src/libcharon/plugins/load_tester/load_tester_config.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "load_tester_config.h"
  17
  18 #include <daemon.h>
  19
  20 typedef struct private_load_tester_config_t private_load_tester_config_t;
  21
  22 /**
  23  * Private data of an load_tester_config_t object
  24  */
  25 struct private_load_tester_config_t {
  26
  27         /**
  28          * Public part
  29          */
  30         load_tester_config_t public;
  31
  32         /**
  33          * peer config
  34          */
  35         peer_cfg_t *peer_cfg;
  36
  37         /**
  38          * virtual IP, if any
  39          */
  40         host_t *vip;
  41
  42         /**
  43          * Remote address
  44          */
  45         char *remote;
  46
  47         /**
  48          * IP address pool
  49          */
  50         char *pool;
  51
  52         /**
  53          * IKE proposal
  54          */
  55         proposal_t *proposal;
  56
  57         /**
  58          * Authentication method(s) to use/expect from initiator
  59          */
  60         char *initiator_auth;
  61
  62         /**
  63          * Authentication method(s) use/expected from responder
  64          */
  65         char *responder_auth;
  66
  67         /**
  68          * IKE_SA rekeying delay
  69          */
  70         u_int ike_rekey;
  71
  72         /**
  73          * CHILD_SA rekeying delay
  74          */
  75         u_int child_rekey;
  76
  77         /**
  78          * incremental numbering of generated configs
  79          */
  80         u_int num;
  81
  82         /**
  83          * Dynamic source port, if used
  84          */
  85         u_int16_t port;
  86 };
  87
  88 /**
  89  * Generate auth config from string
  90  */
  91 static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
  92                                                           peer_cfg_t *peer_cfg, bool local, int num)
  93 {
  94         enumerator_t *enumerator;
  95         auth_cfg_t *auth;
  96         identification_t *id;
  97         auth_class_t class;
  98         eap_type_t type;
  99         char buf[128];
 100         int rnd = 0;
 101
 102         enumerator = enumerator_create_token(str, "|", " ");
 103         while (enumerator->enumerate(enumerator, &str))
 104         {
 105                 auth = auth_cfg_create();
 106                 rnd++;
 107
 108                 if (streq(str, "psk"))
 109                 {       /* PSK authentication, use FQDNs */
 110                         class = AUTH_CLASS_PSK;
 111                         if ((local && !num) || (!local && num))
 112                         {
 113                                 id = identification_create_from_string("srv.strongswan.org");
 114                         }
 115                         else if (local)
 116                         {
 117                                 snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org", num, rnd);
 118                                 id = identification_create_from_string(buf);
 119                         }
 120                         else
 121                         {
 122                                 id = identification_create_from_string("*.strongswan.org");
 123                         }
 124                 }
 125                 else if (strneq(str, "eap", strlen("eap")))
 126                 {       /* EAP authentication, use a NAI */
 127                         class = AUTH_CLASS_EAP;
 128                         if (*(str + strlen("eap")) == '-')
 129                         {
 130                                 type = eap_type_from_string(str + strlen("eap-"));
 131                                 if (type)
 132                                 {
 133                                         auth->add(auth, AUTH_RULE_EAP_TYPE, type);
 134                                 }
 135                         }
 136                         if (local && num)
 137                         {
 138                                 snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org", num, rnd);
 139                                 id = identification_create_from_string(buf);
 140                         }
 141                         else
 142                         {
 143                                 id = identification_create_from_encoding(ID_ANY, chunk_empty);
 144                         }
 145                 }
 146                 else
 147                 {
 148                         if (!streq(str, "pubkey"))
 149                         {
 150                                 DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
 151                                          str);
 152                         }
 153                         /* certificate authentication, use distinguished names */
 154                         class = AUTH_CLASS_PUBKEY;
 155                         if ((local && !num) || (!local && num))
 156                         {
 157                                 id = identification_create_from_string(
 158                                                         "CN=srv, OU=load-test, O=strongSwan");
 159                         }
 160                         else if (local)
 161                         {
 162                                 snprintf(buf, sizeof(buf),
 163                                                  "CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
 164                                 id = identification_create_from_string(buf);
 165                         }
 166                         else
 167                         {
 168                                 id = identification_create_from_string(
 169                                                                 "CN=*, OU=load-test, O=strongSwan");
 170                         }
 171                 }
 172                 auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
 173                 auth->add(auth, AUTH_RULE_IDENTITY, id);
 174                 peer_cfg->add_auth_cfg(peer_cfg, auth, local);
 175         }
 176         enumerator->destroy(enumerator);
 177 }
 178
 179 /**
 180  * Generate a new initiator config, num = 0 for responder config
 181  */
 182 static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
 183 {
 184         ike_cfg_t *ike_cfg;
 185         child_cfg_t *child_cfg;
 186         peer_cfg_t *peer_cfg;
 187         traffic_selector_t *ts;
 188         proposal_t *proposal;
 189         lifetime_cfg_t lifetime = {
 190                 .time = {
 191                         .life = this->child_rekey * 2,
 192                         .rekey = this->child_rekey,
 193                         .jitter = 0
 194                 }
 195         };
 196
 197         if (this->port && num)
 198         {
 199                 ike_cfg = ike_cfg_create(FALSE, FALSE,
 200                                 "0.0.0.0", this->port + num - 1, this->remote, IKEV2_NATT_PORT);
 201         }
 202         else
 203         {
 204                 ike_cfg = ike_cfg_create(FALSE, FALSE,
 205                                 "0.0.0.0", IKEV2_UDP_PORT, this->remote, IKEV2_UDP_PORT);
 206         }
 207         ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
 208         peer_cfg = peer_cfg_create("load-test", 2, ike_cfg,
 209                                                            CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
 210                                                            this->ike_rekey, 0, /* rekey, reauth */
 211                                                            0, this->ike_rekey, /* jitter, overtime */
 212                                                            FALSE, 0, /* mobike, dpddelay */
 213                                                            this->vip ? this->vip->clone(this->vip) : NULL,
 214                                                            this->pool, FALSE, NULL, NULL);
 215         if (num)
 216         {       /* initiator */
 217                 generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
 218                 generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
 219         }
 220         else
 221         {       /* responder */
 222                 generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
 223                 generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
 224         }
 225
 226         child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE, MODE_TUNNEL,
 227                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
 228                                                                  0, 0, NULL, NULL, 0);
 229         proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
 230         child_cfg->add_proposal(child_cfg, proposal);
 231         ts = traffic_selector_create_dynamic(0, 0, 65535);
 232         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 233         ts = traffic_selector_create_dynamic(0, 0, 65535);
 234         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 235         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 236         return peer_cfg;
 237 }
 238
 239 /**
 240  * Implementation of backend_t.create_peer_cfg_enumerator.
 241  */
 242 static enumerator_t* create_peer_cfg_enumerator(private_load_tester_config_t *this,
 243                                                                                                 identification_t *me,
 244                                                                                                 identification_t *other)
 245 {
 246         return enumerator_create_single(this->peer_cfg, NULL);
 247 }
 248
 249 /**
 250  * Implementation of backend_t.create_ike_cfg_enumerator.
 251  */
 252 static enumerator_t* create_ike_cfg_enumerator(private_load_tester_config_t *this,
 253                                                                                            host_t *me, host_t *other)
 254 {
 255         ike_cfg_t *ike_cfg;
 256
 257         ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
 258         return enumerator_create_single(ike_cfg, NULL);
 259 }
 260
 261 /**
 262  * implements backend_t.get_peer_cfg_by_name.
 263  */
 264 static peer_cfg_t *get_peer_cfg_by_name(private_load_tester_config_t *this,
 265                                                                                 char *name)
 266 {
 267         if (streq(name, "load-test"))
 268         {
 269                 return generate_config(this, this->num++);
 270         }
 271         return NULL;
 272 }
 273
 274 /**
 275  * Implementation of load_tester_config_t.destroy.
 276  */
 277 static void destroy(private_load_tester_config_t *this)
 278 {
 279         this->peer_cfg->destroy(this->peer_cfg);
 280         DESTROY_IF(this->proposal);
 281         DESTROY_IF(this->vip);
 282         free(this->pool);
 283         free(this->remote);
 284         free(this->initiator_auth);
 285         free(this->responder_auth);
 286         free(this);
 287 }
 288
 289 /**
 290  * Described in header.
 291  */
 292 load_tester_config_t *load_tester_config_create()
 293 {
 294         private_load_tester_config_t *this = malloc_thing(private_load_tester_config_t);
 295
 296         this->public.backend.create_peer_cfg_enumerator = (enumerator_t*(*)(backend_t*, identification_t *me, identification_t *other))create_peer_cfg_enumerator;
 297         this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
 298         this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
 299         this->public.destroy = (void(*)(load_tester_config_t*))destroy;
 300
 301         this->vip = NULL;
 302         if (lib->settings->get_bool(lib->settings,
 303                                 "charon.plugins.load-tester.request_virtual_ip", FALSE))
 304         {
 305                 this->vip = host_create_from_string("0.0.0.0", 0);
 306         }
 307         this->pool = lib->settings->alloc_str(lib->settings,
 308                                 "charon.plugins.load-tester.pool", NULL);
 309         this->remote = lib->settings->alloc_str(lib->settings,
 310                                 "charon.plugins.load-tester.remote", "127.0.0.1");
 311
 312         this->proposal = proposal_create_from_string(PROTO_IKE,
 313                         lib->settings->get_str(lib->settings,
 314                                 "charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
 315         if (!this->proposal)
 316         {       /* fallback */
 317                 this->proposal = proposal_create_from_string(PROTO_IKE,
 318                                                                                                          "aes128-sha1-modp768");
 319         }
 320         this->ike_rekey = lib->settings->get_int(lib->settings,
 321                                 "charon.plugins.load-tester.ike_rekey", 0);
 322         this->child_rekey = lib->settings->get_int(lib->settings,
 323                                 "charon.plugins.load-tester.child_rekey", 600);
 324
 325         this->initiator_auth = lib->settings->alloc_str(lib->settings,
 326                                 "charon.plugins.load-tester.initiator_auth", "pubkey");
 327         this->responder_auth = lib->settings->alloc_str(lib->settings,
 328                                 "charon.plugins.load-tester.responder_auth", "pubkey");
 329
 330         this->port = lib->settings->get_int(lib->settings,
 331                                 "charon.plugins.load-tester.dynamic_port", 0);
 332
 333         this->num = 1;
 334         this->peer_cfg = generate_config(this, 0);
 335
 336         return &this->public;
 337 }
 338