CyberMind-FR
aeb4825b25
Pure-shell WiFi MAC address security monitor detecting randomized MACs, OUI anomalies, MAC floods, and spoofing. Integrates with CrowdSec via JSON log parsing and provides real-time hostapd hotplug detection. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
65 lines
1.4 KiB
Bash
65 lines
1.4 KiB
Bash
#!/bin/sh
|
|
# mac-guardian hotplug handler for hostapd events
|
|
# Provides real-time detection on station connect/disconnect
|
|
|
|
# Exit early for irrelevant events or missing data
|
|
[ -n "$ACTION" ] || exit 0
|
|
[ -n "$MACADDR" ] || exit 0
|
|
|
|
# Only handle station events
|
|
case "$ACTION" in
|
|
AP-STA-CONNECTED|AP-STA-DISCONNECTED) ;;
|
|
*) exit 0 ;;
|
|
esac
|
|
|
|
# Check if enabled
|
|
. /lib/functions.sh
|
|
config_load mac-guardian
|
|
config_get enabled main enabled 0
|
|
[ "$enabled" = "1" ] || exit 0
|
|
|
|
# Fork to background for fast return to hostapd
|
|
{
|
|
. /usr/lib/secubox/mac-guardian/functions.sh
|
|
mg_load_config
|
|
mg_init
|
|
|
|
mac=$(mg_normalize_mac "$MACADDR")
|
|
iface="${INTERFACE:-unknown}"
|
|
|
|
case "$ACTION" in
|
|
AP-STA-CONNECTED)
|
|
if mg_validate_mac "$mac"; then
|
|
if ! mg_is_whitelisted "$mac"; then
|
|
mg_lock && {
|
|
mg_check_station "$mac" "" "$iface"
|
|
mg_unlock
|
|
}
|
|
else
|
|
mg_lock && {
|
|
local hostname
|
|
hostname=$(mg_resolve_hostname "$mac")
|
|
mg_db_upsert "$mac" "$iface" "$hostname"
|
|
mg_unlock
|
|
}
|
|
fi
|
|
fi
|
|
;;
|
|
AP-STA-DISCONNECTED)
|
|
# Lightweight: just update last_seen
|
|
if mg_validate_mac "$mac"; then
|
|
mg_lock && {
|
|
local existing
|
|
existing=$(mg_db_lookup "$mac")
|
|
if [ -n "$existing" ]; then
|
|
local hostname
|
|
hostname=$(mg_resolve_hostname "$mac")
|
|
mg_db_upsert "$mac" "$iface" "$hostname"
|
|
fi
|
|
mg_unlock
|
|
}
|
|
fi
|
|
;;
|
|
esac
|
|
} &
|