diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile index 849522105..ebdf96b0a 100644 --- a/net/freeradius/Makefile +++ b/net/freeradius/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= freeradius -PLUGIN_VERSION= 1.1.0 +PLUGIN_VERSION= 1.2.0 PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server PLUGIN_DEPENDS= freeradius3 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/EapController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/EapController.php new file mode 100644 index 000000000..7d7ffaab9 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/EapController.php @@ -0,0 +1,76 @@ +request->isGet()) { + $mdlEAP = new EAP(); + $result['eap'] = $mdlEAP->getNodes(); + } + return $result; + } + + public function setAction() + { + $result = array("result"=>"failed"); + if ($this->request->isPost()) { + // load model and update with provided data + $mdlEAP = new EAP(); + $mdlEAP->setNodes($this->request->getPost("eap")); + + // perform validation + $valMsgs = $mdlEAP->performValidation(); + foreach ($valMsgs as $field => $msg) { + if (!array_key_exists("validations", $result)) { + $result["validations"] = array(); + } + $result["validations"]["eap.".$msg->getField()] = $msg->getMessage(); + } + + // serialize model to config and save + if ($valMsgs->count() == 0) { + $mdlEAP->serializeToConfig(); + Config::getInstance()->save(); + $result["result"] = "saved"; + } + } + return $result; + } +} diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/EapController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/EapController.php new file mode 100644 index 000000000..3a5ca25a9 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/EapController.php @@ -0,0 +1,38 @@ +view->title = gettext("EAP Settings"); + $this->view->eapForm = $this->getForm("eap"); + $this->view->pick('OPNsense/Freeradius/eap'); + } +} diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml new file mode 100644 index 000000000..077d5316d --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml @@ -0,0 +1,32 @@ +
+ + eap.default_eap_type + + dropdown + Set the default EAP type. + + + eap.enable_client_cert + + checkbox + This will activate certificate based authentication. Please choose CA and Certificate below and do not forget to roll out certificates to the clients. + + + eap.ca + + dropdown + Choose the Root CA. + + + eap.certificate + + dropdown + Choose the certificate the Radius service should use. + + + eap.crl + + dropdown + This enables CRL checking, please restart this service with every change to the CRL. + +
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.php b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.php new file mode 100644 index 000000000..218714369 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.php @@ -0,0 +1,34 @@ + + //OPNsense/freeradius/eap + EAP configuration + 1.0.0 + + + MD5 + Y + N + + MD5 + MSCHAPv2 + PEAP + TTLS + + + + 0 + Y + + + + ca + N + + + + cert + N + + + + crl + N + + + diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml index a1222c17c..6d976707f 100644 --- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml @@ -4,6 +4,7 @@ + diff --git a/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/eap.volt b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/eap.volt new file mode 100644 index 000000000..25d184715 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/eap.volt @@ -0,0 +1,62 @@ +{# + +OPNsense® is Copyright © 2014 – 2017 by Deciso B.V. +This file is Copyright © 2017 by Michael Muenz +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, +OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +#} + +
+ {{ partial("layout_partials/base_form",['fields':eapForm,'id':'frm_eap_settings'])}} +
+
+ +
+
+ + diff --git a/net/freeradius/src/opnsense/scripts/Freeradius/generate_certs.php b/net/freeradius/src/opnsense/scripts/Freeradius/generate_certs.php new file mode 100644 index 000000000..0846ceded --- /dev/null +++ b/net/freeradius/src/opnsense/scripts/Freeradius/generate_certs.php @@ -0,0 +1,78 @@ +#!/usr/local/bin/php +object(); +if (isset($configObj->OPNsense->freeradius)) { + foreach ($configObj->OPNsense->freeradius->children() as $find_cert) { + $cert_refid = (string)$find_cert->certificate; + // if eap has a certificate attached, search for its contents + if ($cert_refid != "") { + foreach ($configObj->cert as $cert) { + if ($cert_refid == (string)$cert->refid) { + // generate cert pem file + $pem_content = trim(str_replace("\n\n", "\n", str_replace( + "\r", + "", + base64_decode((string)$cert->crt) + ))); + + $pem_content .= "\n"; + $pem_content .= trim(str_replace( + "\n\n", + "\n", + str_replace("\r", "", base64_decode((string)$cert->prv)) + )); + $pem_content .= "\n"; + $output_pem_filename = "/usr/local/etc/raddb/certs/cert_" . $cert_refid . ".pem"; + file_put_contents($output_pem_filename, $pem_content); + chmod($output_pem_filename, 0600); + echo "certificate generated " .$output_pem_filename . "\n"; + // generate ca pem file + if (!empty($cert->caref)) { + $output_pem_filename = "/usr/local/etc/raddb/certs/ca_" . $cert_refid . ".pem"; + $cert = (array)$cert; + $ca = ca_chain($cert); + file_put_contents($output_pem_filename, $ca); + chmod($output_pem_filename, 0600); + echo "certificate generated " .$output_pem_filename ."\n"; + } + } + } + } + } +} diff --git a/net/freeradius/src/opnsense/scripts/Freeradius/generate_crl.php b/net/freeradius/src/opnsense/scripts/Freeradius/generate_crl.php new file mode 100644 index 000000000..b12e8ac50 --- /dev/null +++ b/net/freeradius/src/opnsense/scripts/Freeradius/generate_crl.php @@ -0,0 +1,63 @@ +#!/usr/local/bin/php +object(); +if (isset($configObj->OPNsense->freeradius)) { + foreach ($configObj->OPNsense->freeradius->children() as $find_cert) { + $cert_refid = (string)$find_cert->crl; + // if eap has a certificate attached, search for its contents + if ($cert_refid != "") { + foreach ($configObj->crl as $crl) { + if ($cert_refid == (string)$crl->refid) { + // generate cert pem file + $pem_content = trim(str_replace("\n\n", "\n", str_replace( + "\r", + "", + base64_decode((string)$crl->text) + ))); + + $pem_content .= "\n"; + $output_pem_filename = "/usr/local/etc/raddb/certs/crl.pem"; + file_put_contents($output_pem_filename, $pem_content); + chmod($output_pem_filename, 0600); + echo "certificate generated " .$output_pem_filename . "\n"; + } + } + } + } +} diff --git a/net/freeradius/src/opnsense/scripts/Freeradius/setup.sh b/net/freeradius/src/opnsense/scripts/Freeradius/setup.sh index 5ed191e6a..2cf5360c0 100755 --- a/net/freeradius/src/opnsense/scripts/Freeradius/setup.sh +++ b/net/freeradius/src/opnsense/scripts/Freeradius/setup.sh @@ -15,3 +15,9 @@ for FILE in ${RADIUS_FILES}; do touch ${FILE} chmod 700 ${FILE} done + +# clear old certificates and export new ones +rm -f /usr/local/etc/raddb/certs/ca_*.pem +rm -f /usr/local/etc/raddb/certs/cert_*.pem +/usr/local/opnsense/scripts/Freeradius/generate_certs.php > /dev/null 2>&1 +/usr/local/opnsense/scripts/Freeradius/generate_crl.php > /dev/null 2>&1 diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap index 329b09739..79c547678 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap @@ -26,7 +26,9 @@ eap { # then that EAP type takes precedence over the # default type configured here. # - default_eap_type = md5 +{% if helpers.exists('OPNsense.freeradius.eap.default_eap_type') and OPNsense.freeradius.eap.default_eap_type != '' %} + default_eap_type = {{ OPNsense.freeradius.eap.default_eap_type }} +{% endif %} # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a @@ -172,9 +174,14 @@ eap { # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. tls-config tls-common { +{% if helpers.exists('OPNsense.freeradius.eap.enable_client_cert') and OPNsense.freeradius.eap.enable_client_cert == '1' %} +{% if helpers.exists('OPNsense.freeradius.eap.certificate') and OPNsense.freeradius.eap.certificate != '' %} + private_key_password = + private_key_file = ${certdir}/cert_{{ OPNsense.freeradius.eap.certificate }}.pem + certificate_file = ${certdir}/cert_{{ OPNsense.freeradius.eap.certificate }}.pem +{% else %} private_key_password = whatever private_key_file = ${certdir}/server.pem - # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file @@ -186,7 +193,7 @@ eap { # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/server.pem - +{% endif %} # Trusted Root CA list # # ALL of the CA's in this list will be trusted @@ -197,8 +204,11 @@ eap { # In that case, this CA file should contain # *one* CA certificate. # +{% if helpers.exists('OPNsense.freeradius.eap.ca') and OPNsense.freeradius.eap.ca != '' %} + ca_file = ${certdir}/ca_{{ OPNsense.freeradius.eap.certificate }}.pem +{% else %} ca_file = ${cadir}/ca.pem - +{% endif %} # OpenSSL will automatically create certificate chains, # unless we tell it to not do that. The problem is that # it sometimes gets the chains right from a certificate @@ -280,8 +290,11 @@ eap { # 'c_rehash' is OpenSSL's command. # 3) uncomment the lines below. # 5) Restart radiusd +{% if helpers.exists('OPNsense.freeradius.eap.crl') and OPNsense.freeradius.eap.crl != '' %} + check_crl = yes +{% else %} # check_crl = yes - +{% endif %} # Check if intermediate CAs have been revoked. # check_all_crl = yes @@ -557,7 +570,7 @@ eap { # softfail = no } } - +{% endif %} ## EAP-TLS # # As of Version 3.0, the TLS configuration for TLS-based