More work on Intel AMT ACM host-based TLS activation.
Ylian Saint-Hilaire committed
Mar 16, 2021 at 13:56 UTC
286342bb1b132399b3aff4ea135e6c8909f66cff
5 files changed
+86
-35
agents/meshcmd.js
+17
-3
@@ -113,7 +113,7 @@ function run(argv) {
113
//console.log('addedModules = ' + JSON.stringify(addedModules));
114
var actionpath = 'meshaction.txt';
115
if (args.actionfile != null) { actionpath = args.actionfile; }
116
- var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTCONFIG', 'AMTSCAN', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTUUID', 'AMTCCM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTEVENTLOG', 'AMTPRESENCE', 'AMTWIFI', 'AMTWAKE', 'AMTSTOPCONFIGURATION'];
116
+ var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTCONFIG', 'AMTSCAN', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTUUID', 'AMTCCM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTEVENTLOG', 'AMTPRESENCE', 'AMTWIFI', 'AMTWAKE', 'AMTSTARTCONFIG', 'AMTSTOPCONFIG'];
117
118
// Load the action file
119
var actionfile = null;
@@ -428,7 +428,21 @@ function run(argv) {
428
console.log('Proxy set to ' + proxy[0] + ':' + proxyport);
429
}
430
431
- if (settings.action == 'amtstopconfiguration') {
431
+ if (settings.action == 'amtstartconfig') {
432
+ // Start Intel AMT configuration
433
+ var amtMeiModule, amtMei;
434
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
435
+ amtMei.on('error', function (e) { console.log('ERROR: ' + e); exit(1); return; });
436
+ amtMei.startConfiguration(function (state) {
437
+ if (state == 3) { console.log("Intel AMT is not in correct mode."); }
438
+ else if (state == 1) { console.log("Intel AMT internal error."); }
439
+ else if (state == 48) { console.log("Random generator not ready."); }
440
+ else if (state == 49) { console.log("Certificate not ready."); }
441
+ else if (state == 0) { console.log("Success."); }
442
+ else { console.log("Unknown status: " + state); }
443
+ exit(1);
444
+ });
445
+ } else if (settings.action == 'amtstopconfig') {
446
// Stop Intel AMT configuration
447
var amtMeiModule, amtMei;
448
try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
@@ -437,7 +451,7 @@ function run(argv) {
451
if (state == 3) { console.log("Intel AMT is not in in-provisionning mode."); }
452
else if (state == 1) { console.log("Intel AMT internal error."); }
453
else if (state == 0) { console.log("Success."); }
440
- else { console.log("Unknown state: " + state); }
454
+ else { console.log("Unknown status: " + state); }
455
exit(1);
456
});
457
} else if (settings.action == 'smbios') {
agents/modules_meshcore/amt-apfclient.js
+4
-1
@@ -46,7 +46,10 @@ function CreateAPFClient(parent, args) {
46
function rstr2hex(input) { var r = '', i; for (i = 0; i < input.length; i++) { r += char2hex(input.charCodeAt(i)); } return r; }; // Convert a raw string to a hex string
47
function d2h(d) { return (d / 256 + 1 / 512).toString(16).substring(2, 4); }
48
function buf2hex(input) { var r = '', i; for (i = 0; i < input.length; i++) { r += d2h(input[i]); } return r; };
49
- function Debug(str) { if (obj.parent.debug) { console.log(str); } }
49
+ function Debug(str) {
50
+ //require('MeshAgent').SendCommand({ action: 'msg', type: 'console', value: str });
51
+ if (obj.parent.debug) { console.log(str); }
52
+ }
53
function guidToStr(g) { return g.substring(6, 8) + g.substring(4, 6) + g.substring(2, 4) + g.substring(0, 2) + "-" + g.substring(10, 12) + g.substring(8, 10) + "-" + g.substring(14, 16) + g.substring(12, 14) + "-" + g.substring(16, 20) + "-" + g.substring(20); }
54
function strToGuid(s) { s = s.replace(/-/g, ''); var ret = s.substring(6, 8) + s.substring(4, 6) + s.substring(2, 4) + s.substring(0, 2) + s.substring(10, 12) + s.substring(8, 10) + s.substring(14, 16) + s.substring(12, 14) + s.substring(16, 20) + s.substring(20); return ret; }
55
function binzerostring(len) { var res = ''; for (var l = 0; l < len; l++) { res += String.fromCharCode(0 & 0xFF); } return res; }
agents/modules_meshcore/amt-mei.js
+8
-7
@@ -416,13 +416,15 @@ function amt_heci() {
416
for (var i = 4; i < arguments.length; ++i) { optional.push(arguments[i]); }
417
418
// Format the command
419
- var data = Buffer.alloc(4 + 64 + 4 + 4 + 320);
420
- data.writeUInt32LE((certHash.length == 48) ? 3 : 2, 0); // Write certificate hash type: SHA256 = 2, SHA384 = 3
421
- certHash.copy(data, 4); // Write the hash
422
- data.writeUInt32LE(hostVpn ? 1 : 0, 68); // Write is HostVPN is enabled
419
+ var len = 1 + 64 + 4 + 4;
420
+ if (dnsSuffixList != null) { len += 320; }
421
+ var data = Buffer.alloc(len);
422
+ data[0] = (certHash.length == 48) ? 3 : 2; // Write certificate hash type: SHA256 = 2, SHA384 = 3
423
+ certHash.copy(data, 1); // Write the hash
424
+ data.writeUInt32LE(hostVpn ? 1 : 0, 65); // Write is HostVPN is enabled
425
if (dnsSuffixList != null) {
424
- data.writeUInt32LE(dnsSuffixList.length, 72); // Write the number of DNS Suffix, from 0 to 4
425
- var ptr = 76;
426
+ data.writeUInt32LE(dnsSuffixList.length, 69); // Write the number of DNS Suffix, from 0 to 4
427
+ var ptr = 73;
428
for (var i = 0; i < dnsSuffixList.length; i++) { ptr += data.write(dnsSuffixList[i], ptr) + 1; } // Write up to 4 DNS Suffix with null seperation.
429
}
430
@@ -443,7 +445,6 @@ function amt_heci() {
445
446
module.exports = amt_heci;
447
446
-
448
/*
449
AMT_STATUS_SUCCESS = 0,
450
AMT_STATUS_INTERNAL_ERROR = 1,
amt/amt-wsman-comm.js
+19
-12
@@ -290,7 +290,7 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
290
obj.socket.on('data', obj.xxOnSocketData);
291
obj.socket.on('close', obj.xxOnSocketClosed);
292
obj.socket.on('timeout', obj.xxOnSocketTimeout);
293
- obj.socket.on('error', function (e) { if (e.message && e.message.indexOf('sslv3 alert bad record mac') >= 0) { obj.xtlsMethod = 1 - obj.xtlsMethod; } });
293
+ obj.socket.on('error', function (ex) { if (ex.message && ex.message.indexOf('sslv3 alert bad record mac') >= 0) { obj.xtlsMethod = 1 - obj.xtlsMethod; } });
294
}
295
obj.socket.setNoDelay(true); // Disable nagle. We will encode each WSMAN request as a single send block and want to send it at once. This may help Intel AMT handle pipelining?
296
}
@@ -300,6 +300,23 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
300
obj.getPeerCertificate = function () { if (obj.xtls == 1) { return obj.socket.getPeerCertificate(); } return null; }
301
obj.getPeerCertificateFingerprint = function () { if (obj.xtls == 1) { return obj.socket.getPeerCertificate().fingerprint.split(':').join('').toLowerCase(); } return null; }
302
303
+ // Check if the certificate matched the certificate hash.
304
+ function checkCertHash(cert, hash) {
305
+ // Check not required
306
+ if (hash == 0) return true;
307
+
308
+ // SHA1 compare
309
+ if (cert.fingerprint.split(':').join('').toLowerCase() == hash) return true;
310
+
311
+ // SHA256 compare
312
+ if ((hash.length == 64) && (obj.crypto.createHash('sha256').update(cert.raw).digest('hex') == hash)) { return true; }
313
+
314
+ // SHA384 compare
315
+ if ((hash.length == 96) && (obj.crypto.createHash('sha384').update(cert.raw).digest('hex') == hash)) { return true; }
316
+
317
+ return false;
318
+ }
319
+
320
// NODE.js specific private method
321
obj.xxOnSocketConnected = function () {
322
if (obj.socket == null) return;
@@ -307,7 +324,6 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
324
if (obj.xtls == 1) {
325
obj.xtlsCertificate = obj.socket.getPeerCertificate();
326
310
- // ###BEGIN###{Certificates}
327
// Setup the forge certificate check
328
var camatch = 0;
329
if ((obj.xtlsoptions != null) && (obj.xtlsoptions.ca != null)) {
@@ -327,21 +343,12 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
343
if (amtcertname.toLowerCase() != obj.host.toLowerCase()) { camatch = 0; }
344
}
345
}
330
- if ((camatch == 0) && (obj.xtlsFingerprint != 0) && (obj.xtlsCertificate.fingerprint.split(':').join('').toLowerCase() != obj.xtlsFingerprint)) {
346
+ if ((camatch == 0) && (checkCertHash(obj.xtlsCertificate, obj.xtlsFingerprint) == false)) {
347
obj.FailAllError = 998; // Cause all new responses to be silent. 998 = TLS Certificate check error
348
obj.CancelAllQueries(998);
349
return;
350
}
351
if ((obj.xtlsFingerprint == 0) && (camatch == 0)) { obj.xtlsCheck = 3; } else { obj.xtlsCheck = (camatch == 0) ? 2 : 1; }
336
- // ###END###{Certificates}
337
- // ###BEGIN###{!Certificates}
338
- if ((obj.xtlsFingerprint != 0) && (obj.xtlsCertificate.fingerprint.split(':').join('').toLowerCase() != obj.xtlsFingerprint)) {
339
- obj.FailAllError = 998; // Cause all new responses to be silent. 998 = TLS Certificate check error
340
- obj.CancelAllQueries(998);
341
- return;
342
- }
343
- obj.xtlsCheck = 2;
344
- // ###END###{!Certificates}
352
} else { obj.xtlsCheck = 0; }
353
obj.socketState = 2;
354
obj.socketParseState = 0;
amtmanager.js
+38
-12
@@ -1842,7 +1842,7 @@ module.exports.CreateAmtManager = function (parent) {
1842
1843
// Send the MEI command to enable TLS connections
1844
dev.consoleMsg("Performing TLS ACM activation...");
1845
- dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash256, hostVpn: false, dnsSuffixList: null });
1845
+ dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash256, hostVpn: false, dnsSuffixList: null }); // TODO: Use SHA384 is possible.
1846
} else {
1847
// MeshCore or MeshCMD is to old
1848
dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
@@ -1852,15 +1852,19 @@ module.exports.CreateAmtManager = function (parent) {
1852
1853
// Attempt Intel AMT TLS ACM activation after startConfiguration() is called on remote device
1854
function activateIntelAmtTlsAcmEx(dev, startConfigData) {
1855
- //console.log('activateIntelAmtTlsAcmEx', dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass);
1856
-
1857
- // Setup the WSMAN stack, no TLS
1858
- var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs.join(''), key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1859
- // TODO: Intel AMT leaf TLS cert need to SHA256 hash to "startConfigData.hash"
1860
- var wsstack = WsmanStackCreateService(comm);
1861
- dev.amtstack = AmtStackCreateService(wsstack);
1862
- dev.amtstack.dev = dev;
1863
- dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], activateIntelAmtTlsAcmEx1);
1855
+ if ((startConfigData == null) || (startConfigData.status != 0) || (typeof startConfigData.hash != 'string')) {
1856
+ // Unable to call startTlsHostConfig on remote host.
1857
+ dev.consoleMsg("Failed to startConfigurationHBased(), status = " + startConfigData.status);
1858
+ removeAmtDevice(dev);
1859
+ } else {
1860
+ // Setup the WSMAN stack, no TLS
1861
+ var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs.join(''), key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1862
+ comm.xtlsFingerprint = startConfigData.hash.toLowerCase(); // Intel AMT leaf TLS cert need to match this hash (SHA256 or SHA384)
1863
+ var wsstack = WsmanStackCreateService(comm);
1864
+ dev.amtstack = AmtStackCreateService(wsstack);
1865
+ dev.amtstack.dev = dev;
1866
+ dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], activateIntelAmtTlsAcmEx1);
1867
+ }
1868
}
1869
1870
function activateIntelAmtTlsAcmEx1(stack, name, responses, status) {
@@ -1868,14 +1872,36 @@ module.exports.CreateAmtManager = function (parent) {
1872
const dev = stack.dev;
1873
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1874
1875
+ // Check if we succesfully connected
1876
if (status != 200) {
1872
- dev.consoleMsg("Failed to perform ACM TLS connection, falling back to legacy host-based activation.");
1873
- activateIntelAmtAcm(dev); // Falling back to legacy WSMAN ACM activation, start by refreshing $$OsAdmin username and password.
1877
+ dev.consoleMsg("Failed to perform ACM TLS connection.");
1878
+ //activateIntelAmtAcm(dev); // It's possible to fallback to legacy WSMAN ACM activation here if we needed to..
1879
+ removeAmtDevice(dev);
1880
} else {
1881
// TODO!!!
1882
console.log('TODO!!!!!');
1883
}
1884
}
1885
+
1886
+
1887
+
1888
+
1889
+
1890
+
1891
+
1892
+
1893
+
1894
+
1895
+
1896
+
1897
+
1898
+
1899
+
1900
+
1901
+
1902
+
1903
+
1904
+
1905
1906
// Attempt Intel AMT ACM activation
1907
function activateIntelAmtAcm(dev, password, acminfo) {