@newrelic/security-agent 0.1.2 → 0.2.0

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -9,19 +9,19 @@ const stringify = require('fast-safe-stringify');
 const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
-const { hasWorker: isWorkerSupported } = require('../../../commonUtils');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
 const https = require('https');
+const IASTUtil = require('./IASTUtils');
+const CSEC_SEP = ':IAST:';
+
 require('dns').setDefaultResultOrder('ipv4first')
 
 const {
     IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER,
-    CSEC_LAST_FUZZ_REQUEST_TIME
-} = require('../../../sec-agent-constants');
+    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -29,23 +29,71 @@ const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 
 let logger;
 let lastFuzzEventTime = 0;
+let iastIntervalConst;
+let coolDownIntervalConst;
+let additionalCoolDownTime = 0;
+let fuzzedApiIDSet = new Set();
+
+
+/**
+ * utility to start IAST Schedular
+ */
+function startIASTSchedular() {
+    Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    if (iastIntervalConst) {
+        clearInterval(iastIntervalConst);
+    }
+    iastIntervalConst = setInterval(() => {
+        let data = IASTUtil.generateIASTDataRequest();
+        let currentTime = Date.now();
+        let completedListSize = IASTUtil.getCompletedRequestIds().length;
+        let timeDiffInSeconds = ((currentTime - lastFuzzEventTime) / 1000);
+        logger.trace("Time difference since last fuzz request:", timeDiffInSeconds);
+        logger.trace("Completed requests so far:", completedListSize);
+
+        if (timeDiffInSeconds > 5 && additionalCoolDownTime == 0) {
+            Agent.getAgent().client.dispatcher(data);
+        }
+    }, 5000);
+}
+
+/**
+ * Utility to log scanned apiId
+ * @param {*} fuzzHeader 
+ */
+function logScannedApiId(fuzzHeader, requestURL) {
+    try {
+        let apiId = fuzzHeader.split(CSEC_SEP)[0]
+        if (apiId && !fuzzedApiIDSet.has(apiId) ) {
+            fuzzedApiIDSet.add(apiId);
+            logger.info("IAST Scan for API %s with ID : %s started.", requestURL, apiId);
+        }
+    } catch (error) {
+
+    }
+
+}
 
 // handler function to parse fuzz event and prepare fuzz request
-function handler (json) {
-    setLastFuzzEnventTime();
+function handler(json) {
+    setLastFuzzEventTime();
     let rawFuzzRequest = json.arguments[0];
-    logger.debug('Fuzz request received::' + rawFuzzRequest);
     rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
     let fuzzRequest;
     try {
         fuzzRequest = JSON.parse(rawFuzzRequest);
+        fuzzRequest['id'] = json.id;
+        let completedList = IASTUtil.getCompletedRequestIds();
+        if (completedList.includes(json.id)) {
+            return;
+        }
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
     }
     if (!fuzzRequest) {
         return;
     }
-
+    logger.debug('Fuzz request received::' + JSON.stringify(json));
     logger.info('Fuzz request:: Method: ' + fuzzRequest.method);
     logger.info('Fuzz request:: Headers: ' + stringify(fuzzRequest.headers));
     logger.info('Fuzz request:: Data: ' + fuzzRequest.body);
@@ -61,7 +109,7 @@ function handler (json) {
  *
  * @param {Object} fuzzDetails
  */
-function handleFuzzRequest (fuzzDetails) {
+function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
         if (IS_LAMBDA_ENV) {
@@ -71,7 +119,7 @@ function handleFuzzRequest (fuzzDetails) {
             const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
             logger.info('Invoking Lambda:: ARN: ' + arn);
             logger.info('Invoking Lambda:: Version: ' + ver);
-            
+
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
             const type = config.headers['content-type'];
@@ -81,10 +129,16 @@ function handleFuzzRequest (fuzzDetails) {
                     config.headers['content-type'] = splitted[0];
                 }
             }
+
+            if(fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+        
+
             logger.info('Firing http request:: URL: ' + config.url);
 
-            const request = restClient.fireRequest(config);
-            handleFuzzResponse(request, fuzzDetails);
+            const response = restClient.fireRequest(config);
+            handleFuzzResponse(response, fuzzDetails);
         }
     } catch (err) {
         statusUtils.addErrortoBuffer(err);
@@ -101,13 +155,14 @@ function handleFuzzRequest (fuzzDetails) {
 /**
  * Handles the fuzz response Promise.
  *
- * @param {Promise} request
+ * @param {Promise} response
  * @param {Object} fuzzDetails
  */
-function handleFuzzResponse (request, fuzzDetails) {
+function handleFuzzResponse(response, fuzzDetails) {
     const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
-    if (request) {
-        request.then(() => {
+    if (response) {
+        IASTUtil.addRequestId(fuzzRequest.id);
+        response.then(() => {
             logger.info('Fuzz success: ' + rawFuzzRequest);
         }).catch(() => {
             logger.debug('Error occured:', fuzzRequest.url, fuzzRequest);
@@ -121,11 +176,11 @@ function handleFuzzResponse (request, fuzzDetails) {
  *
  * @param {JSON} requestObject
  */
-function parseAxiosHttpRequestToFuzz (requestObject) {
+function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
     let host = serverName + COLON + requestObject.serverPort
     return {
-        url: requestObject.protocol + COLON_SLASH_SLASH + host  + requestObject.url,
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
         method: requestObject.method,
         data: requestObject.body,
         headers: requestObject.headers,
@@ -141,7 +196,7 @@ function parseAxiosHttpRequestToFuzz (requestObject) {
  * set the handler logger
  * @param {*} l
  */
-function setLogger (l) {
+function setLogger(l) {
     logger = l;
 };
 
@@ -149,25 +204,29 @@ function setLogger (l) {
  * Sets the last fuzz event time epoch
  * @param {Number} time
  */
-function setLastFuzzEnventTime (time = Date.now()) {
-    if (isWorkerSupported()) {
-        process.env[CSEC_LAST_FUZZ_REQUEST_TIME] = time;
-    } else {
-        lastFuzzEventTime = time;
-    }
+function setLastFuzzEventTime(time = Date.now()) {
+    lastFuzzEventTime = time;
 }
 
+
 /**
- * Returns last fuzz event time epoch
- * @returns {Number} lastFuzzEventTime
+ * Sets the last fuzz event time epoch
+ * @param {Number} time
  */
-function getLastFuzzEnventTime () {
-    return isWorkerSupported() ? Number.parseInt(process.env[CSEC_LAST_FUZZ_REQUEST_TIME]) : lastFuzzEventTime;
+function setAdditionalCoolDown(timeInSeconds) {
+    additionalCoolDownTime = timeInSeconds ? timeInSeconds : 10;
+    if (coolDownIntervalConst) {
+        clearTimeout(coolDownIntervalConst)
+    }
+    coolDownIntervalConst = setTimeout(() => {
+        additionalCoolDownTime = 0;
+    }, timeInSeconds * 1000);
 }
 
 module.exports = {
     handler,
     setLogger,
-    setLastFuzzEnventTime,
-    getLastFuzzEnventTime
+    setLastFuzzEventTime,
+    startIASTSchedular,
+    setAdditionalCoolDown
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-cool-down.js

@@ -0,0 +1,15 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+let logger;
+
+module.exports.handler = function handler (json) {
+    logger.debug('IAST cool down command received:', JSON.stringify(json));
+    const fuzzRequestHandler = require('./fuzz-request-handler');
+    fuzzRequestHandler.setLastFuzzEventTime();
+    fuzzRequestHandler.setAdditionalCoolDown(json.data);
+};
+
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-record-deletion.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+let logger;
+const IASTUtil = require('./IASTUtils');
+module.exports.handler = function handler (json) {
+    let deletionList =  json.arguments;
+    let count = 0;
+    deletionList.forEach(element => {
+        count++;
+        IASTUtil.removeRequestId(element);
+    });
+    logger.debug("Purging confirmed %s IAST processed records: ", count, JSON.stringify(deletionList));
+
+};
+
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js

@@ -13,6 +13,10 @@ const CollectorPolicyHandler = require('./collector-policy-handler');
 const CollectorPolicyErrorHandler = require('./collecotor-policy-error-handler');
 const NoOpHandler = require('./no-op-handler');
 const WSReconnect = require('./ws-reconnect');
+const coolDown = require('./iast-cool-down');
+const recordDeletion = require('./iast-record-deletion');
+const logs = require('../../../logging');
+let logger = logs.getLogger();
 
 const commandHandlerMap = {
     [SERVER_COMMAND.STARTUP_WELCOME_MSG]: StartupHandshakeHandler,
@@ -20,15 +24,23 @@ const commandHandlerMap = {
     [SERVER_COMMAND.FUZZ_REQUEST]: FuzzRequestHandler,
     [SERVER_COMMAND.COLLECTOR_CONFIG]: CollectorPolicyHandler,
     [SERVER_COMMAND.POLICY_ERROR]: CollectorPolicyErrorHandler,
-    [SERVER_COMMAND.OBEY_WS_RECONNECT]: WSReconnect
+    [SERVER_COMMAND.OBEY_WS_RECONNECT]: WSReconnect,
+    [SERVER_COMMAND.IAST_RECORD_DELETE_CONFIRMATION]:recordDeletion,
+    [SERVER_COMMAND.ENTER_IAST_COOLDOWN]:coolDown
 };
 
 const handle = function handle (json) {
-    if (json && json.controlCommand && json.arguments && commandHandlerMap[json.controlCommand]) {
-        commandHandlerMap[json.controlCommand].handler.call(this, json);
-    } else {
-        NoOpHandler.handler.call(this, json);
+    try {
+        if (json && json.controlCommand && json.arguments && commandHandlerMap[json.controlCommand]) {
+            logger.debug("Incoming Control Command:", JSON.stringify(json));
+            commandHandlerMap[json.controlCommand].handler.call(this, json);
+        } else {
+            NoOpHandler.handler.call(this, json);
+        }
+    } catch (error) {
+        logger.error("Error in handling Control Commnad",error);
     }
+    
 };
 
 const setLogger = function setLogger (logger) {

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -32,8 +32,9 @@ const INIT_PING_RETRY_DELAY_ON_FAIL = 200; // in ms
 const RECONNECTION_DELAY = 500; // ms
 const APPLICATION_INFO_JSON_NAME = 'applicationinfo';
 let APP_INFO;
+let CSEC_WS_STATE = '';
 
-const queue = new RingBuffer(1000);
+const queue = new RingBuffer(10);
 let logger = logs.getLogger();
 const initLogger = logs.getInitLogger();
 let webSocket;
@@ -115,6 +116,11 @@ SecWebSocket.prototype.init = function init() {
     webSocket.on(WS_ON_ERR, this.errCB);
     webSocket.on(WS_ON_PONG, () => {
         lastPongtime = Date.now();
+        commonUtils.setWSHealthStatus('OK');
+        logger.debug("Pong received from Validator");
+    })
+    webSocket.on('close', () => {
+        logger.warn("WS connection closed");
     })
     this.instance = webSocket;
 };
@@ -126,7 +132,7 @@ SecWebSocket.prototype.init = function init() {
 SecWebSocket.prototype.reconnect = function reconnect() {
     const { instance } = this;
     if (instance.readyState === WebSocket.CONNECTING &&
-        process.env.CSEC_WS_STATE === CONNECTING) {
+        CSEC_WS_STATE === CONNECTING) {
         return;
     }
     setWebSocketConn();
@@ -201,19 +207,15 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
         !this.isICReadyForEvents
     ) {
         handleDispatchFailure(this, event, eventStr);
-        commonUtils.setWSHealthStatus('Error')
         return;
     }
     try {
-        aquireWebSocket();
         await promisify(this.instance, this.instance.send)(eventStr, { mask: true }, () => {
             logger.debug(LOG_MESSAGES.EVENT_SENT + eventStr);
         });
-        releaseWebSocket();
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
         statusUtils.addErrortoBuffer(error);
-        commonUtils.setWSHealthStatus('Error')
         handleDispatchFailure(this, event, eventStr);
     }
 };
@@ -263,7 +265,6 @@ SecWebSocket.prototype.setValidatorNotReadyForEvents = function setValidatorNotR
  * recover these events.
  */
 SecWebSocket.prototype.flushEventQueue = async function flushEventQueue() {
-    aquireWebSocket();
     try {
         const sentEvents = [];
         for (let counter = 0; counter < queue.size(); counter += 1) {
@@ -274,9 +275,7 @@ SecWebSocket.prototype.flushEventQueue = async function flushEventQueue() {
         hc.getInstance().registerEventsSent(results.length);
     } catch (err) {
         statusUtils.addErrortoBuffer(err);
-        logger.error('Flush failed, reception of all events on IC couldn\'t be ensured.');
-    } finally {
-        releaseWebSocket();
+        logger.debug('Flush failed, reception of all events on IC couldn\'t be ensured.');
     }
 };
 
@@ -292,7 +291,6 @@ const handleDispatchFailure = (self, event, eventStr) => {
     // so feeding an old applicationinfo JSON would be incorrect
     if (eventStr && event.jsonName !== APPLICATION_INFO_JSON_NAME) {
         hc.getInstance().registerEventDrop();
-        queue.enq(eventStr);
     }
 };
 
@@ -311,6 +309,14 @@ const handleDispatchFailure = (self, event, eventStr) => {
 const defaultOnOpenCB = () => async function onOpen() {
     const self = this;
     lastPongtime = 0;
+
+    if (pingIntervalConst) {
+        clearInterval(pingIntervalConst);
+    }
+    pingIntervalConst = setInterval(() => {
+        self.pingWS();
+    }, 30000)
+
     if (self.isICReadyForEvents) {
         return;
     }
@@ -318,12 +324,7 @@ const defaultOnOpenCB = () => async function onOpen() {
         self.reconnect();
         return;
     }
-    if (pingIntervalConst) {
-        clearInterval(pingIntervalConst);
-    }
-    pingIntervalConst = setInterval(() => {
-        self.pingWS();
-    }, 30000)
+
     const validatorService = commonUtils.getValidatorServiceEndpointURL();
     initLogger.info(`[STEP-4] => Web socket connection to SaaS validator established successfully at ${validatorService}`)
     try {
@@ -334,13 +335,8 @@ const defaultOnOpenCB = () => async function onOpen() {
         const applicationInfo = APP_INFO || Agent.getAgent().applicationInfo;
         await self.dispatchApplicationInfo(applicationInfo);
 
-        // by now we expect IC to be ready
-        aquireWebSocket(true);
         self.setICReadyForEvents();
-        // we would also want the event queue to be flushed
-        await self.flushEventQueue();
-        ResponseHandler.FuzzRequestHandler.setLastFuzzEnventTime();
-        releaseWebSocket();
+        ResponseHandler.FuzzRequestHandler.setLastFuzzEventTime();
         initLogger.info(LOG_MESSAGES.SENDING_APPINFO_COMPLETE, JSON.stringify(applicationInfo));
     } catch (err) {
         logger.error(`Connection broken: ${err.message}`);
@@ -379,12 +375,13 @@ const defaultOnErrCB = () => function onClose(error) {
     commonUtils.setWSHealthStatus('Error');
     statusUtils.addErrortoBuffer(error);
     const self = this;
+    logger.error("Error while connecting to validator:", error.message)
+    logger.warn("Security Agent INACTIVE!!!")
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {
         logger.debug("WS Client Error callback called:", error);
         self.obeyReconnect();
     }
     else {
-        aquireWebSocket(true);
         self.reconnect();
     }
 };
@@ -404,52 +401,17 @@ SecWebSocket.PING_MSG = ACK;
 SecWebSocket.PING_RETRY_INTERVAL = INIT_PING_RETRY_DELAY_ON_FAIL;
 SecWebSocket.RECONNECTION_DELAY = RECONNECTION_DELAY;
 
-/**
- * Checks if the websocket is currently busy
- * by checking on CSEC_WS_STATE
- *
- * @returns {boolean} busy
- */
-function isWebSocketBusy() {
-    return process.env.CSEC_WS_STATE !== IDLE;
-}
 
 /**
  * Sets the websocket state as connecting
  */
 function setWebSocketConn() {
-    process.env.CSEC_WS_ACQUIRED_COUNT = 0;
-    process.env.CSEC_WS_STATE = CONNECTING;
+    CSEC_WS_STATE = CONNECTING;
 }
 
-/**
- * marks the WS being aquired to be used in an operation
- */
-function aquireWebSocket(forced = false) {
-    if (!forced && process.env.CSEC_WS_STATE === CONNECTING) return;
-
-    let count = Number.parseInt(process.env.CSEC_WS_ACQUIRED_COUNT);
-    count += 1;
-    process.env.CSEC_WS_ACQUIRED_COUNT = count;
-    process.env.CSEC_WS_STATE = BUSY;
-}
-
-/**
- * marks the WS being released after use in an operation
- */
-function releaseWebSocket() {
-    const { CSEC_WS_STATE, CSEC_WS_ACQUIRED_COUNT } = process.env;
-    let count = Number.parseInt(CSEC_WS_ACQUIRED_COUNT);
-    count = count > 0 ? count - 1 : 0;
-    process.env.CSEC_WS_ACQUIRED_COUNT = count;
-    process.env.CSEC_WS_STATE = count === 0 && CSEC_WS_STATE !== CONNECTING ? CSEC_WS_STATE : IDLE;
-}
 
 module.exports = {
     WSCallbacks,
     SecWebSocket,
-    isWebSocketBusy,
-    setWebSocketConn,
-    aquireWebSocket,
-    releaseWebSocket
+    setWebSocketConn
 };