Partial work for host-based ACM AMT activation.
Ylian Saint-Hilaire committed
Mar 3, 2021 at 23:49 UTC
423daaf19d258ffbff13107f9fe91651d5c33cd9
11 files changed
+143
-15
agents/meshcmd.js
+8
@@ -1174,6 +1174,14 @@ function configureJsonControl(data) {
1174
amtMei.on('error', function (e) { settings.apftunnel.sendMeiDeactivationState(1); });
1175
amtMei.unprovision(1, function (status) { settings.apftunnel.sendMeiDeactivationState(status); }); // 0 = Success
1176
break;
1177
+ case 'startTlsHostConfig': // Request start of host based TLS ACM activation
1178
+ var amtMeiModule, amtMei;
1179
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { settings.apftunnel.sendStartTlsHostConfigResponse({ state: -103 }); break; }
1180
+ amtMei.on('error', function (e) { settings.apftunnel.sendStartTlsHostConfigResponse({ state: -104 }); });
1181
+ amtMei.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) {
1182
+ settings.apftunnel.sendStartTlsHostConfigResponse(response);
1183
+ });
1184
+ break;
1185
case 'close': // Close the CIRA-LMS connection
1186
exit(0);
1187
break;
agents/meshcore.js
+5
@@ -1197,6 +1197,11 @@ function handleServerCommand(data) {
1197
amtMei.unprovision(1, function (status) { if (apftunnel) apftunnel.sendMeiDeactivationState(status); }); // 0 = Success
1198
}
1199
if (data.action == 'close') { try { apftunnel.disconnect(); } catch (e) { } apftunnel = null; } // Close the CIRA-LMS connection
1200
+ if (data.action == 'startTlsHostConfig') { // Request start of host based TLS ACM activation
1201
+ amt.startConfigurationHBased(Buffer.from(data.hash, 'hex'), data.hostVpn, data.dnsSuffixList, function (response) {
1202
+ apftunnel.sendStartTlsHostConfigResponse(response);
1203
+ });
1204
+ }
1205
}
1206
apftunnel.onChannelClosed = function () { addAmtEvent('LMS tunnel closed.'); apftunnel = null; }
1207
try { apftunnel.connect(); } catch (ex) { }
agents/modules_meshcmd/amt-apfclient.js
+1
@@ -183,6 +183,7 @@ function CreateAPFClient(parent, args) {
183
184
obj.updateMeiState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'meiState', value: state }); }
185
obj.sendMeiDeactivationState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'deactivate', value: state }); }
186
+ obj.sendStartTlsHostConfigResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'startTlsHostConfig', value: state }); }
187
188
function SendJsonControl(socket, o) {
189
var data = JSON.stringify(o)
agents/modules_meshcmd/amt-mei.js
+19
-4
@@ -419,8 +419,8 @@ function amt_heci() {
419
420
}, this, callback, optional);
421
}
422
- this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, callback) {
423
- if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { throw "Bad certHash"; }
422
+ this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
423
+ if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { func({ status: -101 }); }
424
425
var optional = [];
426
for (var i = 4; i < arguments.length; ++i) { optional.push(arguments[i]); }
@@ -447,8 +447,23 @@ function amt_heci() {
447
opt.unshift({ status: header.Status });
448
}
449
fn.apply(this, opt);
450
- }, callback, optional);
450
+ }, func, optional);
451
}
452
}
453
454
-module.exports = amt_heci;
\ No newline at end of file
454
+module.exports = amt_heci;
455
+
456
+
457
+/*
458
+AMT_STATUS_SUCCESS = 0,
459
+AMT_STATUS_INTERNAL_ERROR = 1,
460
+AMT_STATUS_INVALID_AMT_MODE = 3,
461
+AMT_STATUS_INVALID_MESSAGE_LENGTH = 4,
462
+AMT_STATUS_MAX_LIMIT_REACHED = 23,
463
+AMT_STATUS_INVALID_PARAMETER = 36,
464
+AMT_STATUS_RNG_GENERATION_IN_PROGRESS = 47,
465
+AMT_STATUS_RNG_NOT_READY = 48,
466
+AMT_STATUS_CERTIFICATE_NOT_READY = 49,
467
+AMT_STATUS_INVALID_HANDLE = 2053
468
+AMT_STATUS_NOT_FOUND = 2068,
469
+*/
\ No newline at end of file
agents/modules_meshcore/amt-apfclient.js
+1
@@ -183,6 +183,7 @@ function CreateAPFClient(parent, args) {
183
184
obj.updateMeiState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'meiState', value: state }); }
185
obj.sendMeiDeactivationState = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'deactivate', value: state }); }
186
+ obj.sendStartTlsHostConfigResponse = function (state) { SendJsonControl(obj.forwardClient.ws, { action: 'startTlsHostConfig', value: state }); }
187
188
function SendJsonControl(socket, o) {
189
var data = JSON.stringify(o)
agents/modules_meshcore/amt-manage.js
+6
@@ -157,6 +157,12 @@ function AmtManager(agent, db, isdebug) {
157
}
158
}
159
160
+ // Start host based ACM activation with TLS
161
+ obj.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
162
+ if ((amtMei == null) || (amtMeiState < 2)) { if (func != null) { func({ status: -100 }); } return; }
163
+ amtMei.startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func);
164
+ }
165
+
166
}
167
168
module.exports = AmtManager;
agents/modules_meshcore/amt-mei.js
+19
-4
@@ -419,8 +419,8 @@ function amt_heci() {
419
420
}, this, callback, optional);
421
}
422
- this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, callback) {
423
- if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { throw "Bad certHash"; }
422
+ this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
423
+ if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { func({ status: -101 }); }
424
425
var optional = [];
426
for (var i = 4; i < arguments.length; ++i) { optional.push(arguments[i]); }
@@ -447,8 +447,23 @@ function amt_heci() {
447
opt.unshift({ status: header.Status });
448
}
449
fn.apply(this, opt);
450
- }, callback, optional);
450
+ }, func, optional);
451
}
452
}
453
454
-module.exports = amt_heci;
\ No newline at end of file
454
+module.exports = amt_heci;
455
+
456
+
457
+/*
458
+AMT_STATUS_SUCCESS = 0,
459
+AMT_STATUS_INTERNAL_ERROR = 1,
460
+AMT_STATUS_INVALID_AMT_MODE = 3,
461
+AMT_STATUS_INVALID_MESSAGE_LENGTH = 4,
462
+AMT_STATUS_MAX_LIMIT_REACHED = 23,
463
+AMT_STATUS_INVALID_PARAMETER = 36,
464
+AMT_STATUS_RNG_GENERATION_IN_PROGRESS = 47,
465
+AMT_STATUS_RNG_NOT_READY = 48,
466
+AMT_STATUS_CERTIFICATE_NOT_READY = 49,
467
+AMT_STATUS_INVALID_HANDLE = 2053
468
+AMT_STATUS_NOT_FOUND = 2068,
469
+*/
\ No newline at end of file
amtmanager.js
+35
-1
@@ -246,6 +246,10 @@ module.exports.CreateAmtManager = function (parent) {
246
delete dev.pendingUpdatedMeiState;
247
attemptInitialContact(dev);
248
break;
249
+ case 'startTlsHostConfig':
250
+ if (dev.acmTlsInfo == null) break;
251
+ console.log(jsondata); // TODO: Start TLS activation.
252
+ break;
253
}
254
}
255
@@ -345,6 +349,9 @@ module.exports.CreateAmtManager = function (parent) {
349
if (typeof dev.mpsConnection.tag.meiState['ProvisioningState'] == 'number') {
350
dev.intelamt.state = dev.aquired.state = dev.mpsConnection.tag.meiState['ProvisioningState'];
351
}
352
+ if ((typeof dev.mpsConnection.tag.meiState['Versions'] == 'object') && (typeof dev.mpsConnection.tag.meiState['Versions']['AMT'] == 'string')) {
353
+ dev.intelamt.ver = dev.aquired.version = dev.mpsConnection.tag.meiState['Versions']['AMT'];
354
+ }
355
if (typeof dev.mpsConnection.tag.meiState['Flags'] == 'number') {
356
const flags = dev.intelamt.flags = dev.mpsConnection.tag.meiState['Flags'];
357
if (flags & 2) { dev.aquired.controlMode = 1; } // CCM
@@ -459,6 +466,9 @@ module.exports.CreateAmtManager = function (parent) {
466
dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], attemptLocalConnectResponse);
467
break;
468
case 3: // Local LAN
469
+ // Check if Intel AMT is activated. If not, stop here.
470
+ if ((dev.intelamt == null) || ((dev.intelamt.state != null) && (dev.intelamt.state != 2))) { removeAmtDevice(dev); return; }
471
+
472
// Handle the case where the Intel AMT local scanner found the device (connType 3)
473
parent.debug('amt', dev.name, "Attempt Initial Local Contact", dev.connType, dev.host);
474
if (typeof dev.host != 'string') { removeAmtDevice(dev); return; } // Local connection not valid
@@ -1666,7 +1676,15 @@ module.exports.CreateAmtManager = function (parent) {
1676
deactivateIntelAmtCCM(dev);
1677
} else {
1678
// We are not activated now, go to ACM directly.
1669
- activateIntelAmtAcm(dev, mesh.amt.password, acminfo);
1679
+ // If this is Intel AMT 14 or better, we are going to attempt a host-based end-to-end TLS activation.
1680
+ if (typeof dev.intelamt.ver == 'string') { var verSplit = dev.intelamt.ver.split('.'); if (verSplit.length >= 3) { dev.aquired.majorver = parseInt(verSplit[0]); dev.aquired.minorver = parseInt(verSplit[1]); } }
1681
+ if (dev.aquired.majorver >= 14) {
1682
+ // Perform host-based TLS ACM activation
1683
+ activateIntelAmtTlsAcm(dev, mesh.amt.password, acminfo);
1684
+ } else {
1685
+ // Perform host-based ACM activation
1686
+ activateIntelAmtAcm(dev, mesh.amt.password, acminfo);
1687
+ }
1688
}
1689
}
1690
}
@@ -1769,6 +1787,22 @@ module.exports.CreateAmtManager = function (parent) {
1787
return null; // Did not find a match
1788
}
1789
1790
+ // Attempt Intel AMT TLS ACM activation
1791
+ function activateIntelAmtTlsAcm(dev, password, acminfo) {
1792
+ // Generate a random Intel AMT password if needed
1793
+ if ((password == null) || (password == '')) { password = getRandomAmtPassword(); }
1794
+ dev.temp = { pass: password, acminfo: acminfo };
1795
+
1796
+ // Get our ACM activation certificate chain
1797
+ var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1798
+ if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev); return; }
1799
+ dev.acmTlsInfo = acmTlsInfo;
1800
+
1801
+ // Send the MEI command to enable TLS connections
1802
+ dev.consoleMsg("Performing TLS ACM activation...");
1803
+ dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1804
+ }
1805
+
1806
// Attempt Intel AMT ACM activation
1807
function activateIntelAmtAcm(dev, password, acminfo) {
1808
// Generate a random Intel AMT password if needed
amtscanner.js
+7
-4
@@ -287,15 +287,18 @@ module.exports.CreateAmtScanner = function (parent) {
287
obj.changeConnectState = function (tag, minorVersion, majorVersion, provisioningState, openPort, dualPorts, rinfo, user) {
288
//var provisioningStates = { 0: 'Pre', 1: 'in', 2: 'Post' };
289
//var provisioningStateStr = provisioningStates[provisioningState];
290
- //console.log('Intel AMT ' + majorVersion + '.' + minorVersion + ', ' + provisioningStateStr + '-Provisioning at ' + rinfo.address + ', Open Ports: [' + openPort + '], tag: ' + tag);
290
+ //console.log('Intel AMT ' + majorVersion + '.' + minorVersion + ', ' + provisioningStateStr + '-Provisioning at ' + rinfo.address + ', Open Ports: [' + openPort + '], tag: ' + tag + ', dualPorts: ' + dualPorts);
291
var scaninfo = obj.scanTableTags[tag];
292
if (scaninfo != undefined) {
293
scaninfo.lastpong = Date.now();
294
if (scaninfo.state == 0) {
295
scaninfo.state = 1;
296
- scaninfo.nodeinfo.intelamt.tls = (((openPort == 16993) || (dualPorts == true)) ? 1 : 0);
297
- scaninfo.nodeinfo.intelamt.ver = majorVersion + '.' + minorVersion;
298
- scaninfo.nodeinfo.intelamt.state = provisioningState;
296
+ if ((openPort == 16993) || (dualPorts == true)) { scaninfo.nodeinfo.intelamt.tls = 1; }
297
+ else if (openPort == 16992) { scaninfo.nodeinfo.intelamt.tls = 0; }
298
+ if (majorVersion > 0) { // Older versions of Intel AMT report the AMT version.
299
+ scaninfo.nodeinfo.intelamt.ver = majorVersion + '.' + minorVersion;
300
+ scaninfo.nodeinfo.intelamt.state = provisioningState;
301
+ }
302
obj.parent.SetConnectivityState(scaninfo.nodeinfo.meshid, scaninfo.nodeinfo._id, scaninfo.lastpong, 4, 7); // Report power state as "present" (7).
303
obj.changeAmtState(scaninfo.nodeinfo._id, scaninfo.nodeinfo.intelamt.ver, provisioningState, scaninfo.nodeinfo.intelamt.tls);
304
if (obj.parent.amtManager != null) { obj.parent.amtManager.startAmtManagement(scaninfo.nodeinfo._id, 3, scaninfo.nodeinfo.host); }
certoperations.js
+36
@@ -28,6 +28,42 @@ module.exports.CertificateOperations = function (parent) {
28
29
const TopLevelDomainExtendedSupport = { 'net': 2, 'com': 2, 'arpa': 3, 'org': 2, 'gov': 2, 'edu': 2, 'de': 2, 'fr': 3, 'cn': 3, 'nl': 3, 'br': 3, 'mx': 3, 'uk': 3, 'pl': 3, 'tw': 3, 'ca': 3, 'fi': 3, 'be': 3, 'ru': 3, 'se': 3, 'ch': 2, 'dk': 2, 'ar': 3, 'es': 3, 'no': 3, 'at': 3, 'in': 3, 'tr': 3, 'cz': 2, 'ro': 3, 'hu': 3, 'nz': 3, 'pt': 3, 'il': 3, 'gr': 3, 'co': 3, 'ie': 3, 'za': 3, 'th': 3, 'sg': 3, 'hk': 3, 'cl': 2, 'lt': 3, 'id': 3, 'hr': 3, 'ee': 3, 'bg': 3, 'ua': 2 };
30
31
+ // Sign a Intel AMT TLS ACM activation request
32
+ obj.getAcmCertChain = function (domain, fqdn, hash) {
33
+ if ((domain == null) || (domain.amtacmactivation == null) || (domain.amtacmactivation.certs == null) || (fqdn == null) || (hash == null)) return { action: 'acmactivate', error: 1, errorText: 'Invalid arguments' };
34
+ if (parent.common.validateString(fqdn, 4, 256) == false) return { action: 'acmactivate', error: 1, errorText: "Invalid FQDN argument." };
35
+ if (parent.common.validateString(hash, 16, 256) == false) return { action: 'acmactivate', error: 1, errorText: "Invalid hash argument." };
36
+
37
+ // Look for the signing certificate
38
+ var signkey = null, certChain = null, hashAlgo = null, certIndex = null;
39
+ for (var i in domain.amtacmactivation.certs) {
40
+ const certEntry = domain.amtacmactivation.certs[i];
41
+ if ((certEntry.sha256 == hash) && ((certEntry.cn == '*') || (certEntry.cn == fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
42
+ if ((certEntry.sha1 == hash) && ((certEntry.cn == '*') || (certEntry.cn == fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
43
+ }
44
+ if (signkey == null) return { action: 'acmactivate', error: 2, errorText: "No signing certificate found." }; // Did not find a match.
45
+
46
+ // If the matching certificate our wildcard root cert, we can use the root to match any FQDN
47
+ if (domain.amtacmactivation.certs[certIndex].cn == '*') {
48
+ // Create a leaf certificate that matches the FQDN we want
49
+ // TODO: This is an expensive operation, work on ways to pre-generate or cache this leaf certificate.
50
+ var rootcert = { cert: domain.amtacmactivation.certs[certIndex].rootcert, key: obj.pki.privateKeyFromPem(domain.amtacmactivation.certs[certIndex].key) };
51
+ var leafcert = obj.IssueWebServerCertificate(rootcert, false, fqdn, 'mc', 'Intel(R) Client Setup Certificate', { serverAuth: true, '2.16.840.1.113741.1.2.3': true }, false);
52
+
53
+ // Setup the certificate chain and key
54
+ certChain = [obj.pki.certificateToPem(leafcert.cert), obj.pki.certificateToPem(domain.amtacmactivation.certs[certIndex].rootcert)];
55
+ signkey = obj.pki.privateKeyToPem(leafcert.key);
56
+ } else {
57
+ // Make sure the cert chain is in PEM format
58
+ var certChain2 = [];
59
+ for (var i in certChain) { certChain2.push("-----BEGIN CERTIFICATE-----\r\n" + certChain[i] + "\r\n-----END CERTIFICATE-----\r\n"); }
60
+ certChain = certChain2;
61
+ }
62
+
63
+ // Hash the leaf certificate and return the certificate chain and signing key
64
+ return { action: 'acmactivate', certs: certChain, signkey: signkey, hash: obj.getCertHash(certChain[0]) };
65
+ }
66
+
67
// Sign a Intel AMT ACM activation request
68
obj.signAcmRequest = function (domain, request, user, pass, ipport, nodeid, meshid, computerName, agentId) {
69
if ((domain == null) || (domain.amtacmactivation == null) || (domain.amtacmactivation.certs == null) || (request == null) || (request.nonce == null) || (request.realm == null) || (request.fqdn == null) || (request.hash == null)) return { 'action': 'acmactivate', 'error': 1, 'errorText': 'Invalid arguments' };
mpsserver.js
+6
-2
@@ -913,6 +913,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
913
var jsondata = null, jsondatastr = data.substring(5, 5 + jsondatalen);
914
try { jsondata = JSON.parse(jsondatastr); } catch (ex) { }
915
if ((jsondata == null) || (typeof jsondata.action != 'string')) return;
916
+ parent.debug('mpscmd', '--> JSON_CONTROL', jsondata.action);
917
switch (jsondata.action) {
918
case 'connType':
919
if ((socket.tag.connType != 0) || (socket.tag.SystemId != null)) return; // Once set, the connection type can't be changed.
@@ -930,6 +931,10 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
931
if (socket.tag.connType != 2) break; // Only accept MEI state on CIRA-LMS connection
932
if (obj.parent.amtManager != null) { obj.parent.amtManager.mpsControlMessage(socket.tag.nodeid, socket, socket.tag.connType, jsondata); }
933
break;
934
+ case 'startTlsHostConfig':
935
+ if (socket.tag.connType != 2) break; // Only accept MEI state on CIRA-LMS connection
936
+ if (obj.parent.amtManager != null) { obj.parent.amtManager.mpsControlMessage(socket.tag.nodeid, socket, socket.tag.connType, jsondata); }
937
+ break;
938
}
939
return 5 + jsondatalen;
940
}
@@ -956,8 +961,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
961
962
obj.SendJsonControl = function(socket, data) {
963
if (socket.tag.connType == 0) return; // This command is valid only for connections that are not really CIRA.
959
- parent.debug('mpscmd', '<-- JSON_CONTROL');
960
- if (typeof data == 'object') { data = JSON.stringify(data); }
964
+ if (typeof data == 'object') { parent.debug('mpscmd', '<-- JSON_CONTROL', data.action); data = JSON.stringify(data); } else { parent.debug('mpscmd', '<-- JSON_CONTROL'); }
965
Write(socket, String.fromCharCode(APFProtocol.JSON_CONTROL) + common.IntToStr(data.length) + data);
966
}
967