Fixed and improved ACM activation.
Ylian Saint-Hilaire committed
Mar 4, 2021 at 23:52 UTC
584dfebf815af4d735eed7f0a1273533e4300dcb
6 files changed
+104
-60
agents/meshcmd.js
+11
@@ -1194,9 +1194,20 @@ function configureJsonControl(data) {
1194
settings.apftunnel.sendStartTlsHostConfigResponse(response);
1195
});
1196
break;
1197
+ case 'stopConfiguration': // Request Intel AMT stop configuration.
1198
+ var amtMeiModule, amtMei;
1199
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { settings.apftunnel.sendStartTlsHostConfigResponse({ state: -103 }); break; }
1200
+ amtMei.on('error', function (e) { settings.apftunnel.sendStartTlsHostConfigResponse({ state: -104 }); });
1201
+ amtMei.stopConfiguration(function (status) {
1202
+ settings.apftunnel.sendStopConfigurationResponse(status);
1203
+ });
1204
+ break;
1205
case 'close': // Close the CIRA-LMS connection
1206
exit(0);
1207
break;
1208
+ default:
1209
+ console.log("MeshCmd update may be needed, unknown JSON control action: " + data.action);
1210
+ break;
1211
}
1212
}
1213
agents/meshcore.js
+5
@@ -1202,6 +1202,11 @@ function handleServerCommand(data) {
1202
apftunnel.sendStartTlsHostConfigResponse(response);
1203
});
1204
}
1205
+ if (data.action == 'stopConfiguration') { // Request Intel AMT stop configuration.
1206
+ amt.stopConfiguration(function (response) {
1207
+ apftunnel.sendStopConfigurationResponse(response);
1208
+ });
1209
+ }
1210
}
1211
apftunnel.onChannelClosed = function () { addAmtEvent('LMS tunnel closed.'); apftunnel = null; }
1212
try { apftunnel.connect(); } catch (ex) { }
agents/modules_meshcmd/amt-apfclient.js
+1
@@ -184,6 +184,7 @@ function CreateAPFClient(parent, args) {
184
obj.updateMeiState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'meiState', value: state }); }
185
obj.sendMeiDeactivationState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'deactivate', value: state }); }
186
obj.sendStartTlsHostConfigResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'startTlsHostConfig', value: state }); }
187
+ obj.sendStopConfigurationResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'stopConfiguration', value: state }); }
188
189
function SendJsonControl(socket, o) {
190
var data = JSON.stringify(o)
agents/modules_meshcore/amt-apfclient.js
+1
@@ -184,6 +184,7 @@ function CreateAPFClient(parent, args) {
184
obj.updateMeiState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'meiState', value: state }); }
185
obj.sendMeiDeactivationState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'deactivate', value: state }); }
186
obj.sendStartTlsHostConfigResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'startTlsHostConfig', value: state }); }
187
+ obj.sendStopConfigurationResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'stopConfiguration', value: state }); }
188
189
function SendJsonControl(socket, o) {
190
var data = JSON.stringify(o)
amtmanager.js
+85
-57
@@ -114,8 +114,8 @@ module.exports.CreateAmtManager = function (parent) {
114
}
115
116
// Remove an Intel AMT managed device
117
- function removeAmtDevice(dev) {
118
- parent.debug('amt', dev.name, "Remove device", dev.nodeid, dev.connType);
117
+ function removeAmtDevice(dev, tag) {
118
+ parent.debug('amt', dev.name, "Remove device", dev.nodeid, dev.connType, tag);
119
120
// Find the device in the list
121
var devices = obj.amtDevices[dev.nodeid];
@@ -202,7 +202,7 @@ module.exports.CreateAmtManager = function (parent) {
202
if (devices != null) { for (var i in devices) { if ((devices[i].mpsConnection == connection) || (devices[i].host == connection)) { dev = devices[i]; } } }
203
if (dev == null) return false; // We are not managing this device on this connection
204
parent.debug('amt', dev.name, "Stop Management", nodeid, connType);
205
- return removeAmtDevice(dev);
205
+ return removeAmtDevice(dev, 1);
206
}
207
208
// Get a string status of the managed devices
@@ -249,11 +249,18 @@ module.exports.CreateAmtManager = function (parent) {
249
case 'startTlsHostConfig':
250
if (dev.acmTlsInfo == null) break;
251
if ((typeof jsondata.value != 'object') || (typeof jsondata.value.status != 'number') || (jsondata.value.status != 0)) {
252
- removeAmtDevice(dev); // Failed to start TLS configuration
252
+ removeAmtDevice(dev, 2); // Failed to start TLS configuration
253
} else {
254
activateIntelAmtTlsAcmEx(dev, jsondata.value); // Start TLS activation.
255
}
256
break;
257
+ case 'stopConfiguration':
258
+ if (dev.acmactivate != 1) break;
259
+ delete dev.acmactivate;
260
+ if (jsondata.value == 3) { activateIntelAmtAcmEx0(dev); } // Intel AMT was already not in in-provisioning state, keep going right away.
261
+ else if (jsondata.value == 0) { dev.consoleMsg("Cleared in-provisioning state. Holding 20 seconds prior to ACM activation..."); setTimeout(function () { activateIntelAmtAcmEx0(dev); }, 20000); }
262
+ else { dev.consoleMsg("Unknown stopConfiguration() state of " + jsondata.value + ". Continuing with ACM activation..."); activateIntelAmtAcmEx0(dev); }
263
+ break;
264
}
265
}
266
@@ -280,10 +287,23 @@ module.exports.CreateAmtManager = function (parent) {
287
for (var i in devices) {
288
var dev = devices[i];
289
dev.name = event.node.name;
283
- if (event.node.intelamt != null) { dev.intelamt = event.node.intelamt; }
290
+
291
+ // If there are any changes, apply them.
292
+ if (event.node.intelamt != null) {
293
+ if ((typeof event.node.intelamt.version == 'string') && (event.node.intelamt.version != dev.intelamt.ver)) { dev.intelamt.ver = event.node.intelamt.version; }
294
+ if ((typeof event.node.intelamt.user == 'string') && (event.node.intelamt.user != dev.intelamt.user)) { dev.intelamt.user = event.node.intelamt.user; }
295
+ if ((typeof event.node.intelamt.pass == 'string') && (event.node.intelamt.pass != dev.intelamt.pass)) { dev.intelamt.pass = event.node.intelamt.pass; }
296
+ if ((typeof event.node.intelamt.mpspass == 'string') && (event.node.intelamt.mpspass != dev.intelamt.mpspass)) { dev.intelamt.mpspass = event.node.intelamt.mpspass; }
297
+ if ((typeof event.node.intelamt.host == 'string') && (event.node.intelamt.host != dev.intelamt.host)) { dev.intelamt.host = event.node.intelamt.host; }
298
+ if ((typeof event.node.intelamt.realm == 'string') && (event.node.intelamt.realm != dev.intelamt.realm)) { dev.intelamt.realm = event.node.intelamt.realm; }
299
+ if ((typeof event.node.intelamt.hash == 'string') && (event.node.intelamt.hash != dev.intelamt.hash)) { dev.intelamt.hash = event.node.intelamt.hash; }
300
+ if ((typeof event.node.intelamt.tls == 'number') && (event.node.intelamt.tls != dev.intelamt.tls)) { dev.intelamt.tls = event.node.intelamt.tls; }
301
+ if ((typeof event.node.intelamt.state == 'number') && (event.node.intelamt.state != dev.intelamt.state)) { dev.intelamt.state = event.node.intelamt.state; }
302
+ }
303
+
304
if ((dev.connType == 3) && (dev.host != event.node.host)) {
305
dev.host = event.node.host; // The host has changed, if we are connected to this device locally, we need to reset.
286
- removeAmtDevice(dev); // We are going to wait for the AMT scanned to find this device again.
306
+ removeAmtDevice(dev, 3); // We are going to wait for the AMT scanned to find this device again.
307
rescan = true;
308
}
309
}
@@ -311,11 +331,11 @@ module.exports.CreateAmtManager = function (parent) {
331
// Update information about a device
332
function fetchIntelAmtInformation(dev) {
333
parent.db.Get(dev.nodeid, function (err, nodes) {
314
- if ((nodes == null) || (nodes.length != 1)) { removeAmtDevice(dev); return; }
334
+ if ((nodes == null) || (nodes.length != 1)) { removeAmtDevice(dev, 4); return; }
335
const node = nodes[0];
316
- if ((node.intelamt == null) || (node.meshid == null)) { removeAmtDevice(dev); return; }
336
+ if ((node.intelamt == null) || (node.meshid == null)) { removeAmtDevice(dev, 5); return; }
337
const mesh = parent.webserver.meshes[node.meshid];
318
- if (mesh == null) { removeAmtDevice(dev); return; }
338
+ if (mesh == null) { removeAmtDevice(dev, 6); return; }
339
if (dev == null) { return; }
340
341
// Fetch Intel AMT setup policy
@@ -365,7 +385,7 @@ module.exports.CreateAmtManager = function (parent) {
385
}
386
387
// If there is no Intel AMT policy for this device, stop here.
368
- //if (amtPolicy == 0) { dev.consoleMsg("Done."); removeAmtDevice(dev); return; }
388
+ //if (amtPolicy == 0) { dev.consoleMsg("Done."); removeAmtDevice(dev, 7); return; }
389
390
// Initiate the communication to Intel AMT
391
dev.consoleMsg("Checking Intel AMT state...");
@@ -403,7 +423,7 @@ module.exports.CreateAmtManager = function (parent) {
423
424
// See if we need to try different credentials
425
if ((dev.acctry == null) && ((typeof dev.intelamt.user != 'string') || (typeof dev.intelamt.pass != 'string'))) {
406
- if ((obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; } else { removeAmtDevice(dev); return; }
426
+ if ((obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; } else { removeAmtDevice(dev, 8); return; }
427
}
428
429
switch (dev.connType) {
@@ -413,7 +433,7 @@ module.exports.CreateAmtManager = function (parent) {
433
434
// Check to see if CIRA is connected on this server.
435
var ciraconn = dev.mpsConnection;
416
- if ((ciraconn == null) || (ciraconn.tag == null) || (ciraconn.tag.boundPorts == null)) { removeAmtDevice(dev); return; } // CIRA connection is not on this server, no need to deal with this device anymore.
436
+ if ((ciraconn == null) || (ciraconn.tag == null) || (ciraconn.tag.boundPorts == null)) { removeAmtDevice(dev, 9); return; } // CIRA connection is not on this server, no need to deal with this device anymore.
437
438
// See what user/pass to try.
439
var user = null, pass = null;
@@ -425,7 +445,7 @@ module.exports.CreateAmtManager = function (parent) {
445
var dotls = -1;
446
if (ciraconn.tag.boundPorts.indexOf('16992')) { dotls = 0; }
447
else if (ciraconn.tag.boundPorts.indexOf('16993')) { dotls = 1; }
428
- if (dotls == -1) { removeAmtDevice(dev); return; } // The Intel AMT ports are not open, not a device we can deal with.
448
+ if (dotls == -1) { removeAmtDevice(dev, 10); return; } // The Intel AMT ports are not open, not a device we can deal with.
449
450
// Connect now
451
parent.debug('amt', dev.name, 'CIRA-Connect', (dotls == 1) ? "TLS" : "NoTLS", user, pass);
@@ -446,7 +466,7 @@ module.exports.CreateAmtManager = function (parent) {
466
// Handle the case where the Intel AMT relay or LMS is connected (connType 1 or 2)
467
// Check to see if CIRA is connected on this server.
468
var ciraconn = dev.mpsConnection;
449
- if ((ciraconn == null) || (ciraconn.tag == null) || (ciraconn.tag.boundPorts == null)) { removeAmtDevice(dev); return; } // Relay connection not valid
469
+ if ((ciraconn == null) || (ciraconn.tag == null) || (ciraconn.tag.boundPorts == null)) { console.log('r2'); removeAmtDevice(dev, 11); return; } // Relay connection not valid
470
471
// See what user/pass to try.
472
var user = null, pass = null;
@@ -471,11 +491,11 @@ module.exports.CreateAmtManager = function (parent) {
491
break;
492
case 3: // Local LAN
493
// Check if Intel AMT is activated. If not, stop here.
474
- if ((dev.intelamt == null) || ((dev.intelamt.state != null) && (dev.intelamt.state != 2))) { removeAmtDevice(dev); return; }
494
+ if ((dev.intelamt == null) || ((dev.intelamt.state != null) && (dev.intelamt.state != 2))) { removeAmtDevice(dev, 12); return; }
495
496
// Handle the case where the Intel AMT local scanner found the device (connType 3)
497
parent.debug('amt', dev.name, "Attempt Initial Local Contact", dev.connType, dev.host);
478
- if (typeof dev.host != 'string') { removeAmtDevice(dev); return; } // Local connection not valid
498
+ if (typeof dev.host != 'string') { removeAmtDevice(dev, 13); return; } // Local connection not valid
499
500
// Since we don't allow two or more connections to the same host, check if a pending connection is active.
501
if (obj.activeLocalConnections[dev.host] != null) {
@@ -606,7 +626,7 @@ module.exports.CreateAmtManager = function (parent) {
626
UpdateDevice(dev);
627
}
628
//console.log(dev.nodeid, dev.name, dev.host, status, 'Bad response');
609
- removeAmtDevice(dev);
629
+ removeAmtDevice(dev, 14);
630
}
631
}
632
@@ -619,7 +639,7 @@ module.exports.CreateAmtManager = function (parent) {
639
function UpdateDevice(dev) {
640
// Check that the mesh exists
641
const mesh = parent.webserver.meshes[dev.meshid];
622
- if (mesh == null) { removeAmtDevice(dev); return false; }
642
+ if (mesh == null) { removeAmtDevice(dev, 15); return false; }
643
644
// Get the node and change it if needed
645
parent.db.Get(dev.nodeid, function (err, nodes) {
@@ -674,7 +694,7 @@ module.exports.CreateAmtManager = function (parent) {
694
695
// Check that the mesh exists
696
const mesh = parent.webserver.meshes[dev.meshid];
677
- if (mesh == null) { removeAmtDevice(dev); return; }
697
+ if (mesh == null) { removeAmtDevice(dev, 16); return; }
698
699
// Get the node and change it if needed
700
parent.db.Get(dev.nodeid, function (err, nodes) {
@@ -789,7 +809,7 @@ module.exports.CreateAmtManager = function (parent) {
809
function attemptSyncClockEx(stack, name, response, status) {
810
const dev = stack.dev;
811
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
792
- if (status != 200) { dev.consoleMsg("Failed to get clock (" + status + ")."); removeAmtDevice(dev); return; }
812
+ if (status != 200) { dev.consoleMsg("Failed to get clock (" + status + ")."); removeAmtDevice(dev, 17); return; }
813
814
// Compute how much drift between Intel AMT and our clock.
815
var t = new Date(), now = new Date();
@@ -808,7 +828,7 @@ module.exports.CreateAmtManager = function (parent) {
828
function attemptSyncClockSet(stack, name, responses, status) {
829
const dev = stack.dev;
830
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
811
- if (status != 200) { dev.consoleMsg("Failed to sync clock (" + status + ")."); removeAmtDevice(dev); }
831
+ if (status != 200) { dev.consoleMsg("Failed to sync clock (" + status + ")."); removeAmtDevice(dev, 18); }
832
devTaskCompleted(dev)
833
}
834
@@ -830,7 +850,7 @@ module.exports.CreateAmtManager = function (parent) {
850
function attemptTlsSyncEx(stack, name, responses, status) {
851
const dev = stack.dev;
852
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
833
- if (status != 200) { dev.consoleMsg("Failed to get security information (" + status + ")."); removeAmtDevice(dev); return; }
853
+ if (status != 200) { dev.consoleMsg("Failed to get security information (" + status + ")."); removeAmtDevice(dev, 19); return; }
854
855
// Setup the certificates
856
dev.policy.certPrivateKeys = responses['AMT_PublicPrivateKeyPair'].responses;
@@ -859,18 +879,18 @@ module.exports.CreateAmtManager = function (parent) {
879
dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
880
const dev = stack.dev;
881
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
862
- if (status != 200) { dev.consoleMsg("Failed to generate a key pair (" + status + ")."); removeAmtDevice(dev); return; }
882
+ if (status != 200) { dev.consoleMsg("Failed to generate a key pair (" + status + ")."); removeAmtDevice(dev, 20); return; }
883
884
// Check that we get a key pair reference
885
var x = null;
886
try { x = responses.Body['KeyPair']['ReferenceParameters']['SelectorSet']['Selector']['Value']; } catch (ex) { }
867
- if (x == null) { dev.consoleMsg("Unable to get key pair reference."); removeAmtDevice(dev); return; }
887
+ if (x == null) { dev.consoleMsg("Unable to get key pair reference."); removeAmtDevice(dev, 21); return; }
888
889
// Get the new key pair
890
dev.amtstack.Enum('AMT_PublicPrivateKeyPair', function (stack, name, responses, status, tag) {
891
const dev = stack.dev;
892
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
873
- if (status != 200) { dev.consoleMsg("Failed to get a key pair list (" + status + ")."); removeAmtDevice(dev); return; }
893
+ if (status != 200) { dev.consoleMsg("Failed to get a key pair list (" + status + ")."); removeAmtDevice(dev, 22); return; }
894
895
// Get the new DER key
896
var DERKey = null;
@@ -898,7 +918,7 @@ module.exports.CreateAmtManager = function (parent) {
918
919
// Sign the key pair using the CA certifiate
920
const cert = amtcert_createCertificate(certattributes, xxCaPrivateKey, DERKey, issuerattributes, extKeyUsage);
901
- if (cert == null) { dev.consoleMsg("Failed to sign the TLS certificate."); removeAmtDevice(dev); return; }
921
+ if (cert == null) { dev.consoleMsg("Failed to sign the TLS certificate."); removeAmtDevice(dev, 23); return; }
922
923
// Place the resulting signed certificate back into AMT
924
var pem = obj.parent.certificateOperations.forge.pki.certificateToPem(cert).replace(/(\r\n|\n|\r)/gm, '');
@@ -911,10 +931,10 @@ module.exports.CreateAmtManager = function (parent) {
931
dev.amtstack.AMT_PublicKeyManagementService_AddCertificate(pem.substring(27, pem.length - 25), function (stack, name, responses, status) {
932
const dev = stack.dev;
933
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
914
- if (status != 200) { dev.consoleMsg("Failed to add TLS certificate (" + status + ")."); removeAmtDevice(dev); return; }
934
+ if (status != 200) { dev.consoleMsg("Failed to add TLS certificate (" + status + ")."); removeAmtDevice(dev, 24); return; }
935
var certInstanceId = null;
936
try { certInstanceId = responses.Body['CreatedCertificate']['ReferenceParameters']['SelectorSet']['Selector']['Value']; } catch (ex) { }
917
- if (certInstanceId == null) { dev.consoleMsg("Failed to get TLS certificate identifier."); removeAmtDevice(dev); return; }
937
+ if (certInstanceId == null) { dev.consoleMsg("Failed to get TLS certificate identifier."); removeAmtDevice(dev, 25); return; }
938
939
// Set the TLS certificate
940
dev.setTlsSecurityPendingCalls = 3;
@@ -965,14 +985,14 @@ module.exports.CreateAmtManager = function (parent) {
985
function amtSwitchToTls(stack, name, responses, status) {
986
const dev = stack.dev;
987
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
968
- if (status != 200) { dev.consoleMsg("Failed setup TLS (" + status + ")."); removeAmtDevice(dev); return; }
988
+ if (status != 200) { dev.consoleMsg("Failed setup TLS (" + status + ")."); removeAmtDevice(dev, 26); return; }
989
990
// Check if all the calls are done & perform a commit
991
if ((--dev.setTlsSecurityPendingCalls) == 0) {
992
dev.amtstack.AMT_SetupAndConfigurationService_CommitChanges(null, function (stack, name, responses, status) {
993
const dev = stack.dev;
994
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
975
- if (status != 200) { dev.consoleMsg("Failed perform commit (" + status + ")."); removeAmtDevice(dev); return; }
995
+ if (status != 200) { dev.consoleMsg("Failed perform commit (" + status + ")."); removeAmtDevice(dev, 27); return; }
996
dev.consoleMsg("Enabled TLS, holding 5 seconds...");
997
998
// Update device in the database
@@ -1126,7 +1146,7 @@ module.exports.CreateAmtManager = function (parent) {
1146
dev.amtstack.AMT_PublicKeyManagementService_AddTrustedRootCertificate(obj.rootCertBase64, function (stack, name, responses, status) {
1147
const dev = stack.dev;
1148
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1129
- if (status != 200) { dev.consoleMsg("Failed to add server root certificate (" + status + ")."); removeAmtDevice(dev); return; }
1149
+ if (status != 200) { dev.consoleMsg("Failed to add server root certificate (" + status + ")."); removeAmtDevice(dev, 28); return; }
1150
dev.consoleMsg("Added server root certificate.");
1151
devTaskCompleted(dev);
1152
});
@@ -1179,11 +1199,11 @@ module.exports.CreateAmtManager = function (parent) {
1199
1200
// We tried 5 times, give up.
1201
dev.consoleMsg("Failed to get CIRA state (" + status + ").");
1182
- removeAmtDevice(dev);
1202
+ removeAmtDevice(dev, 29);
1203
return;
1204
}
1205
1186
- if ((responses['AMT_UserInitiatedConnectionService'] == null) || (responses['AMT_UserInitiatedConnectionService'].response == null)) { dev.consoleMsg("Invalid CIRA state."); removeAmtDevice(dev); return; }
1206
+ if ((responses['AMT_UserInitiatedConnectionService'] == null) || (responses['AMT_UserInitiatedConnectionService'].response == null)) { dev.consoleMsg("Invalid CIRA state."); removeAmtDevice(dev, 30); return; }
1207
1208
dev.cira = {};
1209
dev.cira.xxRemoteAccess = responses;
@@ -1265,8 +1285,8 @@ module.exports.CreateAmtManager = function (parent) {
1285
dev.amtstack.AMT_RemoteAccessService_AddMpServer(dev.cira.mpsName, dev.cira.mpsAddressFormat, dev.cira.mpsPort, 2, null, dev.cira.meshidx, dev.cira.mpsPass, dev.cira.mpsName, function (stack, name, response, status) {
1286
const dev = stack.dev;
1287
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1268
- if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev); return; }
1269
- if ((response.Body.MpServer == null) || (response.Body.MpServer.ReferenceParameters == null) || (response.Body.MpServer.ReferenceParameters.SelectorSet == null) || (response.Body.MpServer.ReferenceParameters.SelectorSet.Selector == null)) { dev.consoleMsg("Create new MPS server invalid response."); removeAmtDevice(dev); return; }
1288
+ if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev, 31); return; }
1289
+ if ((response.Body.MpServer == null) || (response.Body.MpServer.ReferenceParameters == null) || (response.Body.MpServer.ReferenceParameters.SelectorSet == null) || (response.Body.MpServer.ReferenceParameters.SelectorSet.Selector == null)) { dev.consoleMsg("Create new MPS server invalid response."); removeAmtDevice(dev, 32); return; }
1290
dev.cira.mpsPresent = getItem(response.Body.MpServer.ReferenceParameters.SelectorSet.Selector, '@Name', 'Name').Value;
1291
dev.consoleMsg("Created new MPS server.");
1292
addMpsPolicy(dev);
@@ -1306,7 +1326,7 @@ module.exports.CreateAmtManager = function (parent) {
1326
dev.amtstack.AMT_RemoteAccessService_AddRemoteAccessPolicyRule(trigger, 0, extendedData, ciraServers, cilaServers, function (stack, name, responses, status) {
1327
const dev = stack.dev;
1328
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1309
- if (status != 200) { dev.consoleMsg("Failed to create new MPS policy (" + status + ")."); removeAmtDevice(dev); return; }
1329
+ if (status != 200) { dev.consoleMsg("Failed to create new MPS policy (" + status + ")."); removeAmtDevice(dev, 33); return; }
1330
dev.consoleMsg("Created new MPS policy.");
1331
checkEnvironmentDetection(dev);
1332
});
@@ -1353,7 +1373,7 @@ module.exports.CreateAmtManager = function (parent) {
1373
dev.amtstack.Put('AMT_EnvironmentDetectionSettingData', t, function (stack, name, responses, status) {
1374
const dev = stack.dev;
1375
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1356
- if (status != 200) { dev.consoleMsg("Failed to set environement detection (" + status + ")."); removeAmtDevice(dev); return; }
1376
+ if (status != 200) { dev.consoleMsg("Failed to set environement detection (" + status + ")."); removeAmtDevice(dev, 34); return; }
1377
if (dev.cira.envclear) { dev.consoleMsg("Environment detection cleared."); } else { dev.consoleMsg("Environment detection set."); }
1378
devTaskCompleted(dev);
1379
}, 0, 1);
@@ -1467,7 +1487,7 @@ module.exports.CreateAmtManager = function (parent) {
1487
function attemptFetchHardwareInventory(dev, func) {
1488
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1489
const mesh = parent.webserver.meshes[dev.meshid];
1470
- if (mesh == null) { removeAmtDevice(dev); return; }
1490
+ if (mesh == null) { removeAmtDevice(dev, 35); return; }
1491
if (mesh.mtype == 1) { // If this is a Intel AMT only device group, pull the hardware inventory and network information for this device
1492
dev.consoleMsg("Fetching hardware inventory.");
1493
dev.taskCount = 2;
@@ -1654,12 +1674,12 @@ module.exports.CreateAmtManager = function (parent) {
1674
function activateIntelAmt(dev) {
1675
// Find the Intel AMT policy
1676
const mesh = parent.webserver.meshes[dev.meshid];
1657
- if (mesh == null) { dev.consoleMsg("Unable to find device group."); removeAmtDevice(dev); return false; }
1677
+ if (mesh == null) { dev.consoleMsg("Unable to find device group."); removeAmtDevice(dev, 36); return false; }
1678
var amtPolicy = 0; // 0 = Do nothing, 1 = Deactivate CCM, 2 = CCM, 3 = ACM
1679
var ccmPolicy = 0; // Only used when in ACM policy: 0 = Do nothing, 1 = Deactivate CCM, 2 = CCM is ACM fails
1680
if (mesh.amt != null) { if (typeof mesh.amt.type == 'number') { amtPolicy = mesh.amt.type; } if (typeof mesh.amt.ccm == 'number') { ccmPolicy = mesh.amt.ccm; } }
1681
if ((typeof dev.mpsConnection.tag.meiState.OsAdmin != 'object') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.user != 'string') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.pass != 'string')) { amtPolicy = 0; }
1662
- if (amtPolicy == 0) { removeAmtDevice(dev); return false; } // Do nothing, we should not have gotten this CIRA-LMS connection.
1682
+ if (amtPolicy == 0) { removeAmtDevice(dev, 37); return false; } // Do nothing, we should not have gotten this CIRA-LMS connection.
1683
if (amtPolicy == 2) { activateIntelAmtCcm(dev, mesh.amt.password); } // Activate to CCM policy
1684
if ((amtPolicy == 3) || (amtPolicy == 4)) { // Activate to ACM policy
1685
var acminfo = checkAcmActivation(dev);
@@ -1671,7 +1691,7 @@ module.exports.CreateAmtManager = function (parent) {
1691
} else {
1692
// We are not in CCM, go to CCM now
1693
if ((amtPolicy == 4) || ((amtPolicy == 3) && (ccmPolicy == 2))) { activateIntelAmtCcm(dev, mesh.amt.password); } // If we are in full automatic or ACM with CCM allowed, setup CCM.
1674
- else { removeAmtDevice(dev); return false; } // We are not in CCM and policy restricts use of CCM, so exit now.
1694
+ else { dev.consoleMsg("No opportunity for ACM activation."); removeAmtDevice(dev, 38); return false; } // We are not in CCM and policy restricts use of CCM, so exit now.
1695
}
1696
} else {
1697
// Found a certificate to activate to ACM.
@@ -1711,14 +1731,14 @@ module.exports.CreateAmtManager = function (parent) {
1731
function activateIntelAmtCcmEx1(stack, name, responses, status) {
1732
const dev = stack.dev;
1733
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1714
- if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev); return; }
1715
- if (responses['IPS_HostBasedSetupService'].response['AllowedControlModes'].length != 2) { dev.consoleMsg("Client control mode activation not allowed."); removeAmtDevice(dev); return; }
1734
+ if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev, 39); return; }
1735
+ if (responses['IPS_HostBasedSetupService'].response['AllowedControlModes'].length != 2) { dev.consoleMsg("Client control mode activation not allowed."); removeAmtDevice(dev, 40); return; }
1736
1737
// Log the activation request, logging is a required step for activation.
1738
var domain = parent.config.domains[dev.domainid];
1719
- if (domain == null) { dev.consoleMsg("Invalid domain."); removeAmtDevice(dev); return; }
1739
+ if (domain == null) { dev.consoleMsg("Invalid domain."); removeAmtDevice(dev, 41); return; }
1740
if (parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: 'ccmactivate', domain: dev.domainid, amtUuid: dev.mpsConnection.tag.meiState.UUID, amtRealm: responses['AMT_GeneralSettings'].response['DigestRealm'], user: 'admin', password: dev.temp.pass, ipport: dev.mpsConnection.remoteAddr + ':' + dev.mpsConnection.remotePort, nodeid: dev.nodeid, meshid: dev.meshid, computerName: dev.name }) == false) {
1721
- dev.consoleMsg("Unable to log operation."); removeAmtDevice(dev); return;
1741
+ dev.consoleMsg("Unable to log operation."); removeAmtDevice(dev, 42); return;
1742
}
1743
1744
// Perform CCM activation
@@ -1728,7 +1748,7 @@ module.exports.CreateAmtManager = function (parent) {
1748
function activateIntelAmtCcmEx2(stack, name, responses, status) {
1749
const dev = stack.dev;
1750
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1731
- if (status != 200) { dev.consoleMsg("Failed to activate Intel AMT to CCM."); removeAmtDevice(dev); return; }
1751
+ if (status != 200) { dev.consoleMsg("Failed to activate Intel AMT to CCM."); removeAmtDevice(dev, 43); return; }
1752
1753
// Update the device
1754
dev.aquired = {};
@@ -1799,7 +1819,7 @@ module.exports.CreateAmtManager = function (parent) {
1819
1820
// Get our ACM activation certificate chain
1821
var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1802
- if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev); return; }
1822
+ if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1823
dev.acmTlsInfo = acmTlsInfo;
1824
1825
// Send the MEI command to enable TLS connections
@@ -1823,7 +1843,7 @@ module.exports.CreateAmtManager = function (parent) {
1843
console.log('activateIntelAmtTlsAcmEx1', status, responses);
1844
const dev = stack.dev;
1845
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1826
- if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev); return; }
1846
+ if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev, 45); return; }
1847
1848
// TODO!!!
1849
}
@@ -1833,7 +1853,15 @@ module.exports.CreateAmtManager = function (parent) {
1853
// Generate a random Intel AMT password if needed
1854
if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1855
dev.temp = { pass: password, acminfo: acminfo };
1856
+ dev.acmactivate = 1;
1857
+
1858
+ // Send the MEI command to stop configuration.
1859
+ // If Intel AMT is "in-provisioning" mode, the WSMAN ACM activation will not work, so we need to do this first.
1860
+ dev.consoleMsg("Getting ready for ACM activation...");
1861
+ dev.controlMsg({ action: 'stopConfiguration' });
1862
+ }
1863
1864
+ function activateIntelAmtAcmEx0(dev) {
1865
// Setup the WSMAN stack, no TLS
1866
var comm = CreateWsmanComm(dev.nodeid, 16992, dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass, 0, null, dev.mpsConnection); // No TLS
1867
var wsstack = WsmanStackCreateService(comm);
@@ -1845,13 +1873,13 @@ module.exports.CreateAmtManager = function (parent) {
1873
function activateIntelAmtAcmEx1(stack, name, responses, status) {
1874
const dev = stack.dev;
1875
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1848
- if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev); return; }
1876
+ if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev, 46); return; }
1877
1878
// Sign the Intel AMT ACM activation request
1879
var info = { nonce: responses['IPS_HostBasedSetupService'].response['ConfigurationNonce'], realm: responses['AMT_GeneralSettings'].response['DigestRealm'], fqdn: dev.temp.acminfo.fqdn, hash: dev.temp.acminfo.hash, uuid: dev.mpsConnection.tag.meiState.UUID };
1880
var acmdata = parent.certificateOperations.signAcmRequest(parent.config.domains[dev.domainid], info, 'admin', dev.temp.pass, dev.mpsConnection.remoteAddr + ':' + dev.mpsConnection.remotePort, dev.nodeid, dev.meshid, dev.name, 0);
1853
- if (acmdata == null) { dev.consoleMsg("Failed to sign ACM nonce."); removeAmtDevice(dev); return; }
1854
- if (acmdata.error != null) { dev.consoleMsg(acmdata.errorText); removeAmtDevice(dev); return; }
1881
+ if (acmdata == null) { dev.consoleMsg("Failed to sign ACM nonce."); removeAmtDevice(dev, 47); return; }
1882
+ if (acmdata.error != null) { dev.consoleMsg(acmdata.errorText); removeAmtDevice(dev, 48); return; }
1883
1884
// Log this activation event
1885
var event = { etype: 'node', action: 'amtactivate', nodeid: dev.nodeid, domain: dev.domainid, msgid: 58, msgArgs: [ dev.temp.acminfo.fqdn ], msg: 'Device requested Intel(R) AMT ACM activation, FQDN: ' + dev.temp.acminfo.fqdn };
@@ -1874,8 +1902,8 @@ module.exports.CreateAmtManager = function (parent) {
1902
function (stack, name, responses, status) {
1903
const dev = stack.dev;
1904
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1877
- if (status != 200) { dev.consoleMsg("Failed to set ACM certificate chain (" + status + ")."); removeAmtDevice(dev); return; }
1878
- if (responses['Body']['ReturnValue'] != 0) { dev.consoleMsg("Failed to set ACM certificate chain (ERR/" + responses['Body']['ReturnValue'] + ")."); removeAmtDevice(dev); return; }
1905
+ if (status != 200) { dev.consoleMsg("Failed to set ACM certificate chain (" + status + ")."); removeAmtDevice(dev, 49); return; }
1906
+ if (responses['Body']['ReturnValue'] != 0) { dev.consoleMsg("Failed to set ACM certificate chain (ERR/" + responses['Body']['ReturnValue'] + ")."); removeAmtDevice(dev, 50); return; }
1907
1908
// Move to the next activation operation
1909
dev.temp.acmdata.index++;
@@ -1887,8 +1915,8 @@ module.exports.CreateAmtManager = function (parent) {
1915
function (stack, name, responses, status) {
1916
const dev = stack.dev;
1917
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1890
- if (status != 200) { dev.consoleMsg("Failed to complete ACM activation (" + status + ")."); removeAmtDevice(dev); return; }
1891
- if (responses['Body']['ReturnValue'] != 0) { dev.consoleMsg("Failed to complete ACM activation (ERR/" + responses['Body']['ReturnValue'] + ")."); removeAmtDevice(dev); return; }
1918
+ if (status != 200) { dev.consoleMsg("Failed to complete ACM activation (" + status + ")."); removeAmtDevice(dev, 51); return; }
1919
+ if (responses['Body']['ReturnValue'] != 0) { dev.consoleMsg("Failed to complete ACM activation (ERR/" + responses['Body']['ReturnValue'] + ")."); removeAmtDevice(dev, 52); return; }
1920
1921
// Success, switch to managing this device
1922
obj.parent.mpsserver.SendJsonControl(dev.mpsConnection, { action: 'mestate' }); // Request an MEI state refresh
@@ -1938,7 +1966,7 @@ module.exports.CreateAmtManager = function (parent) {
1966
function deactivateIntelAmtCCMEx(dev, state) {
1967
if (state != 0) {
1968
dev.consoleMsg("Failed to deactivate Intel AMT CCM.");
1941
- removeAmtDevice(dev);
1969
+ removeAmtDevice(dev, 53);
1970
} else {
1971
// Update the device
1972
dev.aquired = {};
@@ -1951,7 +1979,7 @@ module.exports.CreateAmtManager = function (parent) {
1979
if (dev.policy.amtPolicy == 1) { // Deactivation policy, we are done.
1980
dev.consoleMsg("Deactivation successful.");
1981
dev.consoleMsg("Done.");
1954
- removeAmtDevice(dev);
1982
+ removeAmtDevice(dev, 54);
1983
} else {
1984
// Wait 20 seconds before attempting any operation on this device
1985
dev.consoleMsg("Deactivation successful, holding for 1 minute...");
mpsserver.js
+1
-3
@@ -928,10 +928,8 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
928
if (obj.parent.amtManager != null) { obj.parent.amtManager.mpsControlMessage(socket.tag.nodeid, socket, socket.tag.connType, jsondata); }
929
break;
930
case 'deactivate':
931
- if (socket.tag.connType != 2) break; // Only accept MEI state on CIRA-LMS connection
932
- if (obj.parent.amtManager != null) { obj.parent.amtManager.mpsControlMessage(socket.tag.nodeid, socket, socket.tag.connType, jsondata); }
933
- break;
931
case 'startTlsHostConfig':
932
+ case 'stopConfiguration':
933
if (socket.tag.connType != 2) break; // Only accept MEI state on CIRA-LMS connection
934
if (obj.parent.amtManager != null) { obj.parent.amtManager.mpsControlMessage(socket.tag.nodeid, socket, socket.tag.connType, jsondata); }
935
break;