X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=wrt-setup-local;h=d900897993b2d7503c41e9b3620229e9f4621c10;hb=739efea3642e2f8a7a672c4600da152a27bedf1a;hp=4cf186b44bf6c46047274096cde70e74c4ff42c1;hpb=c47175685b348735b3440e16851dde2cc39b6f3f;p=automated-distro-installer diff --git a/wrt-setup-local b/wrt-setup-local index 4cf186b..d900897 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -15,26 +15,139 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +usage() { + cat <&2; usage 1 ;; + esac + ;; + y) + zblock=false + rm -f /root/zblock + ;; + z) + zblock=true + touch /root/zblock + ;; + m) mac=$OPTARG ;; + *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; + esac +done +shift "$((OPTIND-1))" # Discard the options and sentinel -- + +if [[ ! $mac ]] && ! $test && $secrets; then + # if we wanted to increment it + #mac=${mac:0: -1}$((${mac: -1} + 2)) + mac=${rwmac[$rmac]} +fi + +if (( $# != 0 )); then + usage 1 +fi + + +macpre=${mac:0: -1} +macsuf=${mac: -1} + + +p_updated=false pmirror() { + if $p_updated; then + return + fi # background: upgrading all packages is not recommended because it # doesn't go into the firmware. build new firmware if you want # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location. f=(/var/opkg-lists/*) if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then - opkg update + if ! opkg update; then + echo "$0: warning: opkg update failed" >&2 + fi + p_updated=true fi } pi() { - for x in "$@"; do - if [[ ! $(opkg list-installed "$x") ]]; then + to_install=() + for p in "$@"; do + pname=${p##*/} + pname=${pname%%_*} + if [[ ! $(opkg list-installed "$pname") ]]; then + to_install+=($p) pmirror - opkg install "$@" fi done + if [[ $to_install ]]; then + opkg install ${to_install[@]} + fi } v() { @@ -42,41 +155,216 @@ v() { "$@" } +######### uci example:####### +# # https://wiki.openwrt.org/doc/uci +# wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p') +# wan="firewall.@zone[$wan_index]" +# if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then +# # default is wan +# v uci set firewall.@forwarding[0].dest=$forward_dest +# uci commit firewall +# firewall_restart=true +# fi +####### end uci example ##### + +uset() { + printf "+ uset %s\n" "$*" + local key="$1" + local val="$2" + local service="${key%%.*}" + restart_var=${service}_restart + if [[ ! ${!restart_var} ]]; then + eval $restart_var=false + fi + if [[ $(uci get "$key") != "$val" ]]; then + v uci set "$key"="$val" + uci commit $service + eval $restart_var=true + fi +} + +udel() { + printf "+ udel %s\n" "$*" + local key="$1" + local val="$2" + local service="${key%%.*}" + restart_var=${service}_restart + if [[ ! ${!restart_var} ]]; then + eval $restart_var=false + fi + if uci get "$key" &>/dev/null; then + v uci set "$key"="$val" + uci commit $service + eval $restart_var=true + fi +} +cedit() { + v command cedit -v "$@" +} + + ### network config ### -ssid=cmc2 -lan=10.1.0.0 +lan=10.0.0.0 +if $test; then + lan=10.1.0.0 +elif [[ $hostname == cmc ]]; then + lan=10.2.0.0 +elif $client; then + lan=10.3.0.0 +fi + +if $test; then + ssid="gnuv3" +elif $secrets; then + ssid=${rssid[$rmac]} +fi + +: ${ssid:=librecmc} + + +if $secrets; then + key=${rkey[$rmac]} +fi +: ${key:=pictionary49} + mask=255.255.0.0 +cidr=16 l=${lan%.0} passwd -l root ||: #already locked fails -cat >/usr/bin/arch-pxe-mount <<'EOFOUTER' +sed -ibak '/^root:/d' /etc/shadow +# /root/router created by manually running passwd then copying the resulting +# line. We have no mkpasswd on wrt/librecmc, then we scp it in. +cat /root/router >>/etc/shadow +# otherwise, serial console gets root login with no password +uset system.@system[0].ttylogin 1 + + + +cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER' #!/bin/bash # symlinks are collapsed for nfs mount points, so use a bind mount. # tried putting this in /etc/config/fstab, -# then doig block mount, it didn't work. This doesn't persist across reboots, +# then doing block mount, it didn't work. This doesn't persist across reboots, # todo: figure that out -d=/run/archiso/bootmnt -cat > /etc/fstab <>/etc/fstab </dev/null || mount $d +done /etc/init.d/nfsd restart EOFOUTER -chmod +x /usr/bin/arch-pxe-mount +chmod +x /usr/bin/archlike-pxe-mount -cat >.profile <<'EOF' -# changing login shell emits spam on ssh single commands & scp - # sed -i 's#/bin/ash$#/bin/bash#' /etc/passwd -# https://github.com/openwrt/packages/issues/6137 -[ "$BASH_VERSION" != "" ] || exec /bin/bash -i +sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd + + + +uset dropbear.@dropbear[0].PasswordAuth 0 +uset dropbear.@dropbear[0].RootPasswordAuth 0 +uset dropbear.@dropbear[0].Port 2220 +if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then + cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key + dropbear_restart=true +fi + +if $dropbear_restart; then + v /etc/init.d/dropbear restart +fi + + +uset network.lan.ipaddr $l.$lanip +uset network.lan.netmask $mask +if $dev2 || $client; then + if $dev2; then + uset network.lan.gateway $l.1 + uset network.wan.proto none + uset network.wan6.proto none + fi + /etc/init.d/dnsmasq stop + /etc/init.d/dnsmasq disable + /etc/init.d/odhcpd stop + /etc/init.d/odhcpd disable + rm -f /etc/resolv.conf + cat >/etc/resolv.conf <<'EOF' +nameserver 8.8.8.8 +nameserver 8.8.4.4 EOF -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ - tcpdump openvpn-openssl adblock + + # things i tried to keep dnsmasq running but not enabled except local dns, + # but it didnt work right and i dont need it anyways. + # uset dhcp.wan.ignore $dev2 # default is false + # uset dhcp.lan.ignore $dev2 # default is false + # uset dhcp.@dnsmasq[0].interface lo + # uset dhcp.@dnsmasq[0].localuse 0 + # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf + # uset dhcp.@dnsmasq[0].noresolv 1 + # todo: populate /etc/resolv.conf with a static value + +else + # these are the defaults + uset network.lan.gateway '' + uset network.wan.proto dhcp + uset network.wan6.proto dhcpv6 + /etc/init.d/dnsmasq start + # todo: figure out why this returns 1 + /etc/init.d/dnsmasq enable ||: + /etc/init.d/odhcpd start + /etc/init.d/odhcpd enable +fi + +wireless_restart=false + +if $client; then + uset wireless.default_radio0.network 'wwan' + uset wireless.default_radio0.ssid ${rclientssid[$rmac]} + uset wireless.default_radio0.encryption 'psk2' + uset wireless.default_radio0.device 'radio0' + uset wireless.default_radio0.mode 'sta' + uset wireless.default_radio0.bssid ${rclientbssid[$rmac]} + # todo: look into whether 5g network is available. + uset wireless.default_radio0.key ${rclientkey[$rmac]} + uset wireless.radio0.disabled false + uset wireless.radio1.disabled true +else + # defaults, just reseting in case client config ran + uset wireless.default_radio0.network lan + uset wireless.default_radio0.mode ap + for x in 0 1; do + uset wireless.default_radio$x.ssid "$ssid" + uset wireless.default_radio$x.key $key + uset wireless.default_radio$x.encryption psk2 + if [[ $mac ]]; then + uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) + fi + # secondary device has wireless disabled + uset wireless.radio$x.disabled $dev2 + done +fi + + +# usb, screen, relay are for libremanage +# rsync is for brc +# +# relay package temporarily disabled +# /root/relay_1.0-1_mips_24kc.ipk +v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ + tcpdump openvpn-openssl adblock libusb-compat \ + screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync\ + unbound-daemon-heavy unbound-checkconf + +cat >/etc/libremanage.conf </dev/null) ]]; then - uci delete wireless.default_radio$x.disabled - wireless_restart=true - fi -done - -if $wireless_restart; then - uci commit wireless - v wifi -fi ########## openvpn exampl @@ -190,162 +449,515 @@ fi # # I did, and I had to restart the vpn afterwards. # # This maps a uci interface to a real interface which is # # managed outside of uci. -# v cedit /etc/config/network <<'EOF' ||: +# cedit /etc/config/network <<'EOF' ||: # config interface 'tun0' # option ifname 'tun0' # option proto 'none' # EOF -# v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart +# cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart # config openvpn my_client_config # option enabled 1 # option config /etc/openvpn/client.conf # EOF +wgip4=10.3.0.1/24 +wgip6=fdfd::1/64 +wgport=26000 +network_restart=false +if $client; then + cedit wific /etc/config/network </dev/null; then +# # cant mix cedit plus uci +# echo | cedit /etc/config/firewall ||: +# uci add_list firewall.@zone[1].network=wg0 +# uci commit firewall +# firewall-cedit ||: +# firewall_restart=true +# fi + + + +cedit /etc/hosts </dev/null) ]]; then - # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of - # /etc/resolv.conf. not sure why I did this. - v uci delete dhcp.@dnsmasq[0].resolvfile - uci commit dhcp - dnsmasq_restart=true -fi +uset dhcp.@dnsmasq[0].domain b8.nz +uset system.@system[0].hostname $hostname +uset dhcp.@dnsmasq[0].local + +# uci doesnt seem to have a way to set an empty value, +# if you delete it, it goes back to the default. this seems +# to be a decent workaround. +# todo: setup /etc/resolv.conf to point to 127.0.0.1 +uset dhcp.@dnsmasq[0].resolvfile /dev/null + +# if dnsmasq happens to not send out a dns server, +# odhcpd will send one out like this: +# NetworkManager[953]: [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' +# but i dont want ipv6 dns, just keep it simple to ipv4. +# I know my isp doesnt have ipv6 right now, +# so just stop this thing. +# note: tried this, it didn't do anything: +# uset dhcp.@odhcpd[0].dns 10.2.0.1 +/etc/init.d/odhcpd stop +/etc/init.d/odhcpd disable +# todo: make the above conditional on which server this is. + +# avoid errors in log. current isp doesnt have ipv6 +uset unbound.@unbound[0].protocol ip4_only + +# todo: im not sure all these are needed, but they all look +# like good options. +# https://blog.cloudflare.com/dns-over-tls-for-openwrt/ +# https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 +#https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ +# +# # i found that the zone example was having no effect on the config +# # here: +# https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md +# +# # todo: unbound-control, i'm not sure what the purpose of that thing is, some +# # kind of coordination with dhcp of dnsmasq, but what? +# +# note: for debugging, edit /etc/init.d/unbound, change +# procd_set_param command $PROG -d -c $UB_TOTAL_CONF +# to: +# procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF + +{ + cat <<'EOF' +do-tcp: yes +prefetch: yes +qname-minimisation: yes +rrset-roundrobin: yes +use-caps-for-id: yes +do-ip6: no +private-domain: b8.nz +local-zone: "10.in-addr.arpa." transparent +access-control-view: 10.2.0.31/32 "youtube" +EOF + + if $zblock; then + cat <<'EOF' +# amy, amyw, samsungtab +access-control-view: 10.2.0.8/32 "youtube" +access-control-view: 10.2.0.23/32 "youtube" +access-control-view: 10.2.0.32/32 "youtube" +EOF + fi +} | cedit /etc/unbound/unbound_srv.conf || restart_unbound=true + + +# dns based blocking vs ip based. with ip, same +# server can have multiple domains. in dns, +# you have to make sure clients to use the local dns. +# https dns will need to be blocked by ip in +# order to be comprehensive + +cedit /etc/unbound/unbound_ext.conf <<'EOF' || restart_unbound=true +local-data-ptr: "10.2.0.1 cmc.b8.nz" +local-data-ptr: "10.2.0.2 kd.b8.nz" +local-data-ptr: "10.2.0.3 sy.b8.nz" +local-data-ptr: "10.2.0.4 wrt2.b8.nz" +local-data-ptr: "10.2.0.5 x2.b8.nz" +local-data-ptr: "10.2.0.6 x2w.b8.nz" +local-data-ptr: "10.2.0.7 syw.b8.nz" +local-data-ptr: "10.2.0.8 amy.b8.nz" +local-data-ptr: "10.2.0.9 bb8.b8.nz" +local-data-ptr: "10.2.0.12 demohost.b8.nz" +local-data-ptr: "10.2.0.14 wrt3.b8.nz" +local-data-ptr: "10.2.0.19 brother.b8.nz" +local-data-ptr: "10.2.0.23 amyw.b8.nz" +local-data-ptr: "10.2.0.25 hp.b8.nz" +local-data-ptr: "10.2.0.31 amazontab.b8.nz" +local-data-ptr: "10.2.0.32 samsungtab.b8.nz" +local-data-ptr: "10.173.0.2 transmission.b8.nz" +local-data-ptr: "10.173.8.1 defaultnn.b8.nz" +local-data-ptr: "10.173.8.2 nn.b8.nz" + +forward-zone: + name: "." +# https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https + forward-addr: 1.1.1.3@853#family.cloudflare-dns.com + forward-addr: 1.0.0.3@853#family.cloudflare-dns.com + forward-ssl-upstream: yes + forward-first: no + +view: + name: "youtube" + local-zone: "googlevideo.com." refuse + local-zone: "video.google.com." refuse + local-zone: "youtu.be." refuse + local-zone: "youtube-nocookie.com." refuse + local-zone: "youtube-ui.l.google.com." refuse + local-zone: "youtube.com." refuse + local-zone: "youtube.googleapis.com." refuse + local-zone: "youtubeeducation.com." refuse + local-zone: "youtubei.googleapis.com." refuse + local-zone: "yt3.ggpht.com." refuse + local-zone: "youtubekids.com." refuse + # try global if no match in view + view-first: yes +EOF -if [[ $(uci get dhcp.@dnsmasq[0].domain) != b8.nz ]]; then - v uci set dhcp.@dnsmasq[0].domain=b8.nz - uci commit dhcp - dnsmasq_restart=true -fi -if [[ $(uci get dhcp.@dnsmasq[0].local) != b8.nz ]]; then - v uci set dhcp.@dnsmasq[0].local=/b8.nz/ - uci commit dhcp - dnsmasq_restart=true -fi -if [[ $(uci get system.@system[0].hostname) != wrt ]]; then - v uci set system.@system[0].hostname=wrt - uci commit system +if $restart_unbound; then + /etc/init.d/unbound restart + if ! unbound-checkconf; then + echo $0: error: unbound-checkconf failed >&2 + exit 1 + fi fi -if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then - v uci set adblock.global.adb_enabled=1 +# disabled for now. i want to selectively enable it +# for specific hosts. +if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then + v uci set adblock.global.adb_enabled=0 uci commit adblock /etc/init.d/adblock restart fi @@ -361,15 +973,21 @@ EOF # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot -v cedit /etc/dnsmasq.conf < 2.80. currently at 2.80. + # also we can turn off dnssec in systemd-resolved if we know the router is doing it. + # + # Also, reload of dnsmasq seems to break things, wifi + # clients were not getting internet connectivity. + v /etc/init.d/dnsmasq restart fi @@ -438,20 +1096,14 @@ if $firewall_restart; then v /etc/init.d/firewall restart fi - -reboot=false -if [[ $(uci get network.lan.ipaddr) != $l.1 ]]; then - v uci set network.lan.ipaddr=$l.1 - uci commit network - reboot=true -fi -if [[ $(uci get network.lan.netmask) != $mask ]]; then - v uci set network.lan.netmask=$mask - uci commit network - reboot=true +# this may just restart the network and take care of the network_restart below. +if $wireless_restart; then + v wifi fi -if $reboot; then +# todo: we should catch errors and still run this if needed +if $network_restart; then reboot fi + exit 0