Project

General

Profile

Actions
Copy link

Bug #4794

closed

Handling of ASN1.DN values for RSA IPsec during upgrades from previous versions

Added by Jorge Albarenque about 9 years ago. Updated about 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Renato Botelho
Category:
Upgrade
Target version:
2.2.4
Start date:
06/27/2015
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2.x
Affected Architecture:

Description

The certificate CNs are interpreted differently by raccoon and strongSwan, for example:

raccoon:
C=US, ST=Whatever, L=Springfield, O=Springfield Power Plant/emailAddress=, CN=springfield.powerplant.com

strongSwan:
"C=US, ST=Whatever, L=Springfield, O=Springfield Power Plant, E=, CN=springfield.powerplant.com"

So on upgrades from v2.1.x and before, some regex needs to be done on the ASN1DN field.

Also, the value needs to be surrounded in quotes, but be careful because if the identity prefix is provided, the prefix must be included within the quotes, eg: rightid = "asn1dn:#whateverhexvalue..."
This will depend on how the identity type prefixes are handled (related to bug 4792 )

Actions
Copy link
 #1

Updated by Tobias Brunner about 9 years ago

As I've recently explained on an Ubuntu bug report related to pfSense just adding identity type prefixes is not correct and will most likely not result in the intended result.

Actions
Copy link
 #2

Updated by Jim Thompson about 9 years ago

  • Assignee set to Renato Botelho
Actions
Copy link
 #3

Updated by Chris Buechler about 9 years ago

  • Status changed from New to Confirmed

Should be fine to s/\/emailAddress/, E/ on asn1dn when doing config upgrade from 2.1.5

Actions
Copy link
 #4

Updated by Renato Botelho about 9 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
Actions
Copy link
 #6

Updated by Chris Buechler about 9 years ago

  • Status changed from Feedback to Resolved

works

Actions
Copy link

Also available in: Atom PDF