Added preparations for Intel AMT 802.1x support.
Ylian Saint-Hilaire committed
Mar 18, 2022 at 13:49 UTC
a1943e3df199720955a374046a4acec0e5575063
2 files changed
+212
-19
amtmanager.js
+67
-17
@@ -64,30 +64,61 @@ module.exports.CreateAmtManager = function (parent) {
64
}
65
66
// Check WIFI profiles
67
- //var wifiAuthMethod = { 1: "Other", 2: "Open", 3: "Shared Key", 4: "WPA PSK", 5: "WPA 802.1x", 6: "WPA2 PSK", 7: "WPA2 802.1x", 32768: "WPA3 802.1x" };
67
+ //var wifiAuthMethod = { 1: "Other", 2: "Open", 3: "Shared Key", 4: "WPA PSK", 5: "WPA 802.1x", 6: "WPA2 PSK", 7: "WPA2 802.1x", 32768: "WPA3 SAE IEEE 802.1x", 32769: "WPA3 OWE IEEE 802.1x" };
68
//var wifiEncMethod = { 1: "Other", 2: "WEP", 3: "TKIP", 4: "CCMP", 5: "None" }
69
if (Array.isArray(domain.amtmanager.wifiprofiles) == true) {
70
var goodWifiProfiles = [];
71
for (var i = 0; i < domain.amtmanager.wifiprofiles.length; i++) {
72
var wifiProfile = domain.amtmanager.wifiprofiles[i];
73
- if ((typeof wifiProfile.ssid == 'string') && (wifiProfile.ssid != '') && (typeof wifiProfile.password == 'string') && (wifiProfile.password != '')) {
73
+ if ((typeof wifiProfile.ssid == 'string') && (wifiProfile.ssid != '') && (((typeof wifiProfile.password == 'string') && (wifiProfile.password != '')) || ((typeof wifiProfile['802.1x'] == 'object') && (wifiProfile['802.1x'] != null)))) {
74
if ((wifiProfile.name == null) || (wifiProfile.name == '')) { wifiProfile.name = wifiProfile.ssid; }
75
- if (typeof wifiProfile.authentication == 'string') {
76
- // Authentication
77
- if (typeof wifiProfile.authentication == 'string') { wifiProfile.authentication = wifiProfile.authentication.toLowerCase(); }
78
- if (wifiProfile.authentication == 'wpa-psk') { wifiProfile.authentication = 4; }
79
- if (wifiProfile.authentication == 'wpa2-psk') { wifiProfile.authentication = 6; }
80
- if (typeof wifiProfile.authentication != 'number') { wifiProfile.authentication = 6; } // Default to WPA2-PSK
81
-
82
- // Encyption
83
- if (typeof wifiProfile.encryption == 'string') { wifiProfile.encryption = wifiProfile.encryption.toLowerCase(); }
84
- if ((wifiProfile.encryption == 'ccmp-aes') || (wifiProfile.encryption == 'ccmp')) { wifiProfile.encryption = 4; }
85
- if ((wifiProfile.encryption == 'tkip-rc4') || (wifiProfile.encryption == 'tkip')) { wifiProfile.encryption = 3; }
86
- if (typeof wifiProfile.encryption != 'number') { wifiProfile.encryption = 4; } // Default to CCMP-AES
87
-
88
- // Type
89
- wifiProfile.type = 3; // Infrastructure
75
+
76
+ // Authentication
77
+ if (typeof wifiProfile.authentication == 'string') { wifiProfile.authentication = wifiProfile.authentication.toLowerCase(); }
78
+ if (wifiProfile.authentication == 'wpa-psk') { wifiProfile.authentication = 4; }
79
+ if (wifiProfile.authentication == 'wpa2-psk') { wifiProfile.authentication = 6; }
80
+ if (wifiProfile.authentication == 'wpa-8021x') { wifiProfile.authentication = 5; }
81
+ if (wifiProfile.authentication == 'wpa2-802.1x') { wifiProfile.authentication = 7; }
82
+ if (wifiProfile.authentication == 'wpa3-sae-802.1x') { wifiProfile.authentication = 32768; }
83
+ if (wifiProfile.authentication == 'wpa3-owe-802.1x') { wifiProfile.authentication = 32769; }
84
+ if (typeof wifiProfile.authentication != 'number') {
85
+ if (wifiProfile['802.1x']) { wifiProfile.authentication = 7; } // Default to WPA2-802.1x
86
+ else { wifiProfile.authentication = 6; } // Default to WPA2-PSK
87
+ }
88
+
89
+ // Encyption
90
+ if (typeof wifiProfile.encryption == 'string') { wifiProfile.encryption = wifiProfile.encryption.toLowerCase(); }
91
+ if ((wifiProfile.encryption == 'ccmp-aes') || (wifiProfile.encryption == 'ccmp')) { wifiProfile.encryption = 4; }
92
+ if ((wifiProfile.encryption == 'tkip-rc4') || (wifiProfile.encryption == 'tkip')) { wifiProfile.encryption = 3; }
93
+ if (typeof wifiProfile.encryption != 'number') { wifiProfile.encryption = 4; } // Default to CCMP-AES
94
+
95
+ // Type
96
+ wifiProfile.type = 3; // Infrastructure
97
+
98
+ // Check authentication
99
+ if ([4, 6].indexOf(wifiProfile.authentication) >= 0) {
100
+ // Password authentication
101
+ if ((typeof wifiProfile.password != 'string') || (wifiProfile.password.length < 8) || (wifiProfile.password.length > 63)) continue;
102
+ } else if ([5, 7, 32768, 32769].indexOf(wifiProfile.authentication) >= 0) {
103
+ // 802.1x authentication
104
+ if ((wifiProfile['802.1x'] == null) && (typeof wifiProfile['802.1x'] != 'object')) continue;
105
+ const netAuthStrings = ['eap-tls', 'eap-ttls/mschapv2', 'peapv0/eap-mschapv2', 'peapv1/eap-gtc', 'eap-fast/mschapv2', 'eap-fast/gtc', 'eap-md5', 'eap-psk', 'eap-sim', 'eap-aka', 'eap-fast/tls'];
106
+
107
+ if (typeof wifiProfile['802.1x'].servercertificatename != 'string') {
108
+ delete wifiProfile['802.1x'].servercertificatenamecomparison;
109
+ const serverCertCompareStrings = ['', '', 'fullname', 'domainsuffix'];
110
+ if (typeof wifiProfile['802.1x'].servercertificatenamecomparison == 'string') {
111
+ wifiProfile['802.1x'].servercertificatenamecomparison = serverCertCompareStrings.indexOf(wifiProfile['802.1x'].servercertificatenamecomparison.toLowerCase());
112
+ if (wifiProfile['802.1x'].servercertificatenamecomparison == -1) { wifiProfile['802.1x'].servercertificatenamecomparison = 2; } // Default to full name compare
113
+ }
114
+ }
115
+
116
+ if (typeof wifiProfile['802.1x'].authenticationprotocol == 'string') {
117
+ wifiProfile['802.1x'].authenticationprotocol = netAuthStrings.indexOf(wifiProfile['802.1x'].authenticationprotocol.toLowerCase());
118
+ if (wifiProfile['802.1x'].authenticationprotocol == -1) continue;
119
+ }
120
}
121
+
122
goodWifiProfiles.push(wifiProfile);
123
}
124
}
@@ -95,6 +126,25 @@ module.exports.CreateAmtManager = function (parent) {
126
} else {
127
delete domain.amtmanager.wifiprofiles;
128
}
129
+
130
+ // Check 802.1x wired profile if present
131
+ if ((domain.amtmanager['802.1x'] != null) && (typeof domain.amtmanager['802.1x'] == 'object')) {
132
+ const netAuthStrings = ['eap-tls', 'eap-ttls/mschapv2', 'peapv0/eap-mschapv2', 'peapv1/eap-gtc', 'eap-fast/mschapv2', 'eap-fast/gtc', 'eap-md5', 'eap-psk', 'eap-sim', 'eap-aka', 'eap-fast/tls'];
133
+
134
+ if (typeof domain.amtmanager['802.1x'].servercertificatename != 'string') {
135
+ delete domain.amtmanager['802.1x'].servercertificatenamecomparison;
136
+ const serverCertCompareStrings = ['', '', 'fullname', 'domainsuffix'];
137
+ if (typeof domain.amtmanager['802.1x'].servercertificatenamecomparison == 'string') {
138
+ domain.amtmanager['802.1x'].servercertificatenamecomparison = serverCertCompareStrings.indexOf(domain.amtmanager['802.1x'].servercertificatenamecomparison.toLowerCase());
139
+ if (domain.amtmanager['802.1x'].servercertificatenamecomparison == -1) { domain.amtmanager['802.1x'].servercertificatenamecomparison = 2; } // Default to full name compare
140
+ }
141
+ }
142
+
143
+ if (typeof domain.amtmanager['802.1x'].authenticationprotocol == 'string') {
144
+ domain.amtmanager['802.1x'].authenticationprotocol = netAuthStrings.indexOf(domain.amtmanager['802.1x'].authenticationprotocol.toLowerCase());
145
+ if (domain.amtmanager['802.1x'].authenticationprotocol == -1) { delete domain.amtmanager['802.1x']; }
146
+ }
147
+ }
148
}
149
150
// Check if an Intel AMT device is being managed
meshcentral-config-schema.json
+145
-2
@@ -682,7 +682,7 @@
682
"items": {
683
"type": "object",
684
"additionalProperties": false,
685
- "required": [ "ssid", "password" ],
685
+ "required": [ "ssid" ],
686
"properties": {
687
"name": {
688
"description": "WIFI profile name, if not specified the SSID is used.",
@@ -695,7 +695,7 @@
695
"authentication": {
696
"description": "WIFI authentication.",
697
"type": "string",
698
- "enum": [ "wpa2-psk", "wpa-psk" ],
698
+ "enum": [ "wpa-psk", "wpa2-psk", "wpa-8021x", "wpa2-802.1x", "wpa3-sae-802.1x", "wpa3-owe-802.1x" ],
699
"default": "wpa2-psk"
700
},
701
"encryption": {
@@ -709,9 +709,152 @@
709
"type": "string",
710
"minLength": 8,
711
"maxLength": 63
712
+ },
713
+ "802.1x": {
714
+ "description": "802.1x settings for this WIFI profile. Only required if the WIFI authentication type has 802.1x",
715
+ "default": null,
716
+ "type": "object",
717
+ "additionalProperties": false,
718
+ "required": [ "authenticationProtocol" ],
719
+ "properties": {
720
+ "authenticationProtocol": {
721
+ "description": "Identifies the authentication protocol used to authenticate the access requestor to the AAA server.",
722
+ "type": [ "integer", "string" ],
723
+ "enum": [ "EAP-TLS", "EAP-TTLS/MSCHAPv2", "PEAPv0/EAP-MSCHAPv2", "PEAPv1/EAP-GTC", "EAP-FAST/MSCHAPv2", "EAP-FAST/GTC", "EAP-MD5", "EAP-PSK", "EAP-SIM", "EAP-AKA", "EAP-FAST/TLS", 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ]
724
+ },
725
+ "serverCertificateNameComparison": {
726
+ "type": [ "integer", "string" ],
727
+ "default": "FullName",
728
+ "description": "Determines the comparison algorithm used between the ServerCertificateName value and the subject name field of the certificate presented by the AAA server.",
729
+ "enum": [ "FullName", "DomainSuffix", 2, 3 ]
730
+ },
731
+ "serverCertificateName": {
732
+ "type": "string",
733
+ "default": null,
734
+ "description": "The name compared against the subject name field in the certificate provided by the AAA server.",
735
+ "maxLength": 80
736
+ },
737
+ "availableInS0": {
738
+ "type": "boolean",
739
+ "default": true,
740
+ "description": "Indicates the activity setting of the 802.1X module in H0 state"
741
+ },
742
+ "protectedAccessCredentialHex": {
743
+ "type": "string",
744
+ "default": null,
745
+ "description": "A credential used by the supplicant and AAA server to establish a mutually authenticated encrypted tunnel for confidential user authentication.",
746
+ "maxLength": 64
747
+ },
748
+ "pacPassword": {
749
+ "type": "string",
750
+ "default": null,
751
+ "description": "Optional password to extract the PAC (Protected Access Credential) information from the PAC data.",
752
+ "maxLength": 256
753
+ },
754
+ "domain": {
755
+ "type": "string",
756
+ "default": null,
757
+ "description": "The domain within which Username is unique.",
758
+ "maxLength": 128
759
+ },
760
+ "username": {
761
+ "type": "string",
762
+ "default": null,
763
+ "description": "Within the domain specified by Domain, Identifies the user that is requesting access to the network.",
764
+ "maxLength": 128
765
+ },
766
+ "password": {
767
+ "type": "string",
768
+ "default": null,
769
+ "description": "The password associated with the user identified by Username and Domain.",
770
+ "maxLength": 32
771
+ },
772
+ "roamingIdentity": {
773
+ "type": "string",
774
+ "default": null,
775
+ "description": "A string presented to the authentication server in 802.1x protocol exchange",
776
+ "maxLength": 80
777
+ },
778
+ "pxeTimeoutInSeconds": {
779
+ "type": "integer",
780
+ "default": 120,
781
+ "description": "Timeout in seconds, in which the Intel(R) AMT will hold an authenticated 802.1X session."
782
+ }
783
+ }
784
}
785
}
786
}
787
+ },
788
+ "802.1x": {
789
+ "description": "802.1x settings for the Intel AMT Wired interface. If set to false, any existing 802.1x wired profile will be removed from Intel AMT.",
790
+ "default": null,
791
+ "type": [ "object", "boolean" ],
792
+ "additionalProperties": false,
793
+ "required": [ "authenticationProtocol" ],
794
+ "properties": {
795
+ "authenticationProtocol": {
796
+ "description": "Identifies the authentication protocol used to authenticate the access requestor to the AAA server.",
797
+ "type": [ "integer", "string" ],
798
+ "enum": [ "EAP-TLS", "EAP-TTLS/MSCHAPv2", "PEAPv0/EAP-MSCHAPv2", "PEAPv1/EAP-GTC", "EAP-FAST/MSCHAPv2", "EAP-FAST/GTC", "EAP-MD5", "EAP-PSK", "EAP-SIM", "EAP-AKA", "EAP-FAST/TLS", 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ]
799
+ },
800
+ "serverCertificateNameComparison": {
801
+ "type": [ "integer", "string" ],
802
+ "description": "Determines the comparison algorithm used between the ServerCertificateName value and the subject name field of the certificate presented by the AAA server.",
803
+ "enum": [ "FullName", "DomainSuffix", 2, 3 ]
804
+ },
805
+ "serverCertificateName": {
806
+ "type": "string",
807
+ "default": null,
808
+ "description": "The name compared against the subject name field in the certificate provided by the AAA server.",
809
+ "maxLength": 80
810
+ },
811
+ "availableInS0": {
812
+ "type": "boolean",
813
+ "default": true,
814
+ "description": "Indicates the activity setting of the 802.1X module in H0 state"
815
+ },
816
+ "protectedAccessCredentialHex": {
817
+ "type": "string",
818
+ "default": null,
819
+ "description": "A credential used by the supplicant and AAA server to establish a mutually authenticated encrypted tunnel for confidential user authentication.",
820
+ "maxLength": 64
821
+ },
822
+ "pacPassword": {
823
+ "type": "string",
824
+ "default": null,
825
+ "description": "Optional password to extract the PAC (Protected Access Credential) information from the PAC data.",
826
+ "maxLength": 256
827
+ },
828
+ "domain": {
829
+ "type": "string",
830
+ "default": null,
831
+ "description": "The domain within which Username is unique.",
832
+ "maxLength": 128
833
+ },
834
+ "username": {
835
+ "type": "string",
836
+ "default": null,
837
+ "description": "Within the domain specified by Domain, Identifies the user that is requesting access to the network.",
838
+ "maxLength": 128
839
+ },
840
+ "password": {
841
+ "type": "string",
842
+ "default": null,
843
+ "description": "The password associated with the user identified by Username and Domain.",
844
+ "maxLength": 32
845
+ },
846
+ "roamingIdentity": {
847
+ "type": "string",
848
+ "default": null,
849
+ "description": "A string presented to the authentication server in 802.1x protocol exchange",
850
+ "maxLength": 80
851
+ },
852
+ "pxeTimeoutInSeconds": {
853
+ "type": "integer",
854
+ "default": 120,
855
+ "description": "Timeout in seconds, in which the Intel(R) AMT will hold an authenticated 802.1X session."
856
+ }
857
+ }
858
}
859
}
860
},