From 390526d1865ef66fcdc33a3c296ab277fec5689b Mon Sep 17 00:00:00 2001 From: Michael Date: Fri, 27 Oct 2017 16:58:46 +0200 Subject: [PATCH] net/freeradius: fix super stupid mistake (#347) --- net/freeradius/Makefile | 2 +- .../app/models/OPNsense/Freeradius/Eap.xml | 2 +- .../OPNsense/Freeradius/mods-enabled-eap | 21 ++++++++++++------- 3 files changed, 16 insertions(+), 9 deletions(-) diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile index ebdf96b0a..dd295123b 100644 --- a/net/freeradius/Makefile +++ b/net/freeradius/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= freeradius -PLUGIN_VERSION= 1.2.0 +PLUGIN_VERSION= 1.2.1 PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server PLUGIN_DEPENDS= freeradius3 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml index 632b309ba..a65a3b144 100644 --- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml @@ -4,7 +4,7 @@ 1.0.0 - MD5 + md5 Y N diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap index dc32f5180..fbbb07fa8 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap @@ -28,6 +28,8 @@ eap { # {% if helpers.exists('OPNsense.freeradius.eap.default_eap_type') and OPNsense.freeradius.eap.default_eap_type != '' %} default_eap_type = {{ OPNsense.freeradius.eap.default_eap_type }} +{% else %} + default_eap_type = md5 {% endif %} # A list is maintained to correlate EAP-Response @@ -179,7 +181,8 @@ eap { private_key_password = private_key_file = ${certdir}/cert_opn.pem certificate_file = ${certdir}/cert_opn.pem -{% else %} +{% endif %} +{% else %} private_key_password = whatever private_key_file = ${certdir}/server.pem # If Private key & Certificate are located in @@ -193,7 +196,7 @@ eap { # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/server.pem -{% endif %} +{% endif %} # Trusted Root CA list # # ALL of the CA's in this list will be trusted @@ -204,11 +207,13 @@ eap { # In that case, this CA file should contain # *one* CA certificate. # +{% if helpers.exists('OPNsense.freeradius.eap.enable_client_cert') and OPNsense.freeradius.eap.enable_client_cert == '1' %} {% if helpers.exists('OPNsense.freeradius.eap.ca') and OPNsense.freeradius.eap.ca != '' %} ca_file = ${certdir}/ca_opn.pem -{% else %} - ca_file = ${cadir}/ca.pem {% endif %} +{% else %} + ca_file = ${cadir}/ca.pem +{% endif %} # OpenSSL will automatically create certificate chains, # unless we tell it to not do that. The problem is that # it sometimes gets the chains right from a certificate @@ -290,11 +295,13 @@ eap { # 'c_rehash' is OpenSSL's command. # 3) uncomment the lines below. # 5) Restart radiusd +{% if helpers.exists('OPNsense.freeradius.eap.enable_client_cert') and OPNsense.freeradius.eap.enable_client_cert == '1' %} {% if helpers.exists('OPNsense.freeradius.eap.crl') and OPNsense.freeradius.eap.crl != '' %} check_crl = yes -{% else %} - # check_crl = yes {% endif %} +{% else %} + # check_crl = yes +{% endif %} # Check if intermediate CAs have been revoked. # check_all_crl = yes @@ -570,7 +577,7 @@ eap { # softfail = no } } -{% endif %} + ## EAP-TLS # # As of Version 3.0, the TLS configuration for TLS-based