Improved environment detection setup.
Ylian Saint-Hilaire committed
Oct 22, 2020 at 13:40 UTC
2df78feb6b90ac41832b360f6479e75269496109
2 files changed
+61
-22
amtmanager.js
+50
-21
@@ -28,22 +28,35 @@ module.exports.CreateAmtManager = function (parent) {
28
const AmtStackCreateService = require('./amt/amt');
29
const ConnectionTypeStrings = { 0: "CIRA", 1: "Relay", 2: "LMS", 3: "Local" };
30
31
- // Load the Intel AMT admin accounts credentials for each domain
32
- if ((parent.config != null) && (parent.config.domains != null)) {
33
- for (var domainid in parent.config.domains) {
34
- var domain = parent.config.domains[domainid];
35
- if ((typeof domain.amtmanager == 'object') && (Array.isArray(domain.amtmanager.amtadminaccount) == true)) {
36
- for (var i in domain.amtmanager.amtadminaccount) {
37
- var c = domain.amtmanager.amtadminaccount[i], c2 = { user: 'admin' };
38
- if (typeof c.user == 'string') { c2.user = c.user; }
39
- if (typeof c.pass == 'string') {
40
- c2.pass = c.pass;
41
- if (obj.amtAdminAccounts[domainid] == null) { obj.amtAdminAccounts[domainid] = []; }
42
- obj.amtAdminAccounts[domainid].push(c2);
43
- }
31
+ // Check that each domain configuration is correct because we are not going to be checking this later.
32
+ if (parent.config == null) parent.config = {};
33
+ if (parent.config.domains == null) parent.config.domains = {};
34
+ for (var domainid in parent.config.domains) {
35
+ var domain = parent.config.domains[domainid];
36
+ if (typeof domain.amtmanager != 'object') { domain.amtmanager = {}; }
37
+
38
+ // Load administrator accounts
39
+ if (Array.isArray(domain.amtmanager.adminaccounts) == true) {
40
+ for (var i = 0; i < domain.amtmanager.adminaccounts.length; i++) {
41
+ var c = domain.amtmanager.adminaccounts[i], c2 = {};
42
+ if (typeof c.user == 'string') { c2.user = c.user; } else { c2.user = 'admin'; }
43
+ if (typeof c.pass == 'string') {
44
+ c2.pass = c.pass;
45
+ if (obj.amtAdminAccounts[domainid] == null) { obj.amtAdminAccounts[domainid] = []; }
46
+ obj.amtAdminAccounts[domainid].push(c2);
47
}
48
}
49
+ }
50
51
+ // Check environment detection
52
+ if (Array.isArray(domain.amtmanager.environmentdetection) == true) {
53
+ var envDetect = [];
54
+ for (var i = 0; i < domain.amtmanager.environmentdetection.length; i++) {
55
+ var x = domain.amtmanager.environmentdetection[i].toLowerCase();
56
+ if ((typeof x == 'string') && (x != '') && (x.length < 64) && (envDetect.indexOf(x) == -1)) { envDetect.push(x); }
57
+ if (envDetect.length >= 4) break; // Maximum of 4 DNS suffix
58
+ }
59
+ if (envDetect.length > 0) { domain.amtmanager.environmentdetection = envDetect; } else { delete domain.amtmanager.environmentdetection; }
60
}
61
}
62
@@ -1076,17 +1089,34 @@ module.exports.CreateAmtManager = function (parent) {
1089
function checkEnvironmentDetection(dev) {
1090
var changes = false;
1091
var editEnvironmentDetectionTmp = [];
1079
- var domains = dev.cira.xxEnvironementDetection['DetectionStrings'];
1080
- if (domains == null) { domains = []; }
1081
-
1082
- if (dev.policy.ciraPolicy == 2) {
1083
- // Check that we have a random environment detection
1084
- if (domains.length == 0) { editEnvironmentDetectionTmp = [Buffer.from(parent.crypto.randomBytes(6), 'binary').toString('hex')]; changes = true; }
1092
+ var currentEnvDetect = dev.cira.xxEnvironementDetection['DetectionStrings'];
1093
+ if (currentEnvDetect == null) { currentEnvDetect = []; }
1094
+
1095
+ if (dev.policy.ciraPolicy == 2) { // ciraPolicy: 0 = Do Nothing, 1 = Clear, 2 = Set
1096
+ const newEnvDetect = parent.config.domains[dev.domainid].amtmanager.environmentdetection;
1097
+ if (newEnvDetect == null) {
1098
+ // If no environment detection is specified in the config.json, check that we have a random environment detection
1099
+ if (currentEnvDetect.length == 0) { editEnvironmentDetectionTmp = [ Buffer.from(parent.crypto.randomBytes(6), 'binary').toString('hex') ]; changes = true; }
1100
+ } else {
1101
+ // Check that we have exactly the correct environement detection suffixes
1102
+ var mismatch = false;
1103
+ if (currentEnvDetect.length != newEnvDetect.length) {
1104
+ mismatch = true;
1105
+ } else {
1106
+ // Check if everything matches
1107
+ for (var i in currentEnvDetect) { if (newEnvDetect.indexOf(currentEnvDetect[i]) == -1) { mismatch = true; } }
1108
+ for (var i in newEnvDetect) { if (currentEnvDetect.indexOf(newEnvDetect[i]) == -1) { mismatch = true; } }
1109
+ }
1110
+ // If not, we need to set the new ones
1111
+ if (mismatch == true) { editEnvironmentDetectionTmp = newEnvDetect; changes = true; }
1112
+ }
1113
+
1114
} else if (dev.policy.ciraPolicy == 1) {
1115
// Check environment detection is clear
1087
- if (domains.length != 0) { editEnvironmentDetectionTmp = []; changes = true; }
1116
+ if (currentEnvDetect.length != 0) { editEnvironmentDetectionTmp = []; changes = true; }
1117
}
1118
1119
+ // If we need to change the environment detection on the remote device, do it now.
1120
if (changes == true) {
1121
var t = Clone(dev.cira.xxEnvironementDetection);
1122
t['DetectionStrings'] = editEnvironmentDetectionTmp;
@@ -1130,7 +1160,6 @@ module.exports.CreateAmtManager = function (parent) {
1160
1161
// Clear user consent requirements
1162
if ((responses['IPS_OptInService'] != null) && (responses['IPS_OptInService'].response['OptInRequired'] != 0)) {
1133
- console.log(responses['IPS_OptInService']);
1163
responses['IPS_OptInService'].response['OptInRequired'] = 0; // 0 = Not Required, 1 = Required for KVM only, 0xFFFFFFFF = Always Required
1164
dev.amtstack.Put('IPS_OptInService', responses['IPS_OptInService'].response, function (stack, name, responses, status) {
1165
const dev = stack.dev;
meshcentral-config-schema.json
+11
-1
@@ -276,7 +276,7 @@
276
"additionalProperties": false,
277
"description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
278
"properties": {
279
- "amtAdminAccount": {
279
+ "AdminAccounts": {
280
"description": "List of username and passwords to try when connecting to Intel AMT.",
281
"type": "array",
282
"items": {
@@ -295,6 +295,16 @@
295
}
296
}
297
}
298
+ },
299
+ "EnvironmentDetection": {
300
+ "description": "List of up to 4 domain suffixes to configure in Intel AMT when activating CIRA.",
301
+ "type": "array",
302
+ "items": {
303
+ "type": "string",
304
+ "minItems": 1,
305
+ "maxItems": 4,
306
+ "uniqueItems": true
307
+ }
308
}
309
}
310
},