pfSense » pfSense Packages

}

function freeradius_deinstall_command() {

$pidFile = "/var/run/radiusd.pid";

$i = 0;

}

/* Remove package settings from config if 'Keep Settings' is disabled */

log_error("[freeRADIUS] Removing all FreeRADIUS settings since 'Keep Settings/Data' is disabled...");

}

rmdir_recursive(FREERADIUS_RADDB, false);

write_config("[freeRADIUS] Package uninstalled.");

}

}

function freeradius_upgrade_config() {

// FreeRADIUS built-in certificate manager was removed (Bug #7170)

}

}

}

function freeradius_install_command() {

// We create here different folders for different counters.

safe_mkdir("/var/log/radacct/datacounter/daily");

safe_mkdir("/var/log/radacct/datacounter/weekly");

}

function freeradius_settings_resync($restart_svc = true) {

$conf = '';

// put the constant to a variable

touch("/var/log/radwtmp");

}

// Variables: General configuration

$varsettingsmaxrequests = ($varsettings['varsettingsmaxrequests'] ?: '1024');

$varsettingsmaxrequestsperserver = ($varsettings['varsettingsmaxrequestsperserver'] ?: '0');

// For more details look at freeradius_sqlconf_resync()

// Dis-/Enable SQL in "instatiate" section in freeradius_settings_resync() and radiusd.conf SQL SERVER 2

if ($sqlconf['varsqlconf2includeenable'] == 'on') {

}

function freeradius_users_resync($via_rpc = false) {

$conf = '';

if (!empty($arrusers)) {

foreach ($arrusers as $users) {

}

}

function freeradius_authorizedmacs_resync($restart_svc = true, $via_rpc = false) {

$conf = '';

}

}

function freeradius_eapconf_resync($restart_svc = true) {

$conf = '';

// Disable weak EAP types like MD5, and GTC

if ($eapconf['vareapconfdisableweakeaptypes'] == '') {

// Variables: EAP-TLS

$vareapconffragmentsize = ($eapconf['vareapconffragmentsize'] ?: '1024');

$vareapconfincludelength = ($eapconf['vareapconfincludelength'] ?: 'yes');

// Variables: Cache

$vareapconfcacheenablecache = ($eapconf['vareapconfcacheenablecache'] ?: 'no');

$vareapconfpeapdefaulteaptype = ($eapconf['vareapconfpeapdefaulteaptype'] ?: 'mschapv2');

$vareapconfpeapcopyrequesttotunnel = ($eapconf['vareapconfpeapcopyrequesttotunnel'] ?: 'no');

$vareapconfpeapusetunneledreply = ($eapconf['vareapconfpeapusetunneledreply'] ? 1 : 0);

// This is for enable/disbable MS SoH in EAP-PEAP and the virtuial-server "soh-server"

if ($eapconf['vareapconfpeapsohenable'] == 'Enable') {

unlink_if_exists(FREERADIUS_SITESENABLED . "/soh");

}

// For pfSense cert manager

$ca_cert = lookup_ca($eapconf["ssl_ca_cert"]);

if ($ca_cert == false) {

/* Generate CA with generic details */

$ca = array();

$ca['refid'] = uniqid();

} else {

$eapconf["ssl_ca_cert"] = $ca['refid'];

$ca_cert = $ca;

$a_ca[] = $ca;

$cert = array();

$cert['refid'] = uniqid();

$cert['descr'] = "FreeRADIUS Server Certificate";

file_notice("FreeRADIUS", gettext("Cannot create temporary FreeRADIUS certificate. Visit Services > FreeRADIUS > EAP tab and configure server certificates in the 'Certificates for TLS' section: " . openssl_error_string()));

$cert_error = true;

} else {

$a_cert[] = $cert;

$eapconf["ssl_server_cert"] = $cert['refid'];

}

}

file_put_contents(FREERADIUS_CERTS . "/server_key.pem", base64_decode($svr_cert['prv']));

}

if (base64_decode($svr_cert['crt'])) {

base64_decode($svr_cert['crt']) . "\n" .

ca_chain($svr_cert));

}

$vareapconftlsminversion = '1.0';

}

$conf .= <<<EOD

### EAP

eap {

file_put_contents($filename, $conf);

chmod($filename, 0640);

freeradius_sync_on_changes();

if ($restart_svc === true) {

restart_service("radiusd");

// Gets started from freeradiuseapconf.xml

function freeradius_get_ca_crl() {

$crl_arr = array();

$crl_arr[] = array('refid' => 'none', 'descr' => 'none');

}

return $crl_arr;

}

function freeradius_sqlconf_resync() {

$conf = '';

// Variables: SQL DATABASE 1

$varsqlconfdatabase = ($sqlconf['varsqlconfdatabase'] ?: 'mysql');

\$INCLUDE \${modconfdir}/sql/counter/\${dialect}/\${.:instance}.conf

}

EOD;

$filename = FREERADIUS_MODSENABLED . '/sqlcounter';

function freeradius_serverdefault_resync() {

$conf = '';

// failover/loadbalancing mode

$varmodulesldap2failover = ($arrmodulesldap['varmodulesldap2failover'] ?: 'redundant');

@unlink_if_exists(FREERADIUS_MODSENABLED . '/ldap');

}

// authorize section DATABASE 2

if (($sqlconf['varsqlconf2includeenable'] == 'on') && ($sqlconf['varsqlconf2enableauthorize'] == 'Enable')) {

$varsqlconfpostauthtypereject = '# sql';

}

// If unchecked we need the normal EAP section.

if (!$varsettings['varsettingsenablemacauth']) {

} // endforeach

} // endif empty

$conf .= <<<EOD

authorize {

/* Uses XMLRPC to synchronize the changes to a remote node */

function freeradius_sync_on_changes() {

// if checkbox is NOT checked do nothing

switch ($synconchanges) {

case "manual":

log_error("[FreeRADIUS]: XMLRPC sync is enabled but there are no hosts configured as replication targets.");

return;

}

break;

case "auto":

} else {

log_error("[FreeRADIUS]: XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets.");

return;

}

break;

default:

/* Do the actual XMLRPC sync */

function freeradius_do_xmlrpc_sync($sync_to_ip, $username, $password, $varsyncport, $varsyncprotocol, $varsynctimeout) {

/* Detect boot process, do nothing during boot. */

if (platform_booting()) {

return;

$syncsections = array('freeradius', 'freeradiusauthorizedmacs', 'freeradiusclients', 'freeradiusinterfaces',

'freeradiussettings', 'freeradiuseapconf', 'freeradiussqlconf', 'freeradiusmodulesldap');

foreach ($syncsections as $section) {

}

}

$msg = new XML_RPC_Message($method, $params);

$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);

$cli->setCredentials($username, $password);

$cli->setDebug(1);

}

/* Send our XMLRPC message and timeout after defined sync timeout value */

}

function freeradius_modulescounter_resync() {

$conf = '';

$conf .= <<<EOD

}

function freeradius_modulesmschap_resync() {

$conf = '';

$conf .= <<<EOD

}

function freeradius_modulesrealm_resync() {

$conf = '';

$conf .= <<<EOD

}

function freeradius_modulesldap_resync($restart_svc = true) {

$raddb = FREERADIUS_RADDB;

$conf = '';

// Enable and Disable LDAP for "authorize" and "authenticate" will be done in freeradius_serverdefault_resync()

// redundatnt-load-balancing will there be done, too

}

// Miscellaneous Configuration + MS Active Directory Compatibility ldap1

if ($arrmodulesldap['varmodulesldapmsadcompatibilityenable'] == 'Disable') {

$varmodulesldapmsadcompatibility = '### MS Active Directory Compatibility is disabled ###';

} else {

}

// Miscellaneous Configuration + MS Active Directory Compatibility ldap2

if ($arrmodulesldap['varmodulesldap2msadcompatibilityenable'] == 'Disable') {

$varmodulesldap2msadcompatibility = '### MS Active Directory Compatibility is disabled ###';

} else {

}

function freeradius_plainmacauth_resync() {

// Variables: If not using 802.1x, mac address must be known

// defining variables with filename path

$filemodulesfiles = FREERADIUS_MODSENABLED . '/files';

}

function freeradius_modulesfiles_resync() {

$conf = '';

$conf .= <<<EOD

}

function freeradius_motp_resync() {

$conf = '';

$varsettingsmotptimespan = ($varsettings['varsettingsmotptimespan'] ?: '2');

$varsettingsmotptimespanbeforeafter = $varsettingsmotptimespan + $varsettingsmotptimespan;

}

function freeradius_modulesmotp_resync() {

$conf = '';

// put the constant to a variable

}

function freeradius_modulesgoogleauth_resync() {

$conf = '';

// put the constant to a variable

}

function freeradius_modulesdatacounter_resync() {

$conf = '';

// put the constant to a variable

}

function freeradius_datacounter_auth_resync() {

$conf = '';

$conf .= <<<EOD

USERNAME=`echo -n "\\$1" | sed 's/[^0-9a-zA-Z._:-]/X/g' `

TIMERANGE=`echo -n "\\$2" | sed 's/[^a-z]//g' `

### This is to make sure there is a used-octets file after the cronjob resetted the counter

if [ -e "/var/log/radacct/datacounter/\$TIMERANGE/max-octets-\$USERNAME" ] && [ ! -e "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME" ]; then

echo 0 > "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME"

}

function freeradius_datacounter_acct_resync() {

$conf = '';

$conf .= <<<EOD

}

function freeradius_dictionary_resync() {

$conf = '';

$conf .= <<<EOD

/* Users input validation */

function freeradius_validate_users($post, &$input_errors) {

// Username

if (($post['varusersmotpenable'] == 'on') && !preg_match('/^[a-zA-Z0-9_.-]*$/', $post['varusersusername'])) {

$input_errors[] = "The 'Username' field may only contain a-z, A-Z, 0-9, underscore, period and hyphen (regex /^[a-zA-Z0-9_.-]*$/).";

/* MACs input validation */

function freeradius_validate_macs($post, &$input_errors) {

// MAC Address

if (!empty($post['varmacsaddress'])) {

if (!preg_match('/^[0-9A-F]{2}(?:[-:][0-9A-F]{2}){5}$/i', $post['varmacsaddress'])) {

/* NAS/Clients input validation */

function freeradius_validate_clients($post, &$input_errors) {

// Client IP Address

if ($post['varclientip'] != '*') {

if (preg_match('/^(.+)\/(\d+)$/',$post['varclientip'], $matches)) {

/* Interfaces input validation */

function freeradius_validate_interfaces($post, &$input_errors) {

// Interface IP Address

if (empty($post['varinterfaceip'])) {

$input_errors[] = "The 'Interface IP Address' field must not be empty.";

/* General Settings input validation */

function freeradius_validate_settings($post, &$input_errors) {

// Maximum Requests Tracked

if ($post['varsettingsmaxrequests'] != '' && !is_numericint($post['varsettingsmaxrequests'])) {

$input_errors[] = "The 'Maximum Requests Tracked' field must contain an integer value.";

/* EAP settings input validation */

function freeradius_validate_eap($post, &$input_errors) {

// Disable Weak EAP Types sanity check

if ($post['vareapconfdisableweakeaptypes'] == 'on') {

if (in_array($post['vareapconfdefaulteaptype'], array('md5', 'gtc'))) {

/* SQL settings input validation */

function freeradius_validate_sql($post, &$input_errors) {

// SQL Server Address

if ($post['varsqlconfincludeenable'] == 'on') {

if (empty($post['varsqlconfserver'])) {

}

/* LDAP settings input validation */

function freeradius_validate_ldap($post, &$input_errors) {

// LDAP Server Address

if ($post['varmodulesldapenableauthorize'] == 'on') {

if (empty($post['varmodulesldapserver'])) {

}

function freeradius_plugin_certificates($pluginparams) {

$result = array();

init_config_arr(array('installedpackages', 'freeradiuseapconf', 'config'));

if (($pluginparams['type'] == 'certificates') && !empty($eapconf)) {

if (($pluginparams['event'] == 'used_ca') && !empty($eapconf['ssl_ca_cert'])) {