make mail-route idempotent

diff --git a/mail-route b/mail-route
index 95cbf8d8ef7c1bf4be8efd3d0a069f6d1a077b66..ab26a1333b733eaba7e5307d70df3ed1f18cbce4 100755 (executable)
--- a/mail-route
+++ b/mail-route
@@ -35,6 +35,8 @@ if (( $# != 1 )); then
 fi
 
 start() {
+    start=true
+    stop=false
     iptables_op=-A
     ip_op=add
     # systemd around stretch release time, would wait until openvpn actually connected,
@@ -52,15 +54,20 @@ start() {
         echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
         exit 1
     fi
-    e() { "$@"; }
+    e() { echo "$0: $*"; "$@"; }
     _errcatch_cleanup=stop
     modify
+    # we leave it as is even when stopping, because we would like it to be default, but the only way
+    # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+    e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
 }
 stop() {
+    start=false
+    stop=true
     iptables_op=-D
     ip_op=del
-    tun_dev=$(iptables -t nat -S | sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|head -n1) || printf "failed to find tun device.\n"
-    e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
+    tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+    e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
     modify
 }
 
@@ -80,30 +87,48 @@ show() {
     exit 0
 }
 
+runtest() {
+    # debugging:
+    #echo start=$start stop=$stop exists=$exists
+    { $start && ! $exists; } || { $stop && $exists; }
+}
+
+iptmod() { #iptables modify
+    local check cmd="$*" exists=true
+    ${cmd/-[AD]/-C} &>/dev/null || exists=false
+    if runtest; then e $cmd; fi
+}
 
 # code common to start and stop.
 modify() {
     # match source or dest port. note, when we send to a port, it picks a random high port as
     # the source.
     for port in 25 143; do # smtp and imap.
-        e iptables -t mangle $iptables_op \
-          OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
-        e iptables -t mangle $iptables_op \
-          OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
-          -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+        iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
+        iptmod iptables -t mangle $iptables_op $iptcommon 0x1
+        iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
         # note, we could have used a custom chain and returned instead of setting the mark again.
         # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
-
     done
-    e iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
-    e ip rule $ip_op fwmark 1 table 1
-    # note, this rule does not persist when the tun interface is deleted
-    e ip route $ip_op default via 10.8.0.1 table 1
+
+    if [[ $tun_dev ]]; then
+        # when $tun_dev goes away, so does this rul
+    iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+    fi
+
+
+    iprulecmd="fwmark 1 table 1"
+    exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
+    if runtest; then e ip rule $ip_op $iprulecmd; fi
+
+    iproutecmd="default via 10.8.0.1 table 1"
+    exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
+    if runtest; then e ip route $ip_op $iproutecmd; fi
 
     # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
     # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
     # so, eh, might as well. some rhel docs recommend using it.
-    e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
+
 
     exit 0
 }