more Intel AMT ACM work...
Ylian Saint-Hilaire committed
Jun 22, 2019 at 22:06 UTC
4f16e0f2ca5b38d9a9c25526e3fe4400db4892d6
7 files changed
+53
-6
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+9
-2
@@ -57,7 +57,13 @@ var Small_IntelAmtWebApp = "H4sIAAAAAAAEAHq/e7+Noou/c0hkgCuA0+pcchQHwq9CeXNgFzwZ
57
function onVerifyServer(clientName, certs) {
58
if (certs == null) { certs = clientName; } // Temporary thing until we fix duktape
59
try { for (var i in certs) { if (certs[i].fingerprint.replace(/:/g, '') == settings.serverhttpshash) { return; } } } catch (e) { }
60
- if (serverhash != null) { console.log('Error: Failed to verify server certificate.'); throw 'Invalid server certificate'; }
60
+ console.log(settings.serverhttpshash);
61
+ if (settings.serverhttpshash != null) {
62
+ console.log('Error: Failed to verify server certificate.');
63
+ console.log('Server TLS hash: ' + certs[i].fingerprint.replace(/:/g, ''));
64
+ exit(255);
65
+ throw 'Invalid server certificate';
66
+ }
67
}
68
69
// Various utility functions
@@ -927,7 +933,8 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
933
934
// Establish WebSocket connection to activation server
935
var options = http.parseUri(settings.url);
930
- options.checkServerIdentity = function (clientName, certs) { }; // TODO
936
+ //options.checkServerIdentity = function (clientName, certs) { }; // TODO
937
+ options.checkServerIdentity = onVerifyServer;
938
options.rejectUnauthorized = false;
939
var connection = http.request(options);
940
connection.on('upgrade', function (response, socket) {
agents/meshcmd.min.js
+9
-2
@@ -57,7 +57,13 @@ var Small_IntelAmtWebApp = "H4sIAAAAAAAEAHq/e7+Noou/c0hkgCuA0+pcchQHwq9CeXNgFzwZ
57
function onVerifyServer(clientName, certs) {
58
if (certs == null) { certs = clientName; } // Temporary thing until we fix duktape
59
try { for (var i in certs) { if (certs[i].fingerprint.replace(/:/g, '') == settings.serverhttpshash) { return; } } } catch (e) { }
60
- if (serverhash != null) { console.log('Error: Failed to verify server certificate.'); throw 'Invalid server certificate'; }
60
+ console.log(settings.serverhttpshash);
61
+ if (settings.serverhttpshash != null) {
62
+ console.log('Error: Failed to verify server certificate.');
63
+ console.log('Server TLS hash: ' + certs[i].fingerprint.replace(/:/g, ''));
64
+ exit(255);
65
+ throw 'Invalid server certificate';
66
+ }
67
}
68
69
// Various utility functions
@@ -927,7 +933,8 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
933
934
// Establish WebSocket connection to activation server
935
var options = http.parseUri(settings.url);
930
- options.checkServerIdentity = function (clientName, certs) { }; // TODO
936
+ //options.checkServerIdentity = function (clientName, certs) { }; // TODO
937
+ options.checkServerIdentity = onVerifyServer;
938
options.rejectUnauthorized = false;
939
var connection = http.request(options);
940
connection.on('upgrade', function (response, socket) {
meshuser.js
+9
@@ -291,6 +291,15 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
291
292
// Build server information object
293
var serverinfo = { name: domain.dns ? domain.dns : parent.certificates.CommonName, mpsname: parent.certificates.AmtMpsName, mpsport: mpsport, mpspass: args.mpspass, port: httpport, emailcheck: ((parent.parent.mailserver != null) && (domain.auth != 'sspi') && (domain.auth != 'ldap') && (args.lanonly != true) && (parent.certificates.CommonName != null) && (parent.certificates.CommonName.indexOf('.') != -1)), domainauth: ((domain.auth == 'sspi') || (domain.auth == 'ldap')) };
294
+ serverinfo.tlshash = Buffer.from(parent.webCertificateHashs[domain.id], 'binary').toString('hex').toUpperCase(); // SHA384 of server HTTPS certificate
295
+ if ((parent.parent.config.domains[domain.id].amtacmactivation != null) && (parent.parent.config.domains[domain.id].amtacmactivation.acmmatch != null)) {
296
+ var matchingDomains = [];
297
+ for (var i in parent.parent.config.domains[domain.id].amtacmactivation.acmmatch) {
298
+ var cn = parent.parent.config.domains[domain.id].amtacmactivation.acmmatch[i].cn;
299
+ if ((cn != '*') && (matchingDomains.indexOf(cn) == -1)) { matchingDomains.push(cn); }
300
+ }
301
+ if (matchingDomains.length > 0) { serverinfo.amtAcmFqdn = matchingDomains; }
302
+ }
303
if (args.notls == true) { serverinfo.https = false; } else { serverinfo.https = true; serverinfo.redirport = args.redirport; }
304
if (typeof domain.userconsentflags == 'number') { serverinfo.consent = domain.userconsentflags; }
305
if ((typeof domain.usersessionidletimeout == 'number') && (domain.usersessionidletimeout > 0)) { serverinfo.timeout = (domain.usersessionidletimeout * 60 * 1000); }
views/default.handlebars
+24
@@ -2577,6 +2577,9 @@
2577
r += ' <a style=cursor:pointer;font-size:10px title="Add a new Intel® AMT computer that is located on the local network." onclick=addDeviceToMesh(\"' + mesh._id + '\")>Add Local</a>';
2578
r += ' <a style=cursor:pointer;font-size:10px title="Add a new Intel® AMT computer by scanning the local network." onclick=addAmtScanToMesh(\"' + mesh._id + '\")>Scan Network</a>';
2579
}
2580
+ if ((features & 0x00100000) != 0) { // ACM activation
2581
+ r += ' <a style=cursor:pointer;font-size:10px title="Perform Intel AMT admin control mode (ACM) activation." onclick=showAcmActivation(\"' + mesh._id + '\")>Activation</a>';
2582
+ }
2583
}
2584
if (mesh.mtype == 2) {
2585
r += ' <a style=cursor:pointer;font-size:10px title="Add a new computer to this mesh by installing the mesh agent." onclick=addAgentToMesh(\"' + mesh._id + '\")>Add Agent</a>';
@@ -2599,6 +2602,27 @@
2602
Q('dp1devicename').focus();
2603
}
2604
2605
+ // Intel AMT Activation
2606
+ function showAcmActivation(meshid) {
2607
+ if (xxdialogMode) return;
2608
+ var servername = serverinfo.name, mesh = meshes[meshid];
2609
+ if ((servername.indexOf('.') == -1) || ((features & 2) != 0)) { servername = window.location.hostname; } // If the server name is not set or it's in LAN-only mode, use the URL hostname as server name.
2610
+ var url, domainUrlNoSlash = domainUrl.substring(0, domainUrl.length - 1);
2611
+ if (serverinfo.https == true) {
2612
+ var portStr = (serverinfo.port == 443) ? '' : (":" + serverinfo.port);
2613
+ url = "wss://" + servername + portStr + domainUrl;
2614
+ } else {
2615
+ var portStr = (serverinfo.port == 80) ? '' : (":" + serverinfo.port);
2616
+ url = "ws://" + servername + portStr + domainUrl;
2617
+ }
2618
+ var x = "Perform Intel AMT admin control mode (ACM) activation to group \"" + EscapeHtml(mesh.name) + "\" by downloading the MeshCMD tool and running it like this:<br /><br />";
2619
+ x += '<textarea readonly=readonly style=width:100%;resize:none;height:100px;overflow:auto;font-size:12px readonly>meshcmd amtacm --url ' + url + 'amtactivate?id=' + meshid.split('/')[2] + ' --serverhttpshash ' + serverinfo.tlshash + '</textarea>';
2620
+ if (serverinfo.amtAcmFqdn != null) {
2621
+ x += '<div style=margin-top:8px>Intel AMT will need to be set with a Trusted FQDN in MEBx or have a wired LAN on the network: <b>' + serverinfo.amtAcmFqdn.join(', ') + '</b></div>';
2622
+ }
2623
+ setDialogMode(2, "Intel® AMT activation", 9, null, x);
2624
+ }
2625
+
2626
// Display the Intel AMT scanning dialog box
2627
function addAmtScanToMesh(meshid) {
2628
if (xxdialogMode) return;
webserver.js
+2
-2
@@ -2164,7 +2164,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2164
const mesh = obj.meshes[ws.meshid];
2165
if (mesh == null) { delete ws.meshid; ws.send(JSON.stringify({ errorText: 'Invalid device group' })); ws.close(); return; }
2166
if (mesh.mtype != 1) { ws.send(JSON.stringify({ errorText: 'Invalid device group type' })); ws.close(); return; }
2167
-
2167
+
2168
// Fetch the remote IP:Port for logging
2169
const remoteaddr = (req.ip.startsWith('::ffff:')) ? (req.ip.substring(7)) : req.ip;
2170
ws.remoteaddrport = remoteaddr + ':' + ws._socket.remotePort;
@@ -2215,7 +2215,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2215
2216
// Agent is asking the server to sign an Intel AMT ACM activation request
2217
var signResponse = parent.certificateOperations.signAcmRequest(domain, cmd, 'admin', amtpassword, ws.remoteaddrport, null, ws.meshid, null, null);
2218
- ws.send(JSON.stringify(signResponse));
2218
+ //ws.send(JSON.stringify(signResponse)); // DEBUG***************************
2219
break;
2220
}
2221
default: {