More work on AMT TLS ACM activation.
Ylian Saint-Hilaire committed
Mar 4, 2021 at 01:54 UTC
dc11a44a1900483c8f3feab9f0ac852c5acc4017
5 files changed
+116
-110
agents/modules_meshcmd/amt-mei.js
+40
-50
@@ -24,22 +24,18 @@ function amt_heci() {
24
25
this._ObjectID = "pthi";
26
this._rq = new Q();
27
- this._setupPTHI = function _setupPTHI()
28
- {
27
+ this._setupPTHI = function _setupPTHI() {
28
this._amt = heci.create();
29
this._amt.descriptorMetadata = "amt-pthi";
30
this._amt.BiosVersionLen = 65;
31
this._amt.UnicodeStringLen = 20;
32
33
this._amt.Parent = this;
35
- this._amt.on('error', function _amtOnError(e)
36
- {
37
- if(this.Parent._rq.isEmpty())
38
- {
34
+ this._amt.on('error', function _amtOnError(e) {
35
+ if (this.Parent._rq.isEmpty()) {
36
this.Parent.emit('error', e); // No pending requests, so propagate the error up
37
}
41
- else
42
- {
38
+ else {
39
// There is a pending request, so fail the pending request
40
var user = this.Parent._rq.deQueue();
41
var params = user.optional;
@@ -47,17 +43,14 @@ function amt_heci() {
43
params.unshift({ Status: -1 }); // Relay an error
44
callback.apply(this.Parent, params);
45
50
- if(!this.Parent._rq.isEmpty())
51
- {
46
+ if (!this.Parent._rq.isEmpty()) {
47
// There are still more pending requests, so try to re-helpconnect MEI
48
this.connect(heci.GUIDS.AMT, { noPipeline: 1 });
49
}
50
}
51
});
57
- this._amt.on('connect', function _amtOnConnect()
58
- {
59
- this.on('data', function _amtOnData(chunk)
60
- {
52
+ this._amt.on('connect', function _amtOnConnect() {
53
+ this.on('data', function _amtOnData(chunk) {
54
//console.log("Received: " + chunk.length + " bytes");
55
var header = this.Parent.getCommand(chunk);
56
//console.log("CMD = " + header.Command + " (Status: " + header.Status + ") Response = " + header.IsResponse);
@@ -69,14 +62,12 @@ function amt_heci() {
62
params.unshift(header);
63
callback.apply(this.Parent, params);
64
72
- if(this.Parent._rq.isEmpty())
73
- {
65
+ if (this.Parent._rq.isEmpty()) {
66
// No More Requests, we can close PTHI
67
this.Parent._amt.disconnect();
68
this.Parent._amt = null;
69
}
78
- else
79
- {
70
+ else {
71
// Send the next request
72
this.write(this.Parent._rq.peekQueue().send);
73
}
@@ -93,8 +84,7 @@ function amt_heci() {
84
return (ret);
85
};
86
96
- this.sendCommand = function sendCommand()
97
- {
87
+ this.sendCommand = function sendCommand() {
88
if (arguments.length < 3 || typeof (arguments[0]) != 'number' || typeof (arguments[1]) != 'object' || typeof (arguments[2]) != 'function') { throw ('invalid parameters'); }
89
var args = [];
90
for (var i = 3; i < arguments.length; ++i) { args.push(arguments[i]); }
@@ -102,10 +92,9 @@ function amt_heci() {
92
var header = Buffer.from('010100000000000000000000', 'hex');
93
header.writeUInt32LE(arguments[0] | 0x04000000, 4);
94
header.writeUInt32LE(arguments[1] == null ? 0 : arguments[1].length, 8);
105
- this._rq.enQueue({ cmd: arguments[0], func: arguments[2], optional: args , send: (arguments[1] == null ? header : Buffer.concat([header, arguments[1]]))});
95
+ this._rq.enQueue({ cmd: arguments[0], func: arguments[2], optional: args, send: (arguments[1] == null ? header : Buffer.concat([header, arguments[1]])) });
96
107
- if(!this._amt)
108
- {
97
+ if (!this._amt) {
98
this._setupPTHI();
99
this._amt.connect(heci.GUIDS.AMT, { noPipeline: 1 });
100
}
@@ -117,7 +106,7 @@ function amt_heci() {
106
this.sendCommand(26, null, function (header, fn, opt) {
107
if (header.Status == 0) {
108
var i, CodeVersion = header.Data, val = { BiosVersion: CodeVersion.slice(0, this._amt.BiosVersionLen).toString(), Versions: [] }, v = CodeVersion.slice(this._amt.BiosVersionLen + 4);
120
- for (i = 0; i < CodeVersion.readUInt32LE(this._amt.BiosVersionLen) ; ++i) {
109
+ for (i = 0; i < CodeVersion.readUInt32LE(this._amt.BiosVersionLen); ++i) {
110
val.Versions[i] = { Description: v.slice(2, v.readUInt16LE(0) + 2).toString(), Version: v.slice(4 + this._amt.UnicodeStringLen, 4 + this._amt.UnicodeStringLen + v.readUInt16LE(2 + this._amt.UnicodeStringLen)).toString() };
111
v = v.slice(4 + (2 * this._amt.UnicodeStringLen));
112
}
@@ -302,34 +291,27 @@ function amt_heci() {
291
this.getLocalSystemAccount = function getLocalSystemAccount(callback) {
292
var optional = [];
293
for (var i = 1; i < arguments.length; ++i) { optional.push(arguments[i]); }
305
- this.sendCommand(103, Buffer.alloc(40), function (header, fn, opt)
306
- {
307
- if (header.Status == 0 && header.Data.length == 68)
308
- {
294
+ this.sendCommand(103, Buffer.alloc(40), function (header, fn, opt) {
295
+ if (header.Status == 0 && header.Data.length == 68) {
296
opt.unshift({ user: trim(header.Data.slice(0, 33).toString()), pass: trim(header.Data.slice(33, 67).toString()), raw: header.Data });
297
}
311
- else
312
- {
298
+ else {
299
opt.unshift(null);
300
}
301
fn.apply(this, opt);
302
}, callback, optional);
303
}
318
- this.getLanInterfaceSettings = function getLanInterfaceSettings(index, callback)
319
- {
304
+ this.getLanInterfaceSettings = function getLanInterfaceSettings(index, callback) {
305
var optional = [];
306
for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); }
307
var ifx = Buffer.alloc(4);
308
ifx.writeUInt32LE(index);
324
- this.sendCommand(0x48, ifx, function onGetLanInterfaceSettings(header, fn, opt)
325
- {
326
- if(header.Status == 0)
327
- {
309
+ this.sendCommand(0x48, ifx, function onGetLanInterfaceSettings(header, fn, opt) {
310
+ if (header.Status == 0) {
311
var info = {};
312
info.enabled = header.Data.readUInt32LE(0);
313
info.dhcpEnabled = header.Data.readUInt32LE(8);
331
- switch(header.Data[12])
332
- {
314
+ switch (header.Data[12]) {
315
case 1:
316
info.dhcpMode = 'ACTIVE'
317
break;
@@ -341,14 +323,13 @@ function amt_heci() {
323
break;
324
}
325
info.mac = header.Data.slice(14).toString('hex:');
344
-
326
+
327
var addr = header.Data.readUInt32LE(4);
328
info.address = ((addr >> 24) & 255) + '.' + ((addr >> 16) & 255) + '.' + ((addr >> 8) & 255) + '.' + (addr & 255);
329
opt.unshift(info);
330
fn.apply(this, opt);
331
}
350
- else
351
- {
332
+ else {
333
opt.unshift(null);
334
fn.apply(this, opt);
335
}
@@ -398,21 +379,18 @@ function amt_heci() {
379
fn.apply(this, opt);
380
}, callback, optional);
381
}
401
- this.getProtocolVersion = function getProtocolVersion(callback)
402
- {
382
+ this.getProtocolVersion = function getProtocolVersion(callback) {
383
var optional = [];
384
for (var i = 1; i < arguments.length; ++i) { opt.push(arguments[i]); }
385
406
- if (!this._tmpSession) { this._tmpSession = heci.create(); this._tmpSession.parent = this;}
407
- this._tmpSession.doIoctl(heci.IOCTL.HECI_VERSION, Buffer.alloc(5), Buffer.alloc(5), function (status, buffer, self, fn, opt)
408
- {
386
+ if (!this._tmpSession) { this._tmpSession = heci.create(); this._tmpSession.parent = this; }
387
+ this._tmpSession.doIoctl(heci.IOCTL.HECI_VERSION, Buffer.alloc(5), Buffer.alloc(5), function (status, buffer, self, fn, opt) {
388
if (status == 0) {
389
var result = buffer.readUInt8(0).toString() + '.' + buffer.readUInt8(1).toString() + '.' + buffer.readUInt8(2).toString() + '.' + buffer.readUInt16BE(3).toString();
390
opt.unshift(result);
391
fn.apply(self, opt);
392
}
414
- else
415
- {
393
+ else {
394
opt.unshift(null);
395
fn.apply(self, opt);
396
}
@@ -421,7 +399,19 @@ function amt_heci() {
399
}
400
this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
401
if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { func({ status: -101 }); }
424
-
402
+ this.stopConfiguration(function (status) {
403
+ if (status == 0) {
404
+ // We stopped the configuration, wait 20 seconds before starting up again.
405
+ var f = function tf() { delete tf.parent.xtimeout; tf.parent.startConfigurationHBasedEx(certHash, hostVpn, dnsSuffixList, func); }
406
+ f.parent = this;
407
+ this.xtimeout = setTimeout(f, 20000);
408
+ } else {
409
+ // We are not in the connect mode, this is good, start configuration right away.
410
+ this.startConfigurationHBasedEx(certHash, hostVpn, dnsSuffixList, func);
411
+ }
412
+ })
413
+ }
414
+ this.startConfigurationHBasedEx = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
415
var optional = [];
416
for (var i = 4; i < arguments.length; ++i) { optional.push(arguments[i]); }
417
@@ -442,7 +432,7 @@ function amt_heci() {
432
var amtHash = null;
433
if (header.Data[0] == 2) { amtHash = header.Data.slice(1, 33); } // SHA256
434
if (header.Data[0] == 3) { amtHash = header.Data.slice(1, 49); } // SHA384
445
- opt.unshift({ status: header.Status, hash: amtHash });
435
+ opt.unshift({ status: header.Status, hash: amtHash.toString('hex') });
436
} else {
437
opt.unshift({ status: header.Status });
438
}
agents/modules_meshcore/amt-mei.js
+40
-50
@@ -24,22 +24,18 @@ function amt_heci() {
24
25
this._ObjectID = "pthi";
26
this._rq = new Q();
27
- this._setupPTHI = function _setupPTHI()
28
- {
27
+ this._setupPTHI = function _setupPTHI() {
28
this._amt = heci.create();
29
this._amt.descriptorMetadata = "amt-pthi";
30
this._amt.BiosVersionLen = 65;
31
this._amt.UnicodeStringLen = 20;
32
33
this._amt.Parent = this;
35
- this._amt.on('error', function _amtOnError(e)
36
- {
37
- if(this.Parent._rq.isEmpty())
38
- {
34
+ this._amt.on('error', function _amtOnError(e) {
35
+ if (this.Parent._rq.isEmpty()) {
36
this.Parent.emit('error', e); // No pending requests, so propagate the error up
37
}
41
- else
42
- {
38
+ else {
39
// There is a pending request, so fail the pending request
40
var user = this.Parent._rq.deQueue();
41
var params = user.optional;
@@ -47,17 +43,14 @@ function amt_heci() {
43
params.unshift({ Status: -1 }); // Relay an error
44
callback.apply(this.Parent, params);
45
50
- if(!this.Parent._rq.isEmpty())
51
- {
46
+ if (!this.Parent._rq.isEmpty()) {
47
// There are still more pending requests, so try to re-helpconnect MEI
48
this.connect(heci.GUIDS.AMT, { noPipeline: 1 });
49
}
50
}
51
});
57
- this._amt.on('connect', function _amtOnConnect()
58
- {
59
- this.on('data', function _amtOnData(chunk)
60
- {
52
+ this._amt.on('connect', function _amtOnConnect() {
53
+ this.on('data', function _amtOnData(chunk) {
54
//console.log("Received: " + chunk.length + " bytes");
55
var header = this.Parent.getCommand(chunk);
56
//console.log("CMD = " + header.Command + " (Status: " + header.Status + ") Response = " + header.IsResponse);
@@ -69,14 +62,12 @@ function amt_heci() {
62
params.unshift(header);
63
callback.apply(this.Parent, params);
64
72
- if(this.Parent._rq.isEmpty())
73
- {
65
+ if (this.Parent._rq.isEmpty()) {
66
// No More Requests, we can close PTHI
67
this.Parent._amt.disconnect();
68
this.Parent._amt = null;
69
}
78
- else
79
- {
70
+ else {
71
// Send the next request
72
this.write(this.Parent._rq.peekQueue().send);
73
}
@@ -93,8 +84,7 @@ function amt_heci() {
84
return (ret);
85
};
86
96
- this.sendCommand = function sendCommand()
97
- {
87
+ this.sendCommand = function sendCommand() {
88
if (arguments.length < 3 || typeof (arguments[0]) != 'number' || typeof (arguments[1]) != 'object' || typeof (arguments[2]) != 'function') { throw ('invalid parameters'); }
89
var args = [];
90
for (var i = 3; i < arguments.length; ++i) { args.push(arguments[i]); }
@@ -102,10 +92,9 @@ function amt_heci() {
92
var header = Buffer.from('010100000000000000000000', 'hex');
93
header.writeUInt32LE(arguments[0] | 0x04000000, 4);
94
header.writeUInt32LE(arguments[1] == null ? 0 : arguments[1].length, 8);
105
- this._rq.enQueue({ cmd: arguments[0], func: arguments[2], optional: args , send: (arguments[1] == null ? header : Buffer.concat([header, arguments[1]]))});
95
+ this._rq.enQueue({ cmd: arguments[0], func: arguments[2], optional: args, send: (arguments[1] == null ? header : Buffer.concat([header, arguments[1]])) });
96
107
- if(!this._amt)
108
- {
97
+ if (!this._amt) {
98
this._setupPTHI();
99
this._amt.connect(heci.GUIDS.AMT, { noPipeline: 1 });
100
}
@@ -117,7 +106,7 @@ function amt_heci() {
106
this.sendCommand(26, null, function (header, fn, opt) {
107
if (header.Status == 0) {
108
var i, CodeVersion = header.Data, val = { BiosVersion: CodeVersion.slice(0, this._amt.BiosVersionLen).toString(), Versions: [] }, v = CodeVersion.slice(this._amt.BiosVersionLen + 4);
120
- for (i = 0; i < CodeVersion.readUInt32LE(this._amt.BiosVersionLen) ; ++i) {
109
+ for (i = 0; i < CodeVersion.readUInt32LE(this._amt.BiosVersionLen); ++i) {
110
val.Versions[i] = { Description: v.slice(2, v.readUInt16LE(0) + 2).toString(), Version: v.slice(4 + this._amt.UnicodeStringLen, 4 + this._amt.UnicodeStringLen + v.readUInt16LE(2 + this._amt.UnicodeStringLen)).toString() };
111
v = v.slice(4 + (2 * this._amt.UnicodeStringLen));
112
}
@@ -302,34 +291,27 @@ function amt_heci() {
291
this.getLocalSystemAccount = function getLocalSystemAccount(callback) {
292
var optional = [];
293
for (var i = 1; i < arguments.length; ++i) { optional.push(arguments[i]); }
305
- this.sendCommand(103, Buffer.alloc(40), function (header, fn, opt)
306
- {
307
- if (header.Status == 0 && header.Data.length == 68)
308
- {
294
+ this.sendCommand(103, Buffer.alloc(40), function (header, fn, opt) {
295
+ if (header.Status == 0 && header.Data.length == 68) {
296
opt.unshift({ user: trim(header.Data.slice(0, 33).toString()), pass: trim(header.Data.slice(33, 67).toString()), raw: header.Data });
297
}
311
- else
312
- {
298
+ else {
299
opt.unshift(null);
300
}
301
fn.apply(this, opt);
302
}, callback, optional);
303
}
318
- this.getLanInterfaceSettings = function getLanInterfaceSettings(index, callback)
319
- {
304
+ this.getLanInterfaceSettings = function getLanInterfaceSettings(index, callback) {
305
var optional = [];
306
for (var i = 2; i < arguments.length; ++i) { optional.push(arguments[i]); }
307
var ifx = Buffer.alloc(4);
308
ifx.writeUInt32LE(index);
324
- this.sendCommand(0x48, ifx, function onGetLanInterfaceSettings(header, fn, opt)
325
- {
326
- if(header.Status == 0)
327
- {
309
+ this.sendCommand(0x48, ifx, function onGetLanInterfaceSettings(header, fn, opt) {
310
+ if (header.Status == 0) {
311
var info = {};
312
info.enabled = header.Data.readUInt32LE(0);
313
info.dhcpEnabled = header.Data.readUInt32LE(8);
331
- switch(header.Data[12])
332
- {
314
+ switch (header.Data[12]) {
315
case 1:
316
info.dhcpMode = 'ACTIVE'
317
break;
@@ -341,14 +323,13 @@ function amt_heci() {
323
break;
324
}
325
info.mac = header.Data.slice(14).toString('hex:');
344
-
326
+
327
var addr = header.Data.readUInt32LE(4);
328
info.address = ((addr >> 24) & 255) + '.' + ((addr >> 16) & 255) + '.' + ((addr >> 8) & 255) + '.' + (addr & 255);
329
opt.unshift(info);
330
fn.apply(this, opt);
331
}
350
- else
351
- {
332
+ else {
333
opt.unshift(null);
334
fn.apply(this, opt);
335
}
@@ -398,21 +379,18 @@ function amt_heci() {
379
fn.apply(this, opt);
380
}, callback, optional);
381
}
401
- this.getProtocolVersion = function getProtocolVersion(callback)
402
- {
382
+ this.getProtocolVersion = function getProtocolVersion(callback) {
383
var optional = [];
384
for (var i = 1; i < arguments.length; ++i) { opt.push(arguments[i]); }
385
406
- if (!this._tmpSession) { this._tmpSession = heci.create(); this._tmpSession.parent = this;}
407
- this._tmpSession.doIoctl(heci.IOCTL.HECI_VERSION, Buffer.alloc(5), Buffer.alloc(5), function (status, buffer, self, fn, opt)
408
- {
386
+ if (!this._tmpSession) { this._tmpSession = heci.create(); this._tmpSession.parent = this; }
387
+ this._tmpSession.doIoctl(heci.IOCTL.HECI_VERSION, Buffer.alloc(5), Buffer.alloc(5), function (status, buffer, self, fn, opt) {
388
if (status == 0) {
389
var result = buffer.readUInt8(0).toString() + '.' + buffer.readUInt8(1).toString() + '.' + buffer.readUInt8(2).toString() + '.' + buffer.readUInt16BE(3).toString();
390
opt.unshift(result);
391
fn.apply(self, opt);
392
}
414
- else
415
- {
393
+ else {
394
opt.unshift(null);
395
fn.apply(self, opt);
396
}
@@ -421,7 +399,19 @@ function amt_heci() {
399
}
400
this.startConfigurationHBased = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
401
if ((certHash == null) || ((certHash.length != 32) && (certHash.length != 48))) { func({ status: -101 }); }
424
-
402
+ this.stopConfiguration(function (status) {
403
+ if (status == 0) {
404
+ // We stopped the configuration, wait 20 seconds before starting up again.
405
+ var f = function tf() { delete tf.parent.xtimeout; tf.parent.startConfigurationHBasedEx(certHash, hostVpn, dnsSuffixList, func); }
406
+ f.parent = this;
407
+ this.xtimeout = setTimeout(f, 20000);
408
+ } else {
409
+ // We are not in the connect mode, this is good, start configuration right away.
410
+ this.startConfigurationHBasedEx(certHash, hostVpn, dnsSuffixList, func);
411
+ }
412
+ })
413
+ }
414
+ this.startConfigurationHBasedEx = function startConfigurationHBased(certHash, hostVpn, dnsSuffixList, func) {
415
var optional = [];
416
for (var i = 4; i < arguments.length; ++i) { optional.push(arguments[i]); }
417
@@ -442,7 +432,7 @@ function amt_heci() {
432
var amtHash = null;
433
if (header.Data[0] == 2) { amtHash = header.Data.slice(1, 33); } // SHA256
434
if (header.Data[0] == 3) { amtHash = header.Data.slice(1, 49); } // SHA384
445
- opt.unshift({ status: header.Status, hash: amtHash });
435
+ opt.unshift({ status: header.Status, hash: amtHash.toString('hex') });
436
} else {
437
opt.unshift({ status: header.Status });
438
}
amt/amt-wsman-comm.js
+3
-3
@@ -242,9 +242,9 @@ var CreateWsmanComm = function (host, port, user, pass, tls, tlsoptions, mpsConn
242
var options = { socket: ser, ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
243
if (obj.xtlsMethod == 1) { options.secureProtocol = 'TLSv1_method'; }
244
if (obj.xtlsoptions) {
245
- if (obj.xtlsoptions.ca) options.ca = obj.xtlsoptions.ca;
246
- if (obj.xtlsoptions.cert) options.cert = obj.xtlsoptions.cert;
247
- if (obj.xtlsoptions.key) options.key = obj.xtlsoptions.key;
245
+ if (obj.xtlsoptions.ca) { options.ca = obj.xtlsoptions.ca; }
246
+ if (obj.xtlsoptions.cert) { options.cert = obj.xtlsoptions.cert; }
247
+ if (obj.xtlsoptions.key) { options.key = obj.xtlsoptions.key; }
248
}
249
250
obj.socket = obj.tls.connect(obj.port, obj.host, options, obj.xxOnSocketConnected);
amtmanager.js
+30
-5
@@ -248,7 +248,11 @@ module.exports.CreateAmtManager = function (parent) {
248
break;
249
case 'startTlsHostConfig':
250
if (dev.acmTlsInfo == null) break;
251
- console.log(jsondata); // TODO: Start TLS activation.
251
+ if ((typeof jsondata.value != 'object') || (typeof jsondata.value.status != 'number') || (jsondata.value.status != 0)) {
252
+ removeAmtDevice(dev); // Failed to start TLS configuration
253
+ } else {
254
+ activateIntelAmtTlsAcmEx(dev, jsondata.value); // Start TLS activation.
255
+ }
256
break;
257
}
258
}
@@ -1678,13 +1682,13 @@ module.exports.CreateAmtManager = function (parent) {
1682
// We are not activated now, go to ACM directly.
1683
// If this is Intel AMT 14 or better, we are going to attempt a host-based end-to-end TLS activation.
1684
if (typeof dev.intelamt.ver == 'string') { var verSplit = dev.intelamt.ver.split('.'); if (verSplit.length >= 3) { dev.aquired.majorver = parseInt(verSplit[0]); dev.aquired.minorver = parseInt(verSplit[1]); } }
1681
- if (dev.aquired.majorver >= 14) {
1685
+ //if (dev.aquired.majorver >= 14) {
1686
// Perform host-based TLS ACM activation
1683
- activateIntelAmtTlsAcm(dev, mesh.amt.password, acminfo);
1684
- } else {
1687
+ //activateIntelAmtTlsAcm(dev, mesh.amt.password, acminfo);
1688
+ //} else {
1689
// Perform host-based ACM activation
1690
activateIntelAmtAcm(dev, mesh.amt.password, acminfo);
1687
- }
1691
+ //}
1692
}
1693
}
1694
}
@@ -1803,6 +1807,27 @@ module.exports.CreateAmtManager = function (parent) {
1807
dev.controlMsg({ action: 'startTlsHostConfig', hash: acmTlsInfo.hash, hostVpn: false, dnsSuffixList: null });
1808
}
1809
1810
+ // Attempt Intel AMT TLS ACM activation after startConfiguration() is called on remote device
1811
+ function activateIntelAmtTlsAcmEx(dev, startConfigData) {
1812
+ console.log('activateIntelAmtTlsAcmEx');
1813
+ // Setup the WSMAN stack, no TLS
1814
+ var comm = CreateWsmanComm(dev.nodeid, 16993, 'admin', '', 1, { cert: dev.acmTlsInfo.certs, key: dev.acmTlsInfo.signkey }, dev.mpsConnection); // TLS with client certificate chain and key.
1815
+ // TODO: Intel AMT leaf TLS cert need to SHA256 hash to "startConfigData.hash"
1816
+ var wsstack = WsmanStackCreateService(comm);
1817
+ dev.amtstack = AmtStackCreateService(wsstack);
1818
+ dev.amtstack.dev = dev;
1819
+ dev.amtstack.BatchEnum(null, ['*AMT_GeneralSettings', '*IPS_HostBasedSetupService'], activateIntelAmtTlsAcmEx1);
1820
+ }
1821
+
1822
+ function activateIntelAmtTlsAcmEx1(stack, name, responses, status) {
1823
+ console.log('activateIntelAmtTlsAcmEx1', status, responses);
1824
+ const dev = stack.dev;
1825
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1826
+ if (status != 200) { dev.consoleMsg("Failed to get Intel AMT state."); removeAmtDevice(dev); return; }
1827
+
1828
+ // TODO!!!
1829
+ }
1830
+
1831
// Attempt Intel AMT ACM activation
1832
function activateIntelAmtAcm(dev, password, acminfo) {
1833
// Generate a random Intel AMT password if needed
certoperations.js
+3
-2
@@ -51,7 +51,8 @@ module.exports.CertificateOperations = function (parent) {
51
var leafcert = obj.IssueWebServerCertificate(rootcert, false, fqdn, 'mc', 'Intel(R) Client Setup Certificate', { serverAuth: true, '2.16.840.1.113741.1.2.3': true }, false);
52
53
// Setup the certificate chain and key
54
- certChain = [obj.pki.certificateToPem(leafcert.cert), obj.pki.certificateToPem(domain.amtacmactivation.certs[certIndex].rootcert)];
54
+ //certChain = [ obj.pki.certificateToPem(leafcert.cert), obj.pki.certificateToPem(domain.amtacmactivation.certs[certIndex].rootcert) ];
55
+ certChain = [ obj.pki.certificateToPem(domain.amtacmactivation.certs[certIndex].rootcert), obj.pki.certificateToPem(leafcert.cert) ];
56
signkey = obj.pki.privateKeyToPem(leafcert.key);
57
} else {
58
// Make sure the cert chain is in PEM format
@@ -61,7 +62,7 @@ module.exports.CertificateOperations = function (parent) {
62
}
63
64
// Hash the leaf certificate and return the certificate chain and signing key
64
- return { action: 'acmactivate', certs: certChain, signkey: signkey, hash: obj.getCertHash(certChain[0]) };
65
+ return { action: 'acmactivate', certs: certChain, signkey: signkey, hash: obj.getCertHash(certChain[certChain.length - 1]) };
66
}
67
68
// Sign a Intel AMT ACM activation request