Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
my $blackListFilename = "/etc/radiator/blacklist";
my %blacklist;
if (open(BLACKLIST, "<$blackListFilename")) {
%blacklist = map {$_ => 1} map {$_ =~ s/\s+$//s; $_} <BLACKLIST>;
close(BLACKLIST);
} else {
&main::log($main::LOG_DEBUG, "Can't read \"$blackListFilename\": $!");
&main::log($main::LOG_DEBUG, "Assuming that nobody is blacklisted.");
};
my @stripAttrs = ('Class',
'Cisco-AVPair',
'cisco-avpair',
'Tunnel-Type',
'Tunnel-Medium-Type');
my $testAccountID = 'Tunnel-Private-Group-ID';
my $testAccountIDValue = '1:666';
sub isBlacklisted {
my $username = shift;
return $blacklist{$username};
}
sub stripAttrs {
my $p = shift;
my @stripAttrs = @_;
foreach my $attr (@stripAttrs) {
if (defined($p->get_attr($attr))) {
&main::log($main::LOG_DEBUG,
'Removing prohibited attr '.$attr.' from reply.');
$p->delete_attr($attr);
};
};
};
sub {
my $replyFromProxy = ${$_[0]};
my $replyToNAS = ${$_[1]};
my $originalRequest = ${$_[2]};
my $sentToProxy = ${$_[3]};
my $host = $_[4];
if ($replyFromProxy->code eq 'Access-Accept') {
# Zkontrolovat, jestli uzivatel neni na blacklistu.
if (isBlacklisted($replyFromProxy->get_attr('User-Name'))) {
&main::log($main::LOG_DEBUG,
$replyFromProxy->get_attr('User-Name').
' is blacklisted rewriting to Access-Reject!');
$replyFromProxy->set_code('Access-Reject');
stripAttrs($replyToNAS, @stripAttrs, $testAccountID);
return ;
}; # ----------------------------------------------------------------------
# Mrknout, jestli se jedna o testovaci ucet.
my $attrVal = $replyFromProxy->get_attr($testAccountID);
if ($attrVal eq $testAccountIDValue) {
&main::log($main::LOG_DEBUG, "This is a testing account!");
} else {
stripAttrs($replyToNAS, $testAccountID);
}; # ----------------------------------------------------------------------
# Odstranit atributy, ktery by mohly zmast nase APcka.
stripAttrs($replyToNAS, @stripAttrs);
};
return ;
}