Subversion Repositories ALCASAR

Rev

Rev 854 | Rev 885 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 854 Rev 878
Line 1... Line 1...
1 
#/bin/bash
 1 
#/bin/bash
2 
# $Id: alcasar-bl.sh 854 2012-04-09 19:31:46Z richard $
 2 
# $Id: alcasar-bl.sh 878 2012-06-03 16:07:40Z richard $
3 
 
 3 
 
4 
# alcasar-bl.sh
 4 
# alcasar-bl.sh
5 
# by Franck BOUIJOUX and Richard REY
 5 
# by Franck BOUIJOUX and Richard REY
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
8 
# Gestion de la BL pour le filtrage de domaine (via dnsmasq) et d'URL (via Dansguardian)
 8 
# Gestion de la BL pour le filtrage de domaine (via dnsmasq) et d'URL (via Dansguardian)
9 
# Manage the BL for DnsBlackHole (dnsmasq) and URL filtering (Dansguardian)
 9 
# Manage the BL for DnsBlackHole (dnsmasq) and URL filtering (Dansguardian)
10 
 
 10 
 
- 
 
 11 
DIR_CONF="/usr/local/etc"
11 
CONF_FILE="/usr/local/etc/alcasar.conf"
 12 
CONF_FILE="$DIR_CONF/alcasar.conf"
12 
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
 13 
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
13 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 14 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
14 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 15 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
15 
DIR_tmp="/tmp/blacklists"
 16 
DIR_tmp="/tmp/blacklists"
16 
FILE_tmp="/tmp/fileFilter.txt"
 17 
FILE_tmp="/tmp/fileFilter.txt"
17 
DIR_DG="/etc/dansguardian/lists"
 18 
DIR_DG="/etc/dansguardian/lists"
18 
DIR_DG_BL="$DIR_DG/blacklists"
 19 
DIR_DG_BL="$DIR_DG/blacklists"
19 
BL_CATEGORIES="/usr/local/etc/alcasar-bl-categories"
 20 
BL_CATEGORIES="$DIR_CONF/alcasar-bl-categories"
- 
 
 21 
WL_CATEGORIES="$DIR_CONF/alcasar-wl-categories"
20 
BL_CATEGORIES_ENABLED="/usr/local/etc/alcasar-bl-categories-enabled"
 22 
BL_CATEGORIES_ENABLED="$DIR_CONF/alcasar-bl-categories-enabled"
21 
DIR_DNS_FILTER_AVAILABLE="/usr/local/etc/alcasar-dnsfilter-available"
 23 
DIR_DNS_FILTER_AVAILABLE="$DIR_CONF/alcasar-dnsfilter-available"
22 
DIR_DNS_FILTER_ENABLED="/usr/local/etc/alcasar-dnsfilter-enabled"
 24 
DIR_DNS_FILTER_ENABLED="$DIR_CONF/alcasar-dnsfilter-enabled"
23 
BL_SERVER="cri.univ-tlse1.fr"
 25 
BL_SERVER="dsi.ut-capitole.fr"
24 
SED="/bin/sed -i"
 26 
SED="/bin/sed -i"
25 
 
 27 
 
26 
# Récupération de l'archive de la BL Toulouse
 - 
 
27 
function transfert () {
 - 
 
28 
	mkdir -p $DIR_tmp
 - 
 
29 
	cd $DIR_tmp
 - 
 
30 
	wget http://$BL_SERVER/blacklists/download/blacklists.tar.gz
 - 
 
31 
}
 - 
 
32 
# Décompression de la BL (en conservant la WL)
 - 
 
33 
function install () {
 - 
 
34 
	[ -d $DIR_DG ] || mkdir -p $DIR_DG
 - 
 
35 
	[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp
 - 
 
36 
	[ -d $DIR_DG_BL/ip ] && mv -f $DIR_DG_BL/ip $DIR_tmp
 - 
 
37 
	tar zxf $DIR_tmp/blacklists.tar.gz --directory=$DIR_DG/
 - 
 
38 
	[ -d $DIR_tmp/ossi ] && mv -f $DIR_tmp/ossi $DIR_DG_BL/
 - 
 
39 
	[ -d $DIR_tmp/ip ] && mv -f $DIR_tmp/ip $DIR_DG_BL/
 - 
 
40 
	cd /root
 - 
 
41 
	rm -rf $DIR_tmp
 - 
 
42 
}
 - 
 
43 
# Permet d'activer/désactiver les catégories de la BL
 28 
# Permet d'activer/désactiver les catégories de la BL
44 
function cat_choice (){
 29 
function cat_choice (){
45 
	# un peu de ménage
 30 
	# un peu de ménage
46 
	rm -rf $DIR_DNS_FILTER_ENABLED/*
 31 
	rm -rf $DIR_DNS_FILTER_ENABLED/*
47 
	$SED "/\.Include/d" $DIR_DG/bannedsitelist $DIR_DG/bannedurllist
 32 
	$SED "/\.Include/d" $DIR_DG/bannedsitelist $DIR_DG/bannedurllist
Line 53... Line 38...
53 
		$SED "1i\/etc\/dansguardian\/lists\/blacklists\/$ENABLE_CATEGORIE" $BL_CATEGORIES
 38 
		$SED "1i\/etc\/dansguardian\/lists\/blacklists\/$ENABLE_CATEGORIE" $BL_CATEGORIES
54 
		ln -s $DIR_DNS_FILTER_AVAILABLE/$ENABLE_CATEGORIE.conf $DIR_DNS_FILTER_ENABLED/$ENABLE_CATEGORIE
 39 
		ln -s $DIR_DNS_FILTER_AVAILABLE/$ENABLE_CATEGORIE.conf $DIR_DNS_FILTER_ENABLED/$ENABLE_CATEGORIE
55 
		echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/domains>" >> $DIR_DG/bannedsitelist  # dansguardian s'occupe du contournement par proxy http ;-)
 40 
		echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/domains>" >> $DIR_DG/bannedsitelist  # dansguardian s'occupe du contournement par proxy http ;-)
56 
		echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/urls>" >> $DIR_DG/bannedurllist
 41 
		echo ".Include<$DIR_DG_BL/$ENABLE_CATEGORIE/urls>" >> $DIR_DG/bannedurllist
57 
	done
 42 
	done
58 
	sort -k2n $BL_CATEGORIES > $FILE_tmp
 43 
	sort +0.0 -0.2 $BL_CATEGORIES -o $FILE_tmp
59 
	mv $FILE_tmp $BL_CATEGORIES
 44 
	mv $FILE_tmp $BL_CATEGORIES
60 
}
 45 
}
61 
function bl_enable (){
 46 
function bl_enable (){
62 
	$SED "s/^reportinglevel =.*/reportinglevel = 3/g" /etc/dansguardian/dansguardian.conf
 47 
	$SED "s/^reportinglevel =.*/reportinglevel = 3/g" /etc/dansguardian/dansguardian.conf
63 
	$SED "s?^#\"?\"?g" $DIR_DG/urlregexplist # Enable 'safesearch'
 - 
 
64 
	if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
 48 
	if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
65 
	then
 49 
	then
66 
		service dansguardian restart
 50 
		service dansguardian restart
67 
		service dnsmasq restart
 51 
		service dnsmasq restart
68 
		/usr/local/bin/alcasar-iptables.sh
 52 
		/usr/local/bin/alcasar-iptables.sh
69 
	fi
 53 
	fi
70 
}
 54 
}
71 
function bl_disable (){
 55 
function bl_disable (){
72 
	rm -rf $DIR_DNS_FILTER_ENABLED/*
 56 
	rm -rf $DIR_DNS_FILTER_ENABLED/*
73 
	$SED "s/^reportinglevel =.*/reportinglevel = -1/g" /etc/dansguardian/dansguardian.conf
 57 
	$SED "s/^reportinglevel =.*/reportinglevel = -1/g" /etc/dansguardian/dansguardian.conf
74 
	$SED "s?^[^#]?#&?g" $DIR_DG/urlregexplist # Disable 'safesearch'
 - 
 
75 
	if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
 58 
	if [ "$PARENT_SCRIPT" != "/usr/local/bin/alcasar-conf.sh" ] # don't launch on install stage
76 
	then
 59 
	then
77 
		service dansguardian restart
 60 
		service dansguardian restart
78 
		service dnsmasq restart
 61 
		service dnsmasq restart
79 
		/usr/local/bin/alcasar-iptables.sh
 62 
		/usr/local/bin/alcasar-iptables.sh
Line 109... Line 92...
109 
	# désactivation du filtrage
 92 
	# désactivation du filtrage
110 
	-off | --off)
 93 
	-off | --off)
111 
		$SED "s?^DNS_FILTERING.*?DNS_FILTERING=off?g" $CONF_FILE
 94 
		$SED "s?^DNS_FILTERING.*?DNS_FILTERING=off?g" $CONF_FILE
112 
		bl_disable
 95 
		bl_disable
113 
		;;
 96 
		;;
114 
	# Mise a jour de la blacklist 'Toulouse' (attente validation md5 avant adaptation à notre structure)
 97 
	# Récupération de l'archive de la BL Toulouse
115 
	-download | --download)
 98 
	-download | --download)
116 
		rm -rf /tmp/con_ok.html
 99 
		rm -rf /tmp/con_ok.html
117 
		`/usr/bin/curl $BL_SERVER -# -o /tmp/con_ok.html`
 100 
		`/usr/bin/curl $BL_SERVER -# -o /tmp/con_ok.html`
118 
		if [ ! -e /tmp/con_ok.html ]
 101 
		if [ ! -e /tmp/con_ok.html ]
119 
		then
 102 
		then
120 
			echo "Erreur : le serveur de blacklist ($BL_SERVER) n'est pas joignable"
 103 
			echo "Erreur : le serveur de blacklist ($BL_SERVER) n'est pas joignable"
121 
		else
104 
		else
- 
 
 105 
			rm -rf /tmp/con_ok.html $DIR_tmp
122 
			transfert
 106 
			mkdir $DIR_tmp
123 
			install
 107 
			cd $DIR_tmp
124 
			chown -R dansguardian:apache $DIR_DG
 108 
			wget http://$BL_SERVER/blacklists/download/blacklists.tar.gz
125 
			chmod -R g+w $DIR_DG
 109 
			md5sum $DIR_tmp/blacklists.tar.gz | cut -d" " -f1 > $DIR_tmp/md5sum
126 
			rm -rf /tmp/con_ok.html
 110 
			cd /root
127 
		fi
 111 
		fi
128 
		;;
112 
		;;
129 
	# Adaptation de la BL à notre structure (dnsmasq + DG)
 113 
	# Adaptation de la BL de Toulouse à notre structure (dnsmasq + DG)
130 
	-adapt | --adapt)
 114 
	-adapt | --adapt)
- 
 
 115 
		if [ -f $DIR_tmp/blacklists.tar.gz ]
- 
 
 116 
		then
- 
 
 117 
			[ -d $DIR_DG_BL/ossi ] && mv -f $DIR_DG_BL/ossi $DIR_tmp
- 
 
 118 
			rm -rf $DIR_DG_BL
- 
 
 119 
			mkdir $DIR_DG_BL
- 
 
 120 
			tar zxf $DIR_tmp/blacklists.tar.gz --directory=$DIR_DG/
- 
 
 121 
			[ -d $DIR_tmp/ossi ] && mv -f $DIR_tmp/ossi $DIR_DG_BL/
- 
 
 122 
			rm -rf $DIR_tmp
- 
 
 123 
			chown -R dansguardian:apache $DIR_DG
- 
 
 124 
			chmod -R g+w $DIR_DG
- 
 
 125 
		fi
- 
 
 126 
		rm -f $BL_CATEGORIES $WL_CATEGORIES $DIR_DNS_FILTER_AVAILABLE/*
- 
 
 127 
		touch $BL_CATEGORIES $WL_CATEGORIES
131 
		find $DIR_DG_BL/ -type f -name domains > $BL_CATEGORIES  # On récupère le nom des répertoire (catégories)
 128 
		find $DIR_DG_BL/ -type f -name domains > $FILE_tmp # On récupère le nom des répertoire (catégories)
132 
		$SED "s?\/domains??g" $BL_CATEGORIES # On supprime le suffice "/domains"
 129 
		$SED "s?\/domains??g" $FILE_tmp # On supprime le suffixe "/domains"
- 
 
 130 
		for categorie in `cat $FILE_tmp` # creation des deux fichiers de categories (BL / WL)
- 
 
 131 
		do
- 
 
 132 
			if [ -e $categorie/usage ]
- 
 
 133 
			then
- 
 
 134 
				is_whitelist=`grep white $categorie/usage|wc -l`
- 
 
 135 
			else
- 
 
 136 
				is_whitelist=0 # si le fichier 'usage' n'existe pas, on considère que la catégorie est une BL
- 
 
 137 
			fi
- 
 
 138 
			if [ $is_whitelist -eq "0" ]
- 
 
 139 
			then
- 
 
 140 
				echo "$categorie" >> $BL_CATEGORIES
- 
 
 141 
			else
- 
 
 142 
				echo "$categorie" >> $WL_CATEGORIES
- 
 
 143 
			fi
- 
 
 144 
		done
133 
		rm -f $DIR_DNS_FILTER_AVAILABLE/*
 145 
		rm -f $FILE_tmp
134 
		echo -n "Toulouse BlackList migration process. Please wait : "
 146 
		echo -n "Toulouse BlackList migration process. Please wait : "
135 
		for PATH_FILE in `cat $BL_CATEGORIES`  # pour chaque catégorie
 147 
		for PATH_FILE in `cat $BL_CATEGORIES`  # pour chaque catégorie
136 
		do
 148 
		do
137 
			echo -n "."
 149 
			echo -n "."
138 
		  	if [ ! -f $PATH_FILE/urls ] # on crée le fichier 'urls' s'il n'existe pas
 150 
		  	if [ ! -f $PATH_FILE/urls ] # on crée le fichier 'urls' s'il n'existe pas
139 
			then
 151 
			then
140 
				touch $PATH_FILE/urls
 152 
				touch $PATH_FILE/urls
141 
				chown dansguardian:apache $PATH_FILE/urls
 153 
				chown dansguardian:apache $PATH_FILE/urls
142 
			fi
 154 
			fi
143 
			# suppression des @IP, de caractères acccentués et des lignes commentées
 155 
			# suppression des @IP, de caractères acccentués et des lignes commentées
144 
			egrep  -v "([0-9]{1,3}\.){3}[0-9]{1,3}" $PATH_FILE/domains > /tmp/dnsmasq-bl.tmp
 156 
			egrep  -v "([0-9]{1,3}\.){3}[0-9]{1,3}" $PATH_FILE/domains > $FILE_tmp
145 
			$SED "/[äâëêïîöôüû]/d" /tmp/dnsmasq-bl.tmp
 157 
			$SED "/[äâëêïîöôüû]/d" $FILE_tmp
146 
			$SED "/^#.*/d" /tmp/dnsmasq-bl.tmp
 158 
			$SED "/^#.*/d" $FILE_tmp
147 
			$SED "s?.*?address=/&/$PRIVATE_IP?g" /tmp/dnsmasq-bl.tmp  # Mise en forme dnsmasq
 159 
			$SED "s?.*?address=/&/$PRIVATE_IP?g" $FILE_tmp  # Mise en forme dnsmasq
148 
			DOMAINE=`basename $PATH_FILE`
 160 
			DOMAINE=`basename $PATH_FILE`
149 
			mv /tmp/dnsmasq-bl.tmp $DIR_DNS_FILTER_AVAILABLE/$DOMAINE.conf
 161 
			mv $FILE_tmp $DIR_DNS_FILTER_AVAILABLE/$DOMAINE.conf
150 
		done
 162 
		done
151 
		echo
 163 
		echo
152 
		;;
 164 
		;;
153 
	# regénération suite à modification de la BL secondaire ou du choix des catégories
165 
	# regénération suite à modification du choix des catégories
154 
	-reload | --reload)
 166 
	-reload | --reload)
155 
		# pour Dansguardian
 167 
		# pour Dansguardian
156 
		chown -R dansguardian:apache $DIR_DG_BL/ossi
 168 
		chown -R dansguardian:apache $DIR_DG_BL/ossi
157 
		chmod -R g+w $DIR_DG_BL/ossi
 169 
		chmod -R g+w $DIR_DG_BL/ossi
158 
		cat_choice
 170 
		cat_choice
Line 164... Line 176...
164 
				$SED "/$i/d" $DIR_DNS_FILTER_AVAILABLE/*
 176 
				$SED "/$i/d" $DIR_DNS_FILTER_AVAILABLE/*
165 
			done
 177 
			done
166 
		fi
 178 
		fi
167 
		cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_FILTER_AVAILABLE/ossi.conf
 179 
		cp -f $DIR_DG_BL/ossi/domains $DIR_DNS_FILTER_AVAILABLE/ossi.conf
168 
		$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_FILTER_AVAILABLE/ossi.conf
 180 
		$SED "s?.*?address=/&/$PRIVATE_IP?g" $DIR_DNS_FILTER_AVAILABLE/ossi.conf
169 
		IP_PURE=`grep '^ip' $BL_CATEGORIES_ENABLED|wc -l`
 - 
 
170 
		if [ $IP_PURE -eq "1" ]; then	# filtrage des url sans nom de domaine
 - 
 
171 
			$SED "s/^\#\*ip$/*ip/g" $DIR_DG/bannedsitelist
 - 
 
172 
		else
 - 
 
173 
			$SED "s/^\*ip$/#*ip/g" $DIR_DG/bannedsitelist
 - 
 
174 
		fi
 - 
 
175 
		DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2`		# DNS and URLs filter (on/off)
 181 
		DNS_FILTERING=`grep DNS_FILTERING $CONF_FILE|cut -d"=" -f2`		# DNS and URLs filter (on/off)
176 
		DNS_FILTERING=${DNS_FILTERING:=off}
 182 
		DNS_FILTERING=${DNS_FILTERING:=off}
177 
		if [ $DNS_FILTERING = on ]; then
 183 
		if [ $DNS_FILTERING = on ]; then
178 
			bl_enable
 184 
			bl_enable
179 
		else
 185 
		else