Merge pull request #160 from Nachtfalkeaw/master

freeradius2 updates

1 files changed, 180 insertions, 97 deletions

diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc
index 9409553b..c4edf183 100755
--- a/config/freeradius2/freeradius.inc
+++ b/config/freeradius2/freeradius.inc
@@ -49,20 +49,20 @@ function freeradius_settings_resync() {
 	$varsettings = $config['installedpackages']['freeradiussettings']['config'][0];
 	
 	// Variables: General configuration
-	$varsettingsmaxrequesttime = ($varsettings['varsettingsmaxrequesttime']?$varsettings['varsettingsmaxrequesttime']:'1024');
-	$varsettingscleanupdelay = ($varsettings['varsettingscleanupdelay']?$varsettings['varsettingscleanupdelay']:'30');
-	$varsettingsmaxrequests = ($varsettings['varsettingsmaxrequests']?$varsettings['varsettingsmaxrequests']:'5');
-	$varsettingslogdir = ($varsettings['varsettingslogdir']?$varsettings['varsettingslogdir']:'no');
-	$varsettingsstrippednames = ($varsettings['varsettingsstrippednames']?$varsettings['varsettingsstrippednames']:'no');
+	$varsettingsmaxrequests = ($varsettings['varsettingsmaxrequests']?$varsettings['varsettingsmaxrequests']:'1024');
+	$varsettingsmaxrequesttime = ($varsettings['varsettingsmaxrequesttime']?$varsettings['varsettingsmaxrequesttime']:'30');
+	$varsettingscleanupdelay = ($varsettings['varsettingscleanupdelay']?$varsettings['varsettingscleanupdelay']:'5');
+	$varsettingshostnamelookups = ($varsettings['varsettingshostnamelookups']?$varsettings['varsettingshostnamelookups']:'no');
+	$varsettingsallowcoredumps = ($varsettings['varsettingsallowcoredumps']?$varsettings['varsettingsallowcoredumps']:'no');
+	$varsettingsregularexpressions = ($varsettings['varsettingsregularexpressions']?$varsettings['varsettingsregularexpressions']:'yes');
+	$varsettingsextendedexpressions = ($varsettings['varsettingsextendedexpressions']?$varsettings['varsettingsextendedexpressions']:'yes');
 	
 	// Variables: Logging options
+	$varsettingslogdir = ($varsettings['varsettingslogdir']?$varsettings['varsettingslogdir']:'syslog');
 	$varsettingsauth = ($varsettings['varsettingsauth']?$varsettings['varsettingsauth']:'yes');
-	$varsettingsauthbadpass = ($varsettings['varsettingsauthbadpass']?$varsettings['varsettingsauthbadpass']:'yes');
-	$varsettingsauthgoodpass = ($varsettings['varsettingsauthgoodpass']?$varsettings['varsettingsauthgoodpass']:'files');
-	$varsettingshostnamelookups = ($varsettings['varsettingshostnamelookups']?$varsettings['varsettingshostnamelookups']:'no');
-	$varsettingsallowcoredumps = ($varsettings['varsettingsallowcoredumps']?$varsettings['varsettingsallowcoredumps']:'no');
-	$varsettingsregularexpressions = ($varsettings['varsettingsregularexpressions']?$varsettings['varsettingsregularexpressions']:'no');
-	$varsettingsextendedexpressions = ($varsettings['varsettingsextendedexpressions']?$varsettings['varsettingsextendedexpressions']:'no');
+	$varsettingsauthbadpass = ($varsettings['varsettingsauthbadpass']?$varsettings['varsettingsauthbadpass']:'no');
+	$varsettingsauthgoodpass = ($varsettings['varsettingsauthgoodpass']?$varsettings['varsettingsauthgoodpass']:'no');
+	$varsettingsstrippednames = ($varsettings['varsettingsstrippednames']?$varsettings['varsettingsstrippednames']:'no');
 	
 	// Variables: Security
 	$varsettingsmaxattributes = ($varsettings['varsettingsmaxattributes']?$varsettings['varsettingsmaxattributes']:'200');
@@ -76,12 +76,24 @@ function freeradius_settings_resync() {
 	$varsettingsmaxqueuesize = ($varsettings['varsettingsmaxqueuesize']?$varsettings['varsettingsmaxqueuesize']:'65536');
 	$varsettingsmaxrequestsperserver = ($varsettings['varsettingsmaxrequestsperserver']?$varsettings['varsettingsmaxrequestsperserver']:'0');
 	
-	// These lines are uncommented in fuction "freeradius_settings_resync" to INCLUDE / enable eap.conf
+	// For more details look at "freeradius_sqlconf_resync"
 	$sqlconf = $config['installedpackages']['freeradiussqlconf']['config'][0];
-	$varsqlconfenable = ($sqlconf['varsqlconfenable']?$sqlconf['varsqlconfenable']:'#\$INCLUDE sql.conf');
-	$varsqlconfenablecounter = ($sqlconf['varsqlconfenablecounter']?$sqlconf['varsqlconfenablecounter']:'#\$INCLUDE sql/mysql/counter.conf');
-	
+	$varsqlconfincludeenable = ($sqlconf['varsqlconfincludeenable']?$sqlconf['varsqlconfincludeenable']:'Disable');
+		
 	
+	// Dis-/Enable SQL in "instatiate" section in "freeradius_settings_resync" and radiusd.conf
+	if ($sqlconf['varsqlconfincludeenable'] == 'Enable') {
+		$varsqlconfinclude = '\$INCLUDE sql.conf';
+		$varsqlconfincludecounter = '\$INCLUDE sql/mysql/counter.conf';
+		$varsqlconfinstantiate = 'sql';
+	}
+
+	if ($sqlconf['varsqlconfincludeenable'] == 'Disable') {
+		$varsqlconfinclude = '#\$INCLUDE sql.conf';
+		$varsqlconfincludecounter = '#\$INCLUDE sql/mysql/counter.conf';
+		$varsqlconfinstantiate = '#sql';
+	}
+
 
 	$conf = <<<EOD
 prefix = /usr/local
@@ -214,19 +226,12 @@ thread pool {
 modules {
 	\$INCLUDE \${confdir}/modules/
 	\$INCLUDE eap.conf
+	### Dis-/Enable sql.conf INCLUDE
+	$varsqlconfinclude
 	
-	### Original line
-	### Enable sql.conf INCLUDE
-	###\$INCLUDE sql.conf
-	$varsqlconfenable
-	
-	
-	### Original line
-	### Enable sql/mysql/counter.conf INCLUDE
-	#\$INCLUDE sql/mysql/counter.conf
-	$varsqlconfenablecounter
-	
-	
+	### Dis-/Enable sql/mysql/counter.conf INCLUDE
+	$varsqlconfincludecounter
+		
 	#\$INCLUDE sqlippool.conf
 }
 
@@ -237,10 +242,8 @@ instantiate {
 	#daily
 	expiration
 	logintime
-	#redundant redundant_sql {
-	#	sql1
-	#	sql2
-	#}
+	### Dis-/Enable sql instatiate
+	$varsqlconfinstantiate
 }
 \$INCLUDE policy.conf
 \$INCLUDE sites-enabled/
@@ -258,61 +261,96 @@ function freeradius_users_resync() {
 global $config;
 
 $conf = '';
-$users = $config['installedpackages']['freeradius']['config'];
-if (is_array($users) && !empty($users)) {
-foreach ($users as $user) {
-$username = $user['username'];
-$password = $user['password'];
-$multiconnect = $user['multiconnect'];
-$ip = $user['ip'];
-$subnetmask = $user['subnetmask'];
-$gateway = $user['gateway'];
-$userexpiration=$user['expiration'];
-$sessiontime=$user['sessiontime'];
-$onlinetime=$user['onlinetime'];
-$vlanid=$user['vlanid'];
-$additionaloptions=$user['additionaloptions'];
-$atrib='';
-$head="$username Cleartext-Password := ".'"'.$password.'"';
-      if ($multiconnect <> '') {
-        $head .=", Simultaneous-Use := $multiconnect";
-       }
-      if ($userexpiration <> '') {
-        $head .=", Expiration := ".'"'.$userexpiration.'"';
-       }
-      if ($subnetmask<> '') {
-        $head .=", Framed-IP-Netmask = $subnetmask";
-       }
-      if ($gateway<> '') {
-        $head .=", Framed-Route = $gateway";
-       }
-      if ($onlinetime <> '') {
-        $head .=", Login-Time := ". '"' . $onlinetime .'"';
-       }
-      if ($ip <> '') {
-        if ($atrib <> '') { $atrib .=","; }
-        $atrib .="\r\n\tFramed-IP-Address = $ip";
-       }
-      if ($sessiontime <> '') {
-        if ($atrib <> '') { $atrib .=","; }
-        $atrib .="\r\n\tSession-Timeout := $sessiontime";
-       }
-      if ($vlanid <> '') {
-        if ($atrib <> '') { $atrib .=","; }
-        $atrib .="\r\n\tTunnel-Type = VLAN,\r\n\tTunnel-Medium-Type = IEEE-802,\r\n\tTunnel-Private-Group-ID = \"$vlanid\"";
-       }
-      if ($additionaloptions <> '') {
-        if ($atrib <> '') { $atrib .=","; }
-        $atrib .="\r\n\t$additionaloptions";
-       }
-       
-      $conf .= <<<EOD
-$head
-$atrib
 
+// Empty variables
+
+$arrusers = $config['installedpackages']['freeradius']['config'];
+
+if (is_array($arrusers) && !empty($arrusers)) {
+	foreach ($arrusers as $users) {
+	
+	// Variables for users file defined parameters
+	$varusersusername = $users['varusersusername'];
+	$varuserspassword = $users['varuserspassword'];
+	$varuserssimultaneousconnect = ($users['varuserssimultaneousconnect']?$users['varuserssimultaneousconnect']:'1');
+	$varusersframedipaddress = $users['varusersframedipaddress'];
+	$varusersframedipnetmask = $users['varusersframedipnetmask'];
+	$varusersframedroute = $users['varusersframedroute'];
+	$varusersexpiration=$users['varusersexpiration'];
+	$varuserssessiontimeout=$users['varuserssessiontimeout'];
+	$varuserslogintime=$users['varuserslogintime'];
+	$varusersvlanid=$users['varusersvlanid'];
+
+	// Clear variables for next user foreach additional options
+	$varuserstopadditionaloptions = '';
+	$varusersadditionaloptionstop = '';
+	
+	
+	if(!empty($users['varuserstopadditionaloptions'])) {
+		$varuserstopadditionaloptions = explode("|", ($users['varuserstopadditionaloptions']));
+		foreach ($varuserstopadditionaloptions as $toptmp) {
+			$varusersadditionaloptionstop .= $toptmp . "\n";
+		}
+	}
+	
+	// Clear variables for next user foreach additional options
+	$varusersbottomadditionaloptions = '';
+	$varusersadditionaloptionsbottom = '';
+	
+	if(!empty($users['varusersbottomadditionaloptions'])) {
+		$varusersbottomadditionaloptions = explode("|", ($users['varusersbottomadditionaloptions']));
+		$varusersadditionaloptionsbottom .= '';
+		foreach ($varusersbottomadditionaloptions as $bottomtmp) {
+			$varusersadditionaloptionsbottom .= $bottomtmp . "\n\t";
+		}
+	}
+	
+	
+
+	// Empty variable
+	$varusersmainoptions = '';
+	
+	// Add the user attributes to each user.
+	$varusersmainoptions = '"' . $varusersusername . '"' . " Cleartext-Password := " . '"' . $varuserspassword .'"';
+	
+	if ($varuserssimultaneousconnect != '') {
+	$varusersmainoptions .= "\n\tSimultaneous-Use := $varuserssimultaneousconnect";
+	}
+	if ($varusersexpiration != '') {
+	$varusersmainoptions .= ",\n\tExpiration := " . '"' . $varusersexpiration . '"';
+	}
+	if ($varuserslogintime != '') {
+	$varusersmainoptions .= ",\n\tLogin-Time := " . '"' . $varuserslogintime . '"';
+	}
+	if ($varuserssessiontimeout != '') {
+	$varusersmainoptions .= ",\n\tSession-Timeout := $varuserssessiontimeout";
+	}	
+	if ($varusersframedipaddress != '') {
+	$varusersmainoptions .= ",\n\tFramed-IP-Address = $varusersframedipaddress";
+	}
+	if ($varusersframedipnetmask != '') {
+	$varusersmainoptions .= ",\n\tFramed-IP-Netmask = $varusersframedipnetmask";
+	}
+	if ($varusersframedroute != '') {
+	$varusersmainoptions .= ",\n\tFramed-Route = " . '"' . $varusersframedroute . '"';
+	}
+	if ($varusersvlanid != '') {
+	$varusersmainoptions .= ",\n\tTunnel-Type = VLAN,\n\tTunnel-Medium-Type = IEEE-802,\n\tTunnel-Private-Group-ID = " . '"' . $varusersvlanid . '"';
+	}
+	if ($varusersadditionaloptionsbottom != '') {
+	$varusersmainoptions .= ",\n\t$varusersadditionaloptionsbottom";
+	}
+	// Cosmetic fix - This is just to make a blank new line after each user entry
+	$varusersmainoptions .= "\n\n";
+	
+	
+	$conf .= <<<EOD
+$varusersadditionaloptionstop
+$varusersmainoptions
 EOD;
-}
-}
+	} //end foreach
+} // end if
+
 	$filename = RADDB . '/users';
 	conf_mount_rw();
 	file_put_contents($filename, $conf);
@@ -463,6 +501,9 @@ if ($vareapconfchoosecertmanager == 'pfsensecertmgr') {
 	$vareapconfprivatekeyfile = 'server_key.pem';
 	$vareapconfcertificatefile = 'server_cert.pem';
 	$vareapconfcafile = 'ca_cert.pem';
+	// generate new DH and RANDOM file
+	exec("cd /usr/local/etc/raddb/certs && openssl dhparam -out dh 1024");
+	exec("cd /usr/local/etc/raddb/certs && dd if=/dev/urandom of=./random count=10");
 }
 
 // This is for freeradius cert manager
@@ -624,11 +665,7 @@ function freeradius_sqlconf_resync() {
 	$varsqlconfreadclients = ($sqlconf['varsqlconfreadclients']?$sqlconf['varsqlconfreadclients']:'yes');
 	$varsqlconfnastable = ($sqlconf['varsqlconfnastable']?$sqlconf['varsqlconfnastable']:'nas');
 	
-	// These lines are uncommented in fuction "freeradius_settings_resync" to INCLUDE / enable eap.conf
-	// $sqlconf = $config['installedpackages']['freeradiussqlconf']['config'][0];
-	// $varsqlconfenable = ($sqlconf['varsqlconfenable']?$sqlconf['varsqlconfenable']:'#\$INCLUDE sql.conf');
-	// $varsqlconfenablecounter = ($sqlconf['varsqlconfenablecounter']?$sqlconf['varsqlconfenablecounter']:'#\$INCLUDE sql/mysql/counter.conf');
-	
+	// For more information look at "freeradius_settings_resync"
 
 	$conf .= <<<EOD
 
@@ -676,6 +713,55 @@ function freeradius_serverdefault_resync() {
 	global $config;
 	$conf = '';
 	
+	// Get Variables from freeradiussqlconf.xml
+	$sqlconf = $config['installedpackages']['freeradiussqlconf']['config'][0];
+	$varsqlconfenableauthorize = ($sqlconf['varsqlconfenableauthorize']?$sqlconf['varsqlconfenableauthorize']:'Disable');
+	$varsqlconfenableaccounting = ($sqlconf['varsqlconfenableaccounting']?$sqlconf['varsqlconfenableaccounting']:'Disable');
+	$varsqlconfenablesession = ($sqlconf['varsqlconfenablesession']?$sqlconf['varsqlconfenablesession']:'Disable');
+	$varsqlconfenablepostauth = ($sqlconf['varsqlconfenablepostauth']?$sqlconf['varsqlconfenablepostauth']:'Disable');	
+	
+	
+	// Disable all sql sections if sql is global disabled
+	// if ($sqlconf['varsqlconfincludeenable'] == 'Disable') {
+	// $varsqlconfauthorize = '#sql';
+	// $varsqlconfaccounting = '#sql';
+	// $varsqlconfsession = 'radutmp';
+	// $varsqlconfpostauth = '#sql';
+	// }
+	
+	// authorize section
+	if (($sqlconf['varsqlconfincludeenable'] == 'Enable') && ($sqlconf['varsqlconfenableauthorize'] == 'Enable')) {
+	$varsqlconfauthorize = 'sql';
+	}
+	else {
+	$varsqlconfauthorize = '#sql';
+	}
+	
+	// accounting section
+	if (($sqlconf['varsqlconfincludeenable'] == 'Enable') && ($sqlconf['varsqlconfenableaccounting'] == 'Enable')) {
+	$varsqlconfaccounting = 'sql';
+	}
+	else {
+	$varsqlconfaccounting = '#sql';
+	}
+	
+	// session section
+	if (($sqlconf['varsqlconfincludeenable'] == 'Enable') && ($sqlconf['varsqlconfenablesession'] == 'Enable')) {
+	$varsqlconfsession = 'sql';
+	}
+	else {
+	$varsqlconfsession = 'radutmp';
+	}
+
+	// post-auth section
+	if (($sqlconf['varsqlconfincludeenable'] == 'Enable') && ($sqlconf['varsqlconfenablepostauth'] == 'Enable')) {
+	$varsqlconfpostauth = 'sql';
+	}
+	else {
+	$varsqlconfpostauth = '#sql';
+	}
+	
+	
 	$conf .= <<<EOD
 
 ######################################################################
@@ -854,7 +940,7 @@ authorize {
 	#  is meant to mirror the "users" file.
 	#
 	#  See "Authorization Queries" in sql.conf
-#	sql
+	$varsqlconfauthorize
 
 	#
 	#  If you are using /etc/smbpasswd, and are also doing
@@ -1083,7 +1169,7 @@ accounting {
 	#  Log traffic to an SQL database.
 	#
 	#  See "Accounting queries" in sql.conf
-#	sql
+	$varsqlconfaccounting
 
 	#
 	#  If you receive stop packets with zero session length,
@@ -1127,11 +1213,8 @@ accounting {
 #  or rlm_sql module can handle this.
 #  The rlm_sql module is *much* faster
 session {
-	radutmp
-
-	#
-	#  See "Simultaneous Use Checking Queries" in sql.conf
-#	sql
+	### choose radutmp or sql
+	$varsqlconfsession
 }
 
 
@@ -1152,7 +1235,7 @@ post-auth {
 	#  After authenticating the user, do another SQL query.
 	#
 	#  See "Authentication Logging Queries" in sql.conf
-#	sql
+	$varsqlconfpostauth
 
 	#
 	#  Instead of sending the query to the SQL server,