Added support for AMT 802.1x wired profile.
Ylian Saint-Hilaire committed
Mar 21, 2022 at 18:43 UTC
c3ca5b3076f4b48a6678094de42e0cfe31157a38
1 file changed
+115
-31
amtmanager.js
+115
-31
@@ -678,31 +678,34 @@ module.exports.CreateAmtManager = function (parent) {
678
attemptTlsSync(dev, function (dev) {
679
// If we need to switch to TLS, do it now.
680
if (dev.switchToTls == 1) { delete dev.switchToTls; attemptInitialContact(dev); return; }
681
- // Check Intel AMT WIFI state
682
- attemptWifiSync(dev, function (dev) {
683
- // Check Intel AMT root certificate state
684
- attemptRootCertSync(dev, function (dev) {
685
- // Check Intel AMT CIRA settings
686
- attemptCiraSync(dev, function (dev) {
687
- // Check Intel AMT settings
688
- attemptSettingsSync(dev, function (dev) {
689
- // See if we need to get hardware inventory
690
- attemptFetchHardwareInventory(dev, function (dev) {
691
- dev.consoleMsg('Done.');
692
-
693
- // Remove from task limiter if needed
694
- if (dev.taskid != null) { obj.parent.taskLimiter.completed(dev.taskid); delete dev.taskLimiter; }
695
-
696
- if (dev.connType != 2) {
697
- // Start power polling if not connected to LMS
698
- var ppfunc = function powerPoleFunction() { fetchPowerState(powerPoleFunction.dev); }
699
- ppfunc.dev = dev;
700
- dev.polltimer = new setTimeout(ppfunc, 290000); // Poll for power state every 4 minutes 50 seconds.
701
- fetchPowerState(dev);
702
- } else {
703
- // For LMS connections, close now.
704
- dev.controlMsg({ action: 'close' });
705
- }
681
+ // Check Intel AMT 802.1x state
682
+ attempt8021xSync(dev, function (dev) {
683
+ // Check Intel AMT WIFI state
684
+ attemptWifiSync(dev, function (dev) {
685
+ // Check Intel AMT root certificate state
686
+ attemptRootCertSync(dev, function (dev) {
687
+ // Check Intel AMT CIRA settings
688
+ attemptCiraSync(dev, function (dev) {
689
+ // Check Intel AMT settings
690
+ attemptSettingsSync(dev, function (dev) {
691
+ // See if we need to get hardware inventory
692
+ attemptFetchHardwareInventory(dev, function (dev) {
693
+ dev.consoleMsg('Done.');
694
+
695
+ // Remove from task limiter if needed
696
+ if (dev.taskid != null) { obj.parent.taskLimiter.completed(dev.taskid); delete dev.taskLimiter; }
697
+
698
+ if (dev.connType != 2) {
699
+ // Start power polling if not connected to LMS
700
+ var ppfunc = function powerPoleFunction() { fetchPowerState(powerPoleFunction.dev); }
701
+ ppfunc.dev = dev;
702
+ dev.polltimer = new setTimeout(ppfunc, 290000); // Poll for power state every 4 minutes 50 seconds.
703
+ fetchPowerState(dev);
704
+ } else {
705
+ // For LMS connections, close now.
706
+ dev.controlMsg({ action: 'close' });
707
+ }
708
+ });
709
});
710
});
711
});
@@ -1281,6 +1284,87 @@ module.exports.CreateAmtManager = function (parent) {
1284
}
1285
1286
1287
+ //
1288
+ // Intel AMT 802.1x wired
1289
+ //
1290
+
1291
+ // This method will sync the 802.1x wired profile from the device and the server
1292
+ function attempt8021xSync(dev, func) {
1293
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1294
+ if (dev.policy.amtPolicy == 0) { func(dev); return; } // If there is no Intel AMT policy, skip this operation.
1295
+ if (dev.connType != 2) { func(dev); return; } // Only configure 802.1x over a CIRA-LMS link.
1296
+ if (parent.config.domains[dev.domainid].amtmanager['802.1x'] == null) { func(dev); return; } // No 802.1x policy, leave device as-is.
1297
+
1298
+ // Get the current 802.1x profilee
1299
+ dev.taskCount = 1;
1300
+ dev.taskCompleted = func;
1301
+ dev.amtstack.BatchEnum(null, ['*AMT_8021XProfile'], function (stack, name, responses, status) {
1302
+ const dev = stack.dev;
1303
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1304
+ if (status != 200) { devTaskCompleted(dev); return; } // We can't get the 802.1x settings, maybe no wired interface, ignore and carry on.
1305
+ var devNetAuthProfile = responses['AMT_8021XProfile'].response;
1306
+ var srvNetAuthProfile = parent.config.domains[dev.domainid].amtmanager['802.1x'];
1307
+ var match = true;
1308
+ if ((srvNetAuthProfile === false) && (devNetAuthProfile != null)) {
1309
+ // Remove the 802.1x profile
1310
+ match = false;
1311
+ } else if ((srvNetAuthProfile != null) && (devNetAuthProfile == null)) {
1312
+ // Device has no 802.1x, add it
1313
+ match = false;
1314
+ } else if ((typeof srvNetAuthProfile == 'object') && (devNetAuthProfile != null)) {
1315
+ // Check if the existing 802.1x profile look good
1316
+ if (devNetAuthProfile.AuthenticationProtocol != srvNetAuthProfile.authenticationprotocol) { match = false; }
1317
+ if (devNetAuthProfile.RoamingIdentity != srvNetAuthProfile.roamingidentity) { match = false; }
1318
+ if (devNetAuthProfile.ServerCertificateName != srvNetAuthProfile.servercertificatename) { match = false; }
1319
+ if (devNetAuthProfile.ServerCertificateNameComparison != srvNetAuthProfile.servercertificatenamecomparison) { match = false; }
1320
+ if (devNetAuthProfile.Username != srvNetAuthProfile.username) { match = false; }
1321
+ if (devNetAuthProfile.Domain != srvNetAuthProfile.domain) { match = false; }
1322
+ if (devNetAuthProfile.ActiveInS0 != srvNetAuthProfile.availableins0) { match = false; }
1323
+ }
1324
+
1325
+ // If there is a mismatch, set the new 802.1x profile
1326
+ if (match == false) {
1327
+ var netAuthProfile = Clone(devNetAuthProfile);
1328
+ netAuthProfile['Enabled'] = ((srvNetAuthProfile != null) && (typeof srvNetAuthProfile == 'object'));
1329
+ if (netAuthProfile['Enabled']) {
1330
+ netAuthProfile['ActiveInS0'] = (srvNetAuthProfile.availableInS0 !== false);
1331
+ netAuthProfile['AuthenticationProtocol'] = srvNetAuthProfile.authenticationprotocol;
1332
+ if (srvNetAuthProfile.roamingidentity && (srvNetAuthProfile.roamingidentity != '')) { netAuthProfile['RoamingIdentity'] = srvNetAuthProfile.roamingidentity; } else { delete netAuthProfile['RoamingIdentity']; }
1333
+ if (srvNetAuthProfile.servercertificatename && (srvNetAuthProfile.servercertificatename != '')) {
1334
+ netAuthProfile['ServerCertificateName'] = srvNetAuthProfile.servercertificatename;
1335
+ netAuthProfile['ServerCertificateNameComparison'] = srvNetAuthProfile.servercertificatenamecomparison;
1336
+ } else {
1337
+ delete netAuthProfile['ServerCertificateName'];
1338
+ delete netAuthProfile['ServerCertificateNameComparison'];
1339
+ }
1340
+ if (srvNetAuthProfile.username && (srvNetAuthProfile.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile.username; } else { delete netAuthProfile['Username']; }
1341
+ if (srvNetAuthProfile.password && (srvNetAuthProfile.password != '')) { netAuthProfile['Password'] = srvNetAuthProfile.password; } else { delete netAuthProfile['Password']; }
1342
+ if (srvNetAuthProfile.domain && (srvNetAuthProfile.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile.domain; } else { delete netAuthProfile['Domain']; }
1343
+ if (srvNetAuthProfile.authenticationprotocol > 3) {
1344
+ netAuthProfile['ProtectedAccessCredential'] = srvNetAuthProfile.protectedaccesscredentialhex;
1345
+ netAuthProfile['PACPassword'] = srvNetAuthProfile.pacpassword;
1346
+ } else {
1347
+ delete netAuthProfile['ProtectedAccessCredential'];
1348
+ delete netAuthProfile['PACPassword'];
1349
+ }
1350
+ //if (parseInt(Q('idx_d27clientcert').value) >= 0) { netAuthProfile['ClientCertificate'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27clientcert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ClientCertificate']; }
1351
+ //if (parseInt(Q('idx_d27servercert').value) >= 0) { netAuthProfile['ServerCertificateIssuer'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27servercert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ServerCertificateIssuer']; }
1352
+ netAuthProfile['PxeTimeout'] = (typeof srvNetAuthProfile.pxetimeoutinseconds == 'number') ? srvNetAuthProfile.pxetimeoutinseconds : 120;
1353
+ }
1354
+ dev.amtstack.Put('AMT_8021XProfile', netAuthProfile, function (stack, name, responses, status) {
1355
+ const dev = stack.dev;
1356
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1357
+ if (status == 200) { dev.consoleMsg("802.1x wired profile set."); }
1358
+ devTaskCompleted(dev);
1359
+ });
1360
+ } else {
1361
+ // Nothing to do
1362
+ devTaskCompleted(dev);
1363
+ }
1364
+ });
1365
+ }
1366
+
1367
+
1368
//
1369
// Intel AMT WIFI
1370
//
@@ -1329,12 +1413,12 @@ module.exports.CreateAmtManager = function (parent) {
1413
for (var k in netAuthProfiles) { if (netAuthProfiles[k].ElementName == devProfile.ElementName) { netAuthProfile = netAuthProfiles[k]; } }
1414
if (netAuthProfile != null) {
1415
netAuthMatch = true;
1332
- if (sevProfile['802.1x'].authenticationprotocol != netAuthProfile['AuthenticationProtocol']) { console.log('Y1'); netAuthMatch = false; }
1333
- if (sevProfile['802.1x'].roamingidentity != netAuthProfile['RoamingIdentity']) { console.log('Y3'); netAuthMatch = false; }
1334
- if (sevProfile['802.1x'].servercertificatename != netAuthProfile['ServerCertificateName']) { console.log('Y4'); netAuthMatch = false; }
1335
- if (sevProfile['802.1x'].servercertificatenamecomparison != netAuthProfile['ServerCertificateNameComparison']) { console.log('Y5'); netAuthMatch = false; }
1336
- if (sevProfile['802.1x'].username != netAuthProfile['Username']) { console.log('Y6'); netAuthMatch = false; }
1337
- if (sevProfile['802.1x'].domain != netAuthProfile['Domain']) { console.log('Y7'); netAuthMatch = false; }
1416
+ if (sevProfile['802.1x'].authenticationprotocol != netAuthProfile['AuthenticationProtocol']) { netAuthMatch = false; }
1417
+ if (sevProfile['802.1x'].roamingidentity != netAuthProfile['RoamingIdentity']) { netAuthMatch = false; }
1418
+ if (sevProfile['802.1x'].servercertificatename != netAuthProfile['ServerCertificateName']) { netAuthMatch = false; }
1419
+ if (sevProfile['802.1x'].servercertificatenamecomparison != netAuthProfile['ServerCertificateNameComparison']) { netAuthMatch = false; }
1420
+ if (sevProfile['802.1x'].username != netAuthProfile['Username']) { netAuthMatch = false; }
1421
+ if (sevProfile['802.1x'].domain != netAuthProfile['Domain']) { netAuthMatch = false; }
1422
}
1423
if (netAuthMatch == true) {
1424
// The 802.1x profile seems to match what we want