rezometz/re2o
8
0
Fork 0
mirror of https://gitlab2.federez.net/re2o/re2o synced 2024-12-03 18:12:24 +00:00
Code Issues Releases Wiki Activity

Make use of attributes in auth.py

Browse source
This commit is contained in:
Hugo Levy-Falk 2019-09-09 17:59:43 +02:00 committed by chirac
parent ff058e0cca
commit 0b00b42365
2 changed files with 63 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
freeradius_utils/auth.py
View file

@ -225,7 +225,7 @@ def post_auth(data):
# La ligne suivante fonctionne pour cisco, HP et Juniper # La ligne suivante fonctionne pour cisco, HP et Juniper
port = port.split(".")[0].split('/')[-1][-2:] port = port.split(".")[0].split('/')[-1][-2:]
out = decide_vlan_switch(nas_machine, nas_type, port, mac) out = decide_vlan_switch(nas_machine, nas_type, port, mac)
sw_name, room, reason, vlan_id, decision = out sw_name, room, reason, vlan_id, decision, attributes = out
if decision: if decision:
log_message = '(fil) %s -> %s [%s%s]' % ( log_message = '(fil) %s -> %s [%s%s]' % (
@ -243,7 +243,7 @@ def post_auth(data):
("Tunnel-Type", "VLAN"), ("Tunnel-Type", "VLAN"),
("Tunnel-Medium-Type", "IEEE-802"), ("Tunnel-Medium-Type", "IEEE-802"),
("Tunnel-Private-Group-Id", '%d' % int(vlan_id)), ("Tunnel-Private-Group-Id", '%d' % int(vlan_id)),
), ) + attributes,
() ()
) )
else: else:
@ -254,7 +254,11 @@ def post_auth(data):
) )
logger.info(log_message) logger.info(log_message)
return radiusd.RLM_MODULE_REJECT return (
radiusd.RLM_MODULE_REJECT,
attributes,
()
)
else: else:
return radiusd.RLM_MODULE_OK return radiusd.RLM_MODULE_OK
@ -363,12 +367,20 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
- raison de la décision (str) - raison de la décision (str)
- vlan_id (int) - vlan_id (int)
- decision (bool) - decision (bool)
- Attributs supplémentaires (attribut:str, operateur:str, valeur:str)
""" """
# Get port from switch and port number # Get port from switch and port number
extra_log = "" extra_log = ""
# Si le NAS est inconnu, on place sur le vlan defaut # Si le NAS est inconnu, on place sur le vlan defaut
if not nas_machine: if not nas_machine:
return ('?', u'Chambre inconnue', u'Nas inconnu', RadiusOption.get_cached_value('vlan_decision_ok').vlan_id, True) return (
'?',
u'Chambre inconnue',
u'Nas inconnu',
RadiusOption.get_cached_value('vlan_decision_ok').vlan_id,
True,
RadiusOption.get_attributes('ok_attributes')
)
sw_name = str(getattr(nas_machine, 'short_name', str(nas_machine))) sw_name = str(getattr(nas_machine, 'short_name', str(nas_machine)))
@ -385,10 +397,11 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
if not port: if not port:
return ( return (
sw_name, sw_name,
"Chambre inconnue", "Port inconnu",
u'Port inconnu', u'Port inconnu',
getattr(RadiusOption.get_cached_value('unknown_port_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('unknown_port_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('unknown_port')!= RadiusOption.REJECT RadiusOption.get_cached_value('unknown_port')!= RadiusOption.REJECT,
RadiusOption.get_attributes('unknown_port_attributes')
) )
# On récupère le profil du port # On récupère le profil du port
@ -399,12 +412,14 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
if port_profile.vlan_untagged: if port_profile.vlan_untagged:
DECISION_VLAN = int(port_profile.vlan_untagged.vlan_id) DECISION_VLAN = int(port_profile.vlan_untagged.vlan_id)
extra_log = u"Force sur vlan " + str(DECISION_VLAN) extra_log = u"Force sur vlan " + str(DECISION_VLAN)
attributes = ()
else: else:
DECISION_VLAN = RadiusOption.get_cached_value('vlan_decision_ok').vlan_id DECISION_VLAN = RadiusOption.get_cached_value('vlan_decision_ok').vlan_id
attributes = RadiusOption.get_attributes('ok_attributes')
# Si le port est désactivé, on rejette la connexion # Si le port est désactivé, on rejette la connexion
if not port.state: if not port.state:
return (sw_name, port.room, u'Port desactive', None, False) return (sw_name, port.room, u'Port desactive', None, False, ())
# Si radius est désactivé, on laisse passer # Si radius est désactivé, on laisse passer
if port_profile.radius_type == 'NO': if port_profile.radius_type == 'NO':
@ -412,7 +427,9 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
"", "",
u"Pas d'authentification sur ce port" + extra_log, u"Pas d'authentification sur ce port" + extra_log,
DECISION_VLAN, DECISION_VLAN,
True) True,
attributes
)
# Si le 802.1X est activé sur ce port, cela veut dire que la personne a # Si le 802.1X est activé sur ce port, cela veut dire que la personne a
# été accept précédemment # été accept précédemment
@ -424,7 +441,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u'Acceptation authentification 802.1X', u'Acceptation authentification 802.1X',
DECISION_VLAN, DECISION_VLAN,
True True,
attributes
) )
# Sinon, cela veut dire qu'on fait de l'auth radius par mac # Sinon, cela veut dire qu'on fait de l'auth radius par mac
@ -441,7 +459,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
"Inconnue", "Inconnue",
u'Chambre inconnue', u'Chambre inconnue',
getattr(RadiusOption.get_cached_value('unknown_room_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('unknown_room_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('unknown_room')!= RadiusOption.REJECT RadiusOption.get_cached_value('unknown_room')!= RadiusOption.REJECT,
RadiusOption.get_attributes('unknown_room_attributes'),
) )
room_user = User.objects.filter( room_user = User.objects.filter(
@ -451,18 +470,20 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
return ( return (
sw_name, sw_name,
room, room,
u'Chambre non cotisante -> Web redirect', u'Chambre non cotisante',
None, getattr(RadiusOption.get_cached_value('non_member_vlan'), 'vlan_id', None),
False RadiusOption.get_cached_value('non_member')!= RadiusOption.REJECT,
RadiusOption.get_attributes('non_member_attributes'),
) )
for user in room_user: for user in room_user:
if user.is_ban() or user.state != User.STATE_ACTIVE: if user.is_ban() or user.state != User.STATE_ACTIVE:
return ( return (
sw_name, sw_name,
room, room,
u'Utilisateur banni ou desactive -> Web redirect', u'Utilisateur banni ou desactive',
None, getattr(RadiusOption.get_cached_value('banned_vlan'), 'vlan_id', None),
False RadiusOption.get_cached_value('banned')!= RadiusOption.REJECT,
RadiusOption.get_attributes('banned_attributes'),
) )
elif not (user.is_connected() or user.is_whitelisted()): elif not (user.is_connected() or user.is_whitelisted()):
return ( return (
@ -470,7 +491,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u'Utilisateur non cotisant', u'Utilisateur non cotisant',
getattr(RadiusOption.get_cached_value('non_member_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('non_member_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('non_member')!= RadiusOption.REJECT RadiusOption.get_cached_value('non_member')!= RadiusOption.REJECT,
RadiusOption.get_attributes('non_member_attributes'),
) )
# else: user OK, on passe à la verif MAC # else: user OK, on passe à la verif MAC
@ -491,9 +513,10 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
return ( return (
sw_name, sw_name,
room, room,
u'Machine Inconnue -> Web redirect', u'Machine Inconnue',
None, getattr(RadiusOption.get_cached_value('unknown_machine_vlan'), 'vlan_id', None),
False RadiusOption.get_cached_value('unknown_machine')!= RadiusOption.REJECT,
RadiusOption.get_attributes('unknown_machine_attributes'),
) )
# Sinon on bascule sur la politique définie dans les options # Sinon on bascule sur la politique définie dans les options
# radius. # radius.
@ -503,7 +526,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
"", "",
u'Machine inconnue', u'Machine inconnue',
getattr(RadiusOption.get_cached_value('unknown_machine_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('unknown_machine_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('unknown_machine')!= RadiusOption.REJECT RadiusOption.get_cached_value('unknown_machine')!= RadiusOption.REJECT,
RadiusOption.get_attributes('unknown_machine_attributes'),
) )
# L'interface a été trouvée, on vérifie qu'elle est active, # L'interface a été trouvée, on vérifie qu'elle est active,
@ -518,7 +542,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u'Adherent banni', u'Adherent banni',
getattr(RadiusOption.get_cached_value('banned_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('banned_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('banned')!= RadiusOption.REJECT RadiusOption.get_cached_value('banned')!= RadiusOption.REJECT,
RadiusOption.get_attributes('banned_attributes'),
) )
if not interface.is_active: if not interface.is_active:
return ( return (
@ -526,7 +551,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u'Machine non active / adherent non cotisant', u'Machine non active / adherent non cotisant',
getattr(RadiusOption.get_cached_value('non_member_vlan'), 'vlan_id', None), getattr(RadiusOption.get_cached_value('non_member_vlan'), 'vlan_id', None),
RadiusOption.get_cached_value('non_member')!= RadiusOption.REJECT RadiusOption.get_cached_value('non_member')!= RadiusOption.REJECT,
RadiusOption.get_attributes('non_member_attributes'),
) )
# Si on choisi de placer les machines sur le vlan # Si on choisi de placer les machines sur le vlan
# correspondant à leur type : # correspondant à leur type :
@ -539,7 +565,8 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u"Ok, Reassignation de l'ipv4" + extra_log, u"Ok, Reassignation de l'ipv4" + extra_log,
DECISION_VLAN, DECISION_VLAN,
True True,
attributes
) )
else: else:
return ( return (
@ -547,5 +574,6 @@ def decide_vlan_switch(nas_machine, nas_type, port_number,
room, room,
u'Machine OK' + extra_log, u'Machine OK' + extra_log,
DECISION_VLAN, DECISION_VLAN,
True True,
attributes
) )

10
preferences/models.py
View file

@ -637,6 +637,9 @@ class RadiusAttribute(RevMixin, AclMixin, models.Model):
def __str__(self): def __str__(self):
return ' '.join([self.attribute, self.operator, self.value]) return ' '.join([self.attribute, self.operator, self.value])
def as_tuple(self):
return (self.attribute, self.operator, self.value)
class RadiusOption(AclMixin, PreferencesModel): class RadiusOption(AclMixin, PreferencesModel):
class Meta: class Meta:
@ -786,6 +789,13 @@ class RadiusOption(AclMixin, PreferencesModel):
help_text=_("Answer attributes for accepted users."), help_text=_("Answer attributes for accepted users."),
) )
@classmethod
def get_attributes(cls, name):
return (
attribute.as_tuple()
for attribute in cls.get_cached_value(name).all()
)
def default_invoice(): def default_invoice():
tpl, _ = DocumentTemplate.objects.get_or_create( tpl, _ = DocumentTemplate.objects.get_or_create(