- WS-Management answers are parsed with defusedxml (new dependency,
defusedxml>=0.7) with DTDs forbidden. The check for "<!DOCTYPE" in the raw
bytes it replaces missed a DTD in a UTF-16 answer, which expat reads too;
on plain HTTP (16992) anyone in the path can send one. An answer with a
DTD in any encoding is now refused as no WS-Management answer, as a UTF-8
one already was (B314, B405).
- xml.sax.saxutils only escapes the request envelopes, nothing parses with
SAX (nosec B406).
- python -m napalm_amt.record fetches the landing page without certificate
checks, as before: it sends no credentials and records what discovery
sees, and AMT's certificate is self-signed unless one was provisioned
(nosec B501). The driver itself still verifies by default (verify_ssl).
An `amt` driver (napalm_amt.AmtDriver), a ManagementControllerDriver for the
management controller of Intel vPro machines, with its own lean WS-Management
client (requests + ElementTree, HTTP Digest, ports 16992/16993).
It reads the machine's identity, hardware with the SMBIOS system UUID, firmware
(AMT with build, BIOS), power state and the hardware event log, reports what AMT
listens on (plain HTTP or TLS, KVM incl. port 5900, IDE-R), and switches the
machine's power. AMT cannot be reset over WS-Management, so there is no
reboot_host. Discovery recognises AMT by its ports and its Server header.
Tested against Intel's published AMT 12 recordings (go-wsman-messages,
Apache-2.0, see NOTICE). `python -m napalm_amt.record` records a real AMT
read-only; the first test devices are two Lenovo ThinkCentre M910x.
christianmanivong