Security Agent integration updates

newrelic/config.py

@@ -327,6 +327,14 @@ def _process_configuration(section):
     _process_setting(section, "ca_bundle_path", "get", None)
     _process_setting(section, "audit_log_file", "get", None)
     _process_setting(section, "monitor_mode", "getboolean", None)
+    _process_setting(section, "security.agent.enabled", "getboolean", None)
+    _process_setting(section, "security.enabled", "getboolean", None)
+    _process_setting(section, "security.mode", "get", None)
+    _process_setting(section, "security.validator_service_url", "get", None)
+    _process_setting(section, "security.detection.rci.enabled", "getboolean", None)
+    _process_setting(section, "security.detection.rxss.enabled", "getboolean", None)
+    _process_setting(section, "security.detection.deserialization.enabled", "getboolean", None)
+    _process_setting(section, "security.request.body_limit", "get", None)
     _process_setting(section, "developer_mode", "getboolean", None)
     _process_setting(section, "high_security", "getboolean", None)
     _process_setting(section, "capture_params", "getboolean", None)
@@ -4687,6 +4695,24 @@ def _setup_agent_console():
         newrelic.core.agent.Agent.run_on_startup(_startup_agent_console)
 
 
+def _setup_security_module():
+    """Initiates security module and adds a
+    callback to agent startup to propagate NR config
+    """
+    try:
+        if not _settings.security.agent.enabled or _settings.high_security:
+            _logger.warning("New Relic Security is disabled by one of the user provided config `security.agent.enabled` or `high_security`.")
+            return
+        from newrelic_security.api.agent import get_agent
+
+        # initialize security agent
+        security_agent = get_agent()
+        # create a callback to reinitialise the security module
+        newrelic.core.agent.Agent.run_on_startup(security_agent.refresh_agent)
+    except Exception as csec_error:
+        _logger.error("Security Agent Startup failed with error %s", csec_error)
+
+
 def initialize(
     config_file=None,
     environment=None,
@@ -4705,6 +4731,8 @@ def initialize(
 
     _load_configuration(config_file, environment, ignore_errors, log_file, log_level)
 
+    _setup_security_module()
+
     if _settings.monitor_mode or _settings.developer_mode:
         _settings.enabled = True
         _setup_instrumentation()

newrelic/core/config.py

@@ -335,6 +335,32 @@ class ApplicationLoggingLocalDecoratingSettings(Settings):
     pass
 
 
+class SecuritySettings(Settings):
+    pass
+
+
+class SecurityDetectionSettings(Settings):
+    pass
+
+
+class SecurityAgentSettings(Settings):
+    pass
+
+
+class SecurityDetectionRCISettings(Settings):
+    pass
+
+
+class SecurityDetectionRXSSSettings(Settings):
+    pass
+
+
+class SecurityDetectionDeserializationSettings(Settings):
+    pass
+
+class SecurityRequestSettings(Settings):
+    pass
+
 class InfiniteTracingSettings(Settings):
     _trace_observer_host = None
 
@@ -463,6 +489,13 @@ class EventHarvestConfigHarvestLimitSettings(Settings):
 _settings.message_tracer = MessageTracerSettings()
 _settings.process_host = ProcessHostSettings()
 _settings.rum = RumSettings()
+_settings.security = SecuritySettings()
+_settings.security.agent = SecurityAgentSettings()
+_settings.security.detection = SecurityDetectionSettings()
+_settings.security.detection.deserialization = SecurityDetectionDeserializationSettings()
+_settings.security.detection.rci = SecurityDetectionRCISettings()
+_settings.security.detection.rxss = SecurityDetectionRXSSSettings()
+_settings.security.request = SecurityRequestSettings()
 _settings.serverless_mode = ServerlessModeSettings()
 _settings.slow_sql = SlowSqlSettings()
 _settings.span_events = SpanEventSettings()
@@ -480,7 +513,6 @@ class EventHarvestConfigHarvestLimitSettings(Settings):
 _settings.transaction_tracer.attributes = TransactionTracerAttributesSettings()
 _settings.utilization = UtilizationSettings()
 
-
 _settings.log_file = os.environ.get("NEW_RELIC_LOG", None)
 _settings.audit_log_file = os.environ.get("NEW_RELIC_AUDIT_LOG", None)
 
@@ -965,6 +997,17 @@ def default_otlp_host(host):
 _settings.package_reporting.enabled = _environ_as_bool("NEW_RELIC_PACKAGE_REPORTING_ENABLED", default=True)
 _settings.ml_insights_events.enabled = _environ_as_bool("NEW_RELIC_ML_INSIGHTS_EVENTS_ENABLED", default=False)
 
+_settings.security.agent.enabled = _environ_as_bool("NEW_RELIC_SECURITY_AGENT_ENABLED", False)
+_settings.security.enabled = _environ_as_bool("NEW_RELIC_SECURITY_ENABLED", False)
+_settings.security.mode = os.environ.get("NEW_RELIC_SECURITY_MODE", "IAST")
+_settings.security.validator_service_url = os.environ.get("NEW_RELIC_SECURITY_VALIDATOR_SERVICE_URL", None)
+_settings.security.detection.rci.enabled = _environ_as_bool("NEW_RELIC_SECURITY_DETECTION_RCI_ENABLED", True)
+_settings.security.detection.rxss.enabled = _environ_as_bool("NEW_RELIC_SECURITY_DETECTION_RXSS_ENABLED", True)
+_settings.security.detection.deserialization.enabled = _environ_as_bool(
+    "NEW_RELIC_SECURITY_DETECTION_DESERIALIZATION_ENABLED", True
+)
+_settings.security.request.body_limit = os.environ.get("NEW_RELIC_SECURITY_REQUEST_BODY_LIMIT", None)
+
 
 def global_settings():
     """This returns the default global settings. Generally only used

newrelic/newrelic.ini

@@ -49,6 +49,36 @@ app_name = Python Application
 # NEW_RELIC_MONITOR_MODE environment variable.
 monitor_mode = true
 
+# Indicates if attack detection security module is to be enabled
+security.enabled = false
+
+# To completely disable security set flag to false If the flag is
+# set to false, the security module is not loaded. This property
+# is read only once at application start.
+security.agent.enabled = false
+
+
+# security module provides two modes IAST or RASP
+# RASP stands for Runtime Application Self Protection
+# while IAST for Interactive Application Security Testing
+# Default mode is IAST
+security.mode = IAST
+
+
+# web-protect agent endpoint connection URLs
+security.validator_service_url = wss://csec.nr-data.net
+
+
+# vulnerabilty detection flags
+security.detection.rci.enabled = true
+security.detection.rxss.enabled = true
+security.detection.deserialization.enabled = true
+
+
+# security request body read limiting in kb
+security.request.body_limit = 300
+
+
 # Sets the name of a file to log agent messages to. Whatever you
 # set this to, you must ensure that the permissions for the
 # containing directory and the file itself are correct, and
@@ -251,5 +281,4 @@ monitor_mode = true
 
 [newrelic:production]
 monitor_mode = true
-
 # ---------------------------------------------------------------------------

tests/framework_bottle/conftest.py

@@ -25,6 +25,10 @@
     "transaction_tracer.stack_trace_threshold": 0.0,
     "debug.log_data_collector_payloads": True,
     "debug.record_transaction_failure": True,
+    "security.agent.enabled": True,
+    "security.enabled": True,
+    "security.mode": "IAST",
+    "security.validator_service_url": "wss://csec-staging.nr-data.net"
 }
 
 collector_agent_registration = collector_agent_registration_fixture(

tests/framework_django/conftest.py

@@ -27,6 +27,10 @@
     "debug.record_transaction_failure": True,
     "debug.log_autorum_middleware": True,
     "feature_flag": set(["django.instrumentation.inclusion-tags.r1"]),
+    "security.agent.enabled": True,
+    "security.enabled": True,
+    "security.mode": "IAST",
+    "security.validator_service_url": "wss://csec-staging.nr-data.net"
 }
 
 collector_agent_registration = collector_agent_registration_fixture(

tests/framework_flask/conftest.py

@@ -41,6 +41,10 @@
     "debug.log_data_collector_payloads": True,
     "debug.record_transaction_failure": True,
     "debug.log_autorum_middleware": True,
+    "security.agent.enabled": True,
+    "security.enabled": True,
+    "security.mode": "IAST",
+    "security.validator_service_url": "wss://csec-staging.nr-data.net"
 }
 
 collector_agent_registration = collector_agent_registration_fixture(

tox.ini

@@ -188,6 +188,7 @@ deps =
     WebTest==3.0.0
     py313: legacy-cgi==2.6.1  # cgi was removed from the stdlib in 3.13, and is required for WebTest
 
+
     # Test Suite Dependencies
     adapter_asgiref-asgireflatest: asgiref
     adapter_asgiref-asgiref0303: asgiref<3.4