mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

IPsec ID type parsing changes. Fixes #9243

Browse Source 
* Move code to function to avoid unnecessary duplication of code
* Clean up the logic to avoid further redundancies
* Set keyid type to be quoted and to have its type prefixed
This commit is contained in:
jim-p 2019-08-28 13:57:10 -04:00
parent 4b84c39dbe
commit 3a73fc74ca
2 changed files with 34 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/etc/inc/ipsec.inc
View File

@ -817,6 +817,36 @@ function ipsec_find_id(& $ph1ent, $side = "local", $rgmap = array()) {
return array($thisid_type, $thisid_data);
}
/*
* Fixup ID type/data to include prefix when necessary, add quotes, etc.
*/
function ipsec_fixup_id($type, $data) {
/* List of types to pass through as-is without changes or adding prefix */
$auto_types = array('address');
/* List of types which need the resulting string double quoted. */
$quote_types = array('keyid', 'asn1dn');
/* If the first character of asn1dn type data is not #, then rely on
* automatic parsing https://redmine.pfsense.org/issues/4792 */
if (($type == 'asn1dn') && !empty($data) && ($data[0] != '#')) {
$auto_types[] = 'asn1dn';
}
if ($type == 'any') {
$idstring = "";
} elseif (!in_array($type, $auto_types)) {
$idstring = "{$type}:{$data}";
} else {
$idstring = $data;
}
if (in_array($type, $quote_types)) {
$idstring = "\"{$idstring}\"";
}
return $idstring;
}
function ipsec_fixup_network($network) {
if (substr($network, -3) == '|/0') {
$result = substr($network, 0, -3);

31
src/etc/inc/vpn.inc
View File

@ -928,19 +928,9 @@ EOD;
}
list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, 'local');
if ($myid_type != 'address' && $myid_type != 'keyid' && $myid_type != 'asn1dn') {
$myid_data = "{$myid_type}:{$myid_data}";
} elseif ($myid_type == "asn1dn" && !empty($myid_data)) {
if ($myid_data[0] == '#') {
/* asn1dn needs double quotes */
$myid_data = "\"{$myid_type}:{$myid_data}\"";
} else {
$myid_data = "\"{$myid_data}\"";
}
}
$leftid = '';
if (!empty($myid_data)) {
$leftid = "leftid = {$myid_data}";
$leftid = ipsec_fixup_id($myid_type, $myid_data);
if (!empty($leftid)) {
$leftid = "leftid = {$leftid}";
}
$peerid_spec = '';
@ -948,20 +938,7 @@ EOD;
// Only specify peer ID if we are not dealing with mobile PSK
} else {
list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, 'peer', $rgmap);
if ($peerid_type == 'any') {
$peerid_spec = '';
} elseif ($peerid_type != 'address' && $peerid_type != 'keyid' && $peerid_type != 'asn1dn') {
$peerid_spec = "{$peerid_type}:{$peerid_data}";
} elseif ($peerid_type == "asn1dn") {
/* asn1dn needs double quotes */
if ($peerid_data[0] == '#') {
$peerid_spec = "\"{$peerid_type}:{$peerid_data}\"";
} elseif (!empty($peerid_data)) {
$peerid_spec = "\"{$peerid_data}\"";
}
} else {
$peerid_spec = $peerid_data;
}
$peerid_spec = ipsec_fixup_id($peerid_type, $peerid_data);
}
$ealgosp1 = '';