New Plugin "RadSecProxy" (#1894)

net/radsecproxy/Makefile

@@ -0,0 +1,8 @@
+PLUGIN_NAME=		radsecproxy
+PLUGIN_VERSION=	0.1
+PLUGIN_COMMENT=	RADIUS proxy provides both RADIUS UDP and TCP/TLS (RadSec) transport
+PLUGIN_DEPENDS=	radsecproxy
+PLUGIN_MAINTAINER=	tobias@boehnert.dev
+PLUGIN_DEVEL=		yes
+
+.include "../../Mk/plugins.mk"

net/radsecproxy/pkg-descr

@@ -0,0 +1,5 @@
+A generic RADIUS proxy that in addition to usual RADIUS UDP
+transport, also supports TLS (RadSec), as well as RADIUS
+over TCP and DTLS. The aim is for the proxy to have
+sufficient features to be flexible, while at the same time
+to be small, efficient and easy to configure.

net/radsecproxy/src/etc/inc/plugins.inc.d/radsecproxy.inc

@@ -0,0 +1,73 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+function radsecproxy_enabled()
+{
+    $model = new \OPNsense\RadSecProxy\RadSecProxy();
+    if ((string)$model->general->enabled == '1') {
+        return true;
+    }
+
+    return false;
+}
+
+function radsecproxy_syslog()
+{
+    // $syslogconf = array();
+
+    // $syslogconf['radsecproxy'] = array(
+    //     'local' => '/var/log/radsecproxy.log',
+    //     'facility' => array('radsecproxy'),
+    //     'remote' => 'relayd',
+    // );
+
+    // return $syslogconf;
+
+    $logfacilities = array();
+    $logfacilities['radsecproxy'] = array(
+        'facility' => array('LOG_DAEMON'),
+    );
+    return $logfacilities;
+
+}
+
+
+function radsecproxy_services()
+{
+    $services = array();
+
+    if (radsecproxy_enabled()) {
+        $services[] = array(
+            'description' => gettext('Radius Secure Proxy'),
+            'configd' => array(
+                'restart' => array('radsecproxy restart'),
+                'start' => array('radsecproxy start'),
+                'stop' => array('radsecproxy stop'),
+            ),
+            'name' => 'radsecproxy',
+            'pidfile' => '/var/run/radsecproxy/radsecproxy.pid'
+        );
+    }
+    return $services;
+}

net/radsecproxy/src/etc/rc.d/os-radsecproxy

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# PROVIDE: radsecproxy
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+
+# Add the following line to /etc/rc.conf.local or /etc/rc.conf
+# to enable this service:
+#
+# radsecproxy_enable (bool): Set to NO by default.
+#               Set it to YES to enable radsecproxy.
+
+. /etc/rc.subr
+
+name="radsecproxy"
+rcvar=radsecproxy_enable
+
+: ${radsecproxy_enable:="NO"}
+: ${radsecproxy_user:="root"}
+: ${radsecproxy_group:="wheel"}
+: ${radsecproxy_pidfile:="/var/run/radsecproxy.pid"}
+
+user=${radsecproxy_user}
+group=${radsecproxy_group}
+pidfile=${radsecproxy_pidfile}
+required_files=/usr/local/etc/radsecproxy.conf
+
+command="/usr/local/sbin/${name}"
+command_args="-c /usr/local/etc/radsecproxy.conf -i ${pidfile}"
+
+start_precmd="radsecproxy_prestart"
+stop_postcmd="radsecproxy_poststop"
+
+radsecproxy_prestart() 
+{
+	mkdir -p $(dirname $pidfile)
+	chown ${user}:${group} $(dirname $pidfile)
+}
+
+radsecproxy_poststop() 
+{
+	rm -f ${pidfile}
+}
+
+load_rc_config $name
+run_rc_command "$1"

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/ClientsController.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class ClientsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+
+    public function searchItemAction()
+    {
+        return $this->searchBase(
+            "clients.client",
+            array('enabled', 'description', 'host', 'identifier', 'type'),
+            "name"
+        );
+    }
+
+    public function setItemAction($uuid)
+    {
+        return $this->setBase("client", "clients.client", $uuid);
+    }
+
+    public function addItemAction()
+    {
+        return $this->addBase("client", "clients.client");
+    }
+
+    public function getItemAction($uuid = null)
+    {
+        return $this->getBase("client", "clients.client", $uuid);
+    }
+
+    public function delItemAction($uuid)
+    {
+        return $this->delBase("clients.client", $uuid);
+    }
+
+    public function toggleItemAction($uuid, $enabled = null)
+    {
+        return $this->toggleBase("clients.client", $uuid, $enabled);
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/GeneralController.php

@@ -0,0 +1,33 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class GeneralController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/RealmsController.php

@@ -0,0 +1,63 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class RealmsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+
+    public function searchItemAction()
+    {
+        return $this->searchBase("realms.realm", array('enabled', 'description', 'realm'), "description");
+    }
+
+    public function setItemAction($uuid)
+    {
+        return $this->setBase("realm", "realms.realm", $uuid);
+    }
+
+    public function addItemAction()
+    {
+        return $this->addBase("realm", "realms.realm");
+    }
+
+    public function getItemAction($uuid = null)
+    {
+        return $this->getBase("realm", "realms.realm", $uuid);
+    }
+
+    public function delItemAction($uuid)
+    {
+        return $this->delBase("realms.realm", $uuid);
+    }
+
+    public function toggleItemAction($uuid, $enabled = null)
+    {
+        return $this->toggleBase("realms.realm", $uuid, $enabled);
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/RewritesController.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class RewritesController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+
+    public function searchItemAction()
+    {
+        return $this->searchBase(
+            "rewrites.rewrite",
+            array('enabled', 'name', 'description'),
+            "name"
+        );
+    }
+
+    public function setItemAction($uuid)
+    {
+        return $this->setBase("rewrite", "rewrites.rewrite", $uuid);
+    }
+
+    public function addItemAction()
+    {
+        return $this->addBase("rewrite", "rewrites.rewrite");
+    }
+
+    public function getItemAction($uuid = null)
+    {
+        return $this->getBase("rewrite", "rewrites.rewrite", $uuid);
+    }
+
+    public function delItemAction($uuid)
+    {
+        return $this->delBase("rewrites.rewrite", $uuid);
+    }
+
+    public function toggleItemAction($uuid, $enabled = null)
+    {
+        return $this->toggleBase("rewrites.rewrite", $uuid, $enabled);
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/ServersController.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class ServersController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+
+    public function searchItemAction()
+    {
+        return $this->searchBase(
+            "servers.server",
+            array('description', 'host', 'type', 'identifier', 'tlsConfig'),
+            "name"
+        );
+    }
+
+    public function setItemAction($uuid)
+    {
+        return $this->setBase("server", "servers.server", $uuid);
+    }
+
+    public function addItemAction()
+    {
+        return $this->addBase("server", "servers.server");
+    }
+
+    public function getItemAction($uuid = null)
+    {
+        return $this->getBase("server", "servers.server", $uuid);
+    }
+
+    public function delItemAction($uuid)
+    {
+        return $this->delBase("servers.server", $uuid);
+    }
+
+    public function toggleItemAction($uuid, $enabled = null)
+    {
+        return $this->toggleBase("servers.server", $uuid, $enabled);
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/ServiceController.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableServiceControllerBase;
+use OPNsense\Core\Backend;
+
+class ServiceController extends ApiMutableServiceControllerBase
+{
+    protected static $internalServiceClass = '\OPNsense\RadSecProxy\RadSecProxy';
+    protected static $internalServiceTemplate = 'OPNsense/RadSecProxy';
+    protected static $internalServiceEnabled = 'general.enabled';
+    protected static $internalServiceName = 'radsecproxy';
+    protected function reconfigureForceRestart()
+    {
+        return 0;
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/Api/TlsController.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class TlsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'radsecproxy';
+    protected static $internalModelClass = 'OPNsense\RadSecProxy\RadSecProxy';
+
+    public function searchItemAction()
+    {
+        return $this->searchBase(
+            "tlsConfigs.tlsConfig",
+            array('description', 'name', 'caCertificateRefId', 'proxyCertificateRefId'),
+            "name"
+        );
+    }
+
+    public function setItemAction($uuid)
+    {
+        return $this->setBase("tlsConfig", "tlsConfigs.tlsConfig", $uuid);
+    }
+
+    public function addItemAction()
+    {
+        return $this->addBase("tlsConfig", "tlsConfigs.tlsConfig");
+    }
+
+    public function getItemAction($uuid = null)
+    {
+        return $this->getBase("tlsConfig", "tlsConfigs.tlsConfig", $uuid);
+    }
+
+    public function delItemAction($uuid)
+    {
+        return $this->delBase("tlsConfigs.tlsConfig", $uuid);
+    }
+
+    public function toggleItemAction($uuid, $enabled = null)
+    {
+        return $this->toggleBase("tlsConfigs.tlsConfig", $uuid, $enabled);
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/ClientsController.php

@@ -0,0 +1,36 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class ClientsController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        //$this->view->generalForm = $this->getForm("clients");
+        // pick the template to serve to our users.
+        $this->view->pick('OPNsense/RadSecProxy/clients');
+        $this->view->formDialogClient = $this->getForm("dialogClient");
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/GeneralController.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class GeneralController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->generalForm = $this->getForm("general");
+        $this->view->pick('OPNsense/RadSecProxy/general');
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/IndexController.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class IndexController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->basicForm = $this->getForm("basic");
+        $this->view->pick('OPNsense/RadSecProxy/index');
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/RealmsController.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class RealmsController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->pick('OPNsense/RadSecProxy/realms');
+        $this->view->formDialogRealm = $this->getForm("dialogRealm");
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/RewritesController.php

@@ -0,0 +1,36 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class RewritesController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        //$this->view->generalForm = $this->getForm("clients");
+        // pick the template to serve to our users.
+        $this->view->pick('OPNsense/RadSecProxy/rewrites');
+        $this->view->formDialogRewrite = $this->getForm("dialogRewrite");
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/ServersController.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class ServersController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->pick('OPNsense/RadSecProxy/servers');
+        $this->view->formDialogServer = $this->getForm("dialogServer");
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/TlsController.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+    Copyright (C) 2020 Tobias Boehnert
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\RadSecProxy;
+
+class TlsController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->pick('OPNsense/RadSecProxy/tls');
+        $this->view->formDialogTls = $this->getForm("dialogTls");
+    }
+}

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogClient.xml

@@ -0,0 +1,96 @@
+<form>
+
+    <field>
+        <type>section_title</type>
+        <label>General</label>
+    </field>
+
+    <field>
+        <id>client.enabled</id>
+        <label>Enable Client</label>
+        <type>checkbox</type>
+        <help>Allow connections from this client</help>
+    </field>
+
+    <field>
+        <id>client.identifier</id>
+        <label>Unique identifier</label>
+        <type>text</type>
+        <help>Unique identifier for this client</help>
+    </field>
+
+    <field>
+        <id>client.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Short description of this client</help>
+    </field>
+    
+    <field>
+        <id>client.host</id>
+        <label>IP / Net</label>
+        <type>text</type>
+        <help>The client's IP or net</help>
+    </field>
+    
+    <field>
+        <id>client.type</id>
+        <label>Type</label>
+        <type>dropdown</type>
+        <help>Choose the type of client. Default Radius-clients use UDP.</help>
+    </field>
+
+    <field>
+        <id>client.secret</id>
+        <label>Secret</label>
+        <type>text</type>
+        <help>The shared RADIUS key with this client. This option is optional for TLS/DTLS and if omitted will default to "radsec". (Note that using a secret other than "radsec" for TLS is a violation of the standard (RFC 6614) and that the proposed standard for DTLS stipulates that the secret must be "radius/dtls".)</help>
+    </field>
+
+    <field>
+        <type>section_title</type>
+        <label>Advanced settings</label>
+        <advanced>true</advanced>
+    </field>
+
+    <field>
+        <id>client.tlsConfig</id>
+        <label>TLS-Config</label>
+        <advanced>true</advanced>
+        <type>dropdown</type>
+        <help>For a TLS/DTLS client you may also specify the tls option. The option value must be the name of a previously defined TLS block. If this option is not specified, the TLS block with the name defaultClient or default will be used if defined (in that order). If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error.</help>
+    </field>
+
+    <field>
+        <id>client.certificateNameCheck</id>
+        <label>Certificate-Name-Check</label>
+        <advanced>true</advanced>        
+        <type>dropdown</type>
+        <help>For a TLS/DTLS server, disable the default behaviour of matching CN or SubjectAltName against the specified hostname or IP address.</help>
+    </field>
+
+    <field>
+        <id>client.matchCertificateAttribute</id>
+        <label>Match Certificate-Attribute</label>
+        <advanced>true</advanced>        
+        <type>text</type>
+        <help>Perform additional validation of certificate attributes (CN | SubjectAltName:URI | SubjectAltName:DNS). Currently matching of CN and SubjectAltName types URI DNS and IP is supported.</help>
+    </field>
+
+    <field>
+        <id>client.rewriteIn</id>
+        <label>Rewrite incoming requests</label>
+        <advanced>true</advanced>
+        <type>dropdown</type>
+        <help><![CDATA[Apply the operations in the specified rewrite block on incoming (request) or outgoing (response) messages from this client. Rewriting incoming messages is done before, outgoing after other processing. If the <b>RewriteIn</b> is not configured, the rewrite blocks <b>defaultClient</b> or <b>default</b> will be applied if defined. No default blocks are applied for <b>RewriteOut</b>.]]></help>
+    </field>
+
+    <field>
+        <id>client.rewriteOut</id>
+        <label>Rewrite outgoing requests</label>
+        <advanced>true</advanced>
+        <type>dropdown</type>
+        <help><![CDATA[Apply the operations in the specified rewrite block on incoming (request) or outgoing (response) messages from this client. Rewriting incoming messages is done before, outgoing after other processing. If the <b>RewriteIn</b> is not configured, the rewrite blocks <b>defaultClient</b> or <b>default</b> will be applied if defined. No default blocks are applied for <b>RewriteOut</b>.]]></help>
+    </field>
+
+</form>

net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRealm.xml

@@ -0,0 +1,71 @@
+<form>
+
+    <field>
+        <type>section_title</type>
+        <label>General</label>
+    </field>
+
+    <field>
+        <id>realm.enabled</id>
+        <label>Enable Realm</label>
+        <type>checkbox</type>
+        <help>Enable this realm</help>
+    </field>
+    
+    <field>
+        <id>realm.realm</id>
+        <label>Realm</label>
+        <type>text</type>
+        <help>* | realm | /regex/</help>
+    </field>
+
+    <field>
+        <id>realm.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Short description to identify this realm and its target</help>
+    </field>
+    
+    <field>
+        <type>section_title</type>
+        <label>Authentication</label>
+    </field>
+
+    <field>
+        <id>realm.server</id>
+        <label>Server</label>
+        <type>select_multiple</type>
+        <sortable>true</sortable>
+        <style>tokenize</style>
+        <help>If not configured, the proxy will deny all Access-Requests for this realm.</help>
+    </field>
+
+    <field>
+        <id>realm.replyMessage</id>
+        <label>Reply-Message</label>
+        <type>text</type>
+        <help><![CDATA[Specify a message to be sent back to the client if a Access-Request is denied because no <b>server</b> is configured.]]></help>
+    </field>
+    
+    <field>
+        <type>section_title</type>
+        <label>Accounting</label>
+    </field>
+
+    <field>
+        <id>realm.accountingServer</id>
+        <label>Accounting-Server</label>
+        <type>select_multiple</type>
+        <sortable>true</sortable>
+        <style>tokenize</style>
+        <help>If not configured, the proxy will silently ignore all Accounting-Requests for this realm.</help>
+    </field>
+
+    <field>
+        <id>realm.accountingResponse</id>
+        <label>Accounting-Response</label>
+        <type>dropdown</type>
+        <help><![CDATA[Enable sending Accounting-Response instead of ignoring Accounting-Requests when no <b>accoutingServer</b> is configured.]]></help>
+    </field>
+
+</form>