Old Intel ACM removed, MongoDB targetting improvement.
Ylian Saint-Hilaire committed
Jan 11, 2021 at 13:02 UTC
61077233049fa621a5204ce3afee1c20004e7dd2
3 files changed
+2
-195
db.js
+1
-4
@@ -940,7 +940,6 @@ module.exports.CreateDB = function (parent, func) {
940
obj.dispose = function () { for (var x in obj) { if (obj[x].close) { obj[x].close(); } delete obj[x]; } };
941
obj.getLocalAmtNodes = function (func) { sqlDbQuery('SELECT doc FROM meshcentral.main WHERE (type = "node") AND (extraex IS NOT NULL)', null, function (err, docs) { var r = []; if (err == null) { for (var i in docs) { if (docs[i].host != null) { r.push(docs[i]); } } } func(err, r); }); };
942
obj.getAmtUuidMeshNode = function (meshid, uuid, func) { sqlDbQuery('SELECT doc FROM meshcentral.main WHERE meshid = ? AND extraex = ?', [meshid, 'uuid/' + uuid], func); };
943
- obj.getAmtUuidNode = function (uuid, func) { sqlDbQuery('SELECT doc FROM meshcentral.main WHERE type = "node" AND extraex = ?', ['uuid/' + uuid], func); };
943
obj.isMaxType = function (max, type, domainid, func) { if (max == null) { func(false); } else { sqlDbExec('SELECT COUNT(id) FROM meshcentral.main WHERE domain = ? AND type = ?', [domainid, type], function (err, response) { func((response['COUNT(id)'] == null) || (response['COUNT(id)'] > max), response['COUNT(id)']) }); } }
944
945
// Database actions on the events collection
@@ -1144,9 +1143,8 @@ module.exports.CreateDB = function (parent, func) {
1143
obj.DeleteDomain = function (domain, func) { obj.file.deleteMany({ domain: domain }, { multi: true }, func); };
1144
obj.SetUser = function (user) { if (user.subscriptions != null) { var u = Clone(user); if (u.subscriptions) { delete u.subscriptions; } obj.Set(u); } else { obj.Set(user); } };
1145
obj.dispose = function () { for (var x in obj) { if (obj[x].close) { obj[x].close(); } delete obj[x]; } };
1147
- obj.getLocalAmtNodes = function (func) { obj.file.find({ type: 'node', host: { $exists: true, $ne: null }, intelamt: { $exists: true } }).toArray(func); };
1146
+ obj.getLocalAmtNodes = function (func) { obj.file.find({ type: 'node', host: { $exists: true, $ne: null }, intelamt: { $exists: true } }).toArray(func); }; // TODO: This query is not optimized, but local mode only.
1147
obj.getAmtUuidMeshNode = function (meshid, uuid, func) { obj.file.find({ type: 'node', meshid: meshid, 'intelamt.uuid': uuid }).toArray(func); };
1149
- obj.getAmtUuidNode = function (uuid, func) { obj.file.find({ type: 'node', 'intelamt.uuid': uuid }).toArray(func); };
1148
1149
// TODO: Starting in MongoDB 4.0.3, you should use countDocuments() instead of count() that is deprecated. We should detect MongoDB version and switch.
1150
// https://docs.mongodb.com/manual/reference/method/db.collection.countDocuments/
@@ -1329,7 +1327,6 @@ module.exports.CreateDB = function (parent, func) {
1327
obj.dispose = function () { for (var x in obj) { if (obj[x].close) { obj[x].close(); } delete obj[x]; } };
1328
obj.getLocalAmtNodes = function (func) { obj.file.find({ type: 'node', host: { $exists: true, $ne: null }, intelamt: { $exists: true } }, func); };
1329
obj.getAmtUuidMeshNode = function (meshid, uuid, func) { obj.file.find({ type: 'node', meshid: meshid, 'intelamt.uuid': uuid }, func); };
1332
- obj.getAmtUuidNode = function (uuid, func) { obj.file.find({ type: 'node', 'intelamt.uuid': uuid }, func); };
1330
obj.isMaxType = function (max, type, domainid, func) { if (max == null) { func(false); } else { obj.file.count({ type: type, domain: domainid }, function (err, count) { func((err != null) || (count > max), count); }); } }
1331
1332
// Database actions on the events collection
mpsserver.js
+1
-1
@@ -637,7 +637,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
637
});
638
} else if (mesh.mtype == 2) { // If this is a agent mesh, search the mesh for this device UUID
639
// Intel AMT GUID (socket.tag.SystemId) will be used to search the node
640
- obj.db.getAmtUuidNode(socket.tag.SystemId, function (err, nodes) { // TODO: May need to optimize this request with indexes
640
+ obj.db.getAmtUuidMeshNode(mesh._id, socket.tag.SystemId, function (err, nodes) { // TODO: Need to optimize this request with indexes
641
if ((nodes == null) || (nodes.length === 0) || (obj.parent.webserver.meshes == null)) {
642
// New CIRA connection for unknown node, disconnect.
643
unknownNodeCount++;
webserver.js
-190
@@ -3787,195 +3787,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3787
});
3788
}
3789
3790
- // Handle a Intel AMT activation request
3791
- function handleAmtActivateWebSocket(ws, req) {
3792
- const domain = checkUserIpAddress(ws, req);
3793
- if (domain == null) { return; }
3794
- if (req.query.id == null) { ws.send(JSON.stringify({ errorText: 'Missing group identifier' })); ws.close(); return; }
3795
-
3796
- // Fetch the mesh object
3797
- ws.meshid = 'mesh/' + domain.id + '/' + req.query.id;
3798
- const mesh = obj.meshes[ws.meshid];
3799
- if (mesh == null) { ws.send(JSON.stringify({ errorText: 'Invalid device group: ' + ws.meshid })); delete ws.meshid; ws.close(); return; }
3800
- if (mesh.mtype != 1) { ws.send(JSON.stringify({ errorText: 'Invalid device group type:' + ws.meshid })); delete ws.meshid; ws.close(); return; }
3801
-
3802
- // Fetch the remote IP:Port for logging
3803
- ws.remoteaddr = req.clientIp;
3804
- ws.remoteaddrport = ws.remoteaddr + ':' + ws._socket.remotePort;
3805
-
3806
- // When data is received from the web socket, echo it back
3807
- ws.on('message', function (data) {
3808
- // Parse the incoming command
3809
- var cmd = null;
3810
- try { cmd = JSON.parse(data); } catch (ex) { };
3811
- if (cmd == null) return;
3812
-
3813
- // Process the command
3814
- switch (cmd.action) {
3815
- case 'ccmactivate':
3816
- case 'acmactivate': {
3817
- // Check the command
3818
- if (cmd.version != 1) { ws.send(JSON.stringify({ errorText: 'Unsupported version' })); ws.close(); return; }
3819
- if (obj.common.validateString(cmd.realm, 16, 256) == false) { ws.send(JSON.stringify({ errorText: 'Invalid realm argument' })); ws.close(); return; }
3820
- if (obj.common.validateString(cmd.uuid, 36, 36) == false) { ws.send(JSON.stringify({ errorText: 'Invalid UUID argument' })); ws.close(); return; }
3821
- if (typeof cmd.hashes !== 'object') { ws.send(JSON.stringify({ errorText: 'Invalid hashes' })); ws.close(); return; }
3822
- if (typeof cmd.fqdn !== 'string') { ws.send(JSON.stringify({ errorText: 'Invalid FQDN' })); ws.close(); return; }
3823
- if ((obj.common.validateString(cmd.ver, 5, 16) == false) || (cmd.ver.split('.').length != 3)) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT version' })); ws.close(); return; }
3824
- if (obj.common.validateArray(cmd.modes, 1, 2) == false) { ws.send(JSON.stringify({ errorText: 'Invalid activation modes' })); ws.close(); return; }
3825
- if (obj.common.validateInt(cmd.currentMode, 0, 2) == false) { ws.send(JSON.stringify({ errorText: 'Invalid current mode' })); ws.close(); return; }
3826
- if (typeof cmd.sku !== 'number') { ws.send(JSON.stringify({ errorText: 'Invalid SKU number' })); ws.close(); return; }
3827
-
3828
- // Get the current Intel AMT policy
3829
- var mesh = obj.meshes[ws.meshid], activationMode = 4; // activationMode: 2 = CCM, 4 = ACM
3830
- if ((mesh == null) || (mesh.amt == null) || (mesh.amt.password == null) || ((mesh.amt.type != 2) && (mesh.amt.type != 3))) { ws.send(JSON.stringify({ errorText: 'Unable to activate' })); ws.close(); return; }
3831
- if ((mesh.amt.type != 3) || (domain.amtacmactivation == null) || (domain.amtacmactivation.acmmatch == null)) { activationMode = 2; }
3832
-
3833
- if (activationMode == 4) {
3834
- // Check if we have a FQDN/Hash match
3835
- var matchingHash = null, matchingCN = null;
3836
- for (var i in domain.amtacmactivation.acmmatch) {
3837
- // Check for a matching FQDN
3838
- if ((domain.amtacmactivation.acmmatch[i].cn == '*') || (domain.amtacmactivation.acmmatch[i].cn.toLowerCase() == cmd.fqdn)) {
3839
- // Check for a matching certificate
3840
- if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha256) >= 0) {
3841
- matchingCN = domain.amtacmactivation.acmmatch[i].cn;
3842
- matchingHash = domain.amtacmactivation.acmmatch[i].sha256;
3843
- continue;
3844
- } else if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha1) >= 0) {
3845
- matchingCN = domain.amtacmactivation.acmmatch[i].cn;
3846
- matchingHash = domain.amtacmactivation.acmmatch[i].sha1;
3847
- continue;
3848
- }
3849
- }
3850
- }
3851
- // If no cert match or wildcard match which is not yet supported, do CCM activation.
3852
- if ((matchingHash == null) || (matchingCN == '*')) { ws.send(JSON.stringify({ messageText: 'No matching ACM activation certificates, activating in CCM instead...' })); activationMode = 2; } else { cmd.hash = matchingHash; }
3853
- }
3854
-
3855
- // Check if we are going to activate in an allowed mode. cmd.modes: 1 = CCM, 2 = ACM
3856
- if ((activationMode == 4) && (cmd.modes.indexOf(2) == -1)) { ws.send(JSON.stringify({ messageText: 'ACM not allowed on this machine, activating in CCM instead...' })); activationMode = 2; } // We want to do ACM, but mode is not allowed. Change to CCM.
3857
-
3858
- // If we want to do CCM, but mode is not allowed. Error out.
3859
- if ((activationMode == 2) && (cmd.modes.indexOf(1) == -1)) { ws.send(JSON.stringify({ errorText: 'CCM is not an allowed activation mode' })); ws.close(); return; }
3860
-
3861
- // Get the Intel AMT admin password, randomize if needed.
3862
- var amtpassword = ((mesh.amt.password == '') ? getRandomAmtPassword() : mesh.amt.password);
3863
- if (checkAmtPassword(amtpassword) == false) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT password' })); ws.close(); return; } // Invalid Intel AMT password, this should never happen.
3864
-
3865
- // Save some state, if activation is successful, we need this to add the device
3866
- ws.xxstate = { uuid: cmd.uuid, realm: cmd.realm, tag: cmd.tag, name: cmd.name, hostname: cmd.hostname, pass: amtpassword, flags: activationMode, ver: cmd.ver, sku: cmd.sku }; // Flags: 2 = CCM, 4 = ACM
3867
-
3868
- if (activationMode == 4) {
3869
- // ACM: Agent is asking the server to sign an Intel AMT ACM activation request
3870
- var signResponse = parent.certificateOperations.signAcmRequest(domain, cmd, 'admin', amtpassword, ws.remoteaddrport, null, ws.meshid, null, null);
3871
- ws.send(JSON.stringify(signResponse));
3872
- } else {
3873
- // CCM: Log the activation request, logging is a required step for activation.
3874
- if (parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: 'ccmactivate', domain: domain.id, amtUuid: cmd.uuid, amtRealm: cmd.realm, user: 'admin', password: amtpassword, ipport: ws.remoteaddrport, meshid: ws.meshid, tag: cmd.tag, name: cmd.name }) == false) return { errorText: 'Unable to log operation' };
3875
-
3876
- // Compute the HTTP digest hash and send the response for CCM activation
3877
- ws.send(JSON.stringify({ action: 'ccmactivate', password: obj.crypto.createHash('md5').update('admin:' + cmd.realm + ':' + amtpassword).digest('hex') }));
3878
- }
3879
- break;
3880
- }
3881
- case 'ccmactivate-failed':
3882
- case 'acmactivate-failed': {
3883
- // Log the activation response
3884
- parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: cmd.action, domain: domain.id, amtUuid: cmd.uuid, ipport: ws.remoteaddrport, meshid: ws.meshid });
3885
- break;
3886
- }
3887
- case 'amtdiscover':
3888
- case 'ccmactivate-success':
3889
- case 'acmactivate-success': {
3890
- // If this is a discovery command, set the state.
3891
- if (cmd.action == 'amtdiscover') {
3892
- if (cmd.version != 1) { ws.send(JSON.stringify({ errorText: 'Unsupported version' })); ws.close(); return; }
3893
- if (obj.common.validateString(cmd.realm, 16, 256) == false) { ws.send(JSON.stringify({ errorText: 'Invalid realm argument' })); ws.close(); return; }
3894
- if (obj.common.validateString(cmd.uuid, 36, 36) == false) { ws.send(JSON.stringify({ errorText: 'Invalid UUID argument' })); ws.close(); return; }
3895
- if (typeof cmd.hashes != 'object') { ws.send(JSON.stringify({ errorText: 'Invalid hashes' })); ws.close(); return; }
3896
- if (typeof cmd.fqdn != 'string') { ws.send(JSON.stringify({ errorText: 'Invalid FQDN' })); ws.close(); return; }
3897
- if ((obj.common.validateString(cmd.ver, 5, 16) == false) || (cmd.ver.split('.').length != 3)) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT version' })); ws.close(); return; }
3898
- if (obj.common.validateArray(cmd.modes, 1, 2) == false) { ws.send(JSON.stringify({ errorText: 'Invalid activation modes' })); ws.close(); return; }
3899
- if (obj.common.validateInt(cmd.currentMode, 0, 2) == false) { ws.send(JSON.stringify({ errorText: 'Invalid current mode' })); ws.close(); return; }
3900
- var activationMode = 0; if (cmd.currentMode == 1) { activationMode = 2; } else if (cmd.currentMode == 2) { activationMode = 4; }
3901
- ws.xxstate = { uuid: cmd.uuid, realm: cmd.realm, tag: cmd.tag, name: cmd.name, hostname: cmd.hostname, flags: activationMode, ver: cmd.ver, sku: cmd.sku }; // Flags: 2 = CCM, 4 = ACM
3902
- } else {
3903
- // If this is an activation success, check that state was set already.
3904
- if (ws.xxstate == null) { ws.send(JSON.stringify({ errorText: 'Invalid command' })); ws.close(); return; }
3905
- }
3906
-
3907
- // Log the activation response
3908
- parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: cmd.action, domain: domain.id, amtUuid: cmd.uuid, ipport: ws.remoteaddrport, meshid: ws.meshid });
3909
-
3910
- // Get the current Intel AMT policy
3911
- var mesh = obj.meshes[ws.meshid];
3912
- if (mesh == null) { ws.send(JSON.stringify({ errorText: 'Unknown device group' })); ws.close(); return; }
3913
-
3914
- // Fix the computer name if needed
3915
- if ((ws.xxstate.name == null) || (ws.xxstate.name.length == 0)) { ws.xxstate.name = ws.xxstate.hostname; }
3916
- if ((ws.xxstate.name == null) || (ws.xxstate.name.length == 0)) { ws.xxstate.name = ws.xxstate.uuid; }
3917
-
3918
- db.getAmtUuidNode(ws.meshid, ws.xxstate.uuid, function (err, nodes) {
3919
- if ((nodes == null) || (nodes.length == 0)) {
3920
- // Create a new nodeid
3921
- parent.crypto.randomBytes(48, function (err, buf) {
3922
- // Create the new node
3923
- var xxnodeid = 'node/' + domain.id + '/' + buf.toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
3924
- var device = { type: 'node', _id: xxnodeid, meshid: ws.meshid, name: ws.xxstate.name, rname: ws.xxstate.name, host: ws.remoteaddr, domain: domain.id, intelamt: { state: 2, flags: ws.xxstate.flags, tls: 0, uuid: ws.xxstate.uuid, realm: ws.xxstate.realm, tag: ws.xxstate.tag, ver: ws.xxstate.ver, sku: ws.xxstate.sku } };
3925
- if (ws.xxstate.pass != null) { device.intelamt.user = 'admin'; device.intelamt.pass = ws.xxstate.pass; }
3926
- if (device.intelamt.flags != 0) { device.intelamt.state = 2; } else { device.intelamt.state = 0; }
3927
- db.Set(device);
3928
-
3929
- // Event the new node
3930
- var device2 = Object.assign({}, device); // Shallow clone
3931
- device2.intelamt = Object.assign({}, device2.intelamt); // Shallow clone
3932
- delete device2.intelamt.pass; // Remove the Intel AMT password before eventing this.
3933
- parent.DispatchEvent(['*', ws.meshid], obj, { etype: 'node', action: 'addnode', node: device2, msg: 'Added device ' + ws.xxstate.name + ' to mesh ' + mesh.name, domain: domain.id });
3934
- });
3935
- } else {
3936
- // Change an existing device
3937
- var device = nodes[0];
3938
- if (device.host != ws.remoteaddr) { device.host = ws.remoteaddr; }
3939
- if ((ws.xxstate.name != null) && (device.rname != ws.xxstate.name)) { device.rname = ws.xxstate.name; }
3940
- if (device.intelamt.flags != 0) {
3941
- if (device.intelamt.state != 2) { device.intelamt.state = 2; }
3942
- }
3943
- if (device.intelamt.flags != ws.xxstate.flags) { device.intelamt.state = ws.xxstate.flags; }
3944
- if (ws.xxstate.pass != null) {
3945
- if (device.intelamt.user != 'admin') { device.intelamt.user = 'admin'; }
3946
- if (device.intelamt.pass != ws.xxstate.pass) { device.intelamt.pass = ws.xxstate.pass; }
3947
- }
3948
- if (device.intelamt.realm != ws.xxstate.realm) { device.intelamt.realm = ws.xxstate.realm; }
3949
- if (ws.xxstate.realm == null) { delete device.intelamt.tag; }
3950
- else if (device.intelamt.tag != ws.xxstate.tag) { device.intelamt.tag = ws.xxstate.tag; }
3951
- if (device.intelamt.ver != ws.xxstate.ver) { device.intelamt.ver = ws.xxstate.ver; }
3952
- if (device.intelamt.sku != ws.xxstate.sku) { device.intelamt.sku = ws.xxstate.sku; }
3953
- db.Set(device);
3954
-
3955
- // Event the new node
3956
- var device2 = Object.assign({}, device); // Shallow clone
3957
- device2.intelamt = Object.assign({}, device2.intelamt); // Shallow clone
3958
- delete device2.intelamt.pass; // Remove the Intel AMT password before eventing this.
3959
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
3960
- parent.DispatchEvent(['*', ws.meshid], obj, { etype: 'node', action: 'changenode', nodeid: device2._id, node: device2, msg: 'Changed device ' + device.name + ' in mesh ' + mesh.name, domain: domain.id });
3961
- }
3962
- });
3963
-
3964
- if (cmd.action == 'amtdiscover') { ws.send(JSON.stringify({ action: 'amtdiscover' })); }
3965
- break;
3966
- }
3967
- default: {
3968
- // This is not a known command
3969
- ws.send(JSON.stringify({ errorText: 'Invalid command' })); ws.close(); return;
3970
- }
3971
- }
3972
- });
3973
-
3974
- // If close or error, do nothing.
3975
- ws.on('error', function (err) { });
3976
- ws.on('close', function (req) { });
3977
- }
3978
-
3790
// Setup agent to/from server file transfer handler
3791
function handleAgentFileTransfer(ws, req) {
3792
var domain = checkAgentIpAddress(ws, req);
@@ -5146,7 +4957,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4957
obj.app.get(url + 'player', handlePlayerRequest);
4958
obj.app.get(url + 'desktop', handleDesktopRequest);
4959
obj.app.get(url + 'terminal', handleTerminalRequest);
5149
- obj.app.ws(url + 'amtactivate', handleAmtActivateWebSocket);
4960
obj.app.ws(url + 'agenttransfer.ashx', handleAgentFileTransfer); // Setup agent to/from server file transfer handler
4961
obj.app.ws(url + 'meshrelay.ashx', function (ws, req) {
4962
PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie) {