testing: Make RADIUS server enforce client identity in certificate's CN

testing/tests/ikev2-stroke/rw-eap-tls-radius/evaltest.dat

@@ -1,7 +1,7 @@
 carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with RSA.* successful::YES
 carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
 carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
-moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, CN=[email protected]' with EAP successful::YES
+moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
 moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES

testing/tests/ikev2-stroke/rw-eap-tls-radius/hosts/alice/etc/freeradius/3.0/mods-available/eap

@@ -7,6 +7,7 @@ eap {
     ca_file = ${cadir}/strongswanCert.pem
     cipher_list = "DEFAULT"
     random_file = ${certdir}/random
+    check_cert_cn = %{User-Name}
   }
 
   tls {

testing/tests/ikev2-stroke/rw-eap-tls-radius/hosts/carol/etc/ipsec.conf

@@ -10,6 +10,7 @@ conn %default
 conn home
 	left=PH_IP_CAROL
 	leftcert=carolCert.pem
+	[email protected]
 	leftauth=eap
 	leftfirewall=yes
 	right=PH_IP_MOON

testing/tests/ikev2-stroke/rw-eap-tls-radius/hosts/moon/etc/ipsec.conf

@@ -15,7 +15,7 @@ conn rw-eap
 	leftcert=moonCert.pem
 	leftauth=pubkey
 	leftfirewall=yes
-	rightid="C=CH, O=strongSwan Project, OU=Research, CN=[email protected]"
+	[email protected]
 	rightauth=eap-radius
 	rightsendcert=never
 	right=%any