More Intel AMT CCM improvements.
Ylian Saint-Hilaire committed
Oct 20, 2020 at 18:14 UTC
820868bd6e75856d971b9275cb700fb1a08eb0b9
7 files changed
+130
-117
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/MeshService-signed.exe
Binary files a/agents/MeshService-signed.exe and b/agents/MeshService-signed.exe differ
agents/MeshService64-signed.exe
Binary files a/agents/MeshService64-signed.exe and b/agents/MeshService64-signed.exe differ
agents/meshcmd.js
+92
-84
@@ -537,64 +537,66 @@ function run(argv) {
537
var amtMeiModule, amtMei;
538
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
539
amtMei.on('error', function (e) { console.log('ERROR: ' + e); exit(1); return; });
540
- amtMei.getVersion(function (result) {
541
- if (result) {
542
- for (var version in result.Versions) {
543
- if (result.Versions[version].Description == 'AMT') { mestate.ver = result.Versions[version].Version; }
544
- if (result.Versions[version].Description == 'Sku') { mestate.sku = parseInt(result.Versions[version].Version); }
540
+ try {
541
+ amtMei.getVersion(function (result) {
542
+ if (result) {
543
+ for (var version in result.Versions) {
544
+ if (result.Versions[version].Description == 'AMT') { mestate.ver = result.Versions[version].Version; }
545
+ if (result.Versions[version].Description == 'Sku') { mestate.sku = parseInt(result.Versions[version].Version); }
546
+ }
547
}
546
- }
547
- });
548
- amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
549
- amtMei.getProvisioningMode(function (result) { if (result) { mestate.ProvisioningMode = result; } });
550
- amtMei.getEHBCState(function (result) { if (result) { mestate.ehbc = result; } });
551
- amtMei.getControlMode(function (result) { if (result) { mestate.controlmode = result; } });
552
- amtMei.getMACAddresses(function (result) { if (result) { mestate.mac = result; } });
553
- amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
554
- amtMei.getLanInterfaceSettings(1, function (result) { if (result) { mestate.net1 = result; } });
555
- amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
556
- amtMei.getDnsSuffix(function (result) {
557
- if (result) { mestate.dns = result; }
558
- if (mestate.ver && mestate.ProvisioningState && mestate.ProvisioningMode) {
559
- var str = 'Intel ME v' + mestate.ver;
560
- if (mestate.sku & 8) { str = 'Intel AMT v' + mestate.ver }
561
- else if (mestate.sku & 16) { str = 'Intel SM v' + mestate.ver }
562
- if (mestate.ProvisioningState.stateStr == 'PRE') { str += ', pre-provisioning state'; }
563
- else if (mestate.ProvisioningState.stateStr == 'IN') { str += ', in-provisioning state'; }
564
- else if (mestate.ProvisioningState.stateStr == 'POST') {
565
- if (mestate.ProvisioningMode) {
566
- if (mestate.controlmode) {
567
- if (mestate.ProvisioningMode.modeStr == 'ENTERPRISE') { str += ', activated in ' + ["none", "client control mode", "admin control mode", "remote assistance mode"][mestate.controlmode.controlMode]; } else { str += ', activated in ' + mestate.ProvisioningMode.modeStr; }
568
- } else {
569
- str += ', activated in ' + mestate.ProvisioningMode.modeStr;
548
+ });
549
+ amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
550
+ amtMei.getProvisioningMode(function (result) { if (result) { mestate.ProvisioningMode = result; } });
551
+ amtMei.getEHBCState(function (result) { if (result) { mestate.ehbc = result; } });
552
+ amtMei.getControlMode(function (result) { if (result) { mestate.controlmode = result; } });
553
+ amtMei.getMACAddresses(function (result) { if (result) { mestate.mac = result; } });
554
+ amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
555
+ amtMei.getLanInterfaceSettings(1, function (result) { if (result) { mestate.net1 = result; } });
556
+ amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
557
+ amtMei.getDnsSuffix(function (result) {
558
+ if (result) { mestate.dns = result; }
559
+ if (mestate.ver && mestate.ProvisioningState && mestate.ProvisioningMode) {
560
+ var str = 'Intel ME v' + mestate.ver;
561
+ if (mestate.sku & 8) { str = 'Intel AMT v' + mestate.ver }
562
+ else if (mestate.sku & 16) { str = 'Intel SM v' + mestate.ver }
563
+ if (mestate.ProvisioningState.stateStr == 'PRE') { str += ', pre-provisioning state'; }
564
+ else if (mestate.ProvisioningState.stateStr == 'IN') { str += ', in-provisioning state'; }
565
+ else if (mestate.ProvisioningState.stateStr == 'POST') {
566
+ if (mestate.ProvisioningMode) {
567
+ if (mestate.controlmode) {
568
+ if (mestate.ProvisioningMode.modeStr == 'ENTERPRISE') { str += ', activated in ' + ["none", "client control mode", "admin control mode", "remote assistance mode"][mestate.controlmode.controlMode]; } else { str += ', activated in ' + mestate.ProvisioningMode.modeStr; }
569
+ } else {
570
+ str += ', activated in ' + mestate.ProvisioningMode.modeStr;
571
+ }
572
}
573
}
572
- }
573
- if ((mestate.ehbc) && (mestate.ehbc.EHBC == true)) { str += ', EHBC enabled'; }
574
- str += '.';
575
- if (mestate.net0 != null) { str += '\r\nWired ' + ((mestate.net0.enabled == 1) ? 'Enabled' : 'Disabled') + ((mestate.net0.dhcpEnabled == 1) ? ', DHCP' : ', Static') + ', ' + mestate.net0.mac + (mestate.net0.address == '0.0.0.0' ? '' : (', ' + mestate.net0.address)); }
576
- if (mestate.net1 != null) { str += '\r\nWireless ' + ((mestate.net1.enabled == 1) ? 'Enabled' : 'Disabled') + ((mestate.net1.dhcpEnabled == 1) ? ', DHCP' : ', Static') + ', ' + mestate.net1.mac + (mestate.net1.address == '0.0.0.0' ? '' : (', ' + mestate.net1.address)); }
577
- if ((mestate.ProvisioningState.stateStr != 'POST') && (mestate.net0 != null) && (mestate.net0.enabled == 1)) {
578
- if (mestate.dns != null) {
579
- // Intel AMT has a trusted DNS suffix set, use that one.
580
- str += '\r\nTrusted DNS suffix: ' + mestate.dns;
581
- } else {
582
- // Look for the DNS suffix for the Intel AMT Ethernet interface
583
- var fqdn = null, interfaces = require('os').networkInterfaces();
584
- for (var i in interfaces) {
585
- for (var j in interfaces[i]) {
586
- if ((interfaces[i][j].mac == mestate.net0.mac) && (interfaces[i][j].fqdn != null) && (interfaces[i][j].fqdn != '')) { fqdn = interfaces[i][j].fqdn; }
574
+ if ((mestate.ehbc) && (mestate.ehbc.EHBC == true)) { str += ', EHBC enabled'; }
575
+ str += '.';
576
+ if (mestate.net0 != null) { str += '\r\nWired ' + ((mestate.net0.enabled == 1) ? 'Enabled' : 'Disabled') + ((mestate.net0.dhcpEnabled == 1) ? ', DHCP' : ', Static') + ', ' + mestate.net0.mac + (mestate.net0.address == '0.0.0.0' ? '' : (', ' + mestate.net0.address)); }
577
+ if (mestate.net1 != null) { str += '\r\nWireless ' + ((mestate.net1.enabled == 1) ? 'Enabled' : 'Disabled') + ((mestate.net1.dhcpEnabled == 1) ? ', DHCP' : ', Static') + ', ' + mestate.net1.mac + (mestate.net1.address == '0.0.0.0' ? '' : (', ' + mestate.net1.address)); }
578
+ if ((mestate.ProvisioningState.stateStr != 'POST') && (mestate.net0 != null) && (mestate.net0.enabled == 1)) {
579
+ if (mestate.dns != null) {
580
+ // Intel AMT has a trusted DNS suffix set, use that one.
581
+ str += '\r\nTrusted DNS suffix: ' + mestate.dns;
582
+ } else {
583
+ // Look for the DNS suffix for the Intel AMT Ethernet interface
584
+ var fqdn = null, interfaces = require('os').networkInterfaces();
585
+ for (var i in interfaces) {
586
+ for (var j in interfaces[i]) {
587
+ if ((interfaces[i][j].mac == mestate.net0.mac) && (interfaces[i][j].fqdn != null) && (interfaces[i][j].fqdn != '')) { fqdn = interfaces[i][j].fqdn; }
588
+ }
589
}
590
+ if (fqdn != null) { str += '\r\nDNS suffix: ' + fqdn; }
591
}
589
- if (fqdn != null) { str += '\r\nDNS suffix: ' + fqdn; }
592
}
593
+ console.log(str + '.');
594
+ } else {
595
+ console.log('Intel(R) AMT not supported.');
596
}
592
- console.log(str + '.');
593
- } else {
594
- console.log('Intel(R) AMT not supported.');
595
- }
596
- exit(1);
597
- });
597
+ exit(1);
598
+ });
599
+ } catch (ex) { console.log("Unable to perform MEI operations, try running as administrator."); exit(1); return; }
600
} else if (settings.action == 'amtinfodebug') {
601
// Display Intel AMT version and activation state
602
getMeiState(15, function (state) { console.log(JSON.stringify(state, null, 2)); exit(1); }); // Flags: 1 = Versions, 2 = OsAdmin, 4 = Hashes, 8 = Network
@@ -1133,20 +1135,23 @@ function startMeshCommander() {
1135
//
1136
1137
function configureAmt() {
1136
- console.log('Starting Intel AMT configuration...');
1138
settings.noconsole = true;
1139
startLms(configureAmt2, amtMei);
1140
}
1141
1142
function configureAmt2() {
1143
getMeiState(15, function (state) { // Flags: 1 = Versions, 2 = OsAdmin, 4 = Hashes, 8 = Network
1144
+ if (state == null) { console.log('Unable to get Intel AMT state, try running as administrator.'); exit(1); return; }
1145
+ if (state.ProvisioningState == null) { console.log('Intel AMT not ready for configuration.'); exit(1); return; }
1146
+ console.log('Starting Intel AMT configuration...');
1147
+
1148
// Connect to MPS and start APF relay
1149
var apfarg = {
1150
mpsurl: settings.url,
1151
mpsuser: settings.id.substring(0, 16),
1152
mpspass: settings.id.substring(0, 16),
1153
mpskeepalive: 60000,
1149
- clientname: require('os').hostname(),
1154
+ clientname: state.OsHostname,
1155
clientaddress: '127.0.0.1',
1156
clientuuid: state.UUID,
1157
conntype: 2, // 0 = CIRA, 1 = Relay, 2 = LMS. The correct value is 2 since we are performing an LMS relay.
@@ -1306,36 +1311,38 @@ function activeToACM() {
1311
var amtMeiModule, amtMei;
1312
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
1313
amtMei.on('error', function (e) { console.log('ERROR: ' + e); exit(1); return; });
1309
- amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
1310
- amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
1311
- amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
1312
- amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
1313
- amtMei.getControlMode(function (result) { if (result != null) { mestate.controlMode = result.controlMode; } }); // controlMode: 0 = NoActivated, 1 = CCM, 2 = ACM
1314
- amtMei.getDnsSuffix(function (result) {
1315
- if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
1316
- if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
1317
- if ((settings.action != 'amtdiscover') && (mestate.controlMode == 2)) { console.log("Intel AMT already activation in admin control mode."); exit(100); return; }
1318
- if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
1319
- var fqdn = null;
1320
- if ((mestate.net0 == null) && (meinfo.net0.enabled != 0)) { console.log("No Intel AMT wired interface, can't perform ACM activation."); exit(100); return; }
1321
- if (result) { fqdn = result; } // If Intel AMT has a trusted DNS suffix set, use that one.
1322
- else {
1323
- // Look for the DNS suffix for the Intel AMT Ethernet interface
1324
- var interfaces = require('os').networkInterfaces();
1325
- for (var i in interfaces) {
1326
- for (var j in interfaces[i]) {
1327
- if ((interfaces[i][j].mac == mestate.net0.mac) && (interfaces[i][j].fqdn != null) && (interfaces[i][j].fqdn != '')) { fqdn = interfaces[i][j].fqdn; }
1314
+ try {
1315
+ amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
1316
+ amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
1317
+ amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
1318
+ amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
1319
+ amtMei.getControlMode(function (result) { if (result != null) { mestate.controlMode = result.controlMode; } }); // controlMode: 0 = NoActivated, 1 = CCM, 2 = ACM
1320
+ amtMei.getDnsSuffix(function (result) {
1321
+ if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
1322
+ if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
1323
+ if ((settings.action != 'amtdiscover') && (mestate.controlMode == 2)) { console.log("Intel AMT already activation in admin control mode."); exit(100); return; }
1324
+ if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
1325
+ var fqdn = null;
1326
+ if ((mestate.net0 == null) && (meinfo.net0.enabled != 0)) { console.log("No Intel AMT wired interface, can't perform ACM activation."); exit(100); return; }
1327
+ if (result) { fqdn = result; } // If Intel AMT has a trusted DNS suffix set, use that one.
1328
+ else {
1329
+ // Look for the DNS suffix for the Intel AMT Ethernet interface
1330
+ var interfaces = require('os').networkInterfaces();
1331
+ for (var i in interfaces) {
1332
+ for (var j in interfaces[i]) {
1333
+ if ((interfaces[i][j].mac == mestate.net0.mac) && (interfaces[i][j].fqdn != null) && (interfaces[i][j].fqdn != '')) { fqdn = interfaces[i][j].fqdn; }
1334
+ }
1335
}
1336
}
1330
- }
1331
- if (fqdn != null) {
1332
- settings.fqdn = fqdn;
1333
- settings.uuid = mestate.uuid;
1334
- getTrustedHashes(amtMei, function () { startLms(getFwNonce, amtMei); });
1335
- } else {
1336
- console.log("Trusted DNS suffix not set, can't perform ACM activation."); exit(100); return;
1337
- }
1338
- });
1337
+ if (fqdn != null) {
1338
+ settings.fqdn = fqdn;
1339
+ settings.uuid = mestate.uuid;
1340
+ getTrustedHashes(amtMei, function () { startLms(getFwNonce, amtMei); });
1341
+ } else {
1342
+ console.log("Trusted DNS suffix not set, can't perform ACM activation."); exit(100); return;
1343
+ }
1344
+ });
1345
+ } catch (ex) { console.log("Unable to perform MEI operations, try running as administrator."); exit(1); return; }
1346
}
1347
1348
// Gets the FWNonce from AMT and saves it to a file.
@@ -1719,7 +1726,7 @@ function startLms(func, lmscommander, tag) {
1726
//console.log("PTHI Connected.");
1727
1728
console.log('Setting up LME...');
1722
- amtLms = new lme_heci({ debug: settings.lmsdebug });
1729
+ try { amtLms = new lme_heci({ debug: settings.lmsdebug }); } catch (ex) { if (func != null) { func(0, tag); } return; }
1730
amtLms.promise = ret;
1731
amtLms.on('error', function (e) {
1732
//console.log('LME connection failed', e);
@@ -1835,6 +1842,7 @@ function setupMeiOsAdmin(func, state, tag) {
1842
if (func) { func(state, tag); }
1843
} else {
1844
amtMei.getLocalSystemAccount(function (x) {
1845
+ if ((x == null) || (x.user == null) || (x.pass == null)) { if (func) { func(state, tag); } return; } // No OsAdmin, stop here.
1846
var transport = require('amt-wsman-duk');
1847
var wsman = require('amt-wsman');
1848
var amt = require('amt');
@@ -2957,7 +2965,7 @@ function getMeiState(flags, func) {
2965
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { func(null); return; }
2966
amtMei.on('error', function (e) { func(null); return; });
2967
try {
2960
- var amtMeiTmpState = { Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2968
+ var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
2969
amtMei.getProtocolVersion(function (result) { if (result != null) { amtMeiTmpState.MeiVersion = result; } });
2970
if ((flags & 1) != 0) { amtMei.getVersion(function (result) { if (result) { amtMeiTmpState.Versions = {}; for (var version in result.Versions) { amtMeiTmpState.Versions[result.Versions[version].Description] = result.Versions[version].Version; } } }); }
2971
amtMei.getProvisioningMode(function (result) { if (result) { amtMeiTmpState.ProvisioningMode = result.mode; } });
@@ -2980,7 +2988,7 @@ function getMeiState(flags, func) {
2988
amtMei.getDnsSuffix(function (result) { if (result != null) { amtMeiTmpState.DnsSuffix = result; } if ((flags & 4) == 0) { if (func != null) { func(amtMeiTmpState); } } });
2989
if ((flags & 4) != 0) {
2990
amtMei.getHashHandles(function (handles) {
2983
- if (handles != null) { amtMeiTmpState.Hashes = []; } else { func(amtMeiTmpState); }
2991
+ if ((handles != null) && (handles.length > 0)) { amtMeiTmpState.Hashes = []; } else { func(amtMeiTmpState); }
2992
var exitOnCount = handles.length;
2993
for (var i = 0; i < handles.length; ++i) { this.getCertHashEntry(handles[i], function (hashresult) { amtMeiTmpState.Hashes.push(hashresult); if (--exitOnCount == 0) { if (func != null) { func(amtMeiTmpState); } } }); }
2994
});
agents/meshcore.js
+30
-28
@@ -3545,32 +3545,34 @@ function createMeshCore(agent) {
3545
if (amt == null) { response = "No Intel AMT support delected"; break; }
3546
getMeiState(15, function (state) {
3547
var rx = '';
3548
- var apfarg = {
3549
- mpsurl: mesh.ServerUrl.replace('agent.ashx', 'apf.ashx'),
3550
- mpsuser: Buffer.from(mesh.ServerInfo.MeshID, 'hex').toString('base64').substring(0, 16),
3551
- mpspass: Buffer.from(mesh.ServerInfo.MeshID, 'hex').toString('base64').substring(0, 16),
3552
- mpskeepalive: 60000,
3553
- clientname: require('os').hostname(),
3554
- clientaddress: '127.0.0.1',
3555
- clientuuid: state.UUID,
3556
- conntype: 2, // 0 = CIRA, 1 = Relay, 2 = LMS. The correct value is 2 since we are performing an LMS relay, other values for testing.
3557
- meiState: state // MEI state will be passed to MPS server
3558
- };
3559
- if ((state.UUID == null) || (state.UUID.length != 36)) {
3560
- rx = "Unable to get Intel AMT UUID";
3561
- } else {
3562
- apftunnel = require('apfclient')({ debug: false }, apfarg);
3563
- apftunnel.onJsonControl = function (data) {
3564
- if (data.action == 'console') { require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: data.msg }); } // Display a console message
3565
- if (data.action == 'mestate') { getMeiState(15, function (state) { apftunnel.updateMeiState(state); }); } // Update the MEI state
3566
- if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
3567
- }
3568
- apftunnel.onChannelClosed = function () { apftunnel = null; }
3569
- try {
3570
- apftunnel.connect();
3571
- rx = "Started Intel AMT configuration";
3572
- } catch (ex) {
3573
- rx = JSON.stringify(ex);
3548
+ if ((state == null) || (state.ProvisioningState == null)) { rx = "Intel AMT not ready for configuration."; } else {
3549
+ var apfarg = {
3550
+ mpsurl: mesh.ServerUrl.replace('agent.ashx', 'apf.ashx'),
3551
+ mpsuser: Buffer.from(mesh.ServerInfo.MeshID, 'hex').toString('base64').substring(0, 16),
3552
+ mpspass: Buffer.from(mesh.ServerInfo.MeshID, 'hex').toString('base64').substring(0, 16),
3553
+ mpskeepalive: 60000,
3554
+ clientname: state.OsHostname,
3555
+ clientaddress: '127.0.0.1',
3556
+ clientuuid: state.UUID,
3557
+ conntype: 2, // 0 = CIRA, 1 = Relay, 2 = LMS. The correct value is 2 since we are performing an LMS relay, other values for testing.
3558
+ meiState: state // MEI state will be passed to MPS server
3559
+ };
3560
+ if ((state.UUID == null) || (state.UUID.length != 36)) {
3561
+ rx = "Unable to get Intel AMT UUID";
3562
+ } else {
3563
+ apftunnel = require('apfclient')({ debug: false }, apfarg);
3564
+ apftunnel.onJsonControl = function (data) {
3565
+ if (data.action == 'console') { require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: data.msg }); } // Display a console message
3566
+ if (data.action == 'mestate') { getMeiState(15, function (state) { apftunnel.updateMeiState(state); }); } // Update the MEI state
3567
+ if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
3568
+ }
3569
+ apftunnel.onChannelClosed = function () { apftunnel = null; }
3570
+ try {
3571
+ apftunnel.connect();
3572
+ rx = "Started Intel AMT configuration";
3573
+ } catch (ex) {
3574
+ rx = JSON.stringify(ex);
3575
+ }
3576
}
3577
}
3578
if (rx != '') { require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: rx }); }
@@ -3840,7 +3842,7 @@ function createMeshCore(agent) {
3842
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { func(null); return; }
3843
amtMei.on('error', function (e) { func(null); return; });
3844
try {
3843
- var amtMeiTmpState = { Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
3845
+ var amtMeiTmpState = { OsHostname: require('os').hostname(), Flags: 0 }; // Flags: 1=EHBC, 2=CCM, 4=ACM
3846
amtMei.getProtocolVersion(function (result) { if (result != null) { amtMeiTmpState.MeiVersion = result; } });
3847
if ((flags & 1) != 0) { amtMei.getVersion(function (result) { if (result) { amtMeiTmpState.Versions = {}; for (var version in result.Versions) { amtMeiTmpState.Versions[result.Versions[version].Description] = result.Versions[version].Version; } } }); }
3848
amtMei.getProvisioningMode(function (result) { if (result) { amtMeiTmpState.ProvisioningMode = result.mode; } });
@@ -3863,7 +3865,7 @@ function createMeshCore(agent) {
3865
amtMei.getDnsSuffix(function (result) { if (result != null) { amtMeiTmpState.DnsSuffix = result; } if ((flags & 4) == 0) { if (func != null) { func(amtMeiTmpState); } } });
3866
if ((flags & 4) != 0) {
3867
amtMei.getHashHandles(function (handles) {
3866
- if (handles != null) { amtMeiTmpState.Hashes = []; } else { func(amtMeiTmpState); }
3868
+ if ((handles != null) && (handles.length > 0)) { amtMeiTmpState.Hashes = []; } else { func(amtMeiTmpState); }
3869
var exitOnCount = handles.length;
3870
for (var i = 0; i < handles.length; ++i) { this.getCertHashEntry(handles[i], function (hashresult) { amtMeiTmpState.Hashes.push(hashresult); if (--exitOnCount == 0) { if (func != null) { func(amtMeiTmpState); } } }); }
3871
});
amtmanager.js
+8
-5
@@ -443,6 +443,7 @@ module.exports.CreateAmtManager = function(parent) {
443
if (dev.aquired.version && (typeof dev.aquired.version == 'string') && (dev.aquired.version != device.intelamt.ver)) { change = 1; log = 1; device.intelamt.ver = dev.aquired.version; changes.push('AMT version'); }
444
if (dev.aquired.user && (typeof dev.aquired.user == 'string') && (dev.aquired.user != device.intelamt.user)) { change = 1; log = 1; device.intelamt.user = dev.aquired.user; changes.push('AMT user'); }
445
if (dev.aquired.pass && (typeof dev.aquired.pass == 'string') && (dev.aquired.pass != device.intelamt.pass)) { change = 1; log = 1; device.intelamt.pass = dev.aquired.pass; changes.push('AMT pass'); }
446
+ if (dev.aquired.host && (typeof dev.aquired.host == 'string') && (dev.aquired.host != device.host)) { change = 1; log = 1; device.host = dev.aquired.host; changes.push('host'); }
447
if (dev.aquired.realm && (typeof dev.aquired.realm == 'string') && (dev.aquired.realm != device.intelamt.realm)) { change = 1; log = 1; device.intelamt.realm = dev.aquired.realm; changes.push('AMT realm'); }
448
if (dev.aquired.hash && (typeof dev.aquired.hash == 'string') && (dev.aquired.hash != device.intelamt.hash)) { change = 1; log = 1; device.intelamt.hash = dev.aquired.hash; changes.push('AMT hash'); }
449
if (dev.aquired.tls && (typeof dev.aquired.tls == 'number') && (dev.aquired.tls != device.intelamt.tls)) { change = 1; log = 1; device.intelamt.tls = dev.aquired.tls; changes.push('AMT TLS'); }
@@ -469,7 +470,6 @@ module.exports.CreateAmtManager = function(parent) {
470
if (parent.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the node. Another event will come.
471
parent.DispatchEvent(parent.webserver.CreateMeshDispatchTargets(device.meshid, [device._id]), obj, event);
472
}
472
-
473
});
474
}
475
@@ -703,7 +703,7 @@ module.exports.CreateAmtManager = function(parent) {
703
const domain = parent.config.domains[dev.domainid];
704
var serverName = 'MeshCentral';
705
if ((domain != null) && (domain.title != null)) { serverName = domain.title; }
706
- const certattributes = { 'CN': commonName, 'O': serverName, 'ST': serverName, 'C': serverName };
706
+ const certattributes = { 'CN': commonName, 'O': serverName, 'ST': 'MC', 'C': 'MC' };
707
const issuerattributes = { 'CN': obj.rootCertCN };
708
const xxCaPrivateKey = obj.parent.certificates.root.key;
709
@@ -781,7 +781,7 @@ module.exports.CreateAmtManager = function(parent) {
781
const dev = stack.dev;
782
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
783
if (status != 200) { dev.consoleMsg("Failed perform commit (" + status + ")."); removeAmtDevice(dev); return; }
784
- dev.consoleMsg("Enabled TLS");
784
+ dev.consoleMsg("Enabled TLS.");
785
786
// Update device in the database
787
dev.aquired.tls = 1;
@@ -1205,7 +1205,7 @@ module.exports.CreateAmtManager = function(parent) {
1205
}
1206
1207
function activateIntelAmtCcm(dev, password) {
1208
- console.log('Intel AMT CCM Activation Required: ' + dev.name, dev.nodeid);
1208
+ // Generate a random Intel AMT password if needed
1209
if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1210
dev.temp = { pass: password };
1211
@@ -1229,13 +1229,15 @@ module.exports.CreateAmtManager = function(parent) {
1229
const dev = stack.dev;
1230
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1231
if (status != 200) { dev.consoleMsg("Failed to activate Intel AMT to CCM."); removeAmtDevice(dev); return; }
1232
- obj.parent.mpsserver.SendJsonControl(dev.mpsConnection, { action: 'mestate' }); // Request an MEI state refresh
1232
1233
// Update the device
1234
dev.aquired = {};
1235
dev.aquired.controlMode = 1; // 1 = CCM, 2 = ACM
1236
var verSplit = dev.amtstack.wsman.comm.amtVersion.split('.');
1237
if (verSplit.length >= 3) { dev.aquired.version = verSplit[0] + '.' + verSplit[1] + '.' + verSplit[2]; dev.aquired.majorver = parseInt(verSplit[0]); dev.aquired.minorver = parseInt(verSplit[1]); }
1238
+ if ((typeof dev.mpsConnection.tag.meiState.OsHostname == 'string') && (typeof dev.mpsConnection.tag.meiState.OsDnsSuffix == 'string')) {
1239
+ dev.aquired.host = dev.mpsConnection.tag.meiState.OsHostname + '.' + dev.mpsConnection.tag.meiState.OsDnsSuffix;
1240
+ }
1241
dev.aquired.realm = dev.amtstack.wsman.comm.digestRealm;
1242
dev.aquired.user = 'admin';
1243
dev.aquired.pass = dev.temp.pass;
@@ -1244,6 +1246,7 @@ module.exports.CreateAmtManager = function(parent) {
1246
UpdateDevice(dev);
1247
1248
// Success, switch to managing this device
1249
+ obj.parent.mpsserver.SendJsonControl(dev.mpsConnection, { action: 'mestate' }); // Request an MEI state refresh
1250
dev.consoleMsg("Succesfully activated Intel AMT in CCM mode.");
1251
1252
// Wait 8 seconds before attempting to manage this device in CCM