net/freeradius: options for fallback vlan (#2566)

net/freeradius/Makefile

@@ -1,6 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.9.17
-PLUGIN_REVISION=	2
+PLUGIN_VERSION=		1.9.18
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net/freeradius/pkg-descr

@@ -15,6 +15,10 @@ The server is fast, feature-rich, modular, and scalable.
 Plugin Changelog
 ================
 
+1.9.18
+
+* Added support for fallback VLAN
+
 1.9.17
 
 * Added support for Extreme networks EXOS switch Extreme-Netlogin-Extended-VLAN VSA and policy for GEN2 (contributed by Pasi Suominen)

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml

@@ -11,6 +11,20 @@
         <type>checkbox</type>
         <help>This allows you to dynamically assign VLANs on your physical switch ports.</help>
     </field>
+    <field>
+        <id>general.fallbackvlan_enabled</id>
+        <label>Enable VLAN fallback assignment</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>This allows you to define a fallback VLAN-Group-ID. Warning: Setting this option will send an accepted RADIUS reply even if the authentication attempt fails.</help>
+    </field>
+    <field>
+        <id>general.fallbackvlan_id</id>
+        <label>Fallback VLAN ID</label>
+        <type>text</type>
+        <advanced>true</advanced>
+        <help>Define the Fallback VLAN group ID.</help>
+    </field>
     <field>
         <id>general.ldap_enabled</id>
         <label>Enable LDAP</label>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml

@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/freeradius/general</mount>
     <description>FreeRADIUS configuration</description>
-    <version>1.0.1</version>
+    <version>1.0.2</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -11,6 +11,28 @@
             <default>0</default>
             <Required>N</Required>
         </vlanassign>
+        <fallbackvlan_enabled type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+            <Constraints>
+                <check001>
+                    <reference>fallbackvlan_id.check001</reference>
+                </check001>
+            </Constraints>
+        </fallbackvlan_enabled>
+        <fallbackvlan_id type="IntegerField">
+            <MinimumValue>1</MinimumValue>
+            <MaximumValue>4096</MaximumValue>
+            <Constraints>
+                <check001>
+                    <ValidationMessage>You need to set a propper VLAN ID.</ValidationMessage>
+                    <type>DependConstraint</type>
+                    <addFields>
+                        <field1>fallbackvlan_enabled</field1>
+                    </addFields>
+                </check001>
+            </Constraints>
+        </fallbackvlan_id>
         <ldap_enabled type="BooleanField">
             <default>0</default>
             <Required>N</Required>

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users

@@ -98,4 +98,12 @@ DEFAULT Hint == "CSLIP"
 
 DEFAULT Hint == "SLIP"
         Framed-Protocol = SLIP
+{%  if helpers.exists('OPNsense.freeradius.general.fallbackvlan_enabled') and OPNsense.freeradius.general.fallbackvlan_enabled == '1' %}
+
+DEFAULT Auth-Type := Accept
+       Tunnel-Type = VLAN,
+       Tunnel-Medium-Type = IEEE-802,
+       Tunnel-Private-Group-Id = {{ OPNsense.freeradius.general.fallbackvlan_id }},
+       Framed-Protocol = PPP
+{%  endif %}
 {% endif %}