Fixed agent update hash issue, connection hash issue, 2FA issue.
ylianst committed
Feb 14, 2021 at 22:22 UTC
2b2d25a0b60817347f020bfbc507659f9db9b242
5 files changed
+31
-44
meshagent.js
+11
-34
@@ -426,8 +426,8 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
426
obj.sendBinary(common.ShortToStr(1) + msg.substring(2, 50) + obj.nonce); // Command 1, hash + nonce. Use the web hash given by the agent.
427
} else {
428
// Check that the server hash matches our own web certificate hash (SHA384)
429
- const agentSeenCerthash = msg.substring(2, 50);
430
- if ((getWebCertHash(domain) != agentSeenCerthash) && (getWebCertFullHash(domain) != agentSeenCerthash) && (parent.defaultWebCertificateHash != agentSeenCerthash) && (parent.defaultWebCertificateFullHash != agentSeenCerthash)) {
429
+ obj.agentSeenCerthash = msg.substring(2, 50);
430
+ if ((getWebCertHash(domain) != obj.agentSeenCerthash) && (getWebCertFullHash(domain) != obj.agentSeenCerthash) && (parent.defaultWebCertificateHash != obj.agentSeenCerthash) && (parent.defaultWebCertificateFullHash != obj.agentSeenCerthash)) {
431
if (parent.parent.supportsProxyCertificatesRequest !== false) {
432
obj.badWebCert = Buffer.from(parent.crypto.randomBytes(16), 'binary').toString('base64');
433
parent.wsagentsWithBadWebCerts[obj.badWebCert] = obj; // Add this agent to the list of of agents with bad web certificates.
@@ -444,7 +444,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
444
// The hash matched one of the acceptable values, send the agent web hash back to the agent
445
// Send 384 bits SHA384 hash of TLS cert + 384 bits nonce
446
// Command 1, hash + nonce. Use the web hash given by the agent.
447
- obj.sendBinary(common.ShortToStr(1) + agentSeenCerthash + obj.nonce);
447
+ obj.sendBinary(common.ShortToStr(1) + obj.agentSeenCerthash + obj.nonce);
448
}
449
}
450
@@ -1078,7 +1078,8 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1078
if (isIgnoreHashCheck() == false) {
1079
var verified = false;
1080
1081
- if (msg.length != 384) {
1081
+ // Raw RSA signatures have an exact length of 256 or 384. PKCS7 is larger.
1082
+ if ((msg.length != 384) && (msg.length != 256)) {
1083
// Verify a PKCS7 signature.
1084
var msgDer = null;
1085
try { msgDer = forge.asn1.fromDer(forge.util.createBuffer(msg, 'binary')); } catch (ex) { }
@@ -1088,31 +1089,10 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1089
const sig = p7.rawCapture.signature;
1090
1091
// Verify with key hash
1091
- var buf = Buffer.from(getWebCertHash(domain) + obj.nonce + obj.agentnonce, 'binary');
1092
+ var buf = Buffer.from(obj.agentSeenCerthash + obj.nonce + obj.agentnonce, 'binary');
1093
var verifier = parent.crypto.createVerify('RSA-SHA384');
1094
verifier.update(buf);
1095
verified = verifier.verify(obj.unauth.nodeCertPem, sig, 'binary');
1095
- if (verified !== true) {
1096
- // Verify with full hash
1097
- buf = Buffer.from(getWebCertFullHash(domain) + obj.nonce + obj.agentnonce, 'binary');
1098
- verifier = parent.crypto.createVerify('RSA-SHA384');
1099
- verifier.update(buf);
1100
- verified = verifier.verify(obj.unauth.nodeCertPem, sig, 'binary');
1101
- }
1102
- if (verified !== true) {
1103
- // Verify with default key hash
1104
- buf = Buffer.from(parent.defaultWebCertificateHash + obj.nonce + obj.agentnonce, 'binary');
1105
- verifier = parent.crypto.createVerify('RSA-SHA384');
1106
- verifier.update(buf);
1107
- verified = verifier.verify(obj.unauth.nodeCertPem, sig, 'binary');
1108
- }
1109
- if (verified !== true) {
1110
- // Verify with default full hash
1111
- buf = Buffer.from(parent.defaultWebCertificateFullHash + obj.nonce + obj.agentnonce, 'binary');
1112
- verifier = parent.crypto.createVerify('RSA-SHA384');
1113
- verifier.update(buf);
1114
- verified = verifier.verify(obj.unauth.nodeCertPem, sig, 'binary');
1115
- }
1096
if (verified !== true) {
1097
// Not a valid signature
1098
parent.agentStats.invalidPkcsSignatureCount++;
@@ -1126,15 +1106,11 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1106
if (verified == false) {
1107
// Verify the RSA signature. This is the fast way, without using forge.
1108
const verify = parent.crypto.createVerify('SHA384');
1129
- verify.end(Buffer.from(getWebCertHash(domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the private key hash
1109
+ verify.end(Buffer.from(obj.agentSeenCerthash + obj.nonce + obj.agentnonce, 'binary')); // Test using the private key hash
1110
if (verify.verify(obj.unauth.nodeCertPem, Buffer.from(msg, 'binary')) !== true) {
1131
- const verify2 = parent.crypto.createVerify('SHA384');
1132
- verify2.end(Buffer.from(getWebCertFullHash(domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the full cert hash
1133
- if (verify2.verify(obj.unauth.nodeCertPem, Buffer.from(msg, 'binary')) !== true) {
1134
- parent.agentStats.invalidRsaSignatureCount++;
1135
- parent.setAgentIssue(obj, "invalidRsaSignature");
1136
- return false;
1137
- }
1111
+ parent.agentStats.invalidRsaSignatureCount++;
1112
+ parent.setAgentIssue(obj, "invalidRsaSignature");
1113
+ return false;
1114
}
1115
}
1116
}
@@ -1146,6 +1122,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1122
delete obj.agentnonce;
1123
delete obj.unauth;
1124
delete obj.receivedCommands;
1125
+ delete obj.agentSeenCerthash;
1126
if (obj.unauthsign) delete obj.unauthsign;
1127
parent.agentStats.verifiedAgentConnectionCount++;
1128
parent.parent.debug('agent', 'Verified agent connection to ' + obj.nodeid + ' (' + obj.remoteaddrport + ').');
meshcentral.js
+8
-1
@@ -2572,7 +2572,7 @@ function CreateMeshCentralServer(config, args) {
2572
onZipData.x.zdata = concatData;
2573
onZipData.x.zsize = concatData.length;
2574
2575
- console.log('Packed', onZipData.x.size, onZipData.x.zsize);
2575
+ //console.log('Packed', onZipData.x.size, onZipData.x.zsize);
2576
}
2577
const onZipError = function onZipError() { delete onZipData.x.zacc; }
2578
obj.meshAgentBinaries[archid].zacc = [];
@@ -2598,6 +2598,13 @@ function CreateMeshCentralServer(config, args) {
2598
var options = { sourcePath: agentpath, targetStream: hashStream, platform: obj.meshAgentsArchitectureNumbers[archid].platform };
2599
if (obj.meshAgentBinaries[archid].pe != null) { options.peinfo = obj.meshAgentBinaries[archid].pe; }
2600
obj.exeHandler.hashExecutableFile(options);
2601
+
2602
+ // If we are not loading Windows binaries to RAM, compute the RAW file hash of the signed binaries here.
2603
+ if ((obj.args.agentsinram === false) && ((archid == 3) || (archid == 4))) {
2604
+ var hash = obj.crypto.createHash('sha384').update(obj.fs.readFileSync(agentpath));
2605
+ obj.meshAgentBinaries[archid].fileHash = hash.digest('binary');
2606
+ obj.meshAgentBinaries[archid].fileHashHex = Buffer.from(obj.meshAgentBinaries[archid].fileHash, 'binary').toString('hex');
2607
+ }
2608
}
2609
}
2610
if ((obj.meshAgentBinaries[3] == null) && (obj.meshAgentBinaries[10003] != null)) { obj.meshAgentBinaries[3] = obj.meshAgentBinaries[10003]; } // If only the unsigned windows binaries are present, use them.
meshuser.js
+2
@@ -931,6 +931,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
931
r += 'AgentCertHash: ' + parent.agentCertificateHashHex;
932
for (var i in parent.webCertificateHashs) { r += '\r\nwebCertificateHash (' + i + '): ' + common.rstr2hex(parent.webCertificateHashs[i]); }
933
for (var i in parent.webCertificateFullHashs) { r += '\r\nwebCertificateFullHash (' + i + '): ' + common.rstr2hex(parent.webCertificateFullHashs[i]); }
934
+ r += '\r\ndefaultWebCertificateHash: ' + common.rstr2hex(parent.defaultWebCertificateHash);
935
+ r += '\r\ndefaultWebCertificateFullHash: ' + common.rstr2hex(parent.defaultWebCertificateFullHash);
936
break;
937
}
938
case 'amtacm': {
views/default.handlebars
+6
-7
@@ -1945,14 +1945,13 @@
1945
1946
// Return the number of 2nd factor for this account
1947
function count2factoraAuths() {
1948
+ if (userinfo == null) return 0;
1949
var authFactorCount = 0;
1949
- if (userinfo != null) {
1950
- if (userinfo.otpsecret == 1) { authFactorCount++; } // Authenticator time factor
1951
- if (userinfo.otphkeys != null) { authFactorCount += userinfo.otphkeys; } // FIDO hardware factor
1952
- }
1950
+ if (userinfo.otpsecret == 1) { authFactorCount++; } // Authenticator time factor
1951
+ if (userinfo.otphkeys > 0) { authFactorCount += userinfo.otphkeys; } // FIDO hardware factor
1952
if ((features & 0x00800000) && (userinfo.otpekey == 1)) { authFactorCount++; } // EMail factor
1954
- if ((features & 0x04000000) && (userinfo.phone != null)) { authFactorCount++; } // SMS factor
1955
- if ((authFactorCount > 0) && (userinfo.otpkeys == 1)) { authFactorCount++; } // Backup keys
1953
+ if ((features & 0x02000000) && (features & 0x04000000) && (userinfo.phone != null)) { authFactorCount++; } // SMS factor
1954
+ if ((authFactorCount > 0) && (userinfo.otpkeys > 0)) { authFactorCount++; } // Backup keys
1955
return authFactorCount;
1956
}
1957
@@ -9786,7 +9785,7 @@
9785
if ((userinfo.emailVerified !== true) && (serverinfo.emailcheck == true) && (userinfo.siteadmin != 0xFFFFFFFF)) { setDialogMode(2, "Account Security", 1, null, "Unable to access this feature until a email address is verified. This is required for password recovery. Go to the \"My Account\" tab to change and verify an email address."); return false; }
9786
9787
// Remind the user to add two factor authentication
9789
- if ((features & 0x00040000) && !((userinfo.otpsecret == 1) || (userinfo.otphkeys > 0) || (userinfo.otpkeys > 0) || ((features & 0x02000000) && (features & 0x04000000) && (userinfo.phone != null)) || ((features & 0x00800000) && (userinfo.otpekey == 1)))) { setDialogMode(2, "Account Security", 1, null, "Unable to access this feature until two-factor authentication is enabled. This is required for extra security. Go to the \"My Account\" tab and look at the \"Account Security\" section."); return false; }
9788
+ if ((features & 0x00040000) && (count2factoraAuths() == 0)) { setDialogMode(2, "Account Security", 1, null, "Unable to access this feature until two-factor authentication is enabled. This is required for extra security. Go to the \"My Account\" tab and look at the \"Account Security\" section."); return false; }
9789
9790
// We are allowed, let's prompt to information
9791
var x = "Create a new device group using the options below." + '<br /><br />';
webserver.js
+4
-2
@@ -108,14 +108,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
108
}
109
110
// Perform hash on web certificate and agent certificate
111
- obj.webCertificateHash = obj.defaultWebCertificateHash = parent.certificateOperations.getPublicKeyHashBinary(obj.certificates.web.cert);
111
+ obj.webCertificateHash = parent.certificateOperations.getPublicKeyHashBinary(obj.certificates.web.cert);
112
obj.webCertificateHashs = { '': obj.webCertificateHash };
113
obj.webCertificateHashBase64 = Buffer.from(obj.webCertificateHash, 'binary').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
114
- obj.webCertificateFullHash = obj.defaultWebCertificateFullHash = parent.certificateOperations.getCertHashBinary(obj.certificates.web.cert);
114
+ obj.webCertificateFullHash = parent.certificateOperations.getCertHashBinary(obj.certificates.web.cert);
115
obj.webCertificateFullHashs = { '': obj.webCertificateFullHash };
116
obj.agentCertificateHashHex = parent.certificateOperations.getPublicKeyHash(obj.certificates.agent.cert);
117
obj.agentCertificateHashBase64 = Buffer.from(obj.agentCertificateHashHex, 'hex').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
118
obj.agentCertificateAsn1 = parent.certificateOperations.forge.asn1.toDer(parent.certificateOperations.forge.pki.certificateToAsn1(parent.certificateOperations.forge.pki.certificateFromPem(parent.certificates.agent.cert))).getBytes();
119
+ obj.defaultWebCertificateHash = parent.certificateOperations.getPublicKeyHashBinary(obj.certificates.webdefault.cert);
120
+ obj.defaultWebCertificateFullHash = parent.certificateOperations.getCertHashBinary(obj.certificates.webdefault.cert);
121
122
// Compute the hash of all of the web certificates for each domain
123
for (var i in obj.parent.config.domains) {