From 1fa33a06315165ef26c9675db8e432637f6cc071 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 24 Jul 2026 15:33:35 +0200 Subject: [PATCH] tnc-ifmap: Remove prototypical IF-MAP plugin This was primarily used in our labs to visualize some TNC aspects but the third-party daemon and frontend we used have not seen any development in a decade. There never was any industry interest in this protocol anyway, so just remove it. --- conf/Makefile.am | 1 - conf/plugins/tnc-ifmap.opt | 21 - configure.ac | 6 +- src/libcharon/Makefile.am | 7 - src/libcharon/plugins/tnc_ifmap/Makefile.am | 27 - .../plugins/tnc_ifmap/tnc_ifmap_http.c | 246 ----- .../plugins/tnc_ifmap/tnc_ifmap_http.h | 69 -- .../plugins/tnc_ifmap/tnc_ifmap_listener.c | 203 ---- .../plugins/tnc_ifmap/tnc_ifmap_listener.h | 52 - .../plugins/tnc_ifmap/tnc_ifmap_plugin.c | 131 --- .../plugins/tnc_ifmap/tnc_ifmap_plugin.h | 43 - .../tnc_ifmap/tnc_ifmap_renew_session_job.c | 101 -- .../tnc_ifmap/tnc_ifmap_renew_session_job.h | 52 - .../plugins/tnc_ifmap/tnc_ifmap_soap.c | 927 ------------------ .../plugins/tnc_ifmap/tnc_ifmap_soap.h | 134 --- .../plugins/tnc_ifmap/tnc_ifmap_soap_msg.c | 258 ----- .../plugins/tnc_ifmap/tnc_ifmap_soap_msg.h | 63 -- testing/scripts/recipes/013_strongswan.mk | 1 - 18 files changed, 1 insertion(+), 2341 deletions(-) delete mode 100644 conf/plugins/tnc-ifmap.opt delete mode 100644 src/libcharon/plugins/tnc_ifmap/Makefile.am delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.h delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.h delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.h delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.h delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.h delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.c delete mode 100644 src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.h diff --git a/conf/Makefile.am b/conf/Makefile.am index 387e94423..8766b0ecc 100644 --- a/conf/Makefile.am +++ b/conf/Makefile.am @@ -89,7 +89,6 @@ plugins = \ plugins/sql.opt \ plugins/stroke.opt \ plugins/systime-fix.opt \ - plugins/tnc-ifmap.opt \ plugins/tnc-imc.opt \ plugins/tnc-imv.opt \ plugins/tnc-pdp.opt \ diff --git a/conf/plugins/tnc-ifmap.opt b/conf/plugins/tnc-ifmap.opt deleted file mode 100644 index 155c30697..000000000 --- a/conf/plugins/tnc-ifmap.opt +++ /dev/null @@ -1,21 +0,0 @@ -charon.plugins.tnc-ifmap.client_cert = - Path to X.509 certificate file of IF-MAP client. - -charon.plugins.tnc-ifmap.client_key = - Path to private key file of IF-MAP client. - -charon.plugins.tnc-ifmap.device_name = - Unique name of strongSwan server as a PEP and/or PDP device. - -charon.plugins.tnc-ifmap.renew_session_interval = 150 - Interval in seconds between periodic IF-MAP RenewSession requests. - -charon.plugins.tnc-ifmap.server_uri = https://localhost:8444/imap - URI of the form [https://]servername[:port][/path]. - -charon.plugins.tnc-ifmap.server_cert = - Path to X.509 certificate file of IF-MAP server. - -charon.plugins.tnc-ifmap.username_password = - Credentials of IF-MAP client of the form username:password. If set, make - sure to adjust the permissions of the config file accordingly. diff --git a/configure.ac b/configure.ac index bf5a5fee9..ab46f476a 100644 --- a/configure.ac +++ b/configure.ac @@ -249,7 +249,6 @@ ARG_ENABL_SET([imc-swima], [enable IMC swima module.]) ARG_ENABL_SET([imv-swima], [enable IMV swima module.]) ARG_ENABL_SET([imc-hcd], [enable IMC hcd module.]) ARG_ENABL_SET([imv-hcd], [enable IMV hcd module.]) -ARG_ENABL_SET([tnc-ifmap], [enable TNC IF-MAP module. Requires libxml]) ARG_ENABL_SET([tnc-imc], [enable TNC IMC module.]) ARG_ENABL_SET([tnc-imv], [enable TNC IMV module.]) ARG_ENABL_SET([tnc-pdp], [enable TNC policy decision point module.]) @@ -457,7 +456,7 @@ if test x$swanctl = xtrue; then vici=true fi -if test x$tnccs_11 = xtrue -o x$tnc_ifmap = xtrue; then +if test x$tnccs_11 = xtrue; then xml=true fi @@ -1564,7 +1563,6 @@ ADD_PLUGIN([xauth-generic], [c charon cmd]) ADD_PLUGIN([xauth-eap], [c charon]) ADD_PLUGIN([xauth-pam], [c charon]) ADD_PLUGIN([xauth-noauth], [c charon]) -ADD_PLUGIN([tnc-ifmap], [c charon]) ADD_PLUGIN([tnc-pdp], [c charon]) ADD_PLUGIN([tnc-imc], [t charon]) ADD_PLUGIN([tnc-imv], [t charon]) @@ -1718,7 +1716,6 @@ AM_CONDITIONAL(USE_XAUTH_GENERIC, test x$xauth_generic = xtrue) AM_CONDITIONAL(USE_XAUTH_EAP, test x$xauth_eap = xtrue) AM_CONDITIONAL(USE_XAUTH_PAM, test x$xauth_pam = xtrue) AM_CONDITIONAL(USE_XAUTH_NOAUTH, test x$xauth_noauth = xtrue) -AM_CONDITIONAL(USE_TNC_IFMAP, test x$tnc_ifmap = xtrue) AM_CONDITIONAL(USE_TNC_PDP, test x$tnc_pdp = xtrue) AM_CONDITIONAL(USE_TNC_IMC, test x$tnc_imc = xtrue) AM_CONDITIONAL(USE_TNC_IMV, test x$tnc_imv = xtrue) @@ -2006,7 +2003,6 @@ AC_CONFIG_FILES([ src/libcharon/plugins/xauth_eap/Makefile src/libcharon/plugins/xauth_pam/Makefile src/libcharon/plugins/xauth_noauth/Makefile - src/libcharon/plugins/tnc_ifmap/Makefile src/libcharon/plugins/tnc_pdp/Makefile src/libcharon/plugins/save_keys/Makefile src/libcharon/plugins/socket_default/Makefile diff --git a/src/libcharon/Makefile.am b/src/libcharon/Makefile.am index 14accca68..020c39080 100644 --- a/src/libcharon/Makefile.am +++ b/src/libcharon/Makefile.am @@ -481,13 +481,6 @@ if MONOLITHIC endif endif -if USE_TNC_IFMAP - SUBDIRS += plugins/tnc_ifmap -if MONOLITHIC - libcharon_la_LIBADD += plugins/tnc_ifmap/libstrongswan-tnc-ifmap.la -endif -endif - if USE_TNC_PDP SUBDIRS += plugins/tnc_pdp if MONOLITHIC diff --git a/src/libcharon/plugins/tnc_ifmap/Makefile.am b/src/libcharon/plugins/tnc_ifmap/Makefile.am deleted file mode 100644 index dab98129d..000000000 --- a/src/libcharon/plugins/tnc_ifmap/Makefile.am +++ /dev/null @@ -1,27 +0,0 @@ -AM_CPPFLAGS = \ - -I$(top_srcdir)/src/libstrongswan \ - -I$(top_srcdir)/src/libtls \ - -I$(top_srcdir)/src/libcharon - -AM_CFLAGS = \ - ${xml_CFLAGS} \ - $(PLUGIN_CFLAGS) - -if MONOLITHIC -noinst_LTLIBRARIES = libstrongswan-tnc-ifmap.la -else -plugin_LTLIBRARIES = libstrongswan-tnc-ifmap.la -endif - -libstrongswan_tnc_ifmap_la_LIBADD = \ - $(top_builddir)/src/libtls/libtls.la ${xml_LIBS} - -libstrongswan_tnc_ifmap_la_SOURCES = \ - tnc_ifmap_plugin.h tnc_ifmap_plugin.c \ - tnc_ifmap_listener.h tnc_ifmap_listener.c \ - tnc_ifmap_soap.h tnc_ifmap_soap.c \ - tnc_ifmap_soap_msg.h tnc_ifmap_soap_msg.c \ - tnc_ifmap_http.h tnc_ifmap_http.c \ - tnc_ifmap_renew_session_job.h tnc_ifmap_renew_session_job.c - -libstrongswan_tnc_ifmap_la_LDFLAGS = -module -avoid-version diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.c deleted file mode 100644 index 32065ea18..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.c +++ /dev/null @@ -1,246 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#define _GNU_SOURCE /* for asprintf() */ - -#include "tnc_ifmap_http.h" - -#include -#include - -#include - -typedef struct private_tnc_ifmap_http_t private_tnc_ifmap_http_t; - -/** - * Private data of an tnc_ifmap_http_t object. - */ -struct private_tnc_ifmap_http_t { - - /** - * Public tnc_ifmap_http_t interface. - */ - tnc_ifmap_http_t public; - - /** - * HTTPS Server URI with https:// prefix removed - */ - char *uri; - - /** - * Optional base64-encoded username:password for HTTP Basic Authentication - */ - chunk_t user_pass; - - /** - * HTTP chunked mode - */ - bool chunked; - -}; - -METHOD(tnc_ifmap_http_t, build, status_t, - private_tnc_ifmap_http_t *this, chunk_t *in, chunk_t *out) -{ - char *host, *path, *request, auth[128]; - int len; - - /* Duplicate host[/path] string since we are going to manipulate it */ - len = strlen(this->uri) + 2; - host = malloc(len); - memset(host, '\0', len); - strcpy(host, this->uri); - - /* Extract appended path or set to root */ - path = strchr(host, '/'); - if (!path) - { - path = host + len - 2; - *path = '/'; - } - - /* Use Basic Authentication? */ - if (this->user_pass.len) - { - snprintf(auth, sizeof(auth), "Authorization: Basic %.*s\r\n", - (int)this->user_pass.len, this->user_pass.ptr); - } - else - { - *auth = '\0'; - } - - /* Write HTTP POST request, TODO break up into chunks */ - len = asprintf(&request, - "POST %s HTTP/1.1\r\n" - "Host: %.*s\r\n" - "%s" - "Content-Type: application/soap+xml;charset=utf-8\r\n" - "Content-Length: %d\r\n" - "\r\n" - "%.*s", path, (int)(path-host), host, auth, (int)in->len, - (int)in->len, in->ptr); - free(host); - - if (len == -1) - { - return FAILED; - } - *out = chunk_create(request, len); - DBG3(DBG_TLS, "sending HTTP POST request %B", out); - - return SUCCESS; -} - -static bool process_header(chunk_t *in, bool *chunked, u_int *content_len) -{ - chunk_t line, version, parameter; - int code; - u_int len; - - /* Process HTTP protocol version */ - if (!fetchline(in, &line) || !extract_token(&version, ' ', &line) || - !match("HTTP/1.1", &version) || sscanf(line.ptr, "%d", &code) != 1) - { - DBG1(DBG_TNC, "malformed http response header"); - return FALSE; - } - if (code != 200) - { - DBG1(DBG_TNC, "http response returns error code %d", code); - return FALSE; - } - - *content_len = 0; - *chunked = FALSE; - - /* Process HTTP header line by line until the HTTP body is reached */ - while (fetchline(in, &line)) - { - if (line.len == 0) - { - break; - } - if (extract_token(¶meter, ':', &line) && eat_whitespace(&line)) - { - if (match("Content-Length", ¶meter)) - { - if (sscanf(line.ptr, "%u", &len) == 1) - { - *content_len = len; - } - } - else if (match("Transfer-Encoding", ¶meter) && - match("chunked", &line)) - { - *chunked = TRUE; - } - } - } - - return TRUE; -} - -METHOD(tnc_ifmap_http_t, process, status_t, - private_tnc_ifmap_http_t *this, chunk_t *in, chunk_t *out) -{ - u_int len = 0; - chunk_t line, out_chunk; - - DBG3(DBG_TLS, "receiving HTTP response %B", in); - - if (!this->chunked) - { - if (!process_header(in, &this->chunked, &len)) - { - return FAILED; - } - } - - while (in->len) - { - if (this->chunked) - { - if (!fetchline(in, &line) || sscanf(line.ptr, "%x", &len) != 1) - { - return FAILED; - } - DBG3(DBG_TLS, "received HTTP response is chunked (%u bytes)", len); - - /* Received last chunk? */ - if (len == 0) - { - return SUCCESS; - } - } - - /* Check size of of remaining HTTP body */ - if (len > in->len) - { - DBG1(DBG_TNC, "insufficient data in HTTP body"); - return FAILED; - } - - if (this->chunked) - { - out_chunk = *in; - out_chunk.len = len; - *out = chunk_cat("mc", *out, out_chunk); - *in = chunk_skip(*in, len); - if (!fetchline(in, &line) || line.len > 0) - { - return FAILED; - } - } - else - { - if (len) - { - in->len = len; - } - *out = chunk_clone(*in); - return SUCCESS; - } - } - return NEED_MORE; -} - -METHOD(tnc_ifmap_http_t, destroy, void, - private_tnc_ifmap_http_t *this) -{ - free(this); -} - -/** - * See header - */ -tnc_ifmap_http_t *tnc_ifmap_http_create(char *uri, chunk_t user_pass) -{ - private_tnc_ifmap_http_t *this; - - INIT(this, - .public = { - .build = _build, - .process = _process, - .destroy = _destroy, - }, - .uri = uri, - .user_pass = user_pass, - ); - - return &this->public; -} - diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.h deleted file mode 100644 index 21d1a9496..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_http.h +++ /dev/null @@ -1,69 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap_http tnc_ifmap_http - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_HTTP_H_ -#define TNC_IFMAP_HTTP_H_ - -#include -#include - -#include - -typedef struct tnc_ifmap_http_t tnc_ifmap_http_t; - -/** - * Interface for building and processing HTTP messages - */ -struct tnc_ifmap_http_t { - - /** - * Build a HTTP POST message - * - * @param in input data - * @param out HTTP POST request - * @result status return code - */ - status_t (*build)(tnc_ifmap_http_t *this, chunk_t *in, chunk_t *out); - - /** - * Receive a HTTP [chunked] response - * - * @param in [chunked] HTTP response - * @param out output data - * @result status return code - */ - status_t (*process)(tnc_ifmap_http_t *this, chunk_t *in, chunk_t *out); - - /** - * Destroy a tnc_ifmap_http_t object. - */ - void (*destroy)(tnc_ifmap_http_t *this); -}; - -/** - * Create a tnc_ifmap_http instance. - * - * @param uri HTTPS URI with https:// prefix removed - * @param user_pass Optional username:password for HTTP Basic Authentication - */ -tnc_ifmap_http_t *tnc_ifmap_http_create(char *uri, chunk_t user_pass); - -#endif /** TNC_IFMAP_HTTP_H_ @}*/ diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c deleted file mode 100644 index acc5faa49..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c +++ /dev/null @@ -1,203 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnc_ifmap_listener.h" -#include "tnc_ifmap_soap.h" -#include "tnc_ifmap_renew_session_job.h" - -#include -#include - -#define IFMAP_RENEW_SESSION_INTERVAL 150 - -typedef struct private_tnc_ifmap_listener_t private_tnc_ifmap_listener_t; - -/** - * Private data of an tnc_ifmap_listener_t object. - */ -struct private_tnc_ifmap_listener_t { - - /** - * Public tnc_ifmap_listener_t interface. - */ - tnc_ifmap_listener_t public; - - /** - * TNC IF-MAP 2.0 SOAP interface - */ - tnc_ifmap_soap_t *ifmap; - -}; - -/** - * Publish PEP device-ip metadata - */ -static bool publish_device_ip_addresses(private_tnc_ifmap_listener_t *this) -{ - enumerator_t *enumerator; - host_t *host; - bool success = TRUE; - - enumerator = charon->kernel->create_address_enumerator(charon->kernel, - ADDR_TYPE_REGULAR); - while (enumerator->enumerate(enumerator, &host)) - { - if (!this->ifmap->publish_device_ip(this->ifmap, host)) - { - success = FALSE; - break; - } - } - enumerator->destroy(enumerator); - - return success; -} - -/** - * Publish all IKE_SA metadata - */ -static bool reload_metadata(private_tnc_ifmap_listener_t *this) -{ - ike_sa_t *ike_sa; - enumerator_t *enumerator; - bool success = TRUE; - - enumerator = charon->controller->create_ike_sa_enumerator( - charon->controller, FALSE); - while (enumerator->enumerate(enumerator, &ike_sa)) - { - if (ike_sa->get_state(ike_sa) != IKE_ESTABLISHED) - { - continue; - } - if (!this->ifmap->publish_ike_sa(this->ifmap, ike_sa, TRUE) || - !this->ifmap->publish_virtual_ips(this->ifmap, ike_sa, TRUE)) - { - success = FALSE; - break; - } - } - enumerator->destroy(enumerator); - - return success; -} - -METHOD(listener_t, ike_updown, bool, - private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, bool up) -{ - if (ike_sa->get_state(ike_sa) != IKE_CONNECTING) - { - this->ifmap->publish_ike_sa(this->ifmap, ike_sa, up); - } - return TRUE; -} - -METHOD(listener_t, assign_vips, bool, - private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, bool assign) -{ - this->ifmap->publish_virtual_ips(this->ifmap, ike_sa, assign); - return TRUE; -} - -METHOD(listener_t, alert, bool, - private_tnc_ifmap_listener_t *this, ike_sa_t *ike_sa, alert_t alert, - va_list args) -{ - if (alert == ALERT_PEER_AUTH_FAILED) - { - this->ifmap->publish_enforcement_report(this->ifmap, - ike_sa->get_other_host(ike_sa), - "block", "authentication failed"); - } - return TRUE; -} - -METHOD(tnc_ifmap_listener_t, destroy, void, - private_tnc_ifmap_listener_t *this) -{ - if (this->ifmap) - { - if (this->ifmap->get_session_id(this->ifmap)) - { - this->ifmap->endSession(this->ifmap); - } - this->ifmap->destroy(this->ifmap); - } - free(this); -} - -/** - * See header - */ -tnc_ifmap_listener_t *tnc_ifmap_listener_create(bool reload) -{ - private_tnc_ifmap_listener_t *this; - job_t *job; - uint32_t reschedule; - - INIT(this, - .public = { - .listener = { - .ike_updown = _ike_updown, - .assign_vips = _assign_vips, - .alert = _alert, - }, - .destroy = _destroy, - }, - .ifmap = tnc_ifmap_soap_create(), - ); - - if (!this->ifmap) - { - destroy(this); - return NULL; - } - if (!this->ifmap->newSession(this->ifmap)) - { - destroy(this); - return NULL; - } - if (!this->ifmap->purgePublisher(this->ifmap)) - { - destroy(this); - return NULL; - } - if (!publish_device_ip_addresses(this)) - { - destroy(this); - return NULL; - } - if (reload) - { - if (!reload_metadata(this)) - { - destroy(this); - return NULL; - } - } - - /* schedule periodic transmission of IF-MAP renewSession request */ - reschedule = lib->settings->get_int(lib->settings, - "%s.plugins.tnc-ifmap.renew_session_interval", - IFMAP_RENEW_SESSION_INTERVAL, lib->ns); - - job = (job_t*)tnc_ifmap_renew_session_job_create( - this->ifmap->get_ref(this->ifmap), reschedule); - lib->scheduler->schedule_job(lib->scheduler, job, reschedule); - - return &this->public; -} - diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.h deleted file mode 100644 index c279b0006..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.h +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap_listener tnc_ifmap_listener - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_LISTENER_H_ -#define TNC_IFMAP_LISTENER_H_ - -#include - -typedef struct tnc_ifmap_listener_t tnc_ifmap_listener_t; - -/** - * Listener which collects information on IKE_SAs - */ -struct tnc_ifmap_listener_t { - - /** - * Implements listener_t. - */ - listener_t listener; - - /** - * Destroy a tnc_ifmap_listener_t. - */ - void (*destroy)(tnc_ifmap_listener_t *this); -}; - -/** - * Create a tnc_ifmap_listener instance. - * - * @param reload reload all IKE_SA metadata - */ -tnc_ifmap_listener_t *tnc_ifmap_listener_create(bool reload); - -#endif /** TNC_IFMAP_LISTENER_H_ @}*/ diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.c deleted file mode 100644 index af97ccc05..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.c +++ /dev/null @@ -1,131 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnc_ifmap_plugin.h" -#include "tnc_ifmap_listener.h" - -#include - -typedef struct private_tnc_ifmap_plugin_t private_tnc_ifmap_plugin_t; - -/** - * private data of tnc_ifmap plugin - */ -struct private_tnc_ifmap_plugin_t { - - /** - * implements plugin interface - */ - tnc_ifmap_plugin_t public; - - /** - * Listener interface, listens to CHILD_SA state changes - */ - tnc_ifmap_listener_t *listener; -}; - -METHOD(plugin_t, get_name, char*, - private_tnc_ifmap_plugin_t *this) -{ - return "tnc-ifmap"; -} - -/** - * Register tnc_ifmap plugin features - */ -static bool register_tnc_ifmap(private_tnc_ifmap_plugin_t *this, - plugin_feature_t *feature, bool reg, void *data) -{ - if (reg) - { - this->listener = tnc_ifmap_listener_create(FALSE); - if (!this->listener) - { - return FALSE; - } - charon->bus->add_listener(charon->bus, &this->listener->listener); - } - else - { - if (this->listener) - { - charon->bus->remove_listener(charon->bus, &this->listener->listener); - this->listener->destroy(this->listener); - } - } - return TRUE; -} - -METHOD(plugin_t, get_features, int, - tnc_ifmap_plugin_t *this, plugin_feature_t *features[]) -{ - static plugin_feature_t f[] = { - PLUGIN_CALLBACK((plugin_feature_callback_t)register_tnc_ifmap, NULL), - PLUGIN_PROVIDE(CUSTOM, "tnc-ifmap-2.1"), - PLUGIN_SDEPEND(CERT_DECODE, CERT_X509), - PLUGIN_SDEPEND(PRIVKEY, KEY_RSA), - PLUGIN_SDEPEND(CUSTOM, "stroke"), - }; - *features = f; - return countof(f); -} - -METHOD(plugin_t, reload, bool, - private_tnc_ifmap_plugin_t *this) -{ - if (this->listener) - { - charon->bus->remove_listener(charon->bus, &this->listener->listener); - this->listener->destroy(this->listener); - } - - this->listener = tnc_ifmap_listener_create(TRUE); - if (!this->listener) - { - return FALSE; - } - charon->bus->add_listener(charon->bus, &this->listener->listener); - - return TRUE; -} - -METHOD(plugin_t, destroy, void, - private_tnc_ifmap_plugin_t *this) -{ - free(this); -} - -/* - * see header file - */ -PLUGIN_DEFINE(tnc_ifmap) -{ - private_tnc_ifmap_plugin_t *this; - - INIT(this, - .public = { - .plugin = { - .get_name = _get_name, - .get_features = _get_features, - .reload = _reload, - .destroy = _destroy, - }, - }, - ); - - return &this->public.plugin; -} - diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.h deleted file mode 100644 index 694d3b0f8..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.h +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap tnc_ifmap - * @ingroup cplugins - * - * @defgroup tnc_ifmap_plugin tnc_ifmap_plugin - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_PLUGIN_H_ -#define TNC_IFMAP_PLUGIN_H_ - -#include - -typedef struct tnc_ifmap_plugin_t tnc_ifmap_plugin_t; - -/** - * TNC IF-MAP plugin - */ -struct tnc_ifmap_plugin_t { - - /** - * implements plugin interface - */ - plugin_t plugin; -}; - -#endif /** TNC_IFMAP_PLUGIN_H_ @}*/ diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.c deleted file mode 100644 index 8e2fbd13c..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.c +++ /dev/null @@ -1,101 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include - -#include "tnc_ifmap_renew_session_job.h" - -#include - - -typedef struct private_tnc_ifmap_renew_session_job_t private_tnc_ifmap_renew_session_job_t; - -/** - * Private data - */ -struct private_tnc_ifmap_renew_session_job_t { - - /** - * public tnc_ifmap_renew_session_job_t interface - */ - tnc_ifmap_renew_session_job_t public; - - /** - * TNC IF-MAP 2.0 SOAP interface - */ - tnc_ifmap_soap_t *ifmap; - - /** - * Reschedule time interval in seconds - */ - uint32_t reschedule; -}; - -METHOD(job_t, destroy, void, - private_tnc_ifmap_renew_session_job_t *this) -{ - this->ifmap->destroy(this->ifmap); - free(this); -} - -METHOD(job_t, execute, job_requeue_t, - private_tnc_ifmap_renew_session_job_t *this) -{ - if (this->ifmap->orphaned(this->ifmap)) - { - DBG2(DBG_TNC, "removing orphaned ifmap renewSession job for '%s'", - this->ifmap->get_session_id(this->ifmap)); - return JOB_REQUEUE_NONE; - } - else - { - if (!this->ifmap->renewSession(this->ifmap)) - { - DBG1(DBG_TNC, "sending ifmap renewSession failed"); - /* TODO take some action */ - } - return JOB_RESCHEDULE(this->reschedule); - } -} - -METHOD(job_t, get_priority, job_priority_t, - private_tnc_ifmap_renew_session_job_t *this) -{ - return JOB_PRIO_MEDIUM; -} - -/* - * Described in header - */ -tnc_ifmap_renew_session_job_t *tnc_ifmap_renew_session_job_create( - tnc_ifmap_soap_t *ifmap, uint32_t reschedule) -{ - private_tnc_ifmap_renew_session_job_t *this; - - INIT(this, - .public = { - .job_interface = { - .execute = _execute, - .get_priority = _get_priority, - .destroy = _destroy, - }, - }, - .ifmap = ifmap, - .reschedule = reschedule, - ); - - return &this->public; -} diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.h deleted file mode 100644 index 501706b1e..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_renew_session_job.h +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap_renew_session_job tnc_ifmap_renew_session_job - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_RENEW_SESSION_JOB_H_ -#define TNC_IFMAP_RENEW_SESSION_JOB_H_ - -typedef struct tnc_ifmap_renew_session_job_t tnc_ifmap_renew_session_job_t; - -#include "tnc_ifmap_soap.h" - -#include -#include - -/** - * Job periodically sending an IF-MAP RenewSession request. - */ -struct tnc_ifmap_renew_session_job_t { - - /** - * implements job_t interface - */ - job_t job_interface; -}; - -/** - * Creates an tnc_ifmap_renew_session job. - * - * @param ifmap TNC IF-MAP object - * @param reschedule reschedule time in seconds - */ -tnc_ifmap_renew_session_job_t *tnc_ifmap_renew_session_job_create( - tnc_ifmap_soap_t *ifmap, uint32_t reschedule); - -#endif /** TNC_IFMAP_RENEW_SESSION_JOB_H_ @}*/ diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c deleted file mode 100644 index a8b226ac4..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c +++ /dev/null @@ -1,927 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnc_ifmap_soap.h" -#include "tnc_ifmap_soap_msg.h" - -#include -#include -#include - -#include - -#include -#include -#include -#include - -#define IFMAP_NS "http://www.trustedcomputinggroup.org/2010/IFMAP/2" -#define IFMAP_META_NS "http://www.trustedcomputinggroup.org/2010/IFMAP-METADATA/2" -#define IFMAP_URI "https://localhost:8444/imap" -#define IFMAP_NO_FD -1 - -typedef struct private_tnc_ifmap_soap_t private_tnc_ifmap_soap_t; - -/** - * Private data of an tnc_ifmap_soap_t object. - */ -struct private_tnc_ifmap_soap_t { - - /** - * Public tnc_ifmap_soap_t interface. - */ - tnc_ifmap_soap_t public; - - /** - * SOAP Session ID - */ - xmlChar *session_id; - - /** - * IF-MAP Publisher ID - */ - xmlChar *ifmap_publisher_id; - - /** - * IF-MAP namespace - */ - xmlNsPtr ns; - - /** - * IF-MAP metadata namespace - */ - xmlNsPtr ns_meta; - - /** - * PEP and PDP device name - */ - char *device_name; - - /** - * HTTPS Server URI with https:// prefix removed - */ - char *uri; - - /** - * Optional base64-encoded username:password for HTTP Basic Authentication - */ - chunk_t user_pass; - - /** - * IF-MAP Server (IP address and port) - */ - host_t *host; - - /** - * TLS socket - */ - tls_socket_t *tls; - - /** - * File descriptor for secure TCP socket - */ - int fd; - - /** - * In memory credential set - */ - mem_cred_t *creds; - - /** - * reference count - */ - refcount_t ref; - -}; - -METHOD(tnc_ifmap_soap_t, newSession, bool, - private_tnc_ifmap_soap_t *this) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request, result; - - /*build newSession request */ - request = xmlNewNode(NULL, "newSession"); - this->ns = xmlNewNs(request, IFMAP_NS, "ifmap"); - xmlSetNs(request, this->ns); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - if (!soap_msg->post(soap_msg, request, "newSessionResult", &result)) - { - soap_msg->destroy(soap_msg); - return FALSE; - } - - /* get session-id and ifmap-publisher-id properties */ - this->session_id = xmlGetProp(result, "session-id"); - this->ifmap_publisher_id = xmlGetProp(result, "ifmap-publisher-id"); - soap_msg->destroy(soap_msg); - - DBG1(DBG_TNC, "created ifmap session '%s' as publisher '%s'", - this->session_id, this->ifmap_publisher_id); - - /* set PEP and PDP device name (defaults to IF-MAP Publisher ID) */ - this->device_name = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.device_name", - this->ifmap_publisher_id, lib->ns); - this->device_name = strdup(this->device_name); - - return this->session_id && this->ifmap_publisher_id; -} - -METHOD(tnc_ifmap_soap_t, renewSession, bool, - private_tnc_ifmap_soap_t *this) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request; - bool success; - - /* build renewSession request */ - request = xmlNewNode(NULL, "renewSession"); - this->ns = xmlNewNs(request, IFMAP_NS, "ifmap"); - xmlSetNs(request, this->ns); - xmlNewProp(request, "session-id", this->session_id); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "renewSessionResult", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -METHOD(tnc_ifmap_soap_t, purgePublisher, bool, - private_tnc_ifmap_soap_t *this) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request; - bool success; - - /* build purgePublisher request */ - request = xmlNewNode(NULL, "purgePublisher"); - this->ns = xmlNewNs(request, IFMAP_NS, "ifmap"); - xmlSetNs(request, this->ns); - xmlNewProp(request, "session-id", this->session_id); - xmlNewProp(request, "ifmap-publisher-id", this->ifmap_publisher_id); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "purgePublisherReceived", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -/** - * Create an access-request based on device_name and ike_sa_id - */ -static xmlNodePtr create_access_request(private_tnc_ifmap_soap_t *this, - uint32_t id) -{ - xmlNodePtr node; - char buf[BUF_LEN]; - - node = xmlNewNode(NULL, "access-request"); - - snprintf(buf, BUF_LEN, "%s:%d", this->device_name, id); - xmlNewProp(node, "name", buf); - - return node; -} - -/** - * Create an identity - */ -static xmlNodePtr create_identity(private_tnc_ifmap_soap_t *this, - identification_t *id, bool is_user) -{ - xmlNodePtr node; - char buf[BUF_LEN], *id_type; - - node = xmlNewNode(NULL, "identity"); - - snprintf(buf, BUF_LEN, "%Y", id); - xmlNewProp(node, "name", buf); - - switch (id->get_type(id)) - { - case ID_IPV4_ADDR: - id_type = "other"; - xmlNewProp(node, "other-type-definition", "36906:ipv4-address"); - break; - case ID_FQDN: - id_type = is_user ? "username" : "dns-name"; - break; - case ID_RFC822_ADDR: - id_type = "email-address"; - break; - case ID_IPV6_ADDR: - id_type = "other"; - xmlNewProp(node, "other-type-definition", "36906:ipv6-address"); - break; - case ID_DER_ASN1_DN: - id_type = "distinguished-name"; - break; - case ID_KEY_ID: - id_type = "other"; - xmlNewProp(node, "other-type-definition", "36906:key-id"); - break; - default: - id_type = "other"; - xmlNewProp(node, "other-type-definition", "36906:other"); - } - xmlNewProp(node, "type", id_type); - - return node; -} - -/** - * Create enforcement-report metadata - */ -static xmlNodePtr create_enforcement_report(private_tnc_ifmap_soap_t *this, - xmlChar *action, xmlChar *reason) -{ - xmlNodePtr node, node2, node3; - - node = xmlNewNode(NULL, "metadata"); - node2 = xmlNewNode(this->ns_meta, "enforcement-report"); - xmlAddChild(node, node2); - xmlNewProp(node2, "ifmap-cardinality", "multiValue"); - - node3 = xmlNewNode(NULL, "enforcement-action"); - xmlAddChild(node2, node3); - xmlNodeAddContent(node3, action); - - node3 = xmlNewNode(NULL, "enforcement-reason"); - xmlAddChild(node2, node3); - xmlNodeAddContent(node3, reason); - - return node; -} - -/** - * Create delete filter - */ -static xmlNodePtr create_delete_filter(private_tnc_ifmap_soap_t *this, - char *metadata) -{ - xmlNodePtr node; - char buf[BUF_LEN]; - - node = xmlNewNode(NULL, "delete"); - - snprintf(buf, BUF_LEN, "meta:%s[@ifmap-publisher-id='%s']", - metadata, this->ifmap_publisher_id); - xmlNewProp(node, "filter", buf); - - return node; -} - -/** - * Create a publish request - */ -static xmlNodePtr create_publish_request(private_tnc_ifmap_soap_t *this) -{ - xmlNodePtr request; - - request = xmlNewNode(NULL, "publish"); - this->ns = xmlNewNs(request, IFMAP_NS, "ifmap"); - xmlSetNs(request, this->ns); - this->ns_meta = xmlNewNs(request, IFMAP_META_NS, "meta"); - xmlNewProp(request, "session-id", this->session_id); - - return request; -} - -/** - * Create a device - */ -static xmlNodePtr create_device(private_tnc_ifmap_soap_t *this) -{ - xmlNodePtr node, node2; - - node = xmlNewNode(NULL, "device"); - node2 = xmlNewNode(NULL, "name"); - xmlAddChild(node, node2); - xmlNodeAddContent(node2, this->device_name); - - return node; -} - -/** - * Create an ip-address - */ -static xmlNodePtr create_ip_address(private_tnc_ifmap_soap_t *this, - host_t *host) -{ - xmlNodePtr node; - char buf[BUF_LEN]; - - node = xmlNewNode(NULL, "ip-address"); - - if (host->get_family(host) == AF_INET6) - { - chunk_t address; - int len, written, i; - char *pos; - bool first = TRUE; - - /* output IPv6 address in canonical IF-MAP 2.0 format */ - address = host->get_address(host); - pos = buf; - len = sizeof(buf); - - for (i = 0; i < address.len; i = i + 2) - { - written = snprintf(pos, len, "%s%x", first ? "" : ":", - 256*address.ptr[i] + address.ptr[i+1]); - if (written < 0 || written >= len) - { - break; - } - pos += written; - len -= written; - first = FALSE; - } - } - else - { - snprintf(buf, BUF_LEN, "%H", host); - } - - xmlNewProp(node, "value", buf); - xmlNewProp(node, "type", host->get_family(host) == AF_INET ? "IPv4" : "IPv6"); - - return node; -} - -/** - * Create metadata - */ -static xmlNodePtr create_metadata(private_tnc_ifmap_soap_t *this, - xmlChar *metadata) -{ - xmlNodePtr node, node2; - - node = xmlNewNode(NULL, "metadata"); - node2 = xmlNewNode(this->ns_meta, metadata); - xmlAddChild(node, node2); - xmlNewProp(node2, "ifmap-cardinality", "singleValue"); - - return node; -} - -/** - * Create capability metadata - */ -static xmlNodePtr create_capability(private_tnc_ifmap_soap_t *this, - identification_t *name) -{ - xmlNodePtr node, node2; - char buf[BUF_LEN]; - - node = xmlNewNode(this->ns_meta, "capability"); - xmlNewProp(node, "ifmap-cardinality", "multiValue"); - - node2 = xmlNewNode(NULL, "name"); - xmlAddChild(node, node2); - snprintf(buf, BUF_LEN, "%Y", name); - xmlNodeAddContent(node2, buf); - - node2 = xmlNewNode(NULL, "administrative-domain"); - xmlAddChild(node, node2); - xmlNodeAddContent(node2, "strongswan"); - - return node; -} - -METHOD(tnc_ifmap_soap_t, publish_ike_sa, bool, - private_tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, bool up) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request, node, node2 = NULL; - enumerator_t *e1, *e2; - auth_rule_t type; - identification_t *id, *eap_id, *group; - host_t *host; - auth_cfg_t *auth; - uint32_t ike_sa_id; - bool is_user = FALSE, first = TRUE, success; - - /* extract relevant data from IKE_SA*/ - ike_sa_id = ike_sa->get_unique_id(ike_sa); - host = ike_sa->get_other_host(ike_sa); - id = ike_sa->get_other_id(ike_sa); - eap_id = ike_sa->get_other_eap_id(ike_sa); - - /* in the presence of an EAP Identity, treat it as a username */ - if (!id->equals(id, eap_id)) - { - is_user = TRUE; - id = eap_id; - } - - /* build publish request */ - request = create_publish_request(this); - - /* delete any existing enforcement reports */ - if (up) - { - node = create_delete_filter(this, "enforcement-report"); - xmlAddChild(request, node); - xmlAddChild(node, create_ip_address(this, host)); - xmlAddChild(node, create_device(this)); - } - - /** - * update or delete authenticated-as metadata - */ - if (up) - { - node = xmlNewNode(NULL, "update"); - } - else - { - node = create_delete_filter(this, "authenticated-as"); - } - xmlAddChild(request, node); - - /* add access-request, identity and [if up] metadata */ - xmlAddChild(node, create_access_request(this, ike_sa_id)); - xmlAddChild(node, create_identity(this, id, is_user)); - if (up) - { - xmlAddChild(node, create_metadata(this, "authenticated-as")); - } - - /** - * update or delete access-request-ip metadata for physical IP address - */ - if (up) - { - node = xmlNewNode(NULL, "update"); - } - else - { - node = create_delete_filter(this, "access-request-ip"); - } - xmlAddChild(request, node); - - /* add access-request, ip-address and [if up] metadata */ - xmlAddChild(node, create_access_request(this, ike_sa_id)); - xmlAddChild(node, create_ip_address(this, host)); - if (up) - { - xmlAddChild(node, create_metadata(this, "access-request-ip")); - } - - /** - * update or delete authenticated-by metadata - */ - if (up) - { - node = xmlNewNode(NULL, "update"); - } - else - { - node = create_delete_filter(this, "authenticated-by"); - } - xmlAddChild(request, node); - - /* add access-request, device and [if up] metadata */ - xmlAddChild(node, create_access_request(this, ike_sa_id)); - xmlAddChild(node, create_device(this)); - if (up) - { - xmlAddChild(node, create_metadata(this, "authenticated-by")); - } - - /** - * update or delete capability metadata - */ - e1 = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE); - while (e1->enumerate(e1, &auth) && (first || up)) - { - e2 = auth->create_enumerator(auth); - while (e2->enumerate(e2, &type, &group)) - { - /* look for group memberships */ - if (type == AUTH_RULE_GROUP) - { - if (first) - { - first = FALSE; - - if (up) - { - node = xmlNewNode(NULL, "update"); - } - else - { - node = create_delete_filter(this, "capability"); - } - xmlAddChild(request, node); - - /* add access-request */ - xmlAddChild(node, create_access_request(this, ike_sa_id)); - if (!up) - { - break; - } - node2 = xmlNewNode(NULL, "metadata"); - xmlAddChild(node, node2); - } - xmlAddChild(node2, create_capability(this, group)); - } - } - e2->destroy(e2); - } - e1->destroy(e1); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "publishReceived", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -METHOD(tnc_ifmap_soap_t, publish_device_ip, bool, - private_tnc_ifmap_soap_t *this, host_t *host) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request, update; - bool success; - - /* build publish update request */ - request = create_publish_request(this); - update = xmlNewNode(NULL, "update"); - xmlAddChild(request, update); - - /* add device, ip-address and metadata */ - xmlAddChild(update, create_device(this)); - xmlAddChild(update, create_ip_address(this, host)); - xmlAddChild(update, create_metadata(this, "device-ip")); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "publishReceived", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -METHOD(tnc_ifmap_soap_t, publish_virtual_ips, bool, - private_tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, bool assign) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request, node; - uint32_t ike_sa_id; - enumerator_t *enumerator; - host_t *vip; - bool success; - - /* extract relevant data from IKE_SA*/ - ike_sa_id = ike_sa->get_unique_id(ike_sa); - - /* build publish request */ - request = create_publish_request(this); - - enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE); - while (enumerator->enumerate(enumerator, &vip)) - { - /** - * update or delete access-request-ip metadata for a virtual IP address - */ - if (assign) - { - node = xmlNewNode(NULL, "update"); - } - else - { - node = create_delete_filter(this, "access-request-ip"); - } - xmlAddChild(request, node); - - /* add access-request, virtual ip-address and [if assign] metadata */ - xmlAddChild(node, create_access_request(this, ike_sa_id)); - xmlAddChild(node, create_ip_address(this, vip)); - if (assign) - { - xmlAddChild(node, create_metadata(this, "access-request-ip")); - } - } - enumerator->destroy(enumerator); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "publishReceived", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -METHOD(tnc_ifmap_soap_t, publish_enforcement_report, bool, - private_tnc_ifmap_soap_t *this, host_t *host, char *action, char *reason) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request, update; - bool success; - - /* build publish update request */ - request = create_publish_request(this); - update = xmlNewNode(NULL, "update"); - xmlAddChild(request, update); - - /* add ip-address and metadata */ - xmlAddChild(update, create_ip_address(this, host)); - xmlAddChild(update, create_device(this)); - xmlAddChild(update, create_enforcement_report(this, action, reason)); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "publishReceived", NULL); - soap_msg->destroy(soap_msg); - - return success; -} - -METHOD(tnc_ifmap_soap_t, endSession, bool, - private_tnc_ifmap_soap_t *this) -{ - tnc_ifmap_soap_msg_t *soap_msg; - xmlNodePtr request; - bool success; - - /* build endSession request */ - request = xmlNewNode(NULL, "endSession"); - this->ns = xmlNewNs(request, IFMAP_NS, "ifmap"); - xmlSetNs(request, this->ns); - xmlNewProp(request, "session-id", this->session_id); - - soap_msg = tnc_ifmap_soap_msg_create(this->uri, this->user_pass, this->tls); - success = soap_msg->post(soap_msg, request, "endSessionResult", NULL); - soap_msg->destroy(soap_msg); - - DBG1(DBG_TNC, "ended ifmap session '%s' as publisher '%s'", - this->session_id, this->ifmap_publisher_id); - - return success; -} - -METHOD(tnc_ifmap_soap_t, get_session_id, char*, - private_tnc_ifmap_soap_t *this) -{ - return this->session_id; -} - -METHOD(tnc_ifmap_soap_t, orphaned, bool, - private_tnc_ifmap_soap_t *this) -{ - return this->ref == 1; -} - -METHOD(tnc_ifmap_soap_t, get_ref, tnc_ifmap_soap_t*, - private_tnc_ifmap_soap_t *this) -{ - ref_get(&this->ref); - return &this->public; -} - -METHOD(tnc_ifmap_soap_t, destroy, void, - private_tnc_ifmap_soap_t *this) -{ - if (ref_put(&this->ref)) - { - if (this->session_id) - { - xmlFree(this->session_id); - xmlFree(this->ifmap_publisher_id); - free(this->device_name); - } - DESTROY_IF(this->tls); - DESTROY_IF(this->host); - - if (this->fd != IFMAP_NO_FD) - { - close(this->fd); - } - lib->credmgr->remove_set(lib->credmgr, &this->creds->set); - this->creds->destroy(this->creds); - free(this->user_pass.ptr); - free(this); - } -} - -static bool soap_init(private_tnc_ifmap_soap_t *this) -{ - char *server_uri, *server_str, *port_str, *uri_str; - char *server_cert, *client_cert, *client_key, *user_pass; - int port; - auth_cfg_t *auth; - certificate_t *cert; - private_key_t *key; - identification_t *server_id, *client_id = NULL; - - /* getting configuration parameters from strongswan.conf */ - server_uri = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.server_uri", IFMAP_URI, lib->ns); - server_cert = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.server_cert", NULL, lib->ns); - client_cert = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.client_cert", NULL, lib->ns); - client_key = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.client_key", NULL, lib->ns); - user_pass = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.username_password", NULL, lib->ns); - - /* load [self-signed] MAP server certificate */ - if (!server_cert) - { - DBG1(DBG_TNC, "MAP server certificate not defined"); - return FALSE; - } - cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, - BUILD_FROM_FILE, server_cert, BUILD_END); - if (!cert) - { - DBG1(DBG_TNC, "loading MAP server certificate from '%s' failed", - server_cert); - return FALSE; - } - DBG1(DBG_TNC, "loaded MAP server certificate from '%s'", server_cert); - server_id = cert->get_subject(cert); - this->creds->add_cert(this->creds, TRUE, cert); - - /* check availability of client credentials */ - if (!client_cert && !user_pass) - { - DBG1(DBG_TNC, "neither MAP client certificate " - "nor username:password defined"); - return FALSE; - } - - if (client_cert) - { - /* load MAP client certificate */ - cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, - BUILD_FROM_FILE, client_cert, BUILD_END); - if (!cert) - { - DBG1(DBG_TNC, "loading MAP client certificate from '%s' failed", - client_cert); - return FALSE; - } - DBG1(DBG_TNC, "loaded MAP client certificate from '%s'", client_cert); - cert = this->creds->add_cert_ref(this->creds, TRUE, cert); - - /* load MAP client private key */ - if (client_key) - { - key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA, - BUILD_FROM_FILE, client_key, BUILD_END); - if (!key) - { - DBG1(DBG_TNC, "loading MAP client private key from '%s' failed", - client_key); - return FALSE; - } - DBG1(DBG_TNC, "loaded MAP client RSA private key from '%s'", - client_key); - this->creds->add_key(this->creds, key); - } - - /* set client ID to certificate distinguished name */ - client_id = cert->get_subject(cert); - - /* check if we have a private key matching the certificate */ - auth = auth_cfg_create(); - auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert); - key = lib->credmgr->get_private(lib->credmgr, KEY_RSA, client_id, auth); - auth->destroy(auth); - if (!key) - { - DBG1(DBG_TNC, "no RSA private key matching MAP client certificate"); - return FALSE; - } - } - else - { - /* set base64-encoded username:password for HTTP Basic Authentication */ - this->user_pass = chunk_to_base64(chunk_from_str(user_pass), NULL); - } - - /* remove HTTPS prefix if any */ - if (strlen(server_uri) >= 8 && strncaseeq(server_uri, "https://", 8)) - { - server_uri += 8; - } - this->uri = server_uri; - - /* duplicate server string since we are going to manipulate it */ - server_str = strdup(server_uri); - - /* extract server name and port from server URI */ - port_str = strchr(server_str, ':'); - if (port_str) - { - *port_str++ = '\0'; - if (sscanf(port_str, "%d", &port) != 1) - { - DBG1(DBG_TNC, "parsing server port %s failed", port_str); - free(server_str); - return FALSE; - } - } - else - { - /* use default https port */ - port = 443; - uri_str = strchr(server_str, '/'); - if (uri_str) - { - *uri_str = '\0'; - } - } - - /* open TCP socket and connect to MAP server */ - this->host = host_create_from_dns(server_str, 0, port); - if (!this->host) - { - DBG1(DBG_TNC, "resolving hostname %s failed", server_str); - free(server_str); - return FALSE; - } - free(server_str); - - this->fd = socket(this->host->get_family(this->host), SOCK_STREAM, 0); - if (this->fd == IFMAP_NO_FD) - { - DBG1(DBG_TNC, "opening socket failed: %s", strerror(errno)); - return FALSE; - } - - if (connect(this->fd, this->host->get_sockaddr(this->host), - *this->host->get_sockaddr_len(this->host)) == -1) - { - DBG1(DBG_TNC, "connecting to %#H failed: %s", - this->host, strerror(errno)); - return FALSE; - } - - /* open TLS socket */ - this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, - NULL, TLS_UNSPEC, TLS_UNSPEC, 0); - if (!this->tls) - { - DBG1(DBG_TNC, "creating TLS socket failed"); - return FALSE; - } - - return TRUE; -} - -/** - * See header - */ -tnc_ifmap_soap_t *tnc_ifmap_soap_create() -{ - private_tnc_ifmap_soap_t *this; - - INIT(this, - .public = { - .newSession = _newSession, - .renewSession = _renewSession, - .purgePublisher = _purgePublisher, - .publish_ike_sa = _publish_ike_sa, - .publish_device_ip = _publish_device_ip, - .publish_virtual_ips = _publish_virtual_ips, - .publish_enforcement_report = _publish_enforcement_report, - .endSession = _endSession, - .get_session_id = _get_session_id, - .orphaned = _orphaned, - .get_ref = _get_ref, - .destroy = _destroy, - }, - .fd = IFMAP_NO_FD, - .creds = mem_cred_create(), - .ref = 1, - ); - - lib->credmgr->add_set(lib->credmgr, &this->creds->set); - - if (!soap_init(this)) - { - destroy(this); - return NULL; - } - - return &this->public; -} diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.h deleted file mode 100644 index 8b766be17..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.h +++ /dev/null @@ -1,134 +0,0 @@ -/* - * Copyright (C) 2011-2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap_soap tnc_ifmap_soap - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_SOAP_H_ -#define TNC_IFMAP_SOAP_H_ - -#include -#include -#include - -typedef struct tnc_ifmap_soap_t tnc_ifmap_soap_t; - -/** - * Implements the TNC IF-MAP 2.0 SOAP Binding - */ -struct tnc_ifmap_soap_t { - - /** - * Creates a new IF-MAP session - * - * @return TRUE if command was successful - */ - bool (*newSession)(tnc_ifmap_soap_t *this); - - /** - * Check if the IF-MAP session is still active - * - * @return TRUE if command was successful - */ - bool (*renewSession)(tnc_ifmap_soap_t *this); - - /** - * Purges all metadata published by this publisher - * - * @return TRUE if command was successful - */ - bool (*purgePublisher)(tnc_ifmap_soap_t *this); - - /** - * Publish metadata about established/deleted IKE_SAs - * - * @param ike_sa IKE_SA for which metadata is published - * @param up TRUE if IKE_SEA is up, FALSE if down - * @return TRUE if command was successful - */ - bool (*publish_ike_sa)(tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, bool up); - - /** - * Publish PEP device-ip metadata - * - * @param host IP address of local endpoint - * @return TRUE if command was successful - */ - bool (*publish_device_ip)(tnc_ifmap_soap_t *this, host_t *host); - - /** - * Publish Virtual IP access-request-ip metadata - * - * @param ike_sa IKE_SA for which Virtual IP metadata is published - * @param assign TRUE if assigned, FALSE if removed - * @return TRUE if command was successful - */ - bool (*publish_virtual_ips)(tnc_ifmap_soap_t *this, ike_sa_t *ike_sa, - bool assign); - - /** - * Publish enforcement-report metadata - * - * @param host Host to be enforced - * @param action Enforcement action ("block" or "quarantine") - * @param reason Enforcement reason - * @return TRUE if command was successful - */ - bool (*publish_enforcement_report)(tnc_ifmap_soap_t *this, host_t *host, - char *action, char *reason); - - /** - * Ends an IF-MAP session - * - * @return TRUE if command was successful - */ - bool (*endSession)(tnc_ifmap_soap_t *this); - - /** - * Get ID of IF-MAP session - * - * @return IF-MAP session ID - */ - char* (*get_session_id)(tnc_ifmap_soap_t *this); - - /** - * Check for an orphaned IF-MAP session - * - * @return TRUE if IF-MAP session is orphaned - */ - bool (*orphaned)(tnc_ifmap_soap_t *this); - - /** - * Get a reference to an IF-MAP session - * - * @return referenced IF-MAP session - */ - tnc_ifmap_soap_t* (*get_ref)(tnc_ifmap_soap_t *this); - - /** - * Destroy a tnc_ifmap_soap_t. - */ - void (*destroy)(tnc_ifmap_soap_t *this); -}; - -/** - * Create a tnc_ifmap_soap instance. - */ -tnc_ifmap_soap_t *tnc_ifmap_soap_create(); - -#endif /** TNC_IFMAP_SOAP_H_ @}*/ diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.c deleted file mode 100644 index e52d63f80..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.c +++ /dev/null @@ -1,258 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "tnc_ifmap_soap_msg.h" -#include "tnc_ifmap_http.h" - -#include - -#define SOAP_NS "http://www.w3.org/2003/05/soap-envelope" - -typedef struct private_tnc_ifmap_soap_msg_t private_tnc_ifmap_soap_msg_t; - -/** - * Private data of an tnc_ifmap_soap_msg_t object. - */ -struct private_tnc_ifmap_soap_msg_t { - - /** - * Public tnc_ifmap_soap_msg_t interface. - */ - tnc_ifmap_soap_msg_t public; - - /** - * HTTP POST request builder and response processing - */ - tnc_ifmap_http_t *http; - - /** - * TLS socket - */ - tls_socket_t *tls; - - /** - * XML Document - */ - xmlDocPtr doc; - -}; - -/** - * Find a child node with a given name - */ -static xmlNodePtr find_child(xmlNodePtr parent, const xmlChar* name) -{ - xmlNodePtr child; - - child = parent->xmlChildrenNode; - while (child) - { - if (xmlStrcmp(child->name, name) == 0) - { - return child; - } - child = child->next; - } - - DBG1(DBG_TNC, "child node \"%s\" not found", name); - return NULL; -} - -METHOD(tnc_ifmap_soap_msg_t, post, bool, - private_tnc_ifmap_soap_msg_t *this, xmlNodePtr request, char *result_name, - xmlNodePtr *result) -{ - xmlDocPtr doc; - xmlNodePtr env, body, cur, response; - xmlNsPtr ns; - xmlChar *xml_str, *errorCode, *errorString; - int xml_len, len, written; - chunk_t xml, http; - char buf[4096] = { 0 }; - status_t status; - - DBG2(DBG_TNC, "sending ifmap %s", request->name); - - /* Generate XML Document containing SOAP Envelope */ - doc = xmlNewDoc("1.0"); - env =xmlNewNode(NULL, "Envelope"); - ns = xmlNewNs(env, SOAP_NS, "env"); - xmlSetNs(env, ns); - xmlDocSetRootElement(doc, env); - - /* Add SOAP Body containing IF-MAP request */ - body = xmlNewNode(ns, "Body"); - xmlAddChild(body, request); - xmlAddChild(env, body); - - /* Convert XML Document into a character string */ - xmlDocDumpFormatMemory(doc, &xml_str, &xml_len, 1); - xmlFreeDoc(doc); - DBG3(DBG_TNC, "%.*s", xml_len, xml_str); - xml = chunk_create(xml_str, xml_len); - - /* Send SOAP-XML request via HTTPS POST */ - do - { - status = this->http->build(this->http, &xml, &http); - if (status == FAILED) - { - break; - } - written = this->tls->write(this->tls, http.ptr, http.len); - free(http.ptr); - if (written != http.len) - { - status = FAILED; - break; - } - } - while (status == NEED_MORE); - - xmlFree(xml_str); - if (status != SUCCESS) - { - return FALSE; - } - - /* Receive SOAP-XML response via [chunked] HTTPS */ - xml = chunk_empty; - do - { - /* reduce size so the buffer is null-terminated */ - len = this->tls->read(this->tls, buf, sizeof(buf)-1, TRUE); - if (len <= 0) - { - return FALSE; - } - http = chunk_create(buf, len); - - status = this->http->process(this->http, &http, &xml); - if (status == FAILED) - { - free(xml.ptr); - return FALSE; - } - } - while (status == NEED_MORE); - - DBG3(DBG_TNC, "parsing XML message %B", &xml); - this->doc = xmlParseMemory(xml.ptr, xml.len); - free(xml.ptr); - - if (!this->doc) - { - DBG1(DBG_TNC, "failed to parse XML message"); - return FALSE; - } - - /* check out XML document */ - cur = xmlDocGetRootElement(this->doc); - if (!cur) - { - DBG1(DBG_TNC, "empty XML message"); - return FALSE; - } - - /* get XML Document type is a SOAP Envelope */ - if (xmlStrcmp(cur->name, "Envelope")) - { - DBG1(DBG_TNC, "XML message does not contain a SOAP Envelope"); - return FALSE; - } - - /* get SOAP Body */ - cur = find_child(cur, "Body"); - if (!cur) - { - return FALSE; - } - - /* get IF-MAP response */ - response = find_child(cur, "response"); - if (!response) - { - return FALSE; - } - - /* get IF-MAP result */ - cur = find_child(response, result_name); - if (!cur) - { - cur = find_child(response, "errorResult"); - if (cur) - { - DBG1(DBG_TNC, "received errorResult"); - - errorCode = xmlGetProp(cur, "errorCode"); - if (errorCode) - { - DBG1(DBG_TNC, " %s", errorCode); - xmlFree(errorCode); - } - - cur = find_child(cur, "errorString"); - if (cur) - { - errorString = xmlNodeGetContent(cur); - if (errorString) - { - DBG1(DBG_TNC, " %s", errorString); - xmlFree(errorString); - } - } - } - return FALSE; - } - - if (result) - { - *result = cur; - } - return TRUE; -} - -METHOD(tnc_ifmap_soap_msg_t, destroy, void, - private_tnc_ifmap_soap_msg_t *this) -{ - this->http->destroy(this->http); - if (this->doc) - { - xmlFreeDoc(this->doc); - } - free(this); -} - -/** - * See header - */ -tnc_ifmap_soap_msg_t *tnc_ifmap_soap_msg_create(char *uri, chunk_t user_pass, - tls_socket_t *tls) -{ - private_tnc_ifmap_soap_msg_t *this; - - INIT(this, - .public = { - .post = _post, - .destroy = _destroy, - }, - .http = tnc_ifmap_http_create(uri, user_pass), - .tls = tls, - ); - - return &this->public; -} - diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.h b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.h deleted file mode 100644 index 28f6b98ff..000000000 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap_msg.h +++ /dev/null @@ -1,63 +0,0 @@ -/* - * Copyright (C) 2013 Andreas Steffen - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup tnc_ifmap_soap_msg tnc_ifmap_soap_msg - * @{ @ingroup tnc_ifmap - */ - -#ifndef TNC_IFMAP_SOAP_MSG_H_ -#define TNC_IFMAP_SOAP_MSG_H_ - -#include -#include - -#include - -typedef struct tnc_ifmap_soap_msg_t tnc_ifmap_soap_msg_t; - -/** - * Interface for sending and receiving SOAP-XML messages - */ -struct tnc_ifmap_soap_msg_t { - - /** - * Post an IF-MAP request in a SOAP-XML message and return a result - * - * @param request XML-encoded IF-MAP request - * @param result_name name of the IF-MAP result - * @param result XML-encoded IF-MAP result - */ - bool (*post)(tnc_ifmap_soap_msg_t *this, xmlNodePtr request, - char *result_name, xmlNodePtr* result); - - /** - * Destroy a tnc_ifmap_soap_msg_t object. - */ - void (*destroy)(tnc_ifmap_soap_msg_t *this); -}; - -/** - * Create a tnc_ifmap_soap_msg instance. - * - * @param uri HTTPS URI with https:// prefix removed - * @param user_pass Optional username:password for HTTP Basic Authentication - * @param tls TLS socket protecting the SOAP message - */ -tnc_ifmap_soap_msg_t *tnc_ifmap_soap_msg_create(char *uri, chunk_t user_pass, - tls_socket_t *tls); - -#endif /** TNC_IFMAP_SOAP_MSG_H_ @}*/ diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index e0d95d5a6..af60dfff9 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -39,7 +39,6 @@ CONFIG_OPTS = \ --enable-eap-ttls \ --enable-eap-peap \ --enable-eap-tnc \ - --enable-tnc-ifmap \ --enable-tnc-pdp \ --enable-tnc-imc \ --enable-tnc-imv \