Intel AMT activation improvements.
Ylian Saint-Hilaire committed
Jun 27, 2019 at 16:04 UTC
86fc328325b260ff3bb2a58f9e15de8f8986a73a
5 files changed
+304
-299
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+127
-123
@@ -517,13 +517,18 @@ function run(argv) {
517
settings.protocol = 'http:';
518
settings.localport = 16992;
519
debug(1, "Settings: " + JSON.stringify(settings));
520
- if (settings.password != null) { activeToCCM(); } else { activeServerCCM(); }
520
+ if (settings.password != null) { activeToCCM(); } else { activeToACM(); }
521
} else if (settings.action == 'amtacm') {
522
// Start activation to ACM
523
if ((settings.url == null) || (typeof settings.url != 'string') || (settings.url == '')) { console.log('No activation server URL specified, use --url [url].'); exit(1); return; }
524
if ((typeof settings.profile != 'string') || (settings.profile == '')) { settings.profile = null; }
525
debug(1, "Settings: " + JSON.stringify(settings));
526
activeToACM();
527
+ } else if (settings.action == 'amtdiscover') {
528
+ // Intel AMT server discovery, tell the server the state of Intel AMT.
529
+ if ((settings.url == null) || (typeof settings.url != 'string') || (settings.url == '')) { console.log('No activation server URL specified, use --url [url].'); exit(1); return; }
530
+ debug(1, "Settings: " + JSON.stringify(settings));
531
+ activeToACM();
532
} else if (settings.action == 'amtdeactivate') {
533
// Deactivate CCM
534
debug(1, "Settings: " + JSON.stringify(settings));
@@ -823,91 +828,6 @@ function activeToCCMEx3(stack, name, responses, status) {
828
}
829
830
826
-//
827
-// Activate Intel AMT to CCM with server activation
828
-//
829
-
830
-function activeServerCCM() {
831
- settings.noconsole = true;
832
- mestate = {};
833
- var amtMeiModule, amtMei;
834
- try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
835
- amtMei.on('error', function (e) { console.log('ERROR: ' + e); exit(1); return; });
836
- amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
837
- amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
838
- amtMei.getUuid(function (result) {
839
- if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; }
840
- if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
841
- if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
842
- if (mestate.ProvisioningState.state !== 0) { console.log("Intel AMT is not in pre-provisioning state: " + mestate.ProvisioningState.stateStr); exit(100); return; }
843
- if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
844
- startLms(activeServerCCMEx);
845
- });
846
-}
847
-
848
-function activeServerCCMEx(state) {
849
- osamtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], activeServerCCMEx2);
850
-}
851
-
852
-function activeServerCCMEx2(stack, name, responses, status) {
853
- if (status != 200) { console.log('Failed to fetch activation status, status ' + status); exit(1); }
854
- else if (responses['IPS_HostBasedSetupService'].response['AllowedControlModes'].length != 2) { console.log('Client control mode activation not allowed'); exit(1); }
855
-
856
- // Establish WebSocket connection to activation server
857
- var options = http.parseUri(settings.url);
858
- options.checkServerIdentity = onVerifyServer;
859
- options.rejectUnauthorized = false;
860
- var connection = http.request(options);
861
- connection.on('upgrade', function (response, socket) {
862
- console.log('Connected, requesting activation...');
863
- settings.xxsocket = socket;
864
- socket.on('end', function () { console.log('Connection closed'); exit(0); });
865
- socket.on('error', function () { console.log('Connection error'); exit(100); });
866
- socket.on('data', function (data) {
867
- // Parse and check the response
868
- var cmd = null;
869
- try { cmd = JSON.parse(data); } catch (ex) { console.log('Unable to parse server response: ' + data); exit(100); return; }
870
- if (typeof cmd != 'object') { console.log('Invalid server response: ' + cmd); exit(100); return; }
871
- if (typeof cmd.errorText == 'string') { console.log('Server error: ' + cmd.errorText); exit(100); return; }
872
- if (cmd.action != 'ccmactivate') { console.log('Invalid server response, command: ' + cmd.cmd); exit(100); return; }
873
- if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
874
- settings.xxprofileScript = cmd.profileScript;
875
- settings.xxrawpassword = cmd.rawpassword;
876
-
877
- // We are ready to go, perform CCM activation.
878
- osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, activeServerCCMEx3);
879
- });
880
- socket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate', realm: responses['AMT_GeneralSettings'].response['DigestRealm'], uuid: mestate.uuid, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'] });
881
- });
882
- connection.end();
883
-}
884
-
885
-function activeServerCCMEx3(stack, name, responses, status) {
886
- if (status != 200) {
887
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
888
- console.log('Failed to activate, status ' + status);
889
- } else if (responses.Body.ReturnValue != 0) {
890
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
891
- console.log('Client control mode activation failed: ' + responses.Body.ReturnValueStr);
892
- } else {
893
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-success', uuid: mestate.uuid });
894
- if ((settings.xxprofileScript !== null) && (settings.xxrawpassword != null)) {
895
- console.log("Intel AMT ACM activation success, applying profile...");
896
- settings.scriptjson = settings.xxprofileScript;
897
- settings.password = settings.xxrawpassword; // This is only going to work if the server sends the raw password
898
- settings.username = 'admin';
899
- startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
900
- return;
901
- } else {
902
- console.log('Success');
903
- settings.xxsocket.end();
904
- exit(0);
905
- return;
906
- }
907
- }
908
- settings.xxsocket.end();
909
- exit(1);
910
-}
831
832
833
//
@@ -976,11 +896,11 @@ function getTrustedHashes(amtMei, func, tag) {
896
}
897
898
//
979
-// Activate Intel AMT to ACM
899
+// Activate Intel AMT to with server (ACM or CCM)
900
//
901
902
function activeToACM() {
983
- console.log('Starting Intel AMT provisioning to Admin Control Mode (ACM) attempt...');
903
+ console.log('Starting Intel AMT activation attempt...');
904
settings.noconsole = true;
905
906
// Display Intel AMT version and activation state
@@ -992,10 +912,11 @@ function activeToACM() {
912
amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
913
amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
914
amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
915
+ amtMei.getControlMode(function (result) { if (result != null) { mestate.controlMode = result.controlMode; } }); // controlMode: 0 = NoActivated, 1 = CCM, 2 = ACM
916
amtMei.getDnsSuffix(function (result) {
917
if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
918
if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
998
- if (mestate.ProvisioningState.state !== 0) { console.log("Intel AMT is not in pre-provisioning state: " + mestate.ProvisioningState.stateStr); exit(100); return; }
919
+ if ((settings.action != 'amtdiscover') && (mestate.controlMode == 2)) { console.log("Intel AMT already activation in admin control mode."); exit(100); return; }
920
if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
921
var fqdn = null;
922
if ((mestate.net0 == null) && (meinfo.net0.enabled != 0)) { console.log("No Intel AMT wired interface, can't perform ACM activation."); exit(100); return; }
@@ -1025,12 +946,13 @@ function getFwNonce() {
946
if (status != 200) { console.log("Unable to get firmware activation nonce, status=" + status); exit(100); return; }
947
var fwNonce = responses['IPS_HostBasedSetupService'].response['ConfigurationNonce'];
948
var digestRealm = responses['AMT_GeneralSettings'].response['DigestRealm'];
1028
- activeToACMEx(fwNonce, settings.fqdn, digestRealm, settings.uuid);
949
+ var allowedModes = responses['IPS_HostBasedSetupService'].response['AllowedControlModes']; // 1 = CCM, 2 = ACM
950
+ activeToACMEx(fwNonce, settings.fqdn, digestRealm, settings.uuid, allowedModes);
951
});
952
}
953
954
// Connect to the activation server and perform ACM activation
1033
-function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
955
+function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid, allowedModes) {
956
console.log('FQDN: ' + dnsSuffix);
957
console.log('UUID: ' + uuid);
958
console.log('Realm: ' + digestRealm);
@@ -1039,11 +961,11 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
961
962
// Establish WebSocket connection to activation server
963
var options = http.parseUri(settings.url);
1042
- //options.checkServerIdentity = function (clientName, certs) { }; // TODO
964
options.checkServerIdentity = onVerifyServer;
965
options.rejectUnauthorized = false;
966
var connection = http.request(options);
967
connection.on('upgrade', function (response, socket) {
968
+ settings.xxsocket = socket;
969
console.log('Connected, requesting activation...');
970
socket.on('end', function () { console.log('Connection closed'); exit(0); });
971
socket.on('error', function () { console.log('Connection error'); exit(100); });
@@ -1053,52 +975,135 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
975
try { cmd = JSON.parse(data); } catch (ex) { console.log('Unable to parse server response: ' + data); exit(100); return; }
976
if (typeof cmd != 'object') { console.log('Invalid server response: ' + cmd); exit(100); return; }
977
if (typeof cmd.errorText == 'string') { console.log('Server error: ' + cmd.errorText); exit(100); return; }
1056
- if (cmd.action != 'acmactivate') { console.log('Invalid server response, command: ' + cmd.cmd); exit(100); return; }
1057
- if (typeof cmd.signature != 'string') { console.log('Invalid server signature'); exit(100); return; }
1058
- if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
1059
- if (typeof cmd.nonce != 'string') { console.log('Invalid server nonce'); exit(100); return; }
1060
- if (typeof cmd.certs != 'object') { console.log('Invalid server certificates'); exit(100); return; }
1061
-
1062
- // We are ready to go, perform activation.
1063
- cmd.index = 0;
1064
- performAcmActivation(cmd, function (result) {
1065
- if (result == false) {
1066
- console.log('Intel AMT ACM activation failed.');
1067
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-failed', uuid: mestate.uuid });
1068
- socket.end();
1069
- exit(1);
1070
- } else {
1071
- if ((cmd.profileScript !== null) && (cmd.rawpassword != null)) {
1072
- console.log('Intel AMT ACM activation success, applying profile...');
1073
- settings.scriptjson = cmd.profileScript;
1074
- settings.password = cmd.rawpassword; // This is only going to work if the server sends the raw password
1075
- settings.username = 'admin';
1076
- startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
978
+ switch (cmd.action) {
979
+ case 'acmactivate': {
980
+ // Server responded with ACM activation response
981
+ if (typeof cmd.signature != 'string') { console.log('Invalid server signature'); exit(100); return; }
982
+ if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
983
+ if (typeof cmd.nonce != 'string') { console.log('Invalid server nonce'); exit(100); return; }
984
+ if (typeof cmd.certs != 'object') { console.log('Invalid server certificates'); exit(100); return; }
985
+
986
+ cmd.index = 0;
987
+ // If we are in CCM mode, deactivate.
988
+ if (mestate.controlMode == 1) {
989
+ amtMei.unprovision(1, function (status) {
990
+ if (status == 0) {
991
+ console.log('Intel AMT CCM deactivated, holding 10 seconds...');
992
+ // We are ready to go, perform ACM activation.
993
+ settings.xxTimer = setTimeout(function () { performAcmActivation(cmd, AcmActivationCompleted); }, 10000);
994
+ } else {
995
+ console.log('Intel AMT CCM deactivation error ' + status); exit(1); return;
996
+ }
997
+ });
998
} else {
1078
- console.log('Intel AMT ACM activation success.');
1079
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-success', uuid: mestate.uuid });
1080
- socket.end();
1081
- exit(0);
999
+ // We are ready to go, perform ACM activation.
1000
+ performAcmActivation(cmd, AcmActivationCompleted);
1001
}
1002
+ break;
1003
}
1084
- });
1004
+ case 'ccmactivate': {
1005
+ // Server responded with CCM activation response
1006
+ if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
1007
+ settings.xxprofileScript = cmd.profileScript;
1008
+ settings.xxrawpassword = cmd.rawpassword;
1009
+
1010
+ // If we are already in CCM mode, deactivate.
1011
+ if (mestate.controlMode == 1) {
1012
+ amtMei.unprovision(1, function (status) {
1013
+ if (status == 0) {
1014
+ console.log('Intel AMT CCM deactivated, holding 10 seconds...');
1015
+ // We are ready to go, perform CCM activation.
1016
+ settings.xxTimer = setTimeout(function () { osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, performCcmActivation); }, 10000);
1017
+ } else {
1018
+ console.log('Intel AMT CCM deactivation error ' + status); exit(1); return;
1019
+ }
1020
+ });
1021
+ } else {
1022
+ // We are ready to go, perform CCM activation.
1023
+ osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, performCcmActivation);
1024
+ }
1025
+ break;
1026
+ }
1027
+ case 'amtdiscover': {
1028
+ console.log('Done.');
1029
+ exit(0);
1030
+ break;
1031
+ }
1032
+ default: {
1033
+ console.log('Invalid server response, command: ' + cmd.action); exit(100);
1034
+ break;
1035
+ }
1036
+ }
1037
});
1086
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate', fqdn: dnsSuffix, realm: digestRealm, nonce: fwNonce, uuid: uuid, profile: settings.profile, hashes: trustedHashes, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'] });
1038
+
1039
+ var action = 'acmactivate';
1040
+ if (settings.action == 'amtccm') { action = 'ccmactivate'; }
1041
+ if (settings.action == 'amtdiscover') { action = 'amtdiscover'; }
1042
+ socket.write({ client: 'meshcmd', version: 1, action: action, fqdn: dnsSuffix, realm: digestRealm, nonce: fwNonce, uuid: uuid, profile: settings.profile, hashes: trustedHashes, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'], modes: allowedModes, currentMode: mestate.controlMode });
1043
});
1044
connection.end();
1045
}
1046
1047
+function performCcmActivation(stack, name, responses, status) {
1048
+ if (status != 200) {
1049
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
1050
+ console.log('Failed to activate, status ' + status);
1051
+ } else if (responses.Body.ReturnValue != 0) {
1052
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
1053
+ console.log('Intel AMT CCM activation failed: ' + responses.Body.ReturnValueStr);
1054
+ } else {
1055
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-success', uuid: mestate.uuid });
1056
+ if ((settings.xxprofileScript !== null) && (settings.xxrawpassword != null)) {
1057
+ console.log("Intel AMT CCM activation success, applying profile...");
1058
+ settings.scriptjson = settings.xxprofileScript;
1059
+ settings.password = settings.xxrawpassword; // This is only going to work if the server sends the raw password
1060
+ settings.username = 'admin';
1061
+ startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
1062
+ return;
1063
+ } else {
1064
+ console.log('Intel AMT CCM activation success.');
1065
+ settings.xxsocket.end();
1066
+ exit(0);
1067
+ return;
1068
+ }
1069
+ }
1070
+ settings.xxsocket.end();
1071
+ exit(1);
1072
+}
1073
+
1074
+function AcmActivationCompleted(result) {
1075
+ if (result == false) {
1076
+ console.log('Intel AMT ACM activation failed.');
1077
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-failed', uuid: mestate.uuid });
1078
+ settings.xxsocket.end();
1079
+ exit(1);
1080
+ } else {
1081
+ if ((cmd.profileScript !== null) && (cmd.rawpassword != null)) {
1082
+ console.log('Intel AMT ACM activation success, applying profile...');
1083
+ settings.scriptjson = cmd.profileScript;
1084
+ settings.password = cmd.rawpassword; // This is only going to work if the server sends the raw password
1085
+ settings.username = 'admin';
1086
+ startMeScriptEx(function () { console.log('Intel AMT profile applied.'); settings.xxsocket.end(); exit(0); }, stack);
1087
+ } else {
1088
+ console.log('Intel AMT ACM activation success.');
1089
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-success', uuid: mestate.uuid });
1090
+ settings.xxsocket.end();
1091
+ exit(0);
1092
+ }
1093
+ }
1094
+}
1095
+
1096
// Recursive function to inject the provisioning certificates into AMT in the proper order and completes ACM activation
1097
function performAcmActivation(acmdata, func) {
1098
var leaf = (acmdata.index == 0), root = (acmdata.index == (acmdata.certs.length - 1));
1099
if ((acmdata.index < acmdata.certs.length) && (acmdata.certs[acmdata.index] != null)) {
1100
osamtstack.IPS_HostBasedSetupService_AddNextCertInChain(acmdata.certs[acmdata.index], leaf, root, function (stack, name, responses, status) {
1096
- if (status !== 200) { debug('AddNextCertInChain status: ' + status); return; }
1097
- else if (responses['Body']['ReturnValue'] !== 0) { console.log('AddNextCertInChain error: ' + responses['Body']['ReturnValue']); return; }
1101
+ if (status !== 200) { console.log('AddNextCertInChain error, status=' + status); exit(1); return; }
1102
+ else if (responses['Body']['ReturnValue'] !== 0) { console.log('AddNextCertInChain error: ' + responses['Body']['ReturnValue']); exit(1); return; }
1103
else { acmdata.index++; performAcmActivation(acmdata, func); }
1104
});
1105
} else {
1101
- console.log(acmdata.password, acmdata.nonce, acmdata.signature);
1106
+ //console.log(acmdata.password, acmdata.nonce, acmdata.signature);
1107
osamtstack.IPS_HostBasedSetupService_AdminSetup(2, acmdata.password, acmdata.nonce, 2, acmdata.signature,
1108
function (stack, name, responses, status) {
1109
if (status !== 200) { console.log('Error, AdminSetup status: ' + status); }
@@ -1181,7 +1186,6 @@ function startMeScriptEx(callback, amtstack) {
1186
// FETCH ALL INTEL AMT STATE
1187
//
1188
1184
-
1189
function saveEntireAmtState2() {
1190
console.log('Fetching all Intel AMT state, this may take a few minutes...');
1191
var transport = require('amt-wsman-duk');
agents/meshcmd.min.js
+127
-123
@@ -517,13 +517,18 @@ function run(argv) {
517
settings.protocol = 'http:';
518
settings.localport = 16992;
519
debug(1, "Settings: " + JSON.stringify(settings));
520
- if (settings.password != null) { activeToCCM(); } else { activeServerCCM(); }
520
+ if (settings.password != null) { activeToCCM(); } else { activeToACM(); }
521
} else if (settings.action == 'amtacm') {
522
// Start activation to ACM
523
if ((settings.url == null) || (typeof settings.url != 'string') || (settings.url == '')) { console.log('No activation server URL specified, use --url [url].'); exit(1); return; }
524
if ((typeof settings.profile != 'string') || (settings.profile == '')) { settings.profile = null; }
525
debug(1, "Settings: " + JSON.stringify(settings));
526
activeToACM();
527
+ } else if (settings.action == 'amtdiscover') {
528
+ // Intel AMT server discovery, tell the server the state of Intel AMT.
529
+ if ((settings.url == null) || (typeof settings.url != 'string') || (settings.url == '')) { console.log('No activation server URL specified, use --url [url].'); exit(1); return; }
530
+ debug(1, "Settings: " + JSON.stringify(settings));
531
+ activeToACM();
532
} else if (settings.action == 'amtdeactivate') {
533
// Deactivate CCM
534
debug(1, "Settings: " + JSON.stringify(settings));
@@ -823,91 +828,6 @@ function activeToCCMEx3(stack, name, responses, status) {
828
}
829
830
826
-//
827
-// Activate Intel AMT to CCM with server activation
828
-//
829
-
830
-function activeServerCCM() {
831
- settings.noconsole = true;
832
- mestate = {};
833
- var amtMeiModule, amtMei;
834
- try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
835
- amtMei.on('error', function (e) { console.log('ERROR: ' + e); exit(1); return; });
836
- amtMei.getProvisioningState(function (result) { if (result) { mestate.ProvisioningState = result; } });
837
- amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
838
- amtMei.getUuid(function (result) {
839
- if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; }
840
- if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
841
- if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
842
- if (mestate.ProvisioningState.state !== 0) { console.log("Intel AMT is not in pre-provisioning state: " + mestate.ProvisioningState.stateStr); exit(100); return; }
843
- if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
844
- startLms(activeServerCCMEx);
845
- });
846
-}
847
-
848
-function activeServerCCMEx(state) {
849
- osamtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], activeServerCCMEx2);
850
-}
851
-
852
-function activeServerCCMEx2(stack, name, responses, status) {
853
- if (status != 200) { console.log('Failed to fetch activation status, status ' + status); exit(1); }
854
- else if (responses['IPS_HostBasedSetupService'].response['AllowedControlModes'].length != 2) { console.log('Client control mode activation not allowed'); exit(1); }
855
-
856
- // Establish WebSocket connection to activation server
857
- var options = http.parseUri(settings.url);
858
- options.checkServerIdentity = onVerifyServer;
859
- options.rejectUnauthorized = false;
860
- var connection = http.request(options);
861
- connection.on('upgrade', function (response, socket) {
862
- console.log('Connected, requesting activation...');
863
- settings.xxsocket = socket;
864
- socket.on('end', function () { console.log('Connection closed'); exit(0); });
865
- socket.on('error', function () { console.log('Connection error'); exit(100); });
866
- socket.on('data', function (data) {
867
- // Parse and check the response
868
- var cmd = null;
869
- try { cmd = JSON.parse(data); } catch (ex) { console.log('Unable to parse server response: ' + data); exit(100); return; }
870
- if (typeof cmd != 'object') { console.log('Invalid server response: ' + cmd); exit(100); return; }
871
- if (typeof cmd.errorText == 'string') { console.log('Server error: ' + cmd.errorText); exit(100); return; }
872
- if (cmd.action != 'ccmactivate') { console.log('Invalid server response, command: ' + cmd.cmd); exit(100); return; }
873
- if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
874
- settings.xxprofileScript = cmd.profileScript;
875
- settings.xxrawpassword = cmd.rawpassword;
876
-
877
- // We are ready to go, perform CCM activation.
878
- osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, activeServerCCMEx3);
879
- });
880
- socket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate', realm: responses['AMT_GeneralSettings'].response['DigestRealm'], uuid: mestate.uuid, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'] });
881
- });
882
- connection.end();
883
-}
884
-
885
-function activeServerCCMEx3(stack, name, responses, status) {
886
- if (status != 200) {
887
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
888
- console.log('Failed to activate, status ' + status);
889
- } else if (responses.Body.ReturnValue != 0) {
890
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
891
- console.log('Client control mode activation failed: ' + responses.Body.ReturnValueStr);
892
- } else {
893
- settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-success', uuid: mestate.uuid });
894
- if ((settings.xxprofileScript !== null) && (settings.xxrawpassword != null)) {
895
- console.log("Intel AMT ACM activation success, applying profile...");
896
- settings.scriptjson = settings.xxprofileScript;
897
- settings.password = settings.xxrawpassword; // This is only going to work if the server sends the raw password
898
- settings.username = 'admin';
899
- startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
900
- return;
901
- } else {
902
- console.log('Success');
903
- settings.xxsocket.end();
904
- exit(0);
905
- return;
906
- }
907
- }
908
- settings.xxsocket.end();
909
- exit(1);
910
-}
831
832
833
//
@@ -976,11 +896,11 @@ function getTrustedHashes(amtMei, func, tag) {
896
}
897
898
//
979
-// Activate Intel AMT to ACM
899
+// Activate Intel AMT to with server (ACM or CCM)
900
//
901
902
function activeToACM() {
983
- console.log('Starting Intel AMT provisioning to Admin Control Mode (ACM) attempt...');
903
+ console.log('Starting Intel AMT activation attempt...');
904
settings.noconsole = true;
905
906
// Display Intel AMT version and activation state
@@ -992,10 +912,11 @@ function activeToACM() {
912
amtMei.getVersion(function (val) { mestate.vers = {}; if (val != null) { for (var version in val.Versions) { mestate.vers[val.Versions[version].Description] = val.Versions[version].Version; } } });
913
amtMei.getLanInterfaceSettings(0, function (result) { if (result) { mestate.net0 = result; } });
914
amtMei.getUuid(function (result) { if ((result != null) && (result.uuid != null)) { mestate.uuid = result.uuid; } });
915
+ amtMei.getControlMode(function (result) { if (result != null) { mestate.controlMode = result.controlMode; } }); // controlMode: 0 = NoActivated, 1 = CCM, 2 = ACM
916
amtMei.getDnsSuffix(function (result) {
917
if ((mestate.vers == null) || (mestate.vers['AMT'] == null)) { console.log("Unable to get Intel AMT version."); exit(100); return; }
918
if (mestate.ProvisioningState == null) { console.log("Unable to read Intel AMT activation state."); exit(100); return; }
998
- if (mestate.ProvisioningState.state !== 0) { console.log("Intel AMT is not in pre-provisioning state: " + mestate.ProvisioningState.stateStr); exit(100); return; }
919
+ if ((settings.action != 'amtdiscover') && (mestate.controlMode == 2)) { console.log("Intel AMT already activation in admin control mode."); exit(100); return; }
920
if (mestate.uuid == null) { console.log("Unable to get Intel AMT UUID."); exit(100); return; }
921
var fqdn = null;
922
if ((mestate.net0 == null) && (meinfo.net0.enabled != 0)) { console.log("No Intel AMT wired interface, can't perform ACM activation."); exit(100); return; }
@@ -1025,12 +946,13 @@ function getFwNonce() {
946
if (status != 200) { console.log("Unable to get firmware activation nonce, status=" + status); exit(100); return; }
947
var fwNonce = responses['IPS_HostBasedSetupService'].response['ConfigurationNonce'];
948
var digestRealm = responses['AMT_GeneralSettings'].response['DigestRealm'];
1028
- activeToACMEx(fwNonce, settings.fqdn, digestRealm, settings.uuid);
949
+ var allowedModes = responses['IPS_HostBasedSetupService'].response['AllowedControlModes']; // 1 = CCM, 2 = ACM
950
+ activeToACMEx(fwNonce, settings.fqdn, digestRealm, settings.uuid, allowedModes);
951
});
952
}
953
954
// Connect to the activation server and perform ACM activation
1033
-function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
955
+function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid, allowedModes) {
956
console.log('FQDN: ' + dnsSuffix);
957
console.log('UUID: ' + uuid);
958
console.log('Realm: ' + digestRealm);
@@ -1039,11 +961,11 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
961
962
// Establish WebSocket connection to activation server
963
var options = http.parseUri(settings.url);
1042
- //options.checkServerIdentity = function (clientName, certs) { }; // TODO
964
options.checkServerIdentity = onVerifyServer;
965
options.rejectUnauthorized = false;
966
var connection = http.request(options);
967
connection.on('upgrade', function (response, socket) {
968
+ settings.xxsocket = socket;
969
console.log('Connected, requesting activation...');
970
socket.on('end', function () { console.log('Connection closed'); exit(0); });
971
socket.on('error', function () { console.log('Connection error'); exit(100); });
@@ -1053,52 +975,135 @@ function activeToACMEx(fwNonce, dnsSuffix, digestRealm, uuid) {
975
try { cmd = JSON.parse(data); } catch (ex) { console.log('Unable to parse server response: ' + data); exit(100); return; }
976
if (typeof cmd != 'object') { console.log('Invalid server response: ' + cmd); exit(100); return; }
977
if (typeof cmd.errorText == 'string') { console.log('Server error: ' + cmd.errorText); exit(100); return; }
1056
- if (cmd.action != 'acmactivate') { console.log('Invalid server response, command: ' + cmd.cmd); exit(100); return; }
1057
- if (typeof cmd.signature != 'string') { console.log('Invalid server signature'); exit(100); return; }
1058
- if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
1059
- if (typeof cmd.nonce != 'string') { console.log('Invalid server nonce'); exit(100); return; }
1060
- if (typeof cmd.certs != 'object') { console.log('Invalid server certificates'); exit(100); return; }
1061
-
1062
- // We are ready to go, perform activation.
1063
- cmd.index = 0;
1064
- performAcmActivation(cmd, function (result) {
1065
- if (result == false) {
1066
- console.log('Intel AMT ACM activation failed.');
1067
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-failed', uuid: mestate.uuid });
1068
- socket.end();
1069
- exit(1);
1070
- } else {
1071
- if ((cmd.profileScript !== null) && (cmd.rawpassword != null)) {
1072
- console.log('Intel AMT ACM activation success, applying profile...');
1073
- settings.scriptjson = cmd.profileScript;
1074
- settings.password = cmd.rawpassword; // This is only going to work if the server sends the raw password
1075
- settings.username = 'admin';
1076
- startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
978
+ switch (cmd.action) {
979
+ case 'acmactivate': {
980
+ // Server responded with ACM activation response
981
+ if (typeof cmd.signature != 'string') { console.log('Invalid server signature'); exit(100); return; }
982
+ if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
983
+ if (typeof cmd.nonce != 'string') { console.log('Invalid server nonce'); exit(100); return; }
984
+ if (typeof cmd.certs != 'object') { console.log('Invalid server certificates'); exit(100); return; }
985
+
986
+ cmd.index = 0;
987
+ // If we are in CCM mode, deactivate.
988
+ if (mestate.controlMode == 1) {
989
+ amtMei.unprovision(1, function (status) {
990
+ if (status == 0) {
991
+ console.log('Intel AMT CCM deactivated, holding 10 seconds...');
992
+ // We are ready to go, perform ACM activation.
993
+ settings.xxTimer = setTimeout(function () { performAcmActivation(cmd, AcmActivationCompleted); }, 10000);
994
+ } else {
995
+ console.log('Intel AMT CCM deactivation error ' + status); exit(1); return;
996
+ }
997
+ });
998
} else {
1078
- console.log('Intel AMT ACM activation success.');
1079
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-success', uuid: mestate.uuid });
1080
- socket.end();
1081
- exit(0);
999
+ // We are ready to go, perform ACM activation.
1000
+ performAcmActivation(cmd, AcmActivationCompleted);
1001
}
1002
+ break;
1003
}
1084
- });
1004
+ case 'ccmactivate': {
1005
+ // Server responded with CCM activation response
1006
+ if (typeof cmd.password != 'string') { console.log('Invalid server password'); exit(100); return; }
1007
+ settings.xxprofileScript = cmd.profileScript;
1008
+ settings.xxrawpassword = cmd.rawpassword;
1009
+
1010
+ // If we are already in CCM mode, deactivate.
1011
+ if (mestate.controlMode == 1) {
1012
+ amtMei.unprovision(1, function (status) {
1013
+ if (status == 0) {
1014
+ console.log('Intel AMT CCM deactivated, holding 10 seconds...');
1015
+ // We are ready to go, perform CCM activation.
1016
+ settings.xxTimer = setTimeout(function () { osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, performCcmActivation); }, 10000);
1017
+ } else {
1018
+ console.log('Intel AMT CCM deactivation error ' + status); exit(1); return;
1019
+ }
1020
+ });
1021
+ } else {
1022
+ // We are ready to go, perform CCM activation.
1023
+ osamtstack.IPS_HostBasedSetupService_Setup(2, cmd.password, null, null, null, null, performCcmActivation);
1024
+ }
1025
+ break;
1026
+ }
1027
+ case 'amtdiscover': {
1028
+ console.log('Done.');
1029
+ exit(0);
1030
+ break;
1031
+ }
1032
+ default: {
1033
+ console.log('Invalid server response, command: ' + cmd.action); exit(100);
1034
+ break;
1035
+ }
1036
+ }
1037
});
1086
- socket.write({ client: 'meshcmd', version: 1, action: 'acmactivate', fqdn: dnsSuffix, realm: digestRealm, nonce: fwNonce, uuid: uuid, profile: settings.profile, hashes: trustedHashes, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'] });
1038
+
1039
+ var action = 'acmactivate';
1040
+ if (settings.action == 'amtccm') { action = 'ccmactivate'; }
1041
+ if (settings.action == 'amtdiscover') { action = 'amtdiscover'; }
1042
+ socket.write({ client: 'meshcmd', version: 1, action: action, fqdn: dnsSuffix, realm: digestRealm, nonce: fwNonce, uuid: uuid, profile: settings.profile, hashes: trustedHashes, tag: settings.tag, name: settings.name, ver: mestate.vers['AMT'], modes: allowedModes, currentMode: mestate.controlMode });
1043
});
1044
connection.end();
1045
}
1046
1047
+function performCcmActivation(stack, name, responses, status) {
1048
+ if (status != 200) {
1049
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
1050
+ console.log('Failed to activate, status ' + status);
1051
+ } else if (responses.Body.ReturnValue != 0) {
1052
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-failed', uuid: mestate.uuid });
1053
+ console.log('Intel AMT CCM activation failed: ' + responses.Body.ReturnValueStr);
1054
+ } else {
1055
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'ccmactivate-success', uuid: mestate.uuid });
1056
+ if ((settings.xxprofileScript !== null) && (settings.xxrawpassword != null)) {
1057
+ console.log("Intel AMT CCM activation success, applying profile...");
1058
+ settings.scriptjson = settings.xxprofileScript;
1059
+ settings.password = settings.xxrawpassword; // This is only going to work if the server sends the raw password
1060
+ settings.username = 'admin';
1061
+ startMeScriptEx(function () { console.log('Intel AMT profile applied.'); socket.end(); exit(0); }, stack);
1062
+ return;
1063
+ } else {
1064
+ console.log('Intel AMT CCM activation success.');
1065
+ settings.xxsocket.end();
1066
+ exit(0);
1067
+ return;
1068
+ }
1069
+ }
1070
+ settings.xxsocket.end();
1071
+ exit(1);
1072
+}
1073
+
1074
+function AcmActivationCompleted(result) {
1075
+ if (result == false) {
1076
+ console.log('Intel AMT ACM activation failed.');
1077
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-failed', uuid: mestate.uuid });
1078
+ settings.xxsocket.end();
1079
+ exit(1);
1080
+ } else {
1081
+ if ((cmd.profileScript !== null) && (cmd.rawpassword != null)) {
1082
+ console.log('Intel AMT ACM activation success, applying profile...');
1083
+ settings.scriptjson = cmd.profileScript;
1084
+ settings.password = cmd.rawpassword; // This is only going to work if the server sends the raw password
1085
+ settings.username = 'admin';
1086
+ startMeScriptEx(function () { console.log('Intel AMT profile applied.'); settings.xxsocket.end(); exit(0); }, stack);
1087
+ } else {
1088
+ console.log('Intel AMT ACM activation success.');
1089
+ settings.xxsocket.write({ client: 'meshcmd', version: 1, action: 'acmactivate-success', uuid: mestate.uuid });
1090
+ settings.xxsocket.end();
1091
+ exit(0);
1092
+ }
1093
+ }
1094
+}
1095
+
1096
// Recursive function to inject the provisioning certificates into AMT in the proper order and completes ACM activation
1097
function performAcmActivation(acmdata, func) {
1098
var leaf = (acmdata.index == 0), root = (acmdata.index == (acmdata.certs.length - 1));
1099
if ((acmdata.index < acmdata.certs.length) && (acmdata.certs[acmdata.index] != null)) {
1100
osamtstack.IPS_HostBasedSetupService_AddNextCertInChain(acmdata.certs[acmdata.index], leaf, root, function (stack, name, responses, status) {
1096
- if (status !== 200) { debug('AddNextCertInChain status: ' + status); return; }
1097
- else if (responses['Body']['ReturnValue'] !== 0) { console.log('AddNextCertInChain error: ' + responses['Body']['ReturnValue']); return; }
1101
+ if (status !== 200) { console.log('AddNextCertInChain error, status=' + status); exit(1); return; }
1102
+ else if (responses['Body']['ReturnValue'] !== 0) { console.log('AddNextCertInChain error: ' + responses['Body']['ReturnValue']); exit(1); return; }
1103
else { acmdata.index++; performAcmActivation(acmdata, func); }
1104
});
1105
} else {
1101
- console.log(acmdata.password, acmdata.nonce, acmdata.signature);
1106
+ //console.log(acmdata.password, acmdata.nonce, acmdata.signature);
1107
osamtstack.IPS_HostBasedSetupService_AdminSetup(2, acmdata.password, acmdata.nonce, 2, acmdata.signature,
1108
function (stack, name, responses, status) {
1109
if (status !== 200) { console.log('Error, AdminSetup status: ' + status); }
@@ -1181,7 +1186,6 @@ function startMeScriptEx(callback, amtstack) {
1186
// FETCH ALL INTEL AMT STATE
1187
//
1188
1184
-
1189
function saveEntireAmtState2() {
1190
console.log('Fetching all Intel AMT state, this may take a few minutes...');
1191
var transport = require('amt-wsman-duk');
webserver.js
+50
-53
@@ -2190,73 +2190,74 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2190
2191
// Process the command
2192
switch (cmd.action) {
2193
- case 'ccmactivate': {
2194
- // Check the command
2195
- if (cmd.version != 1) { ws.send(JSON.stringify({ errorText: 'Unsupported version' })); ws.close(); return; }
2196
- if (obj.common.validateString(cmd.realm, 16, 256) == false) { ws.send(JSON.stringify({ errorText: 'Invalid realm argument' })); ws.close(); return; }
2197
- if (obj.common.validateString(cmd.uuid, 36, 36) == false) { ws.send(JSON.stringify({ errorText: 'Invalid UUID argument' })); ws.close(); return; }
2198
- if ((obj.common.validateString(cmd.ver, 5, 16) == false) || (cmd.ver.split('.').length != 3)) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT version' })); ws.close(); return; }
2199
-
2200
- // Get the current Intel AMT policy
2201
- var mesh = obj.meshes[ws.meshid];
2202
- if ((mesh == null) || (mesh.amt == null) || (mesh.amt.type != 2) || (mesh.amt.password == null)) { ws.send(JSON.stringify({ errorText: 'Unable to activate' })); ws.close(); return; }
2203
-
2204
- // Get the Intel AMT admin password, randomize if needed.
2205
- var amtpassword = ((mesh.amt.password == '') ? getRandomAmtPassword() : mesh.amt.password);
2206
- if (checkAmtPassword(amtpassword) == false) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT password' })); ws.close(); return; } // Invalid Intel AMT password, this should never happen.
2207
-
2208
- // Log the activation request, logging is a required step for activation.
2209
- if (parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: 'ccmactivate', domain: domain.id, amtUuid: cmd.uuid, amtRealm: cmd.realm, user: 'admin', password: amtpassword, ipport: ws.remoteaddrport, meshid: ws.meshid, tag: cmd.tag, name: cmd.name }) == false) return { errorText: 'Unable to log operation' };
2210
-
2211
- // Save some state, if activation is succesful, we need this to add the device
2212
- ws.xxstate = { uuid: cmd.uuid, realm: cmd.realm, tag: cmd.tag, name: cmd.name, pass: amtpassword, flags: 2, ver: cmd.ver }; // Flags 2 = CCM
2213
-
2214
- // Compute the HTTP digest hash and send the response
2215
- ws.send(JSON.stringify({ action: 'ccmactivate', password: obj.crypto.createHash('md5').update('admin:' + cmd.realm + ':' + amtpassword).digest('hex') }));
2216
- break;
2193
+ case 'amtdiscover': {
2194
+ console.log(cmd);
2195
+ ws.send(JSON.stringify({ action: 'amtdiscover' }));
2196
+ ws.close();
2197
+ return;
2198
}
2199
+ case 'ccmactivate':
2200
case 'acmactivate': {
2201
// Check the command
2202
if (cmd.version != 1) { ws.send(JSON.stringify({ errorText: 'Unsupported version' })); ws.close(); return; }
2203
+ if (obj.common.validateString(cmd.realm, 16, 256) == false) { ws.send(JSON.stringify({ errorText: 'Invalid realm argument' })); ws.close(); return; }
2204
+ if (obj.common.validateString(cmd.uuid, 36, 36) == false) { ws.send(JSON.stringify({ errorText: 'Invalid UUID argument' })); ws.close(); return; }
2205
if (typeof cmd.hashes != 'object') { ws.send(JSON.stringify({ errorText: 'Invalid hashes' })); ws.close(); return; }
2206
if (typeof cmd.fqdn != 'string') { ws.send(JSON.stringify({ errorText: 'Invalid FQDN' })); ws.close(); return; }
2207
if ((obj.common.validateString(cmd.ver, 5, 16) == false) || (cmd.ver.split('.').length != 3)) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT version' })); ws.close(); return; }
2208
+ if (obj.common.validateArray(cmd.modes, 1, 2) == false) { ws.send(JSON.stringify({ errorText: 'Invalid activation modes' })); ws.close(); return; }
2209
2210
// Get the current Intel AMT policy
2226
- var mesh = obj.meshes[ws.meshid];
2227
- if ((mesh == null) || (mesh.amt == null) || (mesh.amt.type != 3) || (domain.amtacmactivation == null) || (domain.amtacmactivation.acmmatch == null) || (mesh.amt.password == null)) { ws.send(JSON.stringify({ errorText: 'Unable to activate' })); ws.close(); return; }
2228
-
2229
- // Check if we have a FQDN/Hash match
2230
- var matchingHash = null, matchingCN = null;
2231
- for (var i in domain.amtacmactivation.acmmatch) {
2232
- // Check for a matching FQDN
2233
- if ((domain.amtacmactivation.acmmatch[i].cn == '*') || (domain.amtacmactivation.acmmatch[i].cn.toLowerCase() == cmd.fqdn)) {
2234
- // Check for a matching certificate
2235
- if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha256) >= 0) {
2236
- matchingCN = domain.amtacmactivation.acmmatch[i].cn;
2237
- matchingHash = domain.amtacmactivation.acmmatch[i].sha256;
2238
- continue;
2239
- } else if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha1) >= 0) {
2240
- matchingCN = domain.amtacmactivation.acmmatch[i].cn;
2241
- matchingHash = domain.amtacmactivation.acmmatch[i].sha1;
2242
- continue;
2211
+ var mesh = obj.meshes[ws.meshid], activationMode = 4; // activationMode: 2 = CCM, 4 = ACM
2212
+ if ((mesh == null) || (mesh.amt == null) || (mesh.amt.password == null) || ((mesh.amt.type != 2) && (mesh.amt.type != 3))) { ws.send(JSON.stringify({ errorText: 'Unable to activate' })); ws.close(); return; }
2213
+ if ((mesh.amt.type != 3) || (domain.amtacmactivation == null) || (domain.amtacmactivation.acmmatch == null)) { activationMode = 2; }
2214
+
2215
+ if (activationMode == 4) {
2216
+ // Check if we have a FQDN/Hash match
2217
+ var matchingHash = null, matchingCN = null;
2218
+ for (var i in domain.amtacmactivation.acmmatch) {
2219
+ // Check for a matching FQDN
2220
+ if ((domain.amtacmactivation.acmmatch[i].cn == '*') || (domain.amtacmactivation.acmmatch[i].cn.toLowerCase() == cmd.fqdn)) {
2221
+ // Check for a matching certificate
2222
+ if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha256) >= 0) {
2223
+ matchingCN = domain.amtacmactivation.acmmatch[i].cn;
2224
+ matchingHash = domain.amtacmactivation.acmmatch[i].sha256;
2225
+ continue;
2226
+ } else if (cmd.hashes.indexOf(domain.amtacmactivation.acmmatch[i].sha1) >= 0) {
2227
+ matchingCN = domain.amtacmactivation.acmmatch[i].cn;
2228
+ matchingHash = domain.amtacmactivation.acmmatch[i].sha1;
2229
+ continue;
2230
+ }
2231
}
2232
}
2233
+ // If no cert match or wildcard match which is not yet supported, do CCM activation.
2234
+ if ((matchingHash == null) || (matchingCN == '*')) { activationMode = 2; } else { cmd.hash = matchingHash; }
2235
}
2246
- if (matchingHash == null) { ws.send(JSON.stringify({ errorText: 'No matching activation certificates' })); ws.close(); return; }
2247
- if (matchingCN == '*') { ws.send(JSON.stringify({ errorText: 'Wildcard certificate activation not yet supported' })); ws.close(); return; }
2248
- cmd.hash = matchingHash;
2236
+
2237
+ // Check if we are going to activate in an allowed mode. cmd.modes: 1 = CCM, 2 = ACM
2238
+ if ((activationMode == 4) && (cmd.modes.indexOf(2) == -1)) { activationMode = 2; } // We want to do ACM, but mode is not allowed. Change to CCM.
2239
+
2240
+ // If we want to do CCM, but mode is not allowed. Error out.
2241
+ if ((activationMode == 2) && (cmd.modes.indexOf(1) == -1)) { ws.send(JSON.stringify({ errorText: 'Unsupported activation mode' })); ws.close(); return; }
2242
2243
// Get the Intel AMT admin password, randomize if needed.
2244
var amtpassword = ((mesh.amt.password == '') ? getRandomAmtPassword() : mesh.amt.password);
2245
if (checkAmtPassword(amtpassword) == false) { ws.send(JSON.stringify({ errorText: 'Invalid Intel AMT password' })); ws.close(); return; } // Invalid Intel AMT password, this should never happen.
2246
2247
// Save some state, if activation is succesful, we need this to add the device
2255
- ws.xxstate = { uuid: cmd.uuid, realm: cmd.realm, tag: cmd.tag, name: cmd.name, pass: amtpassword, flags: 4, ver: cmd.ver }; // Flags 4 = ACM
2248
+ ws.xxstate = { uuid: cmd.uuid, realm: cmd.realm, tag: cmd.tag, name: cmd.name, pass: amtpassword, flags: activationMode, ver: cmd.ver }; // Flags: 2 = CCM, 4 = ACM
2249
+
2250
+ if (activationMode == 4) {
2251
+ // ACM: Agent is asking the server to sign an Intel AMT ACM activation request
2252
+ var signResponse = parent.certificateOperations.signAcmRequest(domain, cmd, 'admin', amtpassword, ws.remoteaddrport, null, ws.meshid, null, null);
2253
+ ws.send(JSON.stringify(signResponse));
2254
+ } else {
2255
+ // CCM: Log the activation request, logging is a required step for activation.
2256
+ if (parent.certificateOperations.logAmtActivation(domain, { time: new Date(), action: 'ccmactivate', domain: domain.id, amtUuid: cmd.uuid, amtRealm: cmd.realm, user: 'admin', password: amtpassword, ipport: ws.remoteaddrport, meshid: ws.meshid, tag: cmd.tag, name: cmd.name }) == false) return { errorText: 'Unable to log operation' };
2257
2257
- // Agent is asking the server to sign an Intel AMT ACM activation request
2258
- var signResponse = parent.certificateOperations.signAcmRequest(domain, cmd, 'admin', amtpassword, ws.remoteaddrport, null, ws.meshid, null, null);
2259
- ws.send(JSON.stringify(signResponse));
2258
+ // Compute the HTTP digest hash and send the response for CCM activation
2259
+ ws.send(JSON.stringify({ action: 'ccmactivate', password: obj.crypto.createHash('md5').update('admin:' + cmd.realm + ':' + amtpassword).digest('hex') }));
2260
+ }
2261
break;
2262
}
2263
case 'ccmactivate-failed':
@@ -2929,6 +2930,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2930
obj.app.ws(url + 'control.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, false, function (ws1, req1, domain, user, cookie) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); }); });
2931
obj.app.get(url + 'logo.png', handleLogoRequest);
2932
obj.app.get(url + 'welcome.jpg', handleWelcomeImageRequest);
2933
+ obj.app.ws(url + 'amtactivate', handleAmtActivateWebSocket);
2934
2935
// Server redirects
2936
if (parent.config.domains[i].redirects) { for (var j in parent.config.domains[i].redirects) { if (j[0] != '_') { obj.app.get(url + j, handleDomainRedirect); } } }
@@ -2967,11 +2969,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2969
});
2970
}
2971
2970
- // Intel AMT ACM activation
2971
- if ((parent.config.domains[i].amtacmactivation != null) && (parent.config.domains[i].amtacmactivation.acmmatch != null)) {
2972
- obj.app.ws(url + 'amtactivate', handleAmtActivateWebSocket);
2973
- }
2974
-
2972
// Creates a login token using the user/pass that is passed in as URL arguments.
2973
// For example: https://localhost/createLoginToken.ashx?user=admin&pass=admin&a=3
2974
// It's not advised to use this to create login tokens since the URL is often logged and you got credentials in the URL.