From 3e5c4547578680dd9e6165917a817d5bbec21a5c Mon Sep 17 00:00:00 2001
From: Michael <m.muenz@gmail.com>
Date: Fri, 5 Nov 2021 08:25:57 +0100
Subject: [PATCH] net/freeradius: Allow setting of minimum TLS version (#2463)

---
 net/freeradius/pkg-descr                               |  1 +
 .../app/controllers/OPNsense/Freeradius/forms/eap.xml  |  6 ++++++
 .../mvc/app/models/OPNsense/Freeradius/Eap.xml         | 10 ++++++++++
 .../templates/OPNsense/Freeradius/mods-enabled-eap     |  2 +-
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/net/freeradius/pkg-descr b/net/freeradius/pkg-descr
index 023f6c57a..1be5165ef 100644
--- a/net/freeradius/pkg-descr
+++ b/net/freeradius/pkg-descr
@@ -27,6 +27,7 @@ Plugin Changelog
 1.9.15
 
 * Fixed validation of CIDR for client network ranges
+* Allow setting of minimum TLS version
 
 1.9.14
 
diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml
index 8747dd6aa..843862089 100644
--- a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml
@@ -41,4 +41,10 @@
         <type>checkbox</type>
         <help>Checks that the username given by the user matches the Common-Name of the certificate.</help>
     </field>
+    <field>
+        <id>eap.tls_min_version</id>
+        <label>TLS Minimum Version</label>
+        <type>dropdown</type>
+        <help>Set minimum TLS version. Please be aware that every version below 1.2 is considered as insecure.</help>
+    </field>
 </form>
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
index f4604c752..1f5e02795 100644
--- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
+++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml
@@ -45,5 +45,15 @@
             <default>0</default>
             <Required>Y</Required>
         </check_tls_names>
+        <tls_min_version type="OptionField">
+            <default>Option1</default>
+            <Required>Y</Required>
+            <multiple>N</multiple>
+            <OptionValues>
+                <Option1 value="1.0">1.0</Option1>
+                <Option2 value="1.1">1.1</Option2>
+                <Option3 value="1.2">1.2</Option3>
+            </OptionValues>
+        </tls_min_version>
     </items>
 </model>
diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
index ff98fca0b..954edf8b6 100644
--- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
+++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap
@@ -453,7 +453,7 @@ eap {
                 #
                 #  The values must be in quotes.
                 #
-                tls_min_version = "1.0"
+                tls_min_version = "{{ OPNsense.freeradius.eap.tls_min_version }}"
                 tls_max_version = "1.2"
 
                 #  Elliptical cryptography configuration