More work on AMT 802.1x support.
Ylian Saint-Hilaire committed
Apr 5, 2022 at 21:52 UTC
fc805eb48bcd04d9d2b4be366c66e5e45790b21b
1 file changed
+21
-23
amtmanager.js
+21
-23
@@ -422,43 +422,45 @@ module.exports.CreateAmtManager = function (parent) {
422
// The 802.1x profile request is done, set it in Intel AMT.
423
if (devFound.netAuthSatReqTimer != null) { clearTimeout(devFound.netAuthSatReqTimer); delete devFound.netAuthSatReqTimer; }
424
425
- if ((event.response == null) || (typeof event.response != 'object') || (typeof event.response.action != 'string')) {
425
+ if ((event.response == null) || (typeof event.response != 'object')) {
426
// Unable to create a 802.1x profile
427
delete devFound.netAuthSatReqId;
428
if (isAmtDeviceValid(devFound) == false) return; // Device no longer exists, ignore this request.
429
delete devFound.netAuthSatReqData;
430
devFound.consoleMsg("MeshCentral Satellite could not create a 802.1x profile for this device.");
431
devTaskCompleted(devFound);
432
+ return;
433
}
434
434
- delete devFound.netAuthSatReqId;
435
- if (typeof event.response.authProtocol != 'number') break;
435
+ if (typeof event.response.authProtocol != 'number') { delete devFound.netAuthSatReqId; break; }
436
437
// We got a new 802.1x profile
438
devFound.netAuthCredentials = event.response;
439
+ console.log('devFound.netAuthCredentials', devFound.netAuthCredentials);
440
if (devFound.netAuthCredentials.certificate) {
441
// The new 802.1x profile includes a new certificate, add it now before adding the 802.1x profiles
442
// devFound.netAuthCredentials.certificate must be in DER encoded format
443
devFound.consoleMsg("Setting up new 802.1x certificate...");
443
- devFound.amtstack.AMT_PublicKeyManagementService_AddCertificate(devFound.netAuthCredentials.certificate, function (stack, name, response, status) {
444
- if (status != 200) {
445
- devFound.consoleMsg("Unable to set 802.1x certificate.");
446
- } else {
444
445
+ const f = function AddCertificateResponse(stack, name, response, status) {
446
+ if ((status != 200) || (response.Body['ReturnValue'] != 0)) {
447
+ AddCertificateResponse.dev.consoleMsg("Unable to set 802.1x certificate.");
448
+ } else {
449
console.log('AddCertificate - TODO', response);
450
// TODO: Keep the certificate reference since we need it to add 802.1x profiles
451
452
// Set the 802.1x wired profile in the device
452
- devFound.consoleMsg("Setting MeshCentral Satellite 802.1x profile...");
453
- var netAuthSatReqData = devFound.netAuthSatReqData;
454
- delete devFound.netAuthSatReqData;
455
- attempt8021xSyncEx(devFound, netAuthSatReqData);
453
+ AddCertificateResponse.dev.consoleMsg("Setting MeshCentral Satellite 802.1x profile...");
454
+ const netAuthSatReqData = AddCertificateResponse.dev.netAuthSatReqData;
455
+ attempt8021xSyncEx(AddCertificateResponse.dev, netAuthSatReqData);
456
}
457
- });
457
+ }
458
+ f.dev = devFound;
459
+ devFound.amtstack.AMT_PublicKeyManagementService_AddCertificate(devFound.netAuthCredentials.certificate, f);
460
} else {
461
// No 802.1x certificate, set the 802.1x wired profile in the device
462
devFound.consoleMsg("Setting MeshCentral Satellite 802.1x profile...");
461
- var netAuthSatReqData = devFound.netAuthSatReqData;
463
+ const netAuthSatReqData = devFound.netAuthSatReqData;
464
delete devFound.netAuthSatReqData;
465
attempt8021xSyncEx(devFound, netAuthSatReqData);
466
}
@@ -1721,23 +1723,19 @@ module.exports.CreateAmtManager = function (parent) {
1723
1724
// 802.1x request to process a Certificate Signing Request, we ask Intel AMT to sign the request
1725
function attempt8021xCRSRequest(dev, event) {
1724
- console.log('attempt8021xCRSRequest', event);
1725
-
1726
- var keyPair = '<a:EndpointReference><a:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address><a:ReferenceParameters><w:ResourceURI>http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicPrivateKeyPair</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + event.keyInstanceId + '</w:Selector></w:SelectorSet></a:ReferenceParameters></a:EndpointReference>'; // keyPair EPR Reference
1727
- var signingAlgorithm = 1; // SHA-256 RSA, highest allowed value.
1728
- var nullSignedCertificateRequest = null; // DEREncodedRequest
1729
-
1726
+ if ((event.response == null) || (event.response.keyInstanceId == null)) return;
1727
+ var keyPair = '<a:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address><a:ReferenceParameters><w:ResourceURI>http://intel.com/wbem/wscim/1/amt-schema/1/AMT_PublicPrivateKeyPair</w:ResourceURI><w:SelectorSet><w:Selector Name="InstanceID">' + event.response.keyInstanceId + '</w:Selector></w:SelectorSet></a:ReferenceParameters>'; // keyPair EPR Reference
1728
+ var signingAlgorithm = 1; // 0 = SHA1-RSA, 1 = SHA256-RSA
1729
+ var nullSignedCertificateRequest = event.response.csr; // DEREncodedRequest
1730
dev.amtstack.AMT_PublicKeyManagementService_GeneratePKCS10RequestEx(keyPair, signingAlgorithm, nullSignedCertificateRequest, function (stack, name, response, status) {
1731
- if (status != 200) {
1731
+ if ((status != 200) || (response.Body['ReturnValue'] != 0)) {
1732
// Failed to get the generated key pair
1733
dev.consoleMsg("Failed to sign the certificate request.");
1734
} else {
1735
- console.log('GeneratePKCS10RequestEx', status, response);
1736
-
1735
// We got a signed certificate request, return that to the server
1736
dev.consoleMsg("Generated a signed certificate request.");
1737
var domain = parent.config.domains[dev.domainid];
1740
- parent.DispatchEvent([domain.amtmanager['802.1x'].satellitecredentials], obj, { action: 'satellite', subaction: '802.1x-CSR-Response', satelliteFlags: 2, nodeid: dev.nodeid, icon: dev.icon, domain: dev.nodeid.split('/')[1], nolog: 1, reqid: dev.netAuthSatReqId, authProtocol: domain.amtmanager['802.1x'].authenticationprotocol, devname: dev.name, osname: dev.rname });
1738
+ parent.DispatchEvent([domain.amtmanager['802.1x'].satellitecredentials], obj, { action: 'satellite', subaction: '802.1x-CSR-Response', satelliteFlags: 2, nodeid: dev.nodeid, icon: dev.icon, domain: dev.nodeid.split('/')[1], nolog: 1, reqid: dev.netAuthSatReqId, authProtocol: domain.amtmanager['802.1x'].authenticationprotocol, devname: dev.name, osname: dev.rname, signedcsr: response.Body['SignedCertificateRequest'] });
1739
}
1740
});
1741
}