pfSense » pfSense Packages

}

function freeradius_deinstall_command() {

	$pidFile = "/var/run/radiusd.pid";

	$i = 0;

	}

	/* Remove package settings from config if 'Keep Settings' is disabled */

		log_error("[freeRADIUS] Removing all FreeRADIUS settings since 'Keep Settings/Data' is disabled...");

		}

		rmdir_recursive(FREERADIUS_RADDB, false);

		write_config("[freeRADIUS] Package uninstalled.");

	}

}

function freeradius_upgrade_config() {

	// FreeRADIUS built-in certificate manager was removed (Bug #7170)

		}

	}

}

function freeradius_install_command() {

	// We create here different folders for different counters.

	safe_mkdir("/var/log/radacct/datacounter/daily");

	safe_mkdir("/var/log/radacct/datacounter/weekly");

}

function freeradius_settings_resync($restart_svc = true) {

	$conf = '';

	// put the constant to a variable

		touch("/var/log/radwtmp");

	}

	// Variables: General configuration

	$varsettingsmaxrequests = ($varsettings['varsettingsmaxrequests'] ?: '1024');

	$varsettingsmaxrequestsperserver = ($varsettings['varsettingsmaxrequestsperserver'] ?: '0');

	// For more details look at freeradius_sqlconf_resync()

	// Dis-/Enable SQL in "instatiate" section in freeradius_settings_resync() and radiusd.conf SQL SERVER 2

	if ($sqlconf['varsqlconf2includeenable'] == 'on') {

}

function freeradius_users_resync($via_rpc = false) {

	$conf = '';

	if (!empty($arrusers)) {

		foreach ($arrusers as $users) {

	}

}

function freeradius_authorizedmacs_resync($restart_svc = true, $via_rpc = false) {

	$conf = '';

	}

}

function freeradius_eapconf_resync($restart_svc = true) {

	$conf = '';

	// Disable weak EAP types like MD5, and GTC

	if ($eapconf['vareapconfdisableweakeaptypes'] == '') {

	// Variables: EAP-TLS

	$vareapconffragmentsize = ($eapconf['vareapconffragmentsize'] ?: '1024');

	$vareapconfincludelength = ($eapconf['vareapconfincludelength'] ?: 'yes');

	// Variables: Cache

	$vareapconfcacheenablecache = ($eapconf['vareapconfcacheenablecache'] ?: 'no');

	$vareapconfpeapdefaulteaptype = ($eapconf['vareapconfpeapdefaulteaptype'] ?: 'mschapv2');

	$vareapconfpeapcopyrequesttotunnel = ($eapconf['vareapconfpeapcopyrequesttotunnel'] ?: 'no');

	$vareapconfpeapusetunneledreply = ($eapconf['vareapconfpeapusetunneledreply'] ? 1 : 0);

	// This is for enable/disbable MS SoH in EAP-PEAP and the virtuial-server "soh-server"

	if ($eapconf['vareapconfpeapsohenable'] == 'Enable') {

		unlink_if_exists(FREERADIUS_SITESENABLED . "/soh");

	}

	// For pfSense cert manager

	$ca_cert = lookup_ca($eapconf["ssl_ca_cert"]);

	if ($ca_cert == false) {

		/* Generate CA with generic details */

		$ca = array();

		$ca['refid'] = uniqid();

		} else {

			$eapconf["ssl_ca_cert"] = $ca['refid'];

			$ca_cert = $ca;

			$a_ca[] = $ca;

			$cert = array();

			$cert['refid'] = uniqid();

			$cert['descr'] = "FreeRADIUS Server Certificate";

				file_notice("FreeRADIUS", gettext("Cannot create temporary FreeRADIUS certificate. Visit Services > FreeRADIUS > EAP tab and configure server certificates in the 'Certificates for TLS' section: " . openssl_error_string()));

				$cert_error = true;

			} else {

				$a_cert[] = $cert;

				$eapconf["ssl_server_cert"] = $cert['refid'];

			}

		}

				file_put_contents(FREERADIUS_CERTS . "/server_key.pem", base64_decode($svr_cert['prv']));

			}

			if (base64_decode($svr_cert['crt'])) {

					base64_decode($svr_cert['crt']) . "\n" .

					ca_chain($svr_cert));

			}

		$vareapconftlsminversion = '1.0';

	}

	$conf .= <<<EOD

### EAP

eap {

	file_put_contents($filename, $conf);

	chmod($filename, 0640);

	freeradius_sync_on_changes();

	if ($restart_svc === true) {

		restart_service("radiusd");

// Gets started from freeradiuseapconf.xml

function freeradius_get_ca_crl() {

	$crl_arr = array();

	$crl_arr[] = array('refid' => 'none', 'descr' => 'none');

	}

	return $crl_arr;

}

function freeradius_sqlconf_resync() {

	$conf = '';

	// Variables: SQL DATABASE 1

	$varsqlconfdatabase = ($sqlconf['varsqlconfdatabase'] ?: 'mysql');

	\$INCLUDE \${modconfdir}/sql/counter/\${dialect}/\${.:instance}.conf

}

EOD;

	$filename = FREERADIUS_MODSENABLED . '/sqlcounter';

function freeradius_serverdefault_resync() {

	$conf = '';

	// failover/loadbalancing mode

	$varmodulesldap2failover = ($arrmodulesldap['varmodulesldap2failover'] ?: 'redundant');

		@unlink_if_exists(FREERADIUS_MODSENABLED . '/ldap');

	}

	// authorize section DATABASE 2

	if (($sqlconf['varsqlconf2includeenable'] == 'on') && ($sqlconf['varsqlconf2enableauthorize'] == 'Enable')) {

		$varsqlconfpostauthtypereject = '# sql';

	}

	// If unchecked we need the normal EAP section.

	if (!$varsettings['varsettingsenablemacauth']) {

		} // endforeach

	} // endif empty

	$conf .= <<<EOD

authorize {

/* Uses XMLRPC to synchronize the changes to a remote node */

function freeradius_sync_on_changes() {

	// if checkbox is NOT checked do nothing

	switch ($synconchanges) {

		case "manual":

				log_error("[FreeRADIUS]: XMLRPC sync is enabled but there are no hosts configured as replication targets.");

				return;

			}

			break;

		case "auto":

			} else {

				log_error("[FreeRADIUS]: XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets.");

				return;

			}

			break;

		default:

/* Do the actual XMLRPC sync */

function freeradius_do_xmlrpc_sync($sync_to_ip, $username, $password, $varsyncport, $varsyncprotocol, $varsynctimeout) {

	/* Detect boot process, do nothing during boot. */

	if (platform_booting()) {

		return;

	$syncsections = array('freeradius', 'freeradiusauthorizedmacs', 'freeradiusclients', 'freeradiusinterfaces',

	'freeradiussettings', 'freeradiuseapconf', 'freeradiussqlconf', 'freeradiusmodulesldap');

	foreach ($syncsections as $section) {

		}

	}

		$msg = new XML_RPC_Message($method, $params);

		$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);

		$cli->setCredentials($username, $password);

			$cli->setDebug(1);

		}

		/* Send our XMLRPC message and timeout after defined sync timeout value */

}

function freeradius_modulescounter_resync() {

	$conf = '';

	$conf .= <<<EOD

}

function freeradius_modulesmschap_resync() {

	$conf = '';

	$conf .= <<<EOD

}

function freeradius_modulesrealm_resync() {

	$conf = '';

	$conf .= <<<EOD

}

function freeradius_modulesldap_resync($restart_svc = true) {

	$raddb = FREERADIUS_RADDB;

	$conf = '';

	// Enable and Disable LDAP for "authorize" and "authenticate" will be done in freeradius_serverdefault_resync()

	// redundatnt-load-balancing will there be done, too

	}

	// Miscellaneous Configuration + MS Active Directory Compatibility ldap1

	if ($arrmodulesldap['varmodulesldapmsadcompatibilityenable'] == 'Disable') {

		$varmodulesldapmsadcompatibility = '### MS Active Directory Compatibility is disabled ###';

	} else {

	}

	// Miscellaneous Configuration + MS Active Directory Compatibility ldap2

	if ($arrmodulesldap['varmodulesldap2msadcompatibilityenable'] == 'Disable') {

		$varmodulesldap2msadcompatibility = '### MS Active Directory Compatibility is disabled ###';

	} else {

}

function freeradius_plainmacauth_resync() {

	// Variables: If not using 802.1x, mac address must be known

	// defining variables with filename path

	$filemodulesfiles = FREERADIUS_MODSENABLED . '/files';

}

function freeradius_modulesfiles_resync() {

	$conf = '';

	$conf .= <<<EOD

}

function freeradius_motp_resync() {

	$conf = '';

	$varsettingsmotptimespan = ($varsettings['varsettingsmotptimespan'] ?: '2');

	$varsettingsmotptimespanbeforeafter = $varsettingsmotptimespan + $varsettingsmotptimespan;

}

function freeradius_modulesmotp_resync() {

	$conf = '';

	// put the constant to a variable

}

function freeradius_modulesgoogleauth_resync() {

	$conf = '';

	// put the constant to a variable

}

function freeradius_modulesdatacounter_resync() {

	$conf = '';

	// put the constant to a variable

}

function freeradius_datacounter_auth_resync() {

	$conf = '';

	$conf .= <<<EOD

USERNAME=`echo -n "\\$1" | sed 's/[^0-9a-zA-Z._:-]/X/g' `

TIMERANGE=`echo -n "\\$2" | sed 's/[^a-z]//g' `

### This is to make sure there is a used-octets file after the cronjob resetted the counter

if [ -e "/var/log/radacct/datacounter/\$TIMERANGE/max-octets-\$USERNAME" ] && [ ! -e "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME" ]; then

	echo 0 > "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME"

}

function freeradius_datacounter_acct_resync() {

	$conf = '';

	$conf .= <<<EOD

}

function freeradius_dictionary_resync() {

	$conf = '';

	$conf .= <<<EOD

/* Users input validation */

function freeradius_validate_users($post, &$input_errors) {

	// Username

	if (($post['varusersmotpenable'] == 'on') && !preg_match('/^[a-zA-Z0-9_.-]*$/', $post['varusersusername'])) {

		$input_errors[] = "The 'Username' field may only contain a-z, A-Z, 0-9, underscore, period and hyphen (regex /^[a-zA-Z0-9_.-]*$/).";

/* MACs input validation */

function freeradius_validate_macs($post, &$input_errors) {

	// MAC Address

	if (!empty($post['varmacsaddress'])) {

		if (!preg_match('/^[0-9A-F]{2}(?:[-:][0-9A-F]{2}){5}$/i', $post['varmacsaddress'])) {

/* NAS/Clients input validation */

function freeradius_validate_clients($post, &$input_errors) {

	// Client IP Address

	if ($post['varclientip'] != '*') {

		if (preg_match('/^(.+)\/(\d+)$/',$post['varclientip'], $matches)) {

/* Interfaces input validation */

function freeradius_validate_interfaces($post, &$input_errors) {

	// Interface IP Address

	if (empty($post['varinterfaceip'])) {

		$input_errors[] = "The 'Interface IP Address' field must not be empty.";

/* General Settings input validation */

function freeradius_validate_settings($post, &$input_errors) {

	// Maximum Requests Tracked

	if ($post['varsettingsmaxrequests'] != '' && !is_numericint($post['varsettingsmaxrequests'])) {

		$input_errors[] = "The 'Maximum Requests Tracked' field must contain an integer value.";

/* EAP settings input validation */

function freeradius_validate_eap($post, &$input_errors) {

	// Disable Weak EAP Types sanity check

	if ($post['vareapconfdisableweakeaptypes'] == 'on') {

		if (in_array($post['vareapconfdefaulteaptype'], array('md5', 'gtc'))) {

/* SQL settings input validation */

function freeradius_validate_sql($post, &$input_errors) {

	// SQL Server Address

	if ($post['varsqlconfincludeenable'] == 'on') {

		if (empty($post['varsqlconfserver'])) {

}

/* LDAP settings input validation */

function freeradius_validate_ldap($post, &$input_errors) {

	// LDAP Server Address

	if ($post['varmodulesldapenableauthorize'] == 'on') {

		if (empty($post['varmodulesldapserver'])) {

}

function freeradius_plugin_certificates($pluginparams) {

	$result = array();

	init_config_arr(array('installedpackages', 'freeradiuseapconf', 'config'));

	if (($pluginparams['type'] == 'certificates') && !empty($eapconf)) {

		if (($pluginparams['event'] == 'used_ca') && !empty($eapconf['ssl_ca_cert'])) {