src/trust/sts_client.c - axis-axis2-c-rampart - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
  * contributor license agreements.  See the NOTICE file distributed with
  * this work for additional information regarding copyright ownership.
  * The ASF licenses this file to You under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <trust_sts_client.h>
 #include <axis2_op_client.h>
 #include <openssl_hmac.h>
 #include <oxs_utility.h>
 #include <axiom_util.h>

 static void
 trust_sts_client_insert_entropy(
     trust_sts_client_t *sts_client,
     const axutil_env_t *env,
     trust_rst_t *rst);

 static oxs_buffer_t*
 trust_sts_client_compute_key(
      trust_sts_client_t *sts_client,
      const axutil_env_t *env,
      trust_rst_t *rst,
      trust_rstr_t *rstr);

 struct trust_sts_client
 {

     /* Algorithm Suite for Entropy */
     rp_algorithmsuite_t *algo_suite;

     /* Trust 1.0 Assertions */
     rp_trust10_t *trust10;

     /* Issuer Address */
     axis2_char_t *issuer_address;

     /* STS Client Home Directory */
     axis2_char_t *home_dir;

     /* Location of the issuer's policy file */
     axis2_char_t *issuer_policy_location;

     /* Location of the service's (relying party's) policy file */
     axis2_char_t *service_policy_location;

 	/*SVC Client Reference*/
 	axis2_svc_client_t *svc_client;

 	/*SENT RST - Most Recent*/
 	axiom_node_t *sent_rst_node;

 	/*RECEIVED RSTR - Most Recent*/
 	axiom_node_t *received_rstr_node;

 	/*RECEIVED In_msg_ctx*/
 	axis2_msg_ctx_t *received_in_msg_ctx;

 	rp_secpolicy_t *sec_policy;


 };

 AXIS2_EXTERN trust_sts_client_t *AXIS2_CALL
 trust_sts_client_create(
     const axutil_env_t * env)
 {
     trust_sts_client_t *sts_client = NULL;

     sts_client = (trust_sts_client_t *) AXIS2_MALLOC(env->allocator, sizeof(trust_sts_client_t));

     sts_client->algo_suite = NULL;
     sts_client->trust10 = NULL;
     sts_client->home_dir = NULL;
     sts_client->issuer_address = NULL;
     sts_client->issuer_policy_location = NULL;
     sts_client->service_policy_location = NULL;
 	sts_client->svc_client = NULL;
 	sts_client->sec_policy = NULL;

     return sts_client;
 }

 AXIS2_EXTERN void AXIS2_CALL
 trust_sts_client_free(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     if(sts_client->sec_policy)
 	{
 		rp_secpolicy_free(sts_client->sec_policy, env);
 		sts_client->sec_policy = NULL;
 	}

 	if(sts_client->svc_client)
 	{
 		axis2_svc_client_free(sts_client->svc_client, env);
 		sts_client->svc_client = NULL;
 	}

     if (sts_client)
     {
         AXIS2_FREE(env->allocator, sts_client);
     }

 }

 AXIS2_EXTERN void AXIS2_CALL
 trust_sts_client_request_security_token(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     trust_context_t *trust_context)
 {
     neethi_policy_t *issuer_policy = NULL;
     neethi_policy_t *service_policy = NULL;
     axis2_status_t status = AXIS2_SUCCESS;
     axiom_node_t *rst_node = NULL;
     axiom_node_t *return_node = NULL;

 	axis2_op_client_t* op_client = NULL;
 	axis2_msg_ctx_t *in_msg_ctx = NULL;


     /*Action Logic*/
     trust_rst_t *rst = NULL;
     axis2_char_t *request_type = NULL;
     axis2_char_t *wsa_action = NULL;

     if(sts_client->issuer_policy_location && sts_client->service_policy_location)
     {
         issuer_policy = neethi_util_create_policy_from_file(env, sts_client->issuer_policy_location);
         service_policy = neethi_util_create_policy_from_file(env, sts_client->service_policy_location);
     }

     if (!issuer_policy || !service_policy)
     {
         status = AXIS2_FAILURE;
     }
     else
     {
         trust_sts_client_process_policies(sts_client, env, issuer_policy, service_policy);
     }


     /*Action Logic - RequestType - used for specify the requesting action*/
     rst = trust_context_get_rst(trust_context, env);
     if(NULL == rst)
     {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST is NULL: Created RST_CTX may not set to TrustContext");
             return;
     }

     request_type = trust_rst_get_request_type(rst, env);
 	wsa_action = trust_rst_get_wsa_action(rst, env);

     if(NULL == request_type)
     {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-RequestType is NOT set. RST MUST have a RequestType");
             return;
     }

 	if(NULL == wsa_action)
 	{
 		AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-WSA-Action is NOT set");
 	}

     sts_client->svc_client =
     trust_sts_client_get_svc_client(sts_client, env, wsa_action, NULL, AXIS2_FALSE);


     if (status == AXIS2_SUCCESS)
     {
         status = axis2_svc_client_set_policy(sts_client->svc_client, env, issuer_policy);
         if (status == AXIS2_FAILURE)
         {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Policy setting failed.");
         }
 		/*Building the RST */
         rst_node = trust_context_build_rst_node(trust_context, env);
         if(rst_node)
         {
             return_node = axis2_svc_client_send_receive(sts_client->svc_client, env, rst_node);
 			sts_client->sent_rst_node = return_node;

 			/*Processing Response*/
 			if(!return_node)
 			{
 				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] Return axiom node NULL");
 			}
 			else
 			{
 				/*Processing IN_MSG_CONTEXT*/
 				op_client = axis2_svc_client_get_op_client(sts_client->svc_client, env);
 				if(op_client)
 				{
 					in_msg_ctx = (axis2_msg_ctx_t *)axis2_op_client_get_msg_ctx (op_client, env, AXIS2_WSDL_MESSAGE_LABEL_IN);

 					if(in_msg_ctx)
 					{
 						trust_context_process_rstr(trust_context, env, in_msg_ctx);
 						sts_client->received_in_msg_ctx = in_msg_ctx;	/*Store the in_msg_context for sec_header extentions in trust*/
 					}
 				}

 			}
         }
         else
         {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-Not send -> RST Node building failed");
             return;
         }
     }

     return;
 }

 AXIS2_EXTERN axis2_svc_client_t *AXIS2_CALL
 trust_sts_client_get_svc_client(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     axis2_char_t * action,
     axis2_char_t *address_version,
     axis2_bool_t is_soap11)
 {
     axis2_endpoint_ref_t *endpoint_ref = NULL;
     axis2_options_t *options = NULL;
     axis2_svc_client_t *svc_client = NULL;

     endpoint_ref = axis2_endpoint_ref_create(env, sts_client->issuer_address);

     options = axis2_options_create(env);
     axis2_options_set_to(options, env, endpoint_ref);
     axis2_options_set_action(options, env, action);
     axis2_options_set_xml_parser_reset(options, env, AXIS2_FALSE);
     if(is_soap11)
     {
         axis2_options_set_soap_action(options, env, axutil_string_create(env, action));
         axis2_options_set_soap_version(options, env, AXIOM_SOAP11);
     }

 	if(!(sts_client->svc_client))
 	{
 		svc_client = axis2_svc_client_create(env, sts_client->home_dir);
 		sts_client->svc_client = svc_client;
 	}
 	else
 	{
 		svc_client = sts_client->svc_client;
 	}

     if (!svc_client)
     {
         AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Stub invoke FAILED: Error code:" " %d :: %s",
                         env->error->error_number, AXIS2_ERROR_GET_MESSAGE(env->error));
         return NULL;
     }

     /* Set service client options */
     axis2_svc_client_set_options(svc_client, env, options);

     /* Engage addressing module and rampart module */
     axis2_svc_client_engage_module(svc_client, env, AXIS2_MODULE_ADDRESSING);
     axis2_svc_client_engage_module(svc_client, env, RAMPART_RAMPART);

     /*set the address version*/
     if(address_version)
     {
         axutil_property_t *property  = NULL;

         property = axutil_property_create(env);
         axutil_property_set_scope(property, env, AXIS2_SCOPE_APPLICATION);
         axutil_property_set_value(property, env, axutil_strdup(env, address_version));
         axis2_options_set_property(options, env, AXIS2_WSA_VERSION, property);
     }

     return svc_client;
 }

 AXIS2_EXTERN axis2_status_t AXIS2_CALL
 trust_sts_client_process_policies(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     neethi_policy_t * issuer_policy,
     neethi_policy_t * service_policy)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     if (issuer_policy)
     {
         sts_client->algo_suite = trust_policy_util_get_algorithmsuite(env, issuer_policy, &sts_client->sec_policy);
     }

     if (service_policy)
     {
         sts_client->trust10 = trust_policy_util_get_trust10(env, service_policy, &sts_client->sec_policy);
     }

     return AXIS2_SUCCESS;
 }


 AXIS2_EXTERN axis2_status_t AXIS2_CALL
 trust_sts_client_set_issuer_address(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     axis2_char_t * address)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
     AXIS2_PARAM_CHECK(env->error, address, AXIS2_FAILURE);

     sts_client->issuer_address = address;

     return AXIS2_SUCCESS;
 }

 AXIS2_EXTERN axis2_char_t *AXIS2_CALL
 trust_sts_client_get_issuer_address(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     return sts_client->issuer_address;
 }

 AXIS2_EXTERN axis2_status_t AXIS2_CALL
 trust_sts_client_set_home_dir(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     axis2_char_t * directory)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
     AXIS2_PARAM_CHECK(env->error, directory, AXIS2_FAILURE);

     sts_client->home_dir = directory;

     return AXIS2_SUCCESS;
 }

 AXIS2_EXTERN axis2_char_t *AXIS2_CALL
 trust_sts_client_get_home_dir(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     return sts_client->home_dir;
 }

 AXIS2_EXTERN axis2_status_t AXIS2_CALL
 trust_sts_client_set_issuer_policy_location(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     axis2_char_t * file_path)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
     AXIS2_PARAM_CHECK(env->error, file_path, AXIS2_FAILURE);

     sts_client->issuer_policy_location = file_path;

     return AXIS2_SUCCESS;
 }

 AXIS2_EXTERN axis2_char_t *AXIS2_CALL
 trust_sts_client_get_issuer_policy_location(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     return sts_client->issuer_policy_location;
 }

 AXIS2_EXTERN axis2_status_t AXIS2_CALL
 trust_sts_client_set_service_policy_location(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     axis2_char_t * file_path)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
     AXIS2_PARAM_CHECK(env->error, file_path, AXIS2_FAILURE);

     sts_client->service_policy_location = file_path;

     return AXIS2_SUCCESS;
 }

 AXIS2_EXTERN axis2_char_t *AXIS2_CALL
 trust_sts_client_get_service_policy_location(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env)
 {
     AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

     return sts_client->service_policy_location;
 }

 AXIS2_EXTERN oxs_buffer_t* AXIS2_CALL
 trust_sts_client_request_security_token_using_policy(
     trust_sts_client_t * sts_client,
     const axutil_env_t * env,
     trust_context_t *trust_context,
     neethi_policy_t *issuer_policy,
     axis2_char_t *address_version,
     axis2_bool_t is_soap11,
     rampart_context_t *rampart_context)
 {
     axis2_status_t status = AXIS2_SUCCESS;
     axiom_node_t *rst_node = NULL;
     axiom_node_t *return_node = NULL;
     axis2_op_client_t* op_client = NULL;
 	axis2_msg_ctx_t *in_msg_ctx = NULL;


     /*Action Logic*/
     trust_rst_t *rst = NULL;
     axis2_char_t *request_type = NULL;
     axis2_char_t *wsa_action = NULL;

     trust_sts_client_process_policies(sts_client, env, issuer_policy, issuer_policy);

     /*Action Logic - RequestType - used for specify the requesting action*/
     rst = trust_context_get_rst(trust_context, env);
     if(NULL == rst)
     {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST is NULL: Created RST_CTX may not set to TrustContest");
             return NULL;
     }

     request_type = trust_rst_get_request_type(rst, env);
     wsa_action = trust_rst_get_wsa_action(rst, env);

     if(NULL == request_type)
     {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-RequestType is NOT set. RST MUST have a RequestType");
             return NULL;
     }

 	if(NULL == wsa_action)
 	{
 		AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-WSA-Action is NOT set");
 	}

     sts_client->svc_client =
     trust_sts_client_get_svc_client(sts_client, env, wsa_action, address_version, is_soap11);

     if (sts_client->svc_client)
     {
         /* if rampart context is set, we can set it to svc_client. This will be used by
          * scripting bindings to specify rampart specific values */
         if(rampart_context)
         {
             axis2_svc_ctx_t *svc_ctx = NULL;
             axis2_conf_ctx_t *conf_ctx = NULL;
             axis2_conf_t *conf = NULL;
             axutil_param_t *security_param = NULL;

             svc_ctx = axis2_svc_client_get_svc_ctx (sts_client->svc_client, env);
             conf_ctx = axis2_svc_ctx_get_conf_ctx (svc_ctx, env);
             conf = axis2_conf_ctx_get_conf (conf_ctx, env);
             security_param = axutil_param_create (
                 env, RAMPART_CONFIGURATION, (void *)rampart_context);
             axis2_conf_add_param (conf, env, security_param);
         }

 		if(issuer_policy)
 		{
 			status = axis2_svc_client_set_policy(sts_client->svc_client, env, issuer_policy);
 			if (status == AXIS2_FAILURE)
 			{
 				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Policy setting failed.");
 			}

             /*insert entropy if needed*/
             trust_sts_client_insert_entropy(sts_client, env, rst);
 		}

 		/*Building the RST */
         rst_node = trust_context_build_rst_node(trust_context, env);
         if(rst_node)
         {
             return_node = axis2_svc_client_send_receive(sts_client->svc_client, env, rst_node);
 			sts_client->sent_rst_node = return_node;

 			/*Processing Response*/
 			if(!return_node)
 			{
 				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] Return axiom node NULL");
 			}
 			else
 			{
                 /*---- for debug ------*/
                 /*axis2_char_t *serialise_node = NULL;
                 serialise_node = axiom_node_to_string(return_node, env);
                 printf("sct reply is %s\n", serialise_node);*/
                 /*---- End for debug ------*/


 				/*Processing IN_MSG_CONTEXT*/
 				op_client = axis2_svc_client_get_op_client(sts_client->svc_client, env);
 				if(op_client)
 				{
 					in_msg_ctx = (axis2_msg_ctx_t *)axis2_op_client_get_msg_ctx (op_client, env, AXIS2_WSDL_MESSAGE_LABEL_IN);

 					if(in_msg_ctx)
 					{
 						trust_context_process_rstr(trust_context, env, in_msg_ctx);
 						sts_client->received_in_msg_ctx = in_msg_ctx;	/*Store the in_msg_context for sec_header extentions in trust*/
                         return trust_sts_client_compute_key(sts_client, env, rst, trust_context_get_rstr(trust_context, env));
 					}
 				}

 			}
         }
         else
         {
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-Not send -> RST Node building failed");
             return NULL;
         }
     }

     return NULL;
 }

 static void
 trust_sts_client_insert_entropy(
     trust_sts_client_t *sts_client,
     const axutil_env_t *env,
     trust_rst_t *rst)
 {
     axis2_char_t *request_type = NULL;
     int key_size = 0;
     axis2_char_t *nonce = NULL;
     trust_entropy_t* entropy = NULL;

     request_type = trust_rst_get_request_type(rst, env);

     /*we support entropy for issue only*/
     if(0 != axutil_strcmp(request_type, TRUST_REQ_TYPE_ISSUE))
         return;

     /*if entropy is already give, no need to create*/
     if(trust_rst_get_entropy(rst, env))
         return;

     /*if algorithm suite is missing or trust10 is missing, then we can't proceed*/
     if((!sts_client->algo_suite) || (!sts_client->trust10))
         return;

     /*check whether client entropy is needed. If not can return*/
     if(!rp_trust10_get_require_client_entropy(sts_client->trust10, env))
         return;

     key_size = rp_algorithmsuite_get_max_symmetric_keylength(sts_client->algo_suite, env);
     if (key_size <= 0)
     {
         AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] maximum symmetric key length of issuer algorithm suite is not valid");
         return;
     }

     /*nonce should be created with half the size. size is in bits, have to convert it to bytes*/
     nonce = oxs_util_generate_nonce(env, key_size/16);
     if(!nonce)
     {
         AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] cannon create nonce with length %d", key_size/16);
         return;
     }

     entropy = trust_entropy_create(env);
     trust_entropy_set_binary_secret(entropy, env, nonce);
     trust_entropy_set_ns_uri(entropy, env, trust_rst_get_wst_ns_uri(rst, env));
     trust_entropy_set_binary_secret_type(entropy, env, NONCE);

     trust_rst_set_key_size(rst, env, key_size);
     trust_rst_set_entropy(rst, env, entropy);
     return;
 }

 static oxs_buffer_t*
 trust_sts_client_compute_key(trust_sts_client_t *sts_client,
                              const axutil_env_t *env,
                              trust_rst_t *rst,
                              trust_rstr_t *rstr)
 {
     trust_entropy_t* requester_entropy = NULL;
     axiom_node_t *proof_token = NULL;

     /*if rstr is not valid, then can't proceed*/
     if(!rstr)
         return NULL;

     /*if requester doesn't provide entropy, then no need to compute the key */
     requester_entropy = trust_rst_get_entropy(rst, env);
     if((!requester_entropy) || (!trust_entropy_get_binary_secret(requester_entropy, env)))
         return NULL;

     /*check the proof token whether to compute the token or not*/
     proof_token = trust_rstr_get_requested_proof_token(rstr, env);

     /*if issuer doesn't give a proof token/entropy, then requester_entropy is the key*/
     if(!proof_token)
     {
         oxs_buffer_t *buffer = NULL;
         int decoded_len = 0;
         axis2_char_t *decoded_shared_secret = NULL;
         axis2_char_t* shared_secret = NULL;

         shared_secret = trust_entropy_get_binary_secret(requester_entropy, env);
         decoded_len = axutil_base64_decode_len(shared_secret);
 	    decoded_shared_secret = AXIS2_MALLOC(env->allocator, decoded_len);
 	    axutil_base64_decode_binary((unsigned char*)decoded_shared_secret, shared_secret);
         buffer = oxs_buffer_create(env);
         oxs_buffer_populate(buffer, env, (unsigned char*)decoded_shared_secret, decoded_len);
         AXIS2_FREE(env->allocator, decoded_shared_secret);
         return buffer;
     }
     else
     /*proof token is available. We have to check the content of proof token*/
     {
         axis2_char_t *local_name = NULL;
         axis2_char_t *compute_key_algo = NULL;
         trust_entropy_t* issuer_entropy = NULL;
         int key_size = 0;
         axis2_char_t *output = NULL;

         oxs_buffer_t *buffer = NULL;
         int requester_entropy_len = 0;
         axis2_char_t *decoded_requester_entropy = NULL;
         axis2_char_t *requester_nonce = NULL;
         int issuer_entropy_len = 0;
         axis2_char_t *decoded_issuer_entropy = NULL;
         axis2_char_t *issuer_nonce = NULL;

         local_name = axiom_util_get_localname(proof_token, env);
         /*if local name is not ComputedKey, then we can return*/
         if(axutil_strcmp(local_name, TRUST_COMPUTED_KEY) != 0)
             return NULL;

         key_size = trust_rst_get_key_size(rst, env)/8;
         if(key_size <= 0)
             return NULL;

         compute_key_algo = oxs_axiom_get_node_content(env, proof_token);

         buffer = oxs_buffer_create(env);
         requester_nonce = trust_entropy_get_binary_secret(requester_entropy, env);
         requester_entropy_len = axutil_base64_decode_len(requester_nonce);
         decoded_requester_entropy = AXIS2_MALLOC(env->allocator, requester_entropy_len);
         axutil_base64_decode_binary((unsigned char*)decoded_requester_entropy, requester_nonce);

         issuer_entropy = trust_rstr_get_entropy(rstr, env);

         /*if issuer doesn't provide entropy, we can take requester entropy as key*/
         if((!requester_entropy) || (!trust_entropy_get_binary_secret(requester_entropy, env)))
         {
             oxs_buffer_populate(buffer, env, (unsigned char*)decoded_requester_entropy, requester_entropy_len);
             AXIS2_FREE(env->allocator, decoded_requester_entropy);
             return buffer;
         }

         issuer_nonce = trust_entropy_get_binary_secret(issuer_entropy, env);
         issuer_entropy_len = axutil_base64_decode_len(issuer_nonce);
         decoded_issuer_entropy = AXIS2_MALLOC(env->allocator, issuer_entropy_len);
         axutil_base64_decode_binary((unsigned char*)decoded_issuer_entropy, issuer_nonce);
         output = AXIS2_MALLOC(env->allocator, key_size);

         openssl_p_hash(env, (unsigned char*)decoded_requester_entropy, requester_entropy_len,
                             (unsigned char*)decoded_issuer_entropy, issuer_entropy_len,
                             (unsigned char*)output, key_size);
         oxs_buffer_populate(buffer, env, (unsigned char*)output, key_size);
         return buffer;
     }
 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one or more
	* contributor license agreements. See the NOTICE file distributed with
	* this work for additional information regarding copyright ownership.
	* The ASF licenses this file to You under the Apache License, Version 2.0
	* (the "License"); you may not use this file except in compliance with
	* the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <trust_sts_client.h>
	#include <axis2_op_client.h>
	#include <openssl_hmac.h>
	#include <oxs_utility.h>
	#include <axiom_util.h>

	static void
	trust_sts_client_insert_entropy(
	trust_sts_client_t *sts_client,
	const axutil_env_t *env,
	trust_rst_t *rst);

	static oxs_buffer_t*
	trust_sts_client_compute_key(
	trust_sts_client_t *sts_client,
	const axutil_env_t *env,
	trust_rst_t *rst,
	trust_rstr_t *rstr);

	struct trust_sts_client
	{

	/* Algorithm Suite for Entropy */
	rp_algorithmsuite_t *algo_suite;

	/* Trust 1.0 Assertions */
	rp_trust10_t *trust10;

	/* Issuer Address */
	axis2_char_t *issuer_address;

	/* STS Client Home Directory */
	axis2_char_t *home_dir;

	/* Location of the issuer's policy file */
	axis2_char_t *issuer_policy_location;

	/* Location of the service's (relying party's) policy file */
	axis2_char_t *service_policy_location;

	/SVC Client Reference/
	axis2_svc_client_t *svc_client;

	/SENT RST - Most Recent/
	axiom_node_t *sent_rst_node;

	/RECEIVED RSTR - Most Recent/
	axiom_node_t *received_rstr_node;

	/RECEIVED In_msg_ctx/
	axis2_msg_ctx_t *received_in_msg_ctx;

	rp_secpolicy_t *sec_policy;


	};

	AXIS2_EXTERN trust_sts_client_t *AXIS2_CALL
	trust_sts_client_create(
	const axutil_env_t * env)
	{
	trust_sts_client_t *sts_client = NULL;

	sts_client = (trust_sts_client_t *) AXIS2_MALLOC(env->allocator, sizeof(trust_sts_client_t));

	sts_client->algo_suite = NULL;
	sts_client->trust10 = NULL;
	sts_client->home_dir = NULL;
	sts_client->issuer_address = NULL;
	sts_client->issuer_policy_location = NULL;
	sts_client->service_policy_location = NULL;
	sts_client->svc_client = NULL;
	sts_client->sec_policy = NULL;

	return sts_client;
	}

	AXIS2_EXTERN void AXIS2_CALL
	trust_sts_client_free(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	if(sts_client->sec_policy)
	{
	rp_secpolicy_free(sts_client->sec_policy, env);
	sts_client->sec_policy = NULL;
	}

	if(sts_client->svc_client)
	{
	axis2_svc_client_free(sts_client->svc_client, env);
	sts_client->svc_client = NULL;
	}

	if (sts_client)
	{
	AXIS2_FREE(env->allocator, sts_client);
	}

	}

	AXIS2_EXTERN void AXIS2_CALL
	trust_sts_client_request_security_token(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	trust_context_t *trust_context)
	{
	neethi_policy_t *issuer_policy = NULL;
	neethi_policy_t *service_policy = NULL;
	axis2_status_t status = AXIS2_SUCCESS;
	axiom_node_t *rst_node = NULL;
	axiom_node_t *return_node = NULL;

	axis2_op_client_t* op_client = NULL;
	axis2_msg_ctx_t *in_msg_ctx = NULL;


	/Action Logic/
	trust_rst_t *rst = NULL;
	axis2_char_t *request_type = NULL;
	axis2_char_t *wsa_action = NULL;

	if(sts_client->issuer_policy_location && sts_client->service_policy_location)
	{
	issuer_policy = neethi_util_create_policy_from_file(env, sts_client->issuer_policy_location);
	service_policy = neethi_util_create_policy_from_file(env, sts_client->service_policy_location);
	}

	if (!issuer_policy \|\| !service_policy)
	{
	status = AXIS2_FAILURE;
	}
	else
	{
	trust_sts_client_process_policies(sts_client, env, issuer_policy, service_policy);
	}


	/Action Logic - RequestType - used for specify the requesting action/
	rst = trust_context_get_rst(trust_context, env);
	if(NULL == rst)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST is NULL: Created RST_CTX may not set to TrustContext");
	return;
	}

	request_type = trust_rst_get_request_type(rst, env);
	wsa_action = trust_rst_get_wsa_action(rst, env);

	if(NULL == request_type)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-RequestType is NOT set. RST MUST have a RequestType");
	return;
	}

	if(NULL == wsa_action)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-WSA-Action is NOT set");
	}

	sts_client->svc_client =
	trust_sts_client_get_svc_client(sts_client, env, wsa_action, NULL, AXIS2_FALSE);


	if (status == AXIS2_SUCCESS)
	{
	status = axis2_svc_client_set_policy(sts_client->svc_client, env, issuer_policy);
	if (status == AXIS2_FAILURE)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Policy setting failed.");
	}
	/Building the RST /
	rst_node = trust_context_build_rst_node(trust_context, env);
	if(rst_node)
	{
	return_node = axis2_svc_client_send_receive(sts_client->svc_client, env, rst_node);
	sts_client->sent_rst_node = return_node;

	/Processing Response/
	if(!return_node)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] Return axiom node NULL");
	}
	else
	{
	/Processing IN_MSG_CONTEXT/
	op_client = axis2_svc_client_get_op_client(sts_client->svc_client, env);
	if(op_client)
	{
	in_msg_ctx = (axis2_msg_ctx_t *)axis2_op_client_get_msg_ctx (op_client, env, AXIS2_WSDL_MESSAGE_LABEL_IN);

	if(in_msg_ctx)
	{
	trust_context_process_rstr(trust_context, env, in_msg_ctx);
	sts_client->received_in_msg_ctx = in_msg_ctx; /Store the in_msg_context for sec_header extentions in trust/
	}
	}

	}
	}
	else
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-Not send -> RST Node building failed");
	return;
	}
	}

	return;
	}

	AXIS2_EXTERN axis2_svc_client_t *AXIS2_CALL
	trust_sts_client_get_svc_client(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	axis2_char_t * action,
	axis2_char_t *address_version,
	axis2_bool_t is_soap11)
	{
	axis2_endpoint_ref_t *endpoint_ref = NULL;
	axis2_options_t *options = NULL;
	axis2_svc_client_t *svc_client = NULL;

	endpoint_ref = axis2_endpoint_ref_create(env, sts_client->issuer_address);

	options = axis2_options_create(env);
	axis2_options_set_to(options, env, endpoint_ref);
	axis2_options_set_action(options, env, action);
	axis2_options_set_xml_parser_reset(options, env, AXIS2_FALSE);
	if(is_soap11)
	{
	axis2_options_set_soap_action(options, env, axutil_string_create(env, action));
	axis2_options_set_soap_version(options, env, AXIOM_SOAP11);
	}

	if(!(sts_client->svc_client))
	{
	svc_client = axis2_svc_client_create(env, sts_client->home_dir);
	sts_client->svc_client = svc_client;
	}
	else
	{
	svc_client = sts_client->svc_client;
	}

	if (!svc_client)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Stub invoke FAILED: Error code:" " %d :: %s",
	env->error->error_number, AXIS2_ERROR_GET_MESSAGE(env->error));
	return NULL;
	}

	/* Set service client options */
	axis2_svc_client_set_options(svc_client, env, options);

	/* Engage addressing module and rampart module */
	axis2_svc_client_engage_module(svc_client, env, AXIS2_MODULE_ADDRESSING);
	axis2_svc_client_engage_module(svc_client, env, RAMPART_RAMPART);

	/set the address version/
	if(address_version)
	{
	axutil_property_t *property = NULL;

	property = axutil_property_create(env);
	axutil_property_set_scope(property, env, AXIS2_SCOPE_APPLICATION);
	axutil_property_set_value(property, env, axutil_strdup(env, address_version));
	axis2_options_set_property(options, env, AXIS2_WSA_VERSION, property);
	}

	return svc_client;
	}

	AXIS2_EXTERN axis2_status_t AXIS2_CALL
	trust_sts_client_process_policies(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	neethi_policy_t * issuer_policy,
	neethi_policy_t * service_policy)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	if (issuer_policy)
	{
	sts_client->algo_suite = trust_policy_util_get_algorithmsuite(env, issuer_policy, &sts_client->sec_policy);
	}

	if (service_policy)
	{
	sts_client->trust10 = trust_policy_util_get_trust10(env, service_policy, &sts_client->sec_policy);
	}

	return AXIS2_SUCCESS;
	}


	AXIS2_EXTERN axis2_status_t AXIS2_CALL
	trust_sts_client_set_issuer_address(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	axis2_char_t * address)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
	AXIS2_PARAM_CHECK(env->error, address, AXIS2_FAILURE);

	sts_client->issuer_address = address;

	return AXIS2_SUCCESS;
	}

	AXIS2_EXTERN axis2_char_t *AXIS2_CALL
	trust_sts_client_get_issuer_address(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	return sts_client->issuer_address;
	}

	AXIS2_EXTERN axis2_status_t AXIS2_CALL
	trust_sts_client_set_home_dir(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	axis2_char_t * directory)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
	AXIS2_PARAM_CHECK(env->error, directory, AXIS2_FAILURE);

	sts_client->home_dir = directory;

	return AXIS2_SUCCESS;
	}

	AXIS2_EXTERN axis2_char_t *AXIS2_CALL
	trust_sts_client_get_home_dir(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	return sts_client->home_dir;
	}

	AXIS2_EXTERN axis2_status_t AXIS2_CALL
	trust_sts_client_set_issuer_policy_location(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	axis2_char_t * file_path)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
	AXIS2_PARAM_CHECK(env->error, file_path, AXIS2_FAILURE);

	sts_client->issuer_policy_location = file_path;

	return AXIS2_SUCCESS;
	}

	AXIS2_EXTERN axis2_char_t *AXIS2_CALL
	trust_sts_client_get_issuer_policy_location(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	return sts_client->issuer_policy_location;
	}

	AXIS2_EXTERN axis2_status_t AXIS2_CALL
	trust_sts_client_set_service_policy_location(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	axis2_char_t * file_path)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);
	AXIS2_PARAM_CHECK(env->error, file_path, AXIS2_FAILURE);

	sts_client->service_policy_location = file_path;

	return AXIS2_SUCCESS;
	}

	AXIS2_EXTERN axis2_char_t *AXIS2_CALL
	trust_sts_client_get_service_policy_location(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env)
	{
	AXIS2_ENV_CHECK(env, AXIS2_FAILURE);

	return sts_client->service_policy_location;
	}

	AXIS2_EXTERN oxs_buffer_t* AXIS2_CALL
	trust_sts_client_request_security_token_using_policy(
	trust_sts_client_t * sts_client,
	const axutil_env_t * env,
	trust_context_t *trust_context,
	neethi_policy_t *issuer_policy,
	axis2_char_t *address_version,
	axis2_bool_t is_soap11,
	rampart_context_t *rampart_context)
	{
	axis2_status_t status = AXIS2_SUCCESS;
	axiom_node_t *rst_node = NULL;
	axiom_node_t *return_node = NULL;
	axis2_op_client_t* op_client = NULL;
	axis2_msg_ctx_t *in_msg_ctx = NULL;


	/Action Logic/
	trust_rst_t *rst = NULL;
	axis2_char_t *request_type = NULL;
	axis2_char_t *wsa_action = NULL;

	trust_sts_client_process_policies(sts_client, env, issuer_policy, issuer_policy);

	/Action Logic - RequestType - used for specify the requesting action/
	rst = trust_context_get_rst(trust_context, env);
	if(NULL == rst)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST is NULL: Created RST_CTX may not set to TrustContest");
	return NULL;
	}

	request_type = trust_rst_get_request_type(rst, env);
	wsa_action = trust_rst_get_wsa_action(rst, env);

	if(NULL == request_type)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-RequestType is NOT set. RST MUST have a RequestType");
	return NULL;
	}

	if(NULL == wsa_action)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-WSA-Action is NOT set");
	}

	sts_client->svc_client =
	trust_sts_client_get_svc_client(sts_client, env, wsa_action, address_version, is_soap11);

	if (sts_client->svc_client)
	{
	/* if rampart context is set, we can set it to svc_client. This will be used by
	* scripting bindings to specify rampart specific values */
	if(rampart_context)
	{
	axis2_svc_ctx_t *svc_ctx = NULL;
	axis2_conf_ctx_t *conf_ctx = NULL;
	axis2_conf_t *conf = NULL;
	axutil_param_t *security_param = NULL;

	svc_ctx = axis2_svc_client_get_svc_ctx (sts_client->svc_client, env);
	conf_ctx = axis2_svc_ctx_get_conf_ctx (svc_ctx, env);
	conf = axis2_conf_ctx_get_conf (conf_ctx, env);
	security_param = axutil_param_create (
	env, RAMPART_CONFIGURATION, (void *)rampart_context);
	axis2_conf_add_param (conf, env, security_param);
	}

	if(issuer_policy)
	{
	status = axis2_svc_client_set_policy(sts_client->svc_client, env, issuer_policy);
	if (status == AXIS2_FAILURE)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Policy setting failed.");
	}

	/insert entropy if needed/
	trust_sts_client_insert_entropy(sts_client, env, rst);
	}

	/Building the RST /
	rst_node = trust_context_build_rst_node(trust_context, env);
	if(rst_node)
	{
	return_node = axis2_svc_client_send_receive(sts_client->svc_client, env, rst_node);
	sts_client->sent_rst_node = return_node;

	/Processing Response/
	if(!return_node)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] Return axiom node NULL");
	}
	else
	{
	/---- for debug ------/
	/axis2_char_t serialise_node = NULL;
	serialise_node = axiom_node_to_string(return_node, env);
	printf("sct reply is %s\n", serialise_node);*/
	/---- End for debug ------/


	/Processing IN_MSG_CONTEXT/
	op_client = axis2_svc_client_get_op_client(sts_client->svc_client, env);
	if(op_client)
	{
	in_msg_ctx = (axis2_msg_ctx_t *)axis2_op_client_get_msg_ctx (op_client, env, AXIS2_WSDL_MESSAGE_LABEL_IN);

	if(in_msg_ctx)
	{
	trust_context_process_rstr(trust_context, env, in_msg_ctx);
	sts_client->received_in_msg_ctx = in_msg_ctx; /Store the in_msg_context for sec_header extentions in trust/
	return trust_sts_client_compute_key(sts_client, env, rst, trust_context_get_rstr(trust_context, env));
	}
	}

	}
	}
	else
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] RST-Not send -> RST Node building failed");
	return NULL;
	}
	}

	return NULL;
	}

	static void
	trust_sts_client_insert_entropy(
	trust_sts_client_t *sts_client,
	const axutil_env_t *env,
	trust_rst_t *rst)
	{
	axis2_char_t *request_type = NULL;
	int key_size = 0;
	axis2_char_t *nonce = NULL;
	trust_entropy_t* entropy = NULL;

	request_type = trust_rst_get_request_type(rst, env);

	/we support entropy for issue only/
	if(0 != axutil_strcmp(request_type, TRUST_REQ_TYPE_ISSUE))
	return;

	/if entropy is already give, no need to create/
	if(trust_rst_get_entropy(rst, env))
	return;

	/if algorithm suite is missing or trust10 is missing, then we can't proceed/
	if((!sts_client->algo_suite) \|\| (!sts_client->trust10))
	return;

	/check whether client entropy is needed. If not can return/
	if(!rp_trust10_get_require_client_entropy(sts_client->trust10, env))
	return;

	key_size = rp_algorithmsuite_get_max_symmetric_keylength(sts_client->algo_suite, env);
	if (key_size <= 0)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] maximum symmetric key length of issuer algorithm suite is not valid");
	return;
	}

	/nonce should be created with half the size. size is in bits, have to convert it to bytes/
	nonce = oxs_util_generate_nonce(env, key_size/16);
	if(!nonce)
	{
	AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[trust] cannon create nonce with length %d", key_size/16);
	return;
	}

	entropy = trust_entropy_create(env);
	trust_entropy_set_binary_secret(entropy, env, nonce);
	trust_entropy_set_ns_uri(entropy, env, trust_rst_get_wst_ns_uri(rst, env));
	trust_entropy_set_binary_secret_type(entropy, env, NONCE);

	trust_rst_set_key_size(rst, env, key_size);
	trust_rst_set_entropy(rst, env, entropy);
	return;
	}

	static oxs_buffer_t*
	trust_sts_client_compute_key(trust_sts_client_t *sts_client,
	const axutil_env_t *env,
	trust_rst_t *rst,
	trust_rstr_t *rstr)
	{
	trust_entropy_t* requester_entropy = NULL;
	axiom_node_t *proof_token = NULL;

	/if rstr is not valid, then can't proceed/
	if(!rstr)
	return NULL;

	/if requester doesn't provide entropy, then no need to compute the key /
	requester_entropy = trust_rst_get_entropy(rst, env);
	if((!requester_entropy) \|\| (!trust_entropy_get_binary_secret(requester_entropy, env)))
	return NULL;

	/check the proof token whether to compute the token or not/
	proof_token = trust_rstr_get_requested_proof_token(rstr, env);

	/if issuer doesn't give a proof token/entropy, then requester_entropy is the key/
	if(!proof_token)
	{
	oxs_buffer_t *buffer = NULL;
	int decoded_len = 0;
	axis2_char_t *decoded_shared_secret = NULL;
	axis2_char_t* shared_secret = NULL;

	shared_secret = trust_entropy_get_binary_secret(requester_entropy, env);
	decoded_len = axutil_base64_decode_len(shared_secret);
	decoded_shared_secret = AXIS2_MALLOC(env->allocator, decoded_len);
	axutil_base64_decode_binary((unsigned char*)decoded_shared_secret, shared_secret);
	buffer = oxs_buffer_create(env);
	oxs_buffer_populate(buffer, env, (unsigned char*)decoded_shared_secret, decoded_len);
	AXIS2_FREE(env->allocator, decoded_shared_secret);
	return buffer;
	}
	else
	/proof token is available. We have to check the content of proof token/
	{
	axis2_char_t *local_name = NULL;
	axis2_char_t *compute_key_algo = NULL;
	trust_entropy_t* issuer_entropy = NULL;
	int key_size = 0;
	axis2_char_t *output = NULL;

	oxs_buffer_t *buffer = NULL;
	int requester_entropy_len = 0;
	axis2_char_t *decoded_requester_entropy = NULL;
	axis2_char_t *requester_nonce = NULL;
	int issuer_entropy_len = 0;
	axis2_char_t *decoded_issuer_entropy = NULL;
	axis2_char_t *issuer_nonce = NULL;

	local_name = axiom_util_get_localname(proof_token, env);
	/if local name is not ComputedKey, then we can return/
	if(axutil_strcmp(local_name, TRUST_COMPUTED_KEY) != 0)
	return NULL;

	key_size = trust_rst_get_key_size(rst, env)/8;
	if(key_size <= 0)
	return NULL;

	compute_key_algo = oxs_axiom_get_node_content(env, proof_token);

	buffer = oxs_buffer_create(env);
	requester_nonce = trust_entropy_get_binary_secret(requester_entropy, env);
	requester_entropy_len = axutil_base64_decode_len(requester_nonce);
	decoded_requester_entropy = AXIS2_MALLOC(env->allocator, requester_entropy_len);
	axutil_base64_decode_binary((unsigned char*)decoded_requester_entropy, requester_nonce);

	issuer_entropy = trust_rstr_get_entropy(rstr, env);

	/if issuer doesn't provide entropy, we can take requester entropy as key/
	if((!requester_entropy) \|\| (!trust_entropy_get_binary_secret(requester_entropy, env)))
	{
	oxs_buffer_populate(buffer, env, (unsigned char*)decoded_requester_entropy, requester_entropy_len);
	AXIS2_FREE(env->allocator, decoded_requester_entropy);
	return buffer;
	}

	issuer_nonce = trust_entropy_get_binary_secret(issuer_entropy, env);
	issuer_entropy_len = axutil_base64_decode_len(issuer_nonce);
	decoded_issuer_entropy = AXIS2_MALLOC(env->allocator, issuer_entropy_len);
	axutil_base64_decode_binary((unsigned char*)decoded_issuer_entropy, issuer_nonce);
	output = AXIS2_MALLOC(env->allocator, key_size);

	openssl_p_hash(env, (unsigned char*)decoded_requester_entropy, requester_entropy_len,
	(unsigned char*)decoded_issuer_entropy, issuer_entropy_len,
	(unsigned char*)output, key_size);
	oxs_buffer_populate(buffer, env, (unsigned char*)output, key_size);
	return buffer;
	}
	}