More work on Intel AMT ACM activation.
Ylian Saint-Hilaire committed
Jun 13, 2019 at 16:39 UTC
9c2da0696f137c77e9e5c324ea128e6d773d6d0f
7 files changed
+52
-10
MeshCentralServer.njsproj
+2
@@ -24,8 +24,10 @@
24
<Compile Include="agents\meshcmd.min.js" />
25
<Compile Include="agents\meshcore.js" />
26
<Compile Include="agents\meshcore.min.js" />
27
+ <Compile Include="agents\modules_meshcmd\amt-ider.js" />
28
<Compile Include="agents\modules_meshcmd\amt-lme.js" />
29
<Compile Include="agents\modules_meshcmd\amt-mei.js" />
30
+ <Compile Include="agents\modules_meshcmd\amt-redir-duk.js" />
31
<Compile Include="agents\modules_meshcmd\amt-scanner.js" />
32
<Compile Include="agents\modules_meshcmd\amt-script.js" />
33
<Compile Include="agents\modules_meshcmd\amt-wsman-duk.js" />
agents/meshcore.js
+19
-5
@@ -1832,11 +1832,25 @@ function createMeshCore(agent) {
1832
try {
1833
if (meinfo == null) return;
1834
var intelamt = {}, p = false;
1835
- if (meinfo.Versions && meinfo.Versions.AMT) { intelamt.ver = meinfo.Versions.AMT; p = true; }
1836
- if (meinfo.ProvisioningState) { intelamt.state = meinfo.ProvisioningState; p = true; }
1837
- if (meinfo.Flags) { intelamt.flags = meinfo.Flags; p = true; }
1838
- if (meinfo.OsHostname) { intelamt.host = meinfo.OsHostname; p = true; }
1839
- if (meinfo.UUID) { intelamt.uuid = meinfo.UUID; p = true; }
1835
+ if ((meinfo.Versions != null) && (meinfo.Versions.AMT != null)) { intelamt.ver = meinfo.Versions.AMT; p = true; }
1836
+ if (meinfo.ProvisioningState != null) { intelamt.state = meinfo.ProvisioningState; p = true; }
1837
+ if (meinfo.Flags != null) { intelamt.flags = meinfo.Flags; p = true; }
1838
+ if (meinfo.OsHostname != null) { intelamt.host = meinfo.OsHostname; p = true; }
1839
+ if (meinfo.UUID != null) { intelamt.uuid = meinfo.UUID; p = true; }
1840
+ if ((meinfo.ProvisioningState == 0) && (meinfo.net0 != null) && (meinfo.net0.enabled == 1)) { // If not activated, look to see if we have wired net working.
1841
+ // Not activated and we have wired ethernet, look for the trusted DNS
1842
+ var dns = meinfo.dns;
1843
+ if (dns == null) {
1844
+ // Trusted DNS not set, let's look for the OS network DNS suffix
1845
+ var interfaces = require('os').networkInterfaces();
1846
+ for (var i in interfaces) {
1847
+ for (var j in interfaces[i]) {
1848
+ if ((interfaces[i][j].mac == mestate.net0.mac) && (interfaces[i][j].fqdn != null) && (interfaces[i][j].fqdn != '')) { dns = interfaces[i][j].fqdn; }
1849
+ }
1850
+ }
1851
+ }
1852
+ if (intelamt.dns != dns) { intelamt.dns = dns; p = true; }
1853
+ } else { if (intelamt.dns != null) { delete intelamt.dns; p = true; } }
1854
if (p == true) {
1855
var meInfoStr = JSON.stringify(intelamt);
1856
if (meInfoStr != lastMeInfo) {
agents/modules_meshcore/amt-manage.js
+9
@@ -516,6 +516,15 @@ function AmtManager(agent, db, isdebug) {
516
var wsmanQuery = ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService', '*AMT_RedirectionService', '*CIM_KVMRedirectionSAP', 'AMT_PublicKeyCertificate', '*AMT_EnvironmentDetectionSettingData'];
517
if (amtpolicy.cirasetup == 2) { wsmanQuery.push("AMT_ManagementPresenceRemoteSAP", "AMT_RemoteAccessCredentialContext", "AMT_RemoteAccessPolicyAppliesToMPS", "AMT_RemoteAccessPolicyRule", "*AMT_UserInitiatedConnectionService", "AMT_MPSUsernamePassword"); }
518
try { amtstack.BatchEnum(null, wsmanQuery, wsmanPassTestResponse); } catch (ex) { debug(ex); }
519
+ } else if ((amtpolicy.type == 3) && (meinfo.ProvisioningState == 0)) {
520
+ // ACM Activation Policy
521
+ // TODO: Check that we have wired ethernet enabled and that the DNS domain suffix matches a server certificate...
522
+
523
+ // TODO: Check that a trusted hash matches the server cert root hash...
524
+
525
+ // TODO: Fetch Intel AMT Realm and Nonce and get ready to ACM activation...
526
+
527
+ //console.log(meinfo);
528
} else {
529
// Other possible cases...
530
}
meshcentral.js
+3
-1
@@ -1018,7 +1018,9 @@ function CreateMeshCentralServer(config, args) {
1018
for (var i in obj.eventsDispatch[id]) {
1019
if (targets.indexOf(obj.eventsDispatch[id][i]) == -1) { // Check if we already displatched to this target
1020
targets.push(obj.eventsDispatch[id][i]);
1021
- obj.eventsDispatch[id][i].HandleEvent(source, event);
1021
+ try { obj.eventsDispatch[id][i].HandleEvent(source, event); } catch (ex) {
1022
+ console.log(ex, obj.eventsDispatch[id][i]);
1023
+ }
1024
}
1025
}
1026
}
meshmail.js
+2
@@ -14,6 +14,8 @@
14
/*jshint esversion: 6 */
15
"use strict";
16
17
+// TODO: Add NTML support with "nodemailer-ntlm-auth" https://github.com/nodemailer/nodemailer-ntlm-auth
18
+
19
// Construct a MeshAgent object, called upon connection
20
module.exports.CreateMeshMail = function (parent) {
21
var obj = {};
meshuser.js
+16
-4
@@ -1395,20 +1395,33 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1395
// We only create Agent-less Intel AMT mesh (Type1), or Agent mesh (Type2)
1396
if ((command.meshtype == 1) || (command.meshtype == 2)) {
1397
parent.crypto.randomBytes(48, function (err, buf) {
1398
+ // Create new device group identifier
1399
meshid = 'mesh/' + domain.id + '/' + buf.toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
1400
+
1401
+ // Create the new device group
1402
var links = {};
1403
links[user._id] = { name: user.name, rights: 0xFFFFFFFF };
1404
mesh = { type: 'mesh', _id: meshid, name: command.meshname, mtype: command.meshtype, desc: command.desc, domain: domain.id, links: links };
1405
db.Set(common.escapeLinksFieldName(mesh));
1406
parent.meshes[meshid] = mesh;
1407
parent.parent.AddEventDispatch([meshid], ws);
1408
+
1409
+ // Change the user to make him administration of the new device group
1410
if (user.links == null) user.links = {};
1411
user.links[meshid] = { rights: 0xFFFFFFFF };
1412
user.subscriptions = parent.subscribe(user._id, ws);
1413
db.SetUser(user);
1414
+
1415
+ // Event the user change
1416
+ var targets = ['*', 'server-users', user._id];
1417
+ if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
1418
+ var event = { etype: 'user', username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', domain: domain.id, nolog: 1 };
1419
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
1420
+ parent.parent.DispatchEvent(targets, obj, event);
1421
+
1422
+ // Event the device group creation
1423
var event = { etype: 'mesh', username: user.name, meshid: meshid, name: command.meshname, mtype: command.meshtype, desc: command.desc, action: 'createmesh', links: links, msg: 'Mesh created: ' + command.meshname, domain: domain.id };
1410
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to create the mesh. Another event will come.
1411
- parent.parent.DispatchEvent(['*', meshid, user._id], obj, event);
1424
+ parent.parent.DispatchEvent(['*', meshid, user._id], obj, event); // Even if DB change stream is active, this event must be acted upon.
1425
});
1426
}
1427
break;
@@ -1427,8 +1440,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1440
1441
// Fire the removal event first, because after this, the event will not route
1442
var event = { etype: 'mesh', username: user.name, meshid: command.meshid, name: command.meshname, action: 'deletemesh', msg: 'Mesh deleted: ' + command.meshname, domain: domain.id };
1430
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to remove the mesh. Another event will come.
1431
- parent.parent.DispatchEvent(['*', command.meshid], obj, event);
1443
+ parent.parent.DispatchEvent(['*', command.meshid], obj, event); // Even if DB change stream is active, this event need to be acted on.
1444
1445
// Remove all user links to this mesh
1446
for (i in meshes) {
views/default.handlebars
+1
@@ -1302,6 +1302,7 @@
1302
}
1303
1304
function onMessage(server, message) {
1305
+ if (args.trace == 1) { console.log('MSG:', message); }
1306
switch (message.action) {
1307
case 'serverstats': {
1308
updateGeneralServerStats(message);