Dynamic Engines - Using Docker

engineStart.bat

@echo off
cd /D "%~dp0"
Powershell.exe -File engineStart.ps1 %*
EXIT /B %ERRORLEVEL%

engineStart.ps1

(Configured only to start a dedicated engine for scans of LOC not greater than 1000).

# parse the script parameters (e.g. -loc, -accessControlUrl, etc.)
param ($scanId, $loc, $accessControlUrl, $messageQueueType, $activeMessageQueueURL, $messageQueueUsername, $messageQueuePassword)

function ExitWithCode
{
    param($pExitCode)

    if ($Host.Name -eq "ConsoleHost")
    {
        #running from the command-line - exit the script
       $host.SetShouldExit($pExitCode)
    }
    else
    {
        #since we are running from PowerShell ISE, just stop the execution
        Stop-Transcript
    }

    Exit $pExitCode
}

Function Get-RandomPort
{
    return Get-Random -Max 32767 -Min 10001;
}

Function Test-PortInUse
{
    Param(
        [Parameter(Mandatory=$true)]
        [Int] $portToTest
    );
    $count = netstat -aon | find `":$portToTest `" /c;
    return [bool]($count -gt 0);
}

Function Get-RandomUsablePort
{
    Param(
        [Int] $maxTries = 100
    );
    $result = -1;
    $tries = 0;
    DO
    {
        $randomPort = Get-RandomPort;
        if (-Not (Test-PortInUse($randomPort)))
        {
            $result = $randomPort;
        }
        $tries += 1;
    } While (($result -lt 0) -and ($tries -lt $maxTries));
    return $result;
}

$parsedLoc = [int]$loc

# handle only scans with LOC not greater than 1000
if ($parsedLoc -gt 1000) {
    # exit with code 0 to instruct SAST application that this scan should be queued as usual for any available public engine
    ExitWithCode 0
}

# configure a unique name for this container, to be able to later terminate it in the cleanup script
$containerName = "cx-engine-scan-${scanId}"
# get a random free port to serve the container in
$port = Get-RandomUsablePort(100)
# define the map that will expose the engine's container port (8088) to the serve port on host
$portMap = "0.0.0.0:${port}:8088"
# get the host's fqdn
$fqdn = [System.Net.Dns]::GetHostByName($env:computerName).HostName
# define the engine's container endpoint
$engineEndpoint = "http://${fqdn}:8088"
# define the engine configuration to automatically register itself, while its only dedicated for the specific scan
$engineConfig = "{ 'Uri': 'http://${fqdn}:${port}/', 'Name': 'docker ${scanId}', 'MinLoc': ${loc}, 'MaxLoc': ${loc}, 'MaxScans': 1, 'Dedications': [{ 'ItemType': 0, 'ItemId': ${scanId} }] }"
# name for this container's volume
$volumeName = "cx-${scanId}"
# define the log path in host
$logPath = "./${volumeName}:/var/checkmarx"

# run the container
docker run -d `
--name ${containerName} `
--env CX_ES_MESSAGE_QUEUE_USERNAME=$messageQueueUsername `
--env CX_ES_MESSAGE_QUEUE_PASSWORD=$messageQueuePassword `
--env CX_ES_MESSAGE_QUEUE_URL=$activeMessageQueueURL `
--env CX_ES_ACCESS_CONTROL_URL=$accessControlUrl `
--env CX_ENGINE_MESSAGE_QUEUE_TYPE=$messageQueueType `
--env CX_ES_END_POINT=$engineEndpoint `
--env CX_ENGINE_REGISTRATION_CONFIG=$engineConfig `
-p $portMap `
-v $logPath `
cx-engine-server

# exiting with code 1 instructs SAST application that this scan should wait for the dedicated engine to own it, and should not be owned by any other engine
ExitWithCode 1

# possible return codes:
#   0: Scan should be queued to any publicly available engine
#   1: Scan has a dedicated engine and should wait for it 
#   500: Startup script has failed with critical error, the associated scan will fail as well
#   X: Startup script has failed, SAST application will retry upto 3 times and eventually the associated scan will fail as well

engineCleanup.bat:

@echo off
cd /D "%~dp0"
Powershell.exe -File engineCleanup.ps1 %*
EXIT /B %ERRORLEVEL%

engineCleanup.ps1:

# parse the script parameters (e.g. -scanId, etc)
param ($scanId, $engineUrl)

function ExitWithCode
{
    param($pExitCode)

    if ($Host.Name -eq "ConsoleHost")
    {
        #running from the command line - exit the script
       $host.SetShouldExit($pExitCode)
    }
    else
    {
        #since we are running from PowerShell ISE, just stop the execution
        Stop-Transcript
    }

    Exit $pExitCode
}

# name for this container, as was specified in the startup script
$containerName = "cx-engine-scan-${scanId}"

# name for this container's volume, as was specified in the startup script
$volumeName = "cx-${scanId}"

# stop and remove the container
docker rm -f $containerName

# remove the container's volume
docker volume rm -f $volumeName

# exiting with code 1 instructs the SAST application that the engine associated with this scan should be unregistered
ExitWithCode 1

# possible return codes:
#   0: Scan should be queued to any publicly available engine
#   1: Scan has a dedicated engine and should wait for it 
#   500: The cleanup script has failed with a critical error
#   X: Cleanup script has failed; SAST application will retry up to 3 times