net/freeradius: fix secret and allow ecdh curve selection (#2511)

net/freeradius/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.9.15
+PLUGIN_VERSION=		1.9.16
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net/freeradius/pkg-descr

@@ -15,6 +15,11 @@ The server is fast, feature-rich, modular, and scalable.
 Plugin Changelog
 ================
 
+1.9.16
+
+* Allow user to choose Elliptic Curve in EAP
+* Allow client secrets starting with hash sign
+
 1.9.15
 
 * Fixed validation of CIDR for client network ranges

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/eap.xml

@@ -5,6 +5,12 @@
         <type>dropdown</type>
         <help>Set the default EAP type.</help>
     </field>
+    <field>
+        <id>eap.elliptic_curve</id>
+        <label>Elliptic Curve</label>
+        <type>dropdown</type>
+        <help>Set the Elliptical cryptography configuration.</help>
+    </field>
     <field>
         <id>eap.enable_client_cert</id>
         <label>Use own certificates</label>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Eap.xml

@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/freeradius/eap</mount>
     <description>EAP configuration</description>
-    <version>1.0.0</version>
+    <version>1.9.16</version>
     <items>
         <default_eap_type type="OptionField">
             <default>md5</default>
@@ -16,6 +16,15 @@
                 <ttls-gtc>TTLS-GTC</ttls-gtc>
             </OptionValues>
         </default_eap_type>
+        <elliptic_curve type="OptionField">
+            <default>prime256v1</default>
+            <Required>Y</Required>
+            <multiple>N</multiple>
+            <OptionValues>
+                <prime256v1>prime256v1</prime256v1>
+                <secp384r1>secp384r1</secp384r1>
+            </OptionValues>
+        </elliptic_curve>
         <enable_client_cert type="BooleanField">
             <default>0</default>
             <Required>Y</Required>

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/clients.conf

@@ -4,7 +4,7 @@
 {%   for client_list in helpers.toList('OPNsense.freeradius.client.clients.client') %}
 {%     if client_list.enabled == '1' %}
 client "{{ client_list.name }}" {
-       secret    = {{ client_list.secret }}
+       secret    = "{{ client_list.secret }}"
        shortname = "{{ client_list.name }}"
 {%       if ':' in client_list.ip %}
        ipv6addr  = {{ client_list.ip }}

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-eap

@@ -471,7 +471,7 @@ eap {
                 #
                 #        openssl ecparam -list_curves
                 #
-                ecdh_curve = "prime256v1"
+                ecdh_curve = "{{ OPNsense.freeradius.eap.elliptic_curve }}"
 
                 #  Session resumption / fast reauthentication
                 #  cache.