pyrad.curved – Twisted integration

Twisted integration code.

RADIUS servers built on Twisted: RADIUSAccess for authentication and RADIUSAccounting for accounting requests, to be passed to reactor.listenUDP. Twisted is not a dependency of pyrad and has to be installed to use this module.

class pyrad.curved.RADIUS(hosts=None, dict=None, enforce_ma=False, enable_pkt_verify=True)[source]

Base class of the Twisted RADIUS servers.

Receives and decodes packets, checks that they come from a known host, verifies them and passes them to processPacket(). Use RADIUSAccess or RADIUSAccounting and override processPacket().

Before processPacket() is called, pkt.secret is set to the secret of the host and pkt.source to its (host, port). The Message-Authenticator of an Access-Request has been verified (and with enforce_ma required), and with enable_pkt_verify the Request Authenticator of an Accounting-Request.

Parameters:

  • hosts (dict[str, pyrad.server.RemoteHost or bytes]) – hosts allowed to send packets, mapping their IP address to a pyrad.server.RemoteHost or to the secret. IPv4 clients of a socket bound to '::' are looked up by their IPv4 address. Unlike pyrad.server.Server, there is no '0.0.0.0' entry for all other hosts: packets from other hosts are dropped.

  • dict (pyrad.dictionary.Dictionary) – RADIUS dictionary used to decode the packets, by default an empty dictionary

  • enforce_ma (bool) – drop Access-Requests without a Message-Authenticator (an invalid Message-Authenticator is always dropped)

  • enable_pkt_verify (bool) – drop Accounting-Requests with an invalid Request Authenticator

createPacket(**kwargs)[source]

Create the packet object for a received datagram.

RADIUSAccess creates a pyrad.packet.AuthPacket and RADIUSAccounting a pyrad.packet.AcctPacket. The base method raises NotImplementedError; a class that doesn’t override it receives generic pyrad.packet.Packet objects.

Parameters:

kwargs – arguments for the packet class, e.g. packet

Returns:

the packet

Return type:

pyrad.packet.Packet

processPacket(pkt)[source]

Process a received packet.

Override it and call the base method first, which raises PacketError for packets of the wrong type in RADIUSAccess and RADIUSAccounting. To answer, create a reply with pkt.CreateReply() and send it with self.transport.write(reply.ReplyPacket(), pkt.source). If no reply is sent, the request is dropped. Raise PacketError to drop the packet with a one-line log message; other exceptions are logged with a traceback.

Parameters:

pkt (pyrad.packet.Packet) – received packet

class pyrad.curved.RADIUSAccess(*args: Any, **kwargs: Any)[source]

Bases: RADIUS

Twisted RADIUS authentication server.

Override processPacket() and call the base method first, which drops all packets except Access-Requests. The User-Password is not verified: decrypt it with pkt.PwDecrypt.

Parameters:

  • hosts (dict[str, pyrad.server.RemoteHost or bytes]) – hosts allowed to send packets, mapping their IP address to a pyrad.server.RemoteHost or to the secret. IPv4 clients of a socket bound to '::' are looked up by their IPv4 address. Unlike pyrad.server.Server, there is no '0.0.0.0' entry for all other hosts: packets from other hosts are dropped.

  • dict (pyrad.dictionary.Dictionary) – RADIUS dictionary used to decode the packets, by default an empty dictionary

  • enforce_ma (bool) – drop Access-Requests without a Message-Authenticator (an invalid Message-Authenticator is always dropped)

  • enable_pkt_verify (bool) – drop Accounting-Requests with an invalid Request Authenticator

createPacket(**kwargs)[source]

Create the packet object for a received datagram.

RADIUSAccess creates a pyrad.packet.AuthPacket and RADIUSAccounting a pyrad.packet.AcctPacket. The base method raises NotImplementedError; a class that doesn’t override it receives generic pyrad.packet.Packet objects.

Parameters:

kwargs – arguments for the packet class, e.g. packet

Returns:

the packet

Return type:

pyrad.packet.Packet

processPacket(pkt)[source]

Process a received packet.

Override it and call the base method first, which raises PacketError for packets of the wrong type in RADIUSAccess and RADIUSAccounting. To answer, create a reply with pkt.CreateReply() and send it with self.transport.write(reply.ReplyPacket(), pkt.source). If no reply is sent, the request is dropped. Raise PacketError to drop the packet with a one-line log message; other exceptions are logged with a traceback.

Parameters:

pkt (pyrad.packet.Packet) – received packet

class pyrad.curved.RADIUSAccounting(*args: Any, **kwargs: Any)[source]

Bases: RADIUS

Twisted RADIUS accounting server.

Override processPacket() and call the base method first, which drops all packets except Accounting-Requests.

Parameters:

  • hosts (dict[str, pyrad.server.RemoteHost or bytes]) – hosts allowed to send packets, mapping their IP address to a pyrad.server.RemoteHost or to the secret. IPv4 clients of a socket bound to '::' are looked up by their IPv4 address. Unlike pyrad.server.Server, there is no '0.0.0.0' entry for all other hosts: packets from other hosts are dropped.

  • dict (pyrad.dictionary.Dictionary) – RADIUS dictionary used to decode the packets, by default an empty dictionary

  • enforce_ma (bool) – drop Access-Requests without a Message-Authenticator (an invalid Message-Authenticator is always dropped)

  • enable_pkt_verify (bool) – drop Accounting-Requests with an invalid Request Authenticator

createPacket(**kwargs)[source]

Create the packet object for a received datagram.

RADIUSAccess creates a pyrad.packet.AuthPacket and RADIUSAccounting a pyrad.packet.AcctPacket. The base method raises NotImplementedError; a class that doesn’t override it receives generic pyrad.packet.Packet objects.

Parameters:

kwargs – arguments for the packet class, e.g. packet

Returns:

the packet

Return type:

pyrad.packet.Packet

processPacket(pkt)[source]

Process a received packet.

Override it and call the base method first, which raises PacketError for packets of the wrong type in RADIUSAccess and RADIUSAccounting. To answer, create a reply with pkt.CreateReply() and send it with self.transport.write(reply.ReplyPacket(), pkt.source). If no reply is sent, the request is dropped. Raise PacketError to drop the packet with a one-line log message; other exceptions are logged with a traceback.

Parameters:

pkt (pyrad.packet.Packet) – received packet

class pyrad.curved.PacketError[source]

A received packet is dropped.

Raised by RADIUSAccess.processPacket() and RADIUSAccounting.processPacket() for packets of the wrong type. A processPacket() override may raise it to drop a packet: the drop is logged as one line instead of a traceback.

This is not pyrad.packet.PacketError, which it shadows in this module; packet handlers may raise either, or pyrad.server.ServerPacketError.