Added Intel AMT cert private key check.
Ylian Saint-Hilaire committed
Jan 6, 2021 at 03:06 UTC
c6ebdd06d048afac0209f35ca8b991b4d673e0af
1 file changed
+15
certoperations.js
+15
@@ -82,6 +82,15 @@ module.exports.CertificateOperations = function (parent) {
82
// Remove the PEM header, footer and carriage returns so we only have the Base64 DER.
83
function pemToBase64(pem) { return pem.split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('').split('\r\n').join(''); }
84
85
+ // Return true if both arrays match
86
+ function compareArrays(a1, a2) {
87
+ if (Array.isArray(a1) == false) return false;
88
+ if (Array.isArray(a2) == false) return false;
89
+ if (a1.length !== a2.length) return false;
90
+ for (var i = 0; i < a1.length; i++) { if (a1[i] !== a2[i]) return false; }
91
+ return true;
92
+ }
93
+
94
// Log the Intel AMT activation operation in the domain log
95
obj.logAmtActivation = function (domain, x) {
96
if (x == null) return true;
@@ -131,6 +140,12 @@ module.exports.CertificateOperations = function (parent) {
140
if (orderingError == true) continue;
141
r.certs = or;
142
143
+ // Check that the certificate and private key match
144
+ if ((compareArrays(r.certs[0].publicKey.n.data, r.keys[0].n.data) == false) || (compareArrays(r.certs[0].publicKey.e.data, r.keys[0].e.data) == false)) {
145
+ parent.addServerWarning('Intel AMT activation certificate provided with a mismatching private key.');
146
+ continue;
147
+ }
148
+
149
/*
150
// Debug: Display all certs & key as PEM
151
for (var k in r.certs) {