vici: Match identity with wildcards against remote ID in redirect command

diff --git a/src/libcharon/plugins/vici/README.md b/src/libcharon/plugins/vici/README.md
index d084883104c05cf40c909cad8263978d292c0598..54291b8bb07f468794e2af3baae14a406d2657b9 100644 (file)
--- a/src/libcharon/plugins/vici/README.md
+++ b/src/libcharon/plugins/vici/README.md
@@ -298,7 +298,8 @@ supported by the peer.
                ike = <redirect an IKE_SA by configuration name>
                ike-id = <redirect an IKE_SA by its unique id>
                peer-ip = <redirect an IKE_SA with matching peer IP>
-               peer-id = <redirect an IKE_SA with matching peer identity>
+               peer-id = <redirect an IKE_SA with matching peer identity, may contain
+                                  wildcards>
        } => {
                success = <yes or no>
                errmsg = <error string on failure>

diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
index 7bcab0e86e0f55ea1f33270f9026d843eb423bd4..a63caf0e1f07deab758a0e13c60f02d28a5c413f 100644 (file)
--- a/src/libcharon/plugins/vici/vici_control.c
+++ b/src/libcharon/plugins/vici/vici_control.c
@@ -366,7 +366,7 @@ CALLBACK(redirect, vici_message_t*,
        enumerator_t *sas;
        char *ike, *peer_ip, *peer_id, *gw, *errmsg = NULL;
        u_int ike_id, current, found = 0;
-       identification_t *gateway, *identity = NULL;
+       identification_t *gateway, *identity = NULL, *other_id;
        host_t *address = NULL;
        ike_sa_t *ike_sa;
        vici_builder_t *builder;
@@ -445,10 +445,13 @@ CALLBACK(redirect, vici_message_t*,
                {
                        continue;
                }
-               if (identity &&
-                       !identity->equals(identity, ike_sa->get_other_eap_id(ike_sa)))
+               if (identity)
                {
-                       continue;
+                       other_id = ike_sa->get_other_eap_id(ike_sa);
+                       if (!other_id->matches(other_id, identity))
+                       {
+                               continue;
+                       }
                }
                lib->processor->queue_job(lib->processor,
                                (job_t*)redirect_job_create(ike_sa->get_id(ike_sa), gateway));

diff --git a/src/swanctl/commands/redirect.c b/src/swanctl/commands/redirect.c
index 0afe96a1b4ffaace25f7b9bb195b6f5fa84f9a93..295689bd3e6e632734c22fb3895a0e757185004d 100644 (file)
--- a/src/swanctl/commands/redirect.c
+++ b/src/swanctl/commands/redirect.c
@@ -117,7 +117,7 @@ static void __attribute__ ((constructor))reg()
        command_register((command_t) {
                redirect, 'd', "redirect", "redirect an IKE_SA",
                {"--ike <name> | --ike-id <id> | --peer-ip <ip>",
-                "--peer-id <id> | --gateway <ip|fqdn> [--raw|--pretty]"},
+                "--peer-id <id|wildcards> | --gateway <ip|fqdn> [--raw|--pretty]"},
                {
                        {"help",                'h', 0, "show usage information"},
                        {"ike",                 'i', 1, "redirect by IKE_SA name"},