Support multiple virtual IPs on peer_cfg and ike_sa classes
[strongswan.git] / src / libcharon / plugins / load_tester / load_tester_config.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "load_tester_config.h"
17
18 #include <daemon.h>
19
20 typedef struct private_load_tester_config_t private_load_tester_config_t;
21
22 /**
23 * Private data of an load_tester_config_t object
24 */
25 struct private_load_tester_config_t {
26
27 /**
28 * Public part
29 */
30 load_tester_config_t public;
31
32 /**
33 * peer config
34 */
35 peer_cfg_t *peer_cfg;
36
37 /**
38 * virtual IP, if any
39 */
40 host_t *vip;
41
42 /**
43 * Remote address
44 */
45 char *remote;
46
47 /**
48 * Local address
49 */
50 char *local;
51
52 /**
53 * IP address pool
54 */
55 char *pool;
56
57 /**
58 * IKE proposal
59 */
60 proposal_t *proposal;
61
62 /**
63 * Authentication method(s) to use/expect from initiator
64 */
65 char *initiator_auth;
66
67 /**
68 * Authentication method(s) use/expected from responder
69 */
70 char *responder_auth;
71
72 /**
73 * Initiator ID to enforce
74 */
75 char *initiator_id;
76
77 /**
78 * Responder ID to enforce
79 */
80 char *responder_id;
81
82 /**
83 * IKE_SA rekeying delay
84 */
85 u_int ike_rekey;
86
87 /**
88 * CHILD_SA rekeying delay
89 */
90 u_int child_rekey;
91
92 /**
93 * DPD check delay
94 */
95 u_int dpd_delay;
96
97 /**
98 * DPD timeout (IKEv1 only)
99 */
100 u_int dpd_timeout;
101
102 /**
103 * incremental numbering of generated configs
104 */
105 u_int num;
106
107 /**
108 * Dynamic source port, if used
109 */
110 u_int16_t port;
111 };
112
113 /**
114 * Generate auth config from string
115 */
116 static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
117 peer_cfg_t *peer_cfg, bool local, int num)
118 {
119 enumerator_t *enumerator;
120 auth_cfg_t *auth;
121 identification_t *id;
122 auth_class_t class;
123 eap_type_t type;
124 char buf[128];
125 int rnd = 0;
126
127 enumerator = enumerator_create_token(str, "|", " ");
128 while (enumerator->enumerate(enumerator, &str))
129 {
130 id = NULL;
131 auth = auth_cfg_create();
132 rnd++;
133
134 if (this->initiator_id)
135 {
136 if ((local && num) || (!local && !num))
137 {
138 snprintf(buf, sizeof(buf), this->initiator_id, num, rnd);
139 id = identification_create_from_string(buf);
140 }
141 }
142 if (this->responder_id)
143 {
144 if ((local && !num) || (!local && num))
145 {
146 snprintf(buf, sizeof(buf), this->responder_id, num, rnd);
147 id = identification_create_from_string(buf);
148 }
149 }
150
151 if (streq(str, "psk"))
152 { /* PSK authentication, use FQDNs */
153 class = AUTH_CLASS_PSK;
154 if (!id)
155 {
156 if ((local && !num) || (!local && num))
157 {
158 id = identification_create_from_string("srv.strongswan.org");
159 }
160 else if (local)
161 {
162 snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org",
163 num, rnd);
164 id = identification_create_from_string(buf);
165 }
166 else
167 {
168 id = identification_create_from_string("*.strongswan.org");
169 }
170 }
171 }
172 else if (strneq(str, "eap", strlen("eap")))
173 { /* EAP authentication, use a NAI */
174 class = AUTH_CLASS_EAP;
175 if (*(str + strlen("eap")) == '-')
176 {
177 type = eap_type_from_string(str + strlen("eap-"));
178 if (type)
179 {
180 auth->add(auth, AUTH_RULE_EAP_TYPE, type);
181 }
182 }
183 if (!id)
184 {
185 if (local && num)
186 {
187 snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org",
188 num, rnd);
189 id = identification_create_from_string(buf);
190 }
191 else
192 {
193 id = identification_create_from_encoding(ID_ANY, chunk_empty);
194 }
195 }
196 }
197 else
198 {
199 if (!streq(str, "pubkey"))
200 {
201 DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
202 str);
203 }
204 /* certificate authentication, use distinguished names */
205 class = AUTH_CLASS_PUBKEY;
206 if (!id)
207 {
208 if ((local && !num) || (!local && num))
209 {
210 id = identification_create_from_string(
211 "CN=srv, OU=load-test, O=strongSwan");
212 }
213 else if (local)
214 {
215 snprintf(buf, sizeof(buf),
216 "CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
217 id = identification_create_from_string(buf);
218 }
219 else
220 {
221 id = identification_create_from_string(
222 "CN=*, OU=load-test, O=strongSwan");
223 }
224 }
225 }
226 auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
227 auth->add(auth, AUTH_RULE_IDENTITY, id);
228 peer_cfg->add_auth_cfg(peer_cfg, auth, local);
229 }
230 enumerator->destroy(enumerator);
231 }
232
233 /**
234 * Generate a new initiator config, num = 0 for responder config
235 */
236 static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
237 {
238 ike_cfg_t *ike_cfg;
239 child_cfg_t *child_cfg;
240 peer_cfg_t *peer_cfg;
241 traffic_selector_t *ts;
242 proposal_t *proposal;
243 lifetime_cfg_t lifetime = {
244 .time = {
245 .life = this->child_rekey * 2,
246 .rekey = this->child_rekey,
247 .jitter = 0
248 }
249 };
250
251 if (this->port && num)
252 {
253 ike_cfg = ike_cfg_create(FALSE, FALSE,
254 this->local, FALSE, this->port + num - 1,
255 this->remote, FALSE, IKEV2_NATT_PORT);
256 }
257 else
258 {
259 ike_cfg = ike_cfg_create(FALSE, FALSE,
260 this->local, FALSE, charon->socket->get_port(charon->socket, FALSE),
261 this->remote, FALSE, IKEV2_UDP_PORT);
262 }
263 ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
264 peer_cfg = peer_cfg_create("load-test", IKEV2, ike_cfg,
265 CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
266 this->ike_rekey, 0, /* rekey, reauth */
267 0, this->ike_rekey, /* jitter, overtime */
268 FALSE, FALSE, /* mobike, aggressive mode */
269 this->dpd_delay, /* dpd_delay */
270 this->dpd_timeout, /* dpd_timeout */
271 this->pool, FALSE, NULL, NULL);
272 if (this->vip)
273 {
274 peer_cfg->add_virtual_ip(peer_cfg, this->vip->clone(this->vip));
275 }
276 if (num)
277 { /* initiator */
278 generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
279 generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
280 }
281 else
282 { /* responder */
283 generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
284 generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
285 }
286
287 child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE, MODE_TUNNEL,
288 ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
289 0, 0, NULL, NULL, 0);
290 proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
291 child_cfg->add_proposal(child_cfg, proposal);
292 ts = traffic_selector_create_dynamic(0, 0, 65535);
293 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
294 ts = traffic_selector_create_dynamic(0, 0, 65535);
295 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
296 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
297 return peer_cfg;
298 }
299
300 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
301 private_load_tester_config_t *this,
302 identification_t *me, identification_t *other)
303 {
304 return enumerator_create_single(this->peer_cfg, NULL);
305 }
306
307 METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
308 private_load_tester_config_t *this, host_t *me, host_t *other)
309 {
310 ike_cfg_t *ike_cfg;
311
312 ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
313 return enumerator_create_single(ike_cfg, NULL);
314 }
315
316 METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
317 private_load_tester_config_t *this, char *name)
318 {
319 if (streq(name, "load-test"))
320 {
321 return generate_config(this, this->num++);
322 }
323 return NULL;
324 }
325
326 METHOD(load_tester_config_t, destroy, void,
327 private_load_tester_config_t *this)
328 {
329 this->peer_cfg->destroy(this->peer_cfg);
330 DESTROY_IF(this->proposal);
331 DESTROY_IF(this->vip);
332 free(this);
333 }
334
335 /**
336 * Described in header.
337 */
338 load_tester_config_t *load_tester_config_create()
339 {
340 private_load_tester_config_t *this;
341
342 INIT(this,
343 .public = {
344 .backend = {
345 .create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
346 .create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
347 .get_peer_cfg_by_name = _get_peer_cfg_by_name,
348 },
349 .destroy = _destroy,
350 },
351 .num = 1,
352 );
353
354 if (lib->settings->get_bool(lib->settings,
355 "%s.plugins.load-tester.request_virtual_ip", FALSE, charon->name))
356 {
357 this->vip = host_create_from_string("0.0.0.0", 0);
358 }
359 this->pool = lib->settings->get_str(lib->settings,
360 "%s.plugins.load-tester.pool", NULL, charon->name);
361 this->remote = lib->settings->get_str(lib->settings,
362 "%s.plugins.load-tester.remote", "127.0.0.1", charon->name);
363 this->local = lib->settings->get_str(lib->settings,
364 "%s.plugins.load-tester.local", "0.0.0.0", charon->name);
365
366 this->proposal = proposal_create_from_string(PROTO_IKE,
367 lib->settings->get_str(lib->settings,
368 "%s.plugins.load-tester.proposal", "aes128-sha1-modp768",
369 charon->name));
370 if (!this->proposal)
371 { /* fallback */
372 this->proposal = proposal_create_from_string(PROTO_IKE,
373 "aes128-sha1-modp768");
374 }
375 this->ike_rekey = lib->settings->get_int(lib->settings,
376 "%s.plugins.load-tester.ike_rekey", 0, charon->name);
377 this->child_rekey = lib->settings->get_int(lib->settings,
378 "%s.plugins.load-tester.child_rekey", 600, charon->name);
379 this->dpd_delay = lib->settings->get_int(lib->settings,
380 "%s.plugins.load-tester.dpd_delay", 0, charon->name);
381 this->dpd_timeout = lib->settings->get_int(lib->settings,
382 "%s.plugins.load-tester.dpd_timeout", 0, charon->name);
383
384 this->initiator_auth = lib->settings->get_str(lib->settings,
385 "%s.plugins.load-tester.initiator_auth", "pubkey", charon->name);
386 this->responder_auth = lib->settings->get_str(lib->settings,
387 "%s.plugins.load-tester.responder_auth", "pubkey", charon->name);
388 this->initiator_id = lib->settings->get_str(lib->settings,
389 "%s.plugins.load-tester.initiator_id", NULL, charon->name);
390 this->responder_id = lib->settings->get_str(lib->settings,
391 "%s.plugins.load-tester.responder_id", NULL, charon->name);
392
393 this->port = lib->settings->get_int(lib->settings,
394 "%s.plugins.load-tester.dynamic_port", 0, charon->name);
395
396 this->peer_cfg = generate_config(this, 0);
397
398 return &this->public;
399 }
400