radius挑战认证+对接华为防火墙实现SSLvpn +钉钉 双因子认证2

# -*- coding: UTF-8 -*-
from pyrad import *
import socket
import pyrad.host
import random
import pymysql
from dingtalk import *
import requests
import json
BUFSIZE = 1024
KEY = b"testing123456789"
CHALLENGE = "666" #挑战码初始为666
appkey='xxx'#钉钉的appkey
appsecret='xxxx' #钉钉的appsecret 在钉钉的管理后台这两个参数都能找到
class RadiusServer(pyrad.host.Host):
    def __init__(self):
        dict = pyrad.dictionary.Dictionary("dictionary") #从通用的字典使用
        pyrad.host.Host.__init__(self, dict=dict)
    def get_challenge(self): #产生一个4字节的随机挑战码
        challenge = ""  #初始化挑战码
        challenge = challenge + str(chr(random.randint(65,90)))
        challenge = challenge + str(chr(random.randint(65,90)))
        challenge = challenge + str(chr(random.randint(65,90)))
        challenge = challenge + str(chr(random.randint(65,90)))
        return challenge
    def get_token(self):
        url = 'https://oapi.dingtalk.com/gettoken?appkey='+appkey+'&appsecret='+appsecret
        response = requests.get(url=url)
        result = response.json()
        errmsg = result['errmsg']
        print('获取token是否成功：',errmsg)
        try:
            access_token = result['access_token']
        except Exception as e:
            print(e)
            access_token = ''
        return access_token                 
    def check_pass(self, radpkt): 
        global CHALLENGE
        global access_token1
        conn=pymysql.connect(
            host='xxxx',
            port=3306,   
            user='root',
            password='xxxx',
            db='xxxx',#这都是数据库的参数 按照你实际的情况来
            charset='utf8'
        )
         # 拿到游标
        cursor=conn.cursor()
        user=radpkt["User-Name"][0]
        print(user)
        password=radpkt["User-Password"][0]
        print(password)
         # 执行sql语句 
        sql='select * from test where user = "%s" '% (user)
        res=cursor.execute(sql)
        pwd=cursor.fetchall()
        cursor.close()
        conn.close()     
        if radpkt.PwCrypt(CHALLENGE) == radpkt["User-Password"][0]:
            radpkt.code = packet.AccessAccept
            CHALLENGE = self.get_challenge() #挑战码使用过后就更换掉
            radpkt.AddAttribute("Reply-Message","PASSCODE Accept")
            print("AccessAccept")                
        elif radpkt.PwCrypt(pwd[0][1]) == radpkt["User-Password"][0]:
            radpkt.code = packet.AccessChallenge
            CHALLENGE = self.get_challenge()
            radpkt.AddAttribute("Reply-Message","Enter Token Code") 
            radpkt.AddAttribute("State",b'0x1122123231') #最好这个还是随机生成，好吧我有点偷懒
            #下面发送验证码
            access_token1 = self.get_token()
            userid=pwd[0][2]
            print('钉钉id为:',pwd[0][2])
            url = 'https://oapi.dingtalk.com/topapi/message/corpconversation/asyncsend_v2?access_token='+access_token1
            content = '你好，VPN验证码为'+CHALLENGE
            _neirong = {
                     'agent_id':'xxxx',#应用id钉钉后台查看
                     'userid_list':userid,
                     'msg':{
                            'msgtype':'text',
                            'text':{'content':content}}
                        }
            neirong = json.dumps(_neirong)
            response = requests.post(url=url,data=neirong)
            result = response.json()
            print(result)            
        else:
            radpkt.code = packet.AccessReject
            print("AccessReject")
    def get_pkt(self, pkt):
        get_pw = None
        get_name = None
        radpkt = self.CreateAuthPacket(packet=pkt) #解析请求报文
        #radpkt.code = packet.AccessChallenge
        radpkt.secret = KEY
        print("输出相关参数")
        for key in radpkt.keys():        
            print(key, radpkt[key])
            if key == "User-Password":
                get_pw = 1
            if key == "User-Name":
                get_name = 1       
        if 1 == get_pw and 1 == get_name:
            self.check_pass(radpkt)        
        return radpkt.ReplyPacket()         
ip_port = ('', 1812)
server = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)  # udp协议
server.bind(ip_port)


while True:
    data,client_addr = server.recvfrom(BUFSIZE)
    srv = RadiusServer()
    reply = srv.get_pkt(data)
    server.sendto(reply, client_addr)