pyrad.client – basic client

Blocking RADIUS client.

class pyrad.client.Timeout[source]

Raised by Client.SendPacket() when no valid reply was received.

pyrad.client_async.ClientAsync fails its futures with TimeoutError instead.

class pyrad.client.Client(server, authport=1812, acctport=1813, coaport=3799, secret=b'', dict=None, retries=3, timeout=5, enforce_ma=False)[source]

Basic blocking RADIUS client.

Sends requests to one RADIUS server, retransmits them if no reply is received and verifies the replies. Packets are created with CreateAuthPacket(), CreateAcctPacket() and CreateCoAPacket() and sent with SendPacket().

Variables:

  • server – hostname or IP address of the RADIUS server

  • secret – RADIUS secret shared with the server

  • retries – maximum number of times a request is sent in total (0 never sends it and raises Timeout)

  • timeout – number of seconds to wait for a reply after each send

  • enforce_ma – require a Message-Authenticator in replies to Access-Request and Status-Server packets

Parameters:

  • server (str) – hostname or IP address of the RADIUS server

  • authport (int) – server port for authentication packets

  • acctport (int) – server port for accounting packets

  • coaport (int) – server port for CoA and Disconnect packets

  • secret (bytes) – RADIUS secret

  • dict (pyrad.dictionary.Dictionary) – RADIUS dictionary

  • retries (int) – maximum number of times a request is sent in total

  • timeout (float) – number of seconds to wait for a reply after each send

  • enforce_ma (bool) – require a Message-Authenticator in replies to Access-Request and Status-Server packets (a Message-Authenticator in a reply is always verified)

CreateAcctPacket(**args)[source]

Create an accounting packet for the server of this client.

The packet has the dictionary and secret of the client. The keyword arguments are passed to pyrad.packet.AcctPacket: packet arguments (code, id, authenticator, message_authenticator, packet) and attributes to add, with - in the attribute names replaced by _. The default code is Accounting-Request; code=pyrad.packet.StatusServer creates a Status-Server packet to the accounting port.

Returns:

a new packet

Return type:

pyrad.packet.AcctPacket

CreateAuthPacket(**args)[source]

Create an authentication packet for the server of this client.

The packet has the dictionary and secret of the client. The keyword arguments are passed to pyrad.packet.AuthPacket: packet arguments (code, id, authenticator, auth_type, message_authenticator, packet) and attributes to add, with - in the attribute names replaced by _. The default code is Access-Request, use code=pyrad.packet.StatusServer for a Status-Server packet to the authentication port.

A Message-Authenticator is added when the packet is encoded, as countermeasure against the BlastRADIUS attack (CVE-2024-3596); disable it with message_authenticator=False.

For PAP the password must be encrypted: pkt['User-Password'] = pkt.PwCrypt(password). For EAP-MD5 pass auth_type='eap-md5' and set the cleartext password as User-Password, see SendPacket().

Returns:

a new packet

Return type:

pyrad.packet.AuthPacket

CreateCoAPacket(**args)[source]

Create a CoA-Request or Disconnect-Request for this client’s server.

The packet has the dictionary and secret of the client. The keyword arguments are passed to pyrad.packet.CoAPacket: packet arguments (code, id, authenticator, message_authenticator, packet) and attributes to add, with - in the attribute names replaced by _. The default code is CoA-Request, pass code=pyrad.packet.DisconnectRequest for a Disconnect-Request.

Returns:

a new packet

Return type:

pyrad.packet.CoAPacket

SendPacket(pkt)[source]

Send a request to the RADIUS server and wait for a valid reply.

The port depends on the packet class: an AuthPacket (also a Status-Server created with CreateAuthPacket()) is sent to authport, a CoAPacket to coaport and any other packet (also a Status-Server AcctPacket) to acctport.

The request is sent at most retries times, waiting timeout seconds for a reply after each send. Invalid replies are ignored: a wrong Response Authenticator or Message-Authenticator, a Proxy-State that was not sent, or a missing Message-Authenticator with enforce_ma. Before an Accounting-Request is sent again, its Acct-Delay-Time is increased by timeout (this modifies pkt).

With auth_type='eap-md5' the client authenticates with EAP-MD5 (RFC 3748, RFC 3579): the EAP-Response/Identity carries the User-Name, and User-Password holds the cleartext password, which is used for the MD5 response but not sent. The Access-Challenge of the server is answered automatically, so pkt ends up with an EAP-Message, the State of the challenge and a new id.

Parameters:

pkt (pyrad.packet.Packet) – the request to send

Returns:

the reply; check reply.code, e.g. Access-Accept or Access-Reject

Return type:

pyrad.packet.Packet

Raises:

  • Timeout – no valid reply was received

  • ValueError – auth_type='eap-md5' without User-Name or User-Password, or an attribute value that cannot be encoded

  • OSError – the socket fails, e.g. the server name cannot be resolved

bind(addr)[source]

Bind the client socket to a local address.

Useful on a machine with multiple addresses. The socket is closed and opened again first.

Parameters:

addr (tuple) – local address (hostname or IP) and port to bind to, port 0 for any free port