Fixed exception when configuring Intel AMT devices that do not have WIFI.
Ylian Saint-Hilaire committed
Jun 19, 2022 at 11:43 UTC
5e070a09cb00d5e0df93a29b6fedc7bae60b5315
1 file changed
+69
-66
amtmanager.js
+69
-66
@@ -1525,55 +1525,55 @@ module.exports.CreateAmtManager = function (parent) {
1525
dev.amtstack.Delete('CIM_WiFiEndpointSettings', { InstanceID: 'Intel(r) AMT:WiFi Endpoint Settings ' + profilesToRemove[i].ElementName }, function (stack, name, responses, status) { }, 0, 1);
1526
}
1527
}
1528
+ }
1529
1529
- // Check the 802.1x client certificate expiration time
1530
- // TODO: We are only getting the client cert from the wired 802.1x profile, need to get it for wireless too.
1531
- var netAuthClientCert = null;
1532
- if (netAuthClientCertInstanceId != null) {
1533
- netAuthClientCert = getInstance(responses['AMT_PublicKeyCertificate'].responses, netAuthClientCertInstanceId);
1534
- if (netAuthClientCert) {
1535
- var cert = null;
1536
- try { cert = obj.parent.certificateOperations.forge.pki.certificateFromAsn1(obj.parent.certificateOperations.forge.asn1.fromDer(obj.parent.certificateOperations.forge.util.decode64(netAuthClientCert.X509Certificate))); } catch (ex) { }
1537
- if (cert != null) {
1538
- const certStart = new Date(cert.validity.notBefore).getTime();
1539
- const certEnd = new Date(cert.validity.notAfter).getTime();
1540
- const certMidPoint = certStart + ((certEnd - certStart) / 2);
1541
- if (Date.now() > certMidPoint) { newNetAuthProfileRequested = true; } // Past mid-point or expired, request a new 802.1x certificate & profile
1542
- }
1530
+ // Check the 802.1x client certificate expiration time
1531
+ // TODO: We are only getting the client cert from the wired 802.1x profile, need to get it for wireless too.
1532
+ var netAuthClientCert = null;
1533
+ if (netAuthClientCertInstanceId != null) {
1534
+ netAuthClientCert = getInstance(responses['AMT_PublicKeyCertificate'].responses, netAuthClientCertInstanceId);
1535
+ if (netAuthClientCert) {
1536
+ var cert = null;
1537
+ try { cert = obj.parent.certificateOperations.forge.pki.certificateFromAsn1(obj.parent.certificateOperations.forge.asn1.fromDer(obj.parent.certificateOperations.forge.util.decode64(netAuthClientCert.X509Certificate))); } catch (ex) { }
1538
+ if (cert != null) {
1539
+ const certStart = new Date(cert.validity.notBefore).getTime();
1540
+ const certEnd = new Date(cert.validity.notAfter).getTime();
1541
+ const certMidPoint = certStart + ((certEnd - certStart) / 2);
1542
+ if (Date.now() > certMidPoint) { newNetAuthProfileRequested = true; } // Past mid-point or expired, request a new 802.1x certificate & profile
1543
}
1544
}
1545
+ }
1546
1546
- // Figure out is there are no changes to 802.1x wired configuration
1547
- if ((wiredMatch == 0) && (newNetAuthProfileRequested == false)) { wiredConfig = false; }
1548
-
1549
- // See if we need to ask MeshCentral Satellite for a new 802.1x profile
1550
- if (newNetAuthProfileRequested && (typeof srvNetAuthProfile.satellitecredentials == 'string')) {
1551
- // Credentials for this 802.1x profile are provided using MeshCentral Satellite
1552
- // Send a message to Satellite requesting a 802.1x profile for this device
1553
- dev.consoleMsg("Requesting 802.1x credentials for " + netAuthStrings[srvNetAuthProfile.authenticationprotocol] + " from MeshCentral Satellite...");
1554
- dev.netAuthSatReqId = Buffer.from(parent.crypto.randomBytes(16), 'binary').toString('base64'); // Generate a crypto-secure request id.
1555
- dev.netAuthSatReqData = { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses, xxCertificates: xxCertificates, xxCertPrivateKeys: xxCertPrivateKeys }
1556
- const request = { action: 'satellite', subaction: '802.1x-ProFile-Request', satelliteFlags: 2, nodeid: dev.nodeid, icon: dev.icon, domain: dev.nodeid.split('/')[1], nolog: 1, reqid: dev.netAuthSatReqId, authProtocol: srvNetAuthProfile.authenticationprotocol, devname: dev.name, osname: dev.rname, ver: dev.intelamt.ver };
1557
- if (netAuthClientCert != null) { request.cert = netAuthClientCert.X509Certificate; request.certid = netAuthClientCertInstanceId; }
1558
- parent.DispatchEvent([srvNetAuthProfile.satellitecredentials], obj, request);
1559
-
1560
- // Set a response timeout
1561
- const netAuthTimeoutFunc = function netAuthTimeout() {
1562
- if (isAmtDeviceValid(netAuthTimeout.dev) == false) return; // Device no longer exists, ignore this request.
1563
- if (dev.netAuthSatReqId != null) {
1564
- delete netAuthTimeout.dev.netAuthSatReqId;
1565
- delete netAuthTimeout.dev.netAuthSatReqData;
1566
- netAuthTimeout.dev.consoleMsg("MeshCentral Satellite did not respond in time, 802.1x profile will not be set.");
1567
- devTaskCompleted(netAuthTimeout.dev);
1568
- }
1547
+ // Figure out if there are no changes to 802.1x wired configuration
1548
+ if ((wiredMatch == 0) && (newNetAuthProfileRequested == false)) { wiredConfig = false; }
1549
+
1550
+ // See if we need to ask MeshCentral Satellite for a new 802.1x profile
1551
+ if (newNetAuthProfileRequested && (typeof srvNetAuthProfile.satellitecredentials == 'string')) {
1552
+ // Credentials for this 802.1x profile are provided using MeshCentral Satellite
1553
+ // Send a message to Satellite requesting a 802.1x profile for this device
1554
+ dev.consoleMsg("Requesting 802.1x credentials for " + netAuthStrings[srvNetAuthProfile.authenticationprotocol] + " from MeshCentral Satellite...");
1555
+ dev.netAuthSatReqId = Buffer.from(parent.crypto.randomBytes(16), 'binary').toString('base64'); // Generate a crypto-secure request id.
1556
+ dev.netAuthSatReqData = { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses, xxCertificates: xxCertificates, xxCertPrivateKeys: xxCertPrivateKeys }
1557
+ const request = { action: 'satellite', subaction: '802.1x-ProFile-Request', satelliteFlags: 2, nodeid: dev.nodeid, icon: dev.icon, domain: dev.nodeid.split('/')[1], nolog: 1, reqid: dev.netAuthSatReqId, authProtocol: srvNetAuthProfile.authenticationprotocol, devname: dev.name, osname: dev.rname, ver: dev.intelamt.ver };
1558
+ if (netAuthClientCert != null) { request.cert = netAuthClientCert.X509Certificate; request.certid = netAuthClientCertInstanceId; }
1559
+ parent.DispatchEvent([srvNetAuthProfile.satellitecredentials], obj, request);
1560
+
1561
+ // Set a response timeout
1562
+ const netAuthTimeoutFunc = function netAuthTimeout() {
1563
+ if (isAmtDeviceValid(netAuthTimeout.dev) == false) return; // Device no longer exists, ignore this request.
1564
+ if (dev.netAuthSatReqId != null) {
1565
+ delete netAuthTimeout.dev.netAuthSatReqId;
1566
+ delete netAuthTimeout.dev.netAuthSatReqData;
1567
+ netAuthTimeout.dev.consoleMsg("MeshCentral Satellite did not respond in time, 802.1x profile will not be set.");
1568
+ devTaskCompleted(netAuthTimeout.dev);
1569
}
1570
- netAuthTimeoutFunc.dev = dev;
1571
- dev.netAuthSatReqTimer = setTimeout(netAuthTimeoutFunc, 20000);
1572
- return;
1573
- } else {
1574
- // No need to call MeshCentral Satellite for a 802.1x profile, so configure everything now.
1575
- attempt8021xSyncEx(dev, { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses, xxCertificates: xxCertificates, xxCertPrivateKeys: xxCertPrivateKeys });
1570
}
1571
+ netAuthTimeoutFunc.dev = dev;
1572
+ dev.netAuthSatReqTimer = setTimeout(netAuthTimeoutFunc, 20000);
1573
+ return;
1574
+ } else {
1575
+ // No need to call MeshCentral Satellite for a 802.1x profile, so configure everything now.
1576
+ attempt8021xSyncEx(dev, { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses, xxCertificates: xxCertificates, xxCertPrivateKeys: xxCertPrivateKeys });
1577
}
1578
});
1579
}
@@ -1813,32 +1813,35 @@ module.exports.CreateAmtManager = function (parent) {
1813
function attemptWifiSyncEx2(dev, devNetAuthData) {
1814
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1815
const responses = devNetAuthData.responses;
1816
+ const wirelessConfig = devNetAuthData.wirelessConfig;
1817
1817
- // Check if local WIFI profile sync is enabled, if not, enabled it.
1818
- if ((responses['AMT_WiFiPortConfigurationService'] != null) && (responses['AMT_WiFiPortConfigurationService'].response != null) && (responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] == 0)) {
1819
- responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] = 1;
1820
- dev.amtstack.Put('AMT_WiFiPortConfigurationService', responses['AMT_WiFiPortConfigurationService'].response, function (stack, name, response, status) {
1821
- if (status != 200) { dev.consoleMsg("Unable to enable local WIFI profile sync."); } else { dev.consoleMsg("Enabled local WIFI profile sync."); }
1822
- });
1823
- }
1824
-
1825
- // Change the WIFI state if needed. Right now, we always enable it.
1826
- // WifiState = { 3: "Disabled", 32768: "Enabled in S0", 32769: "Enabled in S0, Sx/AC" };
1827
- var wifiState = 32769; // For now, always enable WIFI
1828
- if (responses['CIM_WiFiPort'].responses.Body.EnabledState != 32769) {
1829
- if (wifiState == 3) {
1830
- dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1831
- const dev = stack.dev;
1832
- if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1833
- if (status == 200) { dev.consoleMsg("Disabled WIFI."); }
1834
- });
1835
- } else {
1836
- dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1837
- const dev = stack.dev;
1838
- if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1839
- if (status == 200) { dev.consoleMsg("Enabled WIFI."); }
1818
+ if (wirelessConfig) {
1819
+ // Check if local WIFI profile sync is enabled, if not, enabled it.
1820
+ if ((responses['AMT_WiFiPortConfigurationService'] != null) && (responses['AMT_WiFiPortConfigurationService'].response != null) && (responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] == 0)) {
1821
+ responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] = 1;
1822
+ dev.amtstack.Put('AMT_WiFiPortConfigurationService', responses['AMT_WiFiPortConfigurationService'].response, function (stack, name, response, status) {
1823
+ if (status != 200) { dev.consoleMsg("Unable to enable local WIFI profile sync."); } else { dev.consoleMsg("Enabled local WIFI profile sync."); }
1824
});
1825
}
1826
+
1827
+ // Change the WIFI state if needed. Right now, we always enable it.
1828
+ // WifiState = { 3: "Disabled", 32768: "Enabled in S0", 32769: "Enabled in S0, Sx/AC" };
1829
+ var wifiState = 32769; // For now, always enable WIFI
1830
+ if (responses['CIM_WiFiPort'].responses.Body.EnabledState != 32769) {
1831
+ if (wifiState == 3) {
1832
+ dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1833
+ const dev = stack.dev;
1834
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1835
+ if (status == 200) { dev.consoleMsg("Disabled WIFI."); }
1836
+ });
1837
+ } else {
1838
+ dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1839
+ const dev = stack.dev;
1840
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1841
+ if (status == 200) { dev.consoleMsg("Enabled WIFI."); }
1842
+ });
1843
+ }
1844
+ }
1845
}
1846
1847
// Done