Subversion Repositories ALCASAR

Rev

Rev 1474 | Rev 1535 | Go to most recent revision | Only display areas with differences | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1474 Rev 1500
1
#!/bin/bash
1
http://blog.osdev.org/git/2014/02/13/using-git-on-a-synology-nas.html#!/bin/bash
2
# $Id: alcasar-watchdog.sh 1474 2014-11-03 22:55:09Z richard $
2
# $Id: alcasar-watchdog.sh 1500 2014-11-27 08:09:43Z richard $
3
 
3
 
4
# alcasar-watchdog.sh
4
# alcasar-watchdog.sh
5
# by Rexy
5
# by Rexy
6
# This script is distributed under the Gnu General Public License (GPL)
6
# This script is distributed under the Gnu General Public License (GPL)
7
# Ce script prévient les usagers de l'indisponibilité de l'accès Internet
7
# Ce script prévient les usagers de l'indisponibilité de l'accès Internet
8
# il déconnecte les usagers dont
8
# il déconnecte les usagers dont
9
# - les équipements réseau ne répondent plus
9
# - les équipements réseau ne répondent plus
10
# - les adresses MAC sont usurpées
10
# - les adresses MAC sont usurpées
11
# This script tells users that Internet access is down
11
# This script tells users that Internet access is down
12
# it logs out users whose 
12
# it logs out users whose 
13
# - PCs are quiet
13
# - PCs are quiet
14
# - MAC address is used by other systems (usurped)
14
# - MAC address is used by other systems (usurped)
15
 
15
 
16
CONF_FILE="/usr/local/etc/alcasar.conf"
16
CONF_FILE="/usr/local/etc/alcasar.conf"
17
EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2`			# EXTernal InterFace
17
EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2`			# EXTernal InterFace
18
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`			# INTernal InterFace
18
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`			# INTernal InterFace
19
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
19
private_ip_mask=`grep PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
20
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
20
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
21
PRIVATE_IP=`echo "$private_ip_mask" |cut -d"/" -f1`      # @ip du portail (côté LAN)
21
PRIVATE_IP=`echo "$private_ip_mask" |cut -d"/" -f1`      # @ip du portail (côté LAN)
22
PRIVATE_IP=${PRIVATE_IP:=192.168.182.1}
22
PRIVATE_IP=${PRIVATE_IP:=192.168.182.1}
23
tmp_file="/tmp/watchdog.txt"
23
tmp_file="/tmp/watchdog.txt"
24
DIR_WEB="/var/www/html"
24
DIR_WEB="/var/www/html"
25
Index_Page="$DIR_WEB/index.php"
25
Index_Page="$DIR_WEB/index.php"
26
IPTABLES="/sbin/iptables"
26
IPTABLES="/sbin/iptables"
27
TUNIF="tun0"						# listen device for chilli daemon
27
TUNIF="tun0"						# listen device for chilli daemon
28
OLDIFS=$IFS
28
OLDIFS=$IFS
29
IFS=$'\n'
29
IFS=$'\n'
30
 
30
 
31
function lan_down_alert ()
31
function lan_down_alert ()
32
# users are redirected on ALCASAR IP address if a LAN problem is detected
32
# users are redirected on ALCASAR IP address if a LAN problem is detected
33
{
33
{
34
	case $LAN_DOWN in
34
	case $LAN_DOWN in
35
	"1")
35
	"1")
36
		logger "$EXTIF (WAN card) link down"
36
		logger "$EXTIF (WAN card) link down"
37
		echo "$EXTIF (WAN card) link down"
37
		echo "$EXTIF (WAN card) link down"
38
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"$EXTIF (WAN card) link down\";?g" $Index_Page
38
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"$EXTIF (WAN card) link down\";?g" $Index_Page
39
		;;
39
		;;
40
	"2")
40
	"2")
41
		logger "can't contact the default router"
41
		logger "can't contact the default router"
42
		echo "can't contact the default router"
42
		echo "can't contact the default router"
43
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the default router\";?g" $Index_Page
43
		/bin/sed -i "s?diagnostic =.*?diagnostic = \"can't contact the default router\";?g" $Index_Page
44
		;;
44
		;;
45
	esac
45
	esac
46
	net_pb=`grep "network_pb = True;" $Index_Page|wc -l`
46
	net_pb=`grep "network_pb = True;" $Index_Page|wc -l`
47
	if [ $net_pb = "0" ] # user alert (only the first time)	
47
	if [ $net_pb = "0" ] # user alert (only the first time)	
48
		then
48
		then
49
		/bin/sed -i "s?^\$network_pb.*?\$network_pb = True;?g" $Index_Page
49
		/bin/sed -i "s?^\$network_pb.*?\$network_pb = True;?g" $Index_Page
50
		$IPTABLES -I PREROUTING -t nat -i $TUNIF -p udp --dport domain -j REDIRECT --to-port 56
50
		$IPTABLES -I PREROUTING -t nat -i $TUNIF -p udp --dport domain -j REDIRECT --to-port 56
51
	fi
51
	fi
52
}
52
}
53
 
53
 
54
function lan_test ()
54
function lan_test ()
55
# LAN connectiivity testing
55
# LAN connectiivity testing
56
{
56
{
57
	watchdog_process=`ps -C alcasar-watchdog.sh|wc -l`
57
	watchdog_process=`ps -C alcasar-watchdog.sh|wc -l`
58
	if [[ $(expr $watchdog_process) -gt 3 ]]
58
	if [[ $(expr $watchdog_process) -gt 3 ]]
59
		then
59
		then
60
		echo "ALCASAR watchdog is already running"
60
		echo "ALCASAR watchdog is already running"
61
		exit 0
61
		exit 0
62
	fi
62
	fi
63
	# EXTIF testing
63
	# EXTIF testing
64
	LAN_DOWN="0"
64
	LAN_DOWN="0"
65
	if [ `/sbin/ip link | grep $EXTIF|grep "NO-CARRIER" | wc -l` -eq "1" ]
65
	if [ `/sbin/ip link | grep $EXTIF|grep "NO-CARRIER" | wc -l` -eq "1" ]
66
		then
66
		then
67
		LAN_DOWN="1"
67
		LAN_DOWN="1"
68
	fi
68
	fi
69
	# Default GW testing
69
	# Default GW testing
70
	if [ $LAN_DOWN -eq "0" ]
70
	if [ $LAN_DOWN -eq "0" ]
71
		then
71
		then
72
		IP_GW=`/sbin/ip route list|grep ^default|cut -d" " -f3`
72
		IP_GW=`/sbin/ip route list|grep ^default|cut -d" " -f3`
73
		arp_reply=`/usr/sbin/arping -I$EXTIF -c1 $IP_GW|grep response|cut -d" " -f2`
73
		arp_reply=`/usr/sbin/arping -I$EXTIF -c1 $IP_GW|grep response|cut -d" " -f2`
74
		if [ $arp_reply -eq "0" ]
74
		if [ $arp_reply -eq "0" ]
75
	       		then
75
	       		then
76
			LAN_DOWN="2"
76
			LAN_DOWN="2"
77
		fi
77
		fi
78
	fi
78
	fi
79
	# if LAN pb detected, users are warned
79
	# if LAN pb detected, users are warned
80
	if [ $LAN_DOWN != "0" ]
80
	if [ $LAN_DOWN != "0" ]
81
		then
81
		then
82
			lan_down_alert
82
			lan_down_alert
83
	# else switch in normal mode
83
	# else switch in normal mode
84
	else
84
	else
85
		echo "Internet access is OK for now"
85
		echo "Internet access is OK for now"
86
		net_pb=`grep "network_pb = True;" $Index_Page|wc -l`
86
		net_pb=`grep "network_pb = True;" $Index_Page|wc -l`
87
		if [ $net_pb != "0" ]
87
		if [ $net_pb != "0" ]
88
			then
88
			then
89
			/bin/sed -i "s?^\$network_pb.*?\$network_pb = False;?g" $Index_Page
89
			/bin/sed -i "s?^\$network_pb.*?\$network_pb = False;?g" $Index_Page
90
			$IPTABLES -D PREROUTING -t nat -i $TUNIF -p udp --dport domain -j REDIRECT --to-port 56
90
			$IPTABLES -D PREROUTING -t nat -i $TUNIF -p udp --dport domain -j REDIRECT --to-port 56
91
		fi
91
		fi
92
	fi
92
	fi
93
}
93
}
94
 
94
 
95
usage="Usage: alcasar-watchdog.sh {-lt --lan_test}"
95
usage="Usage: alcasar-watchdog.sh {-lt --lan_test}"
96
case $1 in
96
case $1 in
97
	-\? | -h* | --h*)
97
	-\? | -h* | --h*)
98
		echo "$usage"
98
		echo "$usage"
99
		exit 0
99
		exit 0
100
		;;
100
		;;
101
	-lt | --lan_test)
101
	-lt | --lan_test)
102
		lan_test
102
		lan_test
103
		exit 0
103
		exit 0
104
		;;
104
		;;
105
	*)
105
	*)
106
		lan_test
106
		lan_test
107
		# read file that contains IP address of quiet equipments
107
		# read file that contains IP address of quiet equipments
108
		if [ -e $tmp_file ]; then
108
		if [ -e $tmp_file ]; then
109
			cat $tmp_file | while read noresponse
109
			cat $tmp_file | while read noresponse
110
			do
110
			do
111
				noresponse_ip=`echo $noresponse | cut -d" " -f1`
111
				noresponse_ip=`echo $noresponse | cut -d" " -f1`
112
				noresponse_mac=`echo $noresponse | cut -d" " -f2`
112
				noresponse_mac=`echo $noresponse | cut -d" " -f2`
113
				noresponse_user=`echo $noresponse | cut -d" " -f3`
113
				noresponse_user=`echo $noresponse | cut -d" " -f3`
114
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c1 -w4 $noresponse_ip|grep "Unicast reply"|wc -l`
114
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c1 -w4 $noresponse_ip|grep "Unicast reply"|wc -l`
115
				if [[ $(expr $arp_reply) -eq 0 ]]
115
				if [[ $(expr $arp_reply) -eq 0 ]]
116
	       				then
116
	       				then
117
					logger "alcasar-watchdog $noresponse_ip ($noresponse_mac) can't be contact. Alcasar disconnects the user ($noresponse_user)."
117
					logger "alcasar-watchdog $noresponse_ip ($noresponse_mac) can't be contact. Alcasar disconnects the user ($noresponse_user)."
118
					/usr/sbin/chilli_query logout $noresponse_mac
118
					/usr/sbin/chilli_query logout $noresponse_mac
119
					/usr/sbin/chilli_query dhcp-release $noresponse_mac  # release dhcp for mac_auth equipment 
119
					/usr/sbin/chilli_query dhcp-release $noresponse_mac  # release dhcp for mac_auth equipment 
120
				fi
120
				fi
121
			done
121
			done
122
			rm $tmp_file
122
			rm $tmp_file
123
		fi
123
		fi
124
# process each equipment known by chilli
124
# process each equipment known by chilli
125
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
125
		for system in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
126
		do
126
		do
127
			active_ip=`echo $system |cut -d" " -f2`
127
			active_ip=`echo $system |cut -d" " -f2`
128
			active_session=`echo $system |cut -d" " -f5`
128
			active_session=`echo $system |cut -d" " -f5`
129
			active_mac=`echo $system | cut -d" " -f1`
129
			active_mac=`echo $system | cut -d" " -f1`
130
			active_user=`echo $system |cut -d" " -f6`
130
			active_user=`echo $system |cut -d" " -f6`
131
# process only equipment with an authenticated user
131
# process only equipment with an authenticated user
132
			if [[ $(expr $active_session) -eq 1 ]]
132
			if [[ $(expr $active_session) -eq 1 ]]
133
			then
133
			then
134
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
134
				arp_reply=`/usr/sbin/arping -b -I$INTIF -s$PRIVATE_IP -c2 -w4 $active_ip|grep "Unicast reply"|wc -l`
135
# store @IP of quiet equipments
135
# store @IP of quiet equipments
136
				if [[ $(expr $arp_reply) -eq 0 ]]
136
				if [[ $(expr $arp_reply) -eq 0 ]]
137
	       				then
137
	       				then
138
					PTN='^[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]$'
138
					PTN='^[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]]$'
139
					if [[ $(expr $active_user : $PTN) -eq 0 ]] # don't process @mac auth equipments
139
					if [[ $(expr $active_user : $PTN) -eq 0 ]] # don't process @mac auth equipments
140
					then
140
					then
141
						echo "$active_ip $active_mac $active_user" >> $tmp_file
141
						echo "$active_ip $active_mac $active_user" >> $tmp_file
142
					fi
142
					fi
143
				fi
143
				fi
144
# disconnect users whose equipement is usurped (@MAC)
144
# disconnect users whose equipement is usurped (@MAC)
145
				if [[ $(expr $arp_reply) -gt 2 ]]
145
				if [[ $(expr $arp_reply) -gt 2 ]]
146
	       				then 
146
	       				then 
147
					echo "$(date "+[%x-%X] : ")alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/logs/security/watchdog.log
147
					echo "$(date "+[%x-%X] : ")alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)." >> /var/Save/security/watchdog.log
148
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
148
					logger "alcasar-watchdog : $active_ip is usurped ($active_mac). Alcasar disconnect the user ($active_user)."
149
					/usr/sbin/chilli_query logout $active_mac
149
					/usr/sbin/chilli_query logout $active_mac
150
					chmod 644 /var/Save/logs/security/watchdog.log
150
					chmod 644 /var/Save/security/watchdog.log
151
				fi
151
				fi
152
			fi
152
			fi
153
		done
153
		done
154
		;;
154
		;;
155
esac	
155
esac	
156
IFS=$OLDIFS
156
IFS=$OLDIFS
157
 
157