pyrad.proxy – basic proxy

class pyrad.proxy.Proxy(addresses=[], authport=1812, acctport=1813, coaport=3799, hosts=None, dict=None, auth_enabled=True, acct_enabled=True, coa_enabled=False, enforce_ma=False, enable_pkt_verify=True)[source]

Bases: Server

Base class for RADIUS proxies.

A Server with an extra socket, self._proxyfd, to forward requests to home servers and receive their replies. Run() creates the socket (IPv4 only, not bound to a fixed port) before it starts waiting for packets.

To proxy requests, override the packet handlers of Server to forward a request: create a request for the home server, remember it together with the client request, and send it with self._proxyfd.sendto(request.RequestPacket(), (address, port)). Override _HandleProxyPacket() to process the replies: call the base method first, find the request by pkt.id, verify the reply with request.VerifyReply(pkt) (the proxy doesn’t verify replies itself), and answer the client.

Home servers have to be in hosts with their secret; replies from other hosts are dropped (the '0.0.0.0' entry isn’t used for the proxy socket). Note that a hosts entry also allows that host to send requests to the server.

Parameters:

  • addresses (list[str]) – IP addresses or host names to listen on. The constructor binds them with BindToAddress(). Without addresses no packets are received unless BindToAddress() is called.

  • authport (int) – port to listen on for authentication packets

  • acctport (int) – port to listen on for accounting packets

  • coaport (int) – port to listen on for CoA and Disconnect packets

  • hosts (dict[str, pyrad.server.RemoteHost]) – clients allowed to send requests, mapping their IP address to a RemoteHost with the shared secret. The entry '0.0.0.0' is used for all other clients. IPv4 clients of a socket bound to '::' are looked up by their IPv4 address. Requests of other clients are dropped.

  • dict (pyrad.dictionary.Dictionary) – RADIUS dictionary used to decode the requests

  • auth_enabled (bool) – listen for authentication packets

  • acct_enabled (bool) – listen for accounting packets

  • coa_enabled (bool) – listen for CoA and Disconnect packets

  • enforce_ma (bool) – drop Access-Requests without a Message-Authenticator (an invalid Message-Authenticator is always dropped)

  • enable_pkt_verify (bool) – drop Accounting, CoA and Disconnect requests with an invalid Request Authenticator

_HandleProxyPacket(pkt)[source]

Process a reply received on the proxy socket.

The base method sets pkt.secret to the secret of the home server from hosts and raises ServerPacketError for packets from unknown hosts and for packets which are not a reply (Access-Accept, Access-Reject, Access-Challenge, Accounting-Response, CoA-ACK, CoA-NAK, Disconnect-ACK or Disconnect-NAK). It doesn’t verify the reply. Override it, call the base method first and then process the reply. To drop the packet raise ServerPacketError: the main loop drops the packet and logs the reason.

Parameters:

pkt (pyrad.packet.Packet) – received reply, with pkt.source set to the address of the home server