Redback+tray_agent+ip_auth

 event_inc.sh

Главное отличие это создание универсальной функций do_policy, которая вызывается в важных событиях, и уже по состоянию переменных

logged, enabled, over_limit, deleted   передает на оборудование нужную команду.

Таким образом код получается проще и без дублирований.

Также в примере есть блокировка, для последовательного выполнения telnet.

Также в примере реализована интеграции tray_srv  с оборудованием. И авторизации по Ip тоже.

gcount=$RANDOM
do_session=0

function unlock_telnet(){

    flock -u -w 30 11 && LOG INFO "UnLock $lock Success"

}

function lock_telnet(){

    #открываем файл блокировки

    lock="$gcount id=$id ip=$ip $RANDOM"

    exec 11>&-

    exec 11>/tmp/telnet.lock

    # попытка блокировать ждем 30 секунд пока другие все закончат

    LOG INFO "Try Lock $lock 30sec...   "

    if flock -w 120 11 ; then

            LOG INFO "Lock $lock Success"

        else

            LOG INFO "Lock $lock failed. Create New Lock;"

            rm -f /tmp/telnet.lock; #rm -f защита от повисших скриптов

            exec 11>&-

            exec 11>/tmp/telnet.lock

    fi

}

 

SECONDS=""

 

#LOG_LEVEL=ALL

 

#LOGFILE="/var/log/event_sh.log"

LOG_LEVEL=ALL

nas_pass=redpass

coa_port=3799

 

 

#if ! selflock 10; then

#    LOG WARN "reached time limit $$"

#    exit

#fi

 

SENDER=$1; shift

EVENT=$1; shift

DATA=$@

 

for VAR in $DATA; do

      [[ "$VAR" = *"="* ]] && eval ${VAR%%=*}=\'${VAR#*=}\'

done

LOG INFO ""

LOG INFO " $gcount ***$EVENT*** $DATA"

 

function do_reconnect(){

            lock_telnet

            /usr/local/bin/expect /var/lib/event/reconnect_user.tcl $nas_ip $ip $id | grep -i 'Connection refused'

            sleep 4

            [ "$?" = 0 ] && { echo "Connection refused sleep 20" ; sleep 20; }

            unlock_telnet

}

function do_policy(){

 

            do_inet=1

            # выключаем инет кому запрещен

            [ "$auth_type" = "6" -a "$tray_logged" = "0" ] && do_inet=0

            [ "$logged" = -1 ] && do_inet=0

            [ "$enabled" = "0" -o \

                    "$over_limit" = "1" -o "$deleted" = "1" ] && do_inet=0

            if [ $do_inet = "1" ]; then

                        LOG INFO "$gcount Enable Internet for id=$id ip=$ip"

                        echo "Acct-Session-Id=\"$acct_session_id\",Forward-Policy=\"in:\""\

                            | radclient -x $nas_ip:$coa_port coa $nas_pass  2>&1 \

                            | grep -i "Session-Context-Not-Found"

                        [ $? -eq 0  ] && do_session=1

            else

                        LOG INFO "$gcount Disable Internet for id=$id ip=$ip  enabled=$enabled over_limit=$over_limit deleted=$deleted"

                        echo "Acct-Session-Id=\"$acct_session_id\",Forward-Policy=\"in:\",Forward-Policy=\"in:HTTP-REDIRECT\",HTTP-Redirect-URL=\"http://10.0.0.1/noauth\""| radclient -x $nas_ip:$coa_port coa $nas_pass \

                        | grep -i "Session-Context-Not-Found"

                        [ $? -eq 0  ] && do_session=1

 

                        if [ $over_limit = 1 ]; then

                            echo "Acct-Session-Id=\"$acct_session_id\",Forward-Policy=\"in:HTTP-REDIRECT\",HTTP-Redirect-URL=\"http://10.0.0.1/nomoney\""\

                                | radclient -x $nas_ip:$coa_port coa $nas_pass \

                                | grep -i "Session-Context-Not-Found"

                                [ $? -eq 0  ] && do_session=1

                        fi

 

            fi

}

 

case "$EVENT" in

    login | tray_view_login | balance_negative | balance_positive)

        if [ "$nas_ip" = '10.0.0.3' ]; then

            if [ "$acct_session_id" != "" ]; then

                do_policy ## and set do_session

            fi

            if [ "$acct_session_id" = "" -o "$do_session" = "1" ]; then

                do_reconnect # не гарантированно будет новый логин поэтому политику вешаем

                do_policy

            fi

        fi

    ;;

    rad_acc_start)

        [ "$auth_type" = "1" ] &&  do_policy

    ;;

    # TODO radius_update_err)

    try_double_login)

        if [ "$nas_ip" = '10.0.0.3' ]; then

                sleep 30

                do_reconnect

                do_policy

        fi

    ;;

    tray_view_mustlogon|user_data_changed|user_disconnect)

            if [ "$nas_ip" = '10.0.0.3' ]; then

                sleep 10

                do_reconnect

                do_policy

            fi

    ;;

#todo    logout|

#todo   logged=-1

    tray_view_logout)

        do_policy

    ;;

 

    user_del|user_data_changed_before)

        lock_telnet

        /usr/local/bin/expect /var/lib/event/del_user_ip.tcl 10.0.0.3  $ip $id \

            && LOG INFO "$gcount deleted user "$ip $id \

            || LOG INFO "$gcount NOT deleted user "$ip $id

        unlock_telnet

        [ "$EVENT" = "user_del" ] &&  sqlexec "update users set nas_ip=null where id=$id and deleted=1"

    ;;

    "rate_set")

    [ "$nas_ip" = '10.0.0.3' ] && \

    if  [  $ceil_in -ne -1  ]

        then

            let "burst_in = ceil_in * 1000 / 8"

            let "excess_burst_in = ceil_in * 1500 / 8"

            let "burst_out = ceil_out * 1000 / 8"

            let "excess_burst_out = ceil_out * 1500 / 8"

            echo "Acct-Session-Id=\"$acct_session_id\",Dynamic-QoS-Param += \"police-class-rate cls-all rate-absolute $ceil_in\",Dynamic-QoS-Param += \"polic

        else

            LOG INFO " NOT changed ceil_in=$ceil_in and ceil_out=$ceil_out " $ip $id

    fi

    ;;

    *)

    :

    ;;

esac