From 05ebe75074942e3191d81823fa3fe38c0a216edb Mon Sep 17 00:00:00 2001 From: Ylian Saint-Hilaire Date: Fri, 23 Oct 2020 13:28:31 -0700 Subject: [PATCH] Improved CIRA setup when MPS is not running. --- amtmanager.js | 33 +++++++++++++++++++++------------ meshuser.js | 2 +- public/images/checkbox60.png | Bin 0 -> 2447 bytes views/default.handlebars | 13 +++++++++---- 4 files changed, 31 insertions(+), 17 deletions(-) create mode 100644 public/images/checkbox60.png diff --git a/amtmanager.js b/amtmanager.js index 228ff49c..cacb596e 100644 --- a/amtmanager.js +++ b/amtmanager.js @@ -302,9 +302,16 @@ module.exports.CreateAmtManager = function (parent) { var amtPolicy = 0, ciraPolicy = 0, badPass = 0, password = null; if (mesh.amt != null) { if (mesh.amt.type) { amtPolicy = mesh.amt.type; } - if (mesh.amt.cirasetup) { ciraPolicy = mesh.amt.cirasetup; } - if (mesh.amt.badpass) { badPass = mesh.amt.badpass; } - if ((typeof mesh.amt.password == 'string') && (mesh.amt.password != '')) { password = mesh.amt.password; } + if (mesh.amt.type == 4) { + // Fully automatic policy + ciraPolicy = 2; // CIRA will be setup + badPass = 1; // Automatically re-active CCM + password = null; // Randomize the password. + } else { + if (mesh.amt.cirasetup) { ciraPolicy = mesh.amt.cirasetup; } + if (mesh.amt.badpass) { badPass = mesh.amt.badpass; } + if ((typeof mesh.amt.password == 'string') && (mesh.amt.password != '')) { password = mesh.amt.password; } + } } if (amtPolicy < 2) { ciraPolicy = 0; } dev.policy = { amtPolicy: amtPolicy, ciraPolicy: ciraPolicy, badPass: badPass, password: password }; @@ -343,7 +350,7 @@ module.exports.CreateAmtManager = function (parent) { // Attempt to perform initial contact with Intel AMT function attemptInitialContact(dev) { delete dev.amtstack; // If there is a WSMAn stack setup, clean it up now. - parent.debug('amt', "Attempt Initial Contact", dev.name, dev.connType); + parent.debug('amt', "Attempt Initial Contact", dev.name, ["CIRA", "CIRA-Relay", "CIRA-LMS", "Local"][dev.connType]); // Check Intel AMT policy when CIRA-LMS connection is in use. if ((dev.connType == 2) && (dev.mpsConnection != null) && (dev.mpsConnection.tag != null) && (dev.mpsConnection.tag.meiState != null)) { @@ -354,7 +361,7 @@ module.exports.CreateAmtManager = function (parent) { return; } // Check if we have an ACM activation policy, but the device is in CCM - if ((dev.policy.amtPolicy == 3) && ((dev.mpsConnection.tag.meiState.Flags & 2) != 0)) { + if (((dev.policy.amtPolicy == 3) || (dev.policy.amtPolicy == 4)) && ((dev.mpsConnection.tag.meiState.Flags & 2) != 0)) { // This device in is CCM, check if we can upgrade to ACM if (activateIntelAmt(dev) == false) return; // If this return true, the platform is in CCM and can't go to ACM, keep going with management. } @@ -562,7 +569,7 @@ module.exports.CreateAmtManager = function (parent) { dev.tlsfail = true; attemptInitialContact(dev); return; } else if (status == 401) { // Authentication error, see if we can use alternative credentials - if ((dev.acctry == null) && (dev.policy.password != null)) { dev.acctry = 'policy'; attemptInitialContact(dev); return; } + if ((dev.acctry == null) && (typeof dev.policy.password == 'string') && (dev.policy.password != '')) { dev.acctry = 'policy'; attemptInitialContact(dev); return; } if ((dev.acctry == null) || (dev.acctry == 'policy') && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; attemptInitialContact(dev); return; } if ((dev.acctry != null) && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > (dev.acctry + 1))) { dev.acctry++; attemptInitialContact(dev); return; } @@ -1070,7 +1077,7 @@ module.exports.CreateAmtManager = function (parent) { // Check if Intel AMT has the server root certificate function attemptRootCertSync(dev, func) { if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request. - if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed + if ((dev.connType != 2) || (dev.policy.ciraPolicy != 2) || (parent.mpsserver.server == null)) { func(dev); return; } // Server root certificate does not need to be present is CIRA is not needed // Find the current TLS certificate & MeshCentral root certificate var xxMeshCentralRoot = null; @@ -1150,7 +1157,7 @@ module.exports.CreateAmtManager = function (parent) { // Fetch the server's CIRA settings dev.cira.mpsPresent = null; dev.cira.mpsPolicy = false; - if (dev.policy.ciraPolicy == 2) { + if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { // parent.mpsserver.server is not null if the MPS server is listening for TCP/TLS connections dev.cira.meshidx = dev.meshid.split('/')[2].replace(/\@/g, 'X').replace(/\$/g, 'X').substring(0, 16); dev.cira.mpsName = parent.webserver.certificates.AmtMpsName; var serverNameSplit = dev.cira.mpsName.split('.'); @@ -1190,7 +1197,8 @@ module.exports.CreateAmtManager = function (parent) { } // If we need to setup CIRA, start by checking the MPS server - if (dev.policy.ciraPolicy == 2) { addMpsServer(dev); } else { checkEnvironmentDetection(dev); } + // parent.mpsserver.server is not null if the MPS server is listening for TCP/TLS connections + if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { addMpsServer(dev); } else { checkEnvironmentDetection(dev); } }); } @@ -1202,6 +1210,7 @@ module.exports.CreateAmtManager = function (parent) { if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request. if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev); return; } dev.cira.mpsPresent = getItem(response.Body.MpServer.ReferenceParameters.SelectorSet.Selector, '@Name', 'Name').Value; + console.log(dev.cira.mpsPresent); dev.consoleMsg("Created new MPS server."); addMpsPolicy(dev); }); @@ -1251,7 +1260,7 @@ module.exports.CreateAmtManager = function (parent) { var currentEnvDetect = dev.cira.xxEnvironementDetection['DetectionStrings']; if (currentEnvDetect == null) { currentEnvDetect = []; } - if (dev.policy.ciraPolicy == 2) { // ciraPolicy: 0 = Do Nothing, 1 = Clear, 2 = Set + if ((dev.policy.ciraPolicy == 2) && (parent.mpsserver.server != null)) { // ciraPolicy: 0 = Do Nothing, 1 = Clear, 2 = Set const newEnvDetect = parent.config.domains[dev.domainid].amtmanager.environmentdetection; if (newEnvDetect == null) { // If no environment detection is specified in the config.json, check that we have a random environment detection @@ -1270,7 +1279,7 @@ module.exports.CreateAmtManager = function (parent) { if (mismatch == true) { editEnvironmentDetectionTmp = newEnvDetect; changes = true; } } - } else if (dev.policy.ciraPolicy == 1) { + } else if ((dev.policy.ciraPolicy == 1) || (parent.mpsserver.server == null)) { // Check environment detection is clear if (currentEnvDetect.length != 0) { editEnvironmentDetectionTmp = []; changes = true; } } @@ -1589,7 +1598,7 @@ module.exports.CreateAmtManager = function (parent) { if ((typeof dev.mpsConnection.tag.meiState.OsAdmin != 'object') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.user != 'string') || (typeof dev.mpsConnection.tag.meiState.OsAdmin.pass != 'string')) { amtPolicy = 0; } if (amtPolicy == 0) { removeAmtDevice(dev); return false; } // Do nothing, we should not have gotten this CIRA-LMS connection. if (amtPolicy == 2) { activateIntelAmtCcm(dev, mesh.amt.password); } // Activate to CCM policy - if (amtPolicy == 3) { // Activate to ACM policy + if ((amtPolicy == 3) || (amtPolicy == 4)) { // Activate to ACM policy var acminfo = checkAcmActivation(dev); if (acminfo == null) { // No opportunity to activate to ACM, check if we are already in CCM diff --git a/meshuser.js b/meshuser.js index 82f3dc41..dfe06a4c 100644 --- a/meshuser.js +++ b/meshuser.js @@ -3301,7 +3301,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use // Change a mesh Intel AMT policy if (common.validateString(command.meshid, 1, 1024) == false) break; // Check the meshid if (common.validateObject(command.amtpolicy) == false) break; // Check the amtpolicy - if (common.validateInt(command.amtpolicy.type, 0, 3) == false) break; // Check the amtpolicy.type + if (common.validateInt(command.amtpolicy.type, 0, 4) == false) break; // Check the amtpolicy.type if (command.amtpolicy.type === 2) { if (common.validateString(command.amtpolicy.password, 0, 32) == false) break; // Check the amtpolicy.password if ((command.amtpolicy.badpass != null) && common.validateInt(command.amtpolicy.badpass, 0, 1) == false) break; // Check the amtpolicy.badpass diff --git a/public/images/checkbox60.png b/public/images/checkbox60.png new file mode 100644 index 0000000000000000000000000000000000000000..4e1d0a5d7f4e4da8ac3569650d31e53e5243c307 GIT binary patch literal 2447 zcmV;A32^p_P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGp`~UzI`~e>~vxNWv2_#8GK~!i%?V1Zv zRM#2D|GO)@AOQ+u1X4>>5UH&}@CBkKLxNV+PBa3=ac>5#-H2`<-*oy?gh`!Y(K?{D<$J^L^*; z+3$D1b0514Mm4HYjcQc4L$?@5@Hj~3S0LsQd$&@kcGt|!!Gbp@ z|96eYNq2UI%hO^h;S*G`6sdB`g-NcWQ%v@in1!IHh}pRA+zOYaj-%{8rQR&1Vyecq zs!l#=RRGUm#(AZ>Om`;m<&%lJ=XEddA;_h9yMCaFs=!V1hSy}&&$Qh*7T z5uGKQ!TjjxXk=$+BQY@%TJ6wY%&j&nUafcs?;1a%`~?hacvt1~)_ELP$a0Wzxte?Z zNKL|S(i}ECJRED+u0>K((vZV49d0YZp1zM^lb@XATa4_>PgZ8~S)UslvzF4)%JvnO zNlmj{v{<-sA;QAKgy*O_QqC4$UJW%fNK;f&@!2ANH(P+4-)oJa<&l}!AE5Wh^dQ81|q2Vp;ZuwB` zF>tM~$-|lUivr3SmifGrlF!GvUr&~UtnxZB&48r_rkN#Rwb;^q>DqRj>ns(?NM<&f zv7v4!-uz}SxfZdvZ~8;ypYh>!dXQ4!#JuwJvTIeDHB)>!vMaBOX$B=Vuv@)<<0uX^ z)ACiWlyVYQSm_>`*HD1pHSF>EoIcxe5wF$kvR6$3ljn8ocN6StEU7v#rWv%n0)NqQ z4lmbkhfR57Rg$6_4EpW*{dlvkf9Q5|C!W2!868G?0+gYYsyfcA@=atR=dr^|zQ$s+ z>CBpqw5mQ5Q}`{nz>UThJW}=>H1;%$WK>DH_30xDRr;-(z1UrUP|V_}&u@N-{q=v5 z_IF!V5fk$AAB%F2=)Oi&^}aTVM-a_ro>x0ZBg3l!Tm;a!Q;%7jLZCfdk(h z5i?2ZpryS2@)kbsGKXT0v3px5;K8p`Z6Rho1p+6xz~9wRz-KcG@w2;Efj+?46X~ZS z%(qxfc)s*?9J~H^X)@B=)djfPQ6=r;JcoSHg-85RaKp++&7wx_{I5G@Kx)7QQldDz14pbV@|K(zKDr=$LS)m=G&zR zF&jiCftA-oI7Xwxy7;G1I6V(zHNmPR<%C(Hs-zXOqOI>1esbp5cbo6yN?c@9! z$=6ynC`ipif+1dH5P12tW*&`Miod1qLrl;(Rg!X|&OVt~u8rN-@mV9?P2_Q9b*O!* z)zInvTJj6XiOmx4IyCb6B$*#I3n%6rK)fN25_AM}0a1+YN39YUzQec_TORiiUYz!< zc(~h|LP``JykXLyfSIBVQ8=<-KjuZHiYk&hSJk60wU5Lv!_$e6iy4PU zg9c_|&_@>)5_Fmb!cD+=^d*}bHU+!Vw_%KSjF@eBjV3d5;>hfRB&=N z*+*q&G$hCM2*SRF?;wg^JKXXcm?=7#mUq?%NDiNB2Xg_pAB>GN*J17iS{1iJ0Rd); z3yne1;)9rc7d<68!>Z2VthfbOH9`Hvir>?-}^bH&~Zfp#; z-@jFic$e91Mt66&@W48)Qa3PC1D|6Xc66^?VZTrLuXVGZ!%wF_j%|zHKwMbA{|3p` z)YOF5R)w*FY{-C*lJT{4>eMN;wD5xaC9Ot__ZIKOqsb48hE??05DxFrx!M%ws;mXQN6crWm z3JW!pJ$3r@X_tR4^G6O8xw*N?)ck{tKJ-drKZyGS?2C*>Bl`OK)E6su5qXTNdrWcz zCl?BWPNL?IWEo`MOA~l8Vz$zLN%koLvsggowrm8gr)C-1N;3Ap9_*Jz78?qg$lA!* zuYv4ejXoyOZ>b#;^}9|9o>iHBg{YkG0T#Q@_7S9Vr5e?!M&+Y`{{!MgBGUF~a+Cl7 N002ovPDHLkV1m)`x!(W) literal 0 HcmV?d00001 diff --git a/views/default.handlebars b/views/default.handlebars index a0f6f1e0..01e63f16 100644 --- a/views/default.handlebars +++ b/views/default.handlebars @@ -9428,6 +9428,8 @@ } else if (currentMesh.amt.type == 3) { intelAmtPolicy = "Simple Admin Control Mode (ACM)"; if (currentMesh.amt.cirasetup == 2) { intelAmtPolicy += " + CIRA"; } + } else if (currentMesh.amt.type == 4) { + intelAmtPolicy = "Fully Automatic"; } } x += addHtmlValue("Intel® AMT", addLinkConditional(intelAmtPolicy, 'p20editMeshAmt()', meshrights & 1)); @@ -9517,7 +9519,7 @@ if (xxdialogMode) return; var x = '', acmoption = ''; if ((features & 0x100000) != 0) { acmoption = ''; } - x += addHtmlValue("Type", ''); + x += addHtmlValue("Type", ''); x += '
'; setDialogMode(2, "Intel® AMT Policy", 3, p20editMeshAmtEx, x); if (currentMesh.amt) { Q('dp20amtpolicy').value = currentMesh.amt.type; } @@ -9535,7 +9537,7 @@ function p20editMeshAmtChange() { var ptype = Q('dp20amtpolicy').value, x = ''; - if (ptype >= 2) { + if ((ptype >= 2) && (ptype < 4)) { x = addHtmlValue("Password*", '') x += addHtmlValue("Password*", '') x += addHtmlValue("Password mismatch", ''); @@ -9550,6 +9552,7 @@ } } } + if (ptype == 4) { x = '
' + "This is the recommanded policy type. Intel® AMT activation and management is completely automated." + '
'; } QH('dp20amtpolicydiv', x); setTimeout(dp20amtValidatePolicy, 1); } @@ -9565,12 +9568,14 @@ function p20editMeshAmtEx() { var ptype = parseInt(Q('dp20amtpolicy').value), amtpolicy = { type: ptype }; - if (ptype == 2) { + if (ptype == 2) { // CCM policy amtpolicy = { type: ptype, password: Q('dp20amtpolicypass').value, badpass: parseInt(Q('dp20amtbadpass').value) }; if ((features & 0x400) == 0) { amtpolicy.cirasetup = parseInt(Q('dp20amtcira').value); } else { amtpolicy.cirasetup = 1; } - } else if (ptype == 3) { + } else if (ptype == 3) { // ACM policy amtpolicy = { type: ptype, password: Q('dp20amtpolicypass').value, badpass: parseInt(Q('dp20amtbadpass').value) }; if ((features & 0x400) == 0) { amtpolicy.cirasetup = parseInt(Q('dp20amtcira').value); } else { amtpolicy.cirasetup = 1; } + } else if (ptype == 4) { // Fully automatic policy + amtpolicy = { type: ptype }; } meshserver.send({ action: 'meshamtpolicy', meshid: currentMesh._id, amtpolicy: amtpolicy }); }