VPN: IPsec: Connections [new] - Allow the use of eap_id = %any

[Monviech]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [x] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

If you use eap-mschapv2 on the OPNsense side in combination with a Windows VPN as client, Windows expects to be asked for an EAP-Identity exchange. If you don't offer it, the first authentication round will always fail and you have to input your username and password twice each time you connect the client.

For that to be fixed, you have to set the "eap_id = %any" in the remote authentication.

Example:

        remote-id {
            round = 0
            auth = eap-mschapv2
            eap_id = %any
        }

The parameter can't be set in the OPNsense GUI because there is a text validation error.

Describe the solution you like

I would like the GUI to allow setting "EAP Id" explicitly to "%any". The help text can be adjusted to hint to the use of %any.

Describe alternatives you considered

I don't know of any.

Additional context https://wiki.strongswan.org/issues/1183 https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html#_connections_conn_remote "eap_id: Identity to use as peer identity during EAP authentication. If set to %any the EAP-Identity method will be used to ask the client for an EAP identity"

[fichtner]

For reference this was mentioned here just yesterday... https://github.com/opnsense/core/issues/3295#issuecomment-1706853647

[AdSchellevis]

https://github.com/opnsense/core/commit/e6da85918d2a63e35b4e76d6ef0166f7bf3ba872 should do the trick.

[Monviech]

@AdSchellevis I will give feedback tomorrow. Thank you for all your great work!

[Monviech]

I have tested it and it works for locals, but not for remotes.

In /usr/local/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.xml the eap_id is defined in two sections. The patch added the regex pattern to locals.

<locals>
 <eap_id type="TextField">
                    <Required>N</Required>
                    <mask>/^([0-9a-zA-Z\.\-,_\:\@\%]){0,1024}$/u</mask>
                </eap_id>
</locals>

<remotes>
 <eap_id type="TextField">
                    <Required>N</Required>
                    <mask>/^([0-9a-zA-Z\.\-,_\:\@]){0,1024}$/u</mask>
                </eap_id>
</remotes>

[AdSchellevis]

meh, stupid me, missed a spot https://github.com/opnsense/core/commit/2207bd2634643ac77598f25a4175083a12c63b35

[Monviech]

Thank you now it's all good. 👍