src/core/sipe-svc.c

   1 /**
   2  * @file sipe-svc.c
   3  *
   4  * pidgin-sipe
   5  *
   6  * Copyright (C) 2011-12 SIPE Project <http://sipe.sourceforge.net/>
   7  *
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  22  *
  23  *
  24  * Specification references:
  25  *
  26  *   - [MS-SIPAE]:    http://msdn.microsoft.com/en-us/library/cc431510.aspx
  27  *   - [MS-OCAUTHWS]: http://msdn.microsoft.com/en-us/library/ff595592.aspx
  28  *   - MS Tech-Ed Europe 2010 "UNC310: Microsoft Lync 2010 Technology Explained"
  29  *     http://ecn.channel9.msdn.com/o9/te/Europe/2010/pptx/unc310.pptx
  30  */
  31
  32 #include <stdlib.h>
  33 #include <string.h>
  34
  35 #include <glib.h>
  36
  37 #include "sipe-common.h"
  38 #include "http-conn.h"
  39 #include "sipe-backend.h"
  40 #include "sipe-core.h"
  41 #include "sipe-core-private.h"
  42 #include "sipe-svc.h"
  43 #include "sipe-tls.h"
  44 #include "sipe-utils.h"
  45 #include "sipe-xml.h"
  46 #include "uuid.h"
  47
  48 /* forward declaration */
  49 struct svc_request;
  50 typedef void (svc_callback)(struct svc_request *data,
  51                             const gchar *raw,
  52                             sipe_xml *xml);
  53
  54 struct svc_request {
  55         struct sipe_core_private *sipe_private;
  56         svc_callback *internal_cb;
  57         sipe_svc_callback *cb;
  58         gpointer *cb_data;
  59         HttpConn *conn;
  60         HttpConnAuth auth;
  61         gchar *uri;
  62         gchar *soap_action;
  63 };
  64
  65 struct sipe_svc {
  66         GSList *pending_requests;
  67 };
  68
  69 struct sipe_svc_session {
  70         HttpSession *session;
  71 };
  72
  73 static void sipe_svc_request_free(struct svc_request *data)
  74 {
  75         if (data->conn)
  76                 http_conn_free(data->conn);
  77         if (data->cb)
  78                 /* Callback: aborted */
  79                 (*data->cb)(data->sipe_private, NULL, NULL, NULL, data->cb_data);
  80         g_free(data->soap_action);
  81         g_free(data->uri);
  82         g_free(data);
  83 }
  84
  85 void sipe_svc_free(struct sipe_core_private *sipe_private)
  86 {
  87         struct sipe_svc *svc = sipe_private->svc;
  88         if (!svc)
  89                 return;
  90
  91         if (svc->pending_requests) {
  92                 GSList *entry = svc->pending_requests;
  93                 while (entry) {
  94                         sipe_svc_request_free(entry->data);
  95                         entry = entry->next;
  96                 }
  97                 g_slist_free(svc->pending_requests);
  98         }
  99
 100         g_free(svc);
 101         sipe_private->svc = NULL;
 102 }
 103
 104 static void sipe_svc_init(struct sipe_core_private *sipe_private)
 105 {
 106         if (sipe_private->svc)
 107                 return;
 108
 109         sipe_private->svc = g_new0(struct sipe_svc, 1);
 110 }
 111
 112 struct sipe_svc_session *sipe_svc_session_start(void)
 113 {
 114         struct sipe_svc_session *session = g_new0(struct sipe_svc_session, 1);
 115         session->session = http_conn_session_create();
 116         return(session);
 117 }
 118
 119 void sipe_svc_session_close(struct sipe_svc_session *session)
 120 {
 121         if (session) {
 122                 http_conn_session_free(session->session);
 123                 g_free(session);
 124         }
 125 }
 126
 127 static void sipe_svc_https_response(int return_code,
 128                                     const gchar *body,
 129                                     SIPE_UNUSED_PARAMETER GSList *headers,
 130                                     HttpConn *conn,
 131                                     void *callback_data)
 132 {
 133         struct svc_request *data = callback_data;
 134         struct sipe_svc *svc = data->sipe_private->svc;
 135
 136         SIPE_DEBUG_INFO("sipe_svc_https_response: code %d", return_code);
 137         http_conn_set_close(conn);
 138         data->conn = NULL;
 139
 140         if ((return_code == 200) && body) {
 141                 sipe_xml *xml = sipe_xml_parse(body, strlen(body));
 142                 /* Internal callback: success */
 143                 (*data->internal_cb)(data, body, xml);
 144                 sipe_xml_free(xml);
 145         } else {
 146                 /* Internal callback: failed */
 147                 (*data->internal_cb)(data, NULL, NULL);
 148         }
 149
 150         /* Internal callback has already called this */
 151         data->cb = NULL;
 152
 153         svc->pending_requests = g_slist_remove(svc->pending_requests,
 154                                                data);
 155         sipe_svc_request_free(data);
 156 }
 157
 158 static gboolean sipe_svc_https_request(struct sipe_core_private *sipe_private,
 159                                        const gchar *method,
 160                                        struct sipe_svc_session *session,
 161                                        const gchar *uri,
 162                                        const gchar *content_type,
 163                                        const gchar *soap_action,
 164                                        const gchar *body,
 165                                        svc_callback *internal_callback,
 166                                        sipe_svc_callback *callback,
 167                                        gpointer callback_data)
 168 {
 169         struct svc_request *data = g_new0(struct svc_request, 1);
 170         gboolean ret = FALSE;
 171
 172         data->sipe_private = sipe_private;
 173         data->uri          = g_strdup(uri);
 174
 175         if (soap_action)
 176                 data->soap_action = g_strdup_printf("SOAPAction: \"%s\"\r\n",
 177                                                     soap_action);
 178
 179         /* re-use SIP credentials */
 180         data->auth.domain   = sipe_private->authdomain;
 181         data->auth.user     = sipe_private->authuser ? sipe_private->authuser : sipe_private->username;
 182         data->auth.password = sipe_private->password;
 183
 184         data->conn = http_conn_create(SIPE_CORE_PUBLIC,
 185                                       session->session,
 186                                       method,
 187                                       HTTP_CONN_SSL,
 188                                       HTTP_CONN_NO_REDIRECT,
 189                                       uri,
 190                                       body,
 191                                       content_type,
 192                                       data->soap_action,
 193                                       &data->auth,
 194                                       sipe_svc_https_response,
 195                                       data);
 196
 197         if (data->conn) {
 198                 data->internal_cb = internal_callback;
 199                 data->cb          = callback;
 200                 data->cb_data     = callback_data;
 201                 sipe_svc_init(sipe_private);
 202                 sipe_private->svc->pending_requests = g_slist_prepend(sipe_private->svc->pending_requests,
 203                                                                       data);
 204                 ret = TRUE;
 205         } else {
 206                 SIPE_DEBUG_ERROR("failed to create HTTP connection to %s", uri);
 207                 sipe_svc_request_free(data);
 208         }
 209
 210         return(ret);
 211 }
 212
 213 static gboolean sipe_svc_wsdl_request(struct sipe_core_private *sipe_private,
 214                                       struct sipe_svc_session *session,
 215                                       const gchar *uri,
 216                                       const gchar *additional_ns,
 217                                       const gchar *soap_action,
 218                                       const gchar *wsse_security,
 219                                       const gchar *soap_body,
 220                                       svc_callback *internal_callback,
 221                                       sipe_svc_callback *callback,
 222                                       gpointer callback_data)
 223 {
 224         /* Only generate SOAP header if we have a security token */
 225         gchar *soap_header = wsse_security ?
 226                 g_strdup_printf("<soap:Header>"
 227                                 " <wsa:To>%s</wsa:To>"
 228                                 " <wsa:ReplyTo>"
 229                                 "  <wsa:Address>http://www.w3.org/2005/08/addressing/anonymous</wsa:Address>"
 230                                 " </wsa:ReplyTo>"
 231                                 " <wsa:Action>%s</wsa:Action>"
 232                                 " <wsse:Security>%s</wsse:Security>"
 233                                 "</soap:Header>",
 234                                 uri,
 235                                 soap_action,
 236                                 wsse_security) :
 237                 g_strdup("");
 238         gchar *body = g_strdup_printf("<?xml version=\"1.0\"?>\r\n"
 239                                       "<soap:Envelope %s"
 240                                       " xmlns:auth=\"http://schemas.xmlsoap.org/ws/2006/12/authorization\""
 241                                       " xmlns:wsa=\"http://www.w3.org/2005/08/addressing\""
 242                                       " xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\""
 243                                       " xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\""
 244                                       " xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\""
 245                                       " >"
 246                                       "%s"
 247                                       " <soap:Body>%s</soap:Body>"
 248                                       "</soap:Envelope>",
 249                                       additional_ns,
 250                                       soap_header,
 251                                       soap_body);
 252
 253         gboolean ret = sipe_svc_https_request(sipe_private,
 254                                               HTTP_CONN_POST,
 255                                               session,
 256                                               uri,
 257                                               "text/xml",
 258                                               soap_action,
 259                                               body,
 260                                               internal_callback,
 261                                               callback,
 262                                               callback_data);
 263         g_free(soap_header);
 264         g_free(body);
 265
 266         return(ret);
 267 }
 268
 269 static gboolean new_soap_req(struct sipe_core_private *sipe_private,
 270                              struct sipe_svc_session *session,
 271                              const gchar *uri,
 272                              const gchar *soap_action,
 273                              const gchar *wsse_security,
 274                              const gchar *soap_body,
 275                              svc_callback *internal_callback,
 276                              sipe_svc_callback *callback,
 277                              gpointer callback_data)
 278 {
 279         return(sipe_svc_wsdl_request(sipe_private,
 280                                      session,
 281                                      uri,
 282                                      "xmlns:saml=\"urn:oasis:names:tc:SAML:1.0:assertion\" "
 283                                      "xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 284                                      "xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\"",
 285                                      soap_action,
 286                                      wsse_security,
 287                                      soap_body,
 288                                      internal_callback,
 289                                      callback,
 290                                      callback_data));
 291 }
 292
 293 static void sipe_svc_wsdl_response(struct svc_request *data,
 294                                    const gchar *raw,
 295                                    sipe_xml *xml)
 296 {
 297         if (xml) {
 298                 /* Callback: success */
 299                 (*data->cb)(data->sipe_private, data->uri, raw, xml, data->cb_data);
 300         } else {
 301                 /* Callback: failed */
 302                 (*data->cb)(data->sipe_private, data->uri, NULL, NULL, data->cb_data);
 303         }
 304 }
 305
 306 gboolean sipe_svc_get_and_publish_cert(struct sipe_core_private *sipe_private,
 307                                        struct sipe_svc_session *session,
 308                                        const gchar *uri,
 309                                        const gchar *wsse_security,
 310                                        const gchar *certreq,
 311                                        sipe_svc_callback *callback,
 312                                        gpointer callback_data)
 313 {
 314         struct sipe_tls_random id;
 315         gchar *id_base64;
 316         gchar *id_uuid;
 317         gchar *uuid = get_uuid(sipe_private);
 318         gchar *soap_body;
 319         gboolean ret;
 320
 321         /* random request ID */
 322         sipe_tls_fill_random(&id, 256);
 323         id_base64 = g_base64_encode(id.buffer, id.length);
 324         sipe_tls_free_random(&id);
 325         id_uuid = generateUUIDfromEPID(id_base64);
 326         g_free(id_base64);
 327
 328         soap_body = g_strdup_printf("<GetAndPublishCert"
 329                                     " xmlns=\"http://schemas.microsoft.com/OCS/AuthWebServices/\""
 330                                     " xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/\""
 331                                     " xmlns:wstep=\"http://schemas.microsoft.com/windows/pki/2009/01/enrollment\""
 332                                     " DeviceId=\"{%s}\""
 333                                     " Entity=\"%s\""
 334                                     ">"
 335                                     " <wst:RequestSecurityToken>"
 336                                     "  <wst:TokenType>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3</wst:TokenType>"
 337                                     "  <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>"
 338                                     "  <wsse:BinarySecurityToken"
 339                                     "   ValueType=\"http://schemas.microsoft.com/OCS/AuthWebServices.xsd#PKCS10\""
 340                                     "   EncodingType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#Base64Binary\""
 341                                     "  >\r\n%s</wsse:BinarySecurityToken>"
 342                                     "  <wstep:RequestID>%s</wstep:RequestID>"
 343                                     " </wst:RequestSecurityToken>"
 344                                     "</GetAndPublishCert>",
 345                                     uuid,
 346                                     sipe_private->username,
 347                                     certreq,
 348                                     id_uuid);
 349         g_free(id_uuid);
 350         g_free(uuid);
 351
 352         ret = new_soap_req(sipe_private,
 353                            session,
 354                            uri,
 355                            "http://schemas.microsoft.com/OCS/AuthWebServices/GetAndPublishCert",
 356                            wsse_security,
 357                            soap_body,
 358                            sipe_svc_wsdl_response,
 359                            callback,
 360                            callback_data);
 361         g_free(soap_body);
 362
 363         return(ret);
 364 }
 365
 366 gboolean sipe_svc_ab_entry_request(struct sipe_core_private *sipe_private,
 367                                    struct sipe_svc_session *session,
 368                                    const gchar *uri,
 369                                    const gchar *wsse_security,
 370                                    const gchar *search,
 371                                    guint entries,
 372                                    guint max_returns,
 373                                    sipe_svc_callback *callback,
 374                                    gpointer callback_data)
 375 {
 376         gboolean ret;
 377         gchar *soap_body = g_strdup_printf("<SearchAbEntry"
 378                                            " xmlns=\"DistributionListExpander\""
 379                                            " xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\""
 380                                            " xmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\""
 381                                            ">"
 382                                            " <AbEntryRequest>"
 383                                            "  <ChangeSearch xmlns:q1=\"DistributionListExpander\" soapenc:arrayType=\"q1:AbEntryRequest.ChangeSearchQuery[%d]\">"
 384                                            "   %s"
 385                                            "  </ChangeSearch>"
 386                                            "  <Metadata>"
 387                                            "   <FromDialPad>false</FromDialPad>"
 388                                            "   <MaxResultNum>%d</MaxResultNum>"
 389                                            "   <ReturnList>displayName,msRTCSIP-PrimaryUserAddress,title,telephoneNumber,homePhone,mobile,otherTelephone,mail,company,country,photoRelPath,photoSize,photoHash</ReturnList>"
 390                                            "  </Metadata>"
 391                                            " </AbEntryRequest>"
 392                                            "</SearchAbEntry>",
 393                                            entries,
 394                                            search,
 395                                            max_returns);
 396
 397         ret = new_soap_req(sipe_private,
 398                            session,
 399                            uri,
 400                            "DistributionListExpander/IAddressBook/SearchAbEntry",
 401                            wsse_security,
 402                            soap_body,
 403                            sipe_svc_wsdl_response,
 404                            callback,
 405                            callback_data);
 406         g_free(soap_body);
 407
 408         return(ret);
 409 }
 410
 411 /*
 412  * This functions encodes what the Microsoft Lync client does for
 413  * Office365 accounts. It will most definitely fail for internal Lync
 414  * installation that use TLS-DSK instead of NTLM.
 415  *
 416  * But for those anonymous authentication should already have succeeded.
 417  * I guess we'll have to see what happens in real life...
 418  */
 419 gboolean sipe_svc_webticket_lmc(struct sipe_core_private *sipe_private,
 420                                 struct sipe_svc_session *session,
 421                                 const gchar *service_uri,
 422                                 sipe_svc_callback *callback,
 423                                 gpointer callback_data)
 424 {
 425         /* login.microsoftonline.com seems only to accept cleartext passwords :/ */
 426         gchar *security = g_strdup_printf("<wsse:UsernameToken>"
 427                                           " <wsse:Username>%s</wsse:Username>"
 428                                           " <wsse:Password>%s</wsse:Password>"
 429                                           "</wsse:UsernameToken>",
 430                                           sipe_private->username,
 431                                           sipe_private->password);
 432
 433         gchar *soap_body = g_strdup_printf("<ps:RequestMultipleSecurityTokens>"
 434                                            " <wst:RequestSecurityToken>"
 435                                            "  <wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>"
 436                                            "  <wsp:AppliesTo>"
 437                                            "   <wsa:EndpointReference>"
 438                                            "    <wsa:Address>%s</wsa:Address>"
 439                                            "   </wsa:EndpointReference>"
 440                                            "  </wsp:AppliesTo>"
 441                                            " </wst:RequestSecurityToken>"
 442                                            "</ps:RequestMultipleSecurityTokens>",
 443                                            service_uri);
 444
 445         gboolean ret = sipe_svc_wsdl_request(sipe_private,
 446                                              session,
 447                                              "https://login.microsoftonline.com:443/RST2.srf",
 448                                              "xmlns:ps=\"http://schemas.microsoft.com/Passport/SoapServices/PPCRL\" "
 449                                              "xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\" "
 450                                              "xmlns:wst=\"http://schemas.xmlsoap.org/ws/2005/02/trust\"",
 451                                              "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue",
 452                                              security,
 453                                              soap_body,
 454                                              sipe_svc_wsdl_response,
 455                                              callback,
 456                                              callback_data);
 457         g_free(soap_body);
 458         g_free(security);
 459
 460         return(ret);
 461 }
 462
 463 gboolean sipe_svc_webticket(struct sipe_core_private *sipe_private,
 464                             struct sipe_svc_session *session,
 465                             const gchar *uri,
 466                             const gchar *wsse_security,
 467                             const gchar *service_uri,
 468                             const struct sipe_tls_random *entropy,
 469                             sipe_svc_callback *callback,
 470                             gpointer callback_data)
 471 {
 472         gchar *uuid = get_uuid(sipe_private);
 473         gchar *security = NULL;
 474         gchar *secret = g_base64_encode(entropy->buffer, entropy->length);
 475         gchar *soap_body = g_strdup_printf("<wst:RequestSecurityToken Context=\"%s\">"
 476                                            " <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</wst:TokenType>"
 477                                            " <wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>"
 478                                            " <wsp:AppliesTo>"
 479                                            "  <wsa:EndpointReference>"
 480                                            "   <wsa:Address>%s</wsa:Address>"
 481                                            "  </wsa:EndpointReference>"
 482                                            " </wsp:AppliesTo>"
 483                                            " <wst:Claims Dialect=\"urn:component:Microsoft.Rtc.WebAuthentication.2010:authclaims\">"
 484                                            "  <auth:ClaimType Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uri\" Optional=\"false\">"
 485                                            "   <auth:Value>sip:%s</auth:Value>"
 486                                            "  </auth:ClaimType>"
 487                                            " </wst:Claims>"
 488                                            " <wst:Entropy>"
 489                                            "  <wst:BinarySecret>%s</wst:BinarySecret>"
 490                                            " </wst:Entropy>"
 491                                            " <wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</wst:KeyType>"
 492                                            "</wst:RequestSecurityToken>",
 493                                            uuid,
 494                                            service_uri,
 495                                            sipe_private->username,
 496                                            secret);
 497
 498         gboolean ret = new_soap_req(sipe_private,
 499                                     session,
 500                                     uri,
 501                                     "http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue",
 502                                     wsse_security,
 503                                     soap_body,
 504                                     sipe_svc_wsdl_response,
 505                                     callback,
 506                                     callback_data);
 507         g_free(soap_body);
 508         g_free(secret);
 509         g_free(security);
 510         g_free(uuid);
 511
 512         return(ret);
 513 }
 514
 515 static void sipe_svc_metadata_response(struct svc_request *data,
 516                                        const gchar *raw,
 517                                        sipe_xml *xml)
 518 {
 519         if (xml) {
 520                 /* Callback: success */
 521                 (*data->cb)(data->sipe_private, data->uri, raw, xml, data->cb_data);
 522         } else {
 523                 /* Callback: failed */
 524                 (*data->cb)(data->sipe_private, data->uri, NULL, NULL, data->cb_data);
 525         }
 526 }
 527
 528 gboolean sipe_svc_metadata(struct sipe_core_private *sipe_private,
 529                            struct sipe_svc_session *session,
 530                            const gchar *uri,
 531                            sipe_svc_callback *callback,
 532                            gpointer callback_data)
 533 {
 534         gchar *mex_uri = g_strdup_printf("%s/mex", uri);
 535         gboolean ret = sipe_svc_https_request(sipe_private,
 536                                               HTTP_CONN_GET,
 537                                               session,
 538                                               mex_uri,
 539                                               "text",
 540                                               NULL,
 541                                               NULL,
 542                                               sipe_svc_metadata_response,
 543                                               callback,
 544                                               callback_data);
 545         g_free(mex_uri);
 546         return(ret);
 547 }
 548
 549 /*
 550   Local Variables:
 551   mode: c
 552   c-file-style: "bsd"
 553   indent-tabs-mode: t
 554   tab-width: 8
 555   End:
 556 */