net/freeradius: Allow setting of minimum TLS version (#2463)

net/freeradius/pkg-descr

@@ -27,6 +27,7 @@ Plugin Changelog
 1.9.15
 
 * Fixed validation of CIDR for client network ranges
+* Allow setting of minimum TLS version
 
 1.9.14
 

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml

@@ -41,4 +41,10 @@
         <type>checkbox</type>
         <help>Checks that the username given by the user matches the Common-Name of the certificate.</help>
     </field>
+    <field>
+        <id>eap.tls_min_version</id>
+        <label>TLS Minimum Version</label>
+        <type>dropdown</type>
+        <help>Set minimum TLS version. Please be aware that every version below 1.2 is considered as insecure.</help>
+    </field>
 </form>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml

@@ -45,5 +45,15 @@
             <default>0</default>
             <Required>Y</Required>
         </check_tls_names>
+        <tls_min_version type="OptionField">
+            <default>Option1</default>
+            <Required>Y</Required>
+            <multiple>N</multiple>
+            <OptionValues>
+                <Option1 value="1.0">1.0</Option1>
+                <Option2 value="1.1">1.1</Option2>
+                <Option3 value="1.2">1.2</Option3>
+            </OptionValues>
+        </tls_min_version>
     </items>
 </model>

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap

@@ -453,7 +453,7 @@ eap {
                 #
                 #  The values must be in quotes.
                 #
-                tls_min_version = "1.0"
+                tls_min_version = "{{ OPNsense.freeradius.eap.tls_min_version }}"
                 tls_max_version = "1.2"
 
                 #  Elliptical cryptography configuration