From 3a73fc74ca54b1167fbecfb679d0e634f5f1ab2e Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Wed, 28 Aug 2019 13:57:10 -0400
Subject: [PATCH] IPsec ID type parsing changes. Fixes #9243

* Move code to function to avoid unnecessary duplication of code
* Clean up the logic to avoid further redundancies
* Set keyid type to be quoted and to have its type prefixed
---
 src/etc/inc/ipsec.inc | 30 ++++++++++++++++++++++++++++++
 src/etc/inc/vpn.inc   | 31 ++++---------------------------
 2 files changed, 34 insertions(+), 27 deletions(-)

diff --git a/src/etc/inc/ipsec.inc b/src/etc/inc/ipsec.inc
index 5fa0817896..5577775444 100644
--- a/src/etc/inc/ipsec.inc
+++ b/src/etc/inc/ipsec.inc
@@ -817,6 +817,36 @@ function ipsec_find_id(& $ph1ent, $side = "local", $rgmap = array()) {
 	return array($thisid_type, $thisid_data);
 }
 
+/*
+ * Fixup ID type/data to include prefix when necessary, add quotes, etc.
+ */
+function ipsec_fixup_id($type, $data) {
+	/* List of types to pass through as-is without changes or adding prefix */
+	$auto_types = array('address');
+	/* List of types which need the resulting string double quoted. */
+	$quote_types = array('keyid', 'asn1dn');
+
+	/* If the first character of asn1dn type data is not #, then rely on
+	 * automatic parsing https://redmine.pfsense.org/issues/4792 */
+	if (($type == 'asn1dn') && !empty($data) && ($data[0] != '#')) {
+		$auto_types[] = 'asn1dn';
+	}
+
+	if ($type == 'any') {
+		$idstring = "";
+	} elseif (!in_array($type, $auto_types)) {
+		$idstring = "{$type}:{$data}";
+	} else {
+		$idstring = $data;
+	}
+
+	if (in_array($type, $quote_types)) {
+		$idstring = "\"{$idstring}\"";
+	}
+
+	return $idstring;
+}
+
 function ipsec_fixup_network($network) {
 	if (substr($network, -3) == '|/0') {
 		$result = substr($network, 0, -3);
diff --git a/src/etc/inc/vpn.inc b/src/etc/inc/vpn.inc
index 98731e64ba..32712078be 100644
--- a/src/etc/inc/vpn.inc
+++ b/src/etc/inc/vpn.inc
@@ -928,19 +928,9 @@ EOD;
 			}
 
 			list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, 'local');
-			if ($myid_type != 'address' && $myid_type != 'keyid' && $myid_type != 'asn1dn') {
-				$myid_data = "{$myid_type}:{$myid_data}";
-			} elseif ($myid_type == "asn1dn" && !empty($myid_data)) {
-				if ($myid_data[0] == '#') {
-				/* asn1dn needs double quotes */
-					$myid_data = "\"{$myid_type}:{$myid_data}\"";
-				} else {
-					$myid_data = "\"{$myid_data}\"";
-				}
-			}
-			$leftid = '';
-			if (!empty($myid_data)) {
-				$leftid = "leftid = {$myid_data}";
+			$leftid = ipsec_fixup_id($myid_type, $myid_data);
+			if (!empty($leftid)) {
+				$leftid = "leftid = {$leftid}";
 			}
 
 			$peerid_spec = '';
@@ -948,20 +938,7 @@ EOD;
 				// Only specify peer ID if we are not dealing with mobile PSK
 			} else {
 				list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, 'peer', $rgmap);
-				if ($peerid_type == 'any') {
-					$peerid_spec = '';
-				} elseif ($peerid_type != 'address' && $peerid_type != 'keyid' && $peerid_type != 'asn1dn') {
-					$peerid_spec = "{$peerid_type}:{$peerid_data}";
-				} elseif ($peerid_type == "asn1dn") {
-					/* asn1dn needs double quotes */
-					if ($peerid_data[0] == '#') {
-						$peerid_spec = "\"{$peerid_type}:{$peerid_data}\"";
-					} elseif (!empty($peerid_data)) {
-						$peerid_spec = "\"{$peerid_data}\"";
-					}
-				} else {
-					$peerid_spec = $peerid_data;
-				}
+				$peerid_spec = ipsec_fixup_id($peerid_type, $peerid_data);
 			}
 
 			$ealgosp1 = '';