Improved AMT 802.1x config to deal with platforms with just wired or wireless.
Ylian Saint-Hilaire committed
Apr 3, 2022 at 00:34 UTC
da2f53f05f267f6c57b0e0ba38c2ae724b4790a7
1 file changed
+230
-210
amtmanager.js
+230
-210
@@ -1324,117 +1324,126 @@ module.exports.CreateAmtManager = function (parent) {
1324
dev.amtstack.BatchEnum(null, objQuery, function (stack, name, responses, status) {
1325
const dev = stack.dev;
1326
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1327
- if (status != 200) { devTaskCompleted(dev); return; } // We can't get wireless settings, ignore and carry on.
1327
const domain = parent.config.domains[dev.domainid];
1328
1329
+ const wiredConfig = ((parent.config.domains[dev.domainid].amtmanager['802.1x'] != null) && (responses['AMT_8021XProfile'].status == 200));
1330
+ const wirelessConfig = ((responses['CIM_WiFiEndpointSettings'].status == 200) && (responses['AMT_WiFiPortConfigurationService'].status == 200) && (responses['CIM_WiFiPort'].status == 200) && (responses['CIM_IEEE8021xSettings'].status == 200));
1331
+ if (!wiredConfig && !wirelessConfig) { devTaskCompleted(dev); return; } // We can't get wired or wireless settings, ignore and carry on.
1332
+
1333
// Check if wired 802.1x needs updating
1334
var newNetAuthProfileRequested = false;
1332
- var devNetAuthProfile = responses['AMT_8021XProfile'].response;
1335
var srvNetAuthProfile = domain.amtmanager['802.1x'];
1334
- var wiredMatch = 0;
1335
- if ((srvNetAuthProfile === false) && (devNetAuthProfile != null)) {
1336
- // Remove the 802.1x profile
1337
- wiredMatch = 1;
1338
- } else if ((srvNetAuthProfile != null) && (devNetAuthProfile == null)) {
1339
- // Device has no 802.1x, add it
1340
- wiredMatch = 2;
1341
- } else if ((typeof srvNetAuthProfile == 'object') && (devNetAuthProfile != null)) {
1342
- // Check if the existing 802.1x profile look good
1343
- if (devNetAuthProfile.AuthenticationProtocol != srvNetAuthProfile.authenticationprotocol) { wiredMatch = 2; }
1344
- if (devNetAuthProfile.ServerCertificateName != srvNetAuthProfile.servercertificatename) { wiredMatch = 2; }
1345
- if (devNetAuthProfile.ServerCertificateNameComparison != srvNetAuthProfile.servercertificatenamecomparison) { wiredMatch = 2; }
1346
- if (devNetAuthProfile.ActiveInS0 != srvNetAuthProfile.availableins0) { wiredMatch = 2; }
1347
- if (typeof srvNetAuthProfile.satellitecredentials != 'string') {
1348
- // Credentials for this profile are in the config file
1349
- if (devNetAuthProfile.RoamingIdentity != srvNetAuthProfile.roamingidentity) { wiredMatch = 2; }
1350
- if (devNetAuthProfile.Username != srvNetAuthProfile.username) { wiredMatch = 2; }
1351
- if (devNetAuthProfile.Domain != srvNetAuthProfile.domain) { wiredMatch = 2; }
1336
+ var devNetAuthProfile = null;
1337
+
1338
+ if (wiredConfig) {
1339
+ var wiredMatch = 0;
1340
+ devNetAuthProfile = responses['AMT_8021XProfile'].response;
1341
+ if ((srvNetAuthProfile === false) && (devNetAuthProfile != null)) {
1342
+ // Remove the 802.1x profile
1343
+ wiredMatch = 1;
1344
+ } else if ((srvNetAuthProfile != null) && (devNetAuthProfile == null)) {
1345
+ // Device has no 802.1x, add it
1346
+ wiredMatch = 2;
1347
+ } else if ((typeof srvNetAuthProfile == 'object') && (devNetAuthProfile != null)) {
1348
+ // Check if the existing 802.1x profile look good
1349
+ if (devNetAuthProfile.AuthenticationProtocol != srvNetAuthProfile.authenticationprotocol) { wiredMatch = 2; }
1350
+ if (devNetAuthProfile.ServerCertificateName != srvNetAuthProfile.servercertificatename) { wiredMatch = 2; }
1351
+ if (devNetAuthProfile.ServerCertificateNameComparison != srvNetAuthProfile.servercertificatenamecomparison) { wiredMatch = 2; }
1352
+ if (devNetAuthProfile.ActiveInS0 != srvNetAuthProfile.availableins0) { wiredMatch = 2; }
1353
+ if (typeof srvNetAuthProfile.satellitecredentials != 'string') {
1354
+ // Credentials for this profile are in the config file
1355
+ if (devNetAuthProfile.RoamingIdentity != srvNetAuthProfile.roamingidentity) { wiredMatch = 2; }
1356
+ if (devNetAuthProfile.Username != srvNetAuthProfile.username) { wiredMatch = 2; }
1357
+ if (devNetAuthProfile.Domain != srvNetAuthProfile.domain) { wiredMatch = 2; }
1358
+ }
1359
}
1360
+ if (wiredMatch == 2) { newNetAuthProfileRequested = true; }
1361
}
1354
- if (wiredMatch == 2) { newNetAuthProfileRequested = true; }
1355
-
1356
- // If we have server WIFI profiles to sync, do this now.
1357
- if (parent.config.domains[dev.domainid].amtmanager.wifiprofiles != null) {
1358
- // The server and device WIFI profiles, find profiles to add and remove
1359
- const sevProfiles = parent.config.domains[dev.domainid].amtmanager.wifiprofiles;
1360
- const devProfiles = responses['CIM_WiFiEndpointSettings'].responses;
1361
- const netAuthProfiles = responses['CIM_IEEE8021xSettings'].responses;
1362
- var profilesToAdd = [], profilesToRemove = [];
1363
- var profilesToAdd2 = [], profilesToRemove2 = [];
1364
-
1365
- // Look at the WIFI profiles in the device
1366
- for (var i in sevProfiles) {
1367
- var sevProfile = sevProfiles[i], wirelessMatch = false;
1368
- for (var j in devProfiles) {
1369
- var devProfile = devProfiles[j];
1370
- if (
1371
- (devProfile.ElementName == sevProfile.name) &&
1372
- (devProfile.SSID == sevProfile.ssid) &&
1373
- (devProfile.AuthenticationMethod == sevProfile.authentication) &&
1374
- (devProfile.EncryptionMethod == sevProfile.encryption) &&
1375
- (devProfile.BSSType == sevProfile.type)
1376
- ) {
1377
- if (([5, 7, 32768, 32769].indexOf(sevProfile.authentication)) >= 0) {
1378
- // This is a 802.1x profile, do some extra matching.
1379
- // Start by finding the 802.1x profile for this WIFI profile
1380
- var netAuthProfile = null, netAuthMatch = false;
1381
- for (var k in netAuthProfiles) { if (netAuthProfiles[k].ElementName == devProfile.ElementName) { netAuthProfile = netAuthProfiles[k]; } }
1382
- if (netAuthProfile != null) {
1383
- netAuthMatch = true;
1384
- if (srvNetAuthProfile.authenticationprotocol != netAuthProfile['AuthenticationProtocol']) { netAuthMatch = false; }
1385
- if (srvNetAuthProfile.roamingidentity != netAuthProfile['RoamingIdentity']) { netAuthMatch = false; }
1386
- if (srvNetAuthProfile.servercertificatename != netAuthProfile['ServerCertificateName']) { netAuthMatch = false; }
1387
- if (srvNetAuthProfile.servercertificatenamecomparison != netAuthProfile['ServerCertificateNameComparison']) { netAuthMatch = false; }
1388
- if (typeof srvNetAuthProfile.satellitecredentials != 'string') {
1389
- // Credentials for this profile are in the config file
1390
- if (srvNetAuthProfile.username != netAuthProfile['Username']) { netAuthMatch = false; }
1391
- if (srvNetAuthProfile.domain != netAuthProfile['Domain']) { netAuthMatch = false; }
1362
+
1363
+ if (wirelessConfig) {
1364
+ // If we have server WIFI profiles to sync, do this now.
1365
+ if (parent.config.domains[dev.domainid].amtmanager.wifiprofiles != null) {
1366
+ // The server and device WIFI profiles, find profiles to add and remove
1367
+ const sevProfiles = parent.config.domains[dev.domainid].amtmanager.wifiprofiles;
1368
+ const devProfiles = responses['CIM_WiFiEndpointSettings'].responses;
1369
+ const netAuthProfiles = responses['CIM_IEEE8021xSettings'].responses;
1370
+ var profilesToAdd = [], profilesToRemove = [];
1371
+ var profilesToAdd2 = [], profilesToRemove2 = [];
1372
+
1373
+ // Look at the WIFI profiles in the device
1374
+ for (var i in sevProfiles) {
1375
+ var sevProfile = sevProfiles[i], wirelessMatch = false;
1376
+ for (var j in devProfiles) {
1377
+ var devProfile = devProfiles[j];
1378
+ if (
1379
+ (devProfile.ElementName == sevProfile.name) &&
1380
+ (devProfile.SSID == sevProfile.ssid) &&
1381
+ (devProfile.AuthenticationMethod == sevProfile.authentication) &&
1382
+ (devProfile.EncryptionMethod == sevProfile.encryption) &&
1383
+ (devProfile.BSSType == sevProfile.type)
1384
+ ) {
1385
+ if (([5, 7, 32768, 32769].indexOf(sevProfile.authentication)) >= 0) {
1386
+ // This is a 802.1x profile, do some extra matching.
1387
+ // Start by finding the 802.1x profile for this WIFI profile
1388
+ var netAuthProfile = null, netAuthMatch = false;
1389
+ for (var k in netAuthProfiles) { if (netAuthProfiles[k].ElementName == devProfile.ElementName) { netAuthProfile = netAuthProfiles[k]; } }
1390
+ if (netAuthProfile != null) {
1391
+ netAuthMatch = true;
1392
+ if (srvNetAuthProfile.authenticationprotocol != netAuthProfile['AuthenticationProtocol']) { netAuthMatch = false; }
1393
+ if (srvNetAuthProfile.roamingidentity != netAuthProfile['RoamingIdentity']) { netAuthMatch = false; }
1394
+ if (srvNetAuthProfile.servercertificatename != netAuthProfile['ServerCertificateName']) { netAuthMatch = false; }
1395
+ if (srvNetAuthProfile.servercertificatenamecomparison != netAuthProfile['ServerCertificateNameComparison']) { netAuthMatch = false; }
1396
+ if (typeof srvNetAuthProfile.satellitecredentials != 'string') {
1397
+ // Credentials for this profile are in the config file
1398
+ if (srvNetAuthProfile.username != netAuthProfile['Username']) { netAuthMatch = false; }
1399
+ if (srvNetAuthProfile.domain != netAuthProfile['Domain']) { netAuthMatch = false; }
1400
+ }
1401
}
1393
- }
1394
- if (netAuthMatch == true) {
1395
- // The 802.1x profile seems to match what we want, keep it.
1402
+ if (netAuthMatch == true) {
1403
+ // The 802.1x profile seems to match what we want, keep it.
1404
+ wirelessMatch = true;
1405
+ devProfile.match = true;
1406
+ }
1407
+ } else {
1408
+ // Not a 802.1x profile, looks fine, keep it.
1409
wirelessMatch = true;
1410
devProfile.match = true;
1411
}
1399
- } else {
1400
- // Not a 802.1x profile, looks fine, keep it.
1401
- wirelessMatch = true;
1402
- devProfile.match = true;
1412
}
1413
}
1414
+ if (wirelessMatch == false) { profilesToAdd.push(sevProfile); } // Add non-matching profile
1415
+ if ((wirelessMatch == false) || (([5, 7, 32768, 32769].indexOf(sevProfile.authentication)) >= 0)) { profilesToAdd2.push(sevProfile); } // Add non-matching profile or 802.1x profile
1416
}
1406
- if (wirelessMatch == false) { profilesToAdd.push(sevProfile); } // Add non-matching profile
1407
- if ((wirelessMatch == false) || (([5, 7, 32768, 32769].indexOf(sevProfile.authentication)) >= 0)) { profilesToAdd2.push(sevProfile); } // Add non-matching profile or 802.1x profile
1408
- }
1409
- for (var j in devProfiles) {
1410
- var devProfile = devProfiles[j];
1411
- if (devProfile.InstanceID != null) {
1412
- if (devProfile.match !== true) { profilesToRemove.push(devProfile); } // Missing profile to remove
1413
- if ((devProfile.match !== true) || (([5, 7, 32768, 32769].indexOf(devProfile.AuthenticationMethod)) >= 0)) { profilesToRemove2.push(devProfile); } // Missing profile to remove or 802.1x profile
1417
+ for (var j in devProfiles) {
1418
+ var devProfile = devProfiles[j];
1419
+ if (devProfile.InstanceID != null) {
1420
+ if (devProfile.match !== true) { profilesToRemove.push(devProfile); } // Missing profile to remove
1421
+ if ((devProfile.match !== true) || (([5, 7, 32768, 32769].indexOf(devProfile.AuthenticationMethod)) >= 0)) { profilesToRemove2.push(devProfile); } // Missing profile to remove or 802.1x profile
1422
+ }
1423
}
1415
- }
1424
1417
- // Compute what priorities are allowed
1418
- var prioritiesInUse = [];
1419
- for (var j in devProfiles) { if (devProfiles[j].match == true) { prioritiesInUse.push(devProfiles[j].Priority); } }
1425
+ // Compute what priorities are allowed
1426
+ var prioritiesInUse = [];
1427
+ for (var j in devProfiles) { if (devProfiles[j].match == true) { prioritiesInUse.push(devProfiles[j].Priority); } }
1428
1421
- // Check if any other WIFI profiles require a 802.1x request to MeshCentral Satellite
1422
- if (dev.netAuthCredentials == null) {
1423
- for (var i in profilesToAdd) { if (([5, 7, 32768, 32769].indexOf(profilesToAdd[i].authentication)) >= 0) { newNetAuthProfileRequested = true; } }
1424
- }
1429
+ // Check if any other WIFI profiles require a 802.1x request to MeshCentral Satellite
1430
+ if (dev.netAuthCredentials == null) {
1431
+ for (var i in profilesToAdd) { if (([5, 7, 32768, 32769].indexOf(profilesToAdd[i].authentication)) >= 0) { newNetAuthProfileRequested = true; } }
1432
+ }
1433
1426
- // If we need to request a new 802.1x profile, remove all existing 802.1x WIFI profiles and re-add later.
1427
- if (newNetAuthProfileRequested) {
1428
- profilesToAdd = profilesToAdd2; // Just use the second list we built for this purpose.
1429
- profilesToRemove = profilesToRemove2;
1430
- }
1434
+ // If we need to request a new 802.1x profile, remove all existing 802.1x WIFI profiles and re-add later.
1435
+ if (newNetAuthProfileRequested) {
1436
+ profilesToAdd = profilesToAdd2; // Just use the second list we built for this purpose.
1437
+ profilesToRemove = profilesToRemove2;
1438
+ }
1439
1432
- // Notify of WIFI profile changes
1433
- if ((profilesToAdd.length > 0) || (profilesToRemove.length > 0)) { dev.consoleMsg("Changing WIFI profiles, adding " + profilesToAdd.length + ", removing " + profilesToRemove.length + "."); }
1440
+ // Notify of WIFI profile changes
1441
+ if ((profilesToAdd.length > 0) || (profilesToRemove.length > 0)) { dev.consoleMsg("Changing WIFI profiles, adding " + profilesToAdd.length + ", removing " + profilesToRemove.length + "."); }
1442
1435
- // Remove any extra WIFI profiles
1436
- for (var i in profilesToRemove) {
1437
- dev.amtstack.Delete('CIM_WiFiEndpointSettings', { InstanceID: 'Intel(r) AMT:WiFi Endpoint Settings ' + profilesToRemove[i].ElementName }, function (stack, name, responses, status) { }, 0, 1);
1443
+ // Remove any extra WIFI profiles
1444
+ for (var i in profilesToRemove) {
1445
+ dev.amtstack.Delete('CIM_WiFiEndpointSettings', { InstanceID: 'Intel(r) AMT:WiFi Endpoint Settings ' + profilesToRemove[i].ElementName }, function (stack, name, responses, status) { }, 0, 1);
1446
+ }
1447
}
1448
1449
if (newNetAuthProfileRequested) {
@@ -1442,7 +1451,7 @@ module.exports.CreateAmtManager = function (parent) {
1451
// Send a message to Satellite requesting a 802.1x profile for this device
1452
dev.consoleMsg("Requesting 802.1x credentials for " + netAuthStrings[srvNetAuthProfile.authenticationprotocol] + " from MeshCentral Satellite...");
1453
dev.netAuthSatReqId = Buffer.from(parent.crypto.randomBytes(16), 'binary').toString('base64'); // Generate a crypto-secure request id.
1445
- dev.netAuthSatReqData = { domain: domain, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses }
1454
+ dev.netAuthSatReqData = { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses }
1455
parent.DispatchEvent([srvNetAuthProfile.satellitecredentials], obj, { action: 'satellite', satelliteFlags: 2, nodeid: dev.nodeid, domain: dev.nodeid.split('/')[1], nolog: 1, reqid: dev.netAuthSatReqId, authProtocol: srvNetAuthProfile.authenticationprotocol, devname: dev.name });
1456
1457
// Set a response timeout
@@ -1460,7 +1469,7 @@ module.exports.CreateAmtManager = function (parent) {
1469
return;
1470
} else {
1471
// No need to call MeshCentral Satellite for a 802.1x profile, so configure everything now.
1463
- attemptWifiSyncEx(dev, { domain: domain, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses });
1472
+ attemptWifiSyncEx(dev, { domain: domain, wiredConfig: wiredConfig, wirelessConfig: wirelessConfig, devNetAuthProfile: devNetAuthProfile, srvNetAuthProfile: srvNetAuthProfile, profilesToAdd: profilesToAdd, prioritiesInUse: prioritiesInUse, responses: responses });
1473
}
1474
}
1475
});
@@ -1474,100 +1483,38 @@ module.exports.CreateAmtManager = function (parent) {
1483
const srvNetAuthProfile = devNetAuthData.srvNetAuthProfile;
1484
const profilesToAdd = devNetAuthData.profilesToAdd;
1485
const responses = devNetAuthData.responses;
1486
+ const wiredConfig = devNetAuthData.wiredConfig;
1487
+ const wirelessConfig = devNetAuthData.wirelessConfig;
1488
+
1489
+ if (wiredConfig) {
1490
+ var netAuthProfile = Clone(devNetAuthProfile);
1491
+ netAuthProfile['Enabled'] = ((srvNetAuthProfile != null) && (typeof srvNetAuthProfile == 'object'));
1492
+ if (netAuthProfile['Enabled']) {
1493
+ netAuthProfile['ActiveInS0'] = (srvNetAuthProfile.availableInS0 !== false);
1494
+ netAuthProfile['AuthenticationProtocol'] = srvNetAuthProfile.authenticationprotocol;
1495
+ if (srvNetAuthProfile.roamingidentity && (srvNetAuthProfile.roamingidentity != '')) { netAuthProfile['RoamingIdentity'] = srvNetAuthProfile.roamingidentity; } else { delete netAuthProfile['RoamingIdentity']; }
1496
+ if (srvNetAuthProfile.servercertificatename && (srvNetAuthProfile.servercertificatename != '')) {
1497
+ netAuthProfile['ServerCertificateName'] = srvNetAuthProfile.servercertificatename;
1498
+ netAuthProfile['ServerCertificateNameComparison'] = srvNetAuthProfile.servercertificatenamecomparison;
1499
+ } else {
1500
+ delete netAuthProfile['ServerCertificateName'];
1501
+ delete netAuthProfile['ServerCertificateNameComparison'];
1502
+ }
1503
+ if (srvNetAuthProfile.username && (srvNetAuthProfile.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile.username; } else { delete netAuthProfile['Username']; }
1504
+ if (srvNetAuthProfile.password && (srvNetAuthProfile.password != '')) { netAuthProfile['Password'] = srvNetAuthProfile.password; } else { delete netAuthProfile['Password']; }
1505
+ if (srvNetAuthProfile.domain && (srvNetAuthProfile.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile.domain; } else { delete netAuthProfile['Domain']; }
1506
+ if (srvNetAuthProfile.authenticationprotocol > 3) {
1507
+ netAuthProfile['ProtectedAccessCredential'] = srvNetAuthProfile.protectedaccesscredentialhex;
1508
+ netAuthProfile['PACPassword'] = srvNetAuthProfile.pacpassword;
1509
+ } else {
1510
+ delete netAuthProfile['ProtectedAccessCredential'];
1511
+ delete netAuthProfile['PACPassword'];
1512
+ }
1513
+ //if (parseInt(Q('idx_d27clientcert').value) >= 0) { netAuthProfile['ClientCertificate'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27clientcert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ClientCertificate']; }
1514
+ //if (parseInt(Q('idx_d27servercert').value) >= 0) { netAuthProfile['ServerCertificateIssuer'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27servercert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ServerCertificateIssuer']; }
1515
+ netAuthProfile['PxeTimeout'] = (typeof srvNetAuthProfile.pxetimeoutinseconds == 'number') ? srvNetAuthProfile.pxetimeoutinseconds : 120;
1516
1478
- var netAuthProfile = Clone(devNetAuthProfile);
1479
- netAuthProfile['Enabled'] = ((srvNetAuthProfile != null) && (typeof srvNetAuthProfile == 'object'));
1480
- if (netAuthProfile['Enabled']) {
1481
- netAuthProfile['ActiveInS0'] = (srvNetAuthProfile.availableInS0 !== false);
1482
- netAuthProfile['AuthenticationProtocol'] = srvNetAuthProfile.authenticationprotocol;
1483
- if (srvNetAuthProfile.roamingidentity && (srvNetAuthProfile.roamingidentity != '')) { netAuthProfile['RoamingIdentity'] = srvNetAuthProfile.roamingidentity; } else { delete netAuthProfile['RoamingIdentity']; }
1484
- if (srvNetAuthProfile.servercertificatename && (srvNetAuthProfile.servercertificatename != '')) {
1485
- netAuthProfile['ServerCertificateName'] = srvNetAuthProfile.servercertificatename;
1486
- netAuthProfile['ServerCertificateNameComparison'] = srvNetAuthProfile.servercertificatenamecomparison;
1487
- } else {
1488
- delete netAuthProfile['ServerCertificateName'];
1489
- delete netAuthProfile['ServerCertificateNameComparison'];
1490
- }
1491
- if (srvNetAuthProfile.username && (srvNetAuthProfile.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile.username; } else { delete netAuthProfile['Username']; }
1492
- if (srvNetAuthProfile.password && (srvNetAuthProfile.password != '')) { netAuthProfile['Password'] = srvNetAuthProfile.password; } else { delete netAuthProfile['Password']; }
1493
- if (srvNetAuthProfile.domain && (srvNetAuthProfile.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile.domain; } else { delete netAuthProfile['Domain']; }
1494
- if (srvNetAuthProfile.authenticationprotocol > 3) {
1495
- netAuthProfile['ProtectedAccessCredential'] = srvNetAuthProfile.protectedaccesscredentialhex;
1496
- netAuthProfile['PACPassword'] = srvNetAuthProfile.pacpassword;
1497
- } else {
1498
- delete netAuthProfile['ProtectedAccessCredential'];
1499
- delete netAuthProfile['PACPassword'];
1500
- }
1501
- //if (parseInt(Q('idx_d27clientcert').value) >= 0) { netAuthProfile['ClientCertificate'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27clientcert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ClientCertificate']; }
1502
- //if (parseInt(Q('idx_d27servercert').value) >= 0) { netAuthProfile['ServerCertificateIssuer'] = '<a:Address>/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>' + amtstack.CompleteName('AMT_PublicKeyCertificate') + '</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d27servercert').value)]['InstanceID'] + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; } else { delete sc['ServerCertificateIssuer']; }
1503
- netAuthProfile['PxeTimeout'] = (typeof srvNetAuthProfile.pxetimeoutinseconds == 'number') ? srvNetAuthProfile.pxetimeoutinseconds : 120;
1504
-
1505
- // If we have a MeshCentral Satellite profile, use that
1506
- if (dev.netAuthCredentials != null) {
1507
- const srvNetAuthProfile2 = dev.netAuthCredentials;
1508
- if (srvNetAuthProfile2.username && (srvNetAuthProfile2.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile2.username; }
1509
- if (srvNetAuthProfile2.password && (srvNetAuthProfile2.password != '')) { netAuthProfile['Password'] = srvNetAuthProfile2.password; }
1510
- if (srvNetAuthProfile2.domain && (srvNetAuthProfile2.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile2.domain; }
1511
- }
1512
- }
1513
- dev.amtstack.Put('AMT_8021XProfile', netAuthProfile, function (stack, name, responses, status) {
1514
- const dev = stack.dev;
1515
- if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1516
- if (status == 200) { dev.consoleMsg("802.1x wired profile set."); }
1517
- attemptWifiSyncEx(dev, devNetAuthData);
1518
- });
1519
- }
1520
-
1521
- function attemptWifiSyncEx(dev, devNetAuthData) {
1522
- // Unpack
1523
- var domain = devNetAuthData.domain;
1524
- var devNetAuthProfile = devNetAuthData.devNetAuthProfile;
1525
- var srvNetAuthProfile = devNetAuthData.srvNetAuthProfile;
1526
- var profilesToAdd = devNetAuthData.profilesToAdd;
1527
- var responses = devNetAuthData.responses;
1528
- var prioritiesInUse = devNetAuthData.prioritiesInUse;
1529
-
1530
- // Add missing WIFI profiles
1531
- var nextPriority = 0;
1532
- for (var i in profilesToAdd) {
1533
- while (prioritiesInUse.indexOf(nextPriority) >= 0) { nextPriority++; } // Figure out the next available priority slot.
1534
- var profileToAdd = profilesToAdd[i];
1535
- const wifiep = {
1536
- __parameterType: 'reference',
1537
- __resourceUri: 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_WiFiEndpoint',
1538
- Name: 'WiFi Endpoint 0'
1539
- };
1540
- const wifiepsettinginput = {
1541
- __parameterType: 'instance',
1542
- __namespace: 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_WiFiEndpointSettings',
1543
- ElementName: profileToAdd.name,
1544
- InstanceID: 'Intel(r) AMT:WiFi Endpoint Settings ' + profileToAdd.name,
1545
- AuthenticationMethod: profileToAdd.authentication,
1546
- EncryptionMethod: profileToAdd.encryption,
1547
- SSID: profileToAdd.ssid,
1548
- Priority: nextPriority,
1549
- }
1550
- var netAuthProfile, netAuthSettingsClientCert, netAuthSettingsServerCaCert;
1551
- if (([4, 6].indexOf(profileToAdd.authentication)) >= 0) { wifiepsettinginput['PSKPassPhrase'] = profileToAdd.password; }
1552
- if (([5, 7, 32768, 32769].indexOf(profileToAdd.authentication)) >= 0) {
1553
- netAuthProfile = {
1554
- '__parameterType': 'instance',
1555
- '__namespace': dev.amtstack.CompleteName('CIM_IEEE8021xSettings'),
1556
- 'ElementName': '8021x-' + profileToAdd.name,
1557
- 'InstanceID': '8021x-' + profileToAdd.name,
1558
- 'ActiveInS0': (domain.amtmanager['802.1x'].availableins0 !== false),
1559
- 'AuthenticationProtocol': domain.amtmanager['802.1x'].authenticationprotocol
1560
- };
1561
- if (domain.amtmanager['802.1x'].roamingidentity) { netAuthProfile['RoamingIdentity'] = domain.amtmanager['802.1x'].roamingidentity; }
1562
- if (domain.amtmanager['802.1x'].servercertificatename) { netAuthProfile['ServerCertificateName'] = domain.amtmanager['802.1x'].servercertificatename; netAuthProfile['ServerCertificateNameComparison'] = profileToAdd['802.1x'].servercertificatenamecomparison; }
1563
- if (domain.amtmanager['802.1x'].username) { netAuthProfile['Username'] = domain.amtmanager['802.1x'].username; }
1564
- if (domain.amtmanager['802.1x'].password) { netAuthProfile['Password'] = domain.amtmanager['802.1x'].password; }
1565
- if (domain.amtmanager['802.1x'].domain) { netAuthProfile['Domain'] = domain.amtmanager['802.1x'].domain; }
1566
- if (domain.amtmanager['802.1x'].authenticationprotocol > 3) { domain.amtmanager['ProtectedAccessCredential'] = profileToAdd['802.1x'].protectedaccesscredentialhex; netAuthProfile['PACPassword'] = profileToAdd['802.1x'].pacpassword; }
1567
- //if (parseInt(Q('idx_d12clientcert').value) >= 0) { netAuthSettingsClientCert = '<Address xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing">http://schemas.xmlsoap.org/ws/2004/08/addressing</Address><ReferenceParameters xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing"><ResourceURI xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicKeyCertificate</ResourceURI><SelectorSet xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"><Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d12clientcert').value)]['InstanceID'] + '</Selector></SelectorSet></ReferenceParameters>'; }
1568
- //if (parseInt(Q('idx_d12servercert').value) >= 0) { netAuthSettingsServerCaCert = '<Address xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing">http://schemas.xmlsoap.org/ws/2004/08/addressing</Address><ReferenceParameters xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing"><ResourceURI xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicKeyCertificate</ResourceURI><SelectorSet xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"><Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d12servercert').value)]['InstanceID'] + '</Selector></SelectorSet></ReferenceParameters>'; }
1569
-
1570
- // If we have credentials from MeshCentral Satelite, use that
1517
+ // If we have a MeshCentral Satellite profile, use that
1518
if (dev.netAuthCredentials != null) {
1519
const srvNetAuthProfile2 = dev.netAuthCredentials;
1520
if (srvNetAuthProfile2.username && (srvNetAuthProfile2.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile2.username; }
@@ -1575,35 +1522,108 @@ module.exports.CreateAmtManager = function (parent) {
1522
if (srvNetAuthProfile2.domain && (srvNetAuthProfile2.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile2.domain; }
1523
}
1524
}
1578
- prioritiesInUse.push(nextPriority); // Occupy the priority slot and add the WIFI profile.
1579
- dev.amtstack.AMT_WiFiPortConfigurationService_AddWiFiSettings(wifiep, wifiepsettinginput, netAuthProfile, netAuthSettingsClientCert, netAuthSettingsServerCaCert, function (stack, name, responses, status) { });
1580
- }
1581
-
1582
- // Check if local WIFI profile sync is enabled, if not, enabled it.
1583
- if ((responses['AMT_WiFiPortConfigurationService'] != null) && (responses['AMT_WiFiPortConfigurationService'].response != null) && (responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] == 0)) {
1584
- responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] = 1;
1585
- dev.amtstack.Put('AMT_WiFiPortConfigurationService', responses['AMT_WiFiPortConfigurationService'].response, function (stack, name, response, status) {
1586
- if (status != 200) { dev.consoleMsg("Unable to enable local WIFI profile sync."); } else { dev.consoleMsg("Enabled local WIFI profile sync."); }
1525
+ dev.amtstack.Put('AMT_8021XProfile', netAuthProfile, function (stack, name, responses, status) {
1526
+ const dev = stack.dev;
1527
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1528
+ if (status == 200) { dev.consoleMsg("802.1x wired profile set."); }
1529
+ attemptWifiSyncEx(dev, devNetAuthData);
1530
});
1531
+ } else {
1532
+ // No wired interface, skip with WIFI config
1533
+ attemptWifiSyncEx(dev, devNetAuthData);
1534
}
1535
+ }
1536
1590
- // Change the WIFI state if needed. Right now, we always enable it.
1591
- // WifiState = { 3: "Disabled", 32768: "Enabled in S0", 32769: "Enabled in S0, Sx/AC" };
1592
- var wifiState = 32769; // For now, always enable WIFI
1593
- if (responses['CIM_WiFiPort'].responses.Body.EnabledState != 32769) {
1594
- if (wifiState == 3) {
1595
- dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1596
- const dev = stack.dev;
1597
- if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1598
- if (status == 200) { dev.consoleMsg("Disabled WIFI."); }
1599
- });
1600
- } else {
1601
- dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1602
- const dev = stack.dev;
1603
- if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1604
- if (status == 200) { dev.consoleMsg("Enabled WIFI."); }
1537
+ function attemptWifiSyncEx(dev, devNetAuthData) {
1538
+ // Unpack
1539
+ const domain = devNetAuthData.domain;
1540
+ const devNetAuthProfile = devNetAuthData.devNetAuthProfile;
1541
+ const srvNetAuthProfile = devNetAuthData.srvNetAuthProfile;
1542
+ const profilesToAdd = devNetAuthData.profilesToAdd;
1543
+ const responses = devNetAuthData.responses;
1544
+ const prioritiesInUse = devNetAuthData.prioritiesInUse;
1545
+ const wiredConfig = devNetAuthData.wiredConfig;
1546
+ const wirelessConfig = devNetAuthData.wirelessConfig;
1547
+
1548
+ if (wirelessConfig) {
1549
+ // Add missing WIFI profiles
1550
+ var nextPriority = 0;
1551
+ for (var i in profilesToAdd) {
1552
+ while (prioritiesInUse.indexOf(nextPriority) >= 0) { nextPriority++; } // Figure out the next available priority slot.
1553
+ var profileToAdd = profilesToAdd[i];
1554
+ const wifiep = {
1555
+ __parameterType: 'reference',
1556
+ __resourceUri: 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_WiFiEndpoint',
1557
+ Name: 'WiFi Endpoint 0'
1558
+ };
1559
+ const wifiepsettinginput = {
1560
+ __parameterType: 'instance',
1561
+ __namespace: 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_WiFiEndpointSettings',
1562
+ ElementName: profileToAdd.name,
1563
+ InstanceID: 'Intel(r) AMT:WiFi Endpoint Settings ' + profileToAdd.name,
1564
+ AuthenticationMethod: profileToAdd.authentication,
1565
+ EncryptionMethod: profileToAdd.encryption,
1566
+ SSID: profileToAdd.ssid,
1567
+ Priority: nextPriority,
1568
+ }
1569
+ var netAuthProfile, netAuthSettingsClientCert, netAuthSettingsServerCaCert;
1570
+ if (([4, 6].indexOf(profileToAdd.authentication)) >= 0) { wifiepsettinginput['PSKPassPhrase'] = profileToAdd.password; }
1571
+ if (([5, 7, 32768, 32769].indexOf(profileToAdd.authentication)) >= 0) {
1572
+ netAuthProfile = {
1573
+ '__parameterType': 'instance',
1574
+ '__namespace': dev.amtstack.CompleteName('CIM_IEEE8021xSettings'),
1575
+ 'ElementName': '8021x-' + profileToAdd.name,
1576
+ 'InstanceID': '8021x-' + profileToAdd.name,
1577
+ 'ActiveInS0': (domain.amtmanager['802.1x'].availableins0 !== false),
1578
+ 'AuthenticationProtocol': domain.amtmanager['802.1x'].authenticationprotocol
1579
+ };
1580
+ if (domain.amtmanager['802.1x'].roamingidentity) { netAuthProfile['RoamingIdentity'] = domain.amtmanager['802.1x'].roamingidentity; }
1581
+ if (domain.amtmanager['802.1x'].servercertificatename) { netAuthProfile['ServerCertificateName'] = domain.amtmanager['802.1x'].servercertificatename; netAuthProfile['ServerCertificateNameComparison'] = profileToAdd['802.1x'].servercertificatenamecomparison; }
1582
+ if (domain.amtmanager['802.1x'].username) { netAuthProfile['Username'] = domain.amtmanager['802.1x'].username; }
1583
+ if (domain.amtmanager['802.1x'].password) { netAuthProfile['Password'] = domain.amtmanager['802.1x'].password; }
1584
+ if (domain.amtmanager['802.1x'].domain) { netAuthProfile['Domain'] = domain.amtmanager['802.1x'].domain; }
1585
+ if (domain.amtmanager['802.1x'].authenticationprotocol > 3) { domain.amtmanager['ProtectedAccessCredential'] = profileToAdd['802.1x'].protectedaccesscredentialhex; netAuthProfile['PACPassword'] = profileToAdd['802.1x'].pacpassword; }
1586
+ //if (parseInt(Q('idx_d12clientcert').value) >= 0) { netAuthSettingsClientCert = '<Address xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing">http://schemas.xmlsoap.org/ws/2004/08/addressing</Address><ReferenceParameters xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing"><ResourceURI xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicKeyCertificate</ResourceURI><SelectorSet xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"><Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d12clientcert').value)]['InstanceID'] + '</Selector></SelectorSet></ReferenceParameters>'; }
1587
+ //if (parseInt(Q('idx_d12servercert').value) >= 0) { netAuthSettingsServerCaCert = '<Address xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing">http://schemas.xmlsoap.org/ws/2004/08/addressing</Address><ReferenceParameters xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing"><ResourceURI xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd">http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicKeyCertificate</ResourceURI><SelectorSet xmlns="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"><Selector Name="InstanceID">' + xxCertificates[parseInt(Q('idx_d12servercert').value)]['InstanceID'] + '</Selector></SelectorSet></ReferenceParameters>'; }
1588
+
1589
+ // If we have credentials from MeshCentral Satelite, use that
1590
+ if (dev.netAuthCredentials != null) {
1591
+ const srvNetAuthProfile2 = dev.netAuthCredentials;
1592
+ if (srvNetAuthProfile2.username && (srvNetAuthProfile2.username != '')) { netAuthProfile['Username'] = srvNetAuthProfile2.username; }
1593
+ if (srvNetAuthProfile2.password && (srvNetAuthProfile2.password != '')) { netAuthProfile['Password'] = srvNetAuthProfile2.password; }
1594
+ if (srvNetAuthProfile2.domain && (srvNetAuthProfile2.domain != '')) { netAuthProfile['Domain'] = srvNetAuthProfile2.domain; }
1595
+ }
1596
+ }
1597
+ prioritiesInUse.push(nextPriority); // Occupy the priority slot and add the WIFI profile.
1598
+ dev.amtstack.AMT_WiFiPortConfigurationService_AddWiFiSettings(wifiep, wifiepsettinginput, netAuthProfile, netAuthSettingsClientCert, netAuthSettingsServerCaCert, function (stack, name, responses, status) { });
1599
+ }
1600
+
1601
+ // Check if local WIFI profile sync is enabled, if not, enabled it.
1602
+ if ((responses['AMT_WiFiPortConfigurationService'] != null) && (responses['AMT_WiFiPortConfigurationService'].response != null) && (responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] == 0)) {
1603
+ responses['AMT_WiFiPortConfigurationService'].response['localProfileSynchronizationEnabled'] = 1;
1604
+ dev.amtstack.Put('AMT_WiFiPortConfigurationService', responses['AMT_WiFiPortConfigurationService'].response, function (stack, name, response, status) {
1605
+ if (status != 200) { dev.consoleMsg("Unable to enable local WIFI profile sync."); } else { dev.consoleMsg("Enabled local WIFI profile sync."); }
1606
});
1607
}
1608
+
1609
+ // Change the WIFI state if needed. Right now, we always enable it.
1610
+ // WifiState = { 3: "Disabled", 32768: "Enabled in S0", 32769: "Enabled in S0, Sx/AC" };
1611
+ var wifiState = 32769; // For now, always enable WIFI
1612
+ if (responses['CIM_WiFiPort'].responses.Body.EnabledState != 32769) {
1613
+ if (wifiState == 3) {
1614
+ dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1615
+ const dev = stack.dev;
1616
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1617
+ if (status == 200) { dev.consoleMsg("Disabled WIFI."); }
1618
+ });
1619
+ } else {
1620
+ dev.amtstack.CIM_WiFiPort_RequestStateChange(wifiState, null, function (stack, name, responses, status) {
1621
+ const dev = stack.dev;
1622
+ if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1623
+ if (status == 200) { dev.consoleMsg("Enabled WIFI."); }
1624
+ });
1625
+ }
1626
+ }
1627
}
1628
1629
// Done