From 19c74251e03cd3eeabb403baac41987e4a8616b8 Mon Sep 17 00:00:00 2001
From: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Sat, 5 Dec 2020 09:18:28 +0100
Subject: [PATCH] [Freeradius] Create option to set EAP-TTLS-GTC for FreeRadius
 (#2089)

Creates an option to set freeradius to use EAP-TTLS-GTC.
This can, for example, be used to connect to LDAP databases with hashed passwords.

Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
---
 .../src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml  | 1 +
 .../service/templates/OPNsense/Freeradius/mods-enabled-eap   | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
index f2b451bea..9ec71ef01 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
@@ -13,6 +13,7 @@
                 <peap>PEAP</peap>
                 <tls>TLS</tls>
                 <ttls>TTLS</ttls>
+                <ttls-gtc>TTLS-GTC</ttls-gtc>
             </OptionValues>
         </default_eap_type>
         <enable_client_cert type="BooleanField">
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
index 5dc3b327f..8093143e8 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
@@ -628,8 +628,11 @@ eap {
                 #  EAP conversation, then this configuration entry is
                 #  ignored.
                 #
+                {% if helpers.exists('OPNsense.freeradius.eap.default_eap_type') and OPNsense.freeradius.eap.default_eap_type == 'ttls-gtc' %}
+                default_eap_type = gtc
+                {% else %}
                 default_eap_type = md5
-
+                {% endif %}
                 #  The tunneled authentication request does not usually
                 #  contain useful attributes like 'Calling-Station-Id',
                 #  etc.  These attributes are outside of the tunnel,