net\freeradius Certificate for LDAP Connection (#3061)

net/freeradius/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.9.20
+PLUGIN_VERSION=		1.9.21
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net/freeradius/pkg-descr

@@ -15,6 +15,10 @@ The server is fast, feature-rich, modular, and scalable.
 Plugin Changelog
 ================
 
+1.9.21
+
+* Add Certificate, StartTLS and Server port for LDAP Connection
+
 1.9.20
 
 * Remove TTLS-GTC from Default EAP Type (#2421)

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml

@@ -17,6 +17,24 @@
         <type>text</type>
         <help>Set the hostname or IP address to connect to.</help>
     </field>
+    <field>
+        <id>ldap.serverport</id>
+        <label>Server Port</label>
+        <type>text</type>
+        <help>Set the port to connect</help>
+    </field>
+    <field>
+        <id>ldap.ldapcert</id>
+        <label>Certificate</label>
+        <type>dropdown</type>
+        <help>Certificate to use to connect</help>
+    </field>
+    <field>
+        <id>ldap.ldapstarttls</id>
+        <label>Start TLS</label>
+        <type>checkbox</type>
+        <help>Start TLS</help>
+    </field>
     <field>
         <id>ldap.identity</id>
         <label>Bind User</label>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml

@@ -18,6 +18,17 @@
         <server type="TextField">
             <Required>N</Required>
         </server>
+      <serverport type="TextField">
+            <Required>N</Required>
+        </serverport>
+        <ldapcert type="CertificateField">
+            <Type>cert</Type>
+            <Required>N</Required>
+        </ldapcert>
+        <ldapstarttls type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </ldapstarttls>
         <identity type="TextField">
             <Required>N</Required>
         </identity>

net/freeradius/src/opnsense/scripts/Freeradius/generate_certs.php

@@ -41,6 +41,9 @@ $cert_pem_content = '';
 $ca_pem_filename = '/usr/local/etc/raddb/certs/ca_opn.pem';
 $ca_pem_content = '';
 
+$ldapcert_pem_filename = '/usr/local/etc/raddb/certs/cert_ldap.pem';
+$ldapcert_pem_content = '';
+
 // traverse Freeradius plugin for certficiates
 $configObj = Config::getInstance()->object();
 if (isset($configObj->OPNsense->freeradius)) {
@@ -108,6 +111,34 @@ if (isset($configObj->OPNsense->freeradius)) {
                 }
             }
         }
+       $cert_refid = (string)$find_cert->ldapcert;
+        // if eap has a certificate attached, search for its contents
+        if ($cert_refid != "") {
+            foreach ($configObj->cert as $ldapcert) {
+                if ($cert_refid == (string)$ldapcert->refid) {
+                    // generate cert pem file
+                    $pem_content = trim(str_replace("\n\n", "\n", str_replace(
+                        "\r",
+                        "",
+                        base64_decode((string)$ldapcert->crt)
+                    )));
+
+                    $pem_content .= "\n";
+                    $pem_content .= trim(str_replace(
+                        "\n\n",
+                        "\n",
+                        str_replace("\r", "", base64_decode((string)$ldapcert->prv))
+                    ));
+                    $pem_content .= "\n";
+                    $ldapcert_pem_content .= $pem_content;
+                    // generate ca pem file
+                    if (!empty($ldapcert->caref)) {
+                        $ldapcert = (array)$ldapcert;
+                        $ldapcert_pem_content .= ca_chain($ldapcert);
+                    }
+                }
+            }
+        }
     }
 }
 
@@ -118,3 +149,7 @@ echo "Certificates generated $cert_pem_filename\n";
 file_put_contents($ca_pem_filename, $ca_pem_content);
 chmod($ca_pem_filename, 0600);
 echo "Certificates generated $ca_pem_filename\n";
+
+file_put_contents($ldapcert_pem_filename, $ldapcert_pem_content);
+chmod($ldapcert_pem_filename, 0600);
+echo "Certificates generated $ldapcert_pem_filename\n";

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap

@@ -4,7 +4,9 @@ ldap {
 {%     if helpers.exists('OPNsense.freeradius.ldap.server') and OPNsense.freeradius.ldap.server != '' %}
         server = '{{ OPNsense.freeradius.ldap.protocol }}://{{ OPNsense.freeradius.ldap.server }}'
 {%     endif %}
-
+{%     if helpers.exists('OPNsense.freeradius.ldap.serverport') and OPNsense.freeradius.ldap.serverport != '' %}
+        port = '{{ OPNsense.freeradius.ldap.serverport }}'
+{%     endif %}
 {%     if helpers.exists('OPNsense.freeradius.ldap.identity') and OPNsense.freeradius.ldap.identity != '' %}
         identity = '{{ OPNsense.freeradius.ldap.identity }}'
 {%     endif %}
@@ -146,7 +148,16 @@ ldap {
 
         }
         tls {
+	{%     if helpers.exists('OPNsense.freeradius.ldap.ldapstarttls') and OPNsense.freeradius.ldap.ldapstarttls == '1' %}
+                start_tls = yes
+        {%     else %}
+                start_tls = no
+        {%     endif %}
                 require_cert    = 'allow'
+        {%     if helpers.exists('OPNsense.freeradius.ldap.ldapcert') and OPNsense.freeradius.ldap.ldapcert != '' %}
+                certificate_file = ${certdir}/cert_ldap.pem
+                private_key_file = ${certdir}/cert_ldap.pem
+        {%     endif %}
         }
         pool {
                 start = ${thread[pool].start_servers}