From dfa2f0e8ecd8a117bf47b64d7099d613f487d799 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 18 Nov 2019 21:07:07 +0100
Subject: wireless: T1627: change RADIUS CLI syntax

Adopt RADIUS configuration and harmonize it with the rest of VyOS. Move the
following configuration block:

  security {
      wpa {
          cipher CCMP
          mode wpa2
          radius-server 172.16.100.10 {
              port 1812
              secret secretkey
          }
          radius-server 172.16.100.11 {
              port 1812
              secret secretkey
          }
      }
  }

to the harmonized version of:

  security {
      wpa {
          cipher CCMP
          mode wpa2
          radius {
              server 172.16.100.10 {
                  port 1812
                  secret secretkey
              }
              server 172.16.100.11 {
                  port 1812
                  secret secretkey
              }
          }
      }
  }

And add the new "set interfaces wireless wlan0 security wpa radius
source-address" CLI command to specify the origin of any RADIUS query on
systems having multiple IP addresses.
---
 src/conf_mode/interfaces-wireless.py | 43 +++++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 15 deletions(-)

(limited to 'src/conf_mode')

diff --git a/src/conf_mode/interfaces-wireless.py b/src/conf_mode/interfaces-wireless.py
index b25205590..3b270a064 100755
--- a/src/conf_mode/interfaces-wireless.py
+++ b/src/conf_mode/interfaces-wireless.py
@@ -633,14 +633,24 @@ ieee8021x=1
 # WPA-EAP-SHA256 = WPA2-Enterprise using SHA256
 wpa_key_mgmt=WPA-EAP
 
+{% if sec_wpa_radius_source -%}
+# RADIUS client forced local IP address for the access point
+# Normally the local IP address is determined automatically based on configured
+# IP addresses, but this field can be used to force a specific address to be
+# used, e.g., when the device has multiple IP addresses.
+radius_client_addr={{ sec_wpa_radius_source }}
+{% endif %}
+
 {% for radius in sec_wpa_radius -%}
+# RADIUS authentication server
 auth_server_addr={{ radius.server }}
 auth_server_port={{ radius.port }}
-auth_server_shared_secret={{ radius.secret }}
-{% if radius.accounting -%}
+auth_server_shared_secret={{ radius.key }}
+{% if radius.acc_port -%}
+# RADIUS accounting server
 acct_server_addr={{ radius.server }}
 acct_server_port={{ radius.acc_port }}
-acct_server_shared_secret={{ radius.secret }}
+acct_server_shared_secret={{ radius.key }}
 {% endif %}
 {% endfor %}
 
@@ -1156,29 +1166,32 @@ def get_config():
     if conf.exists('security wpa passphrase'):
         wifi['sec_wpa_passphrase'] = conf.return_value('security wpa passphrase')
 
-    # WPA radius server goes here
-    for server in conf.list_nodes('security wpa radius-server'):
-        # set new configuration level
-        conf.set_level(cfg_base + ' security wpa radius-server ' + server)
+    # WPA RADIUS source address
+    if conf.exists('security wpa radius source-address'):
+        wifi['sec_wpa_radius_source'] = conf.return_value('security wpa radius source-address')
 
+    # WPA RADIUS server
+    for server in conf.list_nodes('security wpa radius server'):
+        # set new configuration level
+        conf.set_level(cfg_base + ' security wpa radius server ' + server)
         radius = {
             'server' : server,
             'acc_port' : '',
             'port' : 1812,
-            'secret' : ''
+            'key' : ''
         }
 
-        # receive RADIUS accounting info
-        if conf.exists('accounting'):
-            radius['acc_port'] = conf.return_value('accounting')
-
         # RADIUS server port
         if conf.exists('port'):
-            radius['port'] = conf.return_value('port')
+            radius['port'] = int(conf.return_value('port'))
+
+        # receive RADIUS accounting info
+        if conf.exists('accounting'):
+            radius['acc_port'] = radius['port'] + 1
 
         # RADIUS server shared-secret
-        if conf.exists('secret'):
-            radius['secret'] = conf.return_value('secret')
+        if conf.exists('key'):
+            radius['key'] = conf.return_value('key')
 
         # append RADIUS server to list of servers
         wifi['sec_wpa_radius'].append(radius)
-- 
cgit v1.2.3