Cisco Unified Routing Rules XML Interface

« Back to Routing Rules API Questions

RE: Parsing XACML Request of CUCM

Combination View Flat View Tree View
Threads [ Previous | Next ]
Hi Team,
 
we recently encountered the potential of using those external call control profiles and as it seems they are being further enhanced and developped, .
So i'm trying to make some Tests with this feature.
 
I installed an Apache Webserver and tried to write a PHP-file, that should parse the CUCM routing request and send a Response back. After looking to most of the documentation i have a fairly good imagination of the schema, both for request and response.
 
Set up an ECCP and assigned it to a test-translationpattern the CUCM sends its requests to Apache.
In Access-Logs i see, CUCM sending its requests.
 
My problem is, i have no clue, how to read the CUCM request. As i understand it is a HTTP1.1 POST, but i do not know over which request-name i can do my $_GET[''], e.g. to get the callingnumber.... tried "callingnumber" and "urn:Cisco:uc:1.0:callingnumber"
 
Even so the CUCM sends periodically a Keep-Alive message via HTTP HEAD which should respond with:
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout = <TO> max = <count>
 
Here too, i do not know how to parse this HTTP HEAD request....
 
Does anyone have some hints or guides how to get the information out of those requests ?
Additionally some info on how to send responses would be much appreciated!! emoticon
 
Is Apache & PHP a suitable approach to this or should i try another architecture (ASP, JSP....) ?
 
Regards

hmmmm....
 
xmlrpc is no good idea i guess, i think i have to use SoapServer to handle requests.
although i still have no clue, how to retrieve the request-data...
 
$server = new SoapServer("lib/AXLAPI.wsdl");
$server->handle();
 
is the AXLAPI.wsdl the correct WSDL for this interface?
how do i proceed with this SoapServer to get the data?

ok, Soap was also the wrong approach....
 
read Header-Info sent by CUCM:
========================================
$header = "";
foreach (getallheaders() as $name => $value)
{
      $header = $header . $name.":::". $value."\n";           
}
echo $header;
 
 
read HTTP-Post Info sent by CUCM:
========================================
 
echo file_get_contents('php://input');
or
echo $GLOBALS['HTTP_RAW_POST_DATA'];
 
 
 
going on with trying to send Responses ;)

i guess, here i need some support...
 
the following will not work:
 
function sendResponse()
    {
        $Response =
        "<?xml encoding=\"UTF-8\" version=\"1.0\"?>\n".
        "<Response>\n".
        "<Result>\n".
        "<Decision>Permit</Decision>\n".
        "<Status></Status>\n".
        "<Obligations>\n".
        "<Obligation FulfillOn=\"Permit\¿\n".
        "ObligationId=\"urn:cisco:cepm:3.3:xacml:policy-attribute\">\n".
        "<AttributeAssignment AttributeId=\"Policy:simplecontinue\">\n".
        "<AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">\n".
        "<cixml ver=\"1.0\">\n".
        "<divert>\n".
        "<destination>162\n".
        "</destination>\n".
        "</divert>\n".
        "</cixml>\n".
        "</AttributeValue>\n".
        "</AttributeAssignment>\n".
        "</Obligation>\n".
        "</Obligations>\n".
        "</Result>\n".
        "</Response>";
               
        HttpResponse::status(200);
        HttpResponse::setContentType('text/xml');
        HttpResponse::setData($Response);
        HttpResponse::send();
}
 
also tried establishing a socket-connection on ports 80 and 8080 to CUCM, nothing works...
All i can see from Real-Time Monitoring Tool that the CUCM request didn't get a correct response...
 
please help me out with this one!!

i guess, here i need some support...
 
the following will not work:
 


also tried establishing a socket-connection on ports 80 and 8080 to CUCM, nothing works...
All i can see from Real-Time Monitoring Tool that the CUCM request didn't get a correct response...
 
please help me out with this one!!


 
Hi Stefan,
 
You had the misfortune to send this over a US holiday!
 
Note that you're not really needing to parse headers, but instead are pulling out an XML body attachment from the POST. I only glanced at your XML reply, but it did look like many of the appropriate headers were in place for the reply. So I think there may just be some missing pieces.
 
I'm curious, did you look at the sample Python application that's available here? It instantiates a Web server, pulls in the request, grabs the body, and then parses out the request. Based on the dialed number, it then returns a canned response of each type. Comparing this script's XML to your version may result in your being able to find the discrepancy.
 
Furthermore, I'll try to get in touch with an engineer I know who can take a look at this specific issue, though it will probably be Monday before I can really follow up with him.
Edit: just noticed an unusual character in "<Obligation FulfillOn=\"Permit\¿\n".
Could that be your problem?
 
Chris Pearce
Cisco Distinguished Engineer

Thanks for your answer Chris
 
a) parsing the header was only intended for Keep-Alive messages from CUCM
 
b) unfortunately i'm not familiar with Python. as far as i can tell the Python App builds a socket-connection to CUCM on Port 8080 / 8443 and sends the responses.... but my attempts to send a response via an open socket-connection on Port 8080 were unsuccessful. Here's my code for a socket-connection via PHP:
 
$Host = "<IP>";
writeLog("opening connection to host");
$socket = fsockopen($Host, 8080, &$errno, &$errstr);
if (!$socket)
{
   writeLog("ERROR: no connection to host");  
   return false;         
}
writeLog("connection open");
$idx = 0;
fputs($socket, $Response);
while (!feof($socket))
{
   $Result[$idx++] = fgets($socket, 128);
   writeLog("Result #".$idx.": ".$Result[$idx]);
}
writeLog("end socket-conn");
return true;
 
My Code seems to raise an exception at the fgets() in the while-loop because my logfiles never reache "Result #" or "end socket-conn".......
That's why i tried it with the HttpResponse class of PHP.
 
Replaced the unusual character you mentioned with " -> no work
Replaced the whole response with copy/paste from the Python app -> no work
 
Any help would be greatly appreciated because we have already several customers asking for specific features which could be served perfectly with this technology.
 
Regards

Thanks for your answer Chris
 
b) unfortunately i'm not familiar with Python. as far as i can tell the Python App builds a socket-connection to CUCM on Port 8080 / 8443 and sends the responses.... but my attempts to send a response via an open socket-connection on Port 8080 were unsuccessful. Here's my code for a socket-connection via PHP

 
As I mentioned, I'm a bit out-of-pocket until Monday, whereupon I can try to track down an engineer face-to-face. (In the meantime, I'll give good ol' email a try.) However, the Python SocketServer module is nice in that it's hiding some of the magic of the socket management through an abstraction layer. I'd be interested in if you could pull some traces from the UCM side, which should let me validate that UCM is, in fact, receiving the responses.
 
A couple of other comments: once the spurious character is removed, the structure of your XML looks fine, with a couple of issues.
 
First, I'm not exactly sure how the UCM-side response parser will deal with the embedded "\n"s. It -should-, but the CURRI interface was tested in the context of a specific server-side component.
 
Second, if you look at the XML responses in the Python code, you'll see that the values for the CIXML obligation are escaped! The <divert> or <continue> or <reject> obligations need to be encoded with &lt; and &gt; characters. The requirement to escape this part of the obligation was noted towards the end of the development cycle and, while there was an expressed desire that this simply should be a much saner embedded nested bunch of XML, I don't know that the code complete deadline permitted that particular bit of work.
 
All of this, of course, doesn't explain why your cut-n-pasted version from the Python script is having issues, but if you want to keep trying some different incantations before Monday, those might be places to push.
 
AFAIK, the engineers who implemented CURRI aren't PHP gurus either, but I'm 100% confident that they can, with traces, identify if and where UCM is choking on the reply.

Fortunately we're not in a hurry yet... so Monday/next week is no problem emoticon

Here's my latest Response:
$Response =
"<?xml encoding=\"UTF-8\" version=\"1.0\"?>".
"<Response><Result>".
"<Decision>Permit</Decision>".
"<Obligations><Obligation FulfillOn=\"Permit\" ObligationId=\"continue.simple\">".
"<AttributeAssignment AttributeId=\"Policy:continue.simple\">".
"<AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">".
"&lt;cixml ver=\"1.0\"&gt;&lt;divert&gt;".
"&lt;destination&gt;162&lt;/destination&gt;".
"&lt;/divert&gt;".
"&lt;reason&gt;chaperone&lt;/reason&gt;".
"&lt;/cixml&gt;".
"</AttributeValue></AttributeAssignment>".
"</Obligation></Obligations></Result></Response>";


As you can see i'm not using any "\n"s anymore and the mentioned values are escaped.

I did some digging in the wide & deep CUCM logs. All i have found was this line in the CCM SDI log:
15:42:01.193 |ConnectionFailureToPDP - A connection request from Unified CM to the policy decision point failed Policy Decision Point:http://<IP>:80/_test_eccp.php The cause of the connection failure:No response from PDP App ID:Cisco CallManager Cluster ID:StandAloneCluster Node ID:<NODE>|Alarm^*^*
 
So CUCM did not get a response...

Strange thing about this line:
i can NOT reproduce it...
even if i test my script 10 times, wait 5mins and grab the new logfile via RTMT, this line does not appear anymore.

======================
Did set up my Apache with mod_python & interpreter and uploaded the samplePolicyApp (with minor changes to test).
Works!!
But for dynamical reasons and me being absolute beginner with python (especially when challenging a MySQL-Demoticon i would rather stick to PHP.

Fortunately we're not in a hurry yet... so Monday/next week is no problem

Here's my latest Response:


As you can see i'm not using any "\n"s anymore and the mentioned values are escaped.

I did some digging in the wide & deep CUCM logs. All i have found was this line in the CCM SDI log:
15:42:01.193 |ConnectionFailureToPDP - A connection request from Unified CM to the policy decision point failed Policy Decision Point:http://<IP>:80/_test_eccp.php The cause of the connection failure:No response from PDP App ID:Cisco CallManager Cluster ID:StandAloneCluster Node ID:<NODE>|Alarm^*^*
 
So CUCM did not get a response...

Strange thing about this line:
i can NOT reproduce it...
even if i test my script 10 times, wait 5mins and grab the new logfile via RTMT, this line does not appear anymore.

======================
Did set up my Apache with mod_python & interpreter and uploaded the samplePolicyApp (with minor changes to test).
Works!!
But for dynamical reasons and me being absolute beginner with python (especially when challenging a MySQL-D i would rather stick to PHP.


 
Most curious. Your formatted response looks pretty much like what the Python script is composing. In the error you received, the "PDP" is actually your Web service, and I would interpret that error to mean that UCM couldn't even establish the TCP connection to your service. Do the logs on your Web server show the connection? Are you getting output from your service?
 
In the trace line, I see <IP>:80. Did you redact your IP address? If no, then, yep, I could see why there might be a problem, as the ECC Profile needs to actually have a routable IP address or domain name.
 
Just ruling out some other possible issues: especially with the <divert> option and <continue> option, you'll need to have defined some sort of directory number or pattern to actually receive the call in question. And, to be honest, I think it will be a good idea at some point to remove the <reason>chaperone</reason> stuff from the diversion reply--that's a niche feature--but I don't want to tweak that until we can determine exactly what's up with the connection.
 
No worries about using PHP--I mean, all UCM cares about is that the HTTP connection is working and that the headers and body responses are conforming to the expected schema. The server side could be any Web service infrastructure.
 
Chris Pearce
Cisco Distinguished Engineer

Most curious. Your formatted response looks pretty much like
what the Python script is composing. In the error you received, the
"PDP" is actually your Web service, and I would interpret that error to
mean that UCM couldn't even establish the TCP connection to your
service. Do the logs on your Web server show the connection? Are you
getting output from your service?

The connection is established. I'm able to parse the POST from CUCM.
 
 
In
the trace line, I see <IP>:80. Did you redact your IP address? If
no, then, yep, I could see why there might be a problem, as the ECC
Profile needs to actually have a routable IP address or domain
name.

Yep, i redacted the IP emoticon
 
Just
ruling out some other possible issues: especially with the
<divert> option and <continue> option, you'll need to have
defined some sort of directory number or pattern to actually receive
the call in question. And, to be honest, I think it will be a good idea
at some point to remove the <reason>chaperone</reason>
stuff from the diversion reply--that's a niche feature--but I don't
want to tweak that until we can determine exactly what's up with the
connection.

Also tried it without the <reason>... didn't work either
 
I don't think the problem is on the XML-side... i guess it's just the way i'm trying to send the response back to CUCM.



Most curious. Your formatted response looks pretty much like



I don't think the problem is on the XML-side... i guess it's just the way i'm trying to send the response back to CUCM.

 
That's the conclusion that I'm coming to as well.
 
I've got an engineer who would be happy to look at the SDI and SDL traces and analyze the issue in more detail. Is there an email address at which he can get in touch with you?
 
Chris Pearce
Cisco Distinguished Engineer

sure!
how can i send you a PM ?

for the interested ones:
 
if you are using apache & php for this technique you simple have to output the decision for CUCM:
 
$Response =
        "<?xml encoding=\"UTF-8\" version=\"1.0\" ?>".
        "<Response><Result>".
        "<Decision>Permit</Decision>".
        "<Obligations><Obligation FulfillOn=\"Permit\" ObligationId=\"continue.simple\">".
        "<AttributeAssignment AttributeId=\"Policy:continue.simple\">".
        "<AttributeValue DataType=\"http://www.w3.org/2001/XMLSchema#string\">".
        "&lt;cixml ver=\"1.0\"&gt;&lt;divert&gt;".
        "&lt;destination&gt;1000&lt;/destination&gt;".
        "&lt;/divert&gt;".
        "&lt;reason&gt;chaperone&lt;/reason&gt;".
        "&lt;/cixml&gt;".
        "</AttributeValue></AttributeAssignment>".
        "</Obligation></Obligations></Result></Response>";
echo $Response;
 
don't forget to escape the "<" and ">" in the cixml-section!!
best you get the samplePolicyApp, open the .py with notepad and copy the response-templates