Fixed terminal issue.
Ylian Saint-Hilaire committed
Mar 12, 2021 at 13:44 UTC
0e69492ba56b44e4200ece62baa3097aa6cd2a34
8 files changed
+127
-11
MeshCentralServer.njsproj
+1
-1
@@ -98,7 +98,7 @@
98
<Compile Include="amt\amt-xml.js" />
99
<Compile Include="amt\amt.js" />
100
<Compile Include="exeHandler.js" />
101
- <Compile Include="amthelloserver.js" />
101
+ <Compile Include="amtprovisioningserver.js" />
102
<Compile Include="letsencrypt.js" />
103
<Compile Include="mcrec.js" />
104
<Compile Include="meshaccelerator.js" />
amtprovisioningserver.js
renamed
+1
-1
@@ -17,7 +17,7 @@
17
// Construct the Intel AMT hello server. This is used for Intel AMT bare-metal activation on the local LAN.
18
// This server can receive a notification from Intel AMT and attempt activation.
19
// In Intel documentation, this is called the Setup and Configuration Application (SCA)
20
-module.exports.CreateAmtHelloServer = function (parent, config) {
20
+module.exports.CreateAmtProvisioningServer = function (parent, config) {
21
var obj = {};
22
23
// WSMAN stack
certoperations.js
+107
@@ -355,6 +355,113 @@ module.exports.CertificateOperations = function (parent) {
355
return AmtSetupBinStack.AmtSetupBinEncode(setupbin);
356
}
357
358
+
359
+ // Get a bare metal setup.bin file
360
+ obj.GetBareMetalSetupBinFile = function (amtacmactivation, oldmebxpass, newmebxpass, domain, user) {
361
+ // Create a setup.bin file for our own root cert
362
+ // Get the wiadcard certificate hash
363
+ var wildcardCertSha256 = null;
364
+ for (var i = 0; i < amtacmactivation.acmmatch.length; i++) { if (amtacmactivation.acmmatch[i].cn == '*') { wildcardCertSha256 = amtacmactivation.acmmatch[i].sha256; } }
365
+
366
+ // Create the Setup.bin stack
367
+ const AmtSetupBinStack = require('./amt/amt-setupbin')();
368
+ var setupbin = AmtSetupBinStack.AmtSetupBinCreate(3, 1); // Version 3, 1 = Records will not be consumed.
369
+ var certRootName = 'MeshCentral';
370
+
371
+ // Figure out what trusted FQDN to use.
372
+ var trustedFQDN = parent.config.settings.amtprovisioningserver.trustedfqdn
373
+
374
+ // Figure out the provisioning server port
375
+ var port = 9971;
376
+ if (typeof parent.config.settings.amtprovisioningserver.port == 'number') { port = parent.config.settings.amtprovisioningserver.port; }
377
+
378
+ // Figure out the provisioning server IP address
379
+ var ipaddr = '192.168.2.147'; // TODO
380
+ if (typeof parent.config.settings.amtprovisioningserver.ip == 'string') { ipaddr = parent.config.settings.amtprovisioningserver.ip; }
381
+ var ipaddrSplit = ipaddr.split('.');
382
+ var ipaddrStr = String.fromCharCode(parseInt(ipaddrSplit[3])) + String.fromCharCode(parseInt(ipaddrSplit[2])) + String.fromCharCode(parseInt(ipaddrSplit[1])) + String.fromCharCode(parseInt(ipaddrSplit[0]));
383
+
384
+ // Create a new record
385
+ var r = {};
386
+ r.typeIdentifier = 1;
387
+ r.flags = 1; // Valid, unscrambled record.
388
+ r.chunkCount = 0;
389
+ r.headerByteCount = 0;
390
+ r.number = 0;
391
+ r.variables = [];
392
+ setupbin.records.push(r);
393
+
394
+ // Create "Current MEBx Password" variable
395
+ var v = {};
396
+ v.moduleid = 1;
397
+ v.varid = 1;
398
+ v.length = -1;
399
+ v.value = oldmebxpass;
400
+ setupbin.records[0].variables.push(v);
401
+
402
+ // Create "New MEBx Password" variable
403
+ v = {};
404
+ v.moduleid = 1;
405
+ v.varid = 2;
406
+ v.length = -1;
407
+ v.value = newmebxpass;
408
+ setupbin.records[0].variables.push(v);
409
+
410
+ // Create "User Defined Certificate Addition" variable
411
+ v = {};
412
+ v.moduleid = 2;
413
+ v.varid = 8;
414
+ v.length = -1;
415
+ v.value = String.fromCharCode(2) + Buffer.from(wildcardCertSha256, 'hex').toString('binary') + String.fromCharCode(certRootName.length) + certRootName; // 2 = SHA256 hash type
416
+ setupbin.records[0].variables.push(v);
417
+
418
+ // Create "PKI DNS Suffix" variable
419
+ v = {};
420
+ v.moduleid = 2;
421
+ v.varid = 3;
422
+ v.length = -1;
423
+ v.value = trustedFQDN;
424
+ setupbin.records[0].variables.push(v);
425
+
426
+ // Create "Configuration Server FQDN" variable
427
+ v = {};
428
+ v.moduleid = 2;
429
+ v.varid = 4;
430
+ v.length = -1;
431
+ v.value = trustedFQDN;
432
+ setupbin.records[0].variables.push(v);
433
+
434
+ // Create "Provisioning Server Address" variable
435
+ v = {};
436
+ v.moduleid = 2;
437
+ v.varid = 17;
438
+ v.length = -1;
439
+ v.value = ipaddrStr;
440
+ setupbin.records[0].variables.push(v);
441
+
442
+ // Create "Provisioning Server Port Number" variable
443
+ v = {};
444
+ v.moduleid = 2;
445
+ v.varid = 18;
446
+ v.length = -1;
447
+ v.value = port;
448
+ setupbin.records[0].variables.push(v);
449
+
450
+ // Create "Remote Configuration Enabled (RCFG)" variable
451
+ v = {};
452
+ v.moduleid = 2;
453
+ v.varid = 5;
454
+ v.length = -1;
455
+ v.value = '1'; // Turn on
456
+ setupbin.records[0].variables.push(v);
457
+
458
+ // Write to log file
459
+ obj.logAmtActivation(domain, { time: new Date(), action: 'setupbin', domain: domain.id, userid: user._id, oldmebx: oldmebxpass, newmebx: newmebxpass, rootname: certRootName, hash: wildcardCertSha256, dns: 'rootcert.meshcentral.com' });
460
+
461
+ // Encode the setup.bin file
462
+ return AmtSetupBinStack.AmtSetupBinEncode(setupbin);
463
+ }
464
+
465
// Return the certificate of the remote HTTPS server
466
obj.loadPfxCertificate = function (filename, password) {
467
var r = { certs: [], keys: [] };
meshcentral.js
+2
-2
@@ -1650,8 +1650,8 @@ function CreateMeshCentralServer(config, args) {
1650
});
1651
1652
// Setup Intel AMT hello server
1653
- if ((typeof config.settings.amthelloserver == 'object') && (typeof config.settings.amthelloserver.devicegroup == 'string') && (typeof config.settings.amthelloserver.newmebxpassword == 'string') && (typeof config.settings.amthelloserver.trustedfqdn == 'string')) {
1654
- obj.amthelloserver = require('./amthelloserver').CreateAmtHelloServer(obj, config.settings.amthelloserver);
1653
+ if ((typeof config.settings.amtprovisioningserver == 'object') && (typeof config.settings.amtprovisioningserver.devicegroup == 'string') && (typeof config.settings.amtprovisioningserver.newmebxpassword == 'string') && (typeof config.settings.amtprovisioningserver.trustedfqdn == 'string')) {
1654
+ obj.amtProvisioningServer = require('./amtprovisioningserver').CreateAmtProvisioningServer(obj, config.settings.amtprovisioningserver);
1655
}
1656
1657
// Start collecting server stats every 5 minutes
meshuser.js
+9
-2
@@ -5283,8 +5283,15 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5283
case 'amtsetupbin': {
5284
if ((command.oldmebxpass != 'admin') && (common.validateString(command.oldmebxpass, 8, 16) == false)) break; // Check password
5285
if (common.validateString(command.newmebxpass, 8, 16) == false) break; // Check password
5286
- var bin = parent.parent.certificateOperations.GetSetupBinFile(domain.amtacmactivation, command.oldmebxpass, command.newmebxpass, domain, user);
5287
- try { ws.send(JSON.stringify({ action: 'amtsetupbin', file: Buffer.from(bin, 'binary').toString('base64') })); } catch (ex) { }
5286
+ if ((command.baremetal) && (parent.parent.amtProvisioningServer != null)) {
5287
+ // Create bare metal setup.bin
5288
+ var bin = parent.parent.certificateOperations.GetBareMetalSetupBinFile(domain.amtacmactivation, command.oldmebxpass, command.newmebxpass, domain, user);
5289
+ try { ws.send(JSON.stringify({ action: 'amtsetupbin', file: Buffer.from(bin, 'binary').toString('base64') })); } catch (ex) { }
5290
+ } else {
5291
+ // Create standard setup.bin
5292
+ var bin = parent.parent.certificateOperations.GetSetupBinFile(domain.amtacmactivation, command.oldmebxpass, command.newmebxpass, domain, user);
5293
+ try { ws.send(JSON.stringify({ action: 'amtsetupbin', file: Buffer.from(bin, 'binary').toString('base64') })); } catch (ex) { }
5294
+ }
5295
break;
5296
}
5297
case 'meshToolInfo': {
public/scripts/agent-redir-ws-0.1.1.js
+3
-3
@@ -172,11 +172,11 @@ var CreateAgentRedirect = function (meshserver, module, serverPublicNamePort, au
172
if (typeof e.data == 'string') {
173
obj.xxOnControlCommand(e.data);
174
} else {
175
- // If only 1 byte
176
- if ((cmdAccLen == 0) && (e.data.byteLength == 1)) return; // Ignore single byte data, this is a keep alive.
177
-
175
// Send the data to the module
176
if (obj.m.ProcessBinaryCommand) {
177
+ // If only 1 byte
178
+ if ((cmdAccLen == 0) && (e.data.byteLength < 4)) return; // Ignore any commands less than 4 bytes.
179
+
180
// Send as Binary Command
181
if (cmdAccLen != 0) {
182
// Accumulator is active
views/default.handlebars
+3
-2
@@ -4267,7 +4267,8 @@
4267
x += addHtmlValue("Old Password", '<input id=dp1password0 type=password style=width:230px autocomplete=off maxlength=32 onchange=validateAmtAcmSetupEx() onkeyup=validateAmtAcmSetupEx() />');
4268
x += addHtmlValue("New Password*", '<input id=dp1password1 type=password style=width:230px autocomplete=off maxlength=32 onchange=validateAmtAcmSetupEx() onkeyup=validateAmtAcmSetupEx() />');
4269
x += addHtmlValue("New Password*", '<input id=dp1password2 type=password style=width:230px autocomplete=off maxlength=32 onchange=validateAmtAcmSetupEx() onkeyup=validateAmtAcmSetupEx() />');
4270
- x += '<span id=dp10passNotify style="font-size:10px"> ' + "* 8 characters, 1 upper, 1 lower, 1 numeric, 1 non-alpha numeric." + '</span>';
4270
+ if (features2 & 0x00000020) { x += '<label><input id=dp1lanprov type=checkbox /> ' + "Use for bare-metal LAN activation." + '</label>'; } // Intel AMT LAN provisioning server is active.
4271
+ x += '<div><span id=dp10passNotify style="font-size:10px"> ' + "* 8 characters, 1 upper, 1 lower, 1 numeric, 1 non-alpha numeric." + '</span></div>';
4272
setDialogMode(2, "Intel® AMT ACM", 3, showAmtAcmSetupEx, x);
4273
Q('dp1password0').focus();
4274
validateAmtAcmSetupEx();
@@ -4281,7 +4282,7 @@
4282
}
4283
4284
function showAmtAcmSetupEx() {
4284
- meshserver.send({ action: 'amtsetupbin', oldmebxpass: Q('dp1password0').value, newmebxpass: Q('dp1password1').value });
4285
+ meshserver.send({ action: 'amtsetupbin', oldmebxpass: Q('dp1password0').value, newmebxpass: Q('dp1password1').value, baremetal: ((features2 & 0x00000020) && (Q('dp1lanprov').checked)) });
4286
}
4287
4288
// Display the Intel AMT scanning dialog box
webserver.js
+1
@@ -2476,6 +2476,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2476
if ((obj.parent.firebase != null) && (obj.parent.firebase.pushOnly != true)) { features2 += 0x00000004; } // Indicates the server supports Firebase two-way push messaging
2477
if (obj.parent.webpush != null) { features2 += 0x00000008; } // Indicates web push is enabled
2478
if (((obj.args.noagentupdate == 1) || (obj.args.noagentupdate == true))) { features2 += 0x00000010; } // No agent update
2479
+ if (parent.amtProvisioningServer != null) { features2 += 0x00000020; } // Intel AMT LAN provisioning server
2480
2481
// Create a authentication cookie
2482
const authCookie = obj.parent.encodeCookie({ userid: dbGetFunc.user._id, domainid: domain.id, ip: req.clientIp }, obj.parent.loginCookieEncryptionKey);