Fixed certificate and key matching on new Intel AMT versions.
Ylian Saint-Hilaire committed
Jun 23, 2022 at 15:57 UTC
30c4c9b6ea27dc8eff2e14b73d66c21f723dbfb0
1 file changed
+8
-5
amtmanager.js
+8
-5
@@ -3013,17 +3013,20 @@ module.exports.CreateAmtManager = function (parent) {
3013
3014
function guidToStr(g) { return g.substring(6, 8) + g.substring(4, 6) + g.substring(2, 4) + g.substring(0, 2) + '-' + g.substring(10, 12) + g.substring(8, 10) + '-' + g.substring(14, 16) + g.substring(12, 14) + '-' + g.substring(16, 20) + '-' + g.substring(20); }
3015
3016
+ // Base64 to string conversion utility functions
3017
+ function atob(x) { return Buffer.from(x, 'base64').toString('binary'); }
3018
+ function btoa(x) { return Buffer.from(x, 'binary').toString('base64'); }
3019
+
3020
// Check which key pair matches the public key in the certificate
3021
function amtcert_linkCertPrivateKey(certs, keys) {
3022
+ if ((keys == null) || (keys.length == 0)) return;
3023
for (var i in certs) {
3024
var cert = certs[i];
3025
try {
3021
- if (keys.length == 0) return;
3022
- var b = obj.parent.certificateOperations.forge.asn1.fromDer(cert.X509CertificateBin);
3023
- var a = obj.parent.certificateOperations.forge.pki.certificateFromAsn1(b).publicKey;
3024
- var publicKeyPEM = obj.parent.certificateOperations.forge.pki.publicKeyToPem(a).substring(28 + 32).replace(/(\r\n|\n|\r)/gm, "");
3026
+ var publicKeyPEM = obj.parent.certificateOperations.forge.pki.publicKeyToPem(obj.parent.certificateOperations.forge.pki.certificateFromAsn1(obj.parent.certificateOperations.forge.asn1.fromDer(cert.X509CertificateBin)).publicKey).substring(28 + 32).replace(/(\r\n|\n|\r)/gm, "");
3027
+ publicKeyPEM = publicKeyPEM.substring(0, publicKeyPEM.length - 24); // Remove the PEM footer
3028
for (var j = 0; j < keys.length; j++) {
3026
- if (publicKeyPEM === (keys[j]['DERKey'] + '-----END PUBLIC KEY-----')) {
3029
+ if ((publicKeyPEM === (keys[j]['DERKey'])) || (publicKeyPEM == btoa(atob(keys[j]['DERKey']).substring(24)))) { // Match directly or, new version of Intel AMT put the key type OID in the private key, skip that and match.
3030
keys[j].XCert = cert; // Link the key pair to the certificate
3031
cert.XPrivateKey = keys[j]; // Link the certificate to the key pair
3032
}