Intel AMT ACM activation improvements.

Ylian Saint-Hilaire committed Mar 5, 2021 at 14:58 UTC 44a2506e1ac9d59f266532e9ec07553145792ffc
8 files changed +80 -42
MeshCentralServer.njsproj
+2 -1
@@ -35,9 +35,9 @@
35 <Compile Include="agents\modules_meshcmd\amt-wsman.js" />
36 <Compile Include="agents\modules_meshcmd\amt-xml.js" />
37 <Compile Include="agents\modules_meshcmd\amt.js" />
38 - <Compile Include="agents\modules_meshcmd\identifiers.js" />
38 <Compile Include="agents\modules_meshcmd\smbios.js" />
39 <Compile Include="agents\modules_meshcmd\sysinfo.js" />
40 + <Compile Include="agents\modules_meshcmd\win-securitycenter.js" />
41 <Compile Include="agents\modules_meshcmd_min\amt-ider.min.js" />
42 <Compile Include="agents\modules_meshcmd_min\amt-lme.min.js" />
43 <Compile Include="agents\modules_meshcmd_min\amt-mei.min.js" />
@@ -63,6 +63,7 @@
63 <Compile Include="agents\modules_meshcore\wifi-scanner.js" />
64 <Compile Include="agents\modules_meshcore\win-console.js" />
65 <Compile Include="agents\modules_meshcore\win-info.js" />
66 + <Compile Include="agents\modules_meshcore\win-securitycenter.js" />
67 <Compile Include="agents\modules_meshcore\win-terminal.js" />
68 <Compile Include="agents\modules_meshcore\win-virtual-terminal.js" />
69 <Compile Include="agents\modules_meshcore_min\amt-lme.min.js" />
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+1 -1
@@ -2722,7 +2722,7 @@ function getMeiState(flags, func) {
2722 try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { func(null); return; }
2723 amtMei.on('error', function (e) { func(null); return; });
2724 try {
2725 - var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2725 + var amtMeiTmpState = { 'core-ver': 1, OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2726 amtMei.getProtocolVersion(function (result) { if (result != null) { amtMeiTmpState.MeiVersion = result; } });
2727 if ((flags & 1) != 0) { amtMei.getVersion(function (result) { if (result) { amtMeiTmpState.Versions = {}; for (var version in result.Versions) { amtMeiTmpState.Versions[result.Versions[version].Description] = result.Versions[version].Version; } } }); }
2728 amtMei.getProvisioningMode(function (result) { if (result) { amtMeiTmpState.ProvisioningMode = result.mode; } });
agents/meshcore.js
+9 -7
@@ -1198,14 +1198,16 @@ function handleServerCommand(data) {
1198 }
1199 if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
1200 if (data.action == 'startTlsHostConfig') { // Request start of host based TLS ACM activation
1201 - amt.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) {
1202 - apftunnel.sendStartTlsHostConfigResponse(response);
1203 - });
1201 + var amtMeiModule, amtMei;
1202 + try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { if (apftunnel) apftunnel.sendMeiDeactivationState(1); return; }
1203 + amtMei.on('error', function (e) { if (apftunnel) apftunnel.sendStartTlsHostConfigResponse({ state: -104 }); });
1204 + amtMei.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) { apftunnel.sendStartTlsHostConfigResponse(response); });
1205 }
1206 if (data.action == 'stopConfiguration') { // Request Intel AMT stop configuration.
1206 - amt.stopConfiguration(function (response) {
1207 - apftunnel.sendStopConfigurationResponse(response);
1208 - });
1207 + var amtMeiModule, amtMei;
1208 + try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { if (apftunnel) apftunnel.sendMeiDeactivationState(1); return; }
1209 + amtMei.on('error', function (e) { if (apftunnel) apftunnel.sendStopConfigurationResponse({ state: -104 }); });
1210 + amtMei.stopConfiguration(function (status) { apftunnel.sendStopConfigurationResponse(status); });
1211 }
1212 }
1213 apftunnel.onChannelClosed = function () { addAmtEvent('LMS tunnel closed.'); apftunnel = null; }
@@ -1232,7 +1234,7 @@ function handleServerCommand(data) {
1234 break;
1235 }
1236 case 'coredump':
1235 - // Set the current agent coredump situation.
1237 + // Set the current agent coredump situation.s
1238 if (data.value === true) {
1239 if (process.platform == 'win32') {
1240 // TODO: This replace() below is not ideal, would be better to remove the .exe at the end instead of replace.
agents/modules_meshcore/amt-manage.js
+1 -1
@@ -87,7 +87,7 @@ function AmtManager(agent, db, isdebug) {
87 obj.getMeiState = function(flags, func) {
88 if ((amtMei == null) || (amtMeiState < 2)) { if (func != null) { func(null); } return; }
89 try {
90 - var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
90 + var amtMeiTmpState = { 'core-ver': 1, OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
91 if (getMeiStateCache.MeiVersion != null) { amtMeiTmpState.MeiVersion = getMeiStateCache.MeiVersion; } else { amtMei.getProtocolVersion(function (result) { if (result != null) { getMeiStateCache.MeiVersion = amtMeiTmpState.MeiVersion = result; } }); }
92 if ((flags & 1) != 0) {
93 if (getMeiStateCache.Versions != null) {
amtmanager.js
+66 -31
@@ -242,9 +242,18 @@ module.exports.CreateAmtManager = function (parent) {
242 deactivateIntelAmtCCMEx(dev, jsondata.value);
243 break;
244 case 'meiState':
245 - if (dev.pendingUpdatedMeiState != 1) break;
246 - delete dev.pendingUpdatedMeiState;
247 - attemptInitialContact(dev);
245 + if (dev.acmactivate == 1) {
246 + // Continue ACM activation
247 + dev.consoleMsg("Got new Intel AMT MEI state. Holding 40 seconds prior to ACM activation...");
248 + delete dev.acmactivate;
249 + var continueAcmFunc = function continueAcm() { if (isAmtDeviceValid(continueAcm.dev)) { activateIntelAmtAcmEx0(continueAcm.dev); } }
250 + continueAcmFunc.dev = dev;
251 + setTimeout(continueAcmFunc, 40000);
252 + } else {
253 + if (dev.pendingUpdatedMeiState != 1) break;
254 + delete dev.pendingUpdatedMeiState;
255 + attemptInitialContact(dev);
256 + }
257 break;
258 case 'startTlsHostConfig':
259 if (dev.acmTlsInfo == null) break;
@@ -256,10 +265,14 @@ module.exports.CreateAmtManager = function (parent) {
265 break;
266 case 'stopConfiguration':
267 if (dev.acmactivate != 1) break;
259 - delete dev.acmactivate;
260 - if (jsondata.value == 3) { activateIntelAmtAcmEx0(dev); } // Intel AMT was already not in in-provisioning state, keep going right away.
261 - else if (jsondata.value == 0) { dev.consoleMsg("Cleared in-provisioning state. Holding 20 seconds prior to ACM activation..."); setTimeout(function () { activateIntelAmtAcmEx0(dev); }, 20000); }
262 - else { dev.consoleMsg("Unknown stopConfiguration() state of " + jsondata.value + ". Continuing with ACM activation..."); activateIntelAmtAcmEx0(dev); }
268 + if (jsondata.value == 3) { delete dev.acmactivate; activateIntelAmtAcmEx0(dev); } // Intel AMT was already not in in-provisioning state, keep going right away.
269 + else if (jsondata.value == 0) {
270 + dev.consoleMsg("Cleared in-provisioning state. Holding 30 seconds prior to getting Intel AMT MEI state...");
271 + var askStateFunc = function askState() { if (isAmtDeviceValid(askState.dev)) { askState.dev.controlMsg({ action: 'mestate' }); } }
272 + askStateFunc.dev = dev;
273 + setTimeout(askStateFunc, 30000);
274 + }
275 + else { dev.consoleMsg("Unknown stopConfiguration() state of " + jsondata.value + ". Continuing with ACM activation..."); delete dev.acmactivate; activateIntelAmtAcmEx0(dev); }
276 break;
277 }
278 }
@@ -1813,23 +1826,31 @@ module.exports.CreateAmtManager = function (parent) {
1826
1827 // Attempt Intel AMT TLS ACM activation
1828 function activateIntelAmtTlsAcm(dev, password, acminfo) {
1816 - // Generate a random Intel AMT password if needed
1817 - if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1818 - dev.temp = { pass: password, acminfo: acminfo };
1819 -
1820 - // Get our ACM activation certificate chain
1821 - var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1822 - if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1823 - dev.acmTlsInfo = acmTlsInfo;
1824 -
1825 - // Send the MEI command to enable TLS connections
1826 - dev.consoleMsg("Performing TLS ACM activation...");
1827 - dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1829 + // Check if MeshAgent/MeshCMD can support the startConfigurationhostB() call.
1830 + if ((dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null) && (typeof dev.mpsConnection.tag.meiState['core-ver'] == 'number') && (dev.mpsConnection.tag.meiState['core-ver'] > 0)) {
1831 + // Generate a random Intel AMT password if needed
1832 + if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1833 + dev.temp = { pass: password, acminfo: acminfo };
1834 +
1835 + // Get our ACM activation certificate chain
1836 + var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1837 + if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1838 + dev.acmTlsInfo = acmTlsInfo;
1839 +
1840 + // Send the MEI command to enable TLS connections
1841 + dev.consoleMsg("Performing TLS ACM activation...");
1842 + dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1843 + } else {
1844 + // MeshCore or MeshCMD is to old
1845 + dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
1846 + removeAmtDevice(dev);
1847 + }
1848 }
1849
1850 // Attempt Intel AMT TLS ACM activation after startConfiguration() is called on remote device
1851 function activateIntelAmtTlsAcmEx(dev, startConfigData) {
1832 - console.log('activateIntelAmtTlsAcmEx');
1852 + console.log('activateIntelAmtTlsAcmEx', dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass);
1853 +
1854 // Setup the WSMAN stack, no TLS
1855 var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs, key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1856 // TODO: Intel AMT leaf TLS cert need to SHA256 hash to "startConfigData.hash"
@@ -1843,25 +1864,39 @@ module.exports.CreateAmtManager = function (parent) {
1864 console.log('activateIntelAmtTlsAcmEx1', status, responses);
1865 const dev = stack.dev;
1866 if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1846 - if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev, 45); return; }
1847 -
1848 - // TODO!!!
1867 + if (status != 200) {
1868 + dev.consoleMsg("Failed to perform ACM TLS connection, falling back to legacy host-based activation.");
1869 + activateIntelAmtAcm(dev); // Falling back to legacy WSMAN ACM activation, start by refreshing $$OsAdmin username and password.
1870 + } else {
1871 + // TODO!!!
1872 + }
1873 }
1874
1875 // Attempt Intel AMT ACM activation
1876 function activateIntelAmtAcm(dev, password, acminfo) {
1853 - // Generate a random Intel AMT password if needed
1854 - if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1855 - dev.temp = { pass: password, acminfo: acminfo };
1856 - dev.acmactivate = 1;
1877 + // Check if MeshAgent/MeshCMD can support the stopConfiguration() call.
1878 + if ((dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null) && (typeof dev.mpsConnection.tag.meiState['core-ver'] == 'number') && (dev.mpsConnection.tag.meiState['core-ver'] > 0)) {
1879 + // Generate a random Intel AMT password if needed
1880 + if (acminfo != null) {
1881 + if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1882 + dev.temp = { pass: password, acminfo: acminfo };
1883 + }
1884 + dev.acmactivate = 1;
1885
1858 - // Send the MEI command to stop configuration.
1859 - // If Intel AMT is "in-provisioning" mode, the WSMAN ACM activation will not work, so we need to do this first.
1860 - dev.consoleMsg("Getting ready for ACM activation...");
1861 - dev.controlMsg({ action: 'stopConfiguration' });
1886 + // Send the MEI command to stop configuration.
1887 + // If Intel AMT is "in-provisioning" mode, the WSMAN ACM activation will not work, so we need to do this first.
1888 + dev.consoleMsg("Getting ready for ACM activation...");
1889 + dev.controlMsg({ action: 'stopConfiguration' });
1890 + } else {
1891 + // MeshCore or MeshCMD is to old
1892 + dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
1893 + removeAmtDevice(dev);
1894 + }
1895 }
1896
1897 function activateIntelAmtAcmEx0(dev) {
1898 + if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1899 +
1900 // Setup the WSMAN stack, no TLS
1901 var comm = CreateWsmanComm(dev.nodeid, 16992, dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass, 0, null, dev.mpsConnection); // No TLS
1902 var wsstack = WsmanStackCreateService(comm);
meshcentral.js
+1 -1
@@ -454,7 +454,7 @@ function CreateMeshCentralServer(config, args) {
454 if (error != null) {
455 // This is an un-expected restart
456 console.log(error);
457 - console.log('ERROR: MeshCentral failed with critical error, check MeshErrors.txt. Restarting in 5 seconds...');
457 + console.log('ERROR: MeshCentral failed with critical error, check mesherrors.txt. Restarting in 5 seconds...');
458 setTimeout(function () { obj.launchChildServer(startArgs); }, 5000);
459 }
460 }