| 1 |
#!/bin/sh
|
1 |
#!/bin/sh
|
| 2 |
#
|
2 |
#
|
| 3 |
# $Id: alcasar-macup.sh 2249 2017-05-22 21:24:55Z tom.houdayer $
|
3 |
# $Id: alcasar-macup.sh 2262 2017-05-29 20:19:03Z tom.houdayer $
|
| 4 |
#
|
4 |
#
|
| 5 |
# Le script 'macup' est appelé par coovachilli lorsqu'il attribut une @IP à une @MAC.
|
5 |
# Le script 'macup' est appelé par coovachilli lorsqu'il attribut une @IP à une @MAC.
|
| 6 |
# Depuis la version 3.1 de ALCASAR, le système d'interception a changé. On doit traiter les authorisations par adresse MAC en amont
|
6 |
# Depuis la version 3.1 de ALCASAR, le système d'interception a changé. On doit traiter les authorisations par adresse MAC en amont
|
| 7 |
# Pour une adresse mac authorisée, nous stockons sont @IP dans l'ipset 'not_filtered'
|
7 |
# Pour une adresse mac authorisée, nous stockons sont @IP dans l'ipset 'not_filtered'
|
| 8 |
|
8 |
|
| 9 |
if [ -z $CALLING_STATION_ID ]; then
|
9 |
if [ -z $CALLING_STATION_ID ]; then
|
| 10 |
exit 1
|
10 |
exit 1
|
| 11 |
fi
|
11 |
fi
|
| 12 |
|
12 |
|
| 13 |
chilli_current_mac=$(chilli_query list | grep $CALLING_STATION_ID)
|
13 |
chilli_current_mac=$(chilli_query list | grep $CALLING_STATION_ID)
|
| 14 |
is_connected=$(echo $chilli_current_mac | cut -d' ' -f5)
|
14 |
is_connected=$(echo $chilli_current_mac | cut -d' ' -f5)
|
| 15 |
current_mac=$(echo $chilli_current_mac | cut -d' ' -f1)
|
15 |
current_mac=$(echo $chilli_current_mac | cut -d' ' -f1)
|
| 16 |
current_name=$(echo $chilli_current_mac | cut -d' ' -f6)
|
16 |
current_name=$(echo $chilli_current_mac | cut -d' ' -f6)
|
| 17 |
current_ip=$(echo $chilli_current_mac | cut -d' ' -f2)
|
17 |
current_ip=$(echo $chilli_current_mac | cut -d' ' -f2)
|
| 18 |
|
18 |
|
| 19 |
|
19 |
|
| 20 |
if [ $is_connected == "1" ] && [ $current_mac == $current_name ]; then
|
20 |
if [ $is_connected == "1" ] && [ $current_mac == $current_name ]; then
|
| 21 |
#Lecture du filter-id dans la DB radius afin de placer l'équipement réseau dans le bon ipset
|
21 |
#Lecture du filter-id dans la DB radius afin de placer l'équipement réseau dans le bon ipset
|
| 22 |
#Un équipement autorisé "à chaud" sera placé dans l'ipset 'not_filtered' + pas de filtrage de protocole (proto_0)
|
22 |
#Un équipement autorisé "à chaud" sera placé dans l'ipset 'not_filtered' + pas de filtrage de protocole (proto_0)
|
| 23 |
PASSWD_FILE="/root/ALCASAR-passwords.txt"
|
23 |
PASSWD_FILE="/root/ALCASAR-passwords.txt"
|
| 24 |
QUERY="SELECT value FROM radreply WHERE attribute='Filter-Id' AND username='$current_mac';"
|
24 |
QUERY="SELECT value FROM radreply WHERE attribute='Filter-Id' AND username='$current_mac';"
|
| 25 |
FILTER_ID=$(mysql -D radius -u root -p$(cat $PASSWD_FILE | grep "root /" | rev | cut -d' ' -f1 | rev) -e "$QUERY" -Ns)
|
25 |
FILTER_ID=$(mysql -D radius -u root -p$(cat $PASSWD_FILE | grep "root /" | rev | cut -d' ' -f1 | rev) -e "$QUERY" -Ns)
|
| 26 |
|
26 |
|
| 27 |
# FilterID Byte N°0 to 7
|
27 |
# FilterID Byte N°0 to 7
|
| 28 |
# 0: profile_1 (WEB)
|
28 |
# 0: profile_1 (WEB)
|
| 29 |
# 1: profile_2 (WEB + Mail + Remote access)
|
29 |
# 1: profile_2 (WEB + Mail + Remote access)
|
| 30 |
# 2: profile_3 (Custom)
|
30 |
# 2: profile_3 (Custom)
|
| 31 |
# 3: warn_user (if imputability report has been generated)
|
31 |
# 3: warn_user (if imputability report has been generated)
|
| 32 |
# 5: WL
|
32 |
# 5: WL
|
| 33 |
# 6: BL
|
33 |
# 6: BL
|
| 34 |
# 7: HAVP
|
34 |
# 7: HAVP
|
| 35 |
|
35 |
|
| 36 |
if [ ${FILTER_ID:5:1} == '1' ]; then # HAVP_WL
|
36 |
if [ ${FILTER_ID:5:1} == '1' ]; then # HAVP_WL
|
| 37 |
set_filter="havp_wl"
|
37 |
set_filter="havp_wl"
|
| 38 |
elif [ ${FILTER_ID:6:1} == '1' ]; then # HAVP_BL
|
38 |
elif [ ${FILTER_ID:6:1} == '1' ]; then # HAVP_BL
|
| 39 |
set_filter="havp_bl"
|
39 |
set_filter="havp_bl"
|
| 40 |
elif [ ${FILTER_ID:7:1} == '1' ]; then # HAVP
|
40 |
elif [ ${FILTER_ID:7:1} == '1' ]; then # HAVP
|
| 41 |
set_filter="havp"
|
41 |
set_filter="havp"
|
| 42 |
else # NOT_FILTERED
|
42 |
else # NOT_FILTERED
|
| 43 |
set_filter="not_filtered"
|
43 |
set_filter="not_filtered"
|
| 44 |
fi
|
44 |
fi
|
| 45 |
|
45 |
|
| 46 |
if [ ${FILTER_ID:2:1} == '1' ]; then # PROFILE 3 (Custom)
|
46 |
if [ ${FILTER_ID:2:1} == '1' ]; then # PROFILE 3 (Custom)
|
| 47 |
set_proto="proto_3";
|
47 |
set_proto="proto_3";
|
| 48 |
elif [ ${FILTER_ID:1:1} == '1' ]; then # PROFILE 2 (WEB + Mail + Remote access)
|
48 |
elif [ ${FILTER_ID:1:1} == '1' ]; then # PROFILE 2 (WEB + Mail + Remote access)
|
| 49 |
set_proto="proto_2";
|
49 |
set_proto="proto_2";
|
| 50 |
elif [ ${FILTER_ID:0:1} == '1' ]; then # PROFILE 1 (WEB)
|
50 |
elif [ ${FILTER_ID:0:1} == '1' ]; then # PROFILE 1 (WEB)
|
| 51 |
set_proto="proto_1";
|
51 |
set_proto="proto_1";
|
| 52 |
else # PROFILE 0 (Not filtered)
|
52 |
else # PROFILE 0 (Not filtered)
|
| 53 |
set_proto="proto_0";
|
53 |
set_proto="proto_0";
|
| 54 |
fi
|
54 |
fi
|
| 55 |
|
55 |
|
| 56 |
ipset add $set_filter $current_ip
|
56 |
ipset add $set_filter $current_ip
|
| 57 |
ipset add $set_proto $current_ip
|
57 |
ipset add $set_proto $current_ip
|
| 58 |
fi
|
58 |
fi
|
| 59 |
|
59 |
|