0003-add-blacklists-by-nameIDs-and-mac-addresses-support.patch

Jérôme Schneider, 22 octobre 2014 16:24

Voir les différences: en ligne côte à côte

Subject: [PATCH 3/3] add blacklists (by nameIDs and mac addresses) support

Closes #5571
Closes #5572

 usr/local/univnautes/sp/rc.sh                      |  9 +++++++
 usr/local/univnautes/sp/sp/auth.py                 | 29 ++++++++++++++++++++--
 .../sp/sp/management/commands/configxml.py         | 10 ++++++--
 usr/local/univnautes/sp/sp/pfconfigxml.py          | 13 ++++++++++
 usr/local/univnautes/sp/update-blacklists.sh       | 24 ++++++++++++++++++
 5 files changed, 81 insertions(+), 4 deletions(-)
 create mode 100755 usr/local/univnautes/sp/update-blacklists.sh

         ) &
+    }
     function syncbl() {
         echo "sync blacklist in progress (backgrounded)" | logger -p local4.info -t sp/syncblacklists
+        (
           cd /usr/local/univnautes/sp/
           ./update-blacklists.sh | logger -p local4.info -t sp/update-blacklists
         ) &
+    }
     function syncdata() {
         echo "sync metadatas + geoinfos in progress (backgrounded)" | logger -p local4.info -t sp/syncdata
+        (
-...
         echo "started (manage.py runfcgi)" | logger -p local4.info -t sp/start
         syncdata
         syncwl
         syncbl
         cronstart
+    }

     # -*- encoding: utf-8 -*-
     import re
     import subprocess
     import syslog
     import xml.etree.ElementTree
-...
     from django.contrib import messages
     from authentic2.authsaml2 import signals
     from sp import pfconfigxml
     COMMENT=re.compile('^\s*($|#)')
     def user_login_cb(sender, request, attributes={}, **kwargs):
         if request and request.user.is_anonymous():
-...
         # log needs eduPersonTargetedID + transientID + idp
         username = eduPersonTargetedID + '|' + eduPersonTargetedID_NameQualifier
         # TODO : blacklist
         ip = request.META['REMOTE_ADDR']
         # user blacklist
         try:
             nameid_bl = pfconfigxml.get_blacklists('nameid')
             for line in nameid_bl.splitlines(True):
                 if COMMENT.match(line):
                     continue
                 userbl = line.strip()
                 # if the line starts with ~, it's a regex
                 if userbl[0] == '~' and re.match(userbl[1::], username):
                     request.session['pfsenseid'] = 'BLACKLISTED'
                     messages.error(request, u"Connexion refusée (règle dans une liste noire).")
                     syslog.openlog("logportalauth", syslog.LOG_PID)
                     syslog.syslog(syslog.LOG_LOCAL4 | syslog.LOG_INFO , "BLACKLISTED-REGEX: %s,,%s" % (username, ip))
                     return False
                 elif userbl.strip() == username:
                     request.session['pfsenseid'] = 'BLACKLISTED'
                     messages.error(request, u"Connexion refusée (présent dans une liste noire).")
                     syslog.openlog("logportalauth", syslog.LOG_PID)
                     syslog.syslog(syslog.LOG_LOCAL4 | syslog.LOG_INFO , "BLACKLISTED: %s,,%s" % (username, ip))
                     return False
         except:
             pass
         # univnautes idp returns univnautesPrivileges attribute (a list)
         multiple = 0
         privileges = attributes.get((u'univnautesPrivileges', u'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'), [])

     from django.core.management.base import BaseCommand, CommandError
     import os
     import sys
     from sp import pfconfigxml
     def get(key):
     def get(key, args):
         if key == 'cpnames':
             for n in pfconfigxml.get_saml_cps():
                 print n['name']
         elif key == 'blacklist':
             if len(args) > 2:
                 print pfconfigxml.get_blacklists(args[2])
             else:
                 print >> sys.stderr, 'you need to choose a blacklist (nameid or macadresses)'
     class Command(BaseCommand):
         help = 'get infos from config.xml'
-...
                 print "syntax: configxml get|set key"
                 return
             if action == 'get':
                 return get(key)
                 return get(key, args)

                 })
         return whitelists
     def get_blacklists(list_type):
         """
         <blacklists>
             <macaddresses>base64</macaddresses>
     	<nameid>base64</nameid>
         </blacklists>
         """
         xml_blacklist = root().find('univnautes/blacklists/%s' % list_type)
         if xml_blacklist is not None and xml_blacklist.text:
             return xml_blacklist.text.decode('base64')
         return ''

     #!/bin/sh
     log() {
         logger -p local4.info -t macblacklist -- "$*"
+    }
     log "update MAC blacklist"
     cd /usr/local/univnautes/sp
     for ctx in $(./manage.py configxml get cpnames); do
         /sbin/ipfw -x $ctx -fq delete 666
         for MAC in $(./manage.py configxml get blacklist macaddresses | sed 's/#.*$//'); do
             # sanitize
             MAC=`echo $MAC | tr -dc 0-9a-fA-F:`
             if test -n "$MAC"; then
                 if /sbin/ipfw -x $ctx -fq add 666 deny MAC $MAC any; then
                     log "added: $MAC in $ctx"
                 else
                     log "ERROR can't add: $MAC (incorrect MAC address ?)"
                 fi
             fi
         done
     done
     exit 0
+    -

Projet

Général

Profil

UnivNautes

0003-add-blacklists-by-nameIDs-and-mac-addresses-support.patch