const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 
 let logger;

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -14,7 +14,6 @@ const { Agent } = require('../../agent');
 const logs = require('../../logging');
 const hc = require('../../health-check');
 const fs = require('fs');
-const path = require('path');
 const { promisify } = require('../../sec-util');
 const ResponseHandler = require('./response');
 const { EMPTY_APPLICATION_UUID, LOG_MESSAGES } = require('../../sec-agent-constants');
@@ -27,6 +26,7 @@ const CONNECTING = 'connecting';
 const WS_ON_OPEN = 'open';
 const WS_ON_MSG = 'message';
 const WS_ON_ERR = 'error';
+const WS_ON_PONG = 'pong';
 const ACK = 'ACK';
 const INIT_PING_RETRY_DELAY_ON_FAIL = 200; // in ms
 const RECONNECTION_DELAY = 500; // ms
@@ -39,6 +39,7 @@ const initLogger = logs.getInitLogger();
 let webSocket;
 let pingIntervalConst;
 let initTimeOut;
+let lastPongtime;
 
 /**
  * defines the WebSocket callbacks object
@@ -107,11 +108,14 @@ SecWebSocket.prototype.init = function init() {
         logger.error("Error in reading certificate:", error);
     }
 
-    webSocket = new WebSocket(validatorService, null, { headers: authHeaders, cert: cert });
+    webSocket = new WebSocket(validatorService, null, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
 
     webSocket.on(WS_ON_OPEN, this.openCB);
     webSocket.on(WS_ON_MSG, this.msgCB);
     webSocket.on(WS_ON_ERR, this.errCB);
+    webSocket.on(WS_ON_PONG, () => {
+        lastPongtime = Date.now();
+    })
     this.instance = webSocket;
 };
 
@@ -121,7 +125,6 @@ SecWebSocket.prototype.init = function init() {
  */
 SecWebSocket.prototype.reconnect = function reconnect() {
     const { instance } = this;
-
     if (instance.readyState === WebSocket.CONNECTING &&
         process.env.CSEC_WS_STATE === CONNECTING) {
         return;
@@ -133,7 +136,7 @@ SecWebSocket.prototype.reconnect = function reconnect() {
         this.openCB();
         return;
     }
-    process.env.WS_HEALTH = 'Error';
+    commonUtils.setWSHealthStatus('Error');
     logger.debug(LOG_MESSAGES.DETECTED_BROKEN_CONN);
     this.obeyReconnect();
 
@@ -141,10 +144,10 @@ SecWebSocket.prototype.reconnect = function reconnect() {
 
 SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
     const { instance } = this;
-    if(initTimeOut){
+    if (initTimeOut) {
         clearTimeout(initTimeOut);
     }
-    
+
     initTimeOut = setTimeout(() => {
         logger.debug("Terminating ws instance and reconnecting");
         try {
@@ -159,16 +162,26 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
 
 SecWebSocket.prototype.pingWS = async function pingWS() {
     const self = this;
+    let currentTime = Date.now();
+    let timeDiffInPing = (currentTime - lastPongtime) / 1000;
+    if (timeDiffInPing > 40 && lastPongtime != 0) {
+        self.obeyReconnect();
+        lastPongtime = 0;
+        return;
+    }
     try {
         await promisify(self.instance, self.instance.ping)(ACK, true, function (err) {
             if (err) {
                 logger.debug("Error while pinging:", err);
+                commonUtils.setWSHealthStatus('Error');
+                statusUtils.addErrortoBuffer(err);
                 self.obeyReconnect();
             }
         });
     } catch (err) {
         logger.debug("error in ping:", err);
         statusUtils.addErrortoBuffer(err);
+        commonUtils.setWSHealthStatus('Error');
         return;
     }
 }
@@ -188,16 +201,19 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
         !this.isICReadyForEvents
     ) {
         handleDispatchFailure(this, event, eventStr);
+        commonUtils.setWSHealthStatus('Error')
         return;
     }
     try {
         aquireWebSocket();
-        logger.debug(LOG_MESSAGES.EVENT_SENT + eventStr);
-        await promisify(this.instance, this.instance.send)(eventStr, { mask: true });
+        await promisify(this.instance, this.instance.send)(eventStr, { mask: true }, () => {
+            logger.debug(LOG_MESSAGES.EVENT_SENT + eventStr);
+        });
         releaseWebSocket();
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
         statusUtils.addErrortoBuffer(error);
+        commonUtils.setWSHealthStatus('Error')
         handleDispatchFailure(this, event, eventStr);
     }
 };
@@ -278,10 +294,6 @@ const handleDispatchFailure = (self, event, eventStr) => {
         hc.getInstance().registerEventDrop();
         queue.enq(eventStr);
     }
-    process.env.WS_HEALTH = 'Error';
-    // If the reconnection is not already in progress
-    // we would want to reconnect to IC
-    // self.reconnect();
 };
 
 /**
@@ -316,8 +328,8 @@ const defaultOnOpenCB = () => async function onOpen() {
     try {
 
         this.wsRetryCount = 0;
-        process.env.WS_HEALTH = 'OK';
-
+        commonUtils.setWSHealthStatus('OK')
+        Agent.getAgent().status.setStatus('active');
         const applicationInfo = APP_INFO || Agent.getAgent().applicationInfo;
         await self.dispatchApplicationInfo(applicationInfo);
 
@@ -328,11 +340,11 @@ const defaultOnOpenCB = () => async function onOpen() {
         await self.flushEventQueue();
         ResponseHandler.FuzzRequestHandler.setLastFuzzEnventTime();
         releaseWebSocket();
-        initLogger.info(LOG_MESSAGES.SENDING_APPINFO_COMPLETE, JSON.stringify(applicationInfo)); 
+        initLogger.info(LOG_MESSAGES.SENDING_APPINFO_COMPLETE, JSON.stringify(applicationInfo));
     } catch (err) {
         logger.error(`Connection broken: ${err.message}`);
         statusUtils.addErrortoBuffer(err);
-        process.env.WS_HEALTH = 'Error';
+        commonUtils.setWSHealthStatus('Error')
         setWebSocketConn();
         self.setValidatorNotReadyForEvents();
         setTimeout(self.openCB, INIT_PING_RETRY_DELAY_ON_FAIL);
@@ -362,7 +374,9 @@ const defaultOnMsgCB = () => function onMessage(data) {
  *
  * @param {SecWebSocket} self
  */
-const defaultOnErrCB = (error) => function onClose(error) {
+const defaultOnErrCB = () => function onClose(error) {
+    commonUtils.setWSHealthStatus('Error');
+    statusUtils.addErrortoBuffer(error);
     const self = this;
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {
         logger.debug("WS Client Error callback called:", error);
@@ -372,8 +386,6 @@ const defaultOnErrCB = (error) => function onClose(error) {
         aquireWebSocket(true);
         self.reconnect();
     }
-    statusUtils.addErrortoBuffer(new Error('Error connecting to websocket'));
-    process.env.WS_HEALTH = 'Error';
 };
 
 SecWebSocket.Events = {

package/lib/nr-security-agent/lib/core/logging.js

@@ -9,7 +9,6 @@ const fs = require('fs');
 
 const log4js = require('log4js');
 const { ENV: env } = require('../../resources/config');
-const cp = require('child_process');
 
 const INFO = 'info';
 const LOG_FILE_SIZE = 50485760 * 10000;
@@ -17,11 +16,14 @@ const LOG_PATTERN_OBJ = {
     type: 'pattern',
     pattern: '%[%d[%p][%c][%h][%z]%] %m'
 };
-const { LOG_MESSAGES, LOG_DIR } = require('./sec-agent-constants');
+const { LOG_DIR } = require('./sec-agent-constants');
 let logger;
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 
+const logFileName = `${LOG_DIR}node-security-collector.log`;
+const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
+
 function createLogPathIfNotExist (dir) {
     try {
         if (!fs.existsSync(dir)) {
@@ -57,9 +59,6 @@ function initialize (applicationUUID) {
     } catch (error) {
     }
 
-    const logFileName = `${LOG_DIR}node-security-collector.log`;
-    const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
-
     Object.assign(appenders.NR_CSEC, {
         filename: logFileName,
         maxLogSize: LOG_FILE_SIZE,
@@ -143,6 +142,12 @@ function getLogger (applicationUUID = process.env.applicationUUID) {
         initialize(applicationUUID);
         logger = log4js.getLogger('NR_CSEC');
         const initLogger = getInitLogger();
+        try {
+            fs.chmodSync(`${logFileName}`, 0o777);
+            fs.chmodSync(`${initLogFileName}`, 0o777);
+        } catch (error) {
+            logger.error("Error while setting up permissions on log files", error);
+        }
         initLogger.info("[STEP-2] => Generating unique identifier:",applicationUUID )
         if (NRAgent) {
             setLevel(NRAgent.config.logging.level);

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -10,6 +10,7 @@ const AWS_EXECUTION_ENV_VAR = 'AWS_EXECUTION_ENV';
 const path = require('path');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
+const sep = require('path').sep;
 
 let CSEC_HOME = NRAgent &&  NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home  : require('path').join(process.cwd());
 const CSEC_GROUP_NAME = NRAgent ? NRAgent.config.security.mode : 'IAST';
@@ -19,11 +20,11 @@ const agentStartTime = new Date().toString();
 module.exports = {
     CSEC_HOME: CSEC_HOME,
     CSEC_GROUP_NAME: CSEC_GROUP_NAME,
-    LOG_DIR: `${CSEC_HOME}/nr-security-home/logs/`,
-    CSEC_HOME_TMP: `${CSEC_HOME}/nr-security-home/tmp/language-agent/${process.env.applicationUUID}`,
+    LOG_DIR: `${CSEC_HOME}${sep}nr-security-home${sep}logs${sep}`,
+    CSEC_HOME_TMP: `${CSEC_HOME}${sep}nr-security-home${sep}tmp${sep}language-agent${sep}${process.env.applicationUUID}`,
     AGENT_START_TIME: agentStartTime,
     FRAMEWORK: '',
-    STATUS_LOG_FILE: `${CSEC_HOME}/nr-security-home/logs/snapshots/node-security-collector-status-${process.env.applicationUUID}.log`,
+    STATUS_LOG_FILE: `${CSEC_HOME}${sep}nr-security-home${sep}logs${sep}snapshots${sep}node-security-collector-status-${process.env.applicationUUID}.log`,
 
     DB_LIST: {
         MYSQL: 'MYSQL',
@@ -83,7 +84,7 @@ module.exports = {
     COLON: ':',
     OPEN_PARANTHESIS: '(',
     CLOSE_PARANTHESIS: ')',
-    SLASH: '/',
+    SLASH: sep,
     INCOMING_MSG: 'IncomingMessage',
     OBJECT: 'object',
     STRING: 'string',

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -133,9 +133,9 @@ function generateExitEvent(secEvent) {
 
 function sendEvent(secEvent) {
     const agentModule = Agent.getAgent();
-    if (agentModule.status.getStatus() === 'active' && NRAgent.config.security.enabled) {
+    if (agentModule.status.getStatus() != 'connecting' && NRAgent.config.security.enabled) {
         agentModule.client.dispatcher(secEvent);
-        if (!firstEventSent) {
+        if (!firstEventSent && agentModule.status.getStatus() === 'active') {
             initLogger.info("[STEP-8] => First event sent for validation. Security Agent started successfully", JSON.stringify(secEvent));
             firstEventSent = true;
         }

package/lib/nr-security-agent/lib/core/sha-size-util.js

@@ -264,23 +264,10 @@ function getSHA256ForFileSync (filePath) {
  */
 function getSHA256ForData (data) {
     try {
-        if (!process.traceMap) {
-            return hash.sha256().update(data).digest(HEX_DIGEST); ;
-        }
-        const cachedSha = process.traceMap.get(data);
-
-        if (cachedSha) {
-            return cachedSha;
-        } else {
-            const calSha = hash.sha256().update(data).digest(HEX_DIGEST);
-            if (process.traceMap.size < 2000 && (httpreq && httpreq.data)) {
-                process.traceMap.set(data, calSha);
-            }
-            return calSha;
-        }
+        const calSha = hash.sha256().update(data).digest(HEX_DIGEST);
+        return calSha;
     } catch (err) {
-        logger.error('Unable to calculate SHA256 for data.');
-        logger.debug(err);
+        logger.debug('Unable to calculate SHA256 for data.',err);
         return null;
     }
 }

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -6,7 +6,8 @@
 /* eslint-disable new-cap */
 
 const njsAgentConstants = require('./sec-agent-constants');
-const path = require('path').resolve(__dirname, '../../');
+const agentConfig = require('../../resources/config');
+const { AGENT_DIR } = agentConfig;
 const lodash = require('lodash');
 
 let errors = [];
@@ -24,33 +25,33 @@ const logger = logs.getLogger();
 const statusFile = njsAgentConstants.STATUS_LOG_FILE;
 
 const statusTemplate = 'Snapshot timestamp: : %s\n' +
-`CSEC Agent start timestamp: ${njsAgentConstants.AGENT_START_TIME} with application uuid:${commonUtils.getUUID()}\n` +
-`SEC_HOME: ${njsAgentConstants.CSEC_HOME}\n` +
-`Agent location: ${path}\n` +
-`Using CSEC Agent for Node.js, Node version:${process.version}, PID:${process.pid}\n` +
-`Process title: ${process.title}\n` +
-`Process binary: ${process.execPath}\n` +
-'Application location: %s\n' +
-`Current working directory: ${process.cwd()}\n` +
-`Agent mode: ${commonUtils.getCSECmode()}\n` +
-'Application server: %s\n' +
-'Application Framework: %s\n' +
-`Websocket connection to Prevent Web: ${commonUtils.getValidatorServiceEndpointURL()}, Status: %s\n` +
-'Instrumentation successful:\n' +
-'Tracking loaded modules in the application:\n' +
-'Policy applied successfully. Policy version is: %s\n' +
-'Started Health Check for Agent\n' +
-'Started Inbound and Outbound monitoring \n' +
-'\nProcess stats:\n%s\n' +
-'\nService stats:\n%s\n' +
-'\nLast 5 errors: \n%s\n' +
-'\nLast 5 Health Checks are:\n %s \n';
+    `CSEC Agent start timestamp: ${njsAgentConstants.AGENT_START_TIME} with application uuid:${commonUtils.getUUID()}\n` +
+    `SEC_HOME: ${njsAgentConstants.CSEC_HOME}\n` +
+    `Agent location: ${AGENT_DIR}\n` +
+    `Using CSEC Agent for Node.js, Node version:${process.version}, PID:${process.pid}\n` +
+    `Process title: ${process.title}\n` +
+    `Process binary: ${process.execPath}\n` +
+    'Application location: %s\n' +
+    `Current working directory: ${process.cwd()}\n` +
+    `Agent mode: ${commonUtils.getCSECmode()}\n` +
+    'Application server: %s\n' +
+    'Application Framework: %s\n' +
+    `Websocket connection to Prevent Web: ${commonUtils.getValidatorServiceEndpointURL()}, Status: %s\n` +
+    'Instrumentation successful:\n' +
+    'Tracking loaded modules in the application:\n' +
+    'Policy applied successfully. Policy version is: %s\n' +
+    'Started Health Check for Agent\n' +
+    'Started Inbound and Outbound monitoring \n' +
+    '\nProcess stats:\n%s\n' +
+    '\nService stats:\n%s\n' +
+    '\nLast 5 errors: \n%s\n' +
+    '\nLast 5 Health Checks are:\n %s \n';
 
 /**
  * Utility to add hc in hc buffer
  * @param {*} healthCheck
  */
-function addHCtoBuffer (healthCheck) {
+function addHCtoBuffer(healthCheck) {
     try {
         bufferedHC.enq(healthCheck);
         lastHC = healthCheck;
@@ -63,9 +64,12 @@ function addHCtoBuffer (healthCheck) {
  * Utility to add error object in error buffer
  * @param {*} error
  */
-function addErrortoBuffer (error) {
+function addErrortoBuffer(error) {
     try {
-        bufferedErrors.enq(error);
+        let errorObj = {
+            'error': error.stack
+        }
+        bufferedErrors.enq(errorObj);
     } catch (error) {
         logger.debug(error);
     }
@@ -74,19 +78,19 @@ function addErrortoBuffer (error) {
 /**
  * utility to format status template with dynamic values
  */
-function getFormattedData () {
+function getFormattedData() {
     const Agent = require('./agent').Agent.getAgent();
     const appInfo = Agent.applicationInfo;
     const deployedApplications = appInfo && appInfo.serverInfo && appInfo.serverInfo.deployedApplications;
     const appLoc = deployedApplications[0].deployedPath;
-    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK, process.env.WS_HEALTH, appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
+    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK,commonUtils.getWSHealthStatus(), appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
     return formattedSnapshot;
 }
 
 /**
  * utility to write snapshot in snapshot file
  */
-function writeSnapshot () {
+function writeSnapshot() {
     const snapshot = getFormattedData();
     commonUtils.removeOlderSnapshots();
     fs.writeFile(statusFile, snapshot, { mode: 0o777 }, function (err) {
@@ -105,14 +109,14 @@ function writeSnapshot () {
 /**
  * return buffered error instance.
  */
-function getRingBufferedErrors () {
+function getRingBufferedErrors() {
     return bufferedErrors;
 }
 
 /**
  * return buffered HC list without null, undefined
  */
-function getBufferedHC () {
+function getBufferedHC() {
     try {
         HC = lodash.compact(bufferedHC._elements);
     } catch (error) {
@@ -124,7 +128,7 @@ function getBufferedHC () {
 /**
  * returns buffered error list without null, undefined
  */
-function getBufferedErrors () {
+function getBufferedErrors() {
     try {
         errors = lodash.compact(bufferedErrors._elements);
     } catch (error) {
@@ -137,7 +141,7 @@ function getBufferedErrors () {
  * Utility to get key val pairs from json object
  * @param {*} jsonObject
  */
-function getKeyValPairs (jsonObject) {
+function getKeyValPairs(jsonObject) {
     let statStr = njsAgentConstants.EMPTY_STR;
     for (const key in jsonObject) {
         statStr = statStr + key + ': ' + jsonObject[key] + '\n';

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -195,7 +195,7 @@ function handleWorkerMessage(json) {
             break;
         }
         case WorkerMessage.TYPE.ERROR: {
-            statusUtils.addErrortoBuffer(msg.getPayload().stack);
+            statusUtils.addErrortoBuffer(msg.getPayload());
             break;
         }
         default:
@@ -206,7 +206,7 @@ function handleWorkerMessage(json) {
  * Sends Agent HelthCheck to Validator.
  */
 const sendHC = async function () {
-    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true)) {
+    if (AgentStatus.getInstance().getStatus() != AgentStatus.CSECAgentStatus.codes.DISABLED && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true)) {
         let json = hc.getInstance().get();
         json = JSON.parse(json);
         json.policyVersion = applicationInfo.policyVersion;
@@ -218,7 +218,7 @@ const sendHC = async function () {
         }
 
         json.serviceStatus = {};
-        json.serviceStatus.websocket = process.env.WS_HEALTH;
+        json.serviceStatus.websocket = commonUtils.getWSHealthStatus();
         json.serviceStatus.logWriter = await commonUtils.isLogAccessible(`${LOG_DIR}node-security-collector.log`);
         json.serviceStatus.initLogWriter = await commonUtils.isLogAccessible(`${LOG_DIR}node-security-collector-init.log`);
         json.serviceStatus.statusLogWriter = await commonUtils.isLogAccessible(njsAgentConstants.STATUS_LOG_FILE);

package/lib/nr-security-agent/resources/config.js

@@ -2,9 +2,15 @@
  * Copyright 2023 New Relic Corporation. All rights reserved.
  * SPDX-License-Identifier: New Relic Pre-Release
  */
+const { platform } = require('os');
 const path = require('path');
 
-const AGENT_DIR = path.join(__dirname, '../../../');
+let AGENT_DIR = path.join(__dirname, '../../../');
+
+if(process.platform == 'win32'){
+    AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
+}
+
 const uuidv4 = require('uuid/v4');
 process.env.applicationUUID = process.env.applicationUUID || uuidv4();
 

package/package.json

@@ -1,9 +1,8 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.0.8",
+  "version": "0.1.1",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "collectorVersion": "1.0.3-limited-preview",
   "jsonVersion": "1.0.1",
   "contributors": [
     {