Intel AMT activation fixes.
Ylian Saint-Hilaire committed
Mar 13, 2021 at 21:26 UTC
5bdebda679092cf4a31063029a7d539a6743ee1e
3 files changed
+27
-6
amtmanager.js
+7
-3
@@ -1802,6 +1802,7 @@ module.exports.CreateAmtManager = function (parent) {
1802
const activationCerts = domain.amtacmactivation.certs;
1803
if ((dev.mpsConnection.tag.meiState == null) || (dev.mpsConnection.tag.meiState.Hashes == null) || (dev.mpsConnection.tag.meiState.Hashes.length == 0)) return null;
1804
const deviceHashes = dev.mpsConnection.tag.meiState.Hashes;
1805
+ if (deviceHashes == null) return null;
1806
1807
// Get the trusted FQDN of the device
1808
var trustedFqdn = null;
@@ -1836,11 +1837,12 @@ module.exports.CreateAmtManager = function (parent) {
1837
// Get our ACM activation certificate chain
1838
var acmTlsInfo = parent.certificateOperations.getAcmCertChain(parent.config.domains[dev.domainid], dev.temp.acminfo.fqdn, dev.temp.acminfo.hash);
1839
if (acmTlsInfo.error == 1) { dev.consoleMsg(acmTlsInfo.errorText); removeAmtDevice(dev, 44); return; }
1840
+ acmTlsInfo.certs = acmTlsInfo.certs.reverse(); // Reverse the order of the certificates.
1841
dev.acmTlsInfo = acmTlsInfo;
1842
1843
// Send the MEI command to enable TLS connections
1844
dev.consoleMsg("Performing TLS ACM activation...");
1843
- dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1845
+ dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash256, hostVpn: false, dnsSuffixList: null });
1846
} else {
1847
// MeshCore or MeshCMD is to old
1848
dev.consoleMsg("This software is to old to support ACM activation, pleasse update and try again.");
@@ -1850,10 +1852,10 @@ module.exports.CreateAmtManager = function (parent) {
1852
1853
// Attempt Intel AMT TLS ACM activation after startConfiguration() is called on remote device
1854
function activateIntelAmtTlsAcmEx(dev, startConfigData) {
1853
- console.log('activateIntelAmtTlsAcmEx', dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass);
1855
+ //console.log('activateIntelAmtTlsAcmEx', dev.mpsConnection.tag.meiState.OsAdmin.user, dev.mpsConnection.tag.meiState.OsAdmin.pass);
1856
1857
// Setup the WSMAN stack, no TLS
1856
- var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs.reverse().join(''), key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1858
+ var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs.join(''), key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1859
// TODO: Intel AMT leaf TLS cert need to SHA256 hash to "startConfigData.hash"
1860
var wsstack = WsmanStackCreateService(comm);
1861
dev.amtstack = AmtStackCreateService(wsstack);
@@ -1865,11 +1867,13 @@ module.exports.CreateAmtManager = function (parent) {
1867
console.log('activateIntelAmtTlsAcmEx1', status, responses);
1868
const dev = stack.dev;
1869
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1870
+
1871
if (status != 200) {
1872
dev.consoleMsg("Failed to perform ACM TLS connection, falling back to legacy host-based activation.");
1873
activateIntelAmtAcm(dev); // Falling back to legacy WSMAN ACM activation, start by refreshing $$OsAdmin username and password.
1874
} else {
1875
// TODO!!!
1876
+ console.log('TODO!!!!!');
1877
}
1878
}
1879
certoperations.js
+17
-2
@@ -62,7 +62,7 @@ module.exports.CertificateOperations = function (parent) {
62
}
63
64
// Hash the leaf certificate and return the certificate chain and signing key
65
- return { action: 'acmactivate', certs: certChain, signkey: signkey, hash: obj.getCertHash(certChain[certChain.length - 1]) };
65
+ return { action: 'acmactivate', certs: certChain, signkey: signkey, hash384: obj.getCertHash(certChain[certChain.length - 1]), hash256: obj.getCertHashSha256(certChain[certChain.length - 1]) };
66
}
67
68
// Sign a Intel AMT ACM activation request
@@ -550,7 +550,7 @@ module.exports.CertificateOperations = function (parent) {
550
return obj.pki.getPublicKeyFingerprint(publickey, { encoding: 'hex', md: obj.forge.md.sha384.create() });
551
};
552
553
- // Return the SHA384 hash of the certificate, return hex
553
+ // Return the SHA1 hash of the certificate, return hex
554
obj.getCertHashSha1 = function (cert) {
555
try {
556
var md = obj.forge.md.sha1.create();
@@ -565,6 +565,21 @@ module.exports.CertificateOperations = function (parent) {
565
}
566
};
567
568
+ // Return the SHA256 hash of the certificate, return hex
569
+ obj.getCertHashSha256 = function (cert) {
570
+ try {
571
+ var md = obj.forge.md.sha256.create();
572
+ md.update(obj.forge.asn1.toDer(obj.pki.certificateToAsn1(obj.pki.certificateFromPem(cert))).getBytes());
573
+ return md.digest().toHex();
574
+ } catch (ex) {
575
+ // If this is not an RSA certificate, hash the raw PKCS7 out of the PEM file
576
+ var x1 = cert.indexOf('-----BEGIN CERTIFICATE-----'), x2 = cert.indexOf('-----END CERTIFICATE-----');
577
+ if ((x1 >= 0) && (x2 > x1)) {
578
+ return obj.crypto.createHash('sha256').update(Buffer.from(cert.substring(x1 + 27, x2), 'base64')).digest('hex');
579
+ } else { console.log("ERROR: Unable to decode certificate."); return null; }
580
+ }
581
+ };
582
+
583
// Return the SHA384 hash of the certificate, return hex
584
obj.getCertHash = function (cert) {
585
try {
interceptor.js
+3
-1
@@ -167,7 +167,9 @@ module.exports.CreateHttpInterceptor = function (args) {
167
// We have authentication data, lets use it.
168
var AuthArgs = obj.GetAuthArgs(HttpInterceptorAuthentications[obj.args.host + ':' + obj.args.port]);
169
170
- AuthArgs.qop = 'auth'; // If different QOP options are proposed, always use 'auth' for now.
170
+ // If different QOP options are proposed, always use 'auth' for now.
171
+ AuthArgs.qop = 'auth';
172
+
173
// In the future, we should support auth-int, but that will required the body of the request to be accumulated and hashed.
174
/*
175
if (AuthArgs.qop != null) { // If Intel AMT supports auth-int, use it.