Added per-domain agent customizations, #3736
Ylian Saint-Hilaire committed
Mar 5, 2022 at 09:35 UTC
30e15efd8d382745230f5c444b07130a3afb28e6
3 files changed
+58
-28
meshagent.js
+8
-1
@@ -927,6 +927,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
927
// Not sure why, but in rare cases, obj.agentInfo is undefined here.
928
if ((obj.agentInfo == null) || (typeof obj.agentInfo.capabilities != 'number')) { return; } // This is an odd case.
929
obj.agentExeInfo = parent.parent.meshAgentBinaries[obj.agentInfo.agentId];
930
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[obj.agentInfo.agentId]) { obj.agentExeInfo = domain.meshAgentBinaries[obj.agentInfo.agentId]; }
931
932
// Check if this agent is reconnecting too often.
933
if (disconnectCount > 4) {
@@ -2093,7 +2094,13 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
2094
// If the hash matches or is null, no update required.
2095
if ((agentExeInfo.hash == agentHash) || (agentHash == '\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0')) return 0;
2096
// If this is a macOS x86 or ARM agent type and it matched the universal binary, no update required.
2096
- if (((agentExeInfo.id == 16) || (agentExeInfo.id == 29)) && (parent.parent.meshAgentBinaries[10005].hash == agentHash)) return 0;
2097
+ if ((agentExeInfo.id == 16) || (agentExeInfo.id == 29)) {
2098
+ if (domain.meshAgentBinaries[10005]) {
2099
+ if (domain.meshAgentBinaries[10005].hash == agentHash) return 0;
2100
+ } else {
2101
+ if (parent.parent.meshAgentBinaries[10005].hash == agentHash) return 0;
2102
+ }
2103
+ }
2104
2105
// No match, update the agent.
2106
if (args.agentupdatesystem === 2) return 2; // If set, force a meshcore update.
meshcentral.js
+39
-26
@@ -1572,9 +1572,12 @@ function CreateMeshCentralServer(config, args) {
1572
}
1573
} catch (ex) { }
1574
1575
+ // Load any domain specific agents
1576
+ for (var i in obj.config.domains) { if (i != '') { obj.updateMeshAgentsTable(obj.config.domains[i], function () { }); } }
1577
+
1578
// Load the list of mesh agents and install scripts
1579
if ((obj.args.noagentupdate == 1) || (obj.args.noagentupdate == true)) { for (i in obj.meshAgentsArchitectureNumbers) { obj.meshAgentsArchitectureNumbers[i].update = false; } }
1577
- obj.updateMeshAgentsTable(function () {
1580
+ obj.updateMeshAgentsTable(null, function () {
1581
obj.updateMeshAgentInstallScripts();
1582
1583
// Setup and start the web server
@@ -2791,16 +2794,26 @@ function CreateMeshCentralServer(config, args) {
2794
};
2795
2796
// Update the list of available mesh agents
2794
- obj.updateMeshAgentsTable = function (func) {
2797
+ obj.updateMeshAgentsTable = function (domain, func) {
2798
+ // Setup the domain is specified
2799
+ var objx = domain, suffix = '';
2800
+ if (objx == null) { objx = obj; } else { suffix = '-' + domain.id; objx.meshAgentBinaries = {}; }
2801
+
2802
// Load agent information file. This includes the data & time of the agent.
2803
var agentInfo = [];
2804
try { agentInfo = JSON.parse(obj.fs.readFileSync(obj.path.join(__dirname, 'agents', 'hashagents.json'), 'utf8')); } catch (ex) { }
2805
2806
var archcount = 0;
2807
for (var archid in obj.meshAgentsArchitectureNumbers) {
2801
- var agentpath = obj.path.join(__dirname, 'agents', obj.meshAgentsArchitectureNumbers[archid].localname);
2802
- var agentpath2 = obj.path.join(obj.datapath, 'agents', obj.meshAgentsArchitectureNumbers[archid].localname);
2803
- if (obj.fs.existsSync(agentpath2)) { agentpath = agentpath2; } // If the agent is present in "meshcentral-data/agents", use that one instead.
2808
+ var agentpath;
2809
+ if (domain == null) {
2810
+ agentpath = obj.path.join(__dirname, 'agents' + suffix, obj.meshAgentsArchitectureNumbers[archid].localname);
2811
+ var agentpath2 = obj.path.join(obj.datapath, 'agents' + suffix, obj.meshAgentsArchitectureNumbers[archid].localname);
2812
+ if (obj.fs.existsSync(agentpath2)) { agentpath = agentpath2; } // If the agent is present in "meshcentral-data/agents", use that one instead.
2813
+ } else {
2814
+ var agentpath = obj.path.join(obj.datapath, 'agents' + suffix, obj.meshAgentsArchitectureNumbers[archid].localname);
2815
+ if (!obj.fs.existsSync(agentpath)) continue; // If the agent is not present in "meshcentral-data/agents" skip.
2816
+ }
2817
2818
// Fetch all the agent binary information
2819
var stats = null;
@@ -2808,15 +2821,15 @@ function CreateMeshCentralServer(config, args) {
2821
if ((stats != null)) {
2822
// If file exists
2823
archcount++;
2811
- obj.meshAgentBinaries[archid] = Object.assign({}, obj.meshAgentsArchitectureNumbers[archid]);
2812
- obj.meshAgentBinaries[archid].path = agentpath;
2813
- obj.meshAgentBinaries[archid].url = 'http://' + obj.certificates.CommonName + ':' + ((typeof obj.args.aliasport == 'number') ? obj.args.aliasport : obj.args.port) + '/meshagents?id=' + archid;
2814
- obj.meshAgentBinaries[archid].size = stats.size;
2815
- if ((agentInfo[archid] != null) && (agentInfo[archid].mtime != null)) { obj.meshAgentBinaries[archid].mtime = new Date(agentInfo[archid].mtime); } // Set agent time if available
2824
+ objx.meshAgentBinaries[archid] = Object.assign({}, obj.meshAgentsArchitectureNumbers[archid]);
2825
+ objx.meshAgentBinaries[archid].path = agentpath;
2826
+ objx.meshAgentBinaries[archid].url = 'http://' + obj.certificates.CommonName + ':' + ((typeof obj.args.aliasport == 'number') ? obj.args.aliasport : obj.args.port) + '/meshagents?id=' + archid;
2827
+ objx.meshAgentBinaries[archid].size = stats.size;
2828
+ if ((agentInfo[archid] != null) && (agentInfo[archid].mtime != null)) { objx.meshAgentBinaries[archid].mtime = new Date(agentInfo[archid].mtime); } // Set agent time if available
2829
2830
// If this is a windows binary, pull binary information
2831
if (obj.meshAgentsArchitectureNumbers[archid].platform == 'win32') {
2819
- try { obj.meshAgentBinaries[archid].pe = obj.exeHandler.parseWindowsExecutable(agentpath); } catch (ex) { }
2832
+ try { objx.meshAgentBinaries[archid].pe = obj.exeHandler.parseWindowsExecutable(agentpath); } catch (ex) { }
2833
}
2834
2835
// If agents must be stored in RAM or if this is a Windows 32/64 agent, load the agent in RAM.
@@ -2824,7 +2837,7 @@ function CreateMeshCentralServer(config, args) {
2837
if ((archid == 3) || (archid == 4)) {
2838
// Load the agent with a random msh added to it.
2839
var outStream = new require('stream').Duplex();
2827
- outStream.meshAgentBinary = obj.meshAgentBinaries[archid];
2840
+ outStream.meshAgentBinary = objx.meshAgentBinaries[archid];
2841
outStream.meshAgentBinary.randomMsh = Buffer.from(obj.crypto.randomBytes(64), 'binary').toString('base64');
2842
outStream.bufferList = [];
2843
outStream._write = function (chunk, encoding, callback) { this.bufferList.push(chunk); if (callback) callback(); }; // Append the chuck.
@@ -2883,11 +2896,11 @@ function CreateMeshCentralServer(config, args) {
2896
destinationStream: outStream,
2897
randomPolicy: true, // Indicates that the msh policy is random data.
2898
msh: outStream.meshAgentBinary.randomMsh,
2886
- peinfo: obj.meshAgentBinaries[archid].pe
2899
+ peinfo: objx.meshAgentBinaries[archid].pe
2900
});
2901
} else {
2902
// Load the agent as-is
2890
- obj.meshAgentBinaries[archid].data = obj.fs.readFileSync(agentpath);
2903
+ objx.meshAgentBinaries[archid].data = obj.fs.readFileSync(agentpath);
2904
2905
// Compress the agent using ZIP
2906
var archive = require('archiver')('zip', { level: 9 }); // Sets the compression method.
@@ -2910,14 +2923,14 @@ function CreateMeshCentralServer(config, args) {
2923
//console.log('Packed', onZipData.x.size, onZipData.x.zsize);
2924
}
2925
const onZipError = function onZipError() { delete onZipData.x.zacc; }
2913
- obj.meshAgentBinaries[archid].zacc = [];
2914
- onZipData.x = obj.meshAgentBinaries[archid];
2915
- onZipEnd.x = obj.meshAgentBinaries[archid];
2916
- onZipError.x = obj.meshAgentBinaries[archid];
2926
+ objx.meshAgentBinaries[archid].zacc = [];
2927
+ onZipData.x = objx.meshAgentBinaries[archid];
2928
+ onZipEnd.x = objx.meshAgentBinaries[archid];
2929
+ onZipError.x = objx.meshAgentBinaries[archid];
2930
archive.on('data', onZipData);
2931
archive.on('end', onZipEnd);
2932
archive.on('error', onZipError);
2920
- archive.append(obj.meshAgentBinaries[archid].data, { name: 'meshagent' });
2933
+ archive.append(objx.meshAgentBinaries[archid].data, { name: 'meshagent' });
2934
archive.finalize();
2935
}
2936
}
@@ -2926,24 +2939,24 @@ function CreateMeshCentralServer(config, args) {
2939
var hashStream = obj.crypto.createHash('sha384');
2940
hashStream.archid = archid;
2941
hashStream.on('data', function (data) {
2929
- obj.meshAgentBinaries[this.archid].hash = data.toString('binary');
2930
- obj.meshAgentBinaries[this.archid].hashhex = data.toString('hex');
2942
+ objx.meshAgentBinaries[this.archid].hash = data.toString('binary');
2943
+ objx.meshAgentBinaries[this.archid].hashhex = data.toString('hex');
2944
if ((--archcount == 0) && (func != null)) { func(); }
2945
});
2946
var options = { sourcePath: agentpath, targetStream: hashStream, platform: obj.meshAgentsArchitectureNumbers[archid].platform };
2934
- if (obj.meshAgentBinaries[archid].pe != null) { options.peinfo = obj.meshAgentBinaries[archid].pe; }
2947
+ if (objx.meshAgentBinaries[archid].pe != null) { options.peinfo = objx.meshAgentBinaries[archid].pe; }
2948
obj.exeHandler.hashExecutableFile(options);
2949
2950
// If we are not loading Windows binaries to RAM, compute the RAW file hash of the signed binaries here.
2951
if ((obj.args.agentsinram === false) && ((archid == 3) || (archid == 4))) {
2952
var hash = obj.crypto.createHash('sha384').update(obj.fs.readFileSync(agentpath));
2940
- obj.meshAgentBinaries[archid].fileHash = hash.digest('binary');
2941
- obj.meshAgentBinaries[archid].fileHashHex = Buffer.from(obj.meshAgentBinaries[archid].fileHash, 'binary').toString('hex');
2953
+ objx.meshAgentBinaries[archid].fileHash = hash.digest('binary');
2954
+ objx.meshAgentBinaries[archid].fileHashHex = Buffer.from(objx.meshAgentBinaries[archid].fileHash, 'binary').toString('hex');
2955
}
2956
}
2957
}
2945
- if ((obj.meshAgentBinaries[3] == null) && (obj.meshAgentBinaries[10003] != null)) { obj.meshAgentBinaries[3] = obj.meshAgentBinaries[10003]; } // If only the unsigned windows binaries are present, use them.
2946
- if ((obj.meshAgentBinaries[4] == null) && (obj.meshAgentBinaries[10004] != null)) { obj.meshAgentBinaries[4] = obj.meshAgentBinaries[10004]; } // If only the unsigned windows binaries are present, use them.
2958
+ if ((objx.meshAgentBinaries[3] == null) && (objx.meshAgentBinaries[10003] != null)) { objx.meshAgentBinaries[3] = objx.meshAgentBinaries[10003]; } // If only the unsigned windows binaries are present, use them.
2959
+ if ((objx.meshAgentBinaries[4] == null) && (objx.meshAgentBinaries[10004] != null)) { objx.meshAgentBinaries[4] = objx.meshAgentBinaries[10004]; } // If only the unsigned windows binaries are present, use them.
2960
};
2961
2962
// Generate a time limited user login token
webserver.js
+11
-1
@@ -4864,6 +4864,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
4864
// Get the interactive install script, this only works for non-Windows agents
4865
var agentid = parseInt(req.query.meshinstall);
4866
var argentInfo = obj.parent.meshAgentBinaries[agentid];
4867
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[agentid]) { argentInfo = domain.meshAgentBinaries[agentid]; }
4868
var scriptInfo = obj.parent.meshAgentInstallScripts[6];
4869
if ((argentInfo == null) || (scriptInfo == null) || (argentInfo.platform == 'win32')) { try { res.sendStatus(404); } catch (ex) { } return; }
4870
@@ -4883,6 +4884,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
4884
} else if (req.query.id != null) {
4885
// Send a specific mesh agent back
4886
var argentInfo = obj.parent.meshAgentBinaries[req.query.id];
4887
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[req.query.id]) { argentInfo = domain.meshAgentBinaries[req.query.id]; }
4888
if (argentInfo == null) { try { res.sendStatus(404); } catch (ex) { } return; }
4889
4890
// Download PDB debug files, only allowed for administrator or accounts with agent dump access
@@ -4998,7 +5000,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5000
}
5001
setContentDispositionHeader(res, 'application/octet-stream', meshfilename, null, argentInfo.rname);
5002
if (argentInfo.mtime != null) { res.setHeader('Last-Modified', argentInfo.mtime.toUTCString()); }
5001
- obj.parent.exeHandler.streamExeWithMeshPolicy({ platform: 'win32', sourceFileName: obj.parent.meshAgentBinaries[req.query.id].path, destinationStream: res, msh: meshsettings, peinfo: obj.parent.meshAgentBinaries[req.query.id].pe });
5003
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[req.query.id]) {
5004
+ obj.parent.exeHandler.streamExeWithMeshPolicy({ platform: 'win32', sourceFileName: domain.meshAgentBinaries[req.query.id].path, destinationStream: res, msh: meshsettings, peinfo: domain.meshAgentBinaries[req.query.id].pe });
5005
+ } else {
5006
+ obj.parent.exeHandler.streamExeWithMeshPolicy({ platform: 'win32', sourceFileName: obj.parent.meshAgentBinaries[req.query.id].path, destinationStream: res, msh: meshsettings, peinfo: obj.parent.meshAgentBinaries[req.query.id].pe });
5007
+ }
5008
return;
5009
}
5010
} else if (req.query.script != null) {
@@ -5048,6 +5054,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5054
// No signed agents, we are going to merge a new MeshCmd.
5055
if (((agentid == 3) || (agentid == 4)) && (obj.parent.meshAgentBinaries[agentid + 10000] != null)) { agentid += 10000; } // Avoid merging javascript to a signed mesh agent.
5056
var argentInfo = obj.parent.meshAgentBinaries[agentid];
5057
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[agentid]) { argentInfo = domain.meshAgentBinaries[agentid]; }
5058
if ((argentInfo == null) || (obj.parent.defaultMeshCmd == null)) { try { res.sendStatus(404); } catch (ex) { } return; }
5059
setContentDispositionHeader(res, 'application/octet-stream', 'meshcmd' + ((req.query.meshcmd <= 4) ? '.exe' : ''), null, 'meshcmd');
5060
res.statusCode = 200;
@@ -5216,6 +5223,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5223
var agentid = parseInt(fileSplit[0]);
5224
if ((isNaN(agentid) == false) && (obj.parent.meshAgentBinaries[agentid] != null)) {
5225
var agentinfo = obj.parent.meshAgentBinaries[agentid];
5226
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[agentid]) { argentInfo = domain.meshAgentBinaries[agentid]; }
5227
var filestats = obj.fs.statSync(obj.path.join(parent.datapath, '..', 'meshcentral-coredumps', file));
5228
coredumps.push({
5229
fileSplit: fileSplit,
@@ -5283,6 +5291,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5291
for (var agentid in obj.parent.meshAgentBinaries) {
5292
if ((agentid >= 10000) && (agentid != 10005)) continue;
5293
var agentinfo = obj.parent.meshAgentBinaries[agentid];
5294
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[agentid]) { argentInfo = domain.meshAgentBinaries[agentid]; }
5295
response += '<tr><td>' + agentinfo.id + '</td><td>' + agentinfo.desc.split(' ').join(' ') + '</td>';
5296
response += '<td><a download href="' + originalUrl + '?id=' + agentinfo.id + (req.query.key ? ('&key=' + req.query.key) : '') + '">' + agentinfo.rname + '</a>';
5297
if ((user.siteadmin == 0xFFFFFFFF) || ((Array.isArray(obj.parent.config.settings.agentcoredumpusers)) && (obj.parent.config.settings.agentcoredumpusers.indexOf(user._id) >= 0))) {
@@ -5319,6 +5328,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5328
5329
// Send a specific mesh agent back
5330
var argentInfo = obj.parent.meshAgentBinaries[req.query.id];
5331
+ if (domain.meshAgentBinaries && domain.meshAgentBinaries[req.query.id]) { argentInfo = domain.meshAgentBinaries[req.query.id]; }
5332
if ((argentInfo == null) || (req.query.meshid == null)) { res.sendStatus(404); return; }
5333
5334
// Check if the meshid is a time limited, encrypted cookie