Store custom IKE src/dst ports on ike_cfg
[strongswan.git] / src / charon / plugins / load_tester / load_tester_config.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "load_tester_config.h"
17
18 #include <daemon.h>
19
20 typedef struct private_load_tester_config_t private_load_tester_config_t;
21
22 /**
23 * Private data of an load_tester_config_t object
24 */
25 struct private_load_tester_config_t {
26
27 /**
28 * Public part
29 */
30 load_tester_config_t public;
31
32 /**
33 * peer config
34 */
35 peer_cfg_t *peer_cfg;
36
37 /**
38 * virtual IP, if any
39 */
40 host_t *vip;
41
42 /**
43 * Remote address
44 */
45 char *remote;
46
47 /**
48 * IP address pool
49 */
50 char *pool;
51
52 /**
53 * IKE proposal
54 */
55 proposal_t *proposal;
56
57 /**
58 * Authentication method(s) to use/expect from initiator
59 */
60 char *initiator_auth;
61
62 /**
63 * Authentication method(s) use/expected from responder
64 */
65 char *responder_auth;
66
67 /**
68 * IKE_SA rekeying delay
69 */
70 u_int ike_rekey;
71
72 /**
73 * CHILD_SA rekeying delay
74 */
75 u_int child_rekey;
76
77 /**
78 * incremental numbering of generated configs
79 */
80 u_int num;
81 };
82
83 /**
84 * Generate auth config from string
85 */
86 static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
87 peer_cfg_t *peer_cfg, bool local, int num)
88 {
89 enumerator_t *enumerator;
90 auth_cfg_t *auth;
91 identification_t *id;
92 auth_class_t class;
93 eap_type_t type;
94 char buf[128];
95 int rnd = 0;
96
97 enumerator = enumerator_create_token(str, "|", " ");
98 while (enumerator->enumerate(enumerator, &str))
99 {
100 auth = auth_cfg_create();
101 rnd++;
102
103 if (streq(str, "psk"))
104 { /* PSK authentication, use FQDNs */
105 class = AUTH_CLASS_PSK;
106 if ((local && !num) || (!local && num))
107 {
108 id = identification_create_from_string("srv.strongswan.org");
109 }
110 else if (local)
111 {
112 snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org", num, rnd);
113 id = identification_create_from_string(buf);
114 }
115 else
116 {
117 id = identification_create_from_string("*.strongswan.org");
118 }
119 }
120 else if (strneq(str, "eap", strlen("eap")))
121 { /* EAP authentication, use a NAI */
122 class = AUTH_CLASS_EAP;
123 if (*(str + strlen("eap")) == '-')
124 {
125 type = eap_type_from_string(str + strlen("eap-"));
126 if (type)
127 {
128 auth->add(auth, AUTH_RULE_EAP_TYPE, type);
129 }
130 }
131 if (local && num)
132 {
133 snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org", num, rnd);
134 id = identification_create_from_string(buf);
135 }
136 else
137 {
138 id = identification_create_from_encoding(ID_ANY, chunk_empty);
139 }
140 }
141 else
142 {
143 if (!streq(str, "pubkey"))
144 {
145 DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
146 str);
147 }
148 /* certificate authentication, use distinguished names */
149 class = AUTH_CLASS_PUBKEY;
150 if ((local && !num) || (!local && num))
151 {
152 id = identification_create_from_string(
153 "CN=srv, OU=load-test, O=strongSwan");
154 }
155 else if (local)
156 {
157 snprintf(buf, sizeof(buf),
158 "CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
159 id = identification_create_from_string(buf);
160 }
161 else
162 {
163 id = identification_create_from_string(
164 "CN=*, OU=load-test, O=strongSwan");
165 }
166 }
167 auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
168 auth->add(auth, AUTH_RULE_IDENTITY, id);
169 peer_cfg->add_auth_cfg(peer_cfg, auth, local);
170 }
171 enumerator->destroy(enumerator);
172 }
173
174 /**
175 * Generate a new initiator config, num = 0 for responder config
176 */
177 static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
178 {
179 ike_cfg_t *ike_cfg;
180 child_cfg_t *child_cfg;
181 peer_cfg_t *peer_cfg;
182 traffic_selector_t *ts;
183 proposal_t *proposal;
184 lifetime_cfg_t lifetime = {
185 .time = {
186 .life = this->child_rekey * 2,
187 .rekey = this->child_rekey,
188 .jitter = 0
189 }
190 };
191
192 ike_cfg = ike_cfg_create(FALSE, FALSE,
193 "0.0.0.0", IKEV2_UDP_PORT, this->remote, IKEV2_UDP_PORT);
194 ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
195 peer_cfg = peer_cfg_create("load-test", 2, ike_cfg,
196 CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
197 this->ike_rekey, 0, /* rekey, reauth */
198 0, this->ike_rekey, /* jitter, overtime */
199 FALSE, 0, /* mobike, dpddelay */
200 this->vip ? this->vip->clone(this->vip) : NULL,
201 this->pool, FALSE, NULL, NULL);
202 if (num)
203 { /* initiator */
204 generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
205 generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
206 }
207 else
208 { /* responder */
209 generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
210 generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
211 }
212
213 child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE,
214 MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE, 0);
215 proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
216 child_cfg->add_proposal(child_cfg, proposal);
217 ts = traffic_selector_create_dynamic(0, 0, 65535);
218 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
219 ts = traffic_selector_create_dynamic(0, 0, 65535);
220 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
221 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
222 return peer_cfg;
223 }
224
225 /**
226 * Implementation of backend_t.create_peer_cfg_enumerator.
227 */
228 static enumerator_t* create_peer_cfg_enumerator(private_load_tester_config_t *this,
229 identification_t *me,
230 identification_t *other)
231 {
232 return enumerator_create_single(this->peer_cfg, NULL);
233 }
234
235 /**
236 * Implementation of backend_t.create_ike_cfg_enumerator.
237 */
238 static enumerator_t* create_ike_cfg_enumerator(private_load_tester_config_t *this,
239 host_t *me, host_t *other)
240 {
241 ike_cfg_t *ike_cfg;
242
243 ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
244 return enumerator_create_single(ike_cfg, NULL);
245 }
246
247 /**
248 * implements backend_t.get_peer_cfg_by_name.
249 */
250 static peer_cfg_t *get_peer_cfg_by_name(private_load_tester_config_t *this,
251 char *name)
252 {
253 if (streq(name, "load-test"))
254 {
255 return generate_config(this, this->num++);
256 }
257 return NULL;
258 }
259
260 /**
261 * Implementation of load_tester_config_t.destroy.
262 */
263 static void destroy(private_load_tester_config_t *this)
264 {
265 this->peer_cfg->destroy(this->peer_cfg);
266 DESTROY_IF(this->proposal);
267 DESTROY_IF(this->vip);
268 free(this);
269 }
270
271 /**
272 * Described in header.
273 */
274 load_tester_config_t *load_tester_config_create()
275 {
276 private_load_tester_config_t *this = malloc_thing(private_load_tester_config_t);
277
278 this->public.backend.create_peer_cfg_enumerator = (enumerator_t*(*)(backend_t*, identification_t *me, identification_t *other))create_peer_cfg_enumerator;
279 this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
280 this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
281 this->public.destroy = (void(*)(load_tester_config_t*))destroy;
282
283 this->vip = NULL;
284 if (lib->settings->get_bool(lib->settings,
285 "charon.plugins.load-tester.request_virtual_ip", FALSE))
286 {
287 this->vip = host_create_from_string("0.0.0.0", 0);
288 }
289 this->pool = lib->settings->get_str(lib->settings,
290 "charon.plugins.load-tester.pool", NULL);
291 this->remote = lib->settings->get_str(lib->settings,
292 "charon.plugins.load-tester.remote", "127.0.0.1");
293
294 this->proposal = proposal_create_from_string(PROTO_IKE,
295 lib->settings->get_str(lib->settings,
296 "charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
297 if (!this->proposal)
298 { /* fallback */
299 this->proposal = proposal_create_from_string(PROTO_IKE,
300 "aes128-sha1-modp768");
301 }
302 this->ike_rekey = lib->settings->get_int(lib->settings,
303 "charon.plugins.load-tester.ike_rekey", 0);
304 this->child_rekey = lib->settings->get_int(lib->settings,
305 "charon.plugins.load-tester.child_rekey", 600);
306
307 this->initiator_auth = lib->settings->get_str(lib->settings,
308 "charon.plugins.load-tester.initiator_auth", "pubkey");
309 this->responder_auth = lib->settings->get_str(lib->settings,
310 "charon.plugins.load-tester.responder_auth", "pubkey");
311
312 this->num = 1;
313 this->peer_cfg = generate_config(this, 0);
314
315 return &this->public;
316 }
317