denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

identification: Clarify that ID_USER_FQDN is just an alias for ID_RFC822_ADDR

Browse Source 
This means userfqdn: is a valid prefix for regular expressions.
This commit is contained in:
Tobias Brunner
2025-06-20 10:37:40 +02:00
parent e58ef258b5
commit a153626af7
4 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/tests/suites/test_identification.c
+3 -3
View File
@@ -683,7 +683,7 @@ START_TEST(test_equals_empty)
case ID_FQDN: case ID_FQDN:
ck_assert(!id_equals(a, "moon.strongswan.org")); ck_assert(!id_equals(a, "moon.strongswan.org"));
break; break;
case ID_USER_FQDN: case ID_RFC822_ADDR:
ck_assert(!id_equals(a, "[email protected]")); ck_assert(!id_equals(a, "[email protected]"));
break; break;
case ID_IPV6_ADDR: case ID_IPV6_ADDR:
@@ -1308,7 +1308,7 @@ START_TEST(test_matches_empty)
case ID_FQDN: case ID_FQDN:
ck_assert(id_matches(a, "moon.strongswan.org", ID_MATCH_NONE)); ck_assert(id_matches(a, "moon.strongswan.org", ID_MATCH_NONE));
break; break;
case ID_USER_FQDN: case ID_RFC822_ADDR:
ck_assert(id_matches(a, "[email protected]", ID_MATCH_NONE)); ck_assert(id_matches(a, "[email protected]", ID_MATCH_NONE));
break; break;
case ID_IPV6_ADDR: case ID_IPV6_ADDR:
@@ -1362,7 +1362,7 @@ START_TEST(test_matches_empty_reverse)
case ID_FQDN: case ID_FQDN:
ck_assert(id_matches_rev(a, "moon.strongswan.org", ID_MATCH_NONE)); ck_assert(id_matches_rev(a, "moon.strongswan.org", ID_MATCH_NONE));
break; break;
case ID_USER_FQDN: case ID_RFC822_ADDR:
ck_assert(id_matches_rev(a, "[email protected]", ID_MATCH_NONE)); ck_assert(id_matches_rev(a, "[email protected]", ID_MATCH_NONE));
break; break;
case ID_IPV6_ADDR: case ID_IPV6_ADDR:
src/libstrongswan/utils/identification.c
+2 -2
View File
@@ -1828,7 +1828,7 @@ static const struct {
{ "ipv6range:", ID_IPV6_ADDR_RANGE, FALSE}, { "ipv6range:", ID_IPV6_ADDR_RANGE, FALSE},
{ "rfc822:", ID_RFC822_ADDR, TRUE}, { "rfc822:", ID_RFC822_ADDR, TRUE},
{ "email:", ID_RFC822_ADDR, TRUE}, { "email:", ID_RFC822_ADDR, TRUE},
{ "userfqdn:", ID_USER_FQDN, FALSE}, { "userfqdn:", ID_RFC822_ADDR, TRUE},
{ "fqdn:", ID_FQDN, TRUE}, { "fqdn:", ID_FQDN, TRUE},
{ "dns:", ID_FQDN, TRUE}, { "dns:", ID_FQDN, TRUE},
{ "asn1dn:", ID_DER_ASN1_DN, TRUE}, { "asn1dn:", ID_DER_ASN1_DN, TRUE},
@@ -2111,7 +2111,7 @@ identification_t *identification_create_from_string(char *string)
} }
else if (*string == '@') else if (*string == '@')
{ {
this = identification_create(ID_USER_FQDN); this = identification_create(ID_RFC822_ADDR);
this->encoded = chunk_clone(chunk_from_str(string + 1)); this->encoded = chunk_clone(chunk_from_str(string + 1));
return &this->public; return &this->public;
} }
src/libstrongswan/utils/identification.h
+3 -3
View File
@@ -336,9 +336,9 @@ identification_t *identification_create_from_string(char *string);
* trusted/configured values, never untrusted values received over the network. * trusted/configured values, never untrusted values received over the network.
* *
* A regular expression must be prefixed by an identity type (supported are * A regular expression must be prefixed by an identity type (supported are
* rfc822:, email:, fqdn:, dns:, and asn1dn:), and it must start with a caret * rfc822:, email:, userfqdn:, fqdn:, dns:, and asn1dn:), and it must start
* ('^') and end with a dollar sign ('$') to indicate an anchored pattern. * with a caret ('^') and end with a dollar sign ('$') to indicate an anchored
* If the regular expression is invalid, the function returns NULL. * pattern. If the regular expression is invalid, the function returns NULL.
* *
* The regular expression is always matched against the string representation * The regular expression is always matched against the string representation
* of other identities and matching is performed case-insensitive. * of other identities and matching is performed case-insensitive.
src/swanctl/swanctl.opt
+4 -3
View File
@@ -537,11 +537,12 @@ connections.<conn>.remote<suffix>.id = %any
Extended POSIX regular expressions are also supported for remote identity Extended POSIX regular expressions are also supported for remote identity
matching. They must start with an explicit type prefix, followed by a caret matching. They must start with an explicit type prefix, followed by a caret
character ('^'), and end with a dollar sign ('$') to indicate an anchored character ('^'), and end with a dollar sign ('$') to indicate an anchored
pattern. Supported types are _rfc822_, _email_, _fqdn_, _dns_, and _asn1dn_. pattern. Make sure to escape backslash characters when configuring
identities in double quotes. Supported types are _rfc822_, _email_,
_userfqdn_, _fqdn_, _dns_, and _asn1dn_.
While regular expressions are always matched against the string While regular expressions are always matched against the string
representation of other identities, the type must match as well. The representation of other identities, the type must match as well. The
matching is performed case insensitive. Make sure to escape backslash matching is performed case insensitive. Examples:
characters when configuring identities in double quotes. Examples:
_email:^(moon|sun)@strongswan\.org$_, _fqdn:^vpn[0-9]+\.strongswan\.org$_, _email:^(moon|sun)@strongswan\.org$_, _fqdn:^vpn[0-9]+\.strongswan\.org$_,
_"asn1dn:^.*CN=.+\\.strongswan\\.org$"_. _"asn1dn:^.*CN=.+\\.strongswan\\.org$"_.