488 lines
12 KiB
C
488 lines
12 KiB
C
/*
|
|
* Copyright (C) 2008 Martin Willi
|
|
* Hochschule fuer Technik Rapperswil
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* for more details.
|
|
*/
|
|
|
|
#include "load_tester_config.h"
|
|
|
|
#include <daemon.h>
|
|
|
|
typedef struct private_load_tester_config_t private_load_tester_config_t;
|
|
|
|
/**
|
|
* Private data of an load_tester_config_t object
|
|
*/
|
|
struct private_load_tester_config_t {
|
|
|
|
/**
|
|
* Public part
|
|
*/
|
|
load_tester_config_t public;
|
|
|
|
/**
|
|
* peer config
|
|
*/
|
|
peer_cfg_t *peer_cfg;
|
|
|
|
/**
|
|
* virtual IP, if any
|
|
*/
|
|
host_t *vip;
|
|
|
|
/**
|
|
* Remote address
|
|
*/
|
|
char *remote;
|
|
|
|
/**
|
|
* Local address
|
|
*/
|
|
char *local;
|
|
|
|
/**
|
|
* IP address pool
|
|
*/
|
|
char *pool;
|
|
|
|
/**
|
|
* IKE proposal
|
|
*/
|
|
proposal_t *proposal;
|
|
|
|
/**
|
|
* Authentication method(s) to use/expect from initiator
|
|
*/
|
|
char *initiator_auth;
|
|
|
|
/**
|
|
* Authentication method(s) use/expected from responder
|
|
*/
|
|
char *responder_auth;
|
|
|
|
/**
|
|
* Initiator ID to enforce
|
|
*/
|
|
char *initiator_id;
|
|
|
|
/**
|
|
* Initiator ID to to match against as responder
|
|
*/
|
|
char *initiator_match;
|
|
|
|
/**
|
|
* Responder ID to enforce
|
|
*/
|
|
char *responder_id;
|
|
|
|
/**
|
|
* Traffic Selector on initiator side, as proposed from initiator
|
|
*/
|
|
char *initiator_tsi;
|
|
|
|
/**
|
|
* Traffic Selector on responder side, as proposed from initiator
|
|
*/
|
|
char *initiator_tsr;
|
|
|
|
/**
|
|
* Traffic Selector on initiator side, as narrowed by responder
|
|
*/
|
|
char *responder_tsi;
|
|
|
|
/**
|
|
* Traffic Selector on responder side, as narrowed by responder
|
|
*/
|
|
char *responder_tsr;
|
|
|
|
/**
|
|
* IKE_SA rekeying delay
|
|
*/
|
|
u_int ike_rekey;
|
|
|
|
/**
|
|
* CHILD_SA rekeying delay
|
|
*/
|
|
u_int child_rekey;
|
|
|
|
/**
|
|
* DPD check delay
|
|
*/
|
|
u_int dpd_delay;
|
|
|
|
/**
|
|
* DPD timeout (IKEv1 only)
|
|
*/
|
|
u_int dpd_timeout;
|
|
|
|
/**
|
|
* incremental numbering of generated configs
|
|
*/
|
|
u_int num;
|
|
|
|
/**
|
|
* Dynamic source port, if used
|
|
*/
|
|
u_int16_t port;
|
|
|
|
/**
|
|
* IKE version to use for load testing
|
|
*/
|
|
ike_version_t version;
|
|
};
|
|
|
|
/**
|
|
* Generate auth config from string
|
|
*/
|
|
static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
|
|
peer_cfg_t *peer_cfg, bool local, int num)
|
|
{
|
|
enumerator_t *enumerator;
|
|
auth_cfg_t *auth;
|
|
identification_t *id;
|
|
auth_class_t class;
|
|
eap_type_t type;
|
|
char buf[128];
|
|
int rnd = 0;
|
|
|
|
enumerator = enumerator_create_token(str, "|", " ");
|
|
while (enumerator->enumerate(enumerator, &str))
|
|
{
|
|
id = NULL;
|
|
auth = auth_cfg_create();
|
|
rnd++;
|
|
|
|
if (this->initiator_id)
|
|
{
|
|
if (this->initiator_match && (!local && !num))
|
|
{ /* as responder, use the secified identity that matches
|
|
* all used initiator identities, if given. */
|
|
snprintf(buf, sizeof(buf), this->initiator_match, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
else if ((local && num) || (!local && !num))
|
|
{ /* as initiator, create peer specific identities */
|
|
snprintf(buf, sizeof(buf), this->initiator_id, num, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
}
|
|
if (this->responder_id)
|
|
{
|
|
if ((local && !num) || (!local && num))
|
|
{
|
|
snprintf(buf, sizeof(buf), this->responder_id, num, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
}
|
|
|
|
if (streq(str, "psk"))
|
|
{ /* PSK authentication, use FQDNs */
|
|
class = AUTH_CLASS_PSK;
|
|
if (!id)
|
|
{
|
|
if ((local && !num) || (!local && num))
|
|
{
|
|
id = identification_create_from_string("srv.strongswan.org");
|
|
}
|
|
else if (local)
|
|
{
|
|
snprintf(buf, sizeof(buf), "c%d-r%d.strongswan.org",
|
|
num, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
else
|
|
{
|
|
id = identification_create_from_string("*.strongswan.org");
|
|
}
|
|
}
|
|
}
|
|
else if (strneq(str, "eap", strlen("eap")))
|
|
{ /* EAP authentication, use a NAI */
|
|
class = AUTH_CLASS_EAP;
|
|
if (*(str + strlen("eap")) == '-')
|
|
{
|
|
type = eap_type_from_string(str + strlen("eap-"));
|
|
if (type)
|
|
{
|
|
auth->add(auth, AUTH_RULE_EAP_TYPE, type);
|
|
}
|
|
}
|
|
if (!id)
|
|
{
|
|
if (local && num)
|
|
{
|
|
snprintf(buf, sizeof(buf), "1%.10d%.4d@strongswan.org",
|
|
num, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
else
|
|
{
|
|
id = identification_create_from_encoding(ID_ANY, chunk_empty);
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (!streq(str, "pubkey"))
|
|
{
|
|
DBG1(DBG_CFG, "invalid authentication: '%s', fallback to pubkey",
|
|
str);
|
|
}
|
|
/* certificate authentication, use distinguished names */
|
|
class = AUTH_CLASS_PUBKEY;
|
|
if (!id)
|
|
{
|
|
if ((local && !num) || (!local && num))
|
|
{
|
|
id = identification_create_from_string(
|
|
"CN=srv, OU=load-test, O=strongSwan");
|
|
}
|
|
else if (local)
|
|
{
|
|
snprintf(buf, sizeof(buf),
|
|
"CN=c%d-r%d, OU=load-test, O=strongSwan", num, rnd);
|
|
id = identification_create_from_string(buf);
|
|
}
|
|
else
|
|
{
|
|
id = identification_create_from_string(
|
|
"CN=*, OU=load-test, O=strongSwan");
|
|
}
|
|
}
|
|
}
|
|
auth->add(auth, AUTH_RULE_AUTH_CLASS, class);
|
|
auth->add(auth, AUTH_RULE_IDENTITY, id);
|
|
peer_cfg->add_auth_cfg(peer_cfg, auth, local);
|
|
}
|
|
enumerator->destroy(enumerator);
|
|
}
|
|
|
|
/**
|
|
* Add a TS from a string to a child_cfg
|
|
*/
|
|
static void add_ts(char *string, child_cfg_t *cfg, bool local)
|
|
{
|
|
traffic_selector_t *ts;
|
|
|
|
if (string)
|
|
{
|
|
ts = traffic_selector_create_from_cidr(string, 0, 0);
|
|
if (!ts)
|
|
{
|
|
DBG1(DBG_CFG, "parsing TS string '%s' failed", string);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
ts = traffic_selector_create_dynamic(0, 0, 65535);
|
|
}
|
|
if (ts)
|
|
{
|
|
cfg->add_traffic_selector(cfg, local, ts);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generate a new initiator config, num = 0 for responder config
|
|
*/
|
|
static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
|
|
{
|
|
ike_cfg_t *ike_cfg;
|
|
child_cfg_t *child_cfg;
|
|
peer_cfg_t *peer_cfg;
|
|
proposal_t *proposal;
|
|
lifetime_cfg_t lifetime = {
|
|
.time = {
|
|
.life = this->child_rekey * 2,
|
|
.rekey = this->child_rekey,
|
|
.jitter = 0
|
|
}
|
|
};
|
|
|
|
if (this->port && num)
|
|
{
|
|
ike_cfg = ike_cfg_create(this->version, TRUE, FALSE,
|
|
this->local, FALSE, this->port + num - 1,
|
|
this->remote, FALSE, IKEV2_NATT_PORT);
|
|
}
|
|
else
|
|
{
|
|
ike_cfg = ike_cfg_create(this->version, TRUE, FALSE,
|
|
this->local, FALSE,
|
|
charon->socket->get_port(charon->socket, FALSE),
|
|
this->remote, FALSE, IKEV2_UDP_PORT);
|
|
}
|
|
ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
|
|
peer_cfg = peer_cfg_create("load-test", ike_cfg,
|
|
CERT_SEND_IF_ASKED, UNIQUE_NO, 1, /* keytries */
|
|
this->ike_rekey, 0, /* rekey, reauth */
|
|
0, this->ike_rekey, /* jitter, overtime */
|
|
FALSE, FALSE, /* mobike, aggressive mode */
|
|
this->dpd_delay, /* dpd_delay */
|
|
this->dpd_timeout, /* dpd_timeout */
|
|
FALSE, NULL, NULL);
|
|
if (this->vip)
|
|
{
|
|
peer_cfg->add_virtual_ip(peer_cfg, this->vip->clone(this->vip));
|
|
}
|
|
if (this->pool)
|
|
{
|
|
peer_cfg->add_pool(peer_cfg, this->pool);
|
|
}
|
|
if (num)
|
|
{ /* initiator */
|
|
generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
|
|
generate_auth_cfg(this, this->responder_auth, peer_cfg, FALSE, num);
|
|
}
|
|
else
|
|
{ /* responder */
|
|
generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
|
|
generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
|
|
}
|
|
|
|
child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE, MODE_TUNNEL,
|
|
ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
|
|
0, 0, NULL, NULL, 0);
|
|
proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
|
|
child_cfg->add_proposal(child_cfg, proposal);
|
|
|
|
if (num)
|
|
{ /* initiator */
|
|
add_ts(this->initiator_tsi, child_cfg, TRUE);
|
|
add_ts(this->initiator_tsr, child_cfg, FALSE);
|
|
}
|
|
else
|
|
{ /* responder */
|
|
add_ts(this->responder_tsr, child_cfg, TRUE);
|
|
add_ts(this->responder_tsi, child_cfg, FALSE);
|
|
}
|
|
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
|
|
return peer_cfg;
|
|
}
|
|
|
|
METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
|
|
private_load_tester_config_t *this,
|
|
identification_t *me, identification_t *other)
|
|
{
|
|
return enumerator_create_single(this->peer_cfg, NULL);
|
|
}
|
|
|
|
METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
|
|
private_load_tester_config_t *this, host_t *me, host_t *other)
|
|
{
|
|
ike_cfg_t *ike_cfg;
|
|
|
|
ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg);
|
|
return enumerator_create_single(ike_cfg, NULL);
|
|
}
|
|
|
|
METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
|
|
private_load_tester_config_t *this, char *name)
|
|
{
|
|
if (streq(name, "load-test"))
|
|
{
|
|
return generate_config(this, this->num++);
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
METHOD(load_tester_config_t, destroy, void,
|
|
private_load_tester_config_t *this)
|
|
{
|
|
this->peer_cfg->destroy(this->peer_cfg);
|
|
DESTROY_IF(this->proposal);
|
|
DESTROY_IF(this->vip);
|
|
free(this);
|
|
}
|
|
|
|
/**
|
|
* Described in header.
|
|
*/
|
|
load_tester_config_t *load_tester_config_create()
|
|
{
|
|
private_load_tester_config_t *this;
|
|
|
|
INIT(this,
|
|
.public = {
|
|
.backend = {
|
|
.create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
|
|
.create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
|
|
.get_peer_cfg_by_name = _get_peer_cfg_by_name,
|
|
},
|
|
.destroy = _destroy,
|
|
},
|
|
.num = 1,
|
|
);
|
|
|
|
if (lib->settings->get_bool(lib->settings,
|
|
"%s.plugins.load-tester.request_virtual_ip", FALSE, charon->name))
|
|
{
|
|
this->vip = host_create_from_string("0.0.0.0", 0);
|
|
}
|
|
this->pool = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.pool", NULL, charon->name);
|
|
this->remote = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.remote", "127.0.0.1", charon->name);
|
|
this->local = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.local", "0.0.0.0", charon->name);
|
|
|
|
this->proposal = proposal_create_from_string(PROTO_IKE,
|
|
lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.proposal", "aes128-sha1-modp768",
|
|
charon->name));
|
|
if (!this->proposal)
|
|
{ /* fallback */
|
|
this->proposal = proposal_create_from_string(PROTO_IKE,
|
|
"aes128-sha1-modp768");
|
|
}
|
|
this->ike_rekey = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.ike_rekey", 0, charon->name);
|
|
this->child_rekey = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.child_rekey", 600, charon->name);
|
|
this->dpd_delay = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.dpd_delay", 0, charon->name);
|
|
this->dpd_timeout = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.dpd_timeout", 0, charon->name);
|
|
|
|
this->initiator_auth = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.initiator_auth", "pubkey", charon->name);
|
|
this->responder_auth = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.responder_auth", "pubkey", charon->name);
|
|
this->initiator_id = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.initiator_id", NULL, charon->name);
|
|
this->initiator_match = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.initiator_match", NULL, charon->name);
|
|
this->responder_id = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.responder_id", NULL, charon->name);
|
|
|
|
this->initiator_tsi = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.initiator_tsi", NULL, charon->name);
|
|
this->responder_tsi =lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.responder_tsi",
|
|
this->initiator_tsi, charon->name);
|
|
this->initiator_tsr = lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.initiator_tsr", NULL, charon->name);
|
|
this->responder_tsr =lib->settings->get_str(lib->settings,
|
|
"%s.plugins.load-tester.responder_tsr",
|
|
this->initiator_tsr, charon->name);
|
|
|
|
this->port = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.dynamic_port", 0, charon->name);
|
|
this->version = lib->settings->get_int(lib->settings,
|
|
"%s.plugins.load-tester.version", IKE_ANY, charon->name);
|
|
|
|
this->peer_cfg = generate_config(this, 0);
|
|
|
|
return &this->public;
|
|
}
|
|
|