src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c

   1 /*
   2  * Copyright (C) 2011 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tnc_ifmap_soap.h"
  17
  18 #include <debug.h>
  19
  20 #include <axis2_util.h>
  21 #include <axis2_client.h>
  22 #include <axis2_http_transport.h>
  23 #include <axis2_http_transport_sender.h>
  24 #include <axiom_soap.h>
  25
  26 #define IFMAP_NS          "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
  27 #define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
  28 #define IFMAP_LOGFILE "strongswan_ifmap.log"
  29 #define IFMAP_SERVER  "https://localhost:8443/"
  30
  31 typedef struct private_tnc_ifmap_soap_t private_tnc_ifmap_soap_t;
  32
  33 /**
  34  * Private data of an tnc_ifmap_soap_t object.
  35  */
  36 struct private_tnc_ifmap_soap_t {
  37
  38         /**
  39          * Public tnc_ifmap_soap_t interface.
  40          */
  41         tnc_ifmap_soap_t public;
  42
  43         /**
  44          * Axis2/C environment
  45          */
  46         axutil_env_t *env;
  47
  48         /**
  49          * Axis2 service client
  50          */
  51         axis2_svc_client_t* svc_client;
  52
  53         /**
  54          * SOAP Session ID
  55          */
  56         char *session_id;
  57
  58         /**
  59          * IF-MAP Publisher ID
  60          */
  61         char *ifmap_publisher_id;
  62
  63         /**
  64          * PEP and PDP device name
  65          */
  66         char *device_name;
  67
  68 };
  69
  70 /**
  71  * Send request and receive result via SOAP
  72  */
  73 static bool send_receive(private_tnc_ifmap_soap_t *this,
  74                                                  char *request_qname, axiom_node_t *request,
  75                                                  char *receipt_qname, axiom_node_t **result)
  76
  77 {
  78     axiom_node_t *parent, *node;
  79     axiom_element_t *el;
  80         axutil_qname_t *qname;
  81         bool success = FALSE;
  82
  83         /* send request and receive result */
  84         DBG2(DBG_TNC, "sending  ifmap %s", request_qname);
  85
  86         parent = axis2_svc_client_send_receive(this->svc_client, this->env, request);
  87         if (!parent)
  88         {
  89                 DBG1(DBG_TNC, "no ifmap %s received from MAP server", receipt_qname);
  90                 return FALSE;
  91         }
  92
  93         /* pre-process result */
  94         node = axiom_node_get_first_child(parent, this->env);
  95         if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
  96         {
  97                 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
  98
  99                 qname = axiom_element_get_qname(el, this->env, node);
 100                 success = streq(receipt_qname, axutil_qname_to_string(qname, this->env));
 101                 if (success)
 102                 {
 103                         DBG2(DBG_TNC, "received ifmap %s", receipt_qname);
 104                         if (result)
 105                         {
 106                                 *result = parent;
 107                         }
 108                         else
 109                         {
 110                                 /* no further processing requested */
 111                                 axiom_node_free_tree(parent, this->env);
 112                         }
 113                         return TRUE;
 114                 }
 115                 /* TODO proper error handling */
 116                 DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
 117         }
 118
 119         /* free parent in the error case */
 120         axiom_node_free_tree(parent, this->env);
 121
 122         return FALSE;
 123 }
 124
 125 METHOD(tnc_ifmap_soap_t, newSession, bool,
 126         private_tnc_ifmap_soap_t *this)
 127 {
 128     axiom_node_t *request, *result, *node;
 129     axiom_element_t *el;
 130         axiom_namespace_t *ns;
 131         axis2_char_t *value;
 132
 133
 134         /* build newSession request */
 135     ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 136     el = axiom_element_create(this->env, NULL, "newSession", ns, &request);
 137
 138         /* send newSession request and receive newSessionResult */
 139         if (!send_receive(this, "newSession", request, "newSessionResult", &result))
 140         {
 141                 return FALSE;
 142         }
 143
 144         /* process newSessionResult */
 145         node = axiom_node_get_first_child(result, this->env);
 146         el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
 147
 148         /* get session-id */
 149         value = axiom_element_get_attribute_value_by_name(el, this->env,
 150                                                                  "session-id");
 151         this->session_id = strdup(value);
 152
 153         /* get ifmap-publisher-id */
 154         value = axiom_element_get_attribute_value_by_name(el, this->env,
 155                                                                  "ifmap-publisher-id");
 156         this->ifmap_publisher_id = strdup(value);
 157
 158         DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
 159                                    this->session_id, this->ifmap_publisher_id);
 160
 161         /* set PEP and PDP device name (defaults to IF-MAP Publisher ID) */
 162         this->device_name = lib->settings->get_str(lib->settings,
 163                                                                 "charon.plugins.tnc-ifmap.device_name",
 164                                                                  this->ifmap_publisher_id);
 165         this->device_name = strdup(this->device_name);
 166
 167         /* free result */
 168         axiom_node_free_tree(result, this->env);
 169
 170     return this->session_id && this->ifmap_publisher_id;
 171 }
 172
 173 METHOD(tnc_ifmap_soap_t, purgePublisher, bool,
 174         private_tnc_ifmap_soap_t *this)
 175 {
 176         axiom_node_t *request;
 177         axiom_element_t *el;
 178         axiom_namespace_t *ns;
 179         axiom_attribute_t *attr;
 180
 181         /* build purgePublisher request */
 182         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 183         el = axiom_element_create(this->env, NULL, "purgePublisher", ns, &request);
 184         attr = axiom_attribute_create(this->env, "session-id",
 185                                                                   this->session_id, NULL);
 186         axiom_element_add_attribute(el, this->env, attr, request);
 187         attr = axiom_attribute_create(this->env, "ifmap-publisher-id",
 188                                                                   this->ifmap_publisher_id, NULL);
 189         axiom_element_add_attribute(el, this->env, attr, request);
 190
 191         /* send purgePublisher request and receive purgePublisherReceived */
 192         return send_receive(this, "purgePublisher", request,
 193                                                           "purgePublisherReceived", NULL);
 194 }
 195
 196 /**
 197  * Create an access-request based on device_name and ike_sa_id
 198  */
 199 static axiom_node_t* create_access_request(private_tnc_ifmap_soap_t *this,
 200                                                                                    u_int32_t id)
 201 {
 202         axiom_element_t *el;
 203         axiom_node_t *node;
 204         axiom_attribute_t *attr;
 205         char buf[BUF_LEN];
 206
 207         el = axiom_element_create(this->env, NULL, "access-request", NULL, &node);
 208
 209         snprintf(buf, BUF_LEN, "%s:%d", this->device_name, id);
 210         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 211         axiom_element_add_attribute(el, this->env, attr, node);
 212
 213         return node;
 214 }
 215
 216 /**
 217  * Create an identity
 218  */
 219 static axiom_node_t* create_identity(private_tnc_ifmap_soap_t *this,
 220                                                                          identification_t *id, bool is_user)
 221 {
 222         axiom_element_t *el;
 223         axiom_node_t *node;
 224         axiom_attribute_t *attr;
 225         char buf[BUF_LEN], *id_type;
 226
 227         el = axiom_element_create(this->env, NULL, "identity", NULL, &node);
 228
 229         snprintf(buf, BUF_LEN, "%Y", id);
 230         attr = axiom_attribute_create(this->env, "name", buf, NULL);
 231         axiom_element_add_attribute(el, this->env, attr, node);
 232
 233         switch (id->get_type(id))
 234         {
 235                 case ID_IPV4_ADDR:
 236                         id_type = "other";
 237                         attr = axiom_attribute_create(this->env, "other-type-definition",
 238                                                                                   "36906:ipv4-address", NULL);
 239                         axiom_element_add_attribute(el, this->env, attr, node);
 240                         break;
 241                 case ID_FQDN:
 242                         id_type = is_user ? "username" : "dns-name";
 243                         break;
 244                 case ID_RFC822_ADDR:
 245                         id_type = "email-address";
 246                         break;
 247                 case ID_IPV6_ADDR:
 248                         id_type = "other";
 249                         attr = axiom_attribute_create(this->env, "other-type-definition",
 250                                                                                   "36906:ipv6-address", NULL);
 251                         axiom_element_add_attribute(el, this->env, attr, node);
 252                         break;
 253                 case ID_DER_ASN1_DN:
 254                         id_type = "distinguished-name";
 255                         break;
 256                 case ID_KEY_ID:
 257                         id_type = "other";
 258                         attr = axiom_attribute_create(this->env, "other-type-definition",
 259                                                                                   "36906:key-id", NULL);
 260                         axiom_element_add_attribute(el, this->env, attr, node);
 261                         break;
 262                 default:
 263                         id_type = "other";
 264                         attr = axiom_attribute_create(this->env, "other-type-definition",
 265                                                                                   "36906:other", NULL);
 266                         axiom_element_add_attribute(el, this->env, attr, node);
 267         }
 268         attr = axiom_attribute_create(this->env, "type", id_type, NULL);
 269         axiom_element_add_attribute(el, this->env, attr, node);
 270
 271         return node;
 272 }
 273
 274 /**
 275  * Create an ip-address
 276  */
 277 static axiom_node_t* create_ip_address(private_tnc_ifmap_soap_t *this,
 278                                                                            host_t *host)
 279 {
 280         axiom_element_t *el;
 281         axiom_node_t *node;
 282         axiom_attribute_t *attr;
 283         char buf[BUF_LEN];
 284
 285         el = axiom_element_create(this->env, NULL, "ip-address", NULL, &node);
 286
 287         if (host->get_family(host) == AF_INET6)
 288         {
 289                 chunk_t address;
 290                 int len, written, i;
 291                 char *pos;
 292                 bool first = TRUE;
 293
 294                 /* output IPv6 address in canonical IF-MAP 2.0 format */
 295                 address = host->get_address(host);
 296                 pos = buf;
 297                 len = sizeof(buf);
 298
 299                 for (i = 0; i < address.len; i = i + 2)
 300                 {
 301                         written = snprintf(pos, len, "%s%x", first ? "" : ":",
 302                                                            256*address.ptr[i] +  address.ptr[i+1]);
 303                         if (written < 0 || written > len)
 304                         {
 305                                 break;
 306                         }
 307                         pos += written;
 308                         len -= written;
 309                         first = FALSE;
 310                 }
 311         }
 312         else
 313         {
 314                 snprintf(buf, BUF_LEN, "%H", host);
 315         }
 316         attr = axiom_attribute_create(this->env, "value", buf, NULL);
 317         axiom_element_add_attribute(el, this->env, attr, node);
 318
 319         attr = axiom_attribute_create(this->env, "type",
 320                                  host->get_family(host) == AF_INET ? "IPv4" : "IPv6", NULL);
 321         axiom_element_add_attribute(el, this->env, attr, node);
 322
 323         return node;
 324 }
 325
 326 /**
 327  * Create a device
 328  */
 329 static axiom_node_t* create_device(private_tnc_ifmap_soap_t *this)
 330 {
 331         axiom_element_t *el;
 332         axiom_node_t *node, *node2, *node3;
 333         axiom_text_t *text;
 334
 335         el = axiom_element_create(this->env, NULL, "device", NULL, &node);
 336         el = axiom_element_create(this->env, NULL, "name", NULL, &node2);
 337         axiom_node_add_child(node, this->env, node2);
 338         text = axiom_text_create(this->env, node2, this->device_name, &node3);
 339
 340         return node;
 341 }
 342
 343 /**
 344  * Create metadata
 345  */
 346 static axiom_node_t* create_metadata(private_tnc_ifmap_soap_t *this,
 347                                                                          char *metadata)
 348 {
 349         axiom_element_t *el;
 350         axiom_node_t *node, *node2;
 351         axiom_attribute_t *attr;
 352         axiom_namespace_t *ns_meta;
 353
 354         el = axiom_element_create(this->env, NULL, "metadata", NULL, &node);
 355         ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 356
 357         el = axiom_element_create(this->env, NULL, metadata, ns_meta, &node2);
 358         axiom_node_add_child(node, this->env, node2);
 359         attr = axiom_attribute_create(this->env, "ifmap-cardinality", "singleValue",
 360                                                                   NULL);
 361         axiom_element_add_attribute(el, this->env, attr, node2);
 362
 363         return node;
 364 }
 365
 366 /**
 367  * Create capability metadata
 368  */
 369 static axiom_node_t* create_capability(private_tnc_ifmap_soap_t *this,
 370                                                                            identification_t *name)
 371 {
 372         axiom_element_t *el;
 373         axiom_node_t *node, *node2, *node3;
 374         axiom_namespace_t *ns_meta;
 375         axiom_attribute_t *attr;
 376         axiom_text_t *text;
 377         char buf[BUF_LEN];
 378
 379         ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 380         el = axiom_element_create(this->env, NULL, "capability", ns_meta, &node);
 381         attr = axiom_attribute_create(this->env, "ifmap-cardinality", "multiValue",
 382                                                                   NULL);
 383         axiom_element_add_attribute(el, this->env, attr, node);
 384
 385         el = axiom_element_create(this->env, NULL, "name", NULL, &node2);
 386         axiom_node_add_child(node, this->env, node2);
 387         snprintf(buf, BUF_LEN, "%Y", name);
 388         text = axiom_text_create(this->env, node2, buf, &node3);
 389
 390         el = axiom_element_create(this->env, NULL, "administrative-domain", NULL, &node2);
 391         axiom_node_add_child(node, this->env, node2);
 392         text = axiom_text_create(this->env, node2, "strongswan", &node3);
 393
 394         return node;
 395 }
 396
 397 /**
 398  * Create enforcement-report metadata
 399  */
 400 static axiom_node_t* create_enforcement_report(private_tnc_ifmap_soap_t *this,
 401                                                                                            char *action, char *reason)
 402 {
 403         axiom_element_t *el;
 404         axiom_node_t *node, *node2, *node3, *node4;
 405         axiom_namespace_t *ns_meta;
 406         axiom_attribute_t *attr;
 407         axiom_text_t *text;
 408
 409         el = axiom_element_create(this->env, NULL, "metadata", NULL, &node);
 410
 411         ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 412         el = axiom_element_create(this->env, NULL, "enforcement-report", ns_meta,
 413                                                           &node2);
 414         attr = axiom_attribute_create(this->env, "ifmap-cardinality",
 415                                                                   "multiValue", NULL);
 416         axiom_element_add_attribute(el, this->env, attr, node2);
 417         axiom_node_add_child(node, this->env, node2);
 418
 419         el = axiom_element_create(this->env, NULL, "enforcement-action", NULL,
 420                                                           &node3);
 421         axiom_node_add_child(node2, this->env, node3);
 422         text = axiom_text_create(this->env, node3, action, &node4);
 423
 424         el = axiom_element_create(this->env, NULL, "enforcement-reason", NULL,
 425                                                           &node3);
 426         axiom_node_add_child(node2, this->env, node3);
 427         text = axiom_text_create(this->env, node3, reason, &node4);
 428
 429     return node;
 430 }
 431 /**
 432  * Create delete filter
 433  */
 434 static axiom_node_t* create_delete_filter(private_tnc_ifmap_soap_t *this,
 435                                                                                   char *metadata)
 436 {
 437         axiom_element_t *el;
 438         axiom_node_t *node;
 439         axiom_attribute_t *attr;
 440         char buf[BUF_LEN];
 441
 442         el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
 443
 444         snprintf(buf, BUF_LEN, "meta:%s[@ifmap-publisher-id='%s']",
 445                          metadata, this->ifmap_publisher_id);
 446         attr = axiom_attribute_create(this->env, "filter", buf, NULL);
 447         axiom_element_add_attribute(el, this->env, attr, node);
 448
 449         return node;
 450 }
 451
 452 /**
 453  * Create a publish request
 454  */
 455 static axiom_node_t* create_publish_request(private_tnc_ifmap_soap_t *this)
 456 {
 457         axiom_element_t *el;
 458         axiom_node_t *request;
 459         axiom_namespace_t *ns, *ns_meta;
 460         axiom_attribute_t *attr;
 461
 462         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 463         el = axiom_element_create(this->env, NULL, "publish", ns, &request);
 464         ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
 465         axiom_element_declare_namespace(el, this->env, request, ns_meta);
 466         attr = axiom_attribute_create(this->env, "session-id", this->session_id,
 467                                                                   NULL);
 468         axiom_element_add_attribute(el, this->env, attr, request);
 469
 470         return request;
 471 }
 472 METHOD(tnc_ifmap_soap_t, publish_ike_sa, bool,
 473         private_tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, bool up)
 474 {
 475         axiom_node_t *request, *node, *node2;
 476         axiom_element_t *el;
 477
 478         enumerator_t *e1, *e2;
 479         auth_rule_t type;
 480         identification_t *id, *eap_id, *group;
 481         host_t *host;
 482         auth_cfg_t *auth;
 483         u_int32_t ike_sa_id;
 484         bool is_user = FALSE, first = TRUE;
 485
 486         /* extract relevant data from IKE_SA*/
 487         ike_sa_id = ike_sa->get_unique_id(ike_sa);
 488         id = ike_sa->get_other_id(ike_sa);
 489         eap_id = ike_sa->get_other_eap_id(ike_sa);
 490         host = ike_sa->get_other_host(ike_sa);
 491
 492         /* in the presence of an EAP Identity, treat it as a username */
 493         if (!id->equals(id, eap_id))
 494         {
 495                 is_user = TRUE;
 496                 id = eap_id;
 497         }
 498
 499         /* build publish request */
 500         request = create_publish_request(this);
 501
 502         /* delete any existing enforcement reports */
 503         if (up)
 504         {
 505                 node = create_delete_filter(this, "enforcement-report");
 506                 axiom_node_add_child(request, this->env, node);
 507                 axiom_node_add_child(node, this->env,
 508                                                          create_ip_address(this, host));
 509                 axiom_node_add_child(node, this->env,
 510                                                          create_device(this));
 511         }
 512
 513         /**
 514          * update or delete authenticated-as metadata
 515          */
 516         if (up)
 517         {
 518                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 519         }
 520         else
 521         {
 522                 node = create_delete_filter(this, "authenticated-as");
 523         }
 524         axiom_node_add_child(request, this->env, node);
 525
 526         /* add access-request, identity and [if up] metadata */
 527         axiom_node_add_child(node, this->env,
 528                                                          create_access_request(this, ike_sa_id));
 529         axiom_node_add_child(node, this->env,
 530                                                          create_identity(this, id, is_user));
 531         if (up)
 532         {
 533                 axiom_node_add_child(node, this->env,
 534                                                          create_metadata(this, "authenticated-as"));
 535         }
 536
 537         /**
 538          * update or delete access-request-ip metadata
 539          */
 540         if (up)
 541         {
 542                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 543         }
 544         else
 545         {
 546                 node = create_delete_filter(this, "access-request-ip");
 547         }
 548         axiom_node_add_child(request, this->env, node);
 549
 550         /* add access-request, ip-address and [if up] metadata */
 551         axiom_node_add_child(node, this->env,
 552                                                          create_access_request(this, ike_sa_id));
 553         axiom_node_add_child(node, this->env,
 554                                                          create_ip_address(this, host));
 555         if (up)
 556         {
 557                 axiom_node_add_child(node, this->env,
 558                                                          create_metadata(this, "access-request-ip"));
 559         }
 560
 561         /**
 562          * update or delete authenticated-by metadata
 563          */
 564         if (up)
 565         {
 566                 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 567         }
 568         else
 569         {
 570                 node = create_delete_filter(this, "authenticated-by");
 571         }
 572         axiom_node_add_child(request, this->env, node);
 573
 574         /* add access-request, device and [if up] metadata */
 575         axiom_node_add_child(node, this->env,
 576                                                          create_access_request(this, ike_sa_id));
 577         axiom_node_add_child(node, this->env,
 578                                                          create_device(this));
 579         if (up)
 580         {
 581                 axiom_node_add_child(node, this->env,
 582                                                          create_metadata(this, "authenticated-by"));
 583         }
 584
 585         /**
 586          * update or delete capability metadata
 587          */
 588         e1 = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
 589         while (e1->enumerate(e1, &auth))
 590         {
 591                 e2 = auth->create_enumerator(auth);
 592                 while (e2->enumerate(e2, &type, &group))
 593                 {
 594                         /* look for group memberships */
 595                         if (type == AUTH_RULE_GROUP)
 596                         {
 597                                 if (first)
 598                                 {
 599                                         first = FALSE;
 600
 601                                         if (up)
 602                                         {
 603                                                 el = axiom_element_create(this->env, NULL, "update",
 604                                                                                                   NULL, &node);
 605                                         }
 606                                         else
 607                                         {
 608                                                 node = create_delete_filter(this, "capability");
 609                                         }
 610                                         axiom_node_add_child(request, this->env, node);
 611
 612                                         /* add access-request */
 613                                         axiom_node_add_child(node, this->env,
 614                                                                          create_access_request(this, ike_sa_id));
 615                                         if (!up)
 616                                         {
 617                                                 break;
 618                                         }
 619                                         el = axiom_element_create(this->env, NULL, "metadata", NULL,
 620                                                                                           &node2);
 621                                         axiom_node_add_child(node, this->env, node2);
 622                                 }
 623                                 axiom_node_add_child(node2, this->env,
 624                                                                          create_capability(this, group));
 625                         }
 626                         if (!first && !up)
 627                         {
 628                                 break;
 629                         }
 630                 }
 631                 e2->destroy(e2);
 632         }
 633         e1->destroy(e1);
 634
 635         /* send publish request and receive publishReceived */
 636         return send_receive(this, "publish", request, "publishReceived", NULL);
 637 }
 638
 639 METHOD(tnc_ifmap_soap_t, publish_device_ip, bool,
 640         private_tnc_ifmap_soap_t *this, host_t *host)
 641 {
 642         axiom_node_t *request, *node;
 643         axiom_element_t *el;
 644
 645         /* build publish update request */
 646         request = create_publish_request(this);
 647         el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 648         axiom_node_add_child(request, this->env, node);
 649
 650         /* add device, ip-address and metadata */
 651         axiom_node_add_child(node, this->env,
 652                                                  create_device(this));
 653         axiom_node_add_child(node, this->env,
 654                                                  create_ip_address(this, host));
 655         axiom_node_add_child(node, this->env,
 656                                                  create_metadata(this, "device-ip"));
 657
 658         /* send publish request and receive publishReceived */
 659         return send_receive(this, "publish", request, "publishReceived", NULL);
 660 }
 661
 662 METHOD(tnc_ifmap_soap_t, publish_enforcement_report, bool,
 663         private_tnc_ifmap_soap_t *this, host_t *host, char *action, char *reason)
 664 {
 665         axiom_node_t *request, *node;
 666         axiom_element_t *el;
 667
 668     /* build publish update request */
 669         request = create_publish_request(this);
 670         el = axiom_element_create(this->env, NULL, "update", NULL, &node);
 671         axiom_node_add_child(request, this->env, node);
 672
 673         /* add ip-address and metadata */
 674         axiom_node_add_child(node, this->env,
 675                                                  create_ip_address(this, host));
 676         axiom_node_add_child(node, this->env,
 677                                                  create_device(this));
 678         axiom_node_add_child(node, this->env,
 679                                                  create_enforcement_report(this, action, reason));
 680
 681         /* send publish request and receive publishReceived */
 682         return send_receive(this, "publish", request, "publishReceived", NULL);
 683 }
 684
 685 METHOD(tnc_ifmap_soap_t, endSession, bool,
 686         private_tnc_ifmap_soap_t *this)
 687 {
 688         axiom_node_t *request;
 689         axiom_element_t *el;
 690         axiom_namespace_t *ns;
 691         axiom_attribute_t *attr;
 692
 693         /* build endSession request */
 694         ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
 695         el = axiom_element_create(this->env, NULL, "endSession", ns, &request);
 696         attr = axiom_attribute_create(this->env, "session-id", this->session_id, NULL);
 697         axiom_element_add_attribute(el, this->env, attr, request);
 698
 699         /* send endSession request and receive end SessionResult */
 700         return send_receive(this, "endSession", request, "endSessionResult", NULL);
 701 }
 702
 703 METHOD(tnc_ifmap_soap_t, destroy, void,
 704         private_tnc_ifmap_soap_t *this)
 705 {
 706         if (this->session_id)
 707         {
 708                 endSession(this);
 709                 free(this->session_id);
 710                 free(this->ifmap_publisher_id);
 711                 free(this->device_name);
 712         }
 713         if (this->svc_client)
 714         {
 715                 axis2_svc_client_free(this->svc_client, this->env);
 716         }
 717         if (this->env)
 718         {
 719                 axutil_env_free(this->env);
 720         }
 721         free(this);
 722 }
 723
 724 static bool axis2c_init(private_tnc_ifmap_soap_t *this)
 725 {
 726         axis2_char_t *server, *server_cert, *client_home;
 727         axis2_char_t *username, *password, *auth_type;
 728         axis2_endpoint_ref_t* endpoint_ref = NULL;
 729         axis2_options_t *options = NULL;
 730         axis2_transport_in_desc_t *transport_in;
 731         axis2_transport_out_desc_t *transport_out;
 732         axis2_transport_sender_t *transport_sender;
 733         axutil_property_t* property;
 734
 735         /* Getting configuration parameters from strongswan.conf */
 736         client_home = lib->settings->get_str(lib->settings,
 737                                         "charon.plugins.tnc-ifmap.client_home",
 738                                         AXIS2_GETENV("AXIS2C_HOME"));
 739         server = lib->settings->get_str(lib->settings,
 740                                         "charon.plugins.tnc-ifmap.server", IFMAP_SERVER);
 741         server_cert = lib->settings->get_str(lib->settings,
 742                                         "charon.plugins.tnc-ifmap.server_cert", NULL);
 743         auth_type = lib->settings->get_str(lib->settings,
 744                                         "charon.plugins.tnc-ifmap.auth_type", "Basic");
 745         username = lib->settings->get_str(lib->settings,
 746                                         "charon.plugins.tnc-ifmap.username", NULL);
 747         password = lib->settings->get_str(lib->settings,
 748                                         "charon.plugins.tnc-ifmap.password", NULL);
 749
 750         if (!server_cert)
 751         {
 752                 DBG1(DBG_TNC, "MAP server certificate not defined");
 753                 return FALSE;
 754         }
 755         if (!username || !password)
 756         {
 757                 DBG1(DBG_TNC, "MAP client %s%s%s not defined",
 758                         (!username) ? "username" : "",
 759                         (!username && ! password) ? " and " : "",
 760                         (!password) ? "password" : "");
 761                 return FALSE;
 762         }
 763
 764         /* Create Axis2/C environment and options */
 765         this->env = axutil_env_create_all(IFMAP_LOGFILE, AXIS2_LOG_LEVEL_TRACE);
 766         options = axis2_options_create(this->env);
 767
 768         /* Path to the MAP server certificate */
 769         property =axutil_property_create_with_args(this->env, 0, 0, 0, server_cert);
 770         axis2_options_set_property(options, this->env, AXIS2_SSL_SERVER_CERT, property);
 771
 772         /* Define the MAP server as the to endpoint reference */
 773         endpoint_ref = axis2_endpoint_ref_create(this->env, server);
 774         axis2_options_set_to(options, this->env, endpoint_ref);
 775
 776         /* Set up HTTP Basic or Digest MAP client authentication */
 777         axis2_options_set_http_auth_info(options, this->env, username, password,
 778                                                                          auth_type);
 779
 780         /* Set up https transport */
 781         transport_in = axis2_transport_in_desc_create(this->env,
 782                                                                                                   AXIS2_TRANSPORT_ENUM_HTTPS);
 783         transport_out = axis2_transport_out_desc_create(this->env,
 784                                                                                                   AXIS2_TRANSPORT_ENUM_HTTPS);
 785         transport_sender = axis2_http_transport_sender_create(this->env);
 786         axis2_transport_out_desc_set_sender(transport_out, this->env,
 787                                                                                 transport_sender);
 788         axis2_options_set_transport_in(options, this->env, transport_in);
 789         axis2_options_set_transport_out(options, this->env, transport_out);
 790
 791         /* Create the axis2 service client */
 792         this->svc_client = axis2_svc_client_create(this->env, client_home);
 793         if (!this->svc_client)
 794         {
 795                 DBG1(DBG_TNC, "could not create axis2 service client");
 796                 AXIS2_LOG_ERROR(this->env->log, AXIS2_LOG_SI,
 797                                             "Stub invoke FAILED: Error code: %d :: %s",
 798                                                 this->env->error->error_number,
 799                                                 AXIS2_ERROR_GET_MESSAGE(this->env->error));
 800                 destroy(this);
 801                 return FALSE;
 802         }
 803
 804         axis2_svc_client_set_options(this->svc_client, this->env, options);
 805         DBG1(DBG_TNC, "connecting as MAP client '%s' to MAP server at '%s'",
 806                                    username, server);
 807
 808         return TRUE;
 809 }
 810
 811 /**
 812  * See header
 813  */
 814 tnc_ifmap_soap_t *tnc_ifmap_soap_create()
 815 {
 816         private_tnc_ifmap_soap_t *this;
 817
 818         INIT(this,
 819                 .public = {
 820                         .newSession = _newSession,
 821                         .purgePublisher = _purgePublisher,
 822                         .publish_ike_sa = _publish_ike_sa,
 823                         .publish_device_ip = _publish_device_ip,
 824                         .publish_enforcement_report = _publish_enforcement_report,
 825                         .endSession = _endSession,
 826                         .destroy = _destroy,
 827                 },
 828         );
 829
 830         if (!axis2c_init(this))
 831         {
 832                 destroy(this);
 833                 return NULL;
 834         }
 835
 836         return &this->public;
 837 }
 838