src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c

   1 /*
   2  * Copyright (C) 2011 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tnc_ifmap_listener.h"
  17
  18 #include <daemon.h>
  19 #include <config/child_cfg.h>
  20
  21 #include <axis2_util.h>
  22 #include <axis2_client.h>
  23 #include <axiom_soap.h>
  24
  25 #define IFMAP_NS          "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
  26 #define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
  27 #define IFMAP_LOGFILE "strongswan_ifmap.log"
  28 #define IFMAP_SERVER  "https://localhost:8443/"
  29
  30 typedef struct private_tnc_ifmap_listener_t private_tnc_ifmap_listener_t;
  31
  32 /**
  33  * Private data of an tnc_ifmap_listener_t object.
  34  */
  35 struct private_tnc_ifmap_listener_t {
  36
  37         /**
  38          * Public tnc_ifmap_listener_t interface.
  39          */
  40         tnc_ifmap_listener_t public;
  41
  42         /**
  43          * Axis2/C environment
  44          */
  45         axutil_env_t *env;
  46
  47         /**
  48          * Axis2 service client
  49          */
  50         axis2_svc_client_t* svc_client;
  51
  52         /**
  53          * SOAP Session ID
  54          */
  55         char *session_id;
  56
  57         /**
  58          * IF-MAP Publisher ID
  59          */
  60         char *ifmap_publisher_id;
  61
  62 };
  63
  64 static bool newSession(private_tnc_ifmap_listener_t *this)
  65 {
  66     axiom_node_t *request, *result, *node;
  67     axiom_element_t *el;
  68         axiom_namespace_t *ns;
  69         axiom_attribute_t *attr;
  70         axis2_char_t *value;
  71         axutil_qname_t *qname;
  72
  73         bool success = FALSE;
  74
  75         /* build newSession request */
  76     ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
  77     el = axiom_element_create(this->env, NULL, "newSession", ns, &request);
  78         attr = axiom_attribute_create(this->env, "max-poll-result-size", "1000000", NULL);
  79         axiom_element_add_attribute(el, this->env, attr, request);
  80
  81         /* send newSession request */
  82         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
  83         if (!result)
  84         {
  85                 return FALSE;
  86         }
  87
  88         /* process newSessionResult */
  89         node = axiom_node_get_first_child(result, this->env);
  90         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
  91         {
  92                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
  93                 qname = axiom_element_get_qname(el, this->env, node);
  94                 success = streq("newSessionResult",
  95                                                  axutil_qname_to_string(qname, this->env));
  96
  97                 /* process the attributes */
  98                 if (success)
  99                 {
 100                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 101                                                                  "session-id");
 102                         this->session_id = strdup(value);
 103                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 104                                                                  "ifmap-publisher-id");
 105                         this->ifmap_publisher_id = strdup(value);
 106
 107                         DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
 108                                  this->session_id, this->ifmap_publisher_id);
 109                         success = this->session_id && this->ifmap_publisher_id;
 110
 111                         value = axiom_element_get_attribute_value_by_name(el, this->env,
 112                                                                  "max-poll-result-size");
 113                         if (value)
 114                         {
 115                                 DBG1(DBG_TNC, "max-poll-result-size: %s", value);
 116                         }
 117                 }
 118                 else
 119                 {
 120                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 121                 }
 122         }
 123         axiom_node_free_tree(result, this->env);
 124
 125     return success;
 126 }
 127
 128 static bool purgePublisher(private_tnc_ifmap_listener_t *this)
 129 {
 130         axiom_node_t *request, *result, *node;
 131         axiom_element_t *el;
 132         axiom_namespace_t *ns;
 133         axiom_attribute_t *attr;
 134         axutil_qname_t *qname;
 135         bool success = FALSE;
 136
 137         /* build purgePublisher request */
 138         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 139         el = axiom_element_create(this->env, NULL, "purgePublisher", ns,
 140                                                           &request);
 141         attr = axiom_attribute_create(this->env, "session-id",
 142                                                                   this->session_id, NULL);
 143         axiom_element_add_attribute(el, this->env, attr, request);
 144         attr = axiom_attribute_create(this->env, "ifmap-publisher-id",
 145                                                                   this->ifmap_publisher_id, NULL);
 146         axiom_element_add_attribute(el, this->env, attr, request);
 147
 148         /* send purgePublisher request */
 149         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 150         if (!result)
 151         {
 152                 return FALSE;
 153         }
 154
 155         /* process purgePublisherReceived */
 156         node = axiom_node_get_first_child(result, this->env);
 157         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 158         {
 159                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 160                 qname = axiom_element_get_qname(el, this->env, node);
 161                 success = streq("purgePublisherReceived",
 162                                                  axutil_qname_to_string(qname, this->env));
 163                 if (!success)
 164                 {
 165                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 166                 }
 167         }
 168         axiom_node_free_tree(result, this->env);
 169
 170    return success;
 171 }
 172
 173 static bool publish(private_tnc_ifmap_listener_t *this, u_int32_t ike_sa_id,
 174                                         identification_t *id, host_t *host, bool up)
 175 {
 176         axiom_node_t *request, *result, *node, *node2, *node3, *node4;
 177         axiom_element_t *el;
 178         axiom_namespace_t *ns, *ns_meta;
 179         axiom_attribute_t *attr;
 180         axiom_text_t *text;
 181         axutil_qname_t *qname;
 182         char buf[BUF_LEN], *id_type;
 183         bool success = FALSE;
 184
 185         /* build publish request */
 186         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 187         el = axiom_element_create(this->env, NULL, "publish", ns, &request);
 188         attr = axiom_attribute_create(this->env, "session-id", this->session_id,
 189                                                                   NULL);
 190         axiom_element_add_attribute(el, this->env, attr, request);
 191
 192         /**
 193          * update or delete authenticated-as metadata
 194          */
 195         if (up)
 196         {
 197                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 198                 axiom_node_add_child(request, this->env, node);
 199         }
 200         else
 201         {
 202                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 203                 axiom_node_add_child(request, this->env, node);
 204
 205                 /* add filter */
 206                 attr = axiom_attribute_create(this->env, "filter",
 207                                                                           "authenticated-as", NULL);
 208                 axiom_element_add_attribute(el, this->env, attr, node);
 209         }
 210
 211         /* add access-request */
 212         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 213         axiom_node_add_child(node, this->env, node2);
 214
 215         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 216         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 217         axiom_element_add_attribute(el, this->env, attr, node2);
 218
 219         /* add identity */
 220         el = axiom_element_create(this->env, NULL, "identity", NULL, &node2);
 221         axiom_node_add_child(node, this->env, node2);
 222
 223         snprintf(buf, BUF_LEN, "%Y", id);
 224         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 225         axiom_element_add_attribute(el, this->env, attr, node2);
 226
 227         switch (id->get_type(id))
 228         {
 229                 case ID_FQDN:
 230                         id_type = "dns-name";
 231                         break;
 232                 case ID_RFC822_ADDR:
 233                         id_type = "email-address";
 234                         break;
 235                 case ID_DER_ASN1_DN:
 236                         id_type = "distinguished-name";
 237                         break;
 238                 default:
 239                         id_type = "other";
 240         }
 241         attr = axiom_attribute_create(this->env, "type", id_type, NULL);
 242         axiom_element_add_attribute(el, this->env, attr, node2);
 243
 244         if (up)
 245         {
 246                 /* add metadata */
 247                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 248                 axiom_node_add_child(node, this->env, node2);
 249
 250                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 251
 252                 el = axiom_element_create(this->env, NULL, "authenticated-as", ns_meta,
 253                                                                   &node3);
 254                 axiom_node_add_child(node2, this->env, node3);
 255                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 256                                                                           "singleValue", NULL);
 257                 axiom_element_add_attribute(el, this->env, attr, node3);
 258         }
 259
 260         /**
 261          * update or delete access-request-ip metadata
 262          */
 263         if (up)
 264         {
 265                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 266                 axiom_node_add_child(request, this->env, node);
 267         }
 268         else
 269         {
 270                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 271                 axiom_node_add_child(request, this->env, node);
 272
 273                 /* add filter */
 274                 attr = axiom_attribute_create(this->env, "filter",
 275                                                                           "access-request-ip", NULL);
 276                 axiom_element_add_attribute(el, this->env, attr, node);
 277         }
 278
 279         /* add access-request */
 280         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 281         axiom_node_add_child(node, this->env, node2);
 282
 283         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 284         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 285         axiom_element_add_attribute(el, this->env, attr, node2);
 286
 287         /* add ip-address */
 288         el = axiom_element_create(this->env, NULL, "ip-address", NULL, &node2);
 289         axiom_node_add_child(node, this->env, node2);
 290
 291         snprintf(buf, BUF_LEN, "%H", host);
 292         attr = axiom_attribute_create(this->env, "value", buf, NULL);
 293         axiom_element_add_attribute(el, this->env, attr, node2);
 294
 295         attr = axiom_attribute_create(this->env, "type",
 296                                  host->get_family(host) == AF_INET ? "IPv4" : "IPv6", NULL);
 297         axiom_element_add_attribute(el, this->env, attr, node2);
 298
 299         if (up)
 300         {
 301                 /* add metadata */
 302                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 303                 axiom_node_add_child(node, this->env, node2);
 304                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 305                 el = axiom_element_create(this->env, NULL, "access-request-ip", ns_meta,
 306                                                                   &node3);
 307                 axiom_node_add_child(node2, this->env, node3);
 308                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 309                                                                           "singleValue", NULL);
 310                 axiom_element_add_attribute(el, this->env, attr, node3);
 311         }
 312
 313         /**
 314          * update or delete authenticated-by metadata
 315          */
 316         if (up)
 317         {
 318                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 319                 axiom_node_add_child(request, this->env, node);
 320         }
 321         else
 322         {
 323                 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 324                 axiom_node_add_child(request, this->env, node);
 325
 326                 /* add filter */
 327                 attr = axiom_attribute_create(this->env, "filter",
 328                                                                           "authenticated-by", NULL);
 329                 axiom_element_add_attribute(el, this->env, attr, node);
 330         }
 331
 332         /* add access-request */
 333         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node2);
 334         axiom_node_add_child(node, this->env, node2);
 335
 336         snprintf(buf, BUF_LEN, "%s:%d", this->ifmap_publisher_id, ike_sa_id);
 337         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 338         axiom_element_add_attribute(el, this->env, attr, node2);
 339
 340         /* add device */
 341         el = axiom_element_create(this->env, NULL, "device", NULL, &node2);
 342         axiom_node_add_child(node, this->env, node2);
 343         el = axiom_element_create(this->env, NULL, "name", NULL, &node3);
 344         axiom_node_add_child(node2, this->env, node3);
 345         text = axiom_text_create(this->env, node3, this->ifmap_publisher_id, &node4);
 346
 347         if (up)
 348         {
 349                 /* add metadata */
 350                 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node2);
 351                 axiom_node_add_child(node, this->env, node2);
 352                 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 353                 el = axiom_element_create(this->env, NULL, "authenticated-by", ns_meta,
 354                                                                   &node3);
 355                 axiom_node_add_child(node2, this->env, node3);
 356                 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 357                                                                           "singleValue", NULL);
 358                 axiom_element_add_attribute(el, this->env, attr, node3);
 359         }
 360
 361         /* send publish request */
 362         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 363         if (!result)
 364         {
 365                 return FALSE;
 366         }
 367
 368         /* process publishReceived */
 369         node = axiom_node_get_first_child(result, this->env);
 370         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 371         {
 372                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 373                 qname = axiom_element_get_qname(el, this->env, node);
 374                 success = streq("publishReceived",
 375                                                 axutil_qname_to_string(qname, this->env));
 376                 if (!success)
 377                 {
 378                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 379                 }
 380         }
 381         axiom_node_free_tree(result, this->env);
 382
 383    return TRUE;
 384 }
 385
 386 static bool endSession(private_tnc_ifmap_listener_t *this)
 387 {
 388         axiom_node_t *request, *result, *node;
 389         axiom_element_t *el;
 390         axiom_namespace_t *ns;
 391         axiom_attribute_t *attr;
 392         axutil_qname_t *qname;
 393         bool success = FALSE;
 394
 395         /* build endSession request */
 396         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 397         el = axiom_element_create(this->env, NULL, "endSession", ns, &request);
 398         attr = axiom_attribute_create(this->env, "session-id", this->session_id, NULL);
 399         axiom_element_add_attribute(el, this->env, attr, request);
 400
 401         /* send endSession request */
 402         result = axis2_svc_client_send_receive(this->svc_client, this->env, request);
 403         if (!result)
 404         {
 405                 return FALSE;
 406         }
 407
 408         /* process endSessionResult */
 409         node = axiom_node_get_first_child(result, this->env);
 410         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
 411         {
 412                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 413                 qname = axiom_element_get_qname(el, this->env, node);
 414                 success = streq("endSessionResult",
 415                                                  axutil_qname_to_string(qname, this->env));
 416                 if (!success)
 417                 {
 418                         DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 419                 }
 420         }
 421         axiom_node_free_tree(result, this->env);
 422
 423    return success;
 424
 425    return TRUE;
 426 }
 427
 428 METHOD(listener_t, ike_updown, bool,
 429         private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, bool up)
 430 {
 431         u_int32_t ike_sa_id;
 432         identification_t *id;
 433         host_t *host;
 434
 435         ike_sa_id = ike_sa->get_unique_id(ike_sa);
 436         id = ike_sa->get_other_id(ike_sa);
 437         host = ike_sa->get_other_host(ike_sa);
 438
 439         DBG2(DBG_TNC, "sending publish");
 440         if (!publish(this, ike_sa_id, id, host, up))
 441         {
 442                 DBG1(DBG_TNC, "publish with MAP server failed");
 443         }
 444
 445         return TRUE;
 446 }
 447
 448 METHOD(tnc_ifmap_listener_t, destroy, void,
 449         private_tnc_ifmap_listener_t *this)
 450 {
 451         if (this->session_id)
 452         {
 453                 DBG2(DBG_TNC, "sending endSession");
 454                 if (!endSession(this))
 455                 {
 456                         DBG1(DBG_TNC, "endSession with MAP server failed");
 457                 }
 458                 free(this->session_id);
 459                 free(this->ifmap_publisher_id);
 460         }
 461         if (this->svc_client)
 462         {
 463                 axis2_svc_client_free(this->svc_client, this->env);
 464         }
 465         if (this->env)
 466         {
 467                 axutil_env_free(this->env);
 468         }
 469         free(this);
 470 }
 471
 472 /**
 473  * See header
 474  */
 475 tnc_ifmap_listener_t *tnc_ifmap_listener_create()
 476 {
 477         private_tnc_ifmap_listener_t *this;
 478         axis2_char_t *server, *client_home, *username, *password, *auth_type;
 479         axis2_endpoint_ref_t* endpoint_ref = NULL;
 480         axis2_options_t *options = NULL;
 481
 482         client_home = lib->settings->get_str(lib->settings,
 483                                         "charon.plugins.tnc-ifmap.client_home",
 484                                         AXIS2_GETENV("AXIS2C_HOME"));
 485         server = lib->settings->get_str(lib->settings,
 486                                         "charon.plugins.tnc-ifmap.server", IFMAP_SERVER);
 487         auth_type = lib->settings->get_str(lib->settings,
 488                                         "charon.plugins.tnc-ifmap.auth_type", "Basic");
 489         username = lib->settings->get_str(lib->settings,
 490                                         "charon.plugins.tnc-ifmap.username", NULL);
 491         password = lib->settings->get_str(lib->settings,
 492                                         "charon.plugins.tnc-ifmap.password", NULL);
 493
 494         if (!username || !password)
 495         {
 496                 DBG1(DBG_TNC, "MAP client %s%s%s not defined",
 497                         (!username) ? "username" : "",
 498                         (!username && ! password) ? " and " : "",
 499                         (!password) ? "password" : "");
 500         }
 501
 502         INIT(this,
 503                 .public = {
 504                         .listener = {
 505                                 .ike_updown = _ike_updown,
 506                         },
 507                         .destroy = _destroy,
 508                 },
 509         );
 510
 511         /* Create Axis2/C environment and options */
 512         this->env = axutil_env_create_all(IFMAP_LOGFILE, AXIS2_LOG_LEVEL_TRACE);
 513     options = axis2_options_create(this->env);
 514
 515         /* Define the IF-MAP server as the to endpoint reference */
 516         endpoint_ref = axis2_endpoint_ref_create(this->env, server);
 517         axis2_options_set_to(options, this->env, endpoint_ref);
 518
 519         /* Create the axis2 service client */
 520         this->svc_client = axis2_svc_client_create(this->env, client_home);
 521         if (!this->svc_client)
 522         {
 523                 DBG1(DBG_TNC, "Error creating axis2 service client");
 524                 AXIS2_LOG_ERROR(this->env->log, AXIS2_LOG_SI,
 525                                             "Stub invoke FAILED: Error code: %d :: %s",
 526                                                 this->env->error->error_number,
 527                                                 AXIS2_ERROR_GET_MESSAGE(this->env->error));
 528                 destroy(this);
 529                 return NULL;
 530         }
 531
 532         axis2_svc_client_set_options(this->svc_client, this->env, options);
 533         axis2_options_set_http_auth_info(options, this->env, username, password,
 534                                                                          auth_type);
 535         DBG1(DBG_TNC, "connecting as MAP client '%s' to MAP server at '%s'",
 536                  username, server);
 537
 538         DBG2(DBG_TNC, "sending newSession");
 539         if (!newSession(this))
 540         {
 541                 DBG1(DBG_TNC, "newSession with MAP server failed");
 542                 destroy(this);
 543                 return NULL;
 544         }
 545         DBG2(DBG_TNC, "sending purgePublisher");
 546         if (!purgePublisher(this))
 547         {
 548                 DBG1(DBG_TNC, "purgePublisher with MAP server failed");
 549                 destroy(this);
 550                 return NULL;
 551         }
 552
 553         return &this->public;
 554 }
 555