strongSwan

As far as I can tell from the code, forwarding other kinds of RADIUS attributes should be possible quite easily.

The question is, though, what kind of attributes those would be. For UNITY_BANNER we currently forward CVPN3000-IPSec-Banner1(15) and CVPN3000-IPSec-Banner2(36), both defined within the ALTIGA PEN (0x000c04/3076), Cisco provides a list of the defined attributes.

For UNITY_DEF_DOMAIN we could use CVPN3000-IPSec-Default-Domain(28), for UNITY_SPLITDNS_NAME there is CVPN3000-IPSec-Split-DNS-Names(29), but for UNITY_SPLIT_INCLUDE and UNITY_LOCAL_LAN there doesn't seem to be a ready to use attribute.

Well, there is CVPN3000-IPSec-Split-Tunnel-List(27) and CVPN3000-IPSec-Split-Tunneling-Policy(55) but those don't exactly correspond to the UNITY attributes. Apparently, split-tunnel-policy can take the values tunnelall(0), tunnelspecified(1), excludespecified(2). And from the Cisco docs it looks like split-tunnel-network-list takes the name of an ACL and not a list of subnets. Which seems to limit the flexibility quite a bit, that is, defining UNITY_SPLIT_INCLUDE and UNITY_LOCAL_LAN seems not possible, all addresses in the ACL are sent in either one of those ModeConfig attributes, depending on the defined policy.

I suppose we could redefine the meaning of the contents of a CVPN3000-IPSec-Split-Tunnel-List attribute to our liking (e.g. as a list of subnets, optionally with a ! before or after a subnet to send it in UNITY_LOCAL_LAN instead of UNITY_SPLIT_INCLUDE) but that wouldn't be compatible with a Cisco setup. Alternatively, we could actually implement something like ACLs (but with more flexibility), for instance:

charon {
    plugins {
        eap-radius {
            unity-acls {
                acl1 {
                    include = <subnets>
                    exclude = <subnets>
                }
                acl2 {
                    include = <subnets>
                }
            }
        }
    }    
}

But that's very IKEv1/Cisco specific and might be overkill.

Of course, we could also define our own attributes in the ITA PEN (0x00902a/36906) namespace, but I don't know if that's preferable.

As for solution, I would prefer combination of CVPN3000-IPSec-Split-Tunnel-List attribute as a list of subnets, and CVPN3000-IPSec-Split-Tunneling-Policy as a "direction" option: 1 sends UNITY_LOCAL_LAN to the client and 2 sends UNITY_SPLIT_INCLUDE to the client.

That would be a possibility. I implemented this in the radius-unity branch of our repository. But I reversed the interpretation of the policy value, that is, tunnelspecified(1) sends UNITY_SPLIT_INCLUDE and excludespecified(2) sends UNITY_LOCAL_LAN. It is still a bit less flexible than e.g. the sql-attr plugin, which allows assigning both kinds of attributes to clients.

Multiple subnets can be separated with a comma (not sure if a space would be better), and are currently sent in a single configuration payload (perhaps I change that as it is not compatible with releases before 5.1.0).

Could you please support "Framed-IP-Netmask" (9) parameter from RADIUS?

I pushed another commit to that branch that adds support for this.