src/libcharon/plugins/load_tester/load_tester_config.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "load_tester_config.h"
  17
  18 #include <daemon.h>
  19
  20 typedef struct private_load_tester_config_t private_load_tester_config_t;
  21
  22 /**
  23  * Private data of an load_tester_config_t object
  24  */
  25 struct private_load_tester_config_t {
  26
  27         /**
  28          * Public part
  29          */
  30         load_tester_config_t public;
  31
  32         /**
  33          * peer config
  34          */
  35         peer_cfg_t *peer_cfg;
  36
  37         /**
  38          * virtual IP, if any
  39          */
  40         host_t *vip;
  41
  42         /**
  43          * Remote address
  44          */
  45         char *remote;
  46
  47         /**
  48          * IP address pool
  49          */
  50         char *pool;
  51
  52         /**
  53          * IKE proposal
  54          */
  55         proposal_t *proposal;
  56
  57         /**
  58          * Authentication method(s) to use/expect from initiator
  59          */
  60         char *initiator_auth;
  61
  62         /**
  63          * Authentication method(s) use/expected from responder
  64          */
  65         char *responder_auth;
  66
  67         /**
  68          * Initiator ID to enforce
  69          */
  70         char *initiator_id;
  71
  72         /**
  73          * Responder ID to enforce
  74          */
  75         char *responder_id;
  76
  77         /**
  78          * IKE_SA rekeying delay
  79          */
  80         u_int ike_rekey;
  81
  82         /**
  83          * CHILD_SA rekeying delay
  84          */
  85         u_int child_rekey;
  86
  87         /**
  88          * incremental numbering of generated configs
  89          */
  90         u_int num;
  91
  92         /**
  93          * Dynamic source port, if used
  94          */
  95         u_int16_t port;
  96 };
  97
  98 /**
  99  * Generate auth config from string
 100  */
 101 static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
 102                                                           peer_cfg_t *peer_cfg, bool local, int num)
 103 {
 104         enumerator_t *enumerator;
 105         auth_cfg_t *auth;
 106         identification_t *id;
 107         auth_class_t class;
 108         eap_type_t type;
 109         char buf[128];
 110         int rnd = 0;
 111
 112         enumerator = enumerator_create_token(str, "|", " ");
 113         while (enumerator->enumerate(enumerator, &str))
 114         {
 115                 id = NULL;
 116                 auth = auth_cfg_create();
 117                 rnd++;
 118
 119                 if (this->initiator_id)
 120                 {
 121                         if ((local && num) || (!local && !num))
 122                         {
 123                                 snprintf(buf, sizeof(buf), this->initiator_id, num, rnd);
 124                                 id = identification_create_from_string(buf);
 125                         }
 126                 }
 127                 if (this->responder_id)
 128                 {
 129                         if ((local && !num) || (!local && num))
 130                         {
 131                                 snprintf(buf, sizeof(buf), this->responder_id, num, rnd);
 132                                 id = identification_create_from_string(buf);
 133                         }
 134                 }
 135
 136                 if (streq(str, "psk"))
 137                 {       /* PSK authentication, use FQDNs */
 138                         class = AUTH_CLASS_PSK;
 139                         if (!id)
 140                         {
 141                                 if ((local && !num) || (!local && num))
 142                                 {
 143                                         id = identification_create_from_string("srv.strongswan.org");
 144                                 }
 145                                 else if (local)
 146                                 {
 147                                         snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org",
 148                                                          num, rnd);
 149                                         id = identification_create_from_string(buf);
 150                                 }
 151                                 else
 152                                 {
 153                                         id = identification_create_from_string("*.strongswan.org");
 154                                 }
 155                         }
 156                 }
 157                 else if (strneq(str, "eap", strlen("eap")))
 158                 {       /* EAP authentication, use a NAI */
 159                         class = AUTH_CLASS_EAP;
 160                         if (*(str + strlen("eap")) == '-')
 161                         {
 162                                 type = eap_type_from_string(str + strlen("eap-"));
 163                                 if (type)
 164                                 {
 165                                         auth->add(auth, AUTH_RULE_EAP_TYPE, type);
 166                                 }
 167                         }
 168                         if (!id)
 169                         {
 170                                 if (local && num)
 171                                 {
 172                                         snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org",
 173                                                          num, rnd);
 174                                         id = identification_create_from_string(buf);
 175                                 }
 176                                 else
 177                                 {
 178                                         id = identification_create_from_encoding(ID_ANY, chunk_empty);
 179                                 }
 180                         }
 181                 }
 182                 else
 183                 {
 184                         if (!streq(str, "pubkey"))
 185                         {
 186                                 DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
 187                                          str);
 188                         }
 189                         /* certificate authentication, use distinguished names */
 190                         class = AUTH_CLASS_PUBKEY;
 191                         if (!id)
 192                         {
 193                                 if ((local && !num) || (!local && num))
 194                                 {
 195                                         id = identification_create_from_string(
 196                                                                 "CN=srv, OU=load-test, O=strongSwan");
 197                                 }
 198                                 else if (local)
 199                                 {
 200                                         snprintf(buf, sizeof(buf),
 201                                                          "CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
 202                                         id = identification_create_from_string(buf);
 203                                 }
 204                                 else
 205                                 {
 206                                         id = identification_create_from_string(
 207                                                                         "CN=*, OU=load-test, O=strongSwan");
 208                                 }
 209                         }
 210                 }
 211                 auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
 212                 auth->add(auth, AUTH_RULE_IDENTITY, id);
 213                 peer_cfg->add_auth_cfg(peer_cfg, auth, local);
 214         }
 215         enumerator->destroy(enumerator);
 216 }
 217
 218 /**
 219  * Generate a new initiator config, num = 0 for responder config
 220  */
 221 static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
 222 {
 223         ike_cfg_t *ike_cfg;
 224         child_cfg_t *child_cfg;
 225         peer_cfg_t *peer_cfg;
 226         traffic_selector_t *ts;
 227         proposal_t *proposal;
 228         lifetime_cfg_t lifetime = {
 229                 .time = {
 230                         .life = this->child_rekey * 2,
 231                         .rekey = this->child_rekey,
 232                         .jitter = 0
 233                 }
 234         };
 235
 236         if (this->port && num)
 237         {
 238                 ike_cfg = ike_cfg_create(FALSE, FALSE,
 239                                 "0.0.0.0", this->port + num - 1, this->remote, IKEV2_NATT_PORT);
 240         }
 241         else
 242         {
 243                 ike_cfg = ike_cfg_create(FALSE, FALSE,
 244                                 "0.0.0.0", IKEV2_UDP_PORT, this->remote, IKEV2_UDP_PORT);
 245         }
 246         ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
 247         peer_cfg = peer_cfg_create("load-test", 2, ike_cfg,
 248                                                            CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
 249                                                            this->ike_rekey, 0, /* rekey, reauth */
 250                                                            0, this->ike_rekey, /* jitter, overtime */
 251                                                            FALSE, 0, /* mobike, dpddelay */
 252                                                            this->vip ? this->vip->clone(this->vip) : NULL,
 253                                                            this->pool, FALSE, NULL, NULL);
 254         if (num)
 255         {       /* initiator */
 256                 generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
 257                 generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
 258         }
 259         else
 260         {       /* responder */
 261                 generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
 262                 generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
 263         }
 264
 265         child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE, MODE_TUNNEL,
 266                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
 267                                                                  0, 0, NULL, NULL, 0);
 268         proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
 269         child_cfg->add_proposal(child_cfg, proposal);
 270         ts = traffic_selector_create_dynamic(0, 0, 65535);
 271         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 272         ts = traffic_selector_create_dynamic(0, 0, 65535);
 273         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 274         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 275         return peer_cfg;
 276 }
 277
 278 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
 279         private_load_tester_config_t *this,
 280         identification_t *me, identification_t *other)
 281 {
 282         return enumerator_create_single(this->peer_cfg, NULL);
 283 }
 284
 285 METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
 286         private_load_tester_config_t *this, host_t *me, host_t *other)
 287 {
 288         ike_cfg_t *ike_cfg;
 289
 290         ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
 291         return enumerator_create_single(ike_cfg, NULL);
 292 }
 293
 294 METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
 295         private_load_tester_config_t *this, char *name)
 296 {
 297         if (streq(name, "load-test"))
 298         {
 299                 return generate_config(this, this->num++);
 300         }
 301         return NULL;
 302 }
 303
 304 METHOD(load_tester_config_t, destroy, void,
 305         private_load_tester_config_t *this)
 306 {
 307         this->peer_cfg->destroy(this->peer_cfg);
 308         DESTROY_IF(this->proposal);
 309         DESTROY_IF(this->vip);
 310         free(this);
 311 }
 312
 313 /**
 314  * Described in header.
 315  */
 316 load_tester_config_t *load_tester_config_create()
 317 {
 318         private_load_tester_config_t *this;
 319
 320         INIT(this,
 321                 .public = {
 322                         .backend = {
 323                                 .create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
 324                                 .create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
 325                                 .get_peer_cfg_by_name = _get_peer_cfg_by_name,
 326                         },
 327                         .destroy = _destroy,
 328                 },
 329                 .num = 1,
 330         );
 331
 332         if (lib->settings->get_bool(lib->settings,
 333                                 "charon.plugins.load-tester.request_virtual_ip", FALSE))
 334         {
 335                 this->vip = host_create_from_string("0.0.0.0", 0);
 336         }
 337         this->pool = lib->settings->get_str(lib->settings,
 338                                 "charon.plugins.load-tester.pool", NULL);
 339         this->remote = lib->settings->get_str(lib->settings,
 340                                 "charon.plugins.load-tester.remote", "127.0.0.1");
 341
 342         this->proposal = proposal_create_from_string(PROTO_IKE,
 343                         lib->settings->get_str(lib->settings,
 344                                 "charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
 345         if (!this->proposal)
 346         {       /* fallback */
 347                 this->proposal = proposal_create_from_string(PROTO_IKE,
 348                                                                                                          "aes128-sha1-modp768");
 349         }
 350         this->ike_rekey = lib->settings->get_int(lib->settings,
 351                                 "charon.plugins.load-tester.ike_rekey", 0);
 352         this->child_rekey = lib->settings->get_int(lib->settings,
 353                                 "charon.plugins.load-tester.child_rekey", 600);
 354
 355         this->initiator_auth = lib->settings->get_str(lib->settings,
 356                                 "charon.plugins.load-tester.initiator_auth", "pubkey");
 357         this->responder_auth = lib->settings->get_str(lib->settings,
 358                                 "charon.plugins.load-tester.responder_auth", "pubkey");
 359         this->initiator_id = lib->settings->get_str(lib->settings,
 360                                 "charon.plugins.load-tester.initiator_id", NULL);
 361         this->responder_id = lib->settings->get_str(lib->settings,
 362                                 "charon.plugins.load-tester.responder_id", NULL);
 363
 364         this->port = lib->settings->get_int(lib->settings,
 365                                 "charon.plugins.load-tester.dynamic_port", 0);
 366
 367         this->peer_cfg = generate_config(this, 0);
 368
 369         return &this->public;
 370 }
 371