More AMT manager improvements.
Ylian Saint-Hilaire committed
Oct 26, 2020 at 12:46 UTC
0f23a343cd6ac48e898fee502c443d94cfe7d7d2
3 files changed
+31
-8
agents/meshcore.js
+21
-5
@@ -134,6 +134,16 @@ function createMeshCore(agent) {
134
}
135
}
136
137
+ // Add an Intel AMT event to the log
138
+ function addAmtEvent(msg) {
139
+ if (obj.amtevents == null) { obj.amtevents = []; }
140
+ var d = new Date();
141
+ obj.amtevents.push(zeroPad(d.getHours(), 2) + ':' + zeroPad(d.getMinutes(), 2) + ':' + zeroPad(d.getSeconds(), 2) + ', ' + msg);
142
+ if (obj.amtevents.length > 100) { obj.amtevents.splice(0, obj.amtevents.length - 100); }
143
+ }
144
+ function zeroPad(num, size) { var s = '000000000' + num; return s.substr(s.length - size); }
145
+
146
+
147
// Create Secure IPC for Diagnostic Agent Communications
148
obj.DAIPC = require('net').createServer();
149
if (process.platform != 'win32') { try { require('fs').unlinkSync(process.cwd() + '/DAIPC'); } catch (e) { } }
@@ -1091,9 +1101,10 @@ function createMeshCore(agent) {
1101
conntype: 2, // 0 = CIRA, 1 = Relay, 2 = LMS. The correct value is 2 since we are performing an LMS relay, other values for testing.
1102
meiState: state // MEI state will be passed to MPS server
1103
};
1104
+ addAmtEvent('LMS tunnel start.');
1105
apftunnel = require('apfclient')({ debug: false }, apfarg);
1106
apftunnel.onJsonControl = function (data) {
1096
- if (data.action == 'console') { require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: data.msg }); } // Display a console message (DEBUG)
1107
+ if (data.action == 'console') { addAmtEvent(data.msg); } // Add console message to AMT event log
1108
if (data.action == 'mestate') { getMeiState(15, function (state) { apftunnel.updateMeiState(state); }); } // Update the MEI state
1109
if (data.action == 'deactivate') { // Request CCM deactivation
1110
var amtMeiModule, amtMei;
@@ -1103,7 +1114,7 @@ function createMeshCore(agent) {
1114
}
1115
if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
1116
}
1106
- apftunnel.onChannelClosed = function () { apftunnel = null; }
1117
+ apftunnel.onChannelClosed = function () { addAmtEvent('LMS tunnel closed.'); apftunnel = null; }
1118
try { apftunnel.connect(); } catch (ex) { }
1119
});
1120
break;
@@ -2589,7 +2600,7 @@ function createMeshCore(agent) {
2600
var response = null;
2601
switch (cmd) {
2602
case 'help': { // Displays available commands
2592
- var fin = '', f = '', availcommands = 'amtconfig,coredump,service,fdsnapshot,fdcount,startupoptions,alert,agentsize,versions,help,info,osinfo,args,print,type,dbkeys,dbget,dbset,dbcompact,eval,parseuri,httpget,nwslist,plugin,wsconnect,wssend,wsclose,notify,ls,ps,kill,amt,netinfo,location,power,wakeonlan,setdebug,smbios,rawsmbios,toast,lock,users,sendcaps,openurl,getscript,getclip,setclip,log,av,cpuinfo,sysinfo,apf,scanwifi,scanamt,wallpaper,agentmsg';
2603
+ var fin = '', f = '', availcommands = 'amtconfig,amtevents,coredump,service,fdsnapshot,fdcount,startupoptions,alert,agentsize,versions,help,info,osinfo,args,print,type,dbkeys,dbget,dbset,dbcompact,eval,parseuri,httpget,nwslist,plugin,wsconnect,wssend,wsclose,notify,ls,ps,kill,amt,netinfo,location,power,wakeonlan,setdebug,smbios,rawsmbios,toast,lock,users,sendcaps,openurl,getscript,getclip,setclip,log,av,cpuinfo,sysinfo,apf,scanwifi,scanamt,wallpaper,agentmsg';
2604
if (process.platform == 'win32') { availcommands += ',safemode,wpfhwacceleration,uac'; }
2605
if (process.platform != 'freebsd') { availcommands += ',vm';}
2606
if (require('MeshAgent').maxKvmTileSize != null) { availcommands += ',kvmmode'; }
@@ -3532,6 +3543,10 @@ function createMeshCore(agent) {
3543
if (diag) { diag.close(); diag = null; }
3544
break;
3545
}
3546
+ case 'amtevents': {
3547
+ if (obj.amtevents == null) { response = 'No events.'; } else { response = obj.amtevents.join('\r\n'); }
3548
+ break;
3549
+ }
3550
case 'amtconfig': {
3551
if (apftunnel != null) { response = "Intel AMT server tunnel already active"; break; }
3552
if (amt == null) { response = "No Intel AMT support delected"; break; }
@@ -3552,9 +3567,10 @@ function createMeshCore(agent) {
3567
if ((state.UUID == null) || (state.UUID.length != 36)) {
3568
rx = "Unable to get Intel AMT UUID";
3569
} else {
3570
+ addAmtEvent('User LMS tunnel start.');
3571
apftunnel = require('apfclient')({ debug: false }, apfarg);
3572
apftunnel.onJsonControl = function (data) {
3557
- if (data.action == 'console') { require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: data.msg }); } // Display a console message
3573
+ if (data.action == 'console') { addAmtEvent(data.msg); require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: data.msg }); } // Display a console message
3574
if (data.action == 'mestate') { getMeiState(15, function (state) { apftunnel.updateMeiState(state); }); } // Update the MEI state
3575
if (data.action == 'deactivate') { // Request CCM deactivation
3576
var amtMeiModule, amtMei;
@@ -3564,7 +3580,7 @@ function createMeshCore(agent) {
3580
}
3581
if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
3582
}
3567
- apftunnel.onChannelClosed = function () { apftunnel = null; }
3583
+ apftunnel.onChannelClosed = function () { addAmtEvent('User LMS tunnel closed.'); apftunnel = null; }
3584
try {
3585
apftunnel.connect();
3586
rx = "Started Intel AMT configuration";
amtmanager.js
+3
@@ -1675,6 +1675,8 @@ module.exports.CreateAmtManager = function (parent) {
1675
if (responses['IPS_HostBasedSetupService'].response['AllowedControlModes'].length != 2) { dev.consoleMsg("Client control mode activation not allowed."); removeAmtDevice(dev); return; }
1676
1677
// Log the activation request, logging is a required step for activation.
1678
+ var domain = parent.config.domains[dev.domainid];
1679
+ if (domain == null) { dev.consoleMsg("Invalid domain."); removeAmtDevice(dev); return; }
1680
if (parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: 'ccmactivate', domain: dev.domainid, amtUuid: dev.mpsConnection.tag.meiState.UUID, amtRealm: responses['AMT_GeneralSettings'].response['DigestRealm'], user: 'admin', password: dev.temp.pass, ipport: dev.mpsConnection.remoteAddr + ':' + dev.mpsConnection.remotePort, nodeid: dev.nodeid, meshid: dev.meshid, computerName: dev.name }) == false) {
1681
dev.consoleMsg("Unable to log operation."); removeAmtDevice(dev); return;
1682
}
@@ -1704,6 +1706,7 @@ module.exports.CreateAmtManager = function (parent) {
1706
dev.intelamt.tls = dev.aquired.tls = 0;
1707
dev.aquired.lastContact = Date.now();
1708
dev.aquired.state = 2; // Activated
1709
+ dev.aquired.warn = 0; // Clear all warnings
1710
delete dev.acctry;
1711
delete dev.temp;
1712
UpdateDevice(dev);
certoperations.js
+7
-3
@@ -68,11 +68,15 @@ module.exports.CertificateOperations = function (parent) {
68
return { 'action': 'acmactivate', 'signature': signature, 'password': obj.crypto.createHash('md5').update(user + ':' + request.realm + ':' + pass).digest('hex'), 'nonce': mcNonce.toString('base64'), 'certs': certChain };
69
}
70
71
- // Log the Intel AMT activation operation
71
+ // Log the Intel AMT activation operation in the domain log
72
obj.logAmtActivation = function (domain, x) {
73
- if ((domain.amtacmactivation == null) || (domain.amtacmactivation.log == null) || (typeof domain.amtacmactivation.log != 'string') || (x == null)) return true;
73
+ if (x == null) return true;
74
var logpath = null;
75
- if ((domain.amtacmactivation.log.length >= 2) && ((domain.amtacmactivation.log[0] == '/') || (domain.amtacmactivation.log[1] == ':'))) { logpath = domain.amtacmactivation.log; } else { logpath = parent.path.join(obj.parent.datapath, domain.amtacmactivation.log); }
75
+ if ((domain.amtacmactivation == null) || (domain.amtacmactivation.log == null) || (typeof domain.amtacmactivation.log != 'string')) {
76
+ if (domain.id == '') { logpath = parent.path.join(obj.parent.datapath, 'amtactivation.log'); } else { logpath = parent.path.join(obj.parent.datapath, 'amtactivation-' + domain.id + '.log'); }
77
+ } else {
78
+ if ((domain.amtacmactivation.log.length >= 2) && ((domain.amtacmactivation.log[0] == '/') || (domain.amtacmactivation.log[1] == ':'))) { logpath = domain.amtacmactivation.log; } else { logpath = parent.path.join(obj.parent.datapath, domain.amtacmactivation.log); }
79
+ }
80
try { obj.fs.appendFileSync(logpath, JSON.stringify(x) + '\r\n'); } catch (ex) { console.log(ex); return false; }
81
return true;
82
}