Intel AMT ACM activation improvements.
Ylian Saint-Hilaire committed
Mar 5, 2021 at 14:58 UTC
44a2506e1ac9d59f266532e9ec07553145792ffc
8 files changed
+80
-42
MeshCentralServer.njsproj
+2
-1
@@ -35,9 +35,9 @@
35
<Compile Include="agents\modules_meshcmd\amt-wsman.js" />
36
<Compile Include="agents\modules_meshcmd\amt-xml.js" />
37
<Compile Include="agents\modules_meshcmd\amt.js" />
38
- <Compile Include="agents\modules_meshcmd\identifiers.js" />
38
<Compile Include="agents\modules_meshcmd\smbios.js" />
39
<Compile Include="agents\modules_meshcmd\sysinfo.js" />
40
+ <Compile Include="agents\modules_meshcmd\win-securitycenter.js" />
41
<Compile Include="agents\modules_meshcmd_min\amt-ider.min.js" />
42
<Compile Include="agents\modules_meshcmd_min\amt-lme.min.js" />
43
<Compile Include="agents\modules_meshcmd_min\amt-mei.min.js" />
@@ -63,6 +63,7 @@
63
<Compile Include="agents\modules_meshcore\wifi-scanner.js" />
64
<Compile Include="agents\modules_meshcore\win-console.js" />
65
<Compile Include="agents\modules_meshcore\win-info.js" />
66
+ <Compile Include="agents\modules_meshcore\win-securitycenter.js" />
67
<Compile Include="agents\modules_meshcore\win-terminal.js" />
68
<Compile Include="agents\modules_meshcore\win-virtual-terminal.js" />
69
<Compile Include="agents\modules_meshcore_min\amt-lme.min.js" />
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+1
-1
@@ -2722,7 +2722,7 @@ function getMeiState(flags, func) {
2722
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { func(null); return; }
2723
amtMei.on('error', function (e) { func(null); return; });
2724
try {
2725
- var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2725
+ var amtMeiTmpState = { 'core-ver': 1, OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2726
amtMei.getProtocolVersion(function (result) { if (result != null) { amtMeiTmpState.MeiVersion = result; } });
2727
if ((flags & 1) != 0) { amtMei.getVersion(function (result) { if (result) { amtMeiTmpState.Versions = {}; for (var version in result.Versions) { amtMeiTmpState.Versions[result.Versions[version].Description] = result.Versions[version].Version; } } }); }
2728
amtMei.getProvisioningMode(function (result) { if (result) { amtMeiTmpState.ProvisioningMode = result.mode; } });
agents/meshcore.js
+9
-7
@@ -1198,14 +1198,16 @@ function handleServerCommand(data) {
1198
}
1199
if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
1200
if (data.action == 'startTlsHostConfig') { // Request start of host based TLS ACM activation
1201
- amt.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) {
1202
- apftunnel.sendStartTlsHostConfigResponse(response);
1203
- });
1201
+ var amtMeiModule, amtMei;
1202
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { if (apftunnel) apftunnel.sendMeiDeactivationState(1); return; }
1203
+ amtMei.on('error', function (e) { if (apftunnel) apftunnel.sendStartTlsHostConfigResponse({ state: -104 }); });
1204
+ amtMei.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) { apftunnel.sendStartTlsHostConfigResponse(response); });
1205
}
1206
if (data.action == 'stopConfiguration') { // Request Intel AMT stop configuration.
1206
- amt.stopConfiguration(function (response) {
1207
- apftunnel.sendStopConfigurationResponse(response);
1208
- });
1207
+ var amtMeiModule, amtMei;
1208
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { if (apftunnel) apftunnel.sendMeiDeactivationState(1); return; }
1209
+ amtMei.on('error', function (e) { if (apftunnel) apftunnel.sendStopConfigurationResponse({ state: -104 }); });
1210
+ amtMei.stopConfiguration(function (status) { apftunnel.sendStopConfigurationResponse(status); });
1211
}
1212
}
1213
apftunnel.onChannelClosed = function () { addAmtEvent('LMS tunnel closed.'); apftunnel = null; }
@@ -1232,7 +1234,7 @@ function handleServerCommand(data) {
1234
break;
1235
}
1236
case 'coredump':
1235
- // Set the current agent coredump situation.
1237
+ // Set the current agent coredump situation.s
1238
if (data.value === true) {
1239
if (process.platform == 'win32') {
1240
// TODO: This replace() below is not ideal, would be better to remove the .exe at the end instead of replace.
agents/modules_meshcore/amt-manage.js
+1
-1
@@ -87,7 +87,7 @@ function AmtManager(agent, db, isdebug) {
87
obj.getMeiState = function(flags, func) {
88
if ((amtMei == null) || (amtMeiState < 2)) { if (func != null) { func(null); } return; }
89
try {
90
- var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
90
+ var amtMeiTmpState = { 'core-ver': 1, OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
91
if (getMeiStateCache.MeiVersion != null) { amtMeiTmpState.MeiVersion = getMeiStateCache.MeiVersion; } else { amtMei.getProtocolVersion(function (result) { if (result != null) { getMeiStateCache.MeiVersion = amtMeiTmpState.MeiVersion = result; } }); }
92
if ((flags & 1) != 0) {
93
if (getMeiStateCache.Versions != null) {
amtmanager.js
+66
-31
@@ -242,9 +242,18 @@ module.exports.CreateAmtManager = function (parent) {
242
deactivateIntelAmtCCMEx(dev, jsondata.value);
243
break;
244
case 'meiState':
245
- if (dev.pendingUpdatedMeiState != 1) break;
246
- delete dev.pendingUpdatedMeiState;
247
- attemptInitialContact(dev);
245
+ if (dev.acmactivate == 1) {
246
+ // Continue ACM activation
247
+ dev.consoleMsg("Got new Intel AMT MEI state. Holding 40 seconds prior to ACM activation...");
248
+ delete dev.acmactivate;
249
+ var continueAcmFunc = function continueAcm() { if (isAmtDeviceValid(continueAcm.dev)) { activateIntelAmtAcmEx0(continueAcm.dev); } }
250
+ continueAcmFunc.dev = dev;
251
+ setTimeout(continueAcmFunc, 40000);
252
+ } else {
253
+ if (dev.pendingUpdatedMeiState != 1) break;
254
+ delete dev.pendingUpdatedMeiState;
255
+ attemptInitialContact(dev);
256
+ }
257
break;
258
case 'startTlsHostConfig':
259
if (dev.acmTlsInfo == null) break;
@@ -256,10 +265,14 @@ module.exports.CreateAmtManager = function (parent) {
265
break;
266
case 'stopConfiguration':
267
if (dev.acmactivate != 1) break;
259
- delete dev.acmactivate;
260
- if (jsondata.value == 3) { activateIntelAmtAcmEx0(dev); } // Intel AMT was already not in in-provisioning state, keep going right away.
261
- else if (jsondata.value == 0) { dev.consoleMsg("Cleared in-provisioning state. Holding 20 seconds prior to ACM activation..."); setTimeout(function () { activateIntelAmtAcmEx0(dev); }, 20000); }
262
- else { dev.consoleMsg("Unknown stopConfiguration() state of " + jsondata.value + ". Continuing with ACM activation..."); activateIntelAmtAcmEx0(dev); }
268
+ if (jsondata.value == 3) { delete dev.acmactivate; activateIntelAmtAcmEx0(dev); } // Intel AMT was already not in in-provisioning state, keep going right away.
269
+ else if (jsondata.value == 0) {
270
+ dev.consoleMsg("Cleared in-provisioning state. Holding 30 seconds prior to getting Intel AMT MEI state...");
271
+ var askStateFunc = function askState() { if (isAmtDeviceValid(askState.dev)) { askState.dev.controlMsg({ action: 'mestate' }); } }
272
+ askStateFunc.dev = dev;
273
+ setTimeout(askStateFunc, 30000);
274
+ }
275
+ else { dev.consoleMsg("Unknown stopConfiguration() state of " + jsondata.value + ". Continuing with ACM activation..."); delete dev.acmactivate; activateIntelAmtAcmEx0(dev); }
276
break;
277
}
278
}
@@ -1813,23 +1826,31 @@ module.exports.CreateAmtManager = function (parent) {
1826
1827
// Attempt Intel AMT TLS ACM activation
1828
function activateIntelAmtTlsAcm(dev, password, acminfo) {
1816
- // Generate a random Intel AMT password if needed
1817
- if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1818
- dev.temp = { pass: password, acminfo: acminfo };
1819
-
1820
- // Get our ACM activation certificate chain
1821
- var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1822
- if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1823
- dev.acmTlsInfo = acmTlsInfo;
1824
-
1825
- // Send the MEI command to enable TLS connections
1826
- dev.consoleMsg("Performing TLS ACM activation...");
1827
- dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1829
+ // Check if MeshAgent/MeshCMD can support the startConfigurationhostB() call.
1830
+ if ((dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null) && (typeof dev.mpsConnection.tag.meiState['core-ver'] == 'number') && (dev.mpsConnection.tag.meiState['core-ver'] > 0)) {
1831
+ // Generate a random Intel AMT password if needed
1832
+ if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1833
+ dev.temp = { pass: password, acminfo: acminfo };
1834
+
1835
+ // Get our ACM activation certificate chain
1836
+ var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1837
+ if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1838
+ dev.acmTlsInfo = acmTlsInfo;
1839
+
1840
+ // Send the MEI command to enable TLS connections
1841
+ dev.consoleMsg("Performing TLS ACM activation...");
1842
+ dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1843
+ } else {
1844
+ // MeshCore or MeshCMD is to old
1845
+ dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
1846
+ removeAmtDevice(dev);
1847
+ }
1848
}
1849
1850
// Attempt Intel AMT TLS ACM activation after startConfiguration() is called on remote device
1851
function activateIntelAmtTlsAcmEx(dev, startConfigData) {
1832
- console.log('activateIntelAmtTlsAcmEx');
1852
+ console.log('activateIntelAmtTlsAcmEx', dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass);
1853
+
1854
// Setup the WSMAN stack, no TLS
1855
var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs, key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1856
// TODO: Intel AMT leaf TLS cert need to SHA256 hash to "startConfigData.hash"
@@ -1843,25 +1864,39 @@ module.exports.CreateAmtManager = function (parent) {
1864
console.log('activateIntelAmtTlsAcmEx1', status, responses);
1865
const dev = stack.dev;
1866
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1846
- if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev, 45); return; }
1847
-
1848
- // TODO!!!
1867
+ if (status != 200) {
1868
+ dev.consoleMsg("Failed to perform ACM TLS connection, falling back to legacy host-based activation.");
1869
+ activateIntelAmtAcm(dev); // Falling back to legacy WSMAN ACM activation, start by refreshing $$OsAdmin username and password.
1870
+ } else {
1871
+ // TODO!!!
1872
+ }
1873
}
1874
1875
// Attempt Intel AMT ACM activation
1876
function activateIntelAmtAcm(dev, password, acminfo) {
1853
- // Generate a random Intel AMT password if needed
1854
- if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1855
- dev.temp = { pass: password, acminfo: acminfo };
1856
- dev.acmactivate = 1;
1877
+ // Check if MeshAgent/MeshCMD can support the stopConfiguration() call.
1878
+ if ((dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null) && (typeof dev.mpsConnection.tag.meiState['core-ver'] == 'number') && (dev.mpsConnection.tag.meiState['core-ver'] > 0)) {
1879
+ // Generate a random Intel AMT password if needed
1880
+ if (acminfo != null) {
1881
+ if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1882
+ dev.temp = { pass: password, acminfo: acminfo };
1883
+ }
1884
+ dev.acmactivate = 1;
1885
1858
- // Send the MEI command to stop configuration.
1859
- // If Intel AMT is "in-provisioning" mode, the WSMAN ACM activation will not work, so we need to do this first.
1860
- dev.consoleMsg("Getting ready for ACM activation...");
1861
- dev.controlMsg({ action: 'stopConfiguration' });
1886
+ // Send the MEI command to stop configuration.
1887
+ // If Intel AMT is "in-provisioning" mode, the WSMAN ACM activation will not work, so we need to do this first.
1888
+ dev.consoleMsg("Getting ready for ACM activation...");
1889
+ dev.controlMsg({ action: 'stopConfiguration' });
1890
+ } else {
1891
+ // MeshCore or MeshCMD is to old
1892
+ dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
1893
+ removeAmtDevice(dev);
1894
+ }
1895
}
1896
1897
function activateIntelAmtAcmEx0(dev) {
1898
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1899
+
1900
// Setup the WSMAN stack, no TLS
1901
var comm = CreateWsmanComm(dev.nodeid, 16992, dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass, 0, null, dev.mpsConnection); // No TLS
1902
var wsstack = WsmanStackCreateService(comm);
meshcentral.js
+1
-1
@@ -454,7 +454,7 @@ function CreateMeshCentralServer(config, args) {
454
if (error != null) {
455
// This is an un-expected restart
456
console.log(error);
457
- console.log('ERROR: MeshCentral failed with critical error, check MeshErrors.txt. Restarting in 5 seconds...');
457
+ console.log('ERROR: MeshCentral failed with critical error, check mesherrors.txt. Restarting in 5 seconds...');
458
setTimeout(function () { obj.launchChildServer(startArgs); }, 5000);
459
}
460
}