static_config.conf

/* --------------------------------------------------------------------------------------------------------- */
/* --------------------------------------------------------------------------------------------------------- */
// icinga2 static configuration for eduroam.cz
//
//
/* --------------------------------------------------------------------------------------------------------- */
/* --------------------------------------------------------------------------------------------------------- */
index = 0

for(realm in realms) {
  key = keys(realm)[0]                // get realm

  /* --------------------------------------------------------------------------------------------------------- */
  // coverage-info

  if(typeof(realm[key].home_servers) == Array) {
    apply Service "COVERAGE-INFO-" + key use(realm, key) {
      import "coverage info template"

      vars.realm = key

      groups = [ "COVERAGE-INFO" ]
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#coverage-info"
      assign where host.name == realm[key].home_servers[0]
    }
  }

  if(typeof(realm[key].home_servers) != Array) {
    apply Service "COVERAGE-INFO-" + key use(realm, key) {
      import "coverage info template"

      vars.realm = key

      groups = [ "COVERAGE-INFO" ]
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#coverage-info"
      assign where host.name == realm[key].home_servers
    }
  }

  /* --------------------------------------------------------------------------------------------------------- */
  // compromised users
  if(typeof(realm[key].home_servers) == Array) {
    h = get_host(realm[key].home_servers[0])        // get host

    if(h != null && host.vars.type != "SP") {       // host exists and does not have "SP" type
      apply Service "COMPROMISED-USERS-" + key use(realm, key) {
        import "compromised users template"
        groups = [ "COMPROMISED-USERS" ]
        enable_notifications = false
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#compromised-users"
        assign where host.name == realm[key].home_servers[0]
      }
    }
  }

  if(typeof(realm[key].home_servers) != Array) {
    h = get_host(realm[key].home_servers)        // get host

    if(h != null && host.vars.type != "SP") {       // host exists and does not have "SP" type
      apply Service "COMPROMISED-USERS-" + key use(realm, key) {
        import "compromised users template"
        groups = [ "COMPROMISED-USERS" ]
        enable_notifications = false
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#compromised-users"
        assign where host.name == realm[key].home_servers
        ignore where host.vars.type == "SP"
      }
    }
  }

  /* --------------------------------------------------------------------------------------------------------- */
  // eduroam CAT

  // CAT needs to be applied for all aliases every realm has
  // for following test EAP-CERTIFICATE that may use CA cert from CAT.
  // The CA cert must have a predictable name (based on alias/realm) for the ease of use of the test.

  for(alias in realm[key].realm_aliases.split(",")) {
    if(typeof(realm[key].home_servers) == Array) {
      apply Service "CAT-" + alias use(alias, realm, key) {

        import "eduroam cat template"
        vars.realm = alias

        groups = [ "CAT" ]
        enable_notifications = false
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#cat"

        assign where host.name == realm[key].home_servers[0] && host.vars.type != "SP"
      }
    }

    if(typeof(realm[key].home_servers) != Array) {
      apply Service "CAT-" + alias use(alias, realm, key) {

        import "eduroam cat template"
        vars.realm = alias

        groups = [ "CAT" ]
        enable_notifications = false
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#cat"

        assign where host.name == realm[key].home_servers && host.vars.type != "SP"
      }
    }
  }

  /* --------------------------------------------------------------------------------------------------------- */
  // concurrent inst
  if(typeof(realm[key].home_servers) == Array) {
    apply Service "CONCURRENT-INST-" + key use(realm, key) {
      import "concurrent inst template"
      vars.realm = key
      groups = [ "CONCURRENT-INST" ]
      enable_notifications = false
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#concurrent-inst"
      assign where host.name == realm[key].home_servers[0]
    }
  }

  if(typeof(realm[key].home_servers) != Array) {
    apply Service "CONCURRENT-INST-" + key use(realm, key) {
      import "concurrent inst template"
      vars.realm = key
      groups = [ "CONCURRENT-INST" ]
      enable_notifications = false
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#concurrent-inst"
      assign where host.name == realm[key].home_servers
    }
  }
  /* --------------------------------------------------------------------------------------------------------- */

  // skip if visitor's realm does not have testing user
  // or no home server exists where testing user should be authenticated
  if(realm[key].testing_id == "undefined" || realm[key].home_servers == "undefined") {
    continue
  }

  /* --------------------------------------------------------------------------------------------------------- */
  // home realm alive
  if(typeof(realm[key].home_servers) == Array) {
    apply Service "HOME-REALM-ALIVE-" + key use(realm, key) {

      import "home realm alive template"
      vars.home_servers = realm[key].home_servers
      vars.realm = key

      groups = [ "HOME-REALM-ALIVE" ]
      enable_notifications = false
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#home-realm-alive"

      assign where host.name == realm[key].home_servers[0]
    }
  }
  /* --------------------------------------------------------------------------------------------------------- */
  /* --------------------------------------------------------------------------------------------------------- */

  for(radius in radius_servers) {
    server = keys(radius)[0]

    /* --------------------------------------------------------------------------------------------------------- */
    // check_rad_eap / matrix of visits
    apply Service "@" + key use(realm, server, radius, index, key) {

      display_name = "@" + key
      check_command = "check_rad_eap"
      vars.testing_id = realm[key].testing_id               // visitor's testind id
      vars.testing_password = realm[key].testing_password   // visitor's testing password
      vars.mac_address = mac_address[index]
      vars.visitors_realm = key
      vars.info = "ermon.cesnet.cz is testing realm " + key + " at radius server " + server
      groups = [ key ]

      if((typeof(realm[key].home_servers) == Array && server in realm[key].home_servers) || (typeof(realm[key].home_servers) == String && server == realm[key].home_servers)) {
        vars.home_realm_check = 1
        check_interval = 300
        retry_interval = 600
      }
      if((typeof(realm[key].home_servers) == Array && server !in realm[key].home_servers) || (typeof(realm[key].home_servers) == String && server != realm[key].home_servers)) {
        vars.home_realm_check = 0
        check_interval = 10800
        retry_interval = 7200
        enable_notifications = false
      }

      if(key == "cesnet.cz") {
        vars.check_cert = 1
        vars.server_hostname = "radius.cesnet.cz"
      }

      max_check_attempts = 3
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#domaci_realm"

      assign where host.name == server
    }
    index += 1
    /* --------------------------------------------------------------------------------------------------------- */

    // TODO - nebylo by lepsi pro kazdy server?
    // tohle rozhodne bude chtit pro kazdy server, protoze by se to melo vadidovat proti informacim z CATu
    // -> muze to odhalit nejake konfiguracni problemy, kdy ma CAT nastaven napr pouze jeden server ... 

    //for(alias in realm[key].realm_aliases.split(",")) {
    //  apply Service "EAP-CERTIFICATE-" + alias use(alias, realm, radius, index, server, key) {

    //    import "eap certificate template"

    //    // testing id realm set to alias
    //    vars.testing_id = realm[key].testing_id.split("@")[0] + "@" + alias               // visitor's testind id

    //    vars.testing_password = realm[key].testing_password   // visitor's testing password
    //    vars.mac_address = mac_address[index]
    //    vars.visitors_realm = key
    //    vars.mon_realm = alias
    //    vars.info = "ermon.cesnet.cz is testing realm " + alias + " at radius server " + server

    //    enable_notifications = false

    //    groups = [ "EAP-CERTIFICATE" ]
    //    vars.doc_url = "TODO"

    //    assign where host.name == server
    //  }
    //  index += 1
    //}
    /* --------------------------------------------------------------------------------------------------------- */

    // apply for each monitored realm for given server
    if(key in radius[server]) {
      /* --------------------------------------------------------------------------------------------------------- */
      // chargeable user identity
      apply Service "CHARGEABLE-USER-IDENTITY-" + key use(realm, server, radius, index, key) {

        import "chargeable user identity template"
        vars.testing_id = realm[key].testing_id
        vars.testing_password = realm[key].testing_password
        vars.mac_address = mac_address[index]
        enable_notifications = false

        groups = [ "CHARGEABLE-USER-IDENTITY" ]
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#chargeable-user-identity"

        assign where host.name == server
      }
      index += 1
      /* --------------------------------------------------------------------------------------------------------- */
      // fake uid
      apply Service "FAKE-UID-" + key use(realm, radius, index, server, key) {

        import "fake uid template"
        vars.testing_id = realm[key].testing_id
        vars.anon_id = "anon" + random().to_string() + "@" + realm[key].testing_id.split("@")[1]
        vars.testing_password = realm[key].testing_password
        vars.mac_address = mac_address[index]

        groups = [ "FAKE-UID" ]
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#fake-uid"

        assign where host.name == server && host.vars.type != "SP"
        ignore where realm[key].testing_id.contains("@") == false
      }
      index += 1
      /* --------------------------------------------------------------------------------------------------------- */
      // vcelka maja
      apply Service "VCELKA-MAJA-" + key use(realm, radius, index, server, key) {

        import "vcelka maja template"

        vars.mac_address1 = mac_address[index]
        vars.mac_address2 = mac_address[index + 1]
        vars.realm = key

        groups = [ "VCELKA-MAJA" ]
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#vcelka-maja"

        assign where host.name == server && host.vars.type != "SP"
      }
      index += 2
      /* --------------------------------------------------------------------------------------------------------- */
      // cve-2017-9148
      apply Service "CVE-2017-9148-" + key use(realm, radius, index, server, key) {

        import "cve-2017-9148 template"

        vars.testing_id = realm[key].testing_id
        vars.mac_address1 = mac_address[index]
        vars.mac_address2 = mac_address[index + 1]
        vars.realm = key

        groups = [ "CVE-2017-9148" ]
        vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#cve-2017-9148"

        assign where host.name == server && host.vars.type != "SP"
      }
      index += 2
      ///* --------------------------------------------------------------------------------------------------------- */
      //// MISSING-NAS-PORT-TYPE
      //apply Service "MISSING-NAS-PORT-TYPE-" + key use(realm, radius, index, server, key) {

      //  import "missing nas port type template"

      //  vars.testing_id = realm[key].testing_id
      //  vars.mac_address = mac_address[index]

      //  groups = [ "MISSING-NAS-PORT-TYPE" ]
      //  //vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#cve-2017-9148"
      //  // TODO

      //  enable_notifications = false

      //  //assign where host.name == server && host.vars.type != "SP"
      //  assign where host.name == server && server == "radius1.cesnet.cz"
      //}
      //index += 1
      ///* --------------------------------------------------------------------------------------------------------- */
    }
    /* --------------------------------------------------------------------------------------------------------- */

    // key in not matching the first monitored realm of server
    if(key != radius[server][0]) {              // suitable for services which should be applied only once to every server in case there are multiple monitored realms on one server
      continue
    }

    /* --------------------------------------------------------------------------------------------------------- */
    // big packet
    apply Service "BIG-PACKET" use(realm, radius, index, server, key) {

      import "big packet template"
      vars.testing_id = "big-test@cesnet.cz"
      vars.testing_password = big_packet_testing_password
      vars.mac_address = mac_address[index]
      vars.info = "ermon.cesnet.cz is testing UDP fragmentation at server " + server
      vars.require_fragmented = 1

      groups = [ "BIG-PACKET" ]
      vars.doc_url = "https://www.eduroam.cz/cs/spravce/monitoring/end2end_monitoring_new#big-packet"

      assign where host.name == server && host.vars.type != "SP"
    }
    index += 1
    /* --------------------------------------------------------------------------------------------------------- */
  }
}