crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[radius/wifi] bl isolement + no tagging => reject

Browse source
This commit is contained in:
Daniel STAN 2015-02-18 16:15:16 +01:00
parent 09a9e291c0
commit 41e97d7cf5
1 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
freeradius/auth.py
View file

@ -20,6 +20,7 @@ from gestion.gen_confs.trigger import trigger_generate_cochon as trigger_generat
import annuaires_pg
TEST_SERVER = bool(os.getenv('DBG_FREERADIUS', False))
WIFI_DYN_VLAN = TEST_SERVER
USERNAME_SUFFIX_WIFI = '.wifi.crans.org'
USERNAME_SUFFIX_FIL = '.crans.org'
@ -39,19 +40,19 @@ logger.addHandler(handler)
## -*- Types de blacklists -*-
#: reject tout de suite
bl_reject = [u'bloq']
BL_REJECT = [u'bloq']
#: place sur le vlan isolement
bl_isolement = [u'virus', u'autodisc_virus', u'autodisc_p2p', u'ipv6_ra']
BL_ISOLEMENT = [u'virus', u'autodisc_virus', u'autodisc_p2p', u'ipv6_ra']
# TODO carte_etudiant: dépend si sursis ou non (regarder lc_ldap)
# TODO LOGSSSSS
#: place sur accueil
bl_accueil = []
BL_ACCUEIL = []
# Ces blacklists ont des effets soft (portail captif port 80)
#bl_accueil = [u'carte_etudiant', u'chambre_invalide', u'paiement']
#BL_ACCUEIL = [u'carte_etudiant', u'chambre_invalide', u'paiement']
## -*- Decorateurs -*-
# À appliquer sur les fonctions qui ont besoin d'une conn ldap
@ -265,8 +266,12 @@ def authorize_wifi(data):
return radiusd.RLM_MODULE_INVALID
for bl in machine.blacklist_actif():
if bl.value['type'] in bl_reject:
if bl.value['type'] in BL_REJECT:
return radiusd.RLM_MODULE_REJECT
# Kludge : vlan isolement pas possible, donc reject quand-même
if not WIFI_DYN_VLAN and bl.value['type'] in BL_ISOLEMENT:
return radiusd.RLM_MODULE_REJECT
if not machine.get('ipsec', False):
radiusd.radlog(radiusd.L_ERR, 'WiFi authentication but machine has no' +
@ -286,7 +291,7 @@ def authorize_wifi(data):
@radius_event
def authorize_fil(data):
"""For now, do nothing.
TODO: check bl_reject.
TODO: check BL_REJECT.
TODO: check chap auth
"""
return (radiusd.RLM_MODULE_UPDATED,
@ -315,7 +320,7 @@ def post_auth_wifi(data):
# WiFi : Pour l'instant, on ne met pas d'infos de vlans dans la réponse
# les bornes wifi ont du mal avec cela
if TEST_SERVER:
if WIFI_DYN_VLAN:
return (radiusd.RLM_MODULE_UPDATED,
(
("Tunnel-Type", "VLAN"),
@ -403,9 +408,9 @@ def decide_vlan(data, is_wifi, conn):
# Application des blacklists
for bl in machine.blacklist_actif():
if bl.value['type'] in bl_isolement:
if bl.value['type'] in BL_ISOLEMENT:
decision = 'isolement', unicode(bl)
if bl.value['type'] in bl_accueil:
if bl.value['type'] in BL_ACCUEIL:
decision = 'accueil', unicode(bl)
# Filaire : protection anti-"squattage"