Fixed Intel AMT TLS.
Ylian Saint-Hilaire committed
Mar 30, 2020 at 19:29 UTC
8f2046984d6f2efd6e4706c820d92e9eb3e1dcfc
8 files changed
+23
-15
agents/meshcmd.js
+2
-1
@@ -1022,7 +1022,8 @@ function startMeshCommander() {
1022
} else {
1023
// If TLS is going to be used, setup a TLS socket
1024
var tls = require('tls');
1025
- var tlsoptions = { host: webargs.host, port: webargs.port, secureProtocol: ((webargs.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), rejectUnauthorized: false };
1025
+ var tlsoptions = { host: webargs.host, port: webargs.port, rejectUnauthorized: false };
1026
+ if (webargs.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
1027
ws.forwardclient = tls.connect(tlsoptions, function () { debug(1, 'Connected TLS to ' + webargs.host + ':' + webargs.port + '.'); this.pipe(this.ws, { end: false }); this.ws.pipe(this, { end: false }); });
1028
ws.forwardclient.on('error', function () { debug(1, 'TLS connection error to ' + webargs.host + ':' + webargs.port + '.'); try { this.ws.end(); } catch (e) { } });
1029
ws.forwardclient.ws = ws;
amt/amt-redir-mesh.js
+4
-2
@@ -150,7 +150,8 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me
150
151
// TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
152
const TLSSocket = require('tls').TLSSocket;
153
- const tlsoptions = { secureProtocol: ((obj.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
153
+ const tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
154
+ if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
155
const tlsock = new TLSSocket(ser, tlsoptions);
156
tlsock.on('error', function (err) { Debug(1, "CIRA TLS Connection Error ", err); });
157
tlsock.on('secureConnect', function () { Debug(2, "CIRA Secure TLS Connection"); ws._socket.resume(); });
@@ -207,7 +208,8 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me
208
obj.forwardclient.setEncoding('binary');
209
} else {
210
// If TLS is going to be used, setup a TLS socket
210
- var tlsoptions = { secureProtocol: ((obj.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
211
+ var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
212
+ if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
213
obj.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () {
214
// The TLS connection method is the same as TCP, but located a bit differently.
215
Debug(2, 'TLS Intel AMT transport connected to ' + node.host + ':' + port + '.');
amt/amt-wsman-comm.js
+2
-1
@@ -179,7 +179,8 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, parent,
179
obj.socket.connect(obj.port, obj.host, obj.xxOnSocketConnected);
180
} else {
181
// Connect with TLS
182
- var options = { secureProtocol: ((obj.xtlsMethod == 0) ? 'SSLv23_method' : 'TLSv1_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
182
+ var options = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
183
+ if (obj.xtlsMethod != 0) { options.secureProtocol = 'TLSv1_method'; }
184
if (obj.xtlsoptions) {
185
if (obj.xtlsoptions.ca) options.ca = obj.xtlsoptions.ca;
186
if (obj.xtlsoptions.cert) options.cert = obj.xtlsoptions.cert;
amtscanner.js
+3
-1
@@ -371,7 +371,9 @@ module.exports.CreateAmtScanner = function (parent) {
371
} else {
372
// Connect using TLS, we will switch from default TLS to TLS1-only and back if we get a connection error to support older Intel AMT.
373
if (scaninfo.tlsoption == null) { scaninfo.tlsoption = 0; }
374
- client = obj.tls.connect(port, host, scaninfo.tlsoption == 1 ? { secureProtocol: 'TLSv1_method', rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE } : { rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE }, function () { this.write('GET / HTTP/1.1\r\nhost: ' + host + '\r\n\r\n'); });
374
+ const tlsOptions = { rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE };
375
+ if (scaninfo.tlsoption == 1) { tlsOptions.secureProtocol = 'TLSv1_method'; }
376
+ client = obj.tls.connect(port, host, tlsOptions, function () { this.write('GET / HTTP/1.1\r\nhost: ' + host + '\r\n\r\n'); });
377
}
378
client.scaninfo = scaninfo;
379
client.func = func;
meshuser.js
+2
-2
@@ -508,7 +508,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
508
parent.cleanDevice(docs[i]);
509
510
// Remove any connectivity and power state information, that should not be in the database anyway.
511
- // TODO: Find why these are sometimes saves in the db.
511
+ // TODO: Find why these are sometimes saved in the db.
512
if (docs[i].conn != null) { delete docs[i].conn; }
513
if (docs[i].pwr != null) { delete docs[i].pwr; }
514
if (docs[i].agct != null) { delete docs[i].agct; }
@@ -2998,7 +2998,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2998
if (command.desc != null && (command.desc != node.desc)) { change = 1; node.desc = command.desc; changes.push('description'); }
2999
if (command.intelamt != null) {
3000
if ((command.intelamt.user != null) && (command.intelamt.pass != undefined) && ((command.intelamt.user != node.intelamt.user) || (command.intelamt.pass != node.intelamt.pass))) { change = 1; node.intelamt.user = command.intelamt.user; node.intelamt.pass = command.intelamt.pass; changes.push('Intel AMT credentials'); }
3001
- if (command.intelamt.tls && (command.intelamt.tls != node.intelamt.tls)) { change = 1; node.intelamt.tls = command.intelamt.tls; changes.push('Intel AMT TLS'); }
3001
+ if ((command.intelamt.tls != null) && (command.intelamt.tls != node.intelamt.tls)) { change = 1; node.intelamt.tls = command.intelamt.tls; changes.push('Intel AMT TLS'); }
3002
}
3003
if (command.tags) { // Node grouping tag, this is a array of strings that can't be empty and can't contain a comma
3004
var ok = true, group2 = [];
views/default-mobile.handlebars
+2
-2
@@ -2230,9 +2230,9 @@
2230
if (amtuser == '') amtuser = 'admin';
2231
var amtpass = Q('dp10password').value;
2232
if (amtpass == '') amtuser = '';
2233
- meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: Q('dp10tls').value } });
2233
+ meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: parseInt(Q('dp10tls').value) } });
2234
tag.node.intelamt.user = amtuser;
2235
- tag.node.intelamt.tls = Q('dp10tls').value;
2235
+ tag.node.intelamt.tls = parseInt(Q('dp10tls').value);
2236
if (tag.func) { setTimeout(tag.func, 300); }
2237
}
2238
}
views/default.handlebars
+2
-2
@@ -5352,9 +5352,9 @@
5352
if (amtuser == '') amtuser = 'admin';
5353
var amtpass = Q('dp10password').value;
5354
if (amtpass == '') amtuser = '';
5355
- meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: Q('dp10tls').value } });
5355
+ meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: parseInt(Q('dp10tls').value) } });
5356
tag.node.intelamt.user = amtuser;
5357
- tag.node.intelamt.tls = Q('dp10tls').value;
5357
+ tag.node.intelamt.tls = parseInt(Q('dp10tls').value);
5358
if (tag.func) { setTimeout(function () { tag.func(null, tag.arg); }, 300); }
5359
}
5360
}
webserver.js
+6
-4
@@ -2615,7 +2615,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2615
2616
// TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
2617
const TLSSocket = require('tls').TLSSocket;
2618
- const tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
2618
+ const tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
2619
+ if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
2620
const tlsock = new TLSSocket(ser, tlsoptions);
2621
tlsock.on('error', function (err) { parent.debug('webrelay', "CIRA TLS Connection Error ", err); });
2622
tlsock.on('secureConnect', function () { parent.debug('webrelay', "CIRA Secure TLS Connection"); ws._socket.resume(); });
@@ -2796,7 +2797,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2797
ws._socket.resume();
2798
} else {
2799
// If TLS is going to be used, setup a TLS socket
2799
- var tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
2800
+ var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
2801
+ if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
2802
ws.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () {
2803
// The TLS connection method is the same as TCP, but located a bit differently.
2804
parent.debug('webrelay', 'TLS connected to ' + node.host + ':' + port + '.');
@@ -2827,13 +2829,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2829
2830
// If the TCP connection closes, disconnect the associated web socket.
2831
ws.forwardclient.on('close', function () {
2830
- parent.debug('webrelay', 'TCP relay disconnected from ' + node.host + '.');
2832
+ parent.debug('webrelay', 'TCP relay disconnected from ' + node.host + ':' + port + '.');
2833
try { ws.close(); } catch (e) { }
2834
});
2835
2836
// If the TCP connection causes an error, disconnect the associated web socket.
2837
ws.forwardclient.on('error', function (err) {
2836
- parent.debug('webrelay', 'TCP relay error from ' + node.host + ': ' + err.errno);
2838
+ parent.debug('webrelay', 'TCP relay error from ' + node.host + ':' + port + ': ' + err);
2839
try { ws.close(); } catch (e) { }
2840
});
2841