Added initiator/responder_id load tester options to enforce different identities
[strongswan.git] / src / libcharon / plugins / load_tester / load_tester_config.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "load_tester_config.h"
17
18 #include <daemon.h>
19
20 typedef struct private_load_tester_config_t private_load_tester_config_t;
21
22 /**
23 * Private data of an load_tester_config_t object
24 */
25 struct private_load_tester_config_t {
26
27 /**
28 * Public part
29 */
30 load_tester_config_t public;
31
32 /**
33 * peer config
34 */
35 peer_cfg_t *peer_cfg;
36
37 /**
38 * virtual IP, if any
39 */
40 host_t *vip;
41
42 /**
43 * Remote address
44 */
45 char *remote;
46
47 /**
48 * IP address pool
49 */
50 char *pool;
51
52 /**
53 * IKE proposal
54 */
55 proposal_t *proposal;
56
57 /**
58 * Authentication method(s) to use/expect from initiator
59 */
60 char *initiator_auth;
61
62 /**
63 * Authentication method(s) use/expected from responder
64 */
65 char *responder_auth;
66
67 /**
68 * Initiator ID to enforce
69 */
70 char *initiator_id;
71
72 /**
73 * Responder ID to enforce
74 */
75 char *responder_id;
76
77 /**
78 * IKE_SA rekeying delay
79 */
80 u_int ike_rekey;
81
82 /**
83 * CHILD_SA rekeying delay
84 */
85 u_int child_rekey;
86
87 /**
88 * incremental numbering of generated configs
89 */
90 u_int num;
91
92 /**
93 * Dynamic source port, if used
94 */
95 u_int16_t port;
96 };
97
98 /**
99 * Generate auth config from string
100 */
101 static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
102 peer_cfg_t *peer_cfg, bool local, int num)
103 {
104 enumerator_t *enumerator;
105 auth_cfg_t *auth;
106 identification_t *id;
107 auth_class_t class;
108 eap_type_t type;
109 char buf[128];
110 int rnd = 0;
111
112 enumerator = enumerator_create_token(str, "|", " ");
113 while (enumerator->enumerate(enumerator, &str))
114 {
115 id = NULL;
116 auth = auth_cfg_create();
117 rnd++;
118
119 if (this->initiator_id)
120 {
121 if ((local && num) || (!local && !num))
122 {
123 snprintf(buf, sizeof(buf), this->initiator_id, num, rnd);
124 id = identification_create_from_string(buf);
125 }
126 }
127 if (this->responder_id)
128 {
129 if ((local && !num) || (!local && num))
130 {
131 snprintf(buf, sizeof(buf), this->responder_id, num, rnd);
132 id = identification_create_from_string(buf);
133 }
134 }
135
136 if (streq(str, "psk"))
137 { /* PSK authentication, use FQDNs */
138 class = AUTH_CLASS_PSK;
139 if (!id)
140 {
141 if ((local && !num) || (!local && num))
142 {
143 id = identification_create_from_string("srv.strongswan.org");
144 }
145 else if (local)
146 {
147 snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org",
148 num, rnd);
149 id = identification_create_from_string(buf);
150 }
151 else
152 {
153 id = identification_create_from_string("*.strongswan.org");
154 }
155 }
156 }
157 else if (strneq(str, "eap", strlen("eap")))
158 { /* EAP authentication, use a NAI */
159 class = AUTH_CLASS_EAP;
160 if (*(str + strlen("eap")) == '-')
161 {
162 type = eap_type_from_string(str + strlen("eap-"));
163 if (type)
164 {
165 auth->add(auth, AUTH_RULE_EAP_TYPE, type);
166 }
167 }
168 if (!id)
169 {
170 if (local && num)
171 {
172 snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org",
173 num, rnd);
174 id = identification_create_from_string(buf);
175 }
176 else
177 {
178 id = identification_create_from_encoding(ID_ANY, chunk_empty);
179 }
180 }
181 }
182 else
183 {
184 if (!streq(str, "pubkey"))
185 {
186 DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
187 str);
188 }
189 /* certificate authentication, use distinguished names */
190 class = AUTH_CLASS_PUBKEY;
191 if (!id)
192 {
193 if ((local && !num) || (!local && num))
194 {
195 id = identification_create_from_string(
196 "CN=srv, OU=load-test, O=strongSwan");
197 }
198 else if (local)
199 {
200 snprintf(buf, sizeof(buf),
201 "CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
202 id = identification_create_from_string(buf);
203 }
204 else
205 {
206 id = identification_create_from_string(
207 "CN=*, OU=load-test, O=strongSwan");
208 }
209 }
210 }
211 auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
212 auth->add(auth, AUTH_RULE_IDENTITY, id);
213 peer_cfg->add_auth_cfg(peer_cfg, auth, local);
214 }
215 enumerator->destroy(enumerator);
216 }
217
218 /**
219 * Generate a new initiator config, num = 0 for responder config
220 */
221 static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
222 {
223 ike_cfg_t *ike_cfg;
224 child_cfg_t *child_cfg;
225 peer_cfg_t *peer_cfg;
226 traffic_selector_t *ts;
227 proposal_t *proposal;
228 lifetime_cfg_t lifetime = {
229 .time = {
230 .life = this->child_rekey * 2,
231 .rekey = this->child_rekey,
232 .jitter = 0
233 }
234 };
235
236 if (this->port && num)
237 {
238 ike_cfg = ike_cfg_create(FALSE, FALSE,
239 "0.0.0.0", this->port + num - 1, this->remote, IKEV2_NATT_PORT);
240 }
241 else
242 {
243 ike_cfg = ike_cfg_create(FALSE, FALSE,
244 "0.0.0.0", IKEV2_UDP_PORT, this->remote, IKEV2_UDP_PORT);
245 }
246 ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
247 peer_cfg = peer_cfg_create("load-test", 2, ike_cfg,
248 CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
249 this->ike_rekey, 0, /* rekey, reauth */
250 0, this->ike_rekey, /* jitter, overtime */
251 FALSE, 0, /* mobike, dpddelay */
252 this->vip ? this->vip->clone(this->vip) : NULL,
253 this->pool, FALSE, NULL, NULL);
254 if (num)
255 { /* initiator */
256 generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
257 generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
258 }
259 else
260 { /* responder */
261 generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
262 generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
263 }
264
265 child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE, MODE_TUNNEL,
266 ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
267 0, 0, NULL, NULL, 0);
268 proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
269 child_cfg->add_proposal(child_cfg, proposal);
270 ts = traffic_selector_create_dynamic(0, 0, 65535);
271 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
272 ts = traffic_selector_create_dynamic(0, 0, 65535);
273 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
274 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
275 return peer_cfg;
276 }
277
278 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
279 private_load_tester_config_t *this,
280 identification_t *me, identification_t *other)
281 {
282 return enumerator_create_single(this->peer_cfg, NULL);
283 }
284
285 METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
286 private_load_tester_config_t *this, host_t *me, host_t *other)
287 {
288 ike_cfg_t *ike_cfg;
289
290 ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
291 return enumerator_create_single(ike_cfg, NULL);
292 }
293
294 METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
295 private_load_tester_config_t *this, char *name)
296 {
297 if (streq(name, "load-test"))
298 {
299 return generate_config(this, this->num++);
300 }
301 return NULL;
302 }
303
304 METHOD(load_tester_config_t, destroy, void,
305 private_load_tester_config_t *this)
306 {
307 this->peer_cfg->destroy(this->peer_cfg);
308 DESTROY_IF(this->proposal);
309 DESTROY_IF(this->vip);
310 free(this);
311 }
312
313 /**
314 * Described in header.
315 */
316 load_tester_config_t *load_tester_config_create()
317 {
318 private_load_tester_config_t *this;
319
320 INIT(this,
321 .public = {
322 .backend = {
323 .create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
324 .create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
325 .get_peer_cfg_by_name = _get_peer_cfg_by_name,
326 },
327 .destroy = _destroy,
328 },
329 .num = 1,
330 );
331
332 if (lib->settings->get_bool(lib->settings,
333 "charon.plugins.load-tester.request_virtual_ip", FALSE))
334 {
335 this->vip = host_create_from_string("0.0.0.0", 0);
336 }
337 this->pool = lib->settings->get_str(lib->settings,
338 "charon.plugins.load-tester.pool", NULL);
339 this->remote = lib->settings->get_str(lib->settings,
340 "charon.plugins.load-tester.remote", "127.0.0.1");
341
342 this->proposal = proposal_create_from_string(PROTO_IKE,
343 lib->settings->get_str(lib->settings,
344 "charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
345 if (!this->proposal)
346 { /* fallback */
347 this->proposal = proposal_create_from_string(PROTO_IKE,
348 "aes128-sha1-modp768");
349 }
350 this->ike_rekey = lib->settings->get_int(lib->settings,
351 "charon.plugins.load-tester.ike_rekey", 0);
352 this->child_rekey = lib->settings->get_int(lib->settings,
353 "charon.plugins.load-tester.child_rekey", 600);
354
355 this->initiator_auth = lib->settings->get_str(lib->settings,
356 "charon.plugins.load-tester.initiator_auth", "pubkey");
357 this->responder_auth = lib->settings->get_str(lib->settings,
358 "charon.plugins.load-tester.responder_auth", "pubkey");
359 this->initiator_id = lib->settings->get_str(lib->settings,
360 "charon.plugins.load-tester.initiator_id", NULL);
361 this->responder_id = lib->settings->get_str(lib->settings,
362 "charon.plugins.load-tester.responder_id", NULL);
363
364 this->port = lib->settings->get_int(lib->settings,
365 "charon.plugins.load-tester.dynamic_port", 0);
366
367 this->peer_cfg = generate_config(this, 0);
368
369 return &this->public;
370 }
371