From 18225b7a4ae52753258deaa1f59399f2545d7fd6 Mon Sep 17 00:00:00 2001
From: Michael <m.muenz@gmail.com>
Date: Tue, 15 Feb 2022 10:00:21 +0100
Subject: [PATCH] net/freeradius: Allow LDAP in inner-tunnel  (#2626)

---
 net/freeradius/Makefile                               |  2 +-
 net/freeradius/pkg-descr                              |  4 ++++
 .../controllers/OPNsense/Freeradius/forms/ldap.xml    |  6 ++++++
 .../mvc/app/models/OPNsense/Freeradius/Ldap.xml       |  6 +++++-
 .../OPNsense/Freeradius/sites-enabled-inner-tunnel    | 11 +++++++++++
 5 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile
index a98a82cb3..ec54c2893 100644
--- a/net/freeradius/Makefile
+++ b/net/freeradius/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.9.18
+PLUGIN_VERSION=		1.9.19
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/net/freeradius/pkg-descr b/net/freeradius/pkg-descr
index d2006a9d0..9e2092f87 100644
--- a/net/freeradius/pkg-descr
+++ b/net/freeradius/pkg-descr
@@ -15,6 +15,10 @@ The server is fast, feature-rich, modular, and scalable.
 Plugin Changelog
 ================
 
+1.9.19
+
+* Allow to use LDAP in inner-tunnel (needed for LDAP authentication within 802.1X)
+
 1.9.18
 
 * Added support for fallback VLAN
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
index 38fa2a650..29cb57c69 100644
--- a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
@@ -1,4 +1,10 @@
 <form>
+    <field>
+        <id>ldap.innertunnel</id>
+        <label>Inner-Tunnel LDAP</label>
+        <type>checkbox</type>
+        <help>This enables LDAP authentication in inner-tunnel configuration. This is needed for protocols requiring encrypted authentication like 802.1X.</help>
+    </field>
     <field>
         <id>ldap.protocol</id>
         <label>Protocol Type</label>
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
index 3797eb5e5..53b4f55b5 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
@@ -1,8 +1,12 @@
 <model>
     <mount>//OPNsense/freeradius/ldap</mount>
     <description>LDAP configuration</description>
-    <version>1.0.0</version>
+    <version>1.0.1</version>
     <items>
+        <innertunnel type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </innertunnel>
         <protocol type="OptionField">
             <default>LDAPS</default>
             <Required>Y</Required>
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-inner-tunnel b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-inner-tunnel
index 55f987990..a7fb95535 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-inner-tunnel
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-inner-tunnel
@@ -155,7 +155,16 @@ authorize {
 
         #
         #  The ldap module reads passwords from the LDAP database.
+{%   if helpers.exists('OPNsense.freeradius.ldap.innertunnel') and OPNsense.freeradius.general.ldap.innertunnel == '1' %}
+        ldap
+          if ((ok || updated) && User-Password) {
+              update control {
+                  Auth-Type := ldap
+              }
+          }
+{%  else %}
         -ldap
+{%  endif %}
 
         #
         #  Enforce daily limits on time spent logged in.
@@ -242,9 +251,11 @@ authenticate {
         #  authentication server, and knows what to do with authentication.
         #  LDAP servers do not.
         #
+{%   if helpers.exists('OPNsense.freeradius.ldap.innertunnel') and OPNsense.freeradius.general.ldap.innertunnel == '1' %}
 #       Auth-Type LDAP {
 #               ldap
 #       }
+{%   endif %}
 
         #
         #  Allow EAP authentication.