Added automatic switch to AMT TLS when enabling.
Ylian Saint-Hilaire committed
Oct 21, 2020 at 10:43 UTC
dd17e72eadca340fc85fcd9196340c0387bb2fe5
1 file changed
+17
-13
amtmanager.js
+17
-13
@@ -371,17 +371,19 @@ module.exports.CreateAmtManager = function(parent) {
371
// TODO: Enable redirection port and KVM
372
373
// Perform Intel AMT clock sync
374
- attemptSyncClock(dev, function () {
374
+ attemptSyncClock(dev, function (dev) {
375
// Check Intel AMT TLS state
376
- attemptTlsSync(dev, function () {
376
+ attemptTlsSync(dev, function (dev) {
377
+ // If we need to switch to TLS, do it now.
378
+ if (dev.switchToTls == 1) { delete dev.amtstack; delete dev.switchToTls; attemptInitialContact(dev); return; }
379
// Check Intel AMT root certificate state
378
- attemptRootCertSync(dev, function () {
380
+ attemptRootCertSync(dev, function (dev) {
381
// Check Intel AMT CIRA settings
380
- attemptCiraSync(dev, function () {
382
+ attemptCiraSync(dev, function (dev) {
383
// Check Intel AMT settings
382
- attemptSettingsSync(dev, function() {
384
+ attemptSettingsSync(dev, function (dev) {
385
// See if we need to get hardware inventory
384
- attemptFetchHardwareInventory(dev, function () {
386
+ attemptFetchHardwareInventory(dev, function (dev) {
387
dev.consoleMsg('Done.');
388
389
// Remove from task limiter if needed
@@ -644,7 +646,7 @@ module.exports.CreateAmtManager = function(parent) {
646
if (amtPolicy < 2) {
647
// No policy or deactivation, do nothing.
648
dev.consoleMsg("No server policy for Intel AMT");
647
- func();
649
+ func(dev);
650
} else {
651
// Manage in CCM or ACM
652
dev.taskCount = 1;
@@ -794,7 +796,9 @@ module.exports.CreateAmtManager = function(parent) {
796
delete dev.aquired.xhash;
797
UpdateDevice(dev);
798
797
- // TODO: Switch our communications to TLS (Restart our management of this node)
799
+ // Switch our communications to TLS (Restart our management of this node)
800
+ dev.switchToTls = 1;
801
+ delete dev.tlsfail;
802
devTaskCompleted(dev);
803
});
804
}
@@ -808,7 +812,7 @@ module.exports.CreateAmtManager = function(parent) {
812
// Check if Intel AMT has the server root certificate
813
function attemptRootCertSync(dev, func) {
814
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
811
- if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(); return; } // Server root certificate does not need to be present is CIRA is not needed
815
+ if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed
816
817
// Find the current TLS certificate & MeshCentral root certificate
818
var xxMeshCentralRoot = null;
@@ -827,7 +831,7 @@ module.exports.CreateAmtManager = function(parent) {
831
dev.consoleMsg("Added server root certificate.");
832
devTaskCompleted(dev);
833
});
830
- } else { func(); }
834
+ } else { func(dev); }
835
}
836
837
@@ -838,7 +842,7 @@ module.exports.CreateAmtManager = function(parent) {
842
// Check if Intel AMT has the server root certificate
843
function attemptCiraSync(dev, func) {
844
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
841
- if ((dev.connType != 2) || ((dev.policy.ciraPolicy != 1) && (dev.policy.ciraPolicy != 2))) { func(); return; } // Only setup CIRA when LMS connection is used and a CIRA policy is enabled.
845
+ if ((dev.connType != 2) || ((dev.policy.ciraPolicy != 1) && (dev.policy.ciraPolicy != 2))) { func(dev); return; } // Only setup CIRA when LMS connection is used and a CIRA policy is enabled.
846
847
// Get current CIRA settings
848
// TODO: We only deal with remote access starting with Intel AMT 6 and beyond
@@ -1122,7 +1126,7 @@ module.exports.CreateAmtManager = function(parent) {
1126
dev.amtstack.BatchEnum('', ['*CIM_ComputerSystemPackage', 'CIM_SystemPackaging', '*CIM_Chassis', 'CIM_Chip', '*CIM_Card', '*CIM_BIOSElement', 'CIM_Processor', 'CIM_PhysicalMemory', 'CIM_MediaAccessDevice', 'CIM_PhysicalPackage'], attemptFetchHardwareInventoryResponse);
1127
dev.amtstack.BatchEnum('', ['AMT_EthernetPortSettings'], attemptFetchNetworkResponse);
1128
} else {
1125
- if (func) { func(); }
1129
+ if (func) { func(dev); }
1130
}
1131
}
1132
@@ -1361,7 +1365,7 @@ module.exports.CreateAmtManager = function(parent) {
1365
// Called this when a task is completed, when all tasks are completed the call back function will be called.
1366
function devTaskCompleted(dev) {
1367
dev.taskCount--;
1364
- if (dev.taskCount == 0) { var f = dev.taskCompleted; delete dev.taskCount; delete dev.taskCompleted; if (f != null) { f(); } }
1368
+ if (dev.taskCount == 0) { var f = dev.taskCompleted; delete dev.taskCount; delete dev.taskCompleted; if (f != null) { f(dev); } }
1369
}
1370
1371
function guidToStr(g) { return g.substring(6, 8) + g.substring(4, 6) + g.substring(2, 4) + g.substring(0, 2) + '-' + g.substring(10, 12) + g.substring(8, 10) + '-' + g.substring(14, 16) + g.substring(12, 14) + '-' + g.substring(16, 20) + '-' + g.substring(20); }