From 90d5a3cd6f43e8dff10410d02caa92326a12a934 Mon Sep 17 00:00:00 2001 From: Ylian Saint-Hilaire Date: Mon, 30 Mar 2020 19:29:46 -0700 Subject: [PATCH] Fixed Intel AMT TLS. --- agents/meshcmd.js | 3 ++- amt/amt-redir-mesh.js | 6 ++++-- amt/amt-wsman-comm.js | 3 ++- amtscanner.js | 4 +++- meshuser.js | 4 ++-- views/default-mobile.handlebars | 4 ++-- views/default.handlebars | 4 ++-- webserver.js | 10 ++++++---- 8 files changed, 23 insertions(+), 15 deletions(-) diff --git a/agents/meshcmd.js b/agents/meshcmd.js index 8474700c..753fcdea 100644 --- a/agents/meshcmd.js +++ b/agents/meshcmd.js @@ -1022,7 +1022,8 @@ function startMeshCommander() { } else { // If TLS is going to be used, setup a TLS socket var tls = require('tls'); - var tlsoptions = { host: webargs.host, port: webargs.port, secureProtocol: ((webargs.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), rejectUnauthorized: false }; + var tlsoptions = { host: webargs.host, port: webargs.port, rejectUnauthorized: false }; + if (webargs.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; } ws.forwardclient = tls.connect(tlsoptions, function () { debug(1, 'Connected TLS to ' + webargs.host + ':' + webargs.port + '.'); this.pipe(this.ws, { end: false }); this.ws.pipe(this, { end: false }); }); ws.forwardclient.on('error', function () { debug(1, 'TLS connection error to ' + webargs.host + ':' + webargs.port + '.'); try { this.ws.end(); } catch (e) { } }); ws.forwardclient.ws = ws; diff --git a/amt/amt-redir-mesh.js b/amt/amt-redir-mesh.js index 6e84cb28..a4a6206a 100644 --- a/amt/amt-redir-mesh.js +++ b/amt/amt-redir-mesh.js @@ -150,7 +150,8 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me // TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF const TLSSocket = require('tls').TLSSocket; - const tlsoptions = { secureProtocol: ((obj.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + const tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; } const tlsock = new TLSSocket(ser, tlsoptions); tlsock.on('error', function (err) { Debug(1, "CIRA TLS Connection Error ", err); }); tlsock.on('secureConnect', function () { Debug(2, "CIRA Secure TLS Connection"); ws._socket.resume(); }); @@ -207,7 +208,8 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me obj.forwardclient.setEncoding('binary'); } else { // If TLS is going to be used, setup a TLS socket - var tlsoptions = { secureProtocol: ((obj.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; } obj.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () { // The TLS connection method is the same as TCP, but located a bit differently. Debug(2, 'TLS Intel AMT transport connected to ' + node.host + ':' + port + '.'); diff --git a/amt/amt-wsman-comm.js b/amt/amt-wsman-comm.js index 9c804e5f..a8bbbc81 100644 --- a/amt/amt-wsman-comm.js +++ b/amt/amt-wsman-comm.js @@ -179,7 +179,8 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, parent, obj.socket.connect(obj.port, obj.host, obj.xxOnSocketConnected); } else { // Connect with TLS - var options = { secureProtocol: ((obj.xtlsMethod == 0) ? 'SSLv23_method' : 'TLSv1_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + var options = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + if (obj.xtlsMethod != 0) { options.secureProtocol = 'TLSv1_method'; } if (obj.xtlsoptions) { if (obj.xtlsoptions.ca) options.ca = obj.xtlsoptions.ca; if (obj.xtlsoptions.cert) options.cert = obj.xtlsoptions.cert; diff --git a/amtscanner.js b/amtscanner.js index 042a9bd0..0da5f5f7 100644 --- a/amtscanner.js +++ b/amtscanner.js @@ -371,7 +371,9 @@ module.exports.CreateAmtScanner = function (parent) { } else { // Connect using TLS, we will switch from default TLS to TLS1-only and back if we get a connection error to support older Intel AMT. if (scaninfo.tlsoption == null) { scaninfo.tlsoption = 0; } - client = obj.tls.connect(port, host, scaninfo.tlsoption == 1 ? { secureProtocol: 'TLSv1_method', rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE } : { rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE }, function () { this.write('GET / HTTP/1.1\r\nhost: ' + host + '\r\n\r\n'); }); + const tlsOptions = { rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE }; + if (scaninfo.tlsoption == 1) { tlsOptions.secureProtocol = 'TLSv1_method'; } + client = obj.tls.connect(port, host, tlsOptions, function () { this.write('GET / HTTP/1.1\r\nhost: ' + host + '\r\n\r\n'); }); } client.scaninfo = scaninfo; client.func = func; diff --git a/meshuser.js b/meshuser.js index 569bb5f6..1aa6122f 100644 --- a/meshuser.js +++ b/meshuser.js @@ -508,7 +508,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use parent.cleanDevice(docs[i]); // Remove any connectivity and power state information, that should not be in the database anyway. - // TODO: Find why these are sometimes saves in the db. + // TODO: Find why these are sometimes saved in the db. if (docs[i].conn != null) { delete docs[i].conn; } if (docs[i].pwr != null) { delete docs[i].pwr; } if (docs[i].agct != null) { delete docs[i].agct; } @@ -2998,7 +2998,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use if (command.desc != null && (command.desc != node.desc)) { change = 1; node.desc = command.desc; changes.push('description'); } if (command.intelamt != null) { if ((command.intelamt.user != null) && (command.intelamt.pass != undefined) && ((command.intelamt.user != node.intelamt.user) || (command.intelamt.pass != node.intelamt.pass))) { change = 1; node.intelamt.user = command.intelamt.user; node.intelamt.pass = command.intelamt.pass; changes.push('Intel AMT credentials'); } - if (command.intelamt.tls && (command.intelamt.tls != node.intelamt.tls)) { change = 1; node.intelamt.tls = command.intelamt.tls; changes.push('Intel AMT TLS'); } + if ((command.intelamt.tls != null) && (command.intelamt.tls != node.intelamt.tls)) { change = 1; node.intelamt.tls = command.intelamt.tls; changes.push('Intel AMT TLS'); } } if (command.tags) { // Node grouping tag, this is a array of strings that can't be empty and can't contain a comma var ok = true, group2 = []; diff --git a/views/default-mobile.handlebars b/views/default-mobile.handlebars index 0e66b586..6ba6ee51 100644 --- a/views/default-mobile.handlebars +++ b/views/default-mobile.handlebars @@ -2230,9 +2230,9 @@ if (amtuser == '') amtuser = 'admin'; var amtpass = Q('dp10password').value; if (amtpass == '') amtuser = ''; - meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: Q('dp10tls').value } }); + meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: parseInt(Q('dp10tls').value) } }); tag.node.intelamt.user = amtuser; - tag.node.intelamt.tls = Q('dp10tls').value; + tag.node.intelamt.tls = parseInt(Q('dp10tls').value); if (tag.func) { setTimeout(tag.func, 300); } } } diff --git a/views/default.handlebars b/views/default.handlebars index 1226f415..dc096a9b 100644 --- a/views/default.handlebars +++ b/views/default.handlebars @@ -5352,9 +5352,9 @@ if (amtuser == '') amtuser = 'admin'; var amtpass = Q('dp10password').value; if (amtpass == '') amtuser = ''; - meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: Q('dp10tls').value } }); + meshserver.send({ action: 'changedevice', nodeid: tag.node._id, intelamt: { user: amtuser, pass: amtpass, tls: parseInt(Q('dp10tls').value) } }); tag.node.intelamt.user = amtuser; - tag.node.intelamt.tls = Q('dp10tls').value; + tag.node.intelamt.tls = parseInt(Q('dp10tls').value); if (tag.func) { setTimeout(function () { tag.func(null, tag.arg); }, 300); } } } diff --git a/webserver.js b/webserver.js index 193118ac..ebe72895 100644 --- a/webserver.js +++ b/webserver.js @@ -2615,7 +2615,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) { // TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF const TLSSocket = require('tls').TLSSocket; - const tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + const tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; } const tlsock = new TLSSocket(ser, tlsoptions); tlsock.on('error', function (err) { parent.debug('webrelay', "CIRA TLS Connection Error ", err); }); tlsock.on('secureConnect', function () { parent.debug('webrelay', "CIRA Secure TLS Connection"); ws._socket.resume(); }); @@ -2796,7 +2797,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) { ws._socket.resume(); } else { // If TLS is going to be used, setup a TLS socket - var tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false }; + if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; } ws.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () { // The TLS connection method is the same as TCP, but located a bit differently. parent.debug('webrelay', 'TLS connected to ' + node.host + ':' + port + '.'); @@ -2827,13 +2829,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) { // If the TCP connection closes, disconnect the associated web socket. ws.forwardclient.on('close', function () { - parent.debug('webrelay', 'TCP relay disconnected from ' + node.host + '.'); + parent.debug('webrelay', 'TCP relay disconnected from ' + node.host + ':' + port + '.'); try { ws.close(); } catch (e) { } }); // If the TCP connection causes an error, disconnect the associated web socket. ws.forwardclient.on('error', function (err) { - parent.debug('webrelay', 'TCP relay error from ' + node.host + ': ' + err.errno); + parent.debug('webrelay', 'TCP relay error from ' + node.host + ':' + port + ': ' + err); try { ws.close(); } catch (e) { } });