src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c

   1 /*
   2  * Copyright (C) 2011 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tnc_ifmap_listener.h"
  17
  18 #include <daemon.h>
  19 #include <config/child_cfg.h>
  20
  21 #include <axis2_util.h>
  22 #include <axis2_client.h>
  23 #include <axiom_soap.h>
  24
  25 #define IFMAP_NS          "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
  26 #define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
  27 #define IFMAP_LOGFILE "strongswan_ifmap.log"
  28 #define IFMAP_SERVER  "https://localhost:8443/"
  29
  30 typedef struct private_tnc_ifmap_listener_t private_tnc_ifmap_listener_t;
  31
  32 /**
  33  * Private data of an tnc_ifmap_listener_t object.
  34  */
  35 struct private_tnc_ifmap_listener_t {
  36
  37         /**
  38          * Public tnc_ifmap_listener_t interface.
  39          */
  40         tnc_ifmap_listener_t public;
  41
  42         /**
  43          * Axis2/C environment
  44          */
  45         axutil_env_t *env;
  46
  47         /**
  48          * Axis2 service client
  49          */
  50         axis2_svc_client_t* svc_client;
  51
  52         /**
  53          * SOAP Session ID
  54          */
  55         char *session_id;
  56
  57         /**
  58          * IF-MAP Publisher ID
  59          */
  60         char *ifmap_publisher_id;
  61
  62 };
  63
  64 static bool newSession(private_tnc_ifmap_listener_t *this)
  65 {
  66     axiom_node_t *request, *result, *node;
  67     axiom_element_t *el;
  68         axiom_namespace_t *ns;
  69         axiom_attribute_t *attr;
  70         axis2_char_t *value;
  71         axutil_qname_t *qname;
  72
  73         bool success = FALSE;
  74
  75         /* build newSession request */
  76     ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
  77     el = axiom_element_create(this->env, NULL, "newSession", ns, &request);
  78         attr = axiom_attribute_create(this->env, "max-poll-result-size", "1000000", NULL);
  79         axiom_element_add_attribute(el, this->env, attr, request);
  80
  81         /* send newSession request */
  82         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
  83         if (!result)
  84         {
  85                 return FALSE;
  86         }
  87
  88         /* process newSessionResult */
  89         node = axiom_node_get_first_child(result, this->env);
  90         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
  91         {
  92                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
  93                 qname = axiom_element_get_qname(el, this->env, node);
  94                 success = streq("newSessionResult",
  95                                                  axutil_qname_to_string(qname, this->env));
  96
  97                 /* process the attributes */
  98                 if (success)
  99                 {
 100                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 101                                                                  "session-id");
 102                         this->session_id = strdup(value);
 103                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 104                                                                  "ifmap-publisher-id");
 105                         this->ifmap_publisher_id = strdup(value);
 106
 107                         DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
 108                                  this->session_id, this->ifmap_publisher_id);
 109                         success = this->session_id && this->ifmap_publisher_id;
 110
 111                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 112                                                                  "max-poll-result-size");
 113                         if (value)
 114                         {
 115                                 DBG1(DBG_TNC, "max-poll-result-size: %s", value);
 116                         }
 117                 }
 118                 else
 119                 {
 120                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 121                 }
 122         }
 123         axiom_node_free_tree(result, this->env);
 124
 125     return success;
 126 }
 127
 128 static bool purgePublisher(private_tnc_ifmap_listener_t *this)
 129 {
 130         axiom_node_t *request, *result, *node;
 131         axiom_element_t *el;
 132         axiom_namespace_t *ns;
 133         axiom_attribute_t *attr;
 134         axutil_qname_t *qname;
 135         bool success = FALSE;
 136
 137         /* build purgePublisher request */
 138         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 139         el = axiom_element_create(this->env, NULL, "purgePublisher", ns,
 140                                                           &request);
 141         attr = axiom_attribute_create(this->env, "session-id",
 142                                                                   this->session_id, NULL);
 143         axiom_element_add_attribute(el, this->env, attr, request);
 144         attr = axiom_attribute_create(this->env, "ifmap-publisher-id",
 145                                                                   this->ifmap_publisher_id, NULL);
 146         axiom_element_add_attribute(el, this->env, attr, request);
 147
 148         /* send purgePublisher request */
 149         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 150         if (!result)
 151         {
 152                 return FALSE;
 153         }
 154
 155         /* process purgePublisherReceived */
 156         node = axiom_node_get_first_child(result, this->env);
 157         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 158         {
 159                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 160                 qname = axiom_element_get_qname(el, this->env, node);
 161                 success = streq("purgePublisherReceived",
 162                                                  axutil_qname_to_string(qname, this->env));
 163                 if (!success)
 164                 {
 165                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 166                 }
 167         }
 168         axiom_node_free_tree(result, this->env);
 169
 170    return success;
 171 }
 172
 173 static bool publish(private_tnc_ifmap_listener_t *this, u_int32_t ike_sa_id,
 174                                         identification_t *id, host_t *host, bool up)
 175 {
 176         axiom_node_t *request, *result, *node, *node2, *node3, *node4;
 177         axiom_element_t *el;
 178         axiom_namespace_t *ns, *ns_meta;
 179         axiom_attribute_t *attr;
 180         axiom_text_t *text;
 181         char buf[BUF_LEN], *id_type;
 182
 183         /* build publish request */
 184         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 185         el = axiom_element_create(this->env, NULL, "publish", ns, &request);
 186         attr = axiom_attribute_create(this->env, "session-id", this->session_id,
 187                                                                   NULL);
 188         axiom_element_add_attribute(el, this->env, attr, request);
 189
 190         /**
 191          * update or delete authenticated-as metadata
 192          */
 193         if (up)
 194         {
 195                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 196                 axiom_node_add_child(request, this->env, node);
 197         }
 198         else
 199         {
 200                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 201                 axiom_node_add_child(request, this->env, node);
 202
 203                 /* add filter */
 204                 attr = axiom_attribute_create(this->env, "filter",
 205                                                                           "authenticated-as", NULL);
 206                 axiom_element_add_attribute(el, this->env, attr, node);
 207         }
 208
 209         /* add access-request */
 210         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 211         axiom_node_add_child(node, this->env, node2);
 212
 213         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 214         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 215         axiom_element_add_attribute(el, this->env, attr, node2);
 216
 217         /* add identity */
 218         el = axiom_element_create(this->env, NULL, "identity", NULL, &node2);
 219         axiom_node_add_child(node, this->env, node2);
 220
 221         snprintf(buf, BUF_LEN, "%Y", id);
 222         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 223         axiom_element_add_attribute(el, this->env, attr, node2);
 224
 225         switch (id->get_type(id))
 226         {
 227                 case ID_FQDN:
 228                         id_type = "dns-name";
 229                         break;
 230                 case ID_RFC822_ADDR:
 231                         id_type = "email-address";
 232                         break;
 233                 case ID_DER_ASN1_DN:
 234                         id_type = "distinguished-name";
 235                         break;
 236                 default:
 237                         id_type = "other";
 238         }
 239         attr = axiom_attribute_create(this->env, "type", id_type, NULL);
 240         axiom_element_add_attribute(el, this->env, attr, node2);
 241
 242         if (up)
 243         {
 244                 /* add metadata */
 245                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 246                 axiom_node_add_child(node, this->env, node2);
 247
 248                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 249
 250                 el = axiom_element_create(this->env, NULL, "authenticated-as", ns_meta,
 251                                                                   &node3);
 252                 axiom_node_add_child(node2, this->env, node3);
 253                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 254                                                                           "singleValue", NULL);
 255                 axiom_element_add_attribute(el, this->env, attr, node3);
 256         }
 257
 258         /**
 259          * update or delete access-request-ip metadata
 260          */
 261         if (up)
 262         {
 263                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 264                 axiom_node_add_child(request, this->env, node);
 265         }
 266         else
 267         {
 268                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 269                 axiom_node_add_child(request, this->env, node);
 270
 271                 /* add filter */
 272                 attr = axiom_attribute_create(this->env, "filter",
 273                                                                           "access-request-ip", NULL);
 274                 axiom_element_add_attribute(el, this->env, attr, node);
 275         }
 276
 277         /* add access-request */
 278         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 279         axiom_node_add_child(node, this->env, node2);
 280
 281         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 282         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 283         axiom_element_add_attribute(el, this->env, attr, node2);
 284
 285         /* add ip-address */
 286         el = axiom_element_create(this->env, NULL, "ip-address", NULL, &node2);
 287         axiom_node_add_child(node, this->env, node2);
 288
 289         snprintf(buf, BUF_LEN, "%H", host);
 290         attr = axiom_attribute_create(this->env, "value", buf, NULL);
 291         axiom_element_add_attribute(el, this->env, attr, node2);
 292
 293         attr = axiom_attribute_create(this->env, "type",
 294                                  host->get_family(host) == AF_INET ? "IPv4" : "IPv6", NULL);
 295         axiom_element_add_attribute(el, this->env, attr, node2);
 296
 297         if (up)
 298         {
 299                 /* add metadata */
 300                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 301                 axiom_node_add_child(node, this->env, node2);
 302                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 303                 el = axiom_element_create(this->env, NULL, "access-request-ip", ns_meta,
 304                                                                   &node3);
 305                 axiom_node_add_child(node2, this->env, node3);
 306                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 307                                                                           "singleValue", NULL);
 308                 axiom_element_add_attribute(el, this->env, attr, node3);
 309         }
 310
 311         /**
 312          * update or delete authenticated-by metadata
 313          */
 314         if (up)
 315         {
 316                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 317                 axiom_node_add_child(request, this->env, node);
 318         }
 319         else
 320         {
 321                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 322                 axiom_node_add_child(request, this->env, node);
 323
 324                 /* add filter */
 325                 attr = axiom_attribute_create(this->env, "filter",
 326                                                                           "authenticated-by", NULL);
 327                 axiom_element_add_attribute(el, this->env, attr, node);
 328         }
 329
 330         /* add access-request */
 331         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 332         axiom_node_add_child(node, this->env, node2);
 333
 334         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 335         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 336         axiom_element_add_attribute(el, this->env, attr, node2);
 337
 338         /* add device */
 339         el = axiom_element_create(this->env, NULL, "device", NULL, &node2);
 340         axiom_node_add_child(node, this->env, node2);
 341         el = axiom_element_create(this->env, NULL, "name", NULL, &node3);
 342         axiom_node_add_child(node2, this->env, node3);
 343         text = axiom_text_create(this->env, node3, this->ifmap_publisher_id, &node4);
 344
 345         if (up)
 346         {
 347                 /* add metadata */
 348                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 349                 axiom_node_add_child(node, this->env, node2);
 350                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 351                 el = axiom_element_create(this->env, NULL, "authenticated-by", ns_meta,
 352                                                                   &node3);
 353                 axiom_node_add_child(node2, this->env, node3);
 354                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 355                                                                           "singleValue", NULL);
 356                 axiom_element_add_attribute(el, this->env, attr, node3);
 357         }
 358
 359         /* send publish request */
 360         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 361         if (!result)
 362         {
 363                 return FALSE;
 364         }
 365
 366         /* process publishReceived */
 367         node = axiom_node_get_first_child(result, this->env);
 368         axiom_node_free_tree(result, this->env);
 369
 370    return TRUE;
 371 }
 372
 373 static bool endSession(private_tnc_ifmap_listener_t *this)
 374 {
 375         axiom_node_t *request, *result, *node;
 376         axiom_element_t *el;
 377         axiom_namespace_t *ns;
 378         axiom_attribute_t *attr;
 379         axutil_qname_t *qname;
 380         bool success = FALSE;
 381
 382         /* build endSession request */
 383         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 384         el = axiom_element_create(this->env, NULL, "endSession", ns, &request);
 385         attr = axiom_attribute_create(this->env, "session-id", this->session_id, NULL);
 386         axiom_element_add_attribute(el, this->env, attr, request);
 387
 388         /* send endSession request */
 389         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 390         if (!result)
 391         {
 392                 return FALSE;
 393         }
 394
 395         /* process endSessionResult */
 396         node = axiom_node_get_first_child(result, this->env);
 397         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 398         {
 399                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 400                 qname = axiom_element_get_qname(el, this->env, node);
 401                 success = streq("endSessionResult",
 402                                                  axutil_qname_to_string(qname, this->env));
 403                 if (!success)
 404                 {
 405                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 406                 }
 407         }
 408         axiom_node_free_tree(result, this->env);
 409
 410    return success;
 411
 412    return TRUE;
 413 }
 414
 415 METHOD(listener_t, ike_updown, bool,
 416         private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, bool up)
 417 {
 418         u_int32_t ike_sa_id;
 419         identification_t *id;
 420         host_t *host;
 421
 422         ike_sa_id = ike_sa->get_unique_id(ike_sa);
 423         id = ike_sa->get_other_id(ike_sa);
 424         host = ike_sa->get_other_host(ike_sa);
 425
 426         DBG2(DBG_TNC, "sending publish");
 427         if (!publish(this, ike_sa_id, id, host, up))
 428         {
 429                 DBG1(DBG_TNC, "publish with MAP server failed");
 430         }
 431
 432         return TRUE;
 433 }
 434
 435 METHOD(tnc_ifmap_listener_t, destroy, void,
 436         private_tnc_ifmap_listener_t *this)
 437 {
 438         if (this->session_id)
 439         {
 440                 DBG2(DBG_TNC, "sending endSession");
 441                 if (!endSession(this))
 442                 {
 443                         DBG1(DBG_TNC, "endSession with MAP server failed");
 444                 }
 445                 free(this->session_id);
 446                 free(this->ifmap_publisher_id);
 447         }
 448         if (this->svc_client)
 449         {
 450                 axis2_svc_client_free(this->svc_client, this->env);
 451         }
 452         if (this->env)
 453         {
 454                 axutil_env_free(this->env);
 455         }
 456         free(this);
 457 }
 458
 459 /**
 460  * See header
 461  */
 462 tnc_ifmap_listener_t *tnc_ifmap_listener_create()
 463 {
 464         private_tnc_ifmap_listener_t *this;
 465         axis2_char_t *server, *client_home, *username, *password, *auth_type;
 466         axis2_endpoint_ref_t* endpoint_ref = NULL;
 467         axis2_options_t *options = NULL;
 468
 469         client_home = lib->settings->get_str(lib->settings,
 470                                         "charon.plugins.tnc-ifmap.client_home",
 471                                         AXIS2_GETENV("AXIS2C_HOME"));
 472         server = lib->settings->get_str(lib->settings,
 473                                         "charon.plugins.tnc-ifmap.server", IFMAP_SERVER);
 474         auth_type = lib->settings->get_str(lib->settings,
 475                                         "charon.plugins.tnc-ifmap.auth_type", "Basic");
 476         username = lib->settings->get_str(lib->settings,
 477                                         "charon.plugins.tnc-ifmap.username", NULL);
 478         password = lib->settings->get_str(lib->settings,
 479                                         "charon.plugins.tnc-ifmap.password", NULL);
 480
 481         if (!username || !password)
 482         {
 483                 DBG1(DBG_TNC, "MAP client %s%s%s not defined",
 484                         (!username) ? "username" : "",
 485                         (!username && ! password) ? " and " : "",
 486                         (!password) ? "password" : "");
 487         }
 488
 489         INIT(this,
 490                 .public = {
 491                         .listener = {
 492                                 .ike_updown = _ike_updown,
 493                         },
 494                         .destroy = _destroy,
 495                 },
 496         );
 497
 498         /* Create Axis2/C environment and options */
 499         this->env = axutil_env_create_all(IFMAP_LOGFILE, AXIS2_LOG_LEVEL_TRACE);
 500     options = axis2_options_create(this->env);
 501
 502         /* Define the IF-MAP server as the to endpoint reference */
 503         endpoint_ref = axis2_endpoint_ref_create(this->env, server);
 504         axis2_options_set_to(options, this->env, endpoint_ref);
 505
 506         /* Create the axis2 service client */
 507         this->svc_client = axis2_svc_client_create(this->env, client_home);
 508         if (!this->svc_client)
 509         {
 510                 DBG1(DBG_TNC, "Error creating axis2 service client");
 511                 AXIS2_LOG_ERROR(this->env->log, AXIS2_LOG_SI,
 512                                             "Stub invoke FAILED: Error code: %d :: %s",
 513                                                 this->env->error->error_number,
 514                                                 AXIS2_ERROR_GET_MESSAGE(this->env->error));
 515                 destroy(this);
 516                 return NULL;
 517         }
 518
 519         axis2_svc_client_set_options(this->svc_client, this->env, options);
 520         axis2_options_set_http_auth_info(options, this->env, username, password,
 521                                                                          auth_type);
 522         DBG1(DBG_TNC, "connecting as MAP client '%s' to MAP server at '%s'",
 523                  username, server);
 524
 525         DBG2(DBG_TNC, "sending newSession");
 526         if (!newSession(this))
 527         {
 528                 DBG1(DBG_TNC, "newSession with MAP server failed");
 529                 destroy(this);
 530                 return NULL;
 531         }
 532         DBG2(DBG_TNC, "sending purgePublisher");
 533         if (!purgePublisher(this))
 534         {
 535                 DBG1(DBG_TNC, "purgePublisher with MAP server failed");
 536                 destroy(this);
 537                 return NULL;
 538         }
 539
 540         return &this->public;
 541 }
 542