src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c

   1 /*
   2  * Copyright (C) 2011 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tnc_ifmap_listener.h"
  17
  18 #include <daemon.h>
  19 #include <config/child_cfg.h>
  20
  21 #include <axis2_util.h>
  22 #include <axis2_client.h>
  23 #include <axiom_soap.h>
  24
  25 #define IFMAP_NS          "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
  26 #define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
  27 #define IFMAP_LOGFILE "strongswan_ifmap.log"
  28 #define IFMAP_SERVER  "https://localhost:8443/"
  29
  30 typedef struct private_tnc_ifmap_listener_t private_tnc_ifmap_listener_t;
  31
  32 /**
  33  * Private data of an tnc_ifmap_listener_t object.
  34  */
  35 struct private_tnc_ifmap_listener_t {
  36
  37         /**
  38          * Public tnc_ifmap_listener_t interface.
  39          */
  40         tnc_ifmap_listener_t public;
  41
  42         /**
  43          * Axis2/C environment
  44          */
  45         axutil_env_t *env;
  46
  47         /**
  48          * Axis2 service client
  49          */
  50         axis2_svc_client_t* svc_client;
  51
  52         /**
  53          * SOAP Session ID
  54          */
  55         char *session_id;
  56
  57         /**
  58          * IF-MAP Publisher ID
  59          */
  60         char *ifmap_publisher_id;
  61
  62 };
  63
  64 static bool newSession(private_tnc_ifmap_listener_t *this)
  65 {
  66     axiom_node_t *request, *result, *node;
  67     axiom_element_t *el;
  68         axiom_namespace_t *ns;
  69         axiom_attribute_t *attr;
  70         axis2_char_t *value;
  71         axutil_qname_t *qname;
  72
  73         bool success = FALSE;
  74
  75         /* build newSession request */
  76     ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
  77     el = axiom_element_create(this->env, NULL, "newSession", ns, &request);
  78         attr = axiom_attribute_create(this->env, "max-poll-result-size", "1000000", NULL);
  79         axiom_element_add_attribute(el, this->env, attr, request);
  80
  81         /* send newSession request */
  82         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
  83         if (!result)
  84         {
  85                 return FALSE;
  86         }
  87
  88         /* process newSessionResult */
  89         node = axiom_node_get_first_child(result, this->env);
  90         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
  91         {
  92                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
  93                 qname = axiom_element_get_qname(el, this->env, node);
  94                 success = streq("newSessionResult",
  95                                                  axutil_qname_to_string(qname, this->env));
  96
  97                 /* process the attributes */
  98                 if (success)
  99                 {
 100                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 101                                                                  "session-id");
 102                         this->session_id = strdup(value);
 103                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 104                                                                  "ifmap-publisher-id");
 105                         this->ifmap_publisher_id = strdup(value);
 106
 107                         DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
 108                                  this->session_id, this->ifmap_publisher_id);
 109                         success = this->session_id && this->ifmap_publisher_id;
 110
 111                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 112                                                                  "max-poll-result-size");
 113                         if (value)
 114                         {
 115                                 DBG1(DBG_TNC, "max-poll-result-size: %s", value);
 116                         }
 117                 }
 118                 else
 119                 {
 120                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 121                 }
 122         }
 123         axiom_node_free_tree(result, this->env);
 124
 125     return success;
 126 }
 127
 128 static bool purgePublisher(private_tnc_ifmap_listener_t *this)
 129 {
 130         axiom_node_t *request, *result, *node;
 131         axiom_element_t *el;
 132         axiom_namespace_t *ns;
 133         axiom_attribute_t *attr;
 134         axutil_qname_t *qname;
 135         bool success = FALSE;
 136
 137         /* build purgePublisher request */
 138         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 139         el = axiom_element_create(this->env, NULL, "purgePublisher", ns,
 140                                                           &request);
 141         attr = axiom_attribute_create(this->env, "session-id",
 142                                                                   this->session_id, NULL);
 143         axiom_element_add_attribute(el, this->env, attr, request);
 144         attr = axiom_attribute_create(this->env, "ifmap-publisher-id",
 145                                                                   this->ifmap_publisher_id, NULL);
 146         axiom_element_add_attribute(el, this->env, attr, request);
 147
 148         /* send purgePublisher request */
 149         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 150         if (!result)
 151         {
 152                 return FALSE;
 153         }
 154
 155         /* process purgePublisherReceived */
 156         node = axiom_node_get_first_child(result, this->env);
 157         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 158         {
 159                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 160                 qname = axiom_element_get_qname(el, this->env, node);
 161                 success = streq("purgePublisherReceived",
 162                                                  axutil_qname_to_string(qname, this->env));
 163                 if (!success)
 164                 {
 165                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 166                 }
 167         }
 168         axiom_node_free_tree(result, this->env);
 169
 170    return success;
 171 }
 172
 173 static bool publish(private_tnc_ifmap_listener_t *this, u_int32_t ike_sa_id,
 174                                         identification_t *id, host_t *host, bool up)
 175 {
 176         axiom_node_t *request, *result, *node, *node2, *node3;
 177         axiom_element_t *el;
 178         axiom_namespace_t *ns, *ns_meta;
 179         axiom_attribute_t *attr;
 180         char buf[BUF_LEN], *id_type;
 181
 182         /* build publish request */
 183         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 184         el = axiom_element_create(this->env, NULL, "publish", ns, &request);
 185         attr = axiom_attribute_create(this->env, "session-id", this->session_id,
 186                                                                   NULL);
 187         axiom_element_add_attribute(el, this->env, attr, request);
 188
 189         /* update or delete IKE_SA information */
 190         if (up)
 191         {
 192                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 193                 axiom_node_add_child(request, this->env, node);
 194         }
 195         else
 196         {
 197                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 198                 axiom_node_add_child(request, this->env, node);
 199
 200                 /* add filter */
 201                 attr = axiom_attribute_create(this->env, "filter",
 202                                                                           "authenticated-as", NULL);
 203                 axiom_element_add_attribute(el, this->env, attr, node);
 204         }
 205
 206         /* add access-request */
 207         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 208         axiom_node_add_child(node, this->env, node2);
 209
 210         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 211         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 212         axiom_element_add_attribute(el, this->env, attr, node2);
 213
 214         /* add identity */
 215         el = axiom_element_create(this->env, NULL, "identity", NULL, &node2);
 216         axiom_node_add_child(node, this->env, node2);
 217
 218         snprintf(buf, BUF_LEN, "%Y", id);
 219         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 220         axiom_element_add_attribute(el, this->env, attr, node2);
 221
 222         switch (id->get_type(id))
 223         {
 224                 case ID_FQDN:
 225                         id_type = "dns-name";
 226                         break;
 227                 case ID_RFC822_ADDR:
 228                         id_type = "email-address";
 229                         break;
 230                 case ID_DER_ASN1_DN:
 231                         id_type = "distinguished-name";
 232                         break;
 233                 default:
 234                         id_type = "other";
 235         }
 236         attr = axiom_attribute_create(this->env, "type", id_type, NULL);
 237         axiom_element_add_attribute(el, this->env, attr, node2);
 238
 239         if (up)
 240         {
 241                 /* add metadata */
 242                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 243                 axiom_node_add_child(node, this->env, node2);
 244
 245                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 246
 247                 el = axiom_element_create(this->env, NULL, "authenticated-as", ns_meta,
 248                                                                   &node3);
 249                 axiom_node_add_child(node2, this->env, node3);
 250                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 251                                                                           "singleValue", NULL);
 252                 axiom_element_add_attribute(el, this->env, attr, node3);
 253         }
 254
 255         /* update or delete IKE_SA information */
 256         if (up)
 257         {
 258                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 259                 axiom_node_add_child(request, this->env, node);
 260         }
 261         else
 262         {
 263                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 264                 axiom_node_add_child(request, this->env, node);
 265
 266                 /* add filter */
 267                 attr = axiom_attribute_create(this->env, "filter",
 268                                                                           "acces-request-ip", NULL);
 269                 axiom_element_add_attribute(el, this->env, attr, node);
 270         }
 271
 272         /* add ip-address */
 273         el = axiom_element_create(this->env, NULL, "ip-address", NULL, &node2);
 274         axiom_node_add_child(node, this->env, node2);
 275
 276         snprintf(buf, BUF_LEN, "%H", host);
 277         attr = axiom_attribute_create(this->env, "value", buf, NULL);
 278         axiom_element_add_attribute(el, this->env, attr, node2);
 279
 280         attr = axiom_attribute_create(this->env, "type",
 281                                  host->get_family(host) == AF_INET ? "IPv4" : "IPv6", NULL);
 282         axiom_element_add_attribute(el, this->env, attr, node2);
 283
 284         /* add access-request */
 285         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 286         axiom_node_add_child(node, this->env, node2);
 287
 288         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 289         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 290         axiom_element_add_attribute(el, this->env, attr, node2);
 291
 292         if (up)
 293         {
 294                 /* add metadata */
 295                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 296                 axiom_node_add_child(node, this->env, node2);
 297                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 298                 el = axiom_element_create(this->env, NULL, "access-request-ip", ns_meta,
 299                                                                   &node3);
 300                 axiom_node_add_child(node2, this->env, node3);
 301                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 302                                                                           "singleValue", NULL);
 303                 axiom_element_add_attribute(el, this->env, attr, node3);
 304         }
 305
 306         /* send publish request */
 307         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 308         if (!result)
 309         {
 310                 return FALSE;
 311         }
 312
 313         /* process publishReceived */
 314         node = axiom_node_get_first_child(result, this->env);
 315         axiom_node_free_tree(result, this->env);
 316
 317    return TRUE;
 318 }
 319
 320 static bool endSession(private_tnc_ifmap_listener_t *this)
 321 {
 322         axiom_node_t *request, *result, *node;
 323         axiom_element_t *el;
 324         axiom_namespace_t *ns;
 325         axiom_attribute_t *attr;
 326         axutil_qname_t *qname;
 327         bool success = FALSE;
 328
 329         /* build endSession request */
 330         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 331         el = axiom_element_create(this->env, NULL, "endSession", ns, &request);
 332         attr = axiom_attribute_create(this->env, "session-id", this->session_id, NULL);
 333         axiom_element_add_attribute(el, this->env, attr, request);
 334
 335         /* send endSession request */
 336         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 337         if (!result)
 338         {
 339                 return FALSE;
 340         }
 341
 342         /* process endSessionResult */
 343         node = axiom_node_get_first_child(result, this->env);
 344         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 345         {
 346                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 347                 qname = axiom_element_get_qname(el, this->env, node);
 348                 success = streq("endSessionResult",
 349                                                  axutil_qname_to_string(qname, this->env));
 350                 if (!success)
 351                 {
 352                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 353                 }
 354         }
 355         axiom_node_free_tree(result, this->env);
 356
 357    return success;
 358
 359    return TRUE;
 360 }
 361
 362 METHOD(listener_t, ike_updown, bool,
 363         private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, bool up)
 364 {
 365         u_int32_t ike_sa_id;
 366         identification_t *id;
 367         host_t *host;
 368
 369         ike_sa_id = ike_sa->get_unique_id(ike_sa);
 370         id = ike_sa->get_other_id(ike_sa);
 371         host = ike_sa->get_other_host(ike_sa);
 372
 373         DBG2(DBG_TNC, "sending publish");
 374         if (!publish(this, ike_sa_id, id, host, up))
 375         {
 376                 DBG1(DBG_TNC, "publish with MAP server failed");
 377         }
 378
 379         return TRUE;
 380 }
 381
 382 METHOD(tnc_ifmap_listener_t, destroy, void,
 383         private_tnc_ifmap_listener_t *this)
 384 {
 385         if (this->session_id)
 386         {
 387                 DBG2(DBG_TNC, "sending endSession");
 388                 if (!endSession(this))
 389                 {
 390                         DBG1(DBG_TNC, "endSession with MAP server failed");
 391                 }
 392                 free(this->session_id);
 393                 free(this->ifmap_publisher_id);
 394         }
 395         if (this->svc_client)
 396         {
 397                 axis2_svc_client_free(this->svc_client, this->env);
 398         }
 399         if (this->env)
 400         {
 401                 axutil_env_free(this->env);
 402         }
 403         free(this);
 404 }
 405
 406 /**
 407  * See header
 408  */
 409 tnc_ifmap_listener_t *tnc_ifmap_listener_create()
 410 {
 411         private_tnc_ifmap_listener_t *this;
 412         axis2_char_t *server, *client_home, *username, *password, *auth_type;
 413         axis2_endpoint_ref_t* endpoint_ref = NULL;
 414         axis2_options_t *options = NULL;
 415
 416         client_home = lib->settings->get_str(lib->settings,
 417                                         "charon.plugins.tnc-ifmap.client_home",
 418                                         AXIS2_GETENV("AXIS2C_HOME"));
 419         server = lib->settings->get_str(lib->settings,
 420                                         "charon.plugins.tnc-ifmap.server", IFMAP_SERVER);
 421         auth_type = lib->settings->get_str(lib->settings,
 422                                         "charon.plugins.tnc-ifmap.auth_type", "Basic");
 423         username = lib->settings->get_str(lib->settings,
 424                                         "charon.plugins.tnc-ifmap.username", NULL);
 425         password = lib->settings->get_str(lib->settings,
 426                                         "charon.plugins.tnc-ifmap.password", NULL);
 427
 428         if (!username || !password)
 429         {
 430                 DBG1(DBG_TNC, "MAP client %s%s%s not defined",
 431                         (!username) ? "username" : "",
 432                         (!username && ! password) ? " and " : "",
 433                         (!password) ? "password" : "");
 434         }
 435
 436         INIT(this,
 437                 .public = {
 438                         .listener = {
 439                                 .ike_updown = _ike_updown,
 440                         },
 441                         .destroy = _destroy,
 442                 },
 443         );
 444
 445         /* Create Axis2/C environment and options */
 446         this->env = axutil_env_create_all(IFMAP_LOGFILE, AXIS2_LOG_LEVEL_TRACE);
 447     options = axis2_options_create(this->env);
 448
 449         /* Define the IF-MAP server as the to endpoint reference */
 450         endpoint_ref = axis2_endpoint_ref_create(this->env, server);
 451         axis2_options_set_to(options, this->env, endpoint_ref);
 452
 453         /* Create the axis2 service client */
 454         this->svc_client = axis2_svc_client_create(this->env, client_home);
 455         if (!this->svc_client)
 456         {
 457                 DBG1(DBG_TNC, "Error creating axis2 service client");
 458                 AXIS2_LOG_ERROR(this->env->log, AXIS2_LOG_SI,
 459                                             "Stub invoke FAILED: Error code: %d :: %s",
 460                                                 this->env->error->error_number,
 461                                                 AXIS2_ERROR_GET_MESSAGE(this->env->error));
 462                 destroy(this);
 463                 return NULL;
 464         }
 465
 466         axis2_svc_client_set_options(this->svc_client, this->env, options);
 467         axis2_options_set_http_auth_info(options, this->env, username, password,
 468                                                                          auth_type);
 469         DBG1(DBG_TNC, "connecting as MAP client '%s' to MAP server at '%s'",
 470                  username, server);
 471
 472         DBG2(DBG_TNC, "sending newSession");
 473         if (!newSession(this))
 474         {
 475                 DBG1(DBG_TNC, "newSession with MAP server failed");
 476                 destroy(this);
 477                 return NULL;
 478         }
 479         DBG2(DBG_TNC, "sending purgePublisher");
 480         if (!purgePublisher(this))
 481         {
 482                 DBG1(DBG_TNC, "purgePublisher with MAP server failed");
 483                 destroy(this);
 484                 return NULL;
 485         }
 486
 487         return &this->public;
 488 }
 489