{"id":1052,"date":"2014-10-12T02:49:29","date_gmt":"2014-10-12T02:49:29","guid":{"rendered":"https:\/\/trouble.org\/?p=1052"},"modified":"2014-10-12T23:13:32","modified_gmt":"2014-10-12T23:13:32","slug":"get-device-id-moar-ipmi-yawn","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=1052","title":{"rendered":"Get Device ID (moar IPMI… yawn….)"},"content":{"rendered":"

I’d had this sitting around for awhile and thought I’d take another look at it; in this I simply toss out an IPMI\u00a0Get Device ID command and see what happens. This is an interesting one; the GUID is a Vendor Specific ID – the specification says that it’s “a unique number per device”, and that “a Device GUID should never change over the lifetime of the device”, which makes it a remarkable thing if true; IP addresses, even MAC addrs, are crummy\u00a0network IDs. Having a remote one would be a handy thing indeed for auditing, scanning, and the like.<\/p>\n

\"snowflakery\"
every flake is sacred<\/figcaption><\/figure>\n

Keeping in line with the spec in general, this does not require authentication, and is “highly recommended”, but not mandatory. I think some require auth despite spec, which is what I’d recommend vendors to do, it’s actually a bit of a nasty thing to have a system pigeonholed with a high veracity.<\/p>\n

The GUID is a weird one; it’s mostly taken from RFC 4122, and can mean various things (look in the comments below for more on this if you’re really interested.) Sometimes it’s immediately and obviously interesting; for instance, you might see something like this from a BMC:<\/p>\n

44454c4c-4b00-1046-8035-c6c04f574c31<\/p>\n

The first 4 hex pairs, if decoded, spell out “DELL”, which presumably has something to do with the manufacturer :)<\/p>\n

Others might use the IANA manufacturing<\/a> #’s, but I haven’t delved deeply into analyzing all this.<\/p>\n

A quick survey of a couple hundred thousand BMCs on the internet showed that about 90% (186291\/207833, or 89.6%) seem to indicate a GUID, although at times its garbage, like all 0’s or F’s.<\/p>\n

p.s.Good job for you in the 19\/8 block, you know who you are!<\/p>\n

#!\/usr\/bin\/env python<\/span>
\n
\n#<\/span>
\n# Do a Get Device ID (see p250 of the IPMI v 2 spec) on a host<\/span>
\n#<\/span>
\n# Usage: $0 ip-address<\/span>
\n#<\/span>
\n# Outputs the target and the GUID in one long string as well as broken<\/span>
\n# up (tab sep'd); something that looks like:<\/span>
\n#<\/span>
\n# 10.0.0.1 373030314d530025903eeba000000000 37303031-4d53-0025-903e-eba000000000<\/span>
\n#<\/span>
\n# (Usually I'd simply emit the GUID, but I was lazy and this made it<\/span>
\n# easier when scripting, just change the print at the bottom if you<\/span>
\n# want to change it.)<\/span>
\n#<\/span>
\n# RFC 4122 specifies four different versions of UUID formats and<\/span>
\n# generation algorightms suitable for use for a Device GUID in<\/span>
\n# IPMI. These are version 1 (0001b) "time based" - and three<\/span>
\n# "name-based" versions: version 3 (0011b) "MD5 hash", version 4<\/span>
\n# (0100b) "Pseudo-random", and version 5 "SHA1 hash". The version 1<\/span>
\n# format is recommended. However, versions 3, 4, or 5 formats are<\/span>
\n# also allowed.<\/span>
\n#<\/span>
\n# Supposedly this is something like this - which illustrates the<\/span>
\n# time-based version... they aren't grouped like that in ipmiutil,<\/span>
\n# but who knows, really.<\/span>
\n#<\/span>
\n# Table 20-10, GUID Format<\/span>
\n#<\/span>
\n# GUID byte Field MSbyte<\/span>
\n# 1 node<\/span>
\n# 2 node<\/span>
\n# 3 node<\/span>
\n# 4 node<\/span>
\n# 5 node<\/span>
\n# 6 node MSbyte<\/span>
\n# 7 clock seq and reserved<\/span>
\n# 8 clock seq and reserved MSbyte<\/span>
\n# 9 time high and version<\/span>
\n# 10 time high and version MSbyte<\/span>
\n# 11 time mid<\/span>
\n# 12 time mid MSbyte<\/span>
\n# 13 time low<\/span>
\n# 14 time low<\/span>
\n# 15 time low<\/span>
\n# 16 time low MSbyte<\/span>
\n#<\/span>
\n# The RFC shows it as:<\/span>
\n#<\/span>
\n# 0 1 2 3<\/span>
\n# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1<\/span>
\n# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/span>
\n# | time_low |<\/span>
\n# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/span>
\n# | time_mid | time_hi_and_version |<\/span>
\n# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/span>
\n# |clk_seq_hi_res | clk_seq_low | node (0-1) |<\/span>
\n# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/span>
\n# | node (2-5) |<\/span>
\n# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/span>
\n#<\/span>
\n# Name-based ones can be, among other things, derived from X500,<\/span>
\n# ISO OIDs, URLs, or FQDNs (appendix C in RFC 4122.)<\/span>
\n#<\/span>
\n#<\/span>
\n#<\/span>
\n# Anyway, back to the fun.<\/span>
\n#<\/span>
\n# This DOES NOT USE AUTHENTICATION. This is as per spec; the command is<\/span>
\n# "highly recommended", but not mandatory. I think some require auth<\/span>
\n# despite spec, which is what I'd recommend vendors use :)<\/span>
\n#<\/span>
\n# The GUID is a Vendor Specific ID - "A unique number per device".<\/span>
\n# "A Device GUID should never change over the lifetime of the device",<\/span>
\n# which makes it a remarkable thing if true; IP addresses, even MAC addrs,<\/span>
\n# are crappy network IDs.<\/span>
\n#<\/span>
\n# This script simply sends request, tears up response, does a little sanity<\/span>
\n# checking, prints out some stuff. Comments are often quotes from<\/span>
\n# the IPMI 2.0 spec. The output steals the format from ipmiutil...<\/span>
\n# no idea why some bytes are reversed and others aren't, even after<\/span>
\n# studying spec. Par for the course.<\/span>
\n#<\/span>
\n
\nimport<\/span> sys<\/span>
\nfrom<\/span> socket<\/span> import<\/span> *
\n
\ntry<\/span>:
\ntarget =<\/span> sys<\/span>.argv<\/span>[<\/span>1<\/span>]<\/span>
\nexcept<\/span>:
\nprint<\/span>(<\/span>"usage: %s target"<\/span> % sys<\/span>.argv<\/span>[<\/span>0<\/span>]<\/span>)<\/span>
\nexit(<\/span>1<\/span>)<\/span>
\n
\n# in seconds<\/span>
\ntimeout =<\/span> 10<\/span>
\ntimeout =<\/span> 5<\/span>
\n# udp<\/span>
\nPORT =<\/span> 623<\/span>
\n
\n#<\/span>
\n# parts of the packet below<\/span>
\n#<\/span>
\n
\n# RMCP class IPMI<\/span>
\nrmcp_class =<\/span> "\\x<\/span>06\\x<\/span>00\\x<\/span>ff\\x<\/span>07"<\/span>
\nauth_type =<\/span> "\\x<\/span>00"<\/span>
\nsession_num =<\/span> "\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00"<\/span>
\nsession_id =<\/span> "\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00"<\/span>
\n
\nmessage_len =<\/span> "\\x<\/span>07"<\/span> # bytes of stuff below<\/span>
\n
\ntarget_addr =<\/span> "\\x<\/span>20"<\/span>
\nlun_netfn =<\/span> "\\x<\/span>18"<\/span> # LUN & NetFn<\/span>
\nheader_chksm =<\/span> "\\x<\/span>c8"<\/span>
\nsource_addr =<\/span> "\\x<\/span>81"<\/span>
\nsource_lun =<\/span> "\\x<\/span>00"<\/span>
\n
\n#<\/span>
\n# 08h = get device guid - works unauth'd on SM!<\/span>
\n# 37h = get system guid<\/span>
\n# 25h = get watchdog timer - works on HP ilo2<\/span>
\n# 0ah = get command support<\/span>
\n# 2fh = get BMC global enables<\/span>
\n#<\/span>
\nipmi_cmd =<\/span> "\\x<\/span>37"<\/span>
\n
\n# checksum fu swiped from jarrod\/xcat - http:\/\/sourceforge.net\/p\/xcat\/code\/HEAD\/tree\/xcat-core\/trunk\/xCAT-server\/lib\/perl\/xCAT\/IPMI.pm<\/span>
\nsum<\/span> =<\/span> 0<\/span>;<\/span>
\nfor<\/span> byte in<\/span> target_addr + lun_netfn + header_chksm + source_addr + source_lun + ipmi_cmd:
\nsum<\/span> +=<\/span> ord<\/span>(<\/span>byte)<\/span>
\nsum<\/span> =<\/span> ~<\/span>sum<\/span> + 1<\/span>
\nchecksum =<\/span> "%s"<\/span> % chr<\/span>(<\/span>sum<\/span> & 0xff<\/span>)<\/span>
\n
\n# IPMI v1.5 session wrapper<\/span>
\npayload =<\/span> rmcp_class + auth_type + session_num + session_id + message_len + \\
\ntarget_addr + lun_netfn + header_chksm + source_addr + source_lun + \\
\nipmi_cmd + checksum
\n
\n#<\/span>
\n# create socket & bind to local port<\/span>
\n#<\/span>
\n
\nudp =<\/span> socket<\/span>(<\/span>AF_INET,<\/span> SOCK_DGRAM)<\/span>
\nsake =<\/span> udp.getsockname<\/span>(<\/span>)<\/span>
\nudp.bind<\/span>(<\/span>sake)<\/span>
\n
\n#<\/span>
\n# swap pairs of hex digits<\/span>
\n#<\/span>
\ndef<\/span> swap(<\/span>s)<\/span>:
\n# print('\\tbefore ' + s)<\/span>
\ns =<\/span> ""<\/span>.join<\/span>(<\/span>reversed<\/span>(<\/span>[<\/span>s[<\/span>i:i+2<\/span>]<\/span> for<\/span> i in<\/span> range<\/span>(<\/span>0<\/span>,<\/span> len<\/span>(<\/span>s)<\/span>,<\/span> 2<\/span>)<\/span>]<\/span>)<\/span>)<\/span>
\n# print('\\tafter ' + s)<\/span>
\nreturn<\/span>(<\/span>s)<\/span>
\n
\n#<\/span>
\n# send packet... or die trying<\/span>
\n#<\/span>
\ntry<\/span>:
\nudp.settimeout<\/span>(<\/span>timeout)<\/span>
\n
\n# if udp.sendto(" ", (target, PORT)) <= 0:<\/span>
\nif<\/span> udp.sendto<\/span>(<\/span>payload,<\/span> (<\/span>target,<\/span> PORT)<\/span>)<\/span> <=<\/span> 0<\/span>:
\nprint<\/span>(<\/span>"couldn't send packet to %s"<\/span> % target)<\/span>
\n
\n# catch response<\/span>
\ndata,<\/span>addr =<\/span> udp.recvfrom<\/span>(<\/span>512<\/span>)<\/span>
\n
\n# print(data)<\/span>
\n
\n# skip the header<\/span>
\ndata =<\/span> data[<\/span>21<\/span>:-1<\/span>]<\/span>
\n
\nguid =<\/span> data.encode<\/span>(<\/span>'hex'<\/span>)<\/span>
\n
\n#<\/span>
\n# in "Wired for Management Baseline", they say:<\/span>
\n#<\/span>
\n# Field Data Type Octet # Note<\/span>
\n# ------ ---------- -------- -----<\/span>
\n# time_low unsigned 32 bit integer 0-3 The low field of the timestamp.<\/span>
\n# time_mid unsigned 16 bit integer 4-5 The middle field of the timestamp.<\/span>
\n# time_hi_and_version unsigned 16 bit integer 6-7 The high field of the timestamp multiplexed with the version number.<\/span>
\n# clock_seq_hi_and_reserved unsigned 8 bit integer 8 The high field of the clock sequence multiplexed with the variant.<\/span>
\n# clock_seq_low unsigned 8 bit integer 9 The low field of the clock sequence.<\/span>
\n# node unsigned 48 bit integer 10-15 The spatially unique node identifier.<\/span>
\n
\n#<\/span>
\n# IPMI reverses some of these... sure, why not... that makes sense<\/span>
\n#<\/span>
\n
\n# print('len of data to work with: %s\\n' % len(data))<\/span>
\n
\n# node = swap(data[0:4].encode('hex'))<\/span>
\n
\nnode =<\/span> data[<\/span>0<\/span>:4<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>
\n
\n# print('nodey ' + node)<\/span>
\n
\nclock_seq =<\/span> swap(<\/span>data[<\/span>4<\/span>:5<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>)<\/span>
\nreserved =<\/span> swap(<\/span>data[<\/span>5<\/span>:6<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>)<\/span>
\n
\ntime_hi =<\/span> swap(<\/span>data[<\/span>6<\/span>:7<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>)<\/span>
\nversion =<\/span> swap(<\/span>data[<\/span>7<\/span>:8<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>)<\/span>
\n
\ntime_mid =<\/span> data[<\/span>8<\/span>:10<\/span>]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>
\n
\ntime_low =<\/span> data[<\/span>10<\/span>:]<\/span>.encode<\/span>(<\/span>'hex'<\/span>)<\/span>
\n
\n# one big string & IPMIutil formatting style<\/span>
\nprint<\/span>(<\/span>"%s\\t<\/span>%s\\t<\/span>%s-%s%s-%s%s-%s-%s"<\/span> %
\n(<\/span>target,<\/span> node + clock_seq + reserved + time_hi + version + time_mid + time_low,<\/span>
\nnode,<\/span> clock_seq,<\/span> reserved,<\/span> time_hi,<\/span> version,<\/span> time_mid,<\/span> time_low)<\/span>)<\/span>
\n
\nudp.close<\/span>(<\/span>)<\/span>
\n
\n#<\/span>
\n# ... this should also catch parsing stuff in parse_response<\/span>
\n#<\/span>
\nexcept<\/span> Exception<\/span>,<\/span> e:
\nsys<\/span>.stderr<\/span>.write<\/span>(<\/span>"%s - hmmm.... problems in IPMI paradise, tonto: %s, bailin'\\n<\/span>"<\/span> % (<\/span>target,<\/span> e)<\/span>)<\/span><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

I’d had this sitting around for awhile and thought I’d take another look at it; in this I simply toss out an IPMI\u00a0Get Device ID command and see what happens. This is an interesting one; the GUID is a Vendor Specific ID – the specification says that it’s “a unique number per device”, and that […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31,88,176,154,172,4,6],"tags":[289,113,290],"class_list":["post-1052","post","type-post","status-publish","format-standard","hentry","category-code","category-dinosaurs","category-embedded","category-ipmi-2","category-python","category-security","category-tech","tag-guid","tag-ipmi","tag-same-ol-same-ol"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1052"}],"version-history":[{"count":3,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1052\/revisions"}],"predecessor-version":[{"id":1055,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/1052\/revisions\/1055"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}