From cd4aa77ca3f6099c533800934efbb1496b9ff7e6 Mon Sep 17 00:00:00 2001
From: Matt Smith <mgsmith@netgate.com>
Date: Thu, 15 Oct 2015 10:21:11 -0500
Subject: [PATCH] Set rightca for IPsec phase 1 using Mutual RSA, Mutual RSA +
 xauth, or EAP-TLS. Fixes #5241.

---
 etc/inc/vpn.inc | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 2d88814259..9627a41c7d 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -957,6 +957,21 @@ EOD;
 				}
 			}
 
+			if (!empty($ph1ent['caref'])) {
+				$ca = lookup_ca($ph1ent['caref']);
+				if ($ca) {
+					$casubarr = cert_get_subject_array($ca['crt']);
+					$casub = "";
+					foreach ($casubarr as $casubfield) {
+						if (empty($casub)) {
+							$casub = "/";
+						}
+						$casub .= "{$casubfield['a']}={$casubfield['v']}/";
+					}
+
+				}
+			}
+
 			$authentication = "";
 			switch ($ph1ent['authentication_method']) {
 				case 'eap-mschapv2':
@@ -981,6 +996,9 @@ EOD;
 							$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
 						}
 					}
+					if (isset($casub)) {
+						$authentication .= "\n\trightca=\"$casub\"";
+					}
 					break;
 				case 'eap-radius':
 					if (isset($ph1ent['mobile'])) {
@@ -1002,6 +1020,9 @@ EOD;
 					if (!empty($ph1ent['certref'])) {
 						$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
 					}
+					if (isset($casub)) {
+						$authentication .= "\n\trightca=\"$casub\"";
+					}
 					break;
 				case 'xauth_psk_server':
 					$authentication = "leftauth = psk\n\trightauth = psk";
@@ -1015,6 +1036,9 @@ EOD;
 					if (!empty($ph1ent['certref'])) {
 						$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
 					}
+					if (isset($casub)) {
+						$authentication .= "\n\trightca=\"$casub\"";
+					}
 					break;
 				case 'hybrid_rsa_server':
 					$authentication = "leftauth = pubkey\n\trightauth = xauth-generic";