Minor code signing improvements and clean up.
Ylian Saint-Hilaire committed
Jun 18, 2022 at 21:47 UTC
fa13239d468ad081461cc978a0e3206e68e9b55c
3 files changed
+20
-20
authenticode.js
+1
-1
@@ -1240,7 +1240,7 @@ function createAuthenticodeHandler(path) {
1240
if ((typeof args.desc == 'string') || (typeof args.url == 'string')) {
1241
var codeSigningAttributes = { 'tagClass': 0, 'type': 16, 'constructed': true, 'composed': true, 'value': [] };
1242
if (args.desc != null) { // Encode description as big-endian unicode.
1243
- var desc = "", ucs = Buffer.from(args.desc, 'ucs2').toString()
1243
+ var desc = '', ucs = Buffer.from(args.desc, 'ucs2').toString()
1244
for (var k = 0; k < ucs.length; k += 2) { desc += String.fromCharCode(ucs.charCodeAt(k + 1), ucs.charCodeAt(k)); }
1245
codeSigningAttributes.value.push({ 'tagClass': 128, 'type': 0, 'constructed': true, 'composed': true, 'value': [{ 'tagClass': 128, 'type': 0, 'constructed': false, 'composed': false, 'value': desc }] });
1246
}
meshcentral.js
+16
-17
@@ -2867,22 +2867,19 @@ function CreateMeshCentralServer(config, args) {
2867
if (domain.id == '') { objx = obj; } else { suffix = '-' + domain.id; objx.meshAgentBinaries = {}; }
2868
2869
// Generate the agent signature description and URL
2870
- var serverSignedAgentsPath, signDesc, signUrl;
2871
- if (agentSignCertInfo != null) {
2872
- serverSignedAgentsPath = obj.path.join(obj.datapath, 'signedagents' + suffix);
2873
- signDesc = (domain.title ? domain.title : agentSignCertInfo.cert.subject.hash);
2874
- var httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified
2875
- var httpsHost = ((domain.dns != null) ? domain.dns : obj.certificates.CommonName);
2876
- if (obj.args.agentaliasdns != null) { httpsHost = obj.args.agentaliasdns; }
2877
- signUrl = 'https://' + httpsHost;
2878
- if (httpsPort != 443) { signUrl += ':' + httpsPort; }
2879
- var xdomain = (domain.dns == null) ? domain.id : '';
2880
- if (xdomain != '') xdomain += '/';
2881
- signUrl += '/' + xdomain;
2882
-
2883
- // If requested, lock the agent to this server
2884
- if (obj.config.settings.agentsignlock) { signUrl += '?ServerID=' + obj.certificateOperations.getPublicKeyHash(obj.certificates.agent.cert).toUpperCase(); }
2885
- }
2870
+ const serverSignedAgentsPath = obj.path.join(obj.datapath, 'signedagents' + suffix);
2871
+ const signDesc = (domain.title ? domain.title : agentSignCertInfo.cert.subject.hash);
2872
+ const httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified
2873
+ var httpsHost = ((domain.dns != null) ? domain.dns : obj.certificates.CommonName);
2874
+ if (obj.args.agentaliasdns != null) { httpsHost = obj.args.agentaliasdns; }
2875
+ var signUrl = 'https://' + httpsHost;
2876
+ if (httpsPort != 443) { signUrl += ':' + httpsPort; }
2877
+ var xdomain = (domain.dns == null) ? domain.id : '';
2878
+ if (xdomain != '') xdomain += '/';
2879
+ signUrl += '/' + xdomain;
2880
+
2881
+ // If requested, lock the agent to this server
2882
+ if (obj.config.settings.agentsignlock) { signUrl += '?ServerID=' + obj.certificateOperations.getPublicKeyHash(obj.certificates.agent.cert).toUpperCase(); }
2883
2884
// Setup the time server
2885
var timeStampUrl = 'http://timestamp.comodoca.com/authenticode';
@@ -2930,7 +2927,8 @@ function CreateMeshCentralServer(config, args) {
2927
// Agent was signed succesfuly
2928
console.log(obj.common.format('Code signed agent {0}.', agentSignedFunc.objx.meshAgentsArchitectureNumbers[agentSignedFunc.archid].localname));
2929
} else {
2933
- console.log(obj.common.format('Failed to sign agent {0}: ' + err, agentSignedFunc.objx.meshAgentsArchitectureNumbers[agentSignedFunc.archid].localname));
2930
+ // Failed to sign agent
2931
+ addServerWarning('Failed to sign agent \"' + agentSignedFunc.objx.meshAgentsArchitectureNumbers[agentSignedFunc.archid].localname + '\": ' + err, 22, [ agentSignedFunc.objx.meshAgentsArchitectureNumbers[agentSignedFunc.archid].localname, err ]);
2932
}
2933
if (--pendingOperations === 0) { agentSignedFunc.func(); }
2934
}
@@ -2939,6 +2937,7 @@ function CreateMeshCentralServer(config, args) {
2937
xagentSignedFunc.objx = objx;
2938
xagentSignedFunc.archid = archid;
2939
xagentSignedFunc.signeedagentpath = signeedagentpath;
2940
+ obj.debug('main', "Code signing agent with arguments: " + JSON.stringify({ out: signeedagentpath, desc: signDesc, url: signUrl, time: timeStampUrl }));
2941
originalAgent.sign(agentSignCertInfo, { out: signeedagentpath, desc: signDesc, url: signUrl, time: timeStampUrl }, xagentSignedFunc);
2942
} else {
2943
// Signed agent is already ok, use it.
views/default.handlebars
+3
-2
@@ -2316,7 +2316,8 @@
2316
18: "SMTP server has limited use in LAN mode.",
2317
19: "SMS gateway has limited use in LAN mode.",
2318
20: "Invalid \"LoginCookieEncryptionKey\" in config.json.",
2319
- 21: "Backup path can't be set within meshcentral-data folder, backup settings ignored."
2319
+ 21: "Backup path can't be set within meshcentral-data folder, backup settings ignored.",
2320
+ 22: "Failed to sign agent {0}: {1}"
2321
};
2322
var x = '';
2323
for (var i in message.warnings) {
@@ -2325,7 +2326,7 @@
2326
x += '<div style=color:red;padding-bottom:6px><b>' + "WARNING: " + y + '</b></div>';
2327
} else {
2328
var z = ServerWarnings[y.id];
2328
- if (z == null) { z = y.msg; } else { z = format(z, y.args); }
2329
+ if (z == null) { z = y.msg; } else { z = format(z, ...y.args); }
2330
x += '<div style=color:red;padding-bottom:6px><b>' + "WARNING: " + z + '</b></div>';
2331
}
2332
}