fix older amt devices with custom amt certificates #6565
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
May 4, 2025 at 14:17 UTC
d9f2f869a28295792b3752268fae6303f3fcfbff
4 files changed
+42
-14
amt/amt-redir-mesh.js
+12
-4
@@ -170,8 +170,12 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me
170
171
// TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
172
const TLSSocket = require('tls').TLSSocket;
173
- const tlsoptions = { minVersion: 'TLSv1', ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
174
- // if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
173
+ const tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
174
+ if (obj.tls1only == 1) {
175
+ tlsoptions.secureProtocol = 'TLSv1_method';
176
+ } else {
177
+ tlsoptions.minVersion = 'TLSv1';
178
+ }
179
const tlsock = new TLSSocket(ser, tlsoptions);
180
tlsock.on('error', function (err) { Debug(1, "CIRA TLS Connection Error ", err); });
181
tlsock.on('secureConnect', function () { Debug(2, "CIRA Secure TLS Connection"); ws._socket.resume(); });
@@ -228,8 +232,12 @@ module.exports.CreateAmtRedirect = function (module, domain, user, webserver, me
232
obj.forwardclient.setEncoding('binary');
233
} else {
234
// If TLS is going to be used, setup a TLS socket
231
- var tlsoptions = { minVersion: 'TLSv1', ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
232
- // if (obj.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
235
+ var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
236
+ if (obj.tls1only == 1) {
237
+ tlsoptions.secureProtocol = 'TLSv1_method';
238
+ } else {
239
+ tlsoptions.minVersion = 'TLSv1';
240
+ }
241
obj.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () {
242
// The TLS connection method is the same as TCP, but located a bit differently.
243
Debug(2, 'TLS Intel AMT transport connected to ' + node.host + ':' + port + '.');
amt/amt-wsman-comm.js
+12
-4
@@ -236,8 +236,12 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
236
if (state == 0) { obj.xxOnSocketClosed(); }
237
if (state == 2) {
238
// TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
239
- var options = { minVersion: 'TLSv1', socket: ser, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE | obj.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
240
- // if (obj.xtlsMethod == 1) { options.secureProtocol = 'TLSv1_method'; }
239
+ var options = { socket: ser, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE | obj.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
240
+ if (obj.xtlsMethod == 1) {
241
+ options.secureProtocol = 'TLSv1_method';
242
+ } else {
243
+ options.minVersion = 'TLSv1';
244
+ }
245
if (obj.xtlsoptions) {
246
if (obj.xtlsoptions.ca) { options.ca = obj.xtlsoptions.ca; }
247
if (obj.xtlsoptions.cert) { options.cert = obj.xtlsoptions.cert; }
@@ -274,8 +278,12 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
278
obj.socket.connect(obj.port, obj.host, obj.xxOnSocketConnected);
279
} else {
280
// Direct connect with TLS
277
- var options = { minVersion: 'TLSv1', ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE | obj.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
278
- // if (obj.xtlsMethod != 0) { options.secureProtocol = 'TLSv1_method'; }
281
+ var options = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE | obj.constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
282
+ if (obj.xtlsMethod == 1) {
283
+ options.secureProtocol = 'TLSv1_method';
284
+ } else {
285
+ options.minVersion = 'TLSv1';
286
+ }
287
if (obj.xtlsoptions) {
288
if (obj.xtlsoptions.ca) { options.ca = obj.xtlsoptions.ca; }
289
if (obj.xtlsoptions.cert) { options.cert = obj.xtlsoptions.cert; }
amtscanner.js
+6
-2
@@ -387,8 +387,12 @@ module.exports.CreateAmtScanner = function (parent) {
387
} else {
388
// Connect using TLS, we will switch from default TLS to TLS1-only and back if we get a connection error to support older Intel AMT.
389
if (scaninfo.tlsoption == null) { scaninfo.tlsoption = 0; }
390
- const tlsOptions = { minVersion: 'TLSv1', rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION };
391
- // if (scaninfo.tlsoption == 1) { tlsOptions.secureProtocol = 'TLSv1_method'; }
390
+ const tlsOptions = { rejectUnauthorized: false, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION };
391
+ if (scaninfo.tlsoption == 1) {
392
+ tlsOptions.secureProtocol = 'TLSv1_method';
393
+ } else {
394
+ tlsOptions.minVersion = 'TLSv1';
395
+ }
396
client = obj.tls.connect(port, host, tlsOptions, function () { this.write('GET / HTTP/1.1\r\nhost: ' + host + '\r\n\r\n'); });
397
}
398
client.scaninfo = scaninfo;
webserver.js
+12
-4
@@ -4854,8 +4854,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
4854
if (state == 0) { try { ws.close(); } catch (e) { } }
4855
if (state == 2) {
4856
// TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
4857
- const tlsoptions = { minVersion: 'TLSv1', socket: ser, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
4858
- // if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
4857
+ const tlsoptions = { socket: ser, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
4858
+ if (req.query.tls1only == 1) {
4859
+ tlsoptions.secureProtocol = 'TLSv1_method';
4860
+ } else {
4861
+ tlsoptions.minVersion = 'TLSv1';
4862
+ }
4863
var tlsock = obj.tls.connect(tlsoptions, function () { parent.debug('webrelay', "CIRA Secure TLS Connection"); ws._socket.resume(); });
4864
tlsock.chnl = chnl;
4865
tlsock.setEncoding('binary');
@@ -5177,8 +5181,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5181
ws._socket.resume();
5182
} else {
5183
// If TLS is going to be used, setup a TLS socket
5180
- var tlsoptions = { minVersion: 'TLSv1', ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
5181
- // if (req.query.tls1only == 1) { tlsoptions.secureProtocol = 'TLSv1_method'; }
5184
+ var tlsoptions = { ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, rejectUnauthorized: false };
5185
+ if (req.query.tls1only == 1) {
5186
+ tlsoptions.secureProtocol = 'TLSv1_method';
5187
+ } else {
5188
+ tlsoptions.minVersion = 'TLSv1';
5189
+ }
5190
ws.forwardclient = obj.tls.connect(port, node.host, tlsoptions, function () {
5191
// The TLS connection method is the same as TCP, but located a bit differently.
5192
parent.debug('webrelay', user.name + ' - TLS connected to ' + node.host + ':' + port + '.');