mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set rightca for IPsec phase 1 using Mutual RSA, Mutual RSA + xauth, or EAP-TLS. Fixes #5241.

Browse Source
This commit is contained in:
Matt Smith 2015-10-15 10:21:11 -05:00
parent b7e3ab94e2
commit cd4aa77ca3
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
etc/inc/vpn.inc
View File

@ -957,6 +957,21 @@ EOD;
}
}
if (!empty($ph1ent['caref'])) {
$ca = lookup_ca($ph1ent['caref']);
if ($ca) {
$casubarr = cert_get_subject_array($ca['crt']);
$casub = "";
foreach ($casubarr as $casubfield) {
if (empty($casub)) {
$casub = "/";
}
$casub .= "{$casubfield['a']}={$casubfield['v']}/";
}
}
}
$authentication = "";
switch ($ph1ent['authentication_method']) {
case 'eap-mschapv2':
@ -981,6 +996,9 @@ EOD;
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
}
}
if (isset($casub)) {
$authentication .= "\n\trightca=\"$casub\"";
}
break;
case 'eap-radius':
if (isset($ph1ent['mobile'])) {
@ -1002,6 +1020,9 @@ EOD;
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
}
if (isset($casub)) {
$authentication .= "\n\trightca=\"$casub\"";
}
break;
case 'xauth_psk_server':
$authentication = "leftauth = psk\n\trightauth = psk";
@ -1015,6 +1036,9 @@ EOD;
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
}
if (isset($casub)) {
$authentication .= "\n\trightca=\"$casub\"";
}
break;
case 'hybrid_rsa_server':
$authentication = "leftauth = pubkey\n\trightauth = xauth-generic";