implemented enforcement-report metadata
[strongswan.git] / src / libcharon / plugins / tnc_ifmap / tnc_ifmap_soap.c
1 /*
2 * Copyright (C) 2011 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "tnc_ifmap_soap.h"
17
18 #include <debug.h>
19
20 #include <axis2_util.h>
21 #include <axis2_client.h>
22 #include <axis2_http_transport.h>
23 #include <axis2_http_transport_sender.h>
24 #include <axiom_soap.h>
25
26 #define IFMAP_NS "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
27 #define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
28 #define IFMAP_LOGFILE "strongswan_ifmap.log"
29 #define IFMAP_SERVER "https://localhost:8443/"
30
31 typedef struct private_tnc_ifmap_soap_t private_tnc_ifmap_soap_t;
32
33 /**
34 * Private data of an tnc_ifmap_soap_t object.
35 */
36 struct private_tnc_ifmap_soap_t {
37
38 /**
39 * Public tnc_ifmap_soap_t interface.
40 */
41 tnc_ifmap_soap_t public;
42
43 /**
44 * Axis2/C environment
45 */
46 axutil_env_t *env;
47
48 /**
49 * Axis2 service client
50 */
51 axis2_svc_client_t* svc_client;
52
53 /**
54 * SOAP Session ID
55 */
56 char *session_id;
57
58 /**
59 * IF-MAP Publisher ID
60 */
61 char *ifmap_publisher_id;
62
63 /**
64 * PEP and PDP device name
65 */
66 char *device_name;
67
68 };
69
70 /**
71 * Send request and receive result via SOAP
72 */
73 static bool send_receive(private_tnc_ifmap_soap_t *this,
74 char *request_qname, axiom_node_t *request,
75 char *receipt_qname, axiom_node_t **result)
76
77 {
78 axiom_node_t *parent, *node;
79 axiom_element_t *el;
80 axutil_qname_t *qname;
81 bool success = FALSE;
82
83 /* send request and receive result */
84 DBG2(DBG_TNC, "sending ifmap %s", request_qname);
85
86 parent = axis2_svc_client_send_receive(this->svc_client, this->env, request);
87 if (!parent)
88 {
89 DBG1(DBG_TNC, "no ifmap %s received from MAP server", receipt_qname);
90 return FALSE;
91 }
92
93 /* pre-process result */
94 node = axiom_node_get_first_child(parent, this->env);
95 if (node && axiom_node_get_node_type(node, this->env) == AXIOM_ELEMENT)
96 {
97 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
98
99 qname = axiom_element_get_qname(el, this->env, node);
100 success = streq(receipt_qname, axutil_qname_to_string(qname, this->env));
101 if (success)
102 {
103 DBG2(DBG_TNC, "received ifmap %s", receipt_qname);
104 if (result)
105 {
106 *result = parent;
107 }
108 else
109 {
110 /* no further processing requested */
111 axiom_node_free_tree(parent, this->env);
112 }
113 return TRUE;
114 }
115 /* TODO proper error handling */
116 DBG1(DBG_TNC, "%s", axiom_element_to_string(el, this->env, node));
117 }
118
119 /* free parent in the error case */
120 axiom_node_free_tree(parent, this->env);
121
122 return FALSE;
123 }
124
125 METHOD(tnc_ifmap_soap_t, newSession, bool,
126 private_tnc_ifmap_soap_t *this)
127 {
128 axiom_node_t *request, *result, *node;
129 axiom_element_t *el;
130 axiom_namespace_t *ns;
131 axis2_char_t *value;
132
133
134 /* build newSession request */
135 ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
136 el = axiom_element_create(this->env, NULL, "newSession", ns, &request);
137
138 /* send newSession request and receive newSessionResult */
139 if (!send_receive(this, "newSession", request, "newSessionResult", &result))
140 {
141 return FALSE;
142 }
143
144 /* process newSessionResult */
145 node = axiom_node_get_first_child(result, this->env);
146 el = (axiom_element_t *)axiom_node_get_data_element(node, this->env);
147
148 /* get session-id */
149 value = axiom_element_get_attribute_value_by_name(el, this->env,
150 "session-id");
151 this->session_id = strdup(value);
152
153 /* get ifmap-publisher-id */
154 value = axiom_element_get_attribute_value_by_name(el, this->env,
155 "ifmap-publisher-id");
156 this->ifmap_publisher_id = strdup(value);
157
158 DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
159 this->session_id, this->ifmap_publisher_id);
160
161 /* set PEP and PDP device name (defaults to IF-MAP Publisher ID) */
162 this->device_name = lib->settings->get_str(lib->settings,
163 "charon.plugins.tnc-ifmap.device_name",
164 this->ifmap_publisher_id);
165 this->device_name = strdup(this->device_name);
166
167 /* free result */
168 axiom_node_free_tree(result, this->env);
169
170 return this->session_id && this->ifmap_publisher_id;
171 }
172
173 METHOD(tnc_ifmap_soap_t, purgePublisher, bool,
174 private_tnc_ifmap_soap_t *this)
175 {
176 axiom_node_t *request;
177 axiom_element_t *el;
178 axiom_namespace_t *ns;
179 axiom_attribute_t *attr;
180
181 /* build purgePublisher request */
182 ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
183 el = axiom_element_create(this->env, NULL, "purgePublisher", ns, &request);
184 attr = axiom_attribute_create(this->env, "session-id",
185 this->session_id, NULL);
186 axiom_element_add_attribute(el, this->env, attr, request);
187 attr = axiom_attribute_create(this->env, "ifmap-publisher-id",
188 this->ifmap_publisher_id, NULL);
189 axiom_element_add_attribute(el, this->env, attr, request);
190
191 /* send purgePublisher request and receive purgePublisherReceived */
192 return send_receive(this, "purgePublisher", request,
193 "purgePublisherReceived", NULL);
194 }
195
196 /**
197 * Create an access-request based on device_name and ike_sa_id
198 */
199 static axiom_node_t* create_access_request(private_tnc_ifmap_soap_t *this,
200 u_int32_t id)
201 {
202 axiom_element_t *el;
203 axiom_node_t *node;
204 axiom_attribute_t *attr;
205 char buf[BUF_LEN];
206
207 el = axiom_element_create(this->env, NULL, "access-request", NULL, &node);
208
209 snprintf(buf, BUF_LEN, "%s:%d", this->device_name, id);
210 attr = axiom_attribute_create(this->env, "name", buf, NULL);
211 axiom_element_add_attribute(el, this->env, attr, node);
212
213 return node;
214 }
215
216 /**
217 * Create an identity
218 */
219 static axiom_node_t* create_identity(private_tnc_ifmap_soap_t *this,
220 identification_t *id, bool is_user)
221 {
222 axiom_element_t *el;
223 axiom_node_t *node;
224 axiom_attribute_t *attr;
225 char buf[BUF_LEN], *id_type;
226
227 el = axiom_element_create(this->env, NULL, "identity", NULL, &node);
228
229 snprintf(buf, BUF_LEN, "%Y", id);
230 attr = axiom_attribute_create(this->env, "name", buf, NULL);
231 axiom_element_add_attribute(el, this->env, attr, node);
232
233 switch (id->get_type(id))
234 {
235 case ID_IPV4_ADDR:
236 id_type = "other";
237 attr = axiom_attribute_create(this->env, "other-type-definition",
238 "36906:ipv4-address", NULL);
239 axiom_element_add_attribute(el, this->env, attr, node);
240 break;
241 case ID_FQDN:
242 id_type = is_user ? "username" : "dns-name";
243 break;
244 case ID_RFC822_ADDR:
245 id_type = "email-address";
246 break;
247 case ID_IPV6_ADDR:
248 id_type = "other";
249 attr = axiom_attribute_create(this->env, "other-type-definition",
250 "36906:ipv6-address", NULL);
251 axiom_element_add_attribute(el, this->env, attr, node);
252 break;
253 case ID_DER_ASN1_DN:
254 id_type = "distinguished-name";
255 break;
256 case ID_KEY_ID:
257 id_type = "other";
258 attr = axiom_attribute_create(this->env, "other-type-definition",
259 "36906:key-id", NULL);
260 axiom_element_add_attribute(el, this->env, attr, node);
261 break;
262 default:
263 id_type = "other";
264 attr = axiom_attribute_create(this->env, "other-type-definition",
265 "36906:other", NULL);
266 axiom_element_add_attribute(el, this->env, attr, node);
267 }
268 attr = axiom_attribute_create(this->env, "type", id_type, NULL);
269 axiom_element_add_attribute(el, this->env, attr, node);
270
271 return node;
272 }
273
274 /**
275 * Create an ip-address
276 */
277 static axiom_node_t* create_ip_address(private_tnc_ifmap_soap_t *this,
278 host_t *host)
279 {
280 axiom_element_t *el;
281 axiom_node_t *node;
282 axiom_attribute_t *attr;
283 char buf[BUF_LEN];
284
285 el = axiom_element_create(this->env, NULL, "ip-address", NULL, &node);
286
287 if (host->get_family(host) == AF_INET6)
288 {
289 chunk_t address;
290 int len, written, i;
291 char *pos;
292 bool first = TRUE;
293
294 /* output IPv6 address in canonical IF-MAP 2.0 format */
295 address = host->get_address(host);
296 pos = buf;
297 len = sizeof(buf);
298
299 for (i = 0; i < address.len; i = i + 2)
300 {
301 written = snprintf(pos, len, "%s%x", first ? "" : ":",
302 256*address.ptr[i] + address.ptr[i+1]);
303 if (written < 0 || written > len)
304 {
305 break;
306 }
307 pos += written;
308 len -= written;
309 first = FALSE;
310 }
311 }
312 else
313 {
314 snprintf(buf, BUF_LEN, "%H", host);
315 }
316 attr = axiom_attribute_create(this->env, "value", buf, NULL);
317 axiom_element_add_attribute(el, this->env, attr, node);
318
319 attr = axiom_attribute_create(this->env, "type",
320 host->get_family(host) == AF_INET ? "IPv4" : "IPv6", NULL);
321 axiom_element_add_attribute(el, this->env, attr, node);
322
323 return node;
324 }
325
326 /**
327 * Create a device
328 */
329 static axiom_node_t* create_device(private_tnc_ifmap_soap_t *this)
330 {
331 axiom_element_t *el;
332 axiom_node_t *node, *node2, *node3;
333 axiom_text_t *text;
334
335 el = axiom_element_create(this->env, NULL, "device", NULL, &node);
336 el = axiom_element_create(this->env, NULL, "name", NULL, &node2);
337 axiom_node_add_child(node, this->env, node2);
338 text = axiom_text_create(this->env, node2, this->device_name, &node3);
339
340 return node;
341 }
342
343 /**
344 * Create metadata
345 */
346 static axiom_node_t* create_metadata(private_tnc_ifmap_soap_t *this,
347 char *metadata)
348 {
349 axiom_element_t *el;
350 axiom_node_t *node, *node2;
351 axiom_attribute_t *attr;
352 axiom_namespace_t *ns_meta;
353
354 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node);
355 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
356
357 el = axiom_element_create(this->env, NULL, metadata, ns_meta, &node2);
358 axiom_node_add_child(node, this->env, node2);
359 attr = axiom_attribute_create(this->env, "ifmap-cardinality", "singleValue",
360 NULL);
361 axiom_element_add_attribute(el, this->env, attr, node2);
362
363 return node;
364 }
365
366 /**
367 * Create capability metadata
368 */
369 static axiom_node_t* create_capability(private_tnc_ifmap_soap_t *this,
370 identification_t *name)
371 {
372 axiom_element_t *el;
373 axiom_node_t *node, *node2, *node3;
374 axiom_namespace_t *ns_meta;
375 axiom_attribute_t *attr;
376 axiom_text_t *text;
377 char buf[BUF_LEN];
378
379 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
380 el = axiom_element_create(this->env, NULL, "capability", ns_meta, &node);
381 attr = axiom_attribute_create(this->env, "ifmap-cardinality", "multiValue",
382 NULL);
383 axiom_element_add_attribute(el, this->env, attr, node);
384
385 el = axiom_element_create(this->env, NULL, "name", NULL, &node2);
386 axiom_node_add_child(node, this->env, node2);
387 snprintf(buf, BUF_LEN, "%Y", name);
388 text = axiom_text_create(this->env, node2, buf, &node3);
389
390 el = axiom_element_create(this->env, NULL, "administrative-domain", NULL, &node2);
391 axiom_node_add_child(node, this->env, node2);
392 text = axiom_text_create(this->env, node2, "strongswan", &node3);
393
394 return node;
395 }
396
397 /**
398 * Create enforcement-report metadata
399 */
400 static axiom_node_t* create_enforcement_report(private_tnc_ifmap_soap_t *this,
401 char *action, char *reason)
402 {
403 axiom_element_t *el;
404 axiom_node_t *node, *node2, *node3, *node4;
405 axiom_namespace_t *ns_meta;
406 axiom_attribute_t *attr;
407 axiom_text_t *text;
408
409 el = axiom_element_create(this->env, NULL, "metadata", NULL, &node);
410
411 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
412 el = axiom_element_create(this->env, NULL, "enforcement-report", ns_meta,
413 &node2);
414 attr = axiom_attribute_create(this->env, "ifmap-cardinality",
415 "multiValue", NULL);
416 axiom_element_add_attribute(el, this->env, attr, node2);
417 axiom_node_add_child(node, this->env, node2);
418
419 el = axiom_element_create(this->env, NULL, "enforcement-action", NULL,
420 &node3);
421 axiom_node_add_child(node2, this->env, node3);
422 text = axiom_text_create(this->env, node3, action, &node4);
423
424 el = axiom_element_create(this->env, NULL, "enforcement-reason", NULL,
425 &node3);
426 axiom_node_add_child(node2, this->env, node3);
427 text = axiom_text_create(this->env, node3, reason, &node4);
428
429 return node;
430 }
431 /**
432 * Create delete filter
433 */
434 static axiom_node_t* create_delete_filter(private_tnc_ifmap_soap_t *this,
435 char *metadata)
436 {
437 axiom_element_t *el;
438 axiom_node_t *node;
439 axiom_attribute_t *attr;
440 char buf[BUF_LEN];
441
442 el = axiom_element_create(this->env, NULL, "delete", NULL, &node);
443
444 snprintf(buf, BUF_LEN, "meta:%s[@ifmap-publisher-id='%s']",
445 metadata, this->ifmap_publisher_id);
446 attr = axiom_attribute_create(this->env, "filter", buf, NULL);
447 axiom_element_add_attribute(el, this->env, attr, node);
448
449 return node;
450 }
451
452 /**
453 * Create a publish request
454 */
455 static axiom_node_t* create_publish_request(private_tnc_ifmap_soap_t *this)
456 {
457 axiom_element_t *el;
458 axiom_node_t *request;
459 axiom_namespace_t *ns, *ns_meta;
460 axiom_attribute_t *attr;
461
462 ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
463 el = axiom_element_create(this->env, NULL, "publish", ns, &request);
464 ns_meta = axiom_namespace_create(this->env, IFMAP_META_NS, "meta");
465 axiom_element_declare_namespace(el, this->env, request, ns_meta);
466 attr = axiom_attribute_create(this->env, "session-id", this->session_id,
467 NULL);
468 axiom_element_add_attribute(el, this->env, attr, request);
469
470 return request;
471 }
472 METHOD(tnc_ifmap_soap_t, publish_ike_sa, bool,
473 private_tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, bool up)
474 {
475 axiom_node_t *request, *node, *node2;
476 axiom_element_t *el;
477
478 enumerator_t *e1, *e2;
479 auth_rule_t type;
480 identification_t *id, *eap_id, *group;
481 host_t *host;
482 auth_cfg_t *auth;
483 u_int32_t ike_sa_id;
484 bool is_user = FALSE, first = TRUE;
485
486 /* extract relevant data from IKE_SA*/
487 ike_sa_id = ike_sa->get_unique_id(ike_sa);
488 id = ike_sa->get_other_id(ike_sa);
489 eap_id = ike_sa->get_other_eap_id(ike_sa);
490 host = ike_sa->get_other_host(ike_sa);
491
492 /* in the presence of an EAP Identity, treat it as a username */
493 if (!id->equals(id, eap_id))
494 {
495 is_user = TRUE;
496 id = eap_id;
497 }
498
499 /* build publish request */
500 request = create_publish_request(this);
501
502 /* delete any existing enforcement reports */
503 if (up)
504 {
505 node = create_delete_filter(this, "enforcement-report");
506 axiom_node_add_child(request, this->env, node);
507 axiom_node_add_child(node, this->env,
508 create_ip_address(this, host));
509 axiom_node_add_child(node, this->env,
510 create_device(this));
511 }
512
513 /**
514 * update or delete authenticated-as metadata
515 */
516 if (up)
517 {
518 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
519 }
520 else
521 {
522 node = create_delete_filter(this, "authenticated-as");
523 }
524 axiom_node_add_child(request, this->env, node);
525
526 /* add access-request, identity and [if up] metadata */
527 axiom_node_add_child(node, this->env,
528 create_access_request(this, ike_sa_id));
529 axiom_node_add_child(node, this->env,
530 create_identity(this, id, is_user));
531 if (up)
532 {
533 axiom_node_add_child(node, this->env,
534 create_metadata(this, "authenticated-as"));
535 }
536
537 /**
538 * update or delete access-request-ip metadata
539 */
540 if (up)
541 {
542 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
543 }
544 else
545 {
546 node = create_delete_filter(this, "access-request-ip");
547 }
548 axiom_node_add_child(request, this->env, node);
549
550 /* add access-request, ip-address and [if up] metadata */
551 axiom_node_add_child(node, this->env,
552 create_access_request(this, ike_sa_id));
553 axiom_node_add_child(node, this->env,
554 create_ip_address(this, host));
555 if (up)
556 {
557 axiom_node_add_child(node, this->env,
558 create_metadata(this, "access-request-ip"));
559 }
560
561 /**
562 * update or delete authenticated-by metadata
563 */
564 if (up)
565 {
566 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
567 }
568 else
569 {
570 node = create_delete_filter(this, "authenticated-by");
571 }
572 axiom_node_add_child(request, this->env, node);
573
574 /* add access-request, device and [if up] metadata */
575 axiom_node_add_child(node, this->env,
576 create_access_request(this, ike_sa_id));
577 axiom_node_add_child(node, this->env,
578 create_device(this));
579 if (up)
580 {
581 axiom_node_add_child(node, this->env,
582 create_metadata(this, "authenticated-by"));
583 }
584
585 /**
586 * update or delete capability metadata
587 */
588 e1 = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
589 while (e1->enumerate(e1, &auth))
590 {
591 e2 = auth->create_enumerator(auth);
592 while (e2->enumerate(e2, &type, &group))
593 {
594 /* look for group memberships */
595 if (type == AUTH_RULE_GROUP)
596 {
597 if (first)
598 {
599 first = FALSE;
600
601 if (up)
602 {
603 el = axiom_element_create(this->env, NULL, "update",
604 NULL, &node);
605 }
606 else
607 {
608 node = create_delete_filter(this, "capability");
609 }
610 axiom_node_add_child(request, this->env, node);
611
612 /* add access-request */
613 axiom_node_add_child(node, this->env,
614 create_access_request(this, ike_sa_id));
615 if (!up)
616 {
617 break;
618 }
619 el = axiom_element_create(this->env, NULL, "metadata", NULL,
620 &node2);
621 axiom_node_add_child(node, this->env, node2);
622 }
623 axiom_node_add_child(node2, this->env,
624 create_capability(this, group));
625 }
626 if (!first && !up)
627 {
628 break;
629 }
630 }
631 e2->destroy(e2);
632 }
633 e1->destroy(e1);
634
635 /* send publish request and receive publishReceived */
636 return send_receive(this, "publish", request, "publishReceived", NULL);
637 }
638
639 METHOD(tnc_ifmap_soap_t, publish_device_ip, bool,
640 private_tnc_ifmap_soap_t *this, host_t *host)
641 {
642 axiom_node_t *request, *node;
643 axiom_element_t *el;
644
645 /* build publish update request */
646 request = create_publish_request(this);
647 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
648 axiom_node_add_child(request, this->env, node);
649
650 /* add device, ip-address and metadata */
651 axiom_node_add_child(node, this->env,
652 create_device(this));
653 axiom_node_add_child(node, this->env,
654 create_ip_address(this, host));
655 axiom_node_add_child(node, this->env,
656 create_metadata(this, "device-ip"));
657
658 /* send publish request and receive publishReceived */
659 return send_receive(this, "publish", request, "publishReceived", NULL);
660 }
661
662 METHOD(tnc_ifmap_soap_t, publish_enforcement_report, bool,
663 private_tnc_ifmap_soap_t *this, host_t *host, char *action, char *reason)
664 {
665 axiom_node_t *request, *node;
666 axiom_element_t *el;
667
668 /* build publish update request */
669 request = create_publish_request(this);
670 el = axiom_element_create(this->env, NULL, "update", NULL, &node);
671 axiom_node_add_child(request, this->env, node);
672
673 /* add ip-address and metadata */
674 axiom_node_add_child(node, this->env,
675 create_ip_address(this, host));
676 axiom_node_add_child(node, this->env,
677 create_device(this));
678 axiom_node_add_child(node, this->env,
679 create_enforcement_report(this, action, reason));
680
681 /* send publish request and receive publishReceived */
682 return send_receive(this, "publish", request, "publishReceived", NULL);
683 }
684
685 METHOD(tnc_ifmap_soap_t, endSession, bool,
686 private_tnc_ifmap_soap_t *this)
687 {
688 axiom_node_t *request;
689 axiom_element_t *el;
690 axiom_namespace_t *ns;
691 axiom_attribute_t *attr;
692
693 /* build endSession request */
694 ns = axiom_namespace_create(this->env, IFMAP_NS, "ifmap");
695 el = axiom_element_create(this->env, NULL, "endSession", ns, &request);
696 attr = axiom_attribute_create(this->env, "session-id", this->session_id, NULL);
697 axiom_element_add_attribute(el, this->env, attr, request);
698
699 /* send endSession request and receive end SessionResult */
700 return send_receive(this, "endSession", request, "endSessionResult", NULL);
701 }
702
703 METHOD(tnc_ifmap_soap_t, destroy, void,
704 private_tnc_ifmap_soap_t *this)
705 {
706 if (this->session_id)
707 {
708 endSession(this);
709 free(this->session_id);
710 free(this->ifmap_publisher_id);
711 free(this->device_name);
712 }
713 if (this->svc_client)
714 {
715 axis2_svc_client_free(this->svc_client, this->env);
716 }
717 if (this->env)
718 {
719 axutil_env_free(this->env);
720 }
721 free(this);
722 }
723
724 static bool axis2c_init(private_tnc_ifmap_soap_t *this)
725 {
726 axis2_char_t *server, *server_cert, *client_home;
727 axis2_char_t *username, *password, *auth_type;
728 axis2_endpoint_ref_t* endpoint_ref = NULL;
729 axis2_options_t *options = NULL;
730 axis2_transport_in_desc_t *transport_in;
731 axis2_transport_out_desc_t *transport_out;
732 axis2_transport_sender_t *transport_sender;
733 axutil_property_t* property;
734
735 /* Getting configuration parameters from strongswan.conf */
736 client_home = lib->settings->get_str(lib->settings,
737 "charon.plugins.tnc-ifmap.client_home",
738 AXIS2_GETENV("AXIS2C_HOME"));
739 server = lib->settings->get_str(lib->settings,
740 "charon.plugins.tnc-ifmap.server", IFMAP_SERVER);
741 server_cert = lib->settings->get_str(lib->settings,
742 "charon.plugins.tnc-ifmap.server_cert", NULL);
743 auth_type = lib->settings->get_str(lib->settings,
744 "charon.plugins.tnc-ifmap.auth_type", "Basic");
745 username = lib->settings->get_str(lib->settings,
746 "charon.plugins.tnc-ifmap.username", NULL);
747 password = lib->settings->get_str(lib->settings,
748 "charon.plugins.tnc-ifmap.password", NULL);
749
750 if (!server_cert)
751 {
752 DBG1(DBG_TNC, "MAP server certificate not defined");
753 return FALSE;
754 }
755 if (!username || !password)
756 {
757 DBG1(DBG_TNC, "MAP client %s%s%s not defined",
758 (!username) ? "username" : "",
759 (!username && ! password) ? " and " : "",
760 (!password) ? "password" : "");
761 return FALSE;
762 }
763
764 /* Create Axis2/C environment and options */
765 this->env = axutil_env_create_all(IFMAP_LOGFILE, AXIS2_LOG_LEVEL_TRACE);
766 options = axis2_options_create(this->env);
767
768 /* Path to the MAP server certificate */
769 property =axutil_property_create_with_args(this->env, 0, 0, 0, server_cert);
770 axis2_options_set_property(options, this->env, AXIS2_SSL_SERVER_CERT, property);
771
772 /* Define the MAP server as the to endpoint reference */
773 endpoint_ref = axis2_endpoint_ref_create(this->env, server);
774 axis2_options_set_to(options, this->env, endpoint_ref);
775
776 /* Set up HTTP Basic or Digest MAP client authentication */
777 axis2_options_set_http_auth_info(options, this->env, username, password,
778 auth_type);
779
780 /* Set up https transport */
781 transport_in = axis2_transport_in_desc_create(this->env,
782 AXIS2_TRANSPORT_ENUM_HTTPS);
783 transport_out = axis2_transport_out_desc_create(this->env,
784 AXIS2_TRANSPORT_ENUM_HTTPS);
785 transport_sender = axis2_http_transport_sender_create(this->env);
786 axis2_transport_out_desc_set_sender(transport_out, this->env,
787 transport_sender);
788 axis2_options_set_transport_in(options, this->env, transport_in);
789 axis2_options_set_transport_out(options, this->env, transport_out);
790
791 /* Create the axis2 service client */
792 this->svc_client = axis2_svc_client_create(this->env, client_home);
793 if (!this->svc_client)
794 {
795 DBG1(DBG_TNC, "could not create axis2 service client");
796 AXIS2_LOG_ERROR(this->env->log, AXIS2_LOG_SI,
797 "Stub invoke FAILED: Error code: %d :: %s",
798 this->env->error->error_number,
799 AXIS2_ERROR_GET_MESSAGE(this->env->error));
800 destroy(this);
801 return FALSE;
802 }
803
804 axis2_svc_client_set_options(this->svc_client, this->env, options);
805 DBG1(DBG_TNC, "connecting as MAP client '%s' to MAP server at '%s'",
806 username, server);
807
808 return TRUE;
809 }
810
811 /**
812 * See header
813 */
814 tnc_ifmap_soap_t *tnc_ifmap_soap_create()
815 {
816 private_tnc_ifmap_soap_t *this;
817
818 INIT(this,
819 .public = {
820 .newSession = _newSession,
821 .purgePublisher = _purgePublisher,
822 .publish_ike_sa = _publish_ike_sa,
823 .publish_device_ip = _publish_device_ip,
824 .publish_enforcement_report = _publish_enforcement_report,
825 .endSession = _endSession,
826 .destroy = _destroy,
827 },
828 );
829
830 if (!axis2c_init(this))
831 {
832 destroy(this);
833 return NULL;
834 }
835
836 return &this->public;
837 }
838