More work on Intel AMT One Click Recovery.
Ylian Saint-Hilaire committed
Mar 22, 2021 at 23:36 UTC
a3f9ffc68b1559982762dfb5cdc6aba11cfa6e98
4 files changed
+55
-24
amtmanager.js
+42
-11
@@ -295,9 +295,9 @@ module.exports.CreateAmtManager = function (parent) {
295
if (Array.isArray(event.nodeids)) { for (var i in event.nodeids) { performPowerAction(event.nodeids[i], 2); } }
296
break;
297
}
298
- case 'clickoncerecovery': { // React to Intel AMT Click Once Recovery command
298
+ case 'oneclickrecovery': { // React to Intel AMT One Click Recovery command
299
if (event.noact == 1) return; // Take no action on these events. We are likely in peering mode and need to only act when the database signals the change in state.
300
- if (Array.isArray(event.nodeids)) { for (var i in event.nodeids) { performClickOnceRecoveryAction(event.nodeids[i], event.file); } }
300
+ if (Array.isArray(event.nodeids)) { for (var i in event.nodeids) { performOneClickRecoveryAction(event.nodeids[i], event.file); } }
301
break;
302
}
303
case 'changenode': { // React to changes in a device
@@ -810,23 +810,53 @@ module.exports.CreateAmtManager = function (parent) {
810
}
811
812
813
- // Perform Intel AMT Click Once Recovery on a device
814
- function performClickOnceRecoveryAction(nodeid, file) {
813
+ //
814
+ // Intel AMT One Click Recovery
815
+ //
816
+
817
+ // Perform Intel AMT One Click Recovery on a device
818
+ function performOneClickRecoveryAction(nodeid, file) {
819
var devices = obj.amtDevices[nodeid];
820
if (devices == null) return;
821
for (var i in devices) {
822
var dev = devices[i];
823
// If not LMS, has a AMT stack present and is in connected state, perform operation.
824
if ((dev.connType != 2) && (dev.state == 1) && (dev.amtstack != null)) {
821
- console.log('Perform Click Once Recovery', nodeid, file);
822
-
823
- // TODO: Make sure the MPS server root certificate is present.
824
- // TODO: Generate the one-time URL.
825
- // TODO: Issue the WSMAN command.
825
+ // Make sure the MPS server root certificate is present.
826
+ // Start by looking at existing certificates.
827
+ dev.ocrfile = file;
828
+ dev.amtstack.BatchEnum(null, ['AMT_PublicKeyCertificate'], performOneClickRecoveryActionEx);
829
}
830
}
831
}
832
833
+ // Response with list of certificates in Intel AMT
834
+ function performOneClickRecoveryActionEx(stack, name, responses, status) {
835
+ const dev = stack.dev;
836
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
837
+ if (status != 200) { dev.consoleMsg("Failed to get security information (" + status + ")."); removeAmtDevice(dev, 19); return; }
838
+
839
+ // Organize the certificates
840
+ var xxCertificates = responses['AMT_PublicKeyCertificate'].responses;
841
+ for (var i in xxCertificates) {
842
+ xxCertificates[i].TrustedRootCertficate = (xxCertificates[i]['TrustedRootCertficate'] == true);
843
+ xxCertificates[i].X509CertificateBin = Buffer.from(xxCertificates[i]['X509Certificate'], 'base64').toString('binary');
844
+ xxCertificates[i].XIssuer = parseCertName(xxCertificates[i]['Issuer']);
845
+ xxCertificates[i].XSubject = parseCertName(xxCertificates[i]['Subject']);
846
+ }
847
+ dev.policy.certificates = xxCertificates;
848
+ attemptRootCertSync(dev, performOneClickRecoveryActionEx2, true);
849
+ }
850
+
851
+ function performOneClickRecoveryActionEx2(dev) {
852
+ // Generate the one-time URL.
853
+ var cookie = obj.parent.encodeCookie({ a: 'ocr', f: dev.ocrfile }, obj.parent.loginCookieEncryptionKey)
854
+ var url = 'https://' + parent.webserver.certificates.AmtMpsName + ':' + ((parent.args.mpsaliasport != null) ? parent.args.mpsaliasport : parent.args.mpsport) + '/ocr/' + cookie + '.iso';
855
+
856
+ // TODO: Issue the WSMAN command.
857
+ console.log('Perform One Click Recovery', url);
858
+ }
859
+
860
//
861
// Intel AMT Clock Syncronization
862
//
@@ -1188,10 +1218,11 @@ module.exports.CreateAmtManager = function (parent) {
1218
//
1219
1220
// Check if Intel AMT has the server root certificate
1191
- function attemptRootCertSync(dev, func) {
1221
+ function attemptRootCertSync(dev, func, forced) {
1222
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1223
if (dev.policy.amtPolicy == 0) { func(dev); return; } // If there is no Intel AMT policy, skip this operation.
1194
- if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2) || (parent.mpsserver.server == null)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed
1224
+ if (forced !== true) { if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(dev); return; } } // Server root certificate does not need to be present if CIRA is not needed and "forced" is false
1225
+ if (parent.mpsserver.server == null) { func(dev); return; } // Root cert not needed if MPS is not active.
1226
1227
// Find the current TLS certificate & MeshCentral root certificate
1228
var xxMeshCentralRoot = null;
meshuser.js
+3
-3
@@ -5492,7 +5492,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5492
}
5493
break;
5494
}
5495
- case 'clickoncerecovery': { // Intel(R) AMT Click once recovery
5495
+ case 'oneclickrecovery': { // Intel(R) AMT One Click Recovery (OCR)
5496
if (common.validateStrArray(command.nodeids, 1) == false) break; // Check nodeids
5497
if (common.validateString(command.path, 1, 2048) == false) break; // Check file path
5498
if (command.type != 'diskimage') break; // Make sure type is correct
@@ -5510,8 +5510,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5510
// Check if we found this device and if we have full rights
5511
if ((node == null) || (rights != 0xFFFFFFFF)) return;
5512
5513
- // Event Intel AMT Click Once Recovery, this will cause Intel AMT wake operations on this and other servers.
5514
- parent.parent.DispatchEvent('*', obj, { action: 'clickoncerecovery', userid: user._id, username: user.name, nodeids: [node._id], domain: domain.id, nolog: 1, file: file.fullpath });
5513
+ // Event Intel AMT One Click Recovery, this will cause Intel AMT wake operations on this and other servers.
5514
+ parent.parent.DispatchEvent('*', obj, { action: 'oneclickrecovery', userid: user._id, username: user.name, nodeids: [node._id], domain: domain.id, nolog: 1, file: file.fullpath });
5515
});
5516
}
5517
views/default.handlebars
+6
-6
@@ -6613,7 +6613,7 @@
6613
if (((currentNode.conn & 1) != 0) && ((rights & 131072) != 0)) { count++; y += '<option value=106>' + "Run Commands" + '</option>'; } // Remote command permission
6614
if ((currentNode.conn != 0) && ((rights & 262144) != 0)) { count++; y += '<option value=4>' + "Sleep" + '</option><option value=3>' + "Reset" + '</option><option value=2>' + "Power off" + '</option>'; }
6615
if ((currentNode.conn & 16) != 0) { count++; y += '<option value=103>' + "Send MQTT Message" + '</option>'; }
6616
- if ((getNodeAmtVersion(currentNode) >= 15) && (currentNode.intelamt.state == 2) && ((currentNode.conn & 6) != 0) && (rights == 0xFFFFFFFF) && ((features & 0x00000400) == 0)) { count++; y += '<option value=107>' + "Intel® AMT Click Once Recovery" + '</option>'; } // CIRA (2) or AMT (4) connected
6616
+ if ((getNodeAmtVersion(currentNode) >= 15) && (currentNode.intelamt.state == 2) && ((currentNode.conn & 6) != 0) && (rights == 0xFFFFFFFF) && ((features & 0x00000400) == 0)) { count++; y += '<option value=107>' + "Intel® AMT One Click Recovery" + '</option>'; } // CIRA (2) or AMT (4) connected
6617
if (((currentNode.conn & 1) != 0) && ((rights & 32768) != 0)) { count++; y += '<option value=104>' + "Uninstall Agent" + '</option>'; }
6618
y += '</select>';
6619
x += addHtmlValue("Operation", y);
@@ -6651,12 +6651,12 @@
6651
//QE('idx_dlgOkButton', true);
6652
}
6653
} else if (op == 107) {
6654
- // Intel AMT Click Once Recovery (OCR)
6655
- Q('d3localmodeform').action = 'clickoncerecovery.ashx';
6654
+ // Intel AMT One Click Recovery (OCR)
6655
+ Q('d3localmodeform').action = 'oneclickrecovery.ashx';
6656
Q('d3auth').value = authCookie;
6657
Q('d3filter').value = '.iso';
6658
Q('d3attrib').value = currentNode._id;
6659
- setDialogMode(3, "Intel® AMT Click Once Recovery", 3, deviceActionClickOnceRecovery);
6659
+ setDialogMode(3, "Intel® AMT One Click Recovery", 3, deviceActionOneClickRecovery);
6660
d3init();
6661
} else {
6662
// Power operation
@@ -6664,7 +6664,7 @@
6664
}
6665
}
6666
6667
- function deviceActionClickOnceRecovery() {
6667
+ function deviceActionOneClickRecovery() {
6668
var mode = Q('d3uploadMode').value;
6669
if (mode == 1) {
6670
// Boot using local disk image file
@@ -6672,7 +6672,7 @@
6672
} else {
6673
// Boot using server image file
6674
var files = d3getFileSel();
6675
- if (files.length == 1) { meshserver.send({ action: 'clickoncerecovery', nodeids: [ Q('d3attrib').value ], type: 'diskimage', path: d3filetreelocation.join('/') + '/' + files[0] }); }
6675
+ if (files.length == 1) { meshserver.send({ action: 'oneclickrecovery', nodeids: [ Q('d3attrib').value ], type: 'diskimage', path: d3filetreelocation.join('/') + '/' + files[0] }); }
6676
}
6677
}
6678
webserver.js
+4
-4
@@ -3408,7 +3408,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3408
}
3409
3410
// Upload a MeshCore.js file to the server
3411
- function handleClickOnceRecoveryFile(req, res) {
3411
+ function handleOneClickRecoveryFile(req, res) {
3412
const domain = checkUserIpAddress(req, res);
3413
if (domain == null) { return; }
3414
if (domain.id !== '') { res.sendStatus(401); return; }
@@ -3439,8 +3439,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3439
for (var i in files.files) {
3440
var file = files.files[i];
3441
3442
- // Event Intel AMT Click Once Recovery, this will cause Intel AMT wake operations on this and other servers.
3443
- parent.DispatchEvent('*', obj, { action: 'clickoncerecovery', userid: user._id, username: user.name, nodeids: [node._id], domain: domain.id, nolog: 1, file: file.path });
3442
+ // Event Intel AMT One Click Recovery, this will cause Intel AMT wake operations on this and other servers.
3443
+ parent.DispatchEvent('*', obj, { action: 'oneclickrecovery', userid: user._id, username: user.name, nodeids: [node._id], domain: domain.id, nolog: 1, file: file.path });
3444
3445
try { obj.fs.unlinkSync(file.path); } catch (e) { } // TODO: Remove this file after 30 minutes.
3446
}
@@ -5250,7 +5250,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5250
obj.app.post(url + 'uploadfile.ashx', handleUploadFile);
5251
obj.app.post(url + 'uploadfilebatch.ashx', handleUploadFileBatch);
5252
obj.app.post(url + 'uploadmeshcorefile.ashx', handleUploadMeshCoreFile);
5253
- obj.app.post(url + 'clickoncerecovery.ashx', handleClickOnceRecoveryFile);
5253
+ obj.app.post(url + 'oneclickrecovery.ashx', handleOneClickRecoveryFile);
5254
obj.app.get(url + 'userfiles/*', handleDownloadUserFiles);
5255
obj.app.ws(url + 'echo.ashx', handleEchoWebSocket);
5256
obj.app.ws(url + 'apf.ashx', function (ws, req) { obj.parent.mpsserver.onWebSocketConnection(ws, req); })