Commit 9693ff67 authored by Jonathan's avatar Jonathan
Browse files

Merge pull request #31 from djjudas21/drop_support_for_fr2 

Drop support for FR2
parents 3fccbcc3 fe171478

README.md

+20 −35
Original line number Diff line number Diff line
@@ -34,9 +34,15 @@ 
## Overview



This module installs and configures [FreeRADIUS](http://freeradius.org/) server

on Linux. It supports FreeRADIUS 2.x and 3.x. It was designed with CentOS in mind

on Linux. It supports FreeRADIUS 3.x only. It was designed with CentOS in mind

but should work on other distributions.



| `jgazeley/freeradius` | FreeRADIUS  |

| --------------------- | ----------- |

| 2.x                   | 3.x         |

| 1.x                   | 2.x and 3.x |

| 0.x                   | 2.x         |



## Module Description



This module installs FreeRADIUS from a distro-provided package and installs a
@@ -224,20 +230,7 @@ freeradius::client { "wlan-controller01": 
```



```puppet

# Range example on FreeRADIUS 2

freeradius::client { "wlan-controllers":

  ip        => '192.168.0.0',

  netmask   => '24',

  secret    => 'testing123',

  shortname => 'wlc01',

  nastype   => 'other',

  port      => '1645-1646',

  firewall  => true,

}

```



```puppet

# Range example in FreeRADIUS 3

# Range example

freeradius::client { "wlan-controllers":

  ip        => '192.168.0.0/24',

  secret    => 'testing123',
@@ -249,14 +242,11 @@ freeradius::client { "wlan-controllers": 
```



##### `ip`

The IP address of the client or range. For IPv6, use `ipv6addr`. `ip` and `ip6` are mutually exclusive but one must be supplied.

On FreeRADIUS 2, specify the netmask separately. On FreeRADIUS 3, set `ip` in CIDR format. Default: `undef`.

The IP address of the client or range in CIDR format. For IPv6, use `ipv6addr`. `ip` and `ip6` are mutually exclusive but one must be supplied.

Default: `undef`.



##### `ip6`

The IPv6 address of the client or range in CIDR notation. `ip` and `ip6` are mutually exclusive but one must be supplied. Default: `undef`.



##### `netmask`

The netmask of the client, specified as an integer, e.g. `24`. Only to be set on FreeRADIUS 2. Default: `undef`.

The IPv6 address of the client or range in CIDR format. `ip` and `ip6` are mutually exclusive but one must be supplied. Default: `undef`.



##### `shortname`

A short alias that is used in place of the IP address or fully qualified hostname provided in the first line of the section. Required.
@@ -436,19 +426,16 @@ Number of seconds to wait for LDAP query to finish. Default: `10` 
##### `start`

Connections to create during module instantiation. If the server cannot create specified number of

connections during instantiation it will exit. Set to 0 to allow the server to start without the

directory being available. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].start_servers}`

directory being available. Default: `${thread[pool].start_servers}`



##### `min`

Minimum number of connections to keep open. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].min_spare_servers}`

Minimum number of connections to keep open. Default: `${thread[pool].min_spare_servers}`



##### `max`

Maximum number of connections. Default: `${thread[pool].max_servers}`



##### `spare`

Spare connections to be left idle. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].max_spare_servers}`

Spare connections to be left idle. Default: `${thread[pool].max_spare_servers}`



##### `starttls`

Set this to 'yes' to use TLS encrypted connections to the LDAP database by using the StartTLS extended operation.
@@ -704,10 +691,10 @@ Define RADIUS clients, specifically to connect to the status server for monitori 
Very similar usage to `freeradius::client` but with fewer options.



##### `ip`

Default: `undef`. The IP address of the client.  For IPv6, use `ipv6addr`. `ip` and `ip6` are mutually exclusive but one must be supplied.

Default: `undef`. The IP address of the client in CIDR format.  For IPv6, use `ipv6addr`. `ip` and `ip6` are mutually exclusive but one must be supplied.



##### `ip6`

Default: `undef`. The IPv6 address of the client. `ip` and `ip6` are mutually exclusive but one must be supplied.

Default: `undef`. The IPv6 address of the client in CIDR format. `ip` and `ip6` are mutually exclusive but one must be supplied.



##### `secret`

required. The RADIUS shared secret used for communication between the client/NAS and the RADIUS server.
@@ -732,9 +719,10 @@ Provide content of template item. Specify only one of `source` or `content`. 


## Limitations



This module is targeted at FreeRADIUS 2.x running on CentOS 6 and FreeRADIUS 3.x running

on CentOS 7. It has not been thoroughly tested on other distributions, but might work.

Likely sticking points with other distros are the names of packages, services and file paths.

This module is targeted at FreeRADIUS 3.x running on CentOS 7. It will not work on

FreeRADIUS 2.x. It has not been thoroughly tested on other distributions, but

might work. Likely sticking points with other distros are the names of packages,

services and file paths.



This module was written for use with Puppet 3.6 and 3.7, but should be quite agnostic

to new versions of Puppet.
@@ -746,9 +734,6 @@ use probably haven't been written. Please send pull requests with new features a 
bug fixes. You are also welcome to file issues but I make no guarantees of

development effort if the features aren't useful to my employer.



When contributing code, please ensure your change works on FreeRADIUS 2.x and 3.x - at

least until this module drops support for 2.x.



## Release Notes



### 1.3.0

manifests/attr.pp

+2 −10
Original line number Diff line number Diff line
@@ -11,17 +11,9 @@ define freeradius::attr ( 
  $fr_group            = $::freeradius::params::fr_group

  $fr_moduleconfigpath = $::freeradius::params::fr_moduleconfigpath

  $fr_modulepath       = $::freeradius::params::fr_modulepath

  $fr_version          = $::freeradius::params::fr_version



  # Decide on location for attribute filters

  $location = $fr_version ? {

    2       => $fr_basepath,

    3       => "${fr_moduleconfigpath}/attr_filter",

    default => $fr_moduleconfigpath,

  }



  # Install the attribute filter snippet

  file { "${location}/${name}":

  file { "${fr_moduleconfigpath}/attr_filter/${name}":

    ensure  => $ensure,

    mode    => '0640',

    owner   => 'root',
@@ -34,7 +26,7 @@ define freeradius::attr ( 
  # Reference all attribute snippets in one file

  concat::fragment { "attr-${name}":

    target  => "${fr_modulepath}/attr_filter",

    content => template("freeradius/attr.fr${fr_version}.erb"),

    content => template('freeradius/attr.erb'),

    order   => 20,

  }

}

manifests/client.pp

+3 −20
Original line number Diff line number Diff line
@@ -6,7 +6,6 @@ define freeradius::client ( 
  $ip6            = undef,

  $virtual_server = undef,

  $nastype        = undef,

  $netmask        = undef,

  $redirect       = undef,

  $port           = undef,

  $srcip          = undef,
@@ -17,29 +16,13 @@ define freeradius::client ( 
  $fr_service  = $::freeradius::params::fr_service

  $fr_basepath = $::freeradius::params::fr_basepath

  $fr_group    = $::freeradius::params::fr_group

  $fr_version  = $::freeradius::params::fr_version



  # Calculate CIDR format IP now that FreeRADIUS has obsoleted use of separate netmask.

  # This workaround means no syntax change is necessary, although we print a warning.

  $cidr = $netmask ? {

    undef   => $ip,

    default => "${ip}/${netmask}",

  }

  $cidr6 = $netmask ? {

    undef   => $ip6,

    default => "${ip6}/${netmask}",

  }



  if ($netmask and $fr_version == 3) {

    warning("netmask field found in client ${shortname} is deprecated, use CIDR notation instead. Please fix your configuration.")

  }



  file { "${fr_basepath}/clients.d/${shortname}.conf":

    ensure  => $ensure,

    mode    => '0640',

    owner   => 'root',

    group   => $fr_group,

    content => template("freeradius/client.conf.fr${fr_version}.erb"),

    content => template('freeradius/client.conf.erb'),

    require => [File["${fr_basepath}/clients.d"], Group[$fr_group]],

    notify  => Service[$fr_service],

  }
@@ -51,7 +34,7 @@ define freeradius::client ( 
          proto  => 'udp',

          dport  => $port,

          action => 'accept',

          source => $cidr,

          source => $ip,

        }

      } elsif $ip6 {

        firewall { "100-${shortname}-${port}-v6":
@@ -59,7 +42,7 @@ define freeradius::client ( 
          dport    => $port,

          action   => 'accept',

          provider => 'ip6tables',

          source   => $cidr6,

          source   => $ip6,

        }

      }

    } else {

manifests/init.pp

+7 −3
Original line number Diff line number Diff line
@@ -12,6 +12,10 @@ class freeradius ( 
  $syslog          = false,

) inherits freeradius::params {



  if ($freeradius::fr_version != 3) {

    fail('This module is only compatible with FreeRADIUS 3')

  }



  if $control_socket == true {

    warning('Use of the control_socket parameter in the freeradius class is deprecated. Please use the freeradius::control_socket class instead.')

  }
@@ -21,7 +25,7 @@ class freeradius ( 
    mode    => '0640',

    owner   => 'root',

    group   => $freeradius::fr_group,

    content => template("freeradius/radiusd.conf.fr${freeradius::fr_version}.erb"),

    content => template('freeradius/radiusd.conf.erb'),

    require => [Package[$freeradius::fr_package], Group[$freeradius::fr_group]],

    notify  => Service[$freeradius::fr_service],

  }
@@ -134,9 +138,9 @@ class freeradius ( 
  }



  # Install default attribute filters

  concat::fragment { "attr-default":

  concat::fragment { 'attr-default':

    target  => "${freeradius::fr_modulepath}/attr_filter",

    content => template("freeradius/attr_default.fr${freeradius::fr_version}.erb"),

    content => template('freeradius/attr_default.erb'),

    order   => 10,

  }

manifests/ldap.pp

+1 −2
Original line number Diff line number Diff line
@@ -25,7 +25,6 @@ define freeradius::ldap ( 
  $fr_service          = $::freeradius::params::fr_service

  $fr_modulepath       = $::freeradius::params::fr_modulepath

  $fr_group            = $::freeradius::params::fr_group

  $fr_version          = $::freeradius::params::fr_version



  # Validate our inputs

  # Hostnames
@@ -70,7 +69,7 @@ define freeradius::ldap ( 
    mode    => '0640',

    owner   => 'root',

    group   => $fr_group,

    content => template("freeradius/ldap.fr${fr_version}.erb"),

    content => template('freeradius/ldap.erb'),

    require => [Package[$fr_package], Group[$fr_group]],

    notify  => Service[$fr_service],

  }