vici: Add support for POSIX regular expressions in identity fields

src/libcharon/plugins/vici/vici_config.c

@@ -1486,13 +1486,15 @@ CALLBACK(parse_auth, bool,
  */
 static bool parse_id(auth_cfg_t *cfg, auth_rule_t rule, chunk_t v)
 {
+	identification_t *id;
 	char buf[BUF_LEN];
 
-	if (!vici_stringify(v, buf, sizeof(buf)))
+	if (!vici_stringify(v, buf, sizeof(buf)) ||
+		!(id = identification_create_from_string_with_regex(buf)))
 	{
 		return FALSE;
 	}
-	cfg->add(cfg, rule, identification_create_from_string(buf));
+	cfg->add(cfg, rule, id);
 	return TRUE;
 }
 

src/libcharon/plugins/vici/vici_cred.c

@@ -395,13 +395,15 @@ CALLBACK(shared_owners, bool,
 {
 	if (streq(name, "owners"))
 	{
+		identification_t *id;
 		char buf[256];
 
-		if (!vici_stringify(value, buf, sizeof(buf)))
+		if (!vici_stringify(value, buf, sizeof(buf)) ||
+			!(id = identification_create_from_string_with_regex(buf)))
 		{
 			return FALSE;
 		}
-		owners->insert_last(owners, identification_create_from_string(buf));
+		owners->insert_last(owners, id);
 	}
 	return TRUE;
 }

src/swanctl/swanctl.opt

@@ -534,6 +534,17 @@ connections.<conn>.remote<suffix>.id = %any
 	with wildcards, the _charon.rdn_matching_ option in **strongswan.conf**(5)
 	specifies how RDNs are matched.
 
+	Extended POSIX regular expressions are also supported for remote identity
+	matching. They must start with an explicit type prefix, followed by a caret
+	character ('^'), and end with a dollar sign ('$') to indicate an anchored
+	pattern. Supported types are _rfc822_, _email_, _fqdn_, _dns_, and _asn1dn_.
+	While regular expressions are always matched against the string
+	representation of other identities, the type must match as well. The
+	matching is performed case insensitive. Make sure to escape backslash
+	characters when configuring identities in double quotes. Examples:
+	_email:^(moon|sun)@strongswan\.org$_, _fqdn:^vpn[0-9]+\.strongswan\.org$_,
+	_"asn1dn:^.*CN=.+\\.strongswan\\.org$"_.
+
 connections.<conn>.remote<suffix>.eap_id = id
 	Use EAP-Identity method to request an identity from the client to match
 	against and use during EAP authentication.
@@ -542,6 +553,9 @@ connections.<conn>.remote<suffix>.eap_id = id
 	against and use during EAP authentication. There is currently no "best"
 	match, configs are matched in the order they are loaded.
 
+	Wildcards and regular expressions are supported, refer to the **id** keyword
+	for details.
+
 connections.<conn>.remote<suffix>.groups =
 	Authorization group memberships to require.