Added AMT Key Pair generation retry and better error display, #3615
Ylian Saint-Hilaire committed
Feb 25, 2022 at 13:37 UTC
fd4823ac823de3acdef2e8aadcbd4e15b5766fba
2 files changed
+59
-5
amtmanager.js
+33
-4
@@ -489,7 +489,11 @@ module.exports.CreateAmtManager = function (parent) {
489
dev.acctry = acctry2;
490
491
// If we have passwords to try, try the first one now.
492
- if (dev.acctry.length == 0) { removeAmtDevice(dev, 8); return; }
492
+ if (dev.acctry.length == 0) {
493
+ dev.consoleMsg("No admin login passwords to try, stopping now.");
494
+ removeAmtDevice(dev, 8);
495
+ return;
496
+ }
497
}
498
499
if ((dev.acctry == null) || (dev.acctry.length == 0)) { removeAmtDevice(dev, 9); return; } // No Intel AMT credentials to try
@@ -1021,6 +1025,31 @@ module.exports.CreateAmtManager = function (parent) {
1025
dev.amtstack.BatchEnum(null, ['AMT_PublicKeyCertificate', 'AMT_PublicPrivateKeyPair', 'AMT_TLSSettingData', 'AMT_TLSCredentialContext'], attemptTlsSyncEx);
1026
}
1027
1028
+ // Intel AMT is not always in a good spot to generate a key pair. This will retry at 10 second interval.
1029
+ function generateKeyPairWithRetry(dev, func) {
1030
+ if (isAmtDeviceValid(dev) == false) return;
1031
+ if (dev.keyPairAttempts == null) { dev.keyPairAttempts = 1; } else { dev.keyPairAttempts++; }
1032
+ dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
1033
+ if (isAmtDeviceValid(dev) == false) { delete dev.keyPairAttempts; return; }
1034
+ if ((status == 200) || (dev.keyPairAttempts > 19)) {
1035
+ delete dev.keyPairAttempts;
1036
+ func(stack, name, responses, status);
1037
+ } else {
1038
+ if ((responses.Body != null) && (responses.Body.ReturnValue != null) && (responses.Body.ReturnValueStr != null)) {
1039
+ dev.consoleMsg("Failed to generate a key pair (" + status + ", " + responses.Body.ReturnValue + ", \"" + responses.Body.ReturnValueStr + "\"), attempt " + dev.keyPairAttempts + ", trying again in 10 seconds...");
1040
+ } else {
1041
+ dev.consoleMsg("Failed to generate a key pair (" + status + "), attempt " + dev.keyPairAttempts + ", trying again in 10 seconds...");
1042
+ }
1043
+
1044
+ // Wait 10 seconds before attempting again
1045
+ var f = function doManage() { generateKeyPairWithRetry(doManage.dev, doManage.func); }
1046
+ f.dev = dev;
1047
+ f.func = func;
1048
+ setTimeout(f, 10000);
1049
+ }
1050
+ });
1051
+ }
1052
+
1053
function attemptTlsSyncEx(stack, name, responses, status) {
1054
const dev = stack.dev;
1055
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
@@ -1050,7 +1079,7 @@ module.exports.CreateAmtManager = function (parent) {
1079
// This is a managed device and TLS is not enabled, turn it on.
1080
if (xxTlsCurrentCert == null) {
1081
// Start by generating a key pair
1053
- dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
1082
+ generateKeyPairWithRetry(dev, function (stack, name, responses, status) {
1083
const dev = stack.dev;
1084
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1085
if (status != 200) { dev.consoleMsg("Failed to generate a key pair (" + status + ")."); removeAmtDevice(dev, 20); return; }
@@ -1145,7 +1174,7 @@ module.exports.CreateAmtManager = function (parent) {
1174
1175
if (dev.hbacmtls == 1) {
1176
// If we are doing Host-based TLS ACM activation, you need to only enable the remote port with TLS.
1148
- // If you enable on local port, the commit() will succeed but be ignored.
1177
+ // If you enable on local port, the commit will succeed but be ignored.
1178
dev.consoleMsg("Enabling TLS on remote port...");
1179
if (remoteNdx == 0) { dev.amtstack.Put('AMT_TLSSettingData', xxTlsSettings2[0], amtSwitchToTls, 0, 1, xxTlsSettings2[0]); }
1180
else { dev.amtstack.Put('AMT_TLSSettingData', xxTlsSettings2[1], amtSwitchToTls, 0, 1, xxTlsSettings2[1]); }
@@ -1176,7 +1205,7 @@ module.exports.CreateAmtManager = function (parent) {
1205
1206
// Check if all the calls are done & perform a commit
1207
if ((--dev.setTlsSecurityPendingCalls) == 0) {
1179
- dev.consoleMsg("Performing Commit()...");
1208
+ dev.consoleMsg("Performing Commit...");
1209
dev.amtstack.AMT_SetupAndConfigurationService_CommitChanges(null, function (stack, name, responses, status) {
1210
const dev = stack.dev;
1211
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
amtprovisioningserver.js
+26
-1
@@ -283,6 +283,31 @@ module.exports.CreateAmtProvisioningServer = function (parent, config) {
283
dev.amtstack.BatchEnum(null, ['AMT_PublicKeyCertificate', 'AMT_PublicPrivateKeyPair', 'AMT_TLSSettingData', 'AMT_TLSCredentialContext'], attemptTlsSyncEx);
284
}
285
286
+ // Intel AMT is not always in a good spot to generate a key pair. This will retry at 10 second interval.
287
+ function generateKeyPairWithRetry(dev, func) {
288
+ if (isAmtDeviceValid(dev) == false) return;
289
+ if (dev.keyPairAttempts == null) { dev.keyPairAttempts = 1; } else { dev.keyPairAttempts++; }
290
+ dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
291
+ if (isAmtDeviceValid(dev) == false) { delete dev.keyPairAttempts; return; }
292
+ if ((status == 200) || (dev.keyPairAttempts > 19)) {
293
+ delete dev.keyPairAttempts;
294
+ func(stack, name, responses, status);
295
+ } else {
296
+ if ((responses.Body != null) && (responses.Body.ReturnValue != null) && (responses.Body.ReturnValueStr != null)) {
297
+ dev.consoleMsg("Failed to generate a key pair (" + status + ", " + responses.Body.ReturnValue + ", \"" + responses.Body.ReturnValueStr + "\"), attempt " + dev.keyPairAttempts + ", trying again in 10 seconds...");
298
+ } else {
299
+ dev.consoleMsg("Failed to generate a key pair (" + status + "), attempt " + dev.keyPairAttempts + ", trying again in 10 seconds...");
300
+ }
301
+
302
+ // Wait 10 seconds before attempting again
303
+ var f = function doManage() { generateKeyPairWithRetry(doManage.dev, doManage.func); }
304
+ f.dev = dev;
305
+ f.func = func;
306
+ setTimeout(f, 10000);
307
+ }
308
+ });
309
+ }
310
+
311
function attemptTlsSyncEx(stack, name, responses, status) {
312
const dev = stack.dev;
313
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
@@ -315,7 +340,7 @@ module.exports.CreateAmtProvisioningServer = function (parent, config) {
340
if (xxTlsCurrentCert === null) {
341
// Start by generating a key pair
342
dev.consoleMsg("No TLS certificate. Generating key pair...");
318
- dev.amtstack.AMT_PublicKeyManagementService_GenerateKeyPair(0, 2048, function (stack, name, responses, status) {
343
+ generateKeyPairWithRetry(dev, function (stack, name, responses, status) {
344
const dev = stack.dev;
345
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
346
if (status != 200) { dev.consoleMsg("Failed to generate a key pair (" + status + ")."); removeAmtDevice(dev, 20); return; }