@newrelic/security-agent 0.5.0 → 0.7.0

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -9,14 +9,16 @@ const stringify = require('fast-safe-stringify');
 const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
-const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP } = require('../../../sec-agent-constants');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
 const https = require('https');
 const IASTUtil = require('./IASTUtils');
+const LogMessage = require('../../../LogMessage');
 
 require('dns').setDefaultResultOrder('ipv4first')
+const PolicyManager = require('../../../Policy');
 
 const {
     IS_LAMBDA_ENV,
@@ -42,6 +44,16 @@ function startIASTSchedular() {
     if (iastIntervalConst) {
         clearInterval(iastIntervalConst);
     }
+    let probingInterval = 5;
+
+    const policyInstance = PolicyManager.getInstance();
+    if (policyInstance.data) {
+        probingInterval = policyInstance.data.vulnerabilityScan.iastScan.probing.interval;
+    }
+    if (isNaN(probingInterval)) {
+        probingInterval = 5;
+    }
+
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
@@ -55,7 +67,7 @@ function startIASTSchedular() {
         if (timeDiffInSeconds > 5 && additionalCoolDownTime == 0) {
             Agent.getAgent().client.dispatcher(data);
         }
-    }, 5000);
+    }, probingInterval * 1000);
 }
 
 /**
@@ -65,7 +77,7 @@ function startIASTSchedular() {
 function logScannedApiId(fuzzHeader, requestURL) {
     try {
         let apiId = fuzzHeader.split(CSEC_SEP)[0]
-        if (apiId && !fuzzedApiIDSet.has(apiId) ) {
+        if (apiId && !fuzzedApiIDSet.has(apiId)) {
             fuzzedApiIDSet.add(apiId);
             logger.info("IAST Scan for API %s with ID : %s started.", requestURL, apiId);
         }
@@ -87,6 +99,9 @@ function handler(json) {
         IASTUtil.addPendingRequestId(json.id);
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
+        
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Parsing exeception in fuzz request', __filename, error);
+        require('../../../commonUtils').addLogEventtoBuffer(logMessage);
     }
     if (!fuzzRequest) {
         return;
@@ -132,10 +147,10 @@ function handleFuzzRequest(fuzzDetails) {
 
             IASTUtil.completedRequestsMapInit(fuzzRequest.id);
 
-            if(fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
                 logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
             }
-        
+
 
             logger.info('Firing http request:: URL: ' + config.url);
 
@@ -181,7 +196,7 @@ function handleFuzzResponse(response, fuzzDetails) {
 function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
     let host = serverName + COLON + requestObject.serverPort;
-    if(requestObject.headers && requestObject.headers['content-length']){
+    if (requestObject.headers && requestObject.headers['content-length']) {
         delete requestObject.headers['content-length'];
     }
     return {

package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js

@@ -5,7 +5,7 @@
 
 const _ = require('lodash');
 
-const { SERVER_COMMAND } = require('../../../sec-agent-constants');
+const { SERVER_COMMAND, SEVERE } = require('../../../sec-agent-constants');
 const UnsupportedAgentHandler = require('./unsupported-agent-handler');
 const StartupHandshakeHandler = require('./startup-handshake-handler');
 const FuzzRequestHandler = require('./fuzz-request-handler');
@@ -17,6 +17,7 @@ const coolDown = require('./iast-cool-down');
 const recordDeletion = require('./iast-record-deletion');
 const logs = require('../../../logging');
 let logger = logs.getLogger();
+const LogMessage = require('../../../LogMessage');
 
 const commandHandlerMap = {
     [SERVER_COMMAND.STARTUP_WELCOME_MSG]: StartupHandshakeHandler,
@@ -38,7 +39,9 @@ const handle = function handle (json) {
             NoOpHandler.handler.call(this, json);
         }
     } catch (error) {
-        logger.error("Error in handling Control Commnad",error);
+        logger.error("Error in handling Control Command",error);
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error in handling Control Command', __filename, error);
+        require('../../../commonUtils').addLogEventtoBuffer(logMessage);
     }
     
 };

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -17,10 +17,11 @@ const hc = require('../../health-check');
 const fs = require('fs');
 const { promisify } = require('../../sec-util');
 const ResponseHandler = require('./response');
-const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP } = require('../../sec-agent-constants');
+const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP, SEVERE } = require('../../sec-agent-constants');
 const statusUtils = require('../../statusUtils');
 const commonUtils = require('../../commonUtils');
 const IASTUtil = require('../websocket/response/IASTUtils');
+const LogMessage = require('../../LogMessage');
 
 const BUSY = 'busy';
 const IDLE = 'idle';
@@ -109,6 +110,9 @@ SecWebSocket.prototype.init = function init() {
         cert = fs.readFileSync(certPath, 'utf8');
     } catch (error) {
         logger.error("Error in reading certificate:", error);
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error in reading certificate for websocket', __filename, error);
+        commonUtils.addLogEventtoBuffer(logMessage);
+
     }
 
     webSocket = new WebSocket(validatorService, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
@@ -120,6 +124,17 @@ SecWebSocket.prototype.init = function init() {
         lastPongtime = Date.now();
         commonUtils.setWSHealthStatus('OK');
         logger.debug("Pong received from Validator");
+
+        try {
+            let logBuffer = commonUtils.getLogEvents();
+            while (logBuffer.size() > 0) {
+                let logEvent = logBuffer.deq();
+                this.dispatch(logEvent);
+            }
+        } catch (error) {
+            logger.error("Error while sending log events", error);
+        }
+
     })
     webSocket.on('close', () => {
         logger.warn("WS connection closed");
@@ -172,6 +187,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
 SecWebSocket.prototype.pingWS = async function pingWS() {
     const self = this;
     let currentTime = Date.now();
+
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
     if (timeDiffInPing > 40 && lastPongtime != 0) {
         self.obeyReconnect();
@@ -193,6 +209,7 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
         commonUtils.setWSHealthStatus('Error');
         return;
     }
+
 }
 
 /**
@@ -412,6 +429,8 @@ const defaultOnErrCB = () => function onClose(error) {
     statusUtils.addErrortoBuffer(error);
     const self = this;
     logger.error("Error while connecting to validator:", error.message)
+    const logMessage = new LogMessage.logMessage(SEVERE, 'Error while connecting to validator', __filename, error);
+    commonUtils.addLogEventtoBuffer(logMessage);
     logger.warn("Security Agent INACTIVE!!!")
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {
         logger.debug("WS Client Error callback called:", error);

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -108,6 +108,9 @@ module.exports = {
     CSEC_SEP: ':IAST:',
     RASP: 'RASP',
     IAST: 'IAST',
+    SEVERE: 'SEVERE',
+    HIGH: 'HIGH',
+    CRITICAL: 'CRITICAL',
 
     LOG_MESSAGES: {
         LOADED_CSEC_ENVS_MSG: '[STEP-1][COMPLETE][env] Environment Information Gathering Done.',

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -9,10 +9,12 @@ const { SecEvent } = require('./event');
 const logs = require('./logging');
 const { Agent } = require('./agent');
 const shaUtil = require('./sha-size-util');
-const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP } = require('./sec-agent-constants');
+const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP, SEVERE } = require('./sec-agent-constants');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const HC = require('./health-check');
+const LogMessage = require('./LogMessage');
+const commonUtils = require('./commonUtils');
 
 const statusUtils = require('./statusUtils');
 
@@ -67,10 +69,10 @@ function generateSecEvent(securityMetadata) {
     const traceObject = securityMetadata.traceObject;
     const request = securityMetadata.request;
 
-    if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+    if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
         HC.getInstance().iastEventStats.processed++;
     }
-    else{
+    else {
         HC.getInstance().raspEventStats.processed++;
     }
     try {
@@ -102,11 +104,14 @@ function generateSecEvent(securityMetadata) {
     } catch (e) {
         statusUtils.addErrortoBuffer(e);
         logger.error("Error in generating event:", e);
-       
-        if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error while generating event', __filename, e);
+        commonUtils.addLogEventtoBuffer(logMessage);
+
+        if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
             HC.getInstance().iastEventStats.errorCount++;
         }
-        else{
+        else {
             HC.getInstance().raspEventStats.errorCount++;
         }
     }
@@ -141,6 +146,9 @@ function generateExitEvent(secEvent) {
             }
         } catch (error) {
             logger.error('Error in generating exit event', error);
+
+            const logMessage = new LogMessage.logMessage(SEVERE, 'Error in generating exit event', __filename, error);
+            commonUtils.addLogEventtoBuffer(logMessage);
             HC.getInstance().exitEventStats.errorCount++;
         }
     }

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -83,7 +83,7 @@ function getFormattedData() {
     const appInfo = Agent.applicationInfo;
     const deployedApplications = appInfo && appInfo.serverInfo && appInfo.serverInfo.deployedApplications;
     const appLoc = deployedApplications[0].deployedPath;
-    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK,commonUtils.getWSHealthStatus(), appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
+    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK, commonUtils.getWSHealthStatus(), appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
     return formattedSnapshot;
 }
 
@@ -96,6 +96,9 @@ function writeSnapshot() {
     fs.writeFile(statusFile, snapshot, { mode: 0o777 }, function (err) {
         if (err) {
             logger.debug(err.message);
+            const LogMessage = require('./LogMessage');
+            const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating snapshot file', __filename, err);
+            commonUtils.addLogEventtoBuffer(logMessage);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);
             fs.chmod(statusFile, 0o777, (err) => {

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -15,6 +15,7 @@ const initLogger = require('./logging').getInitLogger();
 const commonUtils = require('./commonUtils');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
+const LogMessage = require('./LogMessage');
 const {
     SecWebSocket,
     setWebSocketConn,
@@ -69,6 +70,15 @@ const initialize = function () {
     setTimeout(() => {
         setInterval(sendHC, HC_INTERVAL_MS);
         sendHC();
+        try {
+            const framework = NRAgent.environment.get('Framework')[0];
+            const dispatcher = NRAgent.environment.get('Dispatcher')[0];
+            const logMessage = new LogMessage.logMessage("SEVERE", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
+            commonUtils.addLogEventtoBuffer(logMessage);
+        } catch (error) {
+            logger.debug("Error while extracting data from APM environment",error);
+        }
+
     }, 30000);
 
     setInterval(commonUtils.logRollOver, 30000);
@@ -140,17 +150,18 @@ const sendHC = async function () {
  * @param {JSON} eventJson
  */
 function getDispatcherAndSendEvent(eventJson) {
-    const eventType = eventJson.jsonName;
-    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
-        hc.getInstance().registerEventProcessed();
-    }
+    if (eventJson) {
+        const eventType = eventJson.jsonName;
+        if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
+            hc.getInstance().registerEventProcessed();
+        }
 
-    dispatcher(eventJson);
+        dispatcher(eventJson);
 
-    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
-        hc.getInstance().registerEventSent();
+        if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
+            hc.getInstance().registerEventSent();
+        }
     }
-
 }
 
 /**

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.1.0",
+  "jsonVersion": "1.1.1",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -35,9 +35,8 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "@aws-sdk/client-lambda": "^3.436.0",
-    "axios": "1.6.0",
-    "check-disk-space": "3.4.0",
+    "axios": "^1.6.5",
+    "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",
     "find-package-json": "^1.2.0",