Improved CIRA setup when MPS is not running.
Ylian Saint-Hilaire committed
Oct 23, 2020 at 13:28 UTC
05ebe75074942e3191d81823fa3fe38c0a216edb
4 files changed
+31
-17
amtmanager.js
+21
-12
@@ -302,9 +302,16 @@ module.exports.CreateAmtManager = function (parent) {
302
var amtPolicy = 0, ciraPolicy = 0, badPass = 0, password = null;
303
if (mesh.amt != null) {
304
if (mesh.amt.type) { amtPolicy = mesh.amt.type; }
305
- if (mesh.amt.cirasetup) { ciraPolicy = mesh.amt.cirasetup; }
306
- if (mesh.amt.badpass) { badPass = mesh.amt.badpass; }
307
- if ((typeof mesh.amt.password == 'string') && (mesh.amt.password != '')) { password = mesh.amt.password; }
305
+ if (mesh.amt.type == 4) {
306
+ // Fully automatic policy
307
+ ciraPolicy = 2; // CIRA will be setup
308
+ badPass = 1; // Automatically re-active CCM
309
+ password = null; // Randomize the password.
310
+ } else {
311
+ if (mesh.amt.cirasetup) { ciraPolicy = mesh.amt.cirasetup; }
312
+ if (mesh.amt.badpass) { badPass = mesh.amt.badpass; }
313
+ if ((typeof mesh.amt.password == 'string') && (mesh.amt.password != '')) { password = mesh.amt.password; }
314
+ }
315
}
316
if (amtPolicy < 2) { ciraPolicy = 0; }
317
dev.policy = { amtPolicy: amtPolicy, ciraPolicy: ciraPolicy, badPass: badPass, password: password };
@@ -343,7 +350,7 @@ module.exports.CreateAmtManager = function (parent) {
350
// Attempt to perform initial contact with Intel AMT
351
function attemptInitialContact(dev) {
352
delete dev.amtstack; // If there is a WSMAn stack setup, clean it up now.
346
- parent.debug('amt', "Attempt Initial Contact", dev.name, dev.connType);
353
+ parent.debug('amt', "Attempt Initial Contact", dev.name, ["CIRA", "CIRA-Relay", "CIRA-LMS", "Local"][dev.connType]);
354
355
// Check Intel AMT policy when CIRA-LMS connection is in use.
356
if ((dev.connType == 2) && (dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null)) {
@@ -354,7 +361,7 @@ module.exports.CreateAmtManager = function (parent) {
361
return;
362
}
363
// Check if we have an ACM activation policy, but the device is in CCM
357
- if ((dev.policy.amtPolicy == 3) && ((dev.mpsConnection.tag.meiState.Flags & 2) != 0)) {
364
+ if (((dev.policy.amtPolicy == 3) || (dev.policy.amtPolicy == 4)) && ((dev.mpsConnection.tag.meiState.Flags & 2) != 0)) {
365
// This device in is CCM, check if we can upgrade to ACM
366
if (activateIntelAmt(dev) == false) return; // If this return true, the platform is in CCM and can't go to ACM, keep going with management.
367
}
@@ -562,7 +569,7 @@ module.exports.CreateAmtManager = function (parent) {
569
dev.tlsfail = true; attemptInitialContact(dev); return;
570
} else if (status == 401) {
571
// Authentication error, see if we can use alternative credentials
565
- if ((dev.acctry == null) && (dev.policy.password != null)) { dev.acctry = 'policy'; attemptInitialContact(dev); return; }
572
+ if ((dev.acctry == null) && (typeof dev.policy.password == 'string') && (dev.policy.password != '')) { dev.acctry = 'policy'; attemptInitialContact(dev); return; }
573
if ((dev.acctry == null) || (dev.acctry == 'policy') && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; attemptInitialContact(dev); return; }
574
if ((dev.acctry != null) && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > (dev.acctry + 1))) { dev.acctry++; attemptInitialContact(dev); return; }
575
@@ -1070,7 +1077,7 @@ module.exports.CreateAmtManager = function (parent) {
1077
// Check if Intel AMT has the server root certificate
1078
function attemptRootCertSync(dev, func) {
1079
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1073
- if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed
1080
+ if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2) || (parent.mpsserver.server == null)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed
1081
1082
// Find the current TLS certificate & MeshCentral root certificate
1083
var xxMeshCentralRoot = null;
@@ -1150,7 +1157,7 @@ module.exports.CreateAmtManager = function (parent) {
1157
// Fetch the server's CIRA settings
1158
dev.cira.mpsPresent = null;
1159
dev.cira.mpsPolicy = false;
1153
- if (dev.policy.ciraPolicy == 2) {
1160
+ if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { // parent.mpsserver.server is not null if the MPS server is listening for TCP/TLS connections
1161
dev.cira.meshidx = dev.meshid.split('/')[2].replace(/\@/g, 'X').replace(/\$/g, 'X').substring(0, 16);
1162
dev.cira.mpsName = parent.webserver.certificates.AmtMpsName;
1163
var serverNameSplit = dev.cira.mpsName.split('.');
@@ -1190,7 +1197,8 @@ module.exports.CreateAmtManager = function (parent) {
1197
}
1198
1199
// If we need to setup CIRA, start by checking the MPS server
1193
- if (dev.policy.ciraPolicy == 2) { addMpsServer(dev); } else { checkEnvironmentDetection(dev); }
1200
+ // parent.mpsserver.server is not null if the MPS server is listening for TCP/TLS connections
1201
+ if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { addMpsServer(dev); } else { checkEnvironmentDetection(dev); }
1202
});
1203
}
1204
@@ -1202,6 +1210,7 @@ module.exports.CreateAmtManager = function (parent) {
1210
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1211
if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev); return; }
1212
dev.cira.mpsPresent = getItem(response.Body.MpServer.ReferenceParameters.SelectorSet.Selector, '@Name', 'Name').Value;
1213
+ console.log(dev.cira.mpsPresent);
1214
dev.consoleMsg("Created new MPS server.");
1215
addMpsPolicy(dev);
1216
});
@@ -1251,7 +1260,7 @@ module.exports.CreateAmtManager = function (parent) {
1260
var currentEnvDetect = dev.cira.xxEnvironementDetection['DetectionStrings'];
1261
if (currentEnvDetect == null) { currentEnvDetect = []; }
1262
1254
- if (dev.policy.ciraPolicy == 2) { // ciraPolicy: 0 = Do Nothing, 1 = Clear, 2 = Set
1263
+ if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { // ciraPolicy: 0 = Do Nothing, 1 = Clear, 2 = Set
1264
const newEnvDetect = parent.config.domains[dev.domainid].amtmanager.environmentdetection;
1265
if (newEnvDetect == null) {
1266
// If no environment detection is specified in the config.json, check that we have a random environment detection
@@ -1270,7 +1279,7 @@ module.exports.CreateAmtManager = function (parent) {
1279
if (mismatch == true) { editEnvironmentDetectionTmp = newEnvDetect; changes = true; }
1280
}
1281
1273
- } else if (dev.policy.ciraPolicy == 1) {
1282
+ } else if ((dev.policy.ciraPolicy == 1) || (parent.mpsserver.server == null)) {
1283
// Check environment detection is clear
1284
if (currentEnvDetect.length != 0) { editEnvironmentDetectionTmp = []; changes = true; }
1285
}
@@ -1589,7 +1598,7 @@ module.exports.CreateAmtManager = function (parent) {
1598
if ((typeof dev.mpsConnection.tag.meiState.OsAdmin != 'object') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.user != 'string') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.pass != 'string')) { amtPolicy = 0; }
1599
if (amtPolicy == 0) { removeAmtDevice(dev); return false; } // Do nothing, we should not have gotten this CIRA-LMS connection.
1600
if (amtPolicy == 2) { activateIntelAmtCcm(dev, mesh.amt.password); } // Activate to CCM policy
1592
- if (amtPolicy == 3) { // Activate to ACM policy
1601
+ if ((amtPolicy == 3) || (amtPolicy == 4)) { // Activate to ACM policy
1602
var acminfo = checkAcmActivation(dev);
1603
if (acminfo == null) {
1604
// No opportunity to activate to ACM, check if we are already in CCM
meshuser.js
+1
-1
@@ -3301,7 +3301,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3301
// Change a mesh Intel AMT policy
3302
if (common.validateString(command.meshid, 1, 1024) == false) break; // Check the meshid
3303
if (common.validateObject(command.amtpolicy) == false) break; // Check the amtpolicy
3304
- if (common.validateInt(command.amtpolicy.type, 0, 3) == false) break; // Check the amtpolicy.type
3304
+ if (common.validateInt(command.amtpolicy.type, 0, 4) == false) break; // Check the amtpolicy.type
3305
if (command.amtpolicy.type === 2) {
3306
if (common.validateString(command.amtpolicy.password, 0, 32) == false) break; // Check the amtpolicy.password
3307
if ((command.amtpolicy.badpass != null) && common.validateInt(command.amtpolicy.badpass, 0, 1) == false) break; // Check the amtpolicy.badpass
public/images/checkbox60.png
Binary files /dev/null and b/public/images/checkbox60.png differ
views/default.handlebars
+9
-4
@@ -9428,6 +9428,8 @@
9428
} else if (currentMesh.amt.type == 3) {
9429
intelAmtPolicy = "Simple Admin Control Mode (ACM)";
9430
if (currentMesh.amt.cirasetup == 2) { intelAmtPolicy += " + CIRA"; }
9431
+ } else if (currentMesh.amt.type == 4) {
9432
+ intelAmtPolicy = "Fully Automatic";
9433
}
9434
}
9435
x += addHtmlValue("Intel® AMT", addLinkConditional(intelAmtPolicy, 'p20editMeshAmt()', meshrights & 1));
@@ -9517,7 +9519,7 @@
9519
if (xxdialogMode) return;
9520
var x = '', acmoption = '';
9521
if ((features & 0x100000) != 0) { acmoption = '<option value=3>' + "Simple Admin Control Mode (ACM)" + '</option>'; }
9520
- x += addHtmlValue("Type", '<select id=dp20amtpolicy style=width:230px onchange=p20editMeshAmtChange()><option value=0>' + "No Policy" + '</option><option value=1>' + "Deactivate Client Control Mode (CCM)" + '</option><option value=2>' + "Simple Client Control Mode (CCM)" + '</option>' + acmoption + '</select>');
9522
+ x += addHtmlValue("Type", '<select id=dp20amtpolicy style=width:230px onchange=p20editMeshAmtChange()><option value=0>' + "No Policy" + '</option><option value=1>' + "Deactivate Client Control Mode (CCM)" + '</option><option value=2>' + "Simple Client Control Mode (CCM)" + '</option>' + acmoption + '<option value=4>' + "Fully Automatic" + '</option></select>');
9523
x += '<div id=dp20amtpolicydiv></div>';
9524
setDialogMode(2, "Intel® AMT Policy", 3, p20editMeshAmtEx, x);
9525
if (currentMesh.amt) { Q('dp20amtpolicy').value = currentMesh.amt.type; }
@@ -9535,7 +9537,7 @@
9537
9538
function p20editMeshAmtChange() {
9539
var ptype = Q('dp20amtpolicy').value, x = '';
9538
- if (ptype >= 2) {
9540
+ if ((ptype >= 2) && (ptype < 4)) {
9541
x = addHtmlValue("Password*", '<input id=dp20amtpolicypass type=password style=width:230px maxlength=32 onchange=dp20amtValidatePolicy() onkeyup=dp20amtValidatePolicy() autocomplete=off />')
9542
x += addHtmlValue("Password*", '<input id=dp20amtpolicypass2 type=password style=width:230px maxlength=32 onchange=dp20amtValidatePolicy() onkeyup=dp20amtValidatePolicy() autocomplete=off />')
9543
x += addHtmlValue("Password mismatch", '<select id=dp20amtbadpass style=width:230px><option value=0>' + "Do nothing" + '</option><option value=1>' + "Reactivate Intel® AMT" + '</option></select>');
@@ -9550,6 +9552,7 @@
9552
}
9553
}
9554
}
9555
+ if (ptype == 4) { x = '<table style=padding-top:4px><tr><td><img style=padding-right:8px src=images/checkbox60.png width=60 height=60><td>' + "This is the recommanded policy type. Intel® AMT activation and management is completely automated." + '</table>'; }
9556
QH('dp20amtpolicydiv', x);
9557
setTimeout(dp20amtValidatePolicy, 1);
9558
}
@@ -9565,12 +9568,14 @@
9568
9569
function p20editMeshAmtEx() {
9570
var ptype = parseInt(Q('dp20amtpolicy').value), amtpolicy = { type: ptype };
9568
- if (ptype == 2) {
9571
+ if (ptype == 2) { // CCM policy
9572
amtpolicy = { type: ptype, password: Q('dp20amtpolicypass').value, badpass: parseInt(Q('dp20amtbadpass').value) };
9573
if ((features & 0x400) == 0) { amtpolicy.cirasetup = parseInt(Q('dp20amtcira').value); } else { amtpolicy.cirasetup = 1; }
9571
- } else if (ptype == 3) {
9574
+ } else if (ptype == 3) { // ACM policy
9575
amtpolicy = { type: ptype, password: Q('dp20amtpolicypass').value, badpass: parseInt(Q('dp20amtbadpass').value) };
9576
if ((features & 0x400) == 0) { amtpolicy.cirasetup = parseInt(Q('dp20amtcira').value); } else { amtpolicy.cirasetup = 1; }
9577
+ } else if (ptype == 4) { // Fully automatic policy
9578
+ amtpolicy = { type: ptype };
9579
}
9580
meshserver.send({ action: 'meshamtpolicy', meshid: currentMesh._id, amtpolicy: amtpolicy });
9581
}