diff --git a/LICENSE b/LICENSE index c36cfbddd..c0d0614ed 100644 --- a/LICENSE +++ b/LICENSE @@ -30,6 +30,7 @@ Copyright (c) 2008 Shrew Soft Inc. Copyright (c) 2017-2019 Smart-Soft Copyright (c) 2013 Stanley P. Miller \ stan-qaz Copyright (c) 2020 Starkstromkonsument +Copyright (c) 2020 Tobias Boehnert Copyright (c) 2010 Yehuda Katz Copyright (c) 2015 YoungJoo.Kim Copyright (c) 2020 devNan0 diff --git a/README.md b/README.md index c45187bd8..0d7a3cdb0 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,7 @@ net/haproxy -- Reliable, high performance TCP/HTTP load balancer net/igmp-proxy -- IGMP-Proxy Service net/mdns-repeater -- Proxy multicast DNS between networks net/ntopng -- Traffic Analysis and Flow Collection +net/radsecproxy -- RADIUS proxy provides both RADIUS UDP and TCP/TLS (RadSec) transport (development only) net/relayd -- Relayd Load Balancer net/shadowsocks -- Secure socks5 proxy net/siproxd -- Siproxd is a proxy daemon for the SIP protocol diff --git a/net/radsecproxy/src/etc/rc.d/os-radsecproxy b/net/radsecproxy/src/etc/rc.d/os-radsecproxy index 4faca1f6b..cb79588f7 100755 --- a/net/radsecproxy/src/etc/rc.d/os-radsecproxy +++ b/net/radsecproxy/src/etc/rc.d/os-radsecproxy @@ -31,13 +31,13 @@ command_args="-c /usr/local/etc/radsecproxy.conf -i ${pidfile}" start_precmd="radsecproxy_prestart" stop_postcmd="radsecproxy_poststop" -radsecproxy_prestart() +radsecproxy_prestart() { mkdir -p $(dirname $pidfile) chown ${user}:${group} $(dirname $pidfile) } -radsecproxy_poststop() +radsecproxy_poststop() { rm -f ${pidfile} } diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogClient.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogClient.xml index 127ff5768..a74c90b69 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogClient.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogClient.xml @@ -1,96 +1,96 @@ -
- - - section_title - - - - - client.enabled - - checkbox - Allow connections from this client - - - - client.identifier - - text - Unique identifier for this client - - - - client.description - - text - Short description of this client - - - - client.host - - text - The client's IP or net - - - - client.type - - dropdown - Choose the type of client. Default Radius-clients use UDP. - - - - client.secret - - text - The shared RADIUS key with this client. This option is optional for TLS/DTLS and if omitted will default to "radsec". (Note that using a secret other than "radsec" for TLS is a violation of the standard (RFC 6614) and that the proposed standard for DTLS stipulates that the secret must be "radius/dtls".) - - - - section_title - - true - - - - client.tlsConfig - - true - dropdown - For a TLS/DTLS client you may also specify the tls option. The option value must be the name of a previously defined TLS block. If this option is not specified, the TLS block with the name defaultClient or default will be used if defined (in that order). If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error. - - - - client.certificateNameCheck - - true - dropdown - For a TLS/DTLS server, disable the default behaviour of matching CN or SubjectAltName against the specified hostname or IP address. - - - - client.matchCertificateAttribute - - true - text - Perform additional validation of certificate attributes (CN | SubjectAltName:URI | SubjectAltName:DNS). Currently matching of CN and SubjectAltName types URI DNS and IP is supported. - - - - client.rewriteIn - - true - dropdown - RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> - - - - client.rewriteOut - - true - dropdown - RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> - - -
+
+ + + section_title + + + + + client.enabled + + checkbox + Allow connections from this client + + + + client.identifier + + text + Unique identifier for this client + + + + client.description + + text + Short description of this client + + + + client.host + + text + The client's IP or net + + + + client.type + + dropdown + Choose the type of client. Default Radius-clients use UDP. + + + + client.secret + + text + The shared RADIUS key with this client. This option is optional for TLS/DTLS and if omitted will default to "radsec". (Note that using a secret other than "radsec" for TLS is a violation of the standard (RFC 6614) and that the proposed standard for DTLS stipulates that the secret must be "radius/dtls".) + + + + section_title + + true + + + + client.tlsConfig + + true + dropdown + For a TLS/DTLS client you may also specify the tls option. The option value must be the name of a previously defined TLS block. If this option is not specified, the TLS block with the name defaultClient or default will be used if defined (in that order). If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error. + + + + client.certificateNameCheck + + true + dropdown + For a TLS/DTLS server, disable the default behaviour of matching CN or SubjectAltName against the specified hostname or IP address. + + + + client.matchCertificateAttribute + + true + text + Perform additional validation of certificate attributes (CN | SubjectAltName:URI | SubjectAltName:DNS). Currently matching of CN and SubjectAltName types URI DNS and IP is supported. + + + + client.rewriteIn + + true + dropdown + RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> + + + + client.rewriteOut + + true + dropdown + RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRealm.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRealm.xml index 6c270fed7..9aa636e60 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRealm.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRealm.xml @@ -1,71 +1,71 @@ -
- - - section_title - - - - - realm.enabled - - checkbox - Enable this realm - - - - realm.realm - - text - * | realm | /regex/ - - - - realm.description - - text - Short description to identify this realm and its target - - - - section_title - - - - - realm.server - - select_multiple - true - - If not configured, the proxy will deny all Access-Requests for this realm. - - - - realm.replyMessage - - text - server is configured.]]> - - - - section_title - - - - - realm.accountingServer - - select_multiple - true - - If not configured, the proxy will silently ignore all Accounting-Requests for this realm. - - - - realm.accountingResponse - - dropdown - accoutingServer is configured.]]> - - -
+
+ + + section_title + + + + + realm.enabled + + checkbox + Enable this realm + + + + realm.realm + + text + * | realm | /regex/ + + + + realm.description + + text + Short description to identify this realm and its target + + + + section_title + + + + + realm.server + + select_multiple + true + + If not configured, the proxy will deny all Access-Requests for this realm. + + + + realm.replyMessage + + text + server is configured.]]> + + + + section_title + + + + + realm.accountingServer + + select_multiple + true + + If not configured, the proxy will silently ignore all Accounting-Requests for this realm. + + + + realm.accountingResponse + + dropdown + accoutingServer is configured.]]> + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRewrite.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRewrite.xml index ca8ef6092..e4a9e57a5 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRewrite.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogRewrite.xml @@ -1,101 +1,101 @@ -
- - - rewrite.enabled - - checkbox - Use this rule - - - - rewrite.name - - text - Unique name for this rule - - - - rewrite.description - - text - Short description of this rule - - - - rewrite.addAttributes - - textbox - attribute:value, one per line
Add an attribute to the radius message and set it to value. The attribute must be specified using the numerical attribute id. The value can either be numerical, a string, or a hex value. If the value starts with a number, it is interpreted as a 32bit unsigned integer. Use the ’ character at the start of the value to force string interpretation. When using hex value, it is recommended to also lead with ’ to avoid unintended numeric interpretation. See the CONFIGURATION SYNTAX section for further details.]]> - - - - rewrite.addVendorAttributes - - textbox - vendor:subattribute:value, one per line
Add a vendor attribute to the radius message, specified by vendor and subattribute. Both vendor and subattribute must be specified as numerical values. The format of value is the same as for addAttribute above.]]> - - - - rewrite.supplementAttributes - - textbox - attribute:value, one per line
Add an attribute to the radius message and set it to value, only if the attribute is not yet present on the message. The format of value is the same as for addAttribute above.]]> - - - - rewrite.supplementVendorAttributes - - textbox - vendor:subattribute:value, one per line
Add a vendor attribute to the radius message only if the subattribute of this vendor is not yet present on the message. The format of is the same as for addVendorAttribute above.]]> - - - - rewrite.modifyAttributes - - textbox - attribute:/regex/replace/, one per line
Modify the given attribute using the regex replace pattern. As above, attribute must be specified by a numerical value. Example usage: modifyAttribute 1:/^(.*)@local$/\1@example.com/]]> - - - - rewrite.modifyVendorAttributes - - textbox - vendor:subattribute:/regex/replace/, one per line
Modify the given subattribute of given vendor using the regex replace pattern. Other than the added vendor, the same syntax as for ModifyAttribute applies.]]> - - - - rewrite.removeAttributes - - textbox - attribute, one per line
Remove all attributes with the given id.]]> - - - - rewrite.removeVendorAttributes - - textbox - vendor[:subattribute], one per line
Remove all vendor attributes that match the given vendor and subattribute. If the subattribute is omitted, all attributes with the given vendor id are removed.]]> - - - - rewrite.whitelistMode - - dropdown - WhitelistAttribute or WhitelistVendorAttribute will be removed. While whitelist mode is active, RemoveAttribute and RemoveVendorAttribute statements are ignored.]]> - - - - rewrite.whitelistAttributes - - textbox - attribute, one per line
Do not remove attributes with the given id when WhitelistMode is on. Ignored otherwise.]]> - - - - rewrite.whitelistVendorAttributes - - textbox - vendor[:subattribute], one per line
Do not remove vendor attributes that match the given vendor and subattribute when WhitelistMode is on. Ignored otherwise. If the subattribute is omitted, the complete vendor attribute is whitelisted. Otherwise only the specified subattribute is kept but all other subattributes are removed.]]> - - -
+
+ + + rewrite.enabled + + checkbox + Use this rule + + + + rewrite.name + + text + Unique name for this rule + + + + rewrite.description + + text + Short description of this rule + + + + rewrite.addAttributes + + textbox + attribute:value, one per line
Add an attribute to the radius message and set it to value. The attribute must be specified using the numerical attribute id. The value can either be numerical, a string, or a hex value. If the value starts with a number, it is interpreted as a 32bit unsigned integer. Use the ’ character at the start of the value to force string interpretation. When using hex value, it is recommended to also lead with ’ to avoid unintended numeric interpretation. See the CONFIGURATION SYNTAX section for further details.]]> + + + + rewrite.addVendorAttributes + + textbox + vendor:subattribute:value, one per line
Add a vendor attribute to the radius message, specified by vendor and subattribute. Both vendor and subattribute must be specified as numerical values. The format of value is the same as for addAttribute above.]]> + + + + rewrite.supplementAttributes + + textbox + attribute:value, one per line
Add an attribute to the radius message and set it to value, only if the attribute is not yet present on the message. The format of value is the same as for addAttribute above.]]> + + + + rewrite.supplementVendorAttributes + + textbox + vendor:subattribute:value, one per line
Add a vendor attribute to the radius message only if the subattribute of this vendor is not yet present on the message. The format of is the same as for addVendorAttribute above.]]> + + + + rewrite.modifyAttributes + + textbox + attribute:/regex/replace/, one per line
Modify the given attribute using the regex replace pattern. As above, attribute must be specified by a numerical value. Example usage: modifyAttribute 1:/^(.*)@local$/\1@example.com/]]> + + + + rewrite.modifyVendorAttributes + + textbox + vendor:subattribute:/regex/replace/, one per line
Modify the given subattribute of given vendor using the regex replace pattern. Other than the added vendor, the same syntax as for ModifyAttribute applies.]]> + + + + rewrite.removeAttributes + + textbox + attribute, one per line
Remove all attributes with the given id.]]> + + + + rewrite.removeVendorAttributes + + textbox + vendor[:subattribute], one per line
Remove all vendor attributes that match the given vendor and subattribute. If the subattribute is omitted, all attributes with the given vendor id are removed.]]> + + + + rewrite.whitelistMode + + dropdown + WhitelistAttribute or WhitelistVendorAttribute will be removed. While whitelist mode is active, RemoveAttribute and RemoveVendorAttribute statements are ignored.]]> + + + + rewrite.whitelistAttributes + + textbox + attribute, one per line
Do not remove attributes with the given id when WhitelistMode is on. Ignored otherwise.]]> + + + + rewrite.whitelistVendorAttributes + + textbox + vendor[:subattribute], one per line
Do not remove vendor attributes that match the given vendor and subattribute when WhitelistMode is on. Ignored otherwise. If the subattribute is omitted, the complete vendor attribute is whitelisted. Otherwise only the specified subattribute is kept but all other subattributes are removed.]]> + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogServer.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogServer.xml index ce44adcb9..5bd03d431 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogServer.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogServer.xml @@ -1,102 +1,102 @@ -
- - - section_title - - - - - server.identifier - - text - Unique identifier for this server - - - - server.description - - text - Short description to identify this server - - - - server.host - - text - The server's IP or hostname to connect to - - - - server.port - - text - The port (UDP/TCP) to connect to. If omitted, UDP and TCP will default to 1812 while TLS and DTLS will default to 2083. - - - - server.statusServer - - dropdown - off). If statusserver is enabled (on), the proxy will send regular status-server messages to the server to verify that it is alive. Status tracking of the server will solely depend on status-server message and ignore lost requests. This should only be enabled if the server supports it. With the option minimal status-server messages are only sent when regular requests have been lost and no other replies have been received.]]> - - - - server.type - - dropdown - Choose the type of server. Default Radius-clients use UDP. - - - - server.secret - - text - The shared RADIUS key with this server. This option is optional for TLS/DTLS and if omitted will default to "radsec". (Note that using a secret other than "radsec" for TLS is a violation of the standard (RFC 6614) and that the proposed standard for DTLS stipulates that the secret must be "radius/dtls".) - - - - server.tlsConfig - - dropdown - For a TLS/DTLS client you may also specify the tls option. The option value must be the name of a previously defined TLS block. If this option is not specified, the TLS block with the name defaultClient or default will be used if defined (in that order). If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error. - - - - section_title - - true - - - - server.certificateNameCheck - - true - dropdown - For a TLS/DTLS server, disable the default behaviour of matching CN or SubjectAltName against the specified hostname or IP address. - - - - server.matchCertificateAttribute - - true - text - Perform additional validation of certificate attributes (CN | SubjectAltName:URI | SubjectAltName:DNS). Currently matching of CN and SubjectAltName types URI DNS and IP is supported. Note that currently this option can only be specified once in a client block. - - - - server.rewriteIn - - true - dropdown - RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> - - - - server.rewriteOut - - true - dropdown - RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> - - -
+
+ + + section_title + + + + + server.identifier + + text + Unique identifier for this server + + + + server.description + + text + Short description to identify this server + + + + server.host + + text + The server's IP or hostname to connect to + + + + server.port + + text + The port (UDP/TCP) to connect to. If omitted, UDP and TCP will default to 1812 while TLS and DTLS will default to 2083. + + + + server.statusServer + + dropdown + off). If statusserver is enabled (on), the proxy will send regular status-server messages to the server to verify that it is alive. Status tracking of the server will solely depend on status-server message and ignore lost requests. This should only be enabled if the server supports it. With the option minimal status-server messages are only sent when regular requests have been lost and no other replies have been received.]]> + + + + server.type + + dropdown + Choose the type of server. Default Radius-clients use UDP. + + + + server.secret + + text + The shared RADIUS key with this server. This option is optional for TLS/DTLS and if omitted will default to "radsec". (Note that using a secret other than "radsec" for TLS is a violation of the standard (RFC 6614) and that the proposed standard for DTLS stipulates that the secret must be "radius/dtls".) + + + + server.tlsConfig + + dropdown + For a TLS/DTLS client you may also specify the tls option. The option value must be the name of a previously defined TLS block. If this option is not specified, the TLS block with the name defaultClient or default will be used if defined (in that order). If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error. + + + + section_title + + true + + + + server.certificateNameCheck + + true + dropdown + For a TLS/DTLS server, disable the default behaviour of matching CN or SubjectAltName against the specified hostname or IP address. + + + + server.matchCertificateAttribute + + true + text + Perform additional validation of certificate attributes (CN | SubjectAltName:URI | SubjectAltName:DNS). Currently matching of CN and SubjectAltName types URI DNS and IP is supported. Note that currently this option can only be specified once in a client block. + + + + server.rewriteIn + + true + dropdown + RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> + + + + server.rewriteOut + + true + dropdown + RewriteIn is not configured, the rewrite blocks defaultClient or default will be applied if defined. No default blocks are applied for RewriteOut.]]> + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogTls.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogTls.xml index 240d91266..d294c204d 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogTls.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/dialogTls.xml @@ -1,68 +1,68 @@ -
- - - section_title - - - - - tlsConfig.name - - text - This TLS-config's unique name - - - - tlsConfig.description - - text - Short description to identify this TLS-config - - - - tlsConfig.caCertificateRefId - - dropdown - The CA certificate file used to verify the peers certificate. - - - - tlsConfig.proxyCertificateRefId - - dropdown - The server certificate this proxy will use. The file may also contain a certificate chain. - - - - section_title - - true - - - - tlsConfig.policyOids - - true - select_multiple - - true - Require the peers certificate to adhere to the policy specified by this oid / these oids. - - - - tlsConfig.crlCheck - - true - dropdown - fetch-crl.]]> - - - - tlsConfig.cacheExpiry - - true - text - Specify how many seconds the CA and CRL information should be cached. By default, the CA and CRL are loaded at startup and cached indefinetely. This option may be set to zero to disable caching. - - -
+
+ + + section_title + + + + + tlsConfig.name + + text + This TLS-config's unique name + + + + tlsConfig.description + + text + Short description to identify this TLS-config + + + + tlsConfig.caCertificateRefId + + dropdown + The CA certificate file used to verify the peers certificate. + + + + tlsConfig.proxyCertificateRefId + + dropdown + The server certificate this proxy will use. The file may also contain a certificate chain. + + + + section_title + + true + + + + tlsConfig.policyOids + + true + select_multiple + + true + Require the peers certificate to adhere to the policy specified by this oid / these oids. + + + + tlsConfig.crlCheck + + true + dropdown + fetch-crl.]]> + + + + tlsConfig.cacheExpiry + + true + text + Specify how many seconds the CA and CRL information should be cached. By default, the CA and CRL are loaded at startup and cached indefinetely. This option may be set to zero to disable caching. + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/general.xml b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/general.xml index eaf9611ed..eb311b007 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/general.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/controllers/OPNsense/RadSecProxy/forms/general.xml @@ -1,121 +1,121 @@ -
- - - radsecproxy.general.enabled - - checkbox - - - - radsecproxy.general.logLevel - - dropdown - This option specifies the debug level. It must be set to 1, 2, 3, 4 or 5, where 1 logs only serious errors, and 5 logs everything. The default is 2 which logs errors, warnings and a few informational messages. - - - - radsecproxy.general.logFullUsername - - dropdown - This can be set to off to only log the realm in Access-Accept/Reject log messages (for privacy). - - - - radsecproxy.general.logMac - - dropdown - Static, Original, VendorHashed, VendorKeyHashed, FullyHashed or FullyKeyHashed. The default value for LogMAC is Original.]]> - - - - radsecproxy.general.loopPrevention - - dropdown - When this is enabled (on), a request will never be sent to a server named the same as the client it was received from. I.e., the names of the client block and the server block are compared. Note that this only gives limited protection against loops. It can be used as a basic option and inside server blocks where it overrides the basic setting. - - - - section_title - - true - - - - section_title - - true - Listen for the address and port for the respective protocol. Normally the proxy will listen to the standard ports if configured to handle clients with the respective protocol. The default ports are 1812 for UDP and TCP and 2083 for TLS and DTLS. On most systems it will do this for all of the system’s IP addresses (both IPv4 and IPv6). On some systems however, it may respond to only IPv4 or only IPv6. To specify an alternate port you may use a value on the form *:port where port is any valid port number. If you also want to specify a specific address you can do e.g. 192.168.1.1:1812 or [2001:db8::1]:1812. The port may be omitted if you want the default one. Note that you must use brackets around the IPv6 address. These options may be specified multiple times to listen to multiple addresses and/or ports for each protocol. - - - - radsecproxy.general.listenUdp - - text - true - - - - - radsecproxy.general.listenTcp - - text - true - - - - - radsecproxy.general.listenTls - - text - true - - - - - radsecproxy.general.listenDtls - - text - true - - - - - section_title - - true - This can be used to specify source address and/or source port that the proxy will use for connecting to clients to send messages (e.g. Access Request). The same syntax as for Listen... applies. - - - - radsecproxy.general.sourceUdp - - text - true - - - - - radsecproxy.general.sourceTcp - - text - true - - - - - radsecproxy.general.sourceTls - - text - true - - - - - radsecproxy.general.sourceDtls - - text - true - - - -
+
+ + + radsecproxy.general.enabled + + checkbox + + + + radsecproxy.general.logLevel + + dropdown + This option specifies the debug level. It must be set to 1, 2, 3, 4 or 5, where 1 logs only serious errors, and 5 logs everything. The default is 2 which logs errors, warnings and a few informational messages. + + + + radsecproxy.general.logFullUsername + + dropdown + This can be set to off to only log the realm in Access-Accept/Reject log messages (for privacy). + + + + radsecproxy.general.logMac + + dropdown + Static, Original, VendorHashed, VendorKeyHashed, FullyHashed or FullyKeyHashed. The default value for LogMAC is Original.]]> + + + + radsecproxy.general.loopPrevention + + dropdown + When this is enabled (on), a request will never be sent to a server named the same as the client it was received from. I.e., the names of the client block and the server block are compared. Note that this only gives limited protection against loops. It can be used as a basic option and inside server blocks where it overrides the basic setting. + + + + section_title + + true + + + + section_title + + true + Listen for the address and port for the respective protocol. Normally the proxy will listen to the standard ports if configured to handle clients with the respective protocol. The default ports are 1812 for UDP and TCP and 2083 for TLS and DTLS. On most systems it will do this for all of the system’s IP addresses (both IPv4 and IPv6). On some systems however, it may respond to only IPv4 or only IPv6. To specify an alternate port you may use a value on the form *:port where port is any valid port number. If you also want to specify a specific address you can do e.g. 192.168.1.1:1812 or [2001:db8::1]:1812. The port may be omitted if you want the default one. Note that you must use brackets around the IPv6 address. These options may be specified multiple times to listen to multiple addresses and/or ports for each protocol. + + + + radsecproxy.general.listenUdp + + text + true + + + + + radsecproxy.general.listenTcp + + text + true + + + + + radsecproxy.general.listenTls + + text + true + + + + + radsecproxy.general.listenDtls + + text + true + + + + + section_title + + true + This can be used to specify source address and/or source port that the proxy will use for connecting to clients to send messages (e.g. Access Request). The same syntax as for Listen... applies. + + + + radsecproxy.general.sourceUdp + + text + true + + + + + radsecproxy.general.sourceTcp + + text + true + + + + + radsecproxy.general.sourceTls + + text + true + + + + + radsecproxy.general.sourceDtls + + text + true + + + +
diff --git a/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/Menu/Menu.xml b/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/Menu/Menu.xml index 65b18340f..38211fc76 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/Menu/Menu.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/Menu/Menu.xml @@ -1,12 +1,12 @@ - - - - - - - - - - - - + + + + + + + + + + + + diff --git a/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/RadSecProxy.xml b/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/RadSecProxy.xml index 145fb8b59..231a2e9ba 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/RadSecProxy.xml +++ b/net/radsecproxy/src/opnsense/mvc/app/models/OPNsense/RadSecProxy/RadSecProxy.xml @@ -1,514 +1,514 @@ - - //OPNsense/radsecproxy - - RadSecProxy-Management - - 0.0.1 - - - - - 0 - Y - - - - Y - 2 - - 1 (only serious errors) - 2 (default) - 3 - 4 - 5 (log everything) - - - - - Y - off - - On - Off - - - - - Y - Original - - Static - Original - VendorHashed - VendorKeyHashed - FullyHashed - FullyKeyHashed - - - - - Y - on - - On - Off - - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - - - - - - 1 - Y - - - - Y - /^([0-9a-zA-Z_\-]){1,25}$/u - Should be a string between 1 and 25 characters whithout special characters. - - - UniqueConstraint - Identifier already in use - - - - - - N - - - - Y - Y - - - UniqueConstraint - - - - - - Y - udp - - UDP - TCP - TLS - DTLS - - - - - N - - - Must be set for UDP-clients. - SetIfConstraint - type - udp - - - Must be set for TCP-clients. - SetIfConstraint - type - tcp - - - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - tlsConfigs.tlsConfig - name - - - - - - Y - off - - On - Off - - - - - N - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - rewrites.rewrite - name - - - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - rewrites.rewrite - name - - - - - - - - - - - - Y - /^([0-9a-zA-Z_\-]){1,25}$/u - Should be a string between 1 and 25 characters whithout special characters. - - - UniqueConstraint - Identifier already in use - - - - - - N - - - - Y - Y - - - - N - - - - Y - off - - On - Off - Minimal - Auto - - - - - Y - udp - - UDP - TCP - TLS - DTLS - - - - - N - - - Must be set for UDP-servers. - SetIfConstraint - type - udp - - - Must be set for TCP-servers. - SetIfConstraint - type - tcp - - - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - tlsConfigs.tlsConfig - name - - - - - - Y - off - - On - Off - - - - - N - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - rewrites.rewrite - name - - - - - - N - - - OPNsense.RadSecProxy.RadSecProxy - rewrites.rewrite - name - - - - - - - - - - - - Y - /^([0-9a-zA-Z_\-]){1,25}$/u - Should be a string between 1 and 25 characters whithout special characters. - default - - - UniqueConstraint - Name already in use - - - - - - N - - - - Y - Field is required - ca - - - - Y - Field is required - cert - - - - N - Y - - - - Y - off - - On - Off - - - - - N - - - - - - - - - - 1 - Y - - - - N - - - - Y - Must not be empty - - - UniqueConstraint - Must be unique - - - - - - Y - N - Y - - - OPNsense.RadSecProxy.RadSecProxy - servers.server - identifier - - - Related server not found - - - - Y - N - Y - - - OPNsense.RadSecProxy.RadSecProxy - servers.server - identifier - - - Related server not found - - - - Y - off - - On - Off - - - - - N - - - - - - - - - - 1 - Y - - - - Y - /^([0-9a-zA-Z_\-]){1,25}$/u - Should be a string between 1 and 25 characters whithout special characters. - default - - - UniqueConstraint - Name already in use - - - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - N - - - - Y - off - - On - Off - - - - - N - - - - N - - - - - - + + //OPNsense/radsecproxy + + RadSecProxy-Management + + 0.0.1 + + + + + 0 + Y + + + + Y + 2 + + 1 (only serious errors) + 2 (default) + 3 + 4 + 5 (log everything) + + + + + Y + off + + On + Off + + + + + Y + Original + + Static + Original + VendorHashed + VendorKeyHashed + FullyHashed + FullyKeyHashed + + + + + Y + on + + On + Off + + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z_\-]){1,25}$/u + Should be a string between 1 and 25 characters whithout special characters. + + + UniqueConstraint + Identifier already in use + + + + + + N + + + + Y + Y + + + UniqueConstraint + + + + + + Y + udp + + UDP + TCP + TLS + DTLS + + + + + N + + + Must be set for UDP-clients. + SetIfConstraint + type + udp + + + Must be set for TCP-clients. + SetIfConstraint + type + tcp + + + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + tlsConfigs.tlsConfig + name + + + + + + Y + off + + On + Off + + + + + N + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + rewrites.rewrite + name + + + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + rewrites.rewrite + name + + + + + + + + + + + + Y + /^([0-9a-zA-Z_\-]){1,25}$/u + Should be a string between 1 and 25 characters whithout special characters. + + + UniqueConstraint + Identifier already in use + + + + + + N + + + + Y + Y + + + + N + + + + Y + off + + On + Off + Minimal + Auto + + + + + Y + udp + + UDP + TCP + TLS + DTLS + + + + + N + + + Must be set for UDP-servers. + SetIfConstraint + type + udp + + + Must be set for TCP-servers. + SetIfConstraint + type + tcp + + + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + tlsConfigs.tlsConfig + name + + + + + + Y + off + + On + Off + + + + + N + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + rewrites.rewrite + name + + + + + + N + + + OPNsense.RadSecProxy.RadSecProxy + rewrites.rewrite + name + + + + + + + + + + + + Y + /^([0-9a-zA-Z_\-]){1,25}$/u + Should be a string between 1 and 25 characters whithout special characters. + default + + + UniqueConstraint + Name already in use + + + + + + N + + + + Y + Field is required + ca + + + + Y + Field is required + cert + + + + N + Y + + + + Y + off + + On + Off + + + + + N + + + + + + + + + + 1 + Y + + + + N + + + + Y + Must not be empty + + + UniqueConstraint + Must be unique + + + + + + Y + N + Y + + + OPNsense.RadSecProxy.RadSecProxy + servers.server + identifier + + + Related server not found + + + + Y + N + Y + + + OPNsense.RadSecProxy.RadSecProxy + servers.server + identifier + + + Related server not found + + + + Y + off + + On + Off + + + + + N + + + + + + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z_\-]){1,25}$/u + Should be a string between 1 and 25 characters whithout special characters. + default + + + UniqueConstraint + Name already in use + + + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + N + + + + Y + off + + On + Off + + + + + N + + + + N + + + + + + diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/clients.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/clients.volt index 33e7413f2..c03c5d45b 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/clients.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/clients.volt @@ -1,56 +1,56 @@ - - - - - - - - - - - - - - - - - - - - - - -
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Type') }}{{ lang._('Host') }}{{ lang._('Identifier') }}{{ lang._('Description') }}{{ lang._('Commands') }}
- - -
- -
- -
- -{{ partial("layout_partials/base_dialog",['fields':formDialogClient,'id':'DialogClient','label':lang._('Edit client')])}} + + + + + + + + + + + + + + + + + + + + + + +
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Type') }}{{ lang._('Host') }}{{ lang._('Identifier') }}{{ lang._('Description') }}{{ lang._('Commands') }}
+ + +
+ +
+ +
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogClient,'id':'DialogClient','label':lang._('Edit client')])}} diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/general.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/general.volt index 1508a57b5..2c264100f 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/general.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/general.volt @@ -1,31 +1,31 @@ - -
- {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_GeneralSettings'])}} - -
-
- -
-
+ +
+ {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_GeneralSettings'])}} + +
+
+ +
+
diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/realms.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/realms.volt index 974842f40..85453ec79 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/realms.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/realms.volt @@ -1,54 +1,54 @@ - - - - - - - - - - - - - - - - - - - - -
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Realm') }}{{ lang._('Description') }}{{ lang._('Commands') }}
- - -
- -
- -
- -{{ partial("layout_partials/base_dialog",['fields':formDialogRealm,'id':'DialogRealm','label':lang._('Edit realm')])}} + + + + + + + + + + + + + + + + + + + + +
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Realm') }}{{ lang._('Description') }}{{ lang._('Commands') }}
+ + +
+ +
+ +
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogRealm,'id':'DialogRealm','label':lang._('Edit realm')])}} diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/rewrites.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/rewrites.volt index ded628966..0da6b6612 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/rewrites.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/rewrites.volt @@ -1,54 +1,54 @@ - - - - - - - - - - - - - - - - - - - - -
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Type') }}{{ lang._('Description') }}{{ lang._('Commands') }}
- - -
- -
- -
- -{{ partial("layout_partials/base_dialog",['fields':formDialogRewrite,'id':'DialogRewrite','label':lang._('Edit rewrite-rule')])}} + + + + + + + + + + + + + + + + + + + + +
{{ lang._('ID') }}{{ lang._('Enabled') }}{{ lang._('Type') }}{{ lang._('Description') }}{{ lang._('Commands') }}
+ + +
+ +
+ +
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogRewrite,'id':'DialogRewrite','label':lang._('Edit rewrite-rule')])}} diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/servers.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/servers.volt index 058186999..b394b1e5a 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/servers.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/servers.volt @@ -1,56 +1,56 @@ - - - - - - - - - - - - - - - - - - - - - - -
{{ lang._('ID') }}{{ lang._('Host') }}{{ lang._('Identifier') }}{{ lang._('Description') }}{{ lang._('Type') }}{{ lang._('TLS-Config') }}{{ lang._('Commands') }}
- - -
- -
- -
- -{{ partial("layout_partials/base_dialog",['fields':formDialogServer,'id':'DialogServer','label':lang._('Edit server')])}} + + + + + + + + + + + + + + + + + + + + + + +
{{ lang._('ID') }}{{ lang._('Host') }}{{ lang._('Identifier') }}{{ lang._('Description') }}{{ lang._('Type') }}{{ lang._('TLS-Config') }}{{ lang._('Commands') }}
+ + +
+ +
+ +
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogServer,'id':'DialogServer','label':lang._('Edit server')])}} diff --git a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/tls.volt b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/tls.volt index 353348605..cc63e0c74 100644 --- a/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/tls.volt +++ b/net/radsecproxy/src/opnsense/mvc/app/views/OPNsense/RadSecProxy/tls.volt @@ -1,55 +1,55 @@ - - - - - - - - - - - - - - - - - - - - - -
{{ lang._('ID') }}{{ lang._('Name') }}{{ lang._('Description') }}{{ lang._('CA-certificate') }}{{ lang._('Proxy-certificate') }}{{ lang._('Commands') }}
- - -
- -
- -
- -{{ partial("layout_partials/base_dialog",['fields':formDialogTls,'id':'DialogTls','label':lang._('Edit TLS-config')])}} + + + + + + + + + + + + + + + + + + + + + +
{{ lang._('ID') }}{{ lang._('Name') }}{{ lang._('Description') }}{{ lang._('CA-certificate') }}{{ lang._('Proxy-certificate') }}{{ lang._('Commands') }}
+ + +
+ +
+ +
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogTls,'id':'DialogTls','label':lang._('Edit TLS-config')])}} diff --git a/net/radsecproxy/src/opnsense/scripts/OPNsense/RadSecProxy/generate_certs.php b/net/radsecproxy/src/opnsense/scripts/OPNsense/RadSecProxy/generate_certs.php index 9414db161..d123a56e2 100755 --- a/net/radsecproxy/src/opnsense/scripts/OPNsense/RadSecProxy/generate_certs.php +++ b/net/radsecproxy/src/opnsense/scripts/OPNsense/RadSecProxy/generate_certs.php @@ -57,7 +57,7 @@ if (! function_exists('deleteFilesInFolder')) { { echo "deleting all files in folder " . $pathToFolder . "\n"; $files = glob($pathToFolder . '/*'); - + foreach ($files as $file) { //Make sure that this is a file and not a directory. if (is_file($file)) { diff --git a/net/radsecproxy/src/opnsense/service/conf/actions.d/actions_radsecproxy.conf b/net/radsecproxy/src/opnsense/service/conf/actions.d/actions_radsecproxy.conf index 42dfe2296..79ca19046 100644 --- a/net/radsecproxy/src/opnsense/service/conf/actions.d/actions_radsecproxy.conf +++ b/net/radsecproxy/src/opnsense/service/conf/actions.d/actions_radsecproxy.conf @@ -1,35 +1,35 @@ -[setup] -command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh; -parameters: -type:script -message:setup radsecproxy service requirements - -[start] -command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy start; -parameters: -type:script -message:starting radsecproxy - -[stop] -command:/usr/local/etc/rc.d/radsecproxy stop; -parameters: -type:script -message:stopping radsecproxy - -[restart] -command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy restart; -parameters: -type:script -message:restarting radsecproxy - -[reload] -command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy restart; -parameters: -type:script -message:reloading radsecproxy - -[status] -command:/usr/local/etc/rc.d/radsecproxy status;exit 0; -parameters: -type:script_output -message:radsecproxy status +[setup] +command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh; +parameters: +type:script +message:setup radsecproxy service requirements + +[start] +command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy start; +parameters: +type:script +message:starting radsecproxy + +[stop] +command:/usr/local/etc/rc.d/radsecproxy stop; +parameters: +type:script +message:stopping radsecproxy + +[restart] +command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy restart; +parameters: +type:script +message:restarting radsecproxy + +[reload] +command:/usr/local/opnsense/scripts/OPNsense/RadSecProxy/setup.sh;/usr/local/etc/rc.d/radsecproxy restart; +parameters: +type:script +message:reloading radsecproxy + +[status] +command:/usr/local/etc/rc.d/radsecproxy status;exit 0; +parameters: +type:script_output +message:radsecproxy status diff --git a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/+TARGETS b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/+TARGETS index 294d4f30d..d7da8ea4c 100644 --- a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/+TARGETS +++ b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/+TARGETS @@ -1,2 +1,2 @@ -radsecproxy.conf:/usr/local/etc/radsecproxy.conf -rc.conf.d:/etc/rc.conf.d/radsecproxy +radsecproxy.conf:/usr/local/etc/radsecproxy.conf +rc.conf.d:/etc/rc.conf.d/radsecproxy diff --git a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/radsecproxy.conf b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/radsecproxy.conf index b0563b335..bdb62ce38 100644 --- a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/radsecproxy.conf +++ b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/radsecproxy.conf @@ -1,240 +1,240 @@ -{% if helpers.exists('OPNsense.radsecproxy.general') and OPNsense.radsecproxy.general.enabled|default("0") == "1" %} -{% set certDir = '/usr/local/etc/radsecproxy.d/certs/' %} -# auto-generated config-file for radsecproxy -########################################### -# GENERAL -########################################### - -#PidFile /var/run/radsecproxy.pid -#LogDestination file:///var/log/radsecproxy.log -LogDestination x-syslog:///LOG_DAEMON - -{% if OPNsense.radsecproxy.general.logLevel is defined and OPNsense.radsecproxy.general.logLevel != "" %} -LogLevel {{ OPNsense.radsecproxy.general.logLevel }} -{% endif %} -{% if OPNsense.radsecproxy.general.logFullUsername is defined and OPNsense.radsecproxy.general.logFullUsername != "" %} -LogFullUsername {{ OPNsense.radsecproxy.general.logFullUsername }} -{% endif %} -{% if OPNsense.radsecproxy.general.logMac is defined and OPNsense.radsecproxy.general.logMac != "" %} -LogMac {{ OPNsense.radsecproxy.general.logMac }} -{% endif %} -{% if OPNsense.radsecproxy.general.loopPrevention is defined and OPNsense.radsecproxy.general.loopPrevention != "" %} -LoopPrevention {{ OPNsense.radsecproxy.general.loopPrevention }} -{% endif %} -{% if OPNsense.radsecproxy.general.listenUdp is defined and OPNsense.radsecproxy.general.listenUdp != "" %} -ListenUDP {{ OPNsense.radsecproxy.general.listenUdp }} -{% endif %} -{% if OPNsense.radsecproxy.general.listenTcp is defined and OPNsense.radsecproxy.general.listenTcp != "" %} -ListenTCP {{ OPNsense.radsecproxy.general.listenTcp }} -{% endif %} -{% if OPNsense.radsecproxy.general.listenTls is defined and OPNsense.radsecproxy.general.listenTls != "" %} -ListenTLS {{ OPNsense.radsecproxy.general.listenTls }} -{% endif %} -{% if OPNsense.radsecproxy.general.listenDtls is defined and OPNsense.radsecproxy.general.listenDtls != "" %} -ListenDTLS {{ OPNsense.radsecproxy.general.listenDtls }} -{% endif %} -{% if OPNsense.radsecproxy.general.sourceUdp is defined and OPNsense.radsecproxy.general.sourceUdp != "" %} -SourceUDP {{ OPNsense.radsecproxy.general.sourceUdp }} -{% endif %} -{% if OPNsense.radsecproxy.general.sourceTcp is defined and OPNsense.radsecproxy.general.sourceTcp != "" %} -SourceTCP {{ OPNsense.radsecproxy.general.sourceTcp }} -{% endif %} -{% if OPNsense.radsecproxy.general.sourceTls is defined and OPNsense.radsecproxy.general.sourceTls != "" %} -SourceTLS {{ OPNsense.radsecproxy.general.sourceTls }} -{% endif %} -{% if OPNsense.radsecproxy.general.sourceDtls is defined and OPNsense.radsecproxy.general.sourceDtls != "" %} -SourceDTLS {{ OPNsense.radsecproxy.general.sourceDtls }} -{% endif %} - -########################################### -# TLS-CONFIGS -########################################### - -{% for tlsConfig in helpers.toList('OPNsense.radsecproxy.tlsConfigs.tlsConfig') %} -# config for TLS-Config "{{ tlsConfig.description }}" -tls {{ tlsConfig.name }} { -{% if tlsConfig.caCertificateRefId is defined and tlsConfig.caCertificateRefId != "" %} - CACertificateFile {{ certDir}}{{ tlsConfig.name }}_ca-cert.pem -{% endif %} -{% if tlsConfig.proxyCertificateRefId is defined and tlsConfig.proxyCertificateRefId != "" %} - CertificateFile {{ certDir}}{{ tlsConfig.name }}_proxy-cert.pem - CertificateKeyFile {{ certDir}}{{ tlsConfig.name }}_proxy-key.pem -{% endif %} -{% if tlsConfig.policyOids is defined and tlsConfig.policyOids != "" %} -{% for policyOid in tlsConfig.policyOids.split(',') %} - PolicyOID {{ policyOid }} -{% endfor %} -{% endif %} - CRLCheck {{ tlsConfig.crlCheck }} -{% if tlsConfig.cacheExpiry is defined and tlsConfig.cacheExpiry != "" %} - CacheExpiry {{ tlsConfig.cacheExpiry }} -{% endif %} -} - -{% endfor %} - -########################################### -# REWRITE-RULES -########################################### - -{% for rewriteRule in helpers.toList('OPNsense.radsecproxy.rewrites.rewrite') %} -{% if rewriteRule.enabled is defined and rewriteRule.enabled == "1" %} - -rewrite {{ rewriteRule.name }} { -{% if rewriteRule.addAttributes is defined and rewriteRule.addAttributes != "" %} -{% for addAttribute in rewriteRule.addAttributes.split("\n") %} - AddAttribute {{ addAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.addVendorAttributes is defined and rewriteRule.addVendorAttributes != "" %} -{% for addVendorAttribute in rewriteRule.addVendorAttributes.split("\n") %} - AddVendorAttribute {{ addVendorAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.supplementAttributes is defined and rewriteRule.supplementAttributes != "" %} -{% for supplementAttribute in rewriteRule.supplementAttributes.split("\n") %} - SupplementAttribute {{ supplementAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.supplementVendorAttributes is defined and rewriteRule.supplementVendorAttributes != "" %} -{% for supplementVendorAttribute in rewriteRule.supplementVendorAttributes.split("\n") %} - SupplementVendorAttribute {{ supplementVendorAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.modifyAttributes is defined and rewriteRule.modifyAttributes != "" %} -{% for modifyAttribute in rewriteRule.modifyAttributes.split("\n") %} - ModifyAttribute {{ modifyAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.modifyVendorAttributes is defined and rewriteRule.modifyVendorAttributes != "" %} -{% for modifyVendorAttribute in rewriteRule.modifyVendorAttributes.split("\n") %} - ModifyVendorAttribute {{ modifyVendorAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.removeAttributes is defined and rewriteRule.removeAttributes != "" %} -{% for removeAttribute in rewriteRule.removeAttributes.split("\n") %} - RemoveAttribute {{ removeAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.removeVendorAttributes is defined and rewriteRule.removeVendorAttributes != "" %} -{% for removeVendorAttribute in rewriteRule.removeVendorAttributes.split("\n") %} - RemoveVendorAttribute {{ removeVendorAttribute }} -{% endfor %} -{% endif %} - WhitelistMode {{ rewriteRule.whitelistMode }} -{% if rewriteRule.whitelistAttributes is defined and rewriteRule.whitelistAttributes != "" %} -{% for whitelistAttribute in rewriteRule.whitelistAttributes.split("\n") %} - WhitelistAttribute {{ whitelistAttribute }} -{% endfor %} -{% endif %} -{% if rewriteRule.whitelistVendorAttributes is defined and rewriteRule.whitelistVendorAttributes != "" %} -{% for whitelistVendorAttribute in rewriteRule.whitelistVendorAttributes.split("\n") %} - WhitelistVendorAttribute {{ whitelistVendorAttribute }} -{% endfor %} -{% endif %} -} -{% endif %} -{% endfor %} - -########################################### -# CLIENTS -########################################### - -{% for client in helpers.toList('OPNsense.radsecproxy.clients.client') %} -{% if client.enabled is defined and client.enabled == "1" %} -# config for client "{{ client.description }}" -client {{ client.identifier }} { - Host {{ client.host }} - Type {{ client.type }} -{% if client.secret is defined and client.secret != "" %} - Secret {{ client.secret }} -{% endif %} -{% if client.tlsConfig is defined and client.tlsConfig != "" %} -{% set tlsConfig = helpers.getUUID(client.tlsConfig) %} - Tls {{ tlsConfig.name }} -{% endif %} - CertificateNameCheck {{ client.certificateNameCheck }} -{% if client.matchCertificateAttribute is defined and client.matchCertificateAttribute != "" %} - matchCertificateAttribute {{ client.matchCertificateAttribute }} -{% endif %} -{% if client.rewriteIn is defined and client.rewriteIn != "" %} -{% set rewriteInRule = helpers.getUUID(client.rewriteIn) %} - RewriteIn {{ rewriteInRule.name }} -{% endif %} -{% if client.rewriteOut is defined and client.rewriteOut != "" %} -{% set rewriteOutRule = helpers.getUUID(client.rewriteOut) %} - RewriteOut {{ rewriteOutRule.name }} -{% endif %} -} - -{% else %} -# config for client "{{ client.description }}" not enabled, skipping!" - -{% endif %} -{% endfor %} - -########################################### -# SERVERS -########################################### - -{% for server in helpers.toList('OPNsense.radsecproxy.servers.server') %} -# config for server "{{ server.description }}" -server {{ server.identifier }} { - Host {{ server.host }} -{% if server.port is defined and server.port != "" %} - Port {{ server.port }} -{% endif %} - Type {{ server.type }} -{% if server.secret is defined and server.secret != "" %} - Secret {{ server.secret }} -{% endif %} -{% if server.tlsConfig is defined and server.tlsConfig != "" %} -{% set tlsConfig = helpers.getUUID(server.tlsConfig) %} - Tls {{ tlsConfig.name }} -{% endif %} - StatusServer {{ server.statusServer }} - CertificateNameCheck {{ server.certificateNameCheck }} -{% if server.matchCertificateAttribute is defined and server.matchCertificateAttribute != "" %} - matchCertificateAttribute {{ server.matchCertificateAttribute }} -{% endif %} -{% if server.rewriteIn is defined and server.rewriteIn != "" %} -{% set rewriteInRule = helpers.getUUID(server.rewriteIn) %} - RewriteIn {{ rewriteInRule.name }} -{% endif %} -{% if server.rewriteOut is defined and server.rewriteOut != "" %} -{% set rewriteOutRule = helpers.getUUID(server.rewriteOut) %} - RewriteOut {{ rewriteOutRule.name }} -{% endif %} -} - -{% endfor %} - -########################################### -# REALMS -########################################### - -{% for realm in helpers.toList('OPNsense.radsecproxy.realms.realm') %} -{% if realm.enabled is defined and realm.enabled == "1" %} -# config for realm "{{ realm.realm }}" -realm {{ realm.realm }} { -{% if realm.server is defined and realm.server != "" %} -{% for serverUuid in realm.server.split(',') %} -{% set server = helpers.getUUID(serverUuid) %} - Server {{ server.identifier }} -{% endfor %} -{% endif %} -{% if realm.replyMessage is defined and realm.replyMessage != "" %} - ReplyMessage "{{ realm.replyMessage }}" -{% endif %} -{% if realm.accountingResponse is defined and realm.accountingResponse != "" %} - AccountingResponse {{ realm.accountingResponse }} -{% endif %} -} - -{% else %} -# config for realm "{{ realm.realm }}" not enabled, skipping!" - -{% endif %} -{% endfor %} -{# END OF TEMPLATE #} -{% endif %} +{% if helpers.exists('OPNsense.radsecproxy.general') and OPNsense.radsecproxy.general.enabled|default("0") == "1" %} +{% set certDir = '/usr/local/etc/radsecproxy.d/certs/' %} +# auto-generated config-file for radsecproxy +########################################### +# GENERAL +########################################### + +#PidFile /var/run/radsecproxy.pid +#LogDestination file:///var/log/radsecproxy.log +LogDestination x-syslog:///LOG_DAEMON + +{% if OPNsense.radsecproxy.general.logLevel is defined and OPNsense.radsecproxy.general.logLevel != "" %} +LogLevel {{ OPNsense.radsecproxy.general.logLevel }} +{% endif %} +{% if OPNsense.radsecproxy.general.logFullUsername is defined and OPNsense.radsecproxy.general.logFullUsername != "" %} +LogFullUsername {{ OPNsense.radsecproxy.general.logFullUsername }} +{% endif %} +{% if OPNsense.radsecproxy.general.logMac is defined and OPNsense.radsecproxy.general.logMac != "" %} +LogMac {{ OPNsense.radsecproxy.general.logMac }} +{% endif %} +{% if OPNsense.radsecproxy.general.loopPrevention is defined and OPNsense.radsecproxy.general.loopPrevention != "" %} +LoopPrevention {{ OPNsense.radsecproxy.general.loopPrevention }} +{% endif %} +{% if OPNsense.radsecproxy.general.listenUdp is defined and OPNsense.radsecproxy.general.listenUdp != "" %} +ListenUDP {{ OPNsense.radsecproxy.general.listenUdp }} +{% endif %} +{% if OPNsense.radsecproxy.general.listenTcp is defined and OPNsense.radsecproxy.general.listenTcp != "" %} +ListenTCP {{ OPNsense.radsecproxy.general.listenTcp }} +{% endif %} +{% if OPNsense.radsecproxy.general.listenTls is defined and OPNsense.radsecproxy.general.listenTls != "" %} +ListenTLS {{ OPNsense.radsecproxy.general.listenTls }} +{% endif %} +{% if OPNsense.radsecproxy.general.listenDtls is defined and OPNsense.radsecproxy.general.listenDtls != "" %} +ListenDTLS {{ OPNsense.radsecproxy.general.listenDtls }} +{% endif %} +{% if OPNsense.radsecproxy.general.sourceUdp is defined and OPNsense.radsecproxy.general.sourceUdp != "" %} +SourceUDP {{ OPNsense.radsecproxy.general.sourceUdp }} +{% endif %} +{% if OPNsense.radsecproxy.general.sourceTcp is defined and OPNsense.radsecproxy.general.sourceTcp != "" %} +SourceTCP {{ OPNsense.radsecproxy.general.sourceTcp }} +{% endif %} +{% if OPNsense.radsecproxy.general.sourceTls is defined and OPNsense.radsecproxy.general.sourceTls != "" %} +SourceTLS {{ OPNsense.radsecproxy.general.sourceTls }} +{% endif %} +{% if OPNsense.radsecproxy.general.sourceDtls is defined and OPNsense.radsecproxy.general.sourceDtls != "" %} +SourceDTLS {{ OPNsense.radsecproxy.general.sourceDtls }} +{% endif %} + +########################################### +# TLS-CONFIGS +########################################### + +{% for tlsConfig in helpers.toList('OPNsense.radsecproxy.tlsConfigs.tlsConfig') %} +# config for TLS-Config "{{ tlsConfig.description }}" +tls {{ tlsConfig.name }} { +{% if tlsConfig.caCertificateRefId is defined and tlsConfig.caCertificateRefId != "" %} + CACertificateFile {{ certDir}}{{ tlsConfig.name }}_ca-cert.pem +{% endif %} +{% if tlsConfig.proxyCertificateRefId is defined and tlsConfig.proxyCertificateRefId != "" %} + CertificateFile {{ certDir}}{{ tlsConfig.name }}_proxy-cert.pem + CertificateKeyFile {{ certDir}}{{ tlsConfig.name }}_proxy-key.pem +{% endif %} +{% if tlsConfig.policyOids is defined and tlsConfig.policyOids != "" %} +{% for policyOid in tlsConfig.policyOids.split(',') %} + PolicyOID {{ policyOid }} +{% endfor %} +{% endif %} + CRLCheck {{ tlsConfig.crlCheck }} +{% if tlsConfig.cacheExpiry is defined and tlsConfig.cacheExpiry != "" %} + CacheExpiry {{ tlsConfig.cacheExpiry }} +{% endif %} +} + +{% endfor %} + +########################################### +# REWRITE-RULES +########################################### + +{% for rewriteRule in helpers.toList('OPNsense.radsecproxy.rewrites.rewrite') %} +{% if rewriteRule.enabled is defined and rewriteRule.enabled == "1" %} + +rewrite {{ rewriteRule.name }} { +{% if rewriteRule.addAttributes is defined and rewriteRule.addAttributes != "" %} +{% for addAttribute in rewriteRule.addAttributes.split("\n") %} + AddAttribute {{ addAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.addVendorAttributes is defined and rewriteRule.addVendorAttributes != "" %} +{% for addVendorAttribute in rewriteRule.addVendorAttributes.split("\n") %} + AddVendorAttribute {{ addVendorAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.supplementAttributes is defined and rewriteRule.supplementAttributes != "" %} +{% for supplementAttribute in rewriteRule.supplementAttributes.split("\n") %} + SupplementAttribute {{ supplementAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.supplementVendorAttributes is defined and rewriteRule.supplementVendorAttributes != "" %} +{% for supplementVendorAttribute in rewriteRule.supplementVendorAttributes.split("\n") %} + SupplementVendorAttribute {{ supplementVendorAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.modifyAttributes is defined and rewriteRule.modifyAttributes != "" %} +{% for modifyAttribute in rewriteRule.modifyAttributes.split("\n") %} + ModifyAttribute {{ modifyAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.modifyVendorAttributes is defined and rewriteRule.modifyVendorAttributes != "" %} +{% for modifyVendorAttribute in rewriteRule.modifyVendorAttributes.split("\n") %} + ModifyVendorAttribute {{ modifyVendorAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.removeAttributes is defined and rewriteRule.removeAttributes != "" %} +{% for removeAttribute in rewriteRule.removeAttributes.split("\n") %} + RemoveAttribute {{ removeAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.removeVendorAttributes is defined and rewriteRule.removeVendorAttributes != "" %} +{% for removeVendorAttribute in rewriteRule.removeVendorAttributes.split("\n") %} + RemoveVendorAttribute {{ removeVendorAttribute }} +{% endfor %} +{% endif %} + WhitelistMode {{ rewriteRule.whitelistMode }} +{% if rewriteRule.whitelistAttributes is defined and rewriteRule.whitelistAttributes != "" %} +{% for whitelistAttribute in rewriteRule.whitelistAttributes.split("\n") %} + WhitelistAttribute {{ whitelistAttribute }} +{% endfor %} +{% endif %} +{% if rewriteRule.whitelistVendorAttributes is defined and rewriteRule.whitelistVendorAttributes != "" %} +{% for whitelistVendorAttribute in rewriteRule.whitelistVendorAttributes.split("\n") %} + WhitelistVendorAttribute {{ whitelistVendorAttribute }} +{% endfor %} +{% endif %} +} +{% endif %} +{% endfor %} + +########################################### +# CLIENTS +########################################### + +{% for client in helpers.toList('OPNsense.radsecproxy.clients.client') %} +{% if client.enabled is defined and client.enabled == "1" %} +# config for client "{{ client.description }}" +client {{ client.identifier }} { + Host {{ client.host }} + Type {{ client.type }} +{% if client.secret is defined and client.secret != "" %} + Secret {{ client.secret }} +{% endif %} +{% if client.tlsConfig is defined and client.tlsConfig != "" %} +{% set tlsConfig = helpers.getUUID(client.tlsConfig) %} + Tls {{ tlsConfig.name }} +{% endif %} + CertificateNameCheck {{ client.certificateNameCheck }} +{% if client.matchCertificateAttribute is defined and client.matchCertificateAttribute != "" %} + matchCertificateAttribute {{ client.matchCertificateAttribute }} +{% endif %} +{% if client.rewriteIn is defined and client.rewriteIn != "" %} +{% set rewriteInRule = helpers.getUUID(client.rewriteIn) %} + RewriteIn {{ rewriteInRule.name }} +{% endif %} +{% if client.rewriteOut is defined and client.rewriteOut != "" %} +{% set rewriteOutRule = helpers.getUUID(client.rewriteOut) %} + RewriteOut {{ rewriteOutRule.name }} +{% endif %} +} + +{% else %} +# config for client "{{ client.description }}" not enabled, skipping!" + +{% endif %} +{% endfor %} + +########################################### +# SERVERS +########################################### + +{% for server in helpers.toList('OPNsense.radsecproxy.servers.server') %} +# config for server "{{ server.description }}" +server {{ server.identifier }} { + Host {{ server.host }} +{% if server.port is defined and server.port != "" %} + Port {{ server.port }} +{% endif %} + Type {{ server.type }} +{% if server.secret is defined and server.secret != "" %} + Secret {{ server.secret }} +{% endif %} +{% if server.tlsConfig is defined and server.tlsConfig != "" %} +{% set tlsConfig = helpers.getUUID(server.tlsConfig) %} + Tls {{ tlsConfig.name }} +{% endif %} + StatusServer {{ server.statusServer }} + CertificateNameCheck {{ server.certificateNameCheck }} +{% if server.matchCertificateAttribute is defined and server.matchCertificateAttribute != "" %} + matchCertificateAttribute {{ server.matchCertificateAttribute }} +{% endif %} +{% if server.rewriteIn is defined and server.rewriteIn != "" %} +{% set rewriteInRule = helpers.getUUID(server.rewriteIn) %} + RewriteIn {{ rewriteInRule.name }} +{% endif %} +{% if server.rewriteOut is defined and server.rewriteOut != "" %} +{% set rewriteOutRule = helpers.getUUID(server.rewriteOut) %} + RewriteOut {{ rewriteOutRule.name }} +{% endif %} +} + +{% endfor %} + +########################################### +# REALMS +########################################### + +{% for realm in helpers.toList('OPNsense.radsecproxy.realms.realm') %} +{% if realm.enabled is defined and realm.enabled == "1" %} +# config for realm "{{ realm.realm }}" +realm {{ realm.realm }} { +{% if realm.server is defined and realm.server != "" %} +{% for serverUuid in realm.server.split(',') %} +{% set server = helpers.getUUID(serverUuid) %} + Server {{ server.identifier }} +{% endfor %} +{% endif %} +{% if realm.replyMessage is defined and realm.replyMessage != "" %} + ReplyMessage "{{ realm.replyMessage }}" +{% endif %} +{% if realm.accountingResponse is defined and realm.accountingResponse != "" %} + AccountingResponse {{ realm.accountingResponse }} +{% endif %} +} + +{% else %} +# config for realm "{{ realm.realm }}" not enabled, skipping!" + +{% endif %} +{% endfor %} +{# END OF TEMPLATE #} +{% endif %} diff --git a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/rc.conf.d b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/rc.conf.d index 03409f3a7..35042a335 100644 --- a/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/rc.conf.d +++ b/net/radsecproxy/src/opnsense/service/templates/OPNsense/RadSecProxy/rc.conf.d @@ -1,7 +1,7 @@ -{% if helpers.exists('OPNsense.radsecproxy.general.enabled') and OPNsense.radsecproxy.general.enabled == '1' %} -radsecproxy_enable="YES" -{% else %} -radsecproxy_enable="NO" -{% endif %} -radsecproxy_user="root" -radsecproxy_group="wheel" +{% if helpers.exists('OPNsense.radsecproxy.general.enabled') and OPNsense.radsecproxy.general.enabled == '1' %} +radsecproxy_enable="YES" +{% else %} +radsecproxy_enable="NO" +{% endif %} +radsecproxy_user="root" +radsecproxy_group="wheel"