CIRA auto-config completed.
Ylian Saint-Hilaire committed
Oct 18, 2020 at 22:02 UTC
5290732c6f7c1da96ef28f295009a30f47ae46f9
2 files changed
+27
-27
amtmanager.js
+24
-27
@@ -17,7 +17,7 @@ module.exports.CreateAmtManager = function(parent) {
17
var obj = {};
18
obj.parent = parent;
19
obj.amtDevices = {}; // Nodeid --> [ dev ]
20
- obj.activeLocalConnections = {}; // Host --> [ dev ]
20
+ obj.activeLocalConnections = {}; // Host --> dev
21
obj.amtAdminAccounts = {}; // DomainId -> [ { user, pass } ]
22
obj.rootCertBase64 = obj.parent.certificates.root.cert.split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('').split('\r').join('').split('\n').join('')
23
obj.rootCertCN = obj.parent.certificateOperations.forge.pki.certificateFromPem(obj.parent.certificates.root.cert).subject.getField('CN').value;
@@ -251,7 +251,6 @@ module.exports.CreateAmtManager = function(parent) {
251
var wsstack = WsmanStackCreateService(comm);
252
dev.amtstack = AmtStackCreateService(wsstack);
253
dev.amtstack.dev = dev;
254
- obj.activeLocalConnections[dev.host] = dev;
254
dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], attemptLocalConnectResponse);
255
break;
256
case 1:
@@ -279,7 +278,6 @@ module.exports.CreateAmtManager = function(parent) {
278
var wsstack = WsmanStackCreateService(comm);
279
dev.amtstack = AmtStackCreateService(wsstack);
280
dev.amtstack.dev = dev;
282
- obj.activeLocalConnections[dev.host] = dev;
281
dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], attemptLocalConnectResponse);
282
break;
283
case 3:
@@ -566,7 +564,7 @@ module.exports.CreateAmtManager = function(parent) {
564
function attemptSyncClockEx(stack, name, response, status) {
565
const dev = stack.dev;
566
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
569
- if (status != 200) { removeAmtDevice(dev); return; }
567
+ if (status != 200) { dev.consoleMsg("Failed to get clock (" + status + ")."); removeAmtDevice(dev); return; }
568
569
// Compute how much drift between Intel AMT and our clock.
570
var t = new Date(), now = new Date();
@@ -586,7 +584,7 @@ module.exports.CreateAmtManager = function(parent) {
584
function attemptSyncClockSet(stack, name, responses, status) {
585
const dev = stack.dev;
586
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
589
- if (status != 200) { removeAmtDevice(dev); }
587
+ if (status != 200) { dev.consoleMsg("Failed to sync clock (" + status + ")."); removeAmtDevice(dev); }
588
devTaskCompleted(dev)
589
}
590
@@ -625,7 +623,7 @@ module.exports.CreateAmtManager = function(parent) {
623
function attemptTlsSyncEx(stack, name, responses, status) {
624
const dev = stack.dev;
625
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
628
- if (status != 200) { dev.consoleMsg("Failed to get security information."); removeAmtDevice(dev); return; }
626
+ if (status != 200) { dev.consoleMsg("Failed to get security information (" + status + ")."); removeAmtDevice(dev); return; }
627
628
// Setup the certificates
629
dev.policy.certPrivateKeys = responses['AMT_PublicPrivateKeyPair'].responses;
@@ -654,13 +652,13 @@ module.exports.CreateAmtManager = function(parent) {
652
dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
653
const dev = stack.dev;
654
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
657
- if (status != 200) { dev.consoleMsg("Failed to generate a key pair."); removeAmtDevice(dev); return; }
655
+ if (status != 200) { dev.consoleMsg("Failed to generate a key pair (" + status + ")."); removeAmtDevice(dev); return; }
656
657
// Get the new key pair
658
dev.amtstack.Enum('AMT_PublicPrivateKeyPair', function (stack, name, responses, status, tag) {
659
const dev = stack.dev;
660
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
663
- if (status != 200) { dev.consoleMsg("Failed to get a key pair list."); removeAmtDevice(dev); return; }
661
+ if (status != 200) { dev.consoleMsg("Failed to get a key pair list (" + status + ")."); removeAmtDevice(dev); return; }
662
663
// Get the new DER key
664
var DERKey = null;
@@ -687,7 +685,7 @@ module.exports.CreateAmtManager = function(parent) {
685
dev.amtstack.AMT_PublicKeyManagementService_AddCertificate(pem.substring(27, pem.length - 25), function (stack, name, responses, status) {
686
const dev = stack.dev;
687
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
690
- if (status != 200) { dev.consoleMsg("Failed to add TLS certificate."); removeAmtDevice(dev); return; }
688
+ if (status != 200) { dev.consoleMsg("Failed to add TLS certificate (" + status + ")."); removeAmtDevice(dev); return; }
689
var certInstanceId = responses.Body['CreatedCertificate']['ReferenceParameters']['SelectorSet']['Selector']['Value'];
690
691
// Set the TLS certificate
@@ -735,14 +733,14 @@ module.exports.CreateAmtManager = function(parent) {
733
function amtSwitchToTls(stack, name, responses, status) {
734
const dev = stack.dev;
735
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
738
- if (status != 200) { dev.consoleMsg("Failed setup TLS."); removeAmtDevice(dev); return; }
736
+ if (status != 200) { dev.consoleMsg("Failed setup TLS (" + status + ")."); removeAmtDevice(dev); return; }
737
738
// Check if all the calls are done & perform a commit
739
if ((--dev.setTlsSecurityPendingCalls) == 0) {
740
dev.amtstack.AMT_SetupAndConfigurationService_CommitChanges(null, function (stack, name, responses, status) {
741
const dev = stack.dev;
742
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
745
- if (status != 200) { dev.consoleMsg("Failed perform commit."); removeAmtDevice(dev); return; }
743
+ if (status != 200) { dev.consoleMsg("Failed perform commit (" + status + ")."); removeAmtDevice(dev); return; }
744
dev.consoleMsg("Enabled TLS");
745
// TODO: Switch our communications to TLS (Restart our management of this node)
746
devTaskCompleted(dev);
@@ -773,7 +771,7 @@ module.exports.CreateAmtManager = function(parent) {
771
dev.amtstack.AMT_PublicKeyManagementService_AddTrustedRootCertificate(obj.rootCertBase64, function (stack, name, responses, status) {
772
const dev = stack.dev;
773
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
776
- if (status != 200) { dev.consoleMsg("Failed to add server root certificate."); removeAmtDevice(dev); return; }
774
+ if (status != 200) { dev.consoleMsg("Failed to add server root certificate (" + status + ")."); removeAmtDevice(dev); return; }
775
dev.consoleMsg("Added server root certificate.");
776
devTaskCompleted(dev);
777
});
@@ -788,7 +786,7 @@ module.exports.CreateAmtManager = function(parent) {
786
// Check if Intel AMT has the server root certificate
787
function attemptCiraSync(dev, func) {
788
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
791
- if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(); return; } // Only setup CIRA when LMS connection is used and a CIRA policy is enabled.
789
+ if ((dev.connType != 2) || ((dev.policy.ciraPolicy != 1) && (dev.policy.ciraPolicy != 2))) { func(); return; } // Only setup CIRA when LMS connection is used and a CIRA policy is enabled.
790
791
// Get current CIRA settings
792
// TODO: We only deal with remote access starting with Intel AMT 6 and beyond
@@ -808,7 +806,8 @@ module.exports.CreateAmtManager = function(parent) {
806
if (responses['IPS_HTTPProxyService'].status == 400) { delete responses['IPS_HTTPProxyService']; }
807
for (var i in responses) { if (responses[i].status != 200) { status = responses[i].status; } }
808
}
811
- if ((status != 200) || (responses['AMT_UserInitiatedConnectionService'] == null) || (responses['AMT_UserInitiatedConnectionService'].response == null)) { dev.consoleMsg("Failed get CIRA state."); removeAmtDevice(dev); return; }
809
+ if (status != 200) { dev.consoleMsg("Failed get CIRA state (" + status + ")."); removeAmtDevice(dev); return; }
810
+ if ((responses['AMT_UserInitiatedConnectionService'] == null) || (responses['AMT_UserInitiatedConnectionService'].response == null)) { dev.consoleMsg("Invalid CIRA state."); removeAmtDevice(dev); return; }
811
812
dev.cira = {};
813
dev.cira.xxRemoteAccess = responses;
@@ -837,7 +836,7 @@ module.exports.CreateAmtManager = function(parent) {
836
// Fetch the server's CIRA settings
837
dev.cira.mpsPresent = null;
838
dev.cira.mpsPolicy = false;
840
- if (dev.policy.ciraPolicy == 2) { // DEBUG
839
+ if (dev.policy.ciraPolicy == 2) {
840
dev.cira.meshidx = dev.meshid.split('/')[2].replace(/\@/g, 'X').replace(/\$/g, 'X').substring(0, 16);
841
dev.cira.mpsName = parent.webserver.certificates.AmtMpsName;
842
var serverNameSplit = dev.cira.mpsName.split('.');
@@ -884,11 +883,10 @@ module.exports.CreateAmtManager = function(parent) {
883
function addMpsServer(dev) {
884
// Add the MPS server if not present
885
if (dev.cira.mpsPresent == null) {
887
- dev.taskCount++;
886
dev.amtstack.AMT_RemoteAccessService_AddMpServer(dev.cira.mpsName, dev.cira.mpsAddressFormat, dev.cira.mpsPort, 2, null, dev.cira.meshidx, 'P@ssw0rd', dev.cira.mpsName, function (stack, name, response, status) {
887
const dev = stack.dev;
888
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
891
- if (status != 200) { dev.consoleMsg("Failed to create new MPS server."); removeAmtDevice(dev); return; }
889
+ if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev); return; }
890
dev.cira.mpsPresent = getItem(response.Body.MpServer.ReferenceParameters.SelectorSet.Selector, '@Name', 'Name').Value;
891
dev.consoleMsg("Created new MPS server.");
892
addMpsPolicy(dev);
@@ -921,11 +919,10 @@ module.exports.CreateAmtManager = function(parent) {
919
if (server1) { ciraServers.push(server1); if (server2) { ciraServers.push(server2); } }
920
921
// Go ahead and create the new CIRA/CILA policy.
924
- dev.taskCount++;
922
dev.amtstack.AMT_RemoteAccessService_AddRemoteAccessPolicyRule(trigger, 0, extendedData, ciraServers, cilaServers, function (stack, name, responses, status) {
923
const dev = stack.dev;
924
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
928
- if (status != 200) { dev.consoleMsg("Failed to create new MPS policy."); removeAmtDevice(dev); return; }
925
+ if (status != 200) { dev.consoleMsg("Failed to create new MPS policy (" + status + ")."); removeAmtDevice(dev); return; }
926
dev.consoleMsg("Created new MPS policy.");
927
checkEnvironmentDetection(dev);
928
});
@@ -937,24 +934,24 @@ module.exports.CreateAmtManager = function(parent) {
934
function checkEnvironmentDetection(dev) {
935
var changes = false;
936
var editEnvironmentDetectionTmp = [];
937
+ var domains = dev.cira.xxEnvironementDetection['DetectionStrings'];
938
+ if (domains == null) { domains = []; }
939
941
- //console.log('checkEnvironmentDetection', dev.cira.xxEnvironementDetection);
940
if (dev.policy.ciraPolicy == 2) {
941
// Check that we have a random environment detection
944
- // TODO
945
- } else {
942
+ if (domains.length == 0) { editEnvironmentDetectionTmp = [ Buffer.from(parent.crypto.randomBytes(6), 'binary').toString('hex') ]; changes = true; }
943
+ } else if (dev.policy.ciraPolicy == 1) {
944
// Check environment detection is clear
947
- // TODO
945
+ if (domains.length != 0) { editEnvironmentDetectionTmp = []; changes = true; }
946
}
947
948
if (changes == true) {
951
- var t = Clone(dev.cire.xxEnvironementDetection);
949
+ var t = Clone(dev.cira.xxEnvironementDetection);
950
t['DetectionStrings'] = editEnvironmentDetectionTmp;
953
- //console.log('AMT_EnvironmentDetectionSettingData', t);
954
- amtstack.Put('AMT_EnvironmentDetectionSettingData', t, function (stack, name, responses, status) {
951
+ dev.amtstack.Put('AMT_EnvironmentDetectionSettingData', t, function (stack, name, responses, status) {
952
const dev = stack.dev;
953
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
957
- if (status != 200) { dev.consoleMsg("Failed to set environement detection."); removeAmtDevice(dev); return; }
954
+ if (status != 200) { dev.consoleMsg("Failed to set environement detection (" + status + ")."); removeAmtDevice(dev); return; }
955
dev.consoleMsg("Environment detection set.");
956
devTaskCompleted(dev);
957
}, 0, 1);
mpsserver.js
+3
@@ -327,6 +327,9 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
327
socket.SetupChannel = function SetupChannel(targetport) { return SetupChannel.parent.SetupChannel(SetupChannel.conn, targetport); }
328
socket.SetupChannel.parent = obj;
329
socket.SetupChannel.conn = socket;
330
+ socket.ControlMsg = function ControlMsg(message) { return ControlMsg.parent.SendJsonControl(ControlMsg.conn, message); }
331
+ socket.ControlMsg.parent = obj;
332
+ socket.ControlMsg.conn = socket;
333
socket.setEncoding('binary');
334
parent.debug('mps', "New CIRA connection");
335