src/libcharon/plugins/tnc_ifmap2/tnc_ifmap2_soap.c

   1 /*
   2  * Copyright (C) 2011-2013 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tnc_ifmap2_soap.h"
  17 #include "tnc_ifmap2_soap_msg.h"
  18
  19 #include <utils/debug.h>
  20 #include <credentials/sets/mem_cred.h>
  21 #include <daemon.h>
  22
  23 #include <tls_socket.h>
  24
  25 #include <errno.h>
  26 #include <unistd.h>
  27 #include <sys/types.h>
  28 #include <sys/socket.h>
  29
  30 #define IFMAP_NS                "http://www.trustedcomputinggroup.org/2010/IFMAP/2"
  31 #define IFMAP_META_NS   "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2"
  32 #define IFMAP_URI               "https://localhost:8444/imap"
  33 #define IFMAP_NO_FD             -1
  34
  35 typedef struct private_tnc_ifmap2_soap_t private_tnc_ifmap2_soap_t;
  36
  37 /**
  38  * Private data of an tnc_ifmap2_soap_t object.
  39  */
  40 struct private_tnc_ifmap2_soap_t {
  41
  42         /**
  43          * Public tnc_ifmap2_soap_t interface.
  44          */
  45         tnc_ifmap2_soap_t public;
  46
  47         /**
  48          * SOAP Session ID
  49          */
  50         xmlChar *session_id;
  51
  52         /**
  53          * IF-MAP Publisher ID
  54          */
  55         xmlChar *ifmap_publisher_id;
  56
  57         /**
  58          * IF-MAP namespace
  59          */
  60         xmlNsPtr ns;
  61
  62         /**
  63          * IF-MAP metadata namespace
  64          */
  65         xmlNsPtr ns_meta;
  66
  67         /**
  68          * PEP and PDP device name
  69          */
  70         char *device_name;
  71
  72         /**
  73          * HTTPS Server URI with https:// prefix removed
  74          */
  75         char *uri;
  76
  77         /**
  78          * Optional base64-encoded username:password for HTTP Basic Authentication
  79          */
  80         chunk_t user_pass;
  81
  82         /**
  83          * IF-MAP Server (IP address and port)
  84          */
  85         host_t *host;
  86
  87         /**
  88          * TLS socket
  89          */
  90         tls_socket_t *tls;
  91
  92         /**
  93          * File descriptor for secure TCP socket
  94          */
  95         int fd;
  96
  97         /**
  98          * In memory credential set
  99          */
 100         mem_cred_t *creds;
 101
 102 };
 103
 104 METHOD(tnc_ifmap2_soap_t, newSession, bool,
 105         private_tnc_ifmap2_soap_t *this)
 106 {
 107         tnc_ifmap2_soap_msg_t *soap_msg;
 108         xmlNodePtr request, result;
 109
 110         /*build newSession request */
 111         request = xmlNewNode(NULL, "newSession");
 112         this->ns = xmlNewNs(request, IFMAP_NS, "ifmap");
 113         xmlSetNs(request, this->ns);
 114
 115         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 116         if (!soap_msg->post(soap_msg, request, "newSessionResult", &result))
 117         {
 118                 soap_msg->destroy(soap_msg);
 119                 return FALSE;
 120         }
 121
 122         /* get session-id and ifmap-publisher-id properties */
 123         this->session_id = xmlGetProp(result, "session-id");
 124         this->ifmap_publisher_id = xmlGetProp(result, "ifmap-publisher-id");
 125         soap_msg->destroy(soap_msg);
 126
 127         DBG1(DBG_TNC, "session-id: %s, ifmap-publisher-id: %s",
 128                                    this->session_id, this->ifmap_publisher_id);
 129
 130         /* set PEP and PDP device name (defaults to IF-MAP Publisher ID) */
 131         this->device_name = lib->settings->get_str(lib->settings,
 132                                                                         "%s.plugins.tnc-ifmap2.device_name",
 133                                                                          this->ifmap_publisher_id, charon->name);
 134         this->device_name = strdup(this->device_name);
 135
 136     return this->session_id && this->ifmap_publisher_id;
 137 }
 138
 139 METHOD(tnc_ifmap2_soap_t, purgePublisher, bool,
 140         private_tnc_ifmap2_soap_t *this)
 141 {
 142         tnc_ifmap2_soap_msg_t *soap_msg;
 143         xmlNodePtr request;
 144         bool success;
 145
 146         /* build purgePublisher request */
 147         request = xmlNewNode(NULL, "purgePublisher");
 148         this->ns = xmlNewNs(request, IFMAP_NS, "ifmap");
 149         xmlSetNs(request, this->ns);
 150         xmlNewProp(request, "session-id", this->session_id);
 151         xmlNewProp(request, "ifmap-publisher-id", this->ifmap_publisher_id);
 152
 153         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 154         success = soap_msg->post(soap_msg, request, "purgePublisherReceived", NULL);
 155         soap_msg->destroy(soap_msg);
 156
 157         return success;
 158 }
 159
 160 /**
 161  * Create an access-request based on device_name and ike_sa_id
 162  */
 163 static xmlNodePtr create_access_request(private_tnc_ifmap2_soap_t *this,
 164                                                                                 u_int32_t id)
 165 {
 166         xmlNodePtr node;
 167         char buf[BUF_LEN];
 168
 169         node = xmlNewNode(NULL, "access-request");
 170
 171         snprintf(buf, BUF_LEN, "%s:%d", this->device_name, id);
 172         xmlNewProp(node, "name", buf);
 173
 174         return node;
 175 }
 176
 177 /**
 178  * Create an identity
 179  */
 180 static xmlNodePtr create_identity(private_tnc_ifmap2_soap_t *this,
 181                                                                   identification_t *id, bool is_user)
 182 {
 183         xmlNodePtr node;
 184         char buf[BUF_LEN], *id_type;
 185
 186         node = xmlNewNode(NULL, "identity");
 187
 188         snprintf(buf, BUF_LEN, "%Y", id);
 189         xmlNewProp(node, "name", buf);
 190
 191         switch (id->get_type(id))
 192         {
 193                 case ID_IPV4_ADDR:
 194                         id_type = "other";
 195                         xmlNewProp(node, "other-type-definition", "36906:ipv4-address");
 196                         break;
 197                 case ID_FQDN:
 198                         id_type = is_user ? "username" : "dns-name";
 199                         break;
 200                 case ID_RFC822_ADDR:
 201                         id_type = "email-address";
 202                         break;
 203                 case ID_IPV6_ADDR:
 204                         id_type = "other";
 205                         xmlNewProp(node, "other-type-definition", "36906:ipv6-address");
 206                         break;
 207                 case ID_DER_ASN1_DN:
 208                         id_type = "distinguished-name";
 209                         break;
 210                 case ID_KEY_ID:
 211                         id_type = "other";
 212                         xmlNewProp(node, "other-type-definition", "36906:key-id");
 213                         break;
 214                 default:
 215                         id_type = "other";
 216                         xmlNewProp(node, "other-type-definition", "36906:other");
 217         }
 218         xmlNewProp(node, "type", id_type);
 219
 220         return node;
 221 }
 222
 223 /**
 224  * Create enforcement-report metadata
 225  */
 226 static xmlNodePtr create_enforcement_report(private_tnc_ifmap2_soap_t *this,
 227                                                                                         xmlChar *action, xmlChar *reason)
 228 {
 229         xmlNodePtr node, node2, node3;
 230
 231         node = xmlNewNode(NULL, "metadata");
 232         node2 = xmlNewNode(this->ns_meta, "enforcement-report");
 233         xmlAddChild(node, node2);
 234         xmlNewProp(node2, "ifmap-cardinality", "multiValue");
 235
 236         node3 = xmlNewNode(NULL, "enforcement-action");
 237         xmlAddChild(node2, node3);
 238         xmlNodeAddContent(node3, action);
 239
 240         node3 = xmlNewNode(NULL, "enforcement-reason");
 241         xmlAddChild(node2, node3);
 242         xmlNodeAddContent(node3, reason);
 243
 244     return node;
 245 }
 246
 247 /**
 248  * Create delete filter
 249  */
 250 static xmlNodePtr create_delete_filter(private_tnc_ifmap2_soap_t *this,
 251                                                                            char *metadata)
 252 {
 253         xmlNodePtr node;
 254         char buf[BUF_LEN];
 255
 256         node = xmlNewNode(NULL, "delete");
 257
 258         snprintf(buf, BUF_LEN, "meta:%s[@ifmap-publisher-id='%s']",
 259                          metadata, this->ifmap_publisher_id);
 260         xmlNewProp(node, "filter", buf);
 261
 262         return node;
 263 }
 264
 265 /**
 266  * Create a publish request
 267  */
 268 static xmlNodePtr create_publish_request(private_tnc_ifmap2_soap_t *this)
 269 {
 270         xmlNodePtr request;
 271
 272         request = xmlNewNode(NULL, "publish");
 273         this->ns = xmlNewNs(request, IFMAP_NS, "ifmap");
 274         xmlSetNs(request, this->ns);
 275         this->ns_meta = xmlNewNs(request, IFMAP_META_NS, "meta");
 276         xmlNewProp(request, "session-id", this->session_id);
 277
 278         return request;
 279 }
 280
 281 /**
 282  * Create a device
 283  */
 284 static xmlNodePtr create_device(private_tnc_ifmap2_soap_t *this)
 285 {
 286         xmlNodePtr node, node2;
 287
 288         node = xmlNewNode(NULL, "device");
 289         node2 = xmlNewNode(NULL, "name");
 290         xmlAddChild(node, node2);
 291         xmlNodeAddContent(node2, this->device_name);
 292
 293         return node;
 294 }
 295
 296 /**
 297  * Create an ip-address
 298  */
 299 static xmlNodePtr create_ip_address(private_tnc_ifmap2_soap_t *this,
 300                                                                         host_t *host)
 301 {
 302         xmlNodePtr node;
 303         char buf[BUF_LEN];
 304
 305         node = xmlNewNode(NULL, "ip-address");
 306
 307         if (host->get_family(host) == AF_INET6)
 308         {
 309                 chunk_t address;
 310                 int len, written, i;
 311                 char *pos;
 312                 bool first = TRUE;
 313
 314                 /* output IPv6 address in canonical IF-MAP 2.0 format */
 315                 address = host->get_address(host);
 316                 pos = buf;
 317                 len = sizeof(buf);
 318
 319                 for (i = 0; i < address.len; i = i + 2)
 320                 {
 321                         written = snprintf(pos, len, "%s%x", first ? "" : ":",
 322                                                            256*address.ptr[i] +  address.ptr[i+1]);
 323                         if (written < 0 || written >= len)
 324                         {
 325                                 break;
 326                         }
 327                         pos += written;
 328                         len -= written;
 329                         first = FALSE;
 330                 }
 331         }
 332         else
 333         {
 334                 snprintf(buf, BUF_LEN, "%H", host);
 335         }
 336
 337         xmlNewProp(node, "value", buf);
 338         xmlNewProp(node, "type", host->get_family(host) == AF_INET ? "IPv4" : "IPv6");
 339
 340         return node;
 341 }
 342
 343 /**
 344  * Create metadata
 345  */
 346 static xmlNodePtr create_metadata(private_tnc_ifmap2_soap_t *this,
 347                                                                   xmlChar *metadata)
 348 {
 349         xmlNodePtr node, node2;
 350
 351         node = xmlNewNode(NULL, "metadata");
 352         node2 = xmlNewNode(this->ns_meta, metadata);
 353         xmlAddChild(node, node2);
 354         xmlNewProp(node2, "ifmap-cardinality", "singleValue");
 355
 356         return node;
 357 }
 358
 359 /**
 360  * Create capability metadata
 361  */
 362 static xmlNodePtr create_capability(private_tnc_ifmap2_soap_t *this,
 363                                                                         identification_t *name)
 364 {
 365         xmlNodePtr node, node2;
 366         char buf[BUF_LEN];
 367
 368         node = xmlNewNode(this->ns_meta, "capability");
 369         xmlNewProp(node, "ifmap-cardinality", "multiValue");
 370
 371         node2 = xmlNewNode(NULL, "name");
 372         xmlAddChild(node, node2);
 373         snprintf(buf, BUF_LEN, "%Y", name);
 374         xmlNodeAddContent(node2, this->device_name);
 375
 376         node2 = xmlNewNode(NULL, "administrative-domain");
 377         xmlNodeAddContent(node2, "strongswan");
 378
 379         return node;
 380 }
 381
 382 METHOD(tnc_ifmap2_soap_t, publish_ike_sa, bool,
 383         private_tnc_ifmap2_soap_t *this, ike_sa_t *ike_sa, bool up)
 384 {
 385         tnc_ifmap2_soap_msg_t *soap_msg;
 386         xmlNodePtr request, node, node2 = NULL;
 387         enumerator_t *e1, *e2;
 388         auth_rule_t type;
 389         identification_t *id, *eap_id, *group;
 390         host_t *host;
 391         auth_cfg_t *auth;
 392         u_int32_t ike_sa_id;
 393         bool is_user = FALSE, first = TRUE, success;
 394
 395         /* extract relevant data from IKE_SA*/
 396         ike_sa_id = ike_sa->get_unique_id(ike_sa);
 397         id = ike_sa->get_other_id(ike_sa);
 398         eap_id = ike_sa->get_other_eap_id(ike_sa);
 399         host = ike_sa->get_other_host(ike_sa);
 400
 401         /* in the presence of an EAP Identity, treat it as a username */
 402         if (!id->equals(id, eap_id))
 403         {
 404                 is_user = TRUE;
 405                 id = eap_id;
 406         }
 407
 408         /* build publish request */
 409         request = create_publish_request(this);
 410
 411         /* delete any existing enforcement reports */
 412         if (up)
 413         {
 414                 node = create_delete_filter(this, "enforcement-report");
 415                 xmlAddChild(request, node);
 416                 xmlAddChild(node, create_ip_address(this, host));
 417                 xmlAddChild(node, create_device(this));
 418         }
 419
 420         /**
 421          * update or delete authenticated-as metadata
 422          */
 423         if (up)
 424         {
 425                 node = xmlNewNode(NULL, "update");
 426         }
 427         else
 428         {
 429                 node = create_delete_filter(this, "authenticated-as");
 430         }
 431         xmlAddChild(request, node);
 432
 433         /* add access-request, identity and [if up] metadata */
 434         xmlAddChild(node, create_access_request(this, ike_sa_id));
 435         xmlAddChild(node, create_identity(this, id, is_user));
 436         if (up)
 437         {
 438                 xmlAddChild(node, create_metadata(this, "authenticated-as"));
 439         }
 440
 441         /**
 442          * update or delete access-request-ip metadata
 443          */
 444         if (up)
 445         {
 446                 node = xmlNewNode(NULL, "update");
 447         }
 448         else
 449         {
 450                 node = create_delete_filter(this, "access-request-ip");
 451         }
 452         xmlAddChild(request, node);
 453
 454         /* add access-request, ip-address and [if up] metadata */
 455         xmlAddChild(node, create_access_request(this, ike_sa_id));
 456         xmlAddChild(node, create_ip_address(this, host));
 457         if (up)
 458         {
 459                 xmlAddChild(node, create_metadata(this, "access-request-ip"));
 460         }
 461
 462         /**
 463          * update or delete authenticated-by metadata
 464          */
 465         if (up)
 466         {
 467                 node = xmlNewNode(NULL, "update");
 468         }
 469         else
 470         {
 471                 node = create_delete_filter(this, "authenticated-by");
 472         }
 473         xmlAddChild(request, node);
 474
 475         /* add access-request, device and [if up] metadata */
 476         xmlAddChild(node, create_access_request(this, ike_sa_id));
 477         xmlAddChild(node, create_device(this));
 478         if (up)
 479         {
 480                 xmlAddChild(node, create_metadata(this, "authenticated-by"));
 481         }
 482
 483         /**
 484          * update or delete capability metadata
 485          */
 486         e1 = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
 487         while (e1->enumerate(e1, &auth) && (first || up))
 488         {
 489                 e2 = auth->create_enumerator(auth);
 490                 while (e2->enumerate(e2, &type, &group))
 491                 {
 492                         /* look for group memberships */
 493                         if (type == AUTH_RULE_GROUP)
 494                         {
 495                                 if (first)
 496                                 {
 497                                         first = FALSE;
 498
 499                                         if (up)
 500                                         {
 501                                                 node = xmlNewNode(NULL, "update");
 502                                         }
 503                                         else
 504                                         {
 505                                                 node = create_delete_filter(this, "capability");
 506                                         }
 507                                         xmlAddChild(request, node);
 508
 509                                         /* add access-request */
 510                                         xmlAddChild(node, create_access_request(this, ike_sa_id));
 511                                         if (!up)
 512                                         {
 513                                                 break;
 514                                         }
 515                                         node2 = xmlNewNode(NULL, "metadata");
 516                                         xmlAddChild(node, node2);
 517                                 }
 518                                 xmlAddChild(node2, create_capability(this, group));
 519                         }
 520                 }
 521                 e2->destroy(e2);
 522         }
 523         e1->destroy(e1);
 524
 525         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 526         success = soap_msg->post(soap_msg, request, "publishReceived", NULL);
 527         soap_msg->destroy(soap_msg);
 528
 529         return success;
 530 }
 531
 532 METHOD(tnc_ifmap2_soap_t, publish_device_ip, bool,
 533         private_tnc_ifmap2_soap_t *this, host_t *host)
 534 {
 535         tnc_ifmap2_soap_msg_t *soap_msg;
 536         xmlNodePtr request, update;
 537         bool success;
 538
 539         /* build publish update request */
 540         request = create_publish_request(this);
 541         update = xmlNewNode(NULL, "update");
 542         xmlAddChild(request, update);
 543
 544         /* add device, ip-address and metadata */
 545         xmlAddChild(update, create_device(this));
 546         xmlAddChild(update, create_ip_address(this, host));
 547         xmlAddChild(update, create_metadata(this, "device-ip"));
 548
 549         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 550         success = soap_msg->post(soap_msg, request, "publishReceived", NULL);
 551         soap_msg->destroy(soap_msg);
 552
 553         return success;
 554 }
 555
 556 METHOD(tnc_ifmap2_soap_t, publish_enforcement_report, bool,
 557         private_tnc_ifmap2_soap_t *this, host_t *host, char *action, char *reason)
 558 {
 559         tnc_ifmap2_soap_msg_t *soap_msg;
 560         xmlNodePtr request, update;
 561         bool success;
 562
 563         /* build publish update request */
 564         request = create_publish_request(this);
 565         update = xmlNewNode(NULL, "update");
 566         xmlAddChild(request, update);
 567
 568         /* add ip-address and metadata */
 569         xmlAddChild(update, create_ip_address(this, host));
 570         xmlAddChild(update, create_device(this));
 571         xmlAddChild(update, create_enforcement_report(this, action, reason));
 572
 573         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 574         success = soap_msg->post(soap_msg, request, "publishReceived", NULL);
 575         soap_msg->destroy(soap_msg);
 576
 577         return success;
 578 }
 579
 580 METHOD(tnc_ifmap2_soap_t, endSession, bool,
 581         private_tnc_ifmap2_soap_t *this)
 582 {
 583         tnc_ifmap2_soap_msg_t *soap_msg;
 584         xmlNodePtr request;
 585         bool success;
 586
 587         /* build endSession request */
 588         request = xmlNewNode(NULL, "endSession");
 589         this->ns = xmlNewNs(request, IFMAP_NS, "ifmap");
 590         xmlSetNs(request, this->ns);
 591         xmlNewProp(request, "session-id", this->session_id);
 592
 593         soap_msg = tnc_ifmap2_soap_msg_create(this->uri, this->user_pass, this->tls);
 594         success = soap_msg->post(soap_msg, request, "endSessionResult", NULL);
 595         soap_msg->destroy(soap_msg);
 596
 597         return success;
 598 }
 599
 600 METHOD(tnc_ifmap2_soap_t, destroy, void,
 601         private_tnc_ifmap2_soap_t *this)
 602 {
 603         if (this->session_id)
 604         {
 605                 endSession(this);
 606                 xmlFree(this->session_id);
 607                 xmlFree(this->ifmap_publisher_id);
 608                 free(this->device_name);
 609         }
 610         DESTROY_IF(this->tls);
 611         DESTROY_IF(this->host);
 612
 613         if (this->fd != IFMAP_NO_FD)
 614         {
 615                 close(this->fd);
 616         }
 617         lib->credmgr->remove_set(lib->credmgr, &this->creds->set);
 618         this->creds->destroy(this->creds);
 619         free(this->user_pass.ptr);
 620         free(this);
 621 }
 622
 623 static bool soap_init(private_tnc_ifmap2_soap_t *this)
 624 {
 625         char *server_uri, *server_str, *port_str, *uri_str;
 626         char *server_cert, *client_cert, *client_key, *user_pass;
 627         int port;
 628         certificate_t *cert;
 629         private_key_t *key;
 630         identification_t *server_id, *client_id = NULL;
 631
 632         /* getting configuration parameters from strongswan.conf */
 633         server_uri =  lib->settings->get_str(lib->settings,
 634                                         "%s.plugins.tnc-ifmap2.server_uri", IFMAP_URI, charon->name);
 635         server_cert = lib->settings->get_str(lib->settings,
 636                                         "%s.plugins.tnc-ifmap2.server_cert", NULL, charon->name);
 637         client_cert = lib->settings->get_str(lib->settings,
 638                                         "%s.plugins.tnc-ifmap2.client_cert", NULL, charon->name);
 639         client_key =  lib->settings->get_str(lib->settings,
 640                                         "%s.plugins.tnc-ifmap2.client_key", NULL, charon->name);
 641         user_pass =   lib->settings->get_str(lib->settings,
 642                                         "%s.plugins.tnc-ifmap2.username_password", NULL, charon->name);
 643
 644         /* load [self-signed] MAP server certificate */
 645         if (!server_cert)
 646         {
 647                 DBG1(DBG_TNC, "MAP server certificate not defined");
 648                 return FALSE;
 649         }
 650         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 651                                                           BUILD_FROM_FILE, server_cert, BUILD_END);
 652         if (!cert)
 653         {
 654                 DBG1(DBG_TNC, "loading MAP server certificate from '%s' failed",
 655                                            server_cert);
 656                 return FALSE;
 657         }
 658         DBG1(DBG_TNC, "loaded MAP server certificate from '%s'", server_cert);
 659         server_id = cert->get_subject(cert);
 660         this->creds->add_cert(this->creds, TRUE, cert);
 661
 662         /* check availability of client credentials */
 663         if (!((client_cert && client_key) || user_pass))
 664         {
 665                 DBG1(DBG_TNC, "neither MAP client certificate and private key "
 666                                           "nor username:password defined");
 667                 return FALSE;
 668         }
 669
 670         if (client_cert)
 671         {
 672                 /* load MAP client certificate */
 673                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 674                                                                   BUILD_FROM_FILE, client_cert, BUILD_END);
 675                 if (!cert)
 676                 {
 677                         DBG1(DBG_TNC, "loading MAP client certificate from '%s' failed",
 678                                                    client_cert);
 679                         return FALSE;
 680                 }
 681                 DBG1(DBG_TNC, "loaded MAP client certificate from '%s'", client_cert);
 682                 this->creds->add_cert(this->creds, TRUE, cert);
 683
 684                 /* load MAP client private key */
 685                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 686                                                                   BUILD_FROM_FILE, client_key, BUILD_END);
 687                 if (!key)
 688                 {
 689                         DBG1(DBG_TNC, "loading MAP client private key from '%s' failed",
 690                                                    client_key);
 691                         return FALSE;
 692                 }
 693                 DBG1(DBG_TNC, "loaded MAP client RSA private key from '%s'", client_key);
 694                 this->creds->add_key(this->creds, key);
 695
 696                 /* set client ID to certificate distinguished name */
 697                 client_id = cert->get_subject(cert);
 698         }
 699         else
 700         {
 701                 /* set base64-encoded username:password for HTTP Basic Authentication */
 702                 this->user_pass = chunk_to_base64(chunk_from_str(user_pass), NULL);
 703         }
 704
 705         /* remove HTTPS prefix if any */
 706         if (strlen(server_uri) >= 8 && strncaseeq(server_uri, "https://", 8))
 707         {
 708                 server_uri += 8;
 709         }
 710         this->uri = server_uri;
 711
 712         /* duplicate server string since we are going to manipulate it */
 713         server_str = strdup(server_uri);
 714
 715         /* extract server name and port from server URI */
 716         port_str = strchr(server_str, ':');
 717         if (port_str)
 718         {
 719                 *port_str++ = '\0';
 720                 if (sscanf(port_str, "%d", &port) != 1)
 721                 {
 722                         DBG1(DBG_TNC, "parsing server port %s failed", port_str);
 723                         free(server_str);
 724                         return FALSE;
 725                 }
 726         }
 727         else
 728         {
 729                 /* use default https port */
 730                 port = 443;
 731                 uri_str = strchr(server_str, '/');
 732                 if (uri_str)
 733                 {
 734                         *uri_str = '\0';
 735                 }
 736         }
 737
 738         /* open TCP socket and connect to MAP server */
 739         this->host = host_create_from_dns(server_str, 0, port);
 740         if (!this->host)
 741         {
 742                 DBG1(DBG_TNC, "resolving hostname %s failed", server_str);
 743                 free(server_str);
 744                 return FALSE;
 745         }
 746         free(server_str);
 747
 748         this->fd = socket(this->host->get_family(this->host), SOCK_STREAM, 0);
 749         if (this->fd == IFMAP_NO_FD)
 750         {
 751                 DBG1(DBG_TNC, "opening socket failed: %s", strerror(errno));
 752                 return FALSE;
 753         }
 754
 755         if (connect(this->fd, this->host->get_sockaddr(this->host),
 756                                                  *this->host->get_sockaddr_len(this->host)) == -1)
 757         {
 758                 DBG1(DBG_TNC, "connecting to %#H failed: %s",
 759                                            this->host, strerror(errno));
 760                 return FALSE;
 761         }
 762
 763         /* open TLS socket */
 764         this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, NULL);
 765         if (!this->tls)
 766         {
 767                 DBG1(DBG_TNC, "creating TLS socket failed");
 768                 return FALSE;
 769         }
 770
 771         return TRUE;
 772 }
 773
 774 /**
 775  * See header
 776  */
 777 tnc_ifmap2_soap_t *tnc_ifmap2_soap_create()
 778 {
 779         private_tnc_ifmap2_soap_t *this;
 780
 781         INIT(this,
 782                 .public = {
 783                         .newSession = _newSession,
 784                         .purgePublisher = _purgePublisher,
 785                         .publish_ike_sa = _publish_ike_sa,
 786                         .publish_device_ip = _publish_device_ip,
 787                         .publish_enforcement_report = _publish_enforcement_report,
 788                         .endSession = _endSession,
 789                         .destroy = _destroy,
 790                 },
 791                 .fd = IFMAP_NO_FD,
 792                 .creds = mem_cred_create(),
 793         );
 794
 795         lib->credmgr->add_set(lib->credmgr, &this->creds->set);
 796
 797         if (!soap_init(this))
 798         {
 799                 destroy(this);
 800                 return NULL;
 801         }
 802
 803         return &this->public;
 804 }
 805