fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-UBUNTU2004-BASH-581100
- https://snyk.io/vuln/SNYK-UBUNTU2004-NETTLE-1303240
- https://snyk.io/vuln/SNYK-UBUNTU2004-NETTLE-1303240
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-1290722
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-1290722

.github/workflows/ci.yml

@@ -41,8 +41,7 @@ jobs:
       run: cd build && cmake --build . --config Release
     - name: Build RPC (Debug)
       run: cd build && cmake --build . --config Debug
-
-
+        
   build-linux:
     runs-on: ${{ matrix.os }}
     strategy:

.github/workflows/docker-ci.yml

@@ -0,0 +1,29 @@
+#*********************************************************************
+# Copyright (c) Intel Corporation 2020
+# SPDX-License-Identifier: Apache-2.0
+#*********************************************************************/
+
+name: Docker Image CI
+
+on:
+  push:
+      branches: [ master ]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Build the Docker image
+        run: docker build -f "Dockerfile" --tag vprodemo.azurecr.io/rpc:${{ github.sha }} --tag vprodemo.azurecr.io/rpc:latest .
+      - name: Docker Login
+        uses: docker/login-action@v1.6.0
+        with:
+          registry: vprodemo.azurecr.io
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          logout: true
+      - name: Push the Docker image to the registry
+        run: docker push vprodemo.azurecr.io/rpc:${{ github.sha }}
+      - name: Push the Docker image to the registry
+        run: docker push vprodemo.azurecr.io/rpc:latest

CHANGELOG.md

@@ -1,3 +1,20 @@
+<a name="v1.2.0"></a>
+## v1.2.0
+
+### Ci
+- breakout docker build for merge only
+
+### Feat
+- update RPC version to 1.2.0.
+- BREAKING CHANGE: add heartbeat capability, bump RPC Protocol version to 4.0.0
+- add unit test framework
+- add hostname to activation info
+- **docker:** add dockerfile support for RPC
+
+### Fix
+- use message status instead, cleanup message fields.
+
+
 <a name="v1.1.0"></a>
 ## [v1.1.0] - 2021-02-09
 

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required (VERSION 3.1)
 
-project (rpc VERSION 1.1.0)
+project (rpc VERSION 1.2.1)
 
 set (CMAKE_CXX_STANDARD 11)
 
@@ -98,6 +98,8 @@ add_executable (rpc
   commands.cpp
   activation.h
   activation.cpp
+  heartbeat.h
+  heartbeat.cpp
   lms.h
   lms.cpp
   main.cpp

Dockerfile

@@ -0,0 +1,37 @@
+#*********************************************************************
+# Copyright (c) Intel Corporation 2021
+# SPDX-License-Identifier: Apache-2.0
+#*********************************************************************/
+
+FROM ubuntu:20.10 AS rpc-builder
+
+WORKDIR /
+ARG DEBIAN_FRONTEND=noninteractive
+RUN \
+  apt-get update -y -qq && \
+  apt install -y -qq \
+    git cmake build-essential libssl-dev zlib1g-dev \
+    curl unzip zip pkg-config ca-certificates
+RUN git clone https://github.com/open-amt-cloud-toolkit/rpc.git
+WORKDIR /rpc
+RUN mkdir -p build
+RUN git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git
+RUN cd vcpkg && ./bootstrap-vcpkg.sh
+RUN ./vcpkg/vcpkg install cpprestsdk[websockets]
+
+WORKDIR /rpc/build
+RUN cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_TOOLCHAIN_FILE=/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake ..
+RUN cmake --build .
+
+FROM ubuntu:20.10 
+
+LABEL license='SPDX-License-Identifier: Apache-2.0' \
+      copyright='Copyright (c) 2021: Intel'
+
+WORKDIR /root
+RUN \
+  apt-get update -y -qq && \
+  apt install -y -qq \
+    libssl-dev
+COPY --from=rpc-builder /rpc/build/rpc .
+ENTRYPOINT ["/root/rpc"]

Jenkinsfile

@@ -0,0 +1,171 @@
+pipeline {
+    agent none
+    options {
+        buildDiscarder(logRotator(numToKeepStr: '5', daysToKeepStr: '30'))
+        timestamps()
+        timeout(unit: 'HOURS', time: 2)
+    }
+    
+    stages {
+        stage ('Parallel') {
+            parallel {
+                stage ('Linux') {
+                    agent { label 'docker-amt' }
+                    stages {
+                        stage ('Cloning Repository') {
+                            steps {
+                                script {
+                                    scmCheckout {
+                                        clean = true
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                stage ('Windows') {
+                    agent { label 'openamt-win' }
+                    stages {
+                        stage ('Cloning Repository') {
+                            steps {
+                                script {
+                                    scmCheckout {
+                                        clean = true
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        stage ('Static Code Scan - Protex') {
+            agent { label 'docker-amt' }
+            steps {
+                script {
+                    staticCodeScan {
+                        // generic
+                        scanners             = ['protex']
+                        scannerType          = ['c','c++']
+
+                        protexProjectName    = 'OpenAMT - RPC'
+                        // internal, do not change
+                        protexBuildName      = 'rrs-generic-protex-build'
+                    }
+                }
+            }
+        }
+
+        stage ('Parallel Builds') {
+            parallel {
+                stage ('Linux') {
+                    agent { label 'docker-amt' }
+                    stages {
+                        stage('Build') {
+                            agent {
+                                docker {
+                                    image 'ubuntu:18.04'
+                                    reuseNode true
+                                }
+                            }
+                            steps {
+                                sh './scripts/jenkins-pre-build.sh'
+                                sh './scripts/jenkins-build.sh'
+                            }
+                        }
+                        stage ('Archive') {
+                            steps {
+                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build/rpc', caseSensitive: false, onlyIfSuccessful: true
+                            }
+                        }
+                        
+                    }
+                }
+                stage ('Windows') {
+                    agent { label 'openamt-win' }
+                    stages{
+                        stage ('Build') {
+                            steps {
+                                bat 'scripts\\jenkins-pre-build.cmd'
+                                bat 'scripts\\jenkins-build.cmd'
+                                // prepare stash for the binary scan
+                                stash includes: "**/*.exe", name: 'rpc-app'
+                            }
+                        }
+                        stage ('Archive') {
+                            steps {
+                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build\\Release\\rpc.exe', caseSensitive: false, onlyIfSuccessful: true
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        stage ('Parallel Scans') {
+            parallel {
+                stage ('Static Code Scan Linux') {
+                    agent { label 'docker-amt' }
+                    steps {
+                        script {
+                            staticCodeScan {
+                                // generic
+                                scanners             = ['bdba','klocwork']
+                                scannerType          = 'c++'
+
+                                protecodeGroup          = '25'
+                                protecodeScanName       = 'rpc-zip'
+                                protecodeDirectory      = './build/rpc'
+                                
+                                klockworkPreBuildScript = './scripts/jenkins-pre-build.sh'
+                                klockworkBuildCommand = './scripts/jenkins-build.sh'
+                                klockworkProjectName  = 'Panther Point Creek'
+                                klockworkIgnoreCompileErrors = true
+                            }
+                        }
+                    }
+                }
+                stage ('Static Code Scan Windows') {
+                    stages {
+                        stage ('Static Code Scan Windows - Klockwork') {
+                            agent { label 'openamt-win' }
+                            steps {
+                                script {
+                                    staticCodeScan {
+                                        // generic
+                                        scanners             = ['klocwork']
+                                        scannerType          = 'c++'
+                                        
+                                        klockworkPreBuildScript = 'scripts\\jenkins-pre-build.cmd'
+                                        klockworkBuildCommand = 'scripts\\jenkins-build.cmd'
+                                        klockworkProjectName  = 'Panther Point Creek'
+                                        klockworkIgnoreCompileErrors = true
+                                    }
+                                }
+                            }
+                        }
+                        stage ('Static Code Scan Windows - BDBA') {
+                            agent { label 'docker-amt' }
+                            steps {
+                                script {
+                                    sh "mkdir -p bdbaScanDir"
+                                    dir("bdbaScanDir") {
+                                        unstash 'rpc-app'
+                                    }
+                                    staticCodeScan {
+                                        // generic
+                                        scanners             = ['bdba']
+                                        scannerType          = 'c++'
+                                        
+                                        protecodeGroup          = '25'
+                                        protecodeScanName       = 'rpc-zip'
+                                        protecodeDirectory      = 'bdbaScanDir'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).

activation.cpp

@@ -236,7 +236,7 @@ bool act_create_request(std::string commands, std::string dns_suffix, std::strin
     utility::string_t tmp = utility::conversions::convertstring(commands);
     msg[U("method")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("key");
+    tmp = utility::conversions::convertstring("");
     msg[U("apiKey")] = web::json::value::string(tmp);
 
     tmp = utility::conversions::convertstring(PROJECT_VER);
@@ -245,10 +245,10 @@ bool act_create_request(std::string commands, std::string dns_suffix, std::strin
     tmp = utility::conversions::convertstring(PROTOCOL_VERSION);
     msg[U("protocolVersion")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("ok");
+    tmp = utility::conversions::convertstring("");
     msg[U("status")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("ok");
+    tmp = utility::conversions::convertstring("");
     msg[U("message")] = web::json::value::string(tmp);
 
     // get the activation payload
@@ -281,7 +281,7 @@ bool act_create_response(std::string payload, std::string& response)
     utility::string_t tmp = utility::conversions::convertstring("response");
     msg[U("method")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("key");
+    tmp = utility::conversions::convertstring("");
     msg[U("apiKey")] = web::json::value::string(tmp);
 
     tmp = utility::conversions::convertstring(PROJECT_VER);
@@ -290,10 +290,10 @@ bool act_create_response(std::string payload, std::string& response)
     tmp = utility::conversions::convertstring(PROTOCOL_VERSION);
     msg[U("protocolVersion")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("ok");
+    tmp = utility::conversions::convertstring("");
     msg[U("status")] = web::json::value::string(tmp);
 
-    tmp = utility::conversions::convertstring("ok");
+    tmp = utility::conversions::convertstring("");
     msg[U("message")] = web::json::value::string(tmp);
 
     tmp = utility::conversions::convertstring(util_encode_base64(payload));

activation.h

@@ -8,7 +8,7 @@
 
 #include <string>
 
-#define PROTOCOL_VERSION "3.0.0"
+#define PROTOCOL_VERSION "4.0.0"
 
 #ifdef _WIN32
 #define convertstring   to_utf16string

heartbeat.cpp

@@ -0,0 +1,48 @@
+/*********************************************************************
+* Copyright (c) Intel Corporation 2019 - 2020
+* SPDX-License-Identifier: Apache-2.0
+**********************************************************************/
+
+#include "heartbeat.h"
+#include <cpprest/ws_client.h>
+#include <cpprest/json.h>
+#include <cpprest/streams.h>
+#include <iostream>
+#include <string>
+#include "activation.h"
+#include "version.h"
+#include "commands.h"
+#include "network.h"
+#include "utils.h"
+
+bool heartbeat_create_response(std::string& response)
+{
+    web::json::value msg;
+
+    utility::string_t tmp = utility::conversions::convertstring("heartbeat_response");
+    msg[U("method")] = web::json::value::string(tmp);
+
+    tmp = utility::conversions::convertstring("");
+    msg[U("apiKey")] = web::json::value::string(tmp);
+
+    tmp = utility::conversions::convertstring(PROJECT_VER);
+    msg[U("appVersion")] = web::json::value::string(tmp);
+
+    tmp = utility::conversions::convertstring(PROTOCOL_VERSION);
+    msg[U("protocolVersion")] = web::json::value::string(tmp);
+
+    tmp = utility::conversions::convertstring("success");
+    msg[U("status")] = web::json::value::string(tmp);
+
+    tmp = utility::conversions::convertstring("");
+    msg[U("message")] = web::json::value::string(tmp);
+
+    // set empty payload
+    tmp = utility::conversions::convertstring("");
+    msg[U("payload")] = web::json::value::string(tmp);
+
+    // serialize the entire message
+    response = utility::conversions::to_utf8string(msg.serialize());
+
+    return true;
+}

heartbeat.h

@@ -0,0 +1,13 @@
+/*********************************************************************
+* Copyright (c) Intel Corporation 2019 - 2020
+* SPDX-License-Identifier: Apache-2.0
+**********************************************************************/
+
+#ifndef __HEARTBEAT_H__
+#define __HEARTBEAT_H__
+
+#include <string>
+
+bool heartbeat_create_response(std::string& response);
+
+#endif 

main.cpp

@@ -11,6 +11,7 @@
 #include "lms.h"
 #include "commands.h"
 #include "activation.h"
+#include "heartbeat.h"
 #include "utils.h"
 #include "usage.h"
 #include "args.h"
@@ -246,10 +247,25 @@ int main(int argc, char* argv[])
                 return;
             }
 
+            if (msgMethod.compare("heartbeat_request") == 0)
+            {
+                // create the response
+                std::string response;
+                if (!heartbeat_create_response(response)) return;
+
+                // send it
+                web::websockets::client::websocket_outgoing_message send_websocket_msg;
+                std::string send_websocket_buffer(response);
+                send_websocket_msg.set_utf8_message(send_websocket_buffer);
+                client.send(send_websocket_msg).wait();
+
+                return;
+            }
+
             // process any messages we can
             //   - if success, done
             //   - if error, get out
-            if (msgMethod.compare("success")==0)
+            if (msgStatus.compare("success")==0)
             {
                 // cleanup
                 g_timeout_val = 0;
@@ -258,7 +274,7 @@ int main(int argc, char* argv[])
                 std::cout << std::endl << msgMessage << std::endl;
                 return;
             }
-            else if (msgMethod.compare("error")==0)
+            else if (msgStatus.compare("failed")==0)
             {
                 // cleanup
                 g_timeout_val = 0;

scripts/jenkins-build.cmd

@@ -14,7 +14,7 @@ set BASE_DIR=%cd%
 set VCPKG_DIR=C:\opt\vcpkg-source
 
 REM build RPC
-cd %BASE_DIR%/rpc
+
 
 if exist "build" rd /q /s "build"
 
@@ -23,4 +23,4 @@ cd build
 echo %VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake
 cmake -DVCPKG_TARGET_TRIPLET=x64-windows-static -DCMAKE_TOOLCHAIN_FILE=%VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake ..
 cmake --build . --config Release
-dir %BASE_DIR%\rpc\build
+dir %BASE_DIR%\build

scripts/jenkins-build.sh

@@ -5,9 +5,9 @@ set -x
 # Jenkins Build script
 #   - Ubuntu 18.04
 #
-
+export BASE_DIR="$PWD"
 export CMAKE_CXX_FLAGS="-isystem /usr/lib/gcc/x86_64-linux-gnu/7/include"
-cd "$BASE_DIR"/rpc
+
 
 if [ -d "build" ]; then
   rm -rf build
@@ -15,5 +15,5 @@ fi
 
 mkdir build
 cd build
-cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
+cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
 cmake --build .

scripts/jenkins-pre-build.sh

@@ -4,14 +4,15 @@
 #   - Ubuntu 18.04
 #
 
-sudo apt install git cmake build-essential curl zip unzip tar pkg-config
+apt update
+apt install git cmake build-essential curl zip unzip tar pkg-config -y
 
 ## current dir - RPC source directory
-export BASE_DIR="$PWD"
+#export BASE_DIR="$PWD"
 
-cd "$BASE_DIR"/rpc
+#cd "$BASE_DIR"/rpc
 ## build vcpkg
-git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git
+git -C vcpkg pull || git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git vcpkg
 cd vcpkg
 ./bootstrap-vcpkg.sh
 

usage.cpp

@@ -49,15 +49,15 @@ void usage_show_help()
     std::cout << "Examples:"                                                                        << std::endl;
     std::cout << "  # Activate platform using profile1"                                             << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\""                       << std::endl;
+       " --url wss://192.168.86.100/activate --cmd \"-t activate --profile profile1\""              << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Activate platform using profile1 and override DNS detection" << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\" --dns corp.com"        << std::endl;
+       " --url wss://mycloud.com/activate --cmd \"-t activate --profile profile1\" --dns corp.com"  << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Deactivate platform and connect through a proxy"                              << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " -u wss://localhost:8080 -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
+       " -u wss://mycloud.com/activate -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Show all informational items"                                                 << std::endl;
     std::cout << "  " << PROJECT_NAME << " --amtinfo all"                                           << std::endl;