#!/bin/bash

# Device name (IP address) passed as first command line argument, assumed
# to be a valid IP address.
#
# Preliminary status ("pass", "fail", "error") passed as second command
# line argument.
#
# tac_plus.conf example configuration for user or group:
#    after authorization "/path/to/script.sh $name $status"
#

DEVICE=$1
STATUS=$2

RETVAL=0

# Only do something if the prelimiary status is "fail"
if [ "$STATUS" = "fail" ]; then
    # Permit single host
    if [ "$DEVICE" = "192.0.2.53" ]; then
        RETVAL=3
    fi

    # Permit via regular expression (198.51.100.0-255 or 203.0.113.50-59)
    if echo "$DEVICE" | grep -qE "^198\.51\.100\.|^203\.0\.113\.5[0-9]$" ; then
        RETVAL=3
    fi

    # Permit from a list
    DEVICE_LIST=$( mktemp )
    cat > "$DEVICE_LIST" <<EndBlock
172.16.0.1
172.16.0.5
172.16.0.6
172.31.255.254
EndBlock

    if grep -qE "^${DEVICE//./\.}$" "$DEVICE_LIST" ; then
        RETVAL=3
    fi
fi

exit $RETVAL