denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Add support to switch peer configs based on EAP-Identities

Browse Source 
This changes how EAP identities are used from the config. Instead of
setting a statically configured identity != %any, an EAP-Identity
exchange is now always initiated (and required).  If the received identity
doesn't match, the peer config is switched to one with a matching
identity (wildcards are supported for that match).  This allows switching
to a config with a different EAP method or child settings based on the
EAP identity.

There is currently no "best" match.  The configs are evaluated based on
the order returned from the initial peer config lookup.

References strongswan/strongswan#2702
This commit is contained in:
Tobias Brunner
2025-04-14 12:05:24 +02:00
parent 651a5b0ded
commit 2f2e4abe3c
4 changed files with 184 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+5 -3
View File
@@ -535,10 +535,12 @@ connections.<conn>.remote<suffix>.id = %any
specifies how RDNs are matched.
connections.<conn>.remote<suffix>.eap_id = id
Identity to use as peer identity during EAP authentication.
Use EAP-Identity method to request an identity from the client to match
against and use during EAP authentication.
Identity to use as peer identity during EAP authentication. If set to _%any_
the EAP-Identity method will be used to ask the client for an identity.
Use EAP-Identity method to request an identity from the client to match
against and use during EAP authentication. There is currently no "best"
match, configs are matched in the order they are loaded.
connections.<conn>.remote<suffix>.groups =
Authorization group memberships to require.