Added AMT ACM activation wildcard cert support.
Ylian Saint-Hilaire committed
Oct 26, 2020 at 22:52 UTC
e9250c11db12dd0c69505c9e1814e5ecdc8e1ba1
2 files changed
+19
-18
amtmanager.js
+1
-14
@@ -372,21 +372,8 @@ module.exports.CreateAmtManager = function (parent) {
372
// Deactivate CCM.
373
deactivateIntelAmtCCM(dev);
374
return;
375
- } //else {
376
- // Already deactivated or in ACM
377
- //dev.consoleMsg("Done."); // TODO: We need to at least clear CIRA
378
- //removeAmtDevice(dev);
379
- //}
380
- //return;
381
- }
382
- /*
383
- // No Intel AMT policy, since this is CIRA-LMS, stop here.
384
- if (dev.policy.amtPolicy == 0) {
385
- dev.consoleMsg("Done.");
386
- removeAmtDevice(dev);
387
- return;
375
+ }
376
}
389
- */
377
}
378
379
// See if we need to try different credentials
certoperations.js
+18
-4
@@ -46,8 +46,17 @@ module.exports.CertificateOperations = function (parent) {
46
}
47
if (signkey == null) return { 'action': 'acmactivate', 'error': 2, 'errorText': "No signing certificate found." }; // Did not find a match.
48
49
- // If the matching certificate is a root cert, issue a leaf cert that matches the fqdn
50
- if (domain.amtacmactivation.certs[certIndex].cn == '*') return { 'action': 'acmactivate', 'error': 3, 'errorText': "Unsupported activation." }; // TODO: Add support for this mode
49
+ // If the matching certificate our wildcard root cert, we can use the root to match any FQDN
50
+ if (domain.amtacmactivation.certs[certIndex].cn == '*') {
51
+ // Create a leaf certificate that matches the FQDN we want
52
+ // TODO: This is an expensive operation, work on ways to pre-generate or cache this leaf certificate.
53
+ var rootcert = { cert: domain.amtacmactivation.certs[certIndex].rootcert, key: obj.pki.privateKeyFromPem(domain.amtacmactivation.certs[certIndex].key) };
54
+ var leafcert = obj.IssueWebServerCertificate(rootcert, false, request.fqdn, 'mc', 'Intel(R) Client Setup Certificate', { serverAuth: true, '2.16.840.1.113741.1.2.3': true }, false);
55
+
56
+ // Setup the certificate chain and key
57
+ certChain = [pemToBase64(obj.pki.certificateToPem(leafcert.cert)), pemToBase64(obj.pki.certificateToPem(domain.amtacmactivation.certs[certIndex].rootcert))];
58
+ signkey = obj.pki.privateKeyToPem(leafcert.key);
59
+ }
60
61
// Setup both nonces, ready to be signed
62
const mcNonce = Buffer.from(obj.crypto.randomBytes(20), 'binary');
@@ -59,7 +68,9 @@ module.exports.CertificateOperations = function (parent) {
68
var signer = obj.crypto.createSign(hashAlgo);
69
signer.update(Buffer.concat([fwNonce, mcNonce]));
70
signature = signer.sign(signkey, 'base64');
62
- } catch (ex) { return { 'action': 'acmactivate', 'error': 4, 'errorText': "Unable to perform signature." }; }
71
+ } catch (ex) {
72
+ return { 'action': 'acmactivate', 'error': 4, 'errorText': "Unable to perform signature." };
73
+ }
74
75
// Log the activation request, logging is a required step for activation.
76
if (obj.logAmtActivation(domain, { time: new Date(), action: 'acmactivate', domain: domain.id, amtUuid: request.uuid, certHash: request.hash, hashType: hashAlgo, amtRealm: request.realm, amtFqdn: request.fqdn, user: user, password: pass, ipport: ipport, nodeid: nodeid, meshid: meshid, computerName: computerName, agentId: agentId, tag: request.tag, name: request.name }) == false) return { 'action': 'acmactivate', 'error': 5, 'errorText': "Unable to log operation." };
@@ -68,6 +79,9 @@ module.exports.CertificateOperations = function (parent) {
79
return { 'action': 'acmactivate', 'signature': signature, 'password': obj.crypto.createHash('md5').update(user + ':' + request.realm + ':' + pass).digest('hex'), 'nonce': mcNonce.toString('base64'), 'certs': certChain };
80
}
81
82
+ // Remove the PEM header, footer and carriage returns so we only have the Base64 DER.
83
+ function pemToBase64(pem) { return pem.split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('').split('\r\n').join(''); }
84
+
85
// Log the Intel AMT activation operation in the domain log
86
obj.logAmtActivation = function (domain, x) {
87
if (x == null) return true;
@@ -176,7 +190,7 @@ module.exports.CertificateOperations = function (parent) {
190
if ((x1 >= 0) && (x2 > x1)) {
191
var sha256 = obj.crypto.createHash('sha256').update(Buffer.from(obj.parent.certificates.root.cert.substring(x1 + 27, x2), 'base64')).digest('hex');
192
var sha1 = obj.crypto.createHash('sha1').update(Buffer.from(obj.parent.certificates.root.cert.substring(x1 + 27, x2), 'base64')).digest('hex');
179
- amtacmactivation.certs.push({ 'sha256': sha256, 'sha1': sha1, 'cn': '*', certs: [obj.pki.certificateFromPem(obj.parent.certificates.root.cert)], key: obj.parent.certificates.root.key });
193
+ amtacmactivation.certs.push({ 'sha256': sha256, 'sha1': sha1, 'cn': '*', rootcert: obj.pki.certificateFromPem(obj.parent.certificates.root.cert), key: obj.parent.certificates.root.key });
194
amtacmactivation.acmmatch.push({ 'sha256': sha256, 'sha1': sha1, 'cn': '*' });
195
}
196
}