diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile index 09a4dcbc3..abfa82c67 100644 --- a/net/freeradius/Makefile +++ b/net/freeradius/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= freeradius -PLUGIN_VERSION= 1.9.27 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.9.28 PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server PLUGIN_DEPENDS= freeradius3 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/net/freeradius/pkg-descr b/net/freeradius/pkg-descr index 66640e76e..21116160b 100644 --- a/net/freeradius/pkg-descr +++ b/net/freeradius/pkg-descr @@ -17,6 +17,11 @@ WWW: https://www.freeradius.org Plugin Changelog ================ +1.9.28 + +* Add Groups for VLAN assignment +* Add Fallback PPSK + 1.9.27 * Allow EAP-TLS with multiple CAs (contributed by RasAlGhul) diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapgroupController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapgroupController.php new file mode 100644 index 000000000..06b8377b9 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapgroupController.php @@ -0,0 +1,203 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Freeradius\Api; + +use OPNsense\Freeradius\Ldapgroup; +use OPNsense\Core\Config; +use OPNsense\Base\ApiMutableModelControllerBase; +use OPNsense\Base\UIModelGrid; + +class LdapgroupController extends ApiMutableModelControllerBase +{ + protected static $internalModelName = 'Ldapgroup'; + protected static $internalModelClass = '\OPNsense\Freeradius\Ldapgroup'; + + public function getAction() + { + // define list of configurable settings + $result = array(); + if ($this->request->isGet()) { + $mdlLdapgroup = new Ldapgroup(); + $result['ldapgroup'] = $mdlLdapgroup->getNodes(); + } + return $result; + } + + public function setAction() + { + $result = array("result" => "failed"); + if ($this->request->isPost()) { + // load model and update with provided data + $mdlLdapgroup = new Ldapgroup(); + $mdlLdapgroup->setNodes($this->request->getPost("ldapgroup")); + // perform validation + $valMsgs = $mdlLdapgroup->performValidation(); + foreach ($valMsgs as $field => $msg) { + if (!array_key_exists("validations", $result)) { + $result["validations"] = array(); + } + $result["validations"]["ldapgroup." . $msg->getField()] = $msg->getMessage(); + } + // serialize model to config and save + if ($valMsgs->count() == 0) { + $mdlLdapgroup->serializeToConfig(); + Config::getInstance()->save(); + $result["result"] = "saved"; + } + } + return $result; + } + + public function searchLdapgroupAction() + { + $mdlLdapgroup = $this->getModel(); + $grid = new UIModelGrid($mdlLdapgroup->ldapgroups->ldapgroup); + return $grid->fetchBindRequest( + $this->request, + array("enabled", "ldapgroupname", "vlan" ) + ); + } + + public function getLdapgroupAction($uuid = null) + { + $mdlLdapgroup = $this->getModel(); + if ($uuid != null) { + $node = $mdlLdapgroup->getNodeByReference('ldapgroups.ldapgroup.' . $uuid); + if ($node != null) { + // return node + return array("ldapgroup" => $node->getNodes()); + } + } else { + $node = $mdlLdapgroup->ldapgroups->ldapgroup->add(); + return array("ldapgroup" => $node->getNodes()); + } + return array(); + } + + public function addLdapgroupAction() + { + $result = array("result" => "failed"); + if ($this->request->isPost() && $this->request->hasPost("ldapgroup")) { + $result = array("result" => "failed", "validations" => array()); + $mdlLdapgroup = $this->getModel(); + $node = $mdlLdapgroup->ldapgroups->ldapgroup->Add(); + $node->setNodes($this->request->getPost("ldapgroup")); + $valMsgs = $mdlLdapgroup->performValidation(); + foreach ($valMsgs as $field => $msg) { + $fieldnm = str_replace($node->__reference, "ldapgroup", $msg->getField()); + $result["validations"][$fieldnm] = $msg->getMessage(); + } + if (count($result['validations']) == 0) { + unset($result['validations']); + // save config if validated correctly + $mdlLdapgroup->serializeToConfig(); + Config::getInstance()->save(); + unset($result['validations']); + $result["result"] = "saved"; + } + } + return $result; + } + + public function delLdapgroupAction($uuid) + { + $result = array("result" => "failed"); + if ($this->request->isPost()) { + $mdlLdapgroup = $this->getModel(); + if ($uuid != null) { + if ($mdlLdapgroup->ldapgroups->ldapgroup->del($uuid)) { + $mdlLdapgroup->serializeToConfig(); + Config::getInstance()->save(); + $result['result'] = 'deleted'; + } else { + $result['result'] = 'not found'; + } + } + } + return $result; + } + + public function setLdapgroupAction($uuid) + { + if ($this->request->isPost() && $this->request->hasPost("ldapgroup")) { + $mdlSetting = $this->getModel(); + if ($uuid != null) { + $node = $mdlSetting->getNodeByReference('ldapgroups.ldapgroup.' . $uuid); + if ($node != null) { + $result = array("result" => "failed", "validations" => array()); + $ldapgroupInfo = $this->request->getPost("ldapgroup"); + $node->setNodes($ldapgroupInfo); + $valMsgs = $mdlSetting->performValidation(); + foreach ($valMsgs as $field => $msg) { + $fieldnm = str_replace($node->__reference, "ldapgroup", $msg->getField()); + $result["validations"][$fieldnm] = $msg->getMessage(); + } + if (count($result['validations']) == 0) { + // save config if validated correctly + $mdlSetting->serializeToConfig(); + Config::getInstance()->save(); + $result = array("result" => "saved"); + } + return $result; + } + } + } + return array("result" => "failed"); + } + + public function toggle_handler($uuid, $elements, $element) + { + $result = array("result" => "failed"); + if ($this->request->isPost()) { + $mdlSetting = $this->getModel(); + if ($uuid != null) { + $node = $mdlSetting->getNodeByReference($elements . '.' . $element . '.' . $uuid); + if ($node != null) { + if ($node->enabled->__toString() == "1") { + $result['result'] = "Disabled"; + $node->enabled = "0"; + } else { + $result['result'] = "Enabled"; + $node->enabled = "1"; + } + // if item has toggled, serialize to config and save + $mdlSetting->serializeToConfig(); + Config::getInstance()->save(); + } + } + } + return $result; + } + + public function toggleLdapgroupAction($uuid) + { + return $this->toggle_handler($uuid, 'ldapgroups', 'ldapgroup'); + } +} diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapgroupController.php b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapgroupController.php new file mode 100644 index 000000000..4834bf5fd --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapgroupController.php @@ -0,0 +1,38 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Freeradius; + +class LdapgroupController extends \OPNsense\Base\IndexController +{ + public function indexAction() + { + $this->view->formDialogEditFreeRADIUSLdapgroup = $this->getForm("dialogEditFreeRADIUSLdapgroup"); + $this->view->pick('OPNsense/Freeradius/ldapgroup'); + } +} diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSLdapgroup.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSLdapgroup.xml new file mode 100644 index 000000000..ac48a4bb2 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSLdapgroup.xml @@ -0,0 +1,20 @@ +
+ + ldapgroup.enabled + + checkbox + This will enable or disable the user account. + + + ldapgroup.ldapgroupname + + text + The complete LDAP DN. + + + ldapgroup.vlan + + text + VLAN ID for the specific LDAP group. + +
diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.php b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.php new file mode 100644 index 000000000..0e75f2296 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.php @@ -0,0 +1,31 @@ + + All rights reserved. + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +class Ldapgroup extends BaseModel +{ +} diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.xml new file mode 100644 index 000000000..b120513e4 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldapgroup.xml @@ -0,0 +1,23 @@ + + //OPNsense/freeradius/ldapgroup + FreeRADIUS ldapgroup configuration + 1.0.0 + + + + + 1 + Y + + + Y + + + N + 1 + 4096 + + + + + diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml index d74274127..8f471bcb4 100644 --- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml @@ -8,6 +8,7 @@ + diff --git a/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldapgroup.volt b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldapgroup.volt new file mode 100644 index 000000000..88d74b363 --- /dev/null +++ b/net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldapgroup.volt @@ -0,0 +1,135 @@ +{# + +OPNsense® is Copyright © 2014 – 2017 by Deciso B.V. +Copyright (C) 2017 - 2025 Michael Muenz +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, +this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, +this list of conditions and the following disclaimer in the documentation +and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, +OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +#} + + + + + +
+
+ + + + + + + + + + + + + + + + + +
{{ lang._('Enabled') }}{{ lang._('Groupname') }}{{ lang._('VLAN ID') }}{{ lang._('ID') }}{{ lang._('Commands') }}
+ + +
+
+
+
+ +

+
+
+ +{{ partial("layout_partials/base_dialog",['fields':formDialogEditFreeRADIUSLdapgroup,'id':'dialogEditFreeRADIUSLdapgroup','label':lang._('Edit LDAP Group')])}} diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users index 6618e4110..dda33d3f3 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users @@ -101,6 +101,18 @@ DEFAULT Hint == "CSLIP" DEFAULT Hint == "SLIP" Framed-Protocol = SLIP + +{% if helpers.exists('OPNsense.freeradius.ldapgroup.ldapgroups.ldapgroup') %} +{% for ldapgroup_list in helpers.toList('OPNsense.freeradius.ldapgroup.ldapgroups.ldapgroup') %} +{% if ldapgroup_list.enabled == '1' %} +DEFAULT Ldap-Group == "{{ ldapgroup_list.ldapgroupname }}" + Tunnel-Type = VLAN, + Tunnel-Medium-Type = IEEE-802, + Tunnel-Private-Group-Id = "{{ ldapgroup_list.vlan }}" +{% endif %} +{% endfor %} +{% endif %} + {% if helpers.exists('OPNsense.freeradius.general.fallbackvlan_enabled') and OPNsense.freeradius.general.fallbackvlan_enabled == '1' %} DEFAULT Auth-Type := Accept