#!/bin/bash # Copyright (C) 2016 Ian Kelling # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f usage() { cat <&2; usage 1 ;; esac ;; y) zblock=false rm -f /root/zblock ;; z) zblock=true touch /root/zblock ;; m) mac=$OPTARG ;; *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; esac done shift "$((OPTIND-1))" # Discard the options and sentinel -- if [[ $1 ]]; then h=$1 elif [[ $hostname ]]; then h=$hostname else h=cmc fi if [[ ! $hostname ]]; then hostname=$h fi secrets=false if [[ -e /root/router-secrets ]]; then secrets=true source /root/router-secrets fi if [[ ! $mac ]] && ! $test && $secrets; then # if we wanted to increment it #mac=${mac:0: -1}$((${mac: -1} + 2)) mac=${rwmac[$h]} fi if (( $# != 0 )); then usage 1 fi macpre=${mac:0: -1} macsuf=${mac: -1} p_updated=false pmirror() { if $p_updated; then return fi # background: upgrading all packages is not recommended because it # doesn't go into the firmware. build new firmware if you want # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location. f=(/var/opkg-lists/*) if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then if ! opkg update; then echo "$0: warning: opkg update failed" >&2 fi p_updated=true fi } pi() { to_install=() for p in "$@"; do pname=${p##*/} pname=${pname%%_*} if [[ ! $(opkg list-installed "$pname") ]]; then to_install+=($p) pmirror fi done if [[ $to_install ]]; then opkg install ${to_install[@]} fi } v() { printf "+ %s\n" "$*" "$@" } ######### uci example:####### # # https://wiki.openwrt.org/doc/uci # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p') # wan="firewall.@zone[$wan_index]" # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then # # default is wan # v uci set firewall.@forwarding[0].dest=$forward_dest # uci commit firewall # firewall_restart=true # fi ####### end uci example ##### uset() { printf "+ uset %s\n" "$*" local key="$1" local val="$2" local service="${key%%.*}" restart_var=${service}_restart if [[ ! ${!restart_var} ]]; then eval $restart_var=false fi if [[ $(uci get "$key") != "$val" ]]; then v uci set "$key"="$val" uci commit $service eval $restart_var=true fi } udel() { printf "+ udel %s\n" "$*" local key="$1" local val="$2" local service="${key%%.*}" restart_var=${service}_restart if [[ ! ${!restart_var} ]]; then eval $restart_var=false fi if uci get "$key" &>/dev/null; then v uci set "$key"="$val" uci commit $service eval $restart_var=true fi } cedit() { v command cedit -v "$@" } ### network config ### lan=10.0.0.0 if $test; then lan=10.1.0.0 elif [[ $hostname == cmc || $hostname == cmcap ]]; then lan=10.2.0.0 elif $client; then lan=10.3.0.0 fi if $test; then ssid="gnuv3" elif $secrets; then ssid=${rssid[$h]} fi : ${ssid:=librecmc} if $secrets; then key=${rkey[$h]} fi : ${key:=pictionary49} mask=255.255.0.0 cidr=16 l=${lan%.0} # why did we lock this? i don't know #passwd -l root ||: #already locked fails sed -ibak '/^root:/d' /etc/shadow # /root/router created by manually running passwd then copying the resulting # line. We have no mkpasswd on wrt/librecmc, then we scp it in. cat /root/router >>/etc/shadow # otherwise, serial console gets root login with no password uset system.@system[0].ttylogin 1 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER' #!/bin/bash # symlinks are collapsed for nfs mount points, so use a bind mount. # tried putting this in /etc/config/fstab, # then doing block mount, it didn't work. This doesn't persist across reboots, # todo: figure that out rm -f /etc/fstab for d in /run/{arch,parabola}iso/bootmnt; do cat >>/etc/fstab </dev/null || mount $d done /etc/init.d/nfsd restart EOFOUTER chmod +x /usr/bin/archlike-pxe-mount sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd uset dropbear.@dropbear[0].PasswordAuth 0 uset dropbear.@dropbear[0].RootPasswordAuth 0 uset dropbear.@dropbear[0].Port 2220 if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key dropbear_restart=true fi if $dropbear_restart; then v /etc/init.d/dropbear restart fi uset network.lan.ipaddr $l.$lanip uset network.lan.netmask $mask if $dev2 || $client || $ap; then if $dev2 || $ap; then uset network.lan.gateway $l.1 uset network.wan.proto none uset network.wan6.proto none fi /etc/init.d/dnsmasq stop /etc/init.d/dnsmasq disable /etc/init.d/odhcpd stop /etc/init.d/odhcpd disable rm -f /etc/resolv.conf if $ap; then cat >/etc/resolv.conf </etc/resolv.conf <<'EOF' nameserver 8.8.8.8 nameserver 8.8.4.4 EOF fi # things i tried to keep dnsmasq running but not enabled except local dns, # but it didnt work right and i dont need it anyways. # uset dhcp.wan.ignore $dev2 # default is false # uset dhcp.lan.ignore $dev2 # default is false # uset dhcp.@dnsmasq[0].interface lo # uset dhcp.@dnsmasq[0].localuse 0 # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf # uset dhcp.@dnsmasq[0].noresolv 1 # todo: populate /etc/resolv.conf with a static value else # these are the defaults # this is not needed unless switching from the above condition. # disabling just to debug #uset network.lan.gateway '' uset network.wan.proto dhcp uset network.wan6.proto dhcpv6 /etc/init.d/dnsmasq start # todo: figure out why this returns 1 /etc/init.d/dnsmasq enable ||: /etc/init.d/odhcpd start /etc/init.d/odhcpd enable fi wireless_restart=false if $client; then uset wireless.default_radio0.network 'wwan' uset wireless.default_radio0.ssid ${rclientssid[$h]} uset wireless.default_radio0.encryption 'psk2' uset wireless.default_radio0.device 'radio0' uset wireless.default_radio0.mode 'sta' uset wireless.default_radio0.bssid ${rclientbssid[$h]} # todo: look into whether 5g network is available. uset wireless.default_radio0.key ${rclientkey[$h]} uset wireless.radio0.disabled false uset wireless.radio1.disabled true else # defaults, just reseting in case client config ran uset wireless.default_radio0.network lan uset wireless.default_radio0.mode ap for x in 0 1; do uset wireless.default_radio$x.ssid "$ssid" uset wireless.default_radio$x.key $key uset wireless.default_radio$x.encryption psk2 if [[ $mac ]]; then uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) fi # disable/enable. secondary device has wireless disabled uset wireless.radio$x.disabled $dev2 done fi if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc/os-release &>/dev/null; then # todo, I also enabled irqbalance, didnt script it though # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28 cat >/etc/rc.local <<'EOF' echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu exit 0 EOF chmod +x /etc/rc.local /etc/rc.local uset wireless.radio0.disassoc_low_ack 0 uset wireless.radio1.disassoc_low_ack 0 fi # found with https://openwrt.org/docs/guide-user/network/wifi/iwchan. # However, the default also chooses 11, and better to let it choose in case things change. # case $HOSTNAME in # cmc) # uset wireless.radio0.channel 11 # ;; # esac # usb, screen, relay are for libremanage # rsync is for brc # # relay package temporarily disabled # /root/relay_1.0-1_mips_24kc.ipk # # note: prometheus-node-exporter-lua-openwrt seems to be a dependency of # prometheus-node-exporter-lua in practice. pkgs=( tcpdump screen rsync kmod-usb-storage block-mount kmod-fs-ext4 prometheus-node-exporter-lua-openwrt prometheus-node-exporter-lua ) if ! $ap; then pkgs+=( unbound-daemon unbound-checkconf ) fi v pi "${pkgs[@]}" # nfs-kernel-server \ # openvpn-openssl adblock libusb-compat \ # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \ cat >/etc/libremanage.conf </dev/null; then # # cant mix cedit plus uci # echo | cedit /etc/config/firewall ||: # uci add_list firewall.@zone[1].network=wg0 # uci commit firewall # firewall-cedit ||: # firewall_restart=true # fi cedit /etc/hosts < [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' # but i dont want ipv6 dns, just keep it simple to ipv4. # I know my isp doesnt have ipv6 right now, # so just stop this thing. # note: tried this, it didn't do anything: # uset dhcp.@odhcpd[0].dns 10.2.0.1 # iank, disablde while debugging. #/etc/init.d/odhcpd stop #/etc/init.d/odhcpd disable # todo: make the above conditional on which server this is. ## left commented in case we have ipv6 problems in the future # avoid errors in log. current isp doesnt have ipv6 #uset unbound.@unbound[0].protocol ip4_only # todo: im not sure all these are needed, but they all look # like good options. # https://blog.cloudflare.com/dns-over-tls-for-openwrt/ # https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 #https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ # # # i found that the zone example was having no effect on the config # # here: # https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md # # # todo: unbound-control, i'm not sure what the purpose of that thing is, some # # kind of coordination with dhcp of dnsmasq, but what? # # note: for debugging, edit /etc/init.d/unbound, change # procd_set_param command $PROG -d -c $UB_TOTAL_CONF # to: # procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF if ! $ap; then { cat <<'EOF' do-tcp: yes prefetch: yes qname-minimisation: yes rrset-roundrobin: yes use-caps-for-id: yes do-ip6: no private-domain: b8.nz local-zone: "10.in-addr.arpa." transparent access-control-view: 10.2.0.31/32 "youtube" EOF if $zblock; then cat <<'EOF' # no sy until that dongle is used by ziva # syw #access-control-view: 10.2.0.7/32 "youtube" # bow access-control-view: 10.2.0.29/32 "youtube" # samsungtab access-control-view: 10.2.0.32/32 "youtube" EOF fi } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true # dns based blocking vs ip based. with ip, same # server can have multiple domains. in dns, # you have to make sure clients to use the local dns. # https dns will need to be blocked by ip in # order to be comprehensive cedit /etc/unbound/unbound_ext.conf <&2 exit 1 fi fi fi # end if $ap # # disabled for now. i want to selectively enable it # # for specific hosts. # if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then # v uci set adblock.global.adb_enabled=0 # uci commit adblock # /etc/init.d/adblock restart # fi # # https://github.com/openwrt/packages/tree/master/net/adblock/files # cat >/etc/crontabs/root <<'EOF' # 0 06 * * * /etc/init.d/adblock reload # EOF # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq # sometimes /mnt/usb fails, cuz it's just a flash drive, # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot cedit /etc/dnsmasq.conf < # or on cmc, # /etc/init.d/dnsmasq stop # vi /tmp/dhcp.leases # /etc/init.d/dnsmasq start # default dhcp range is 100-150 # bottom port, iPXE (PCI 03:00.0) in seabios boot menu dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd #dhcp-host=94:05:bb:1e:2c:2e,set:bo,$l.38,bo # top port, iPXE (PCI 04:00.0) in seabios boot menu #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd # 4 is reserved for a staticly configured host wrt2 dhcp-host=c4:8e:8f:60:63:cb,set:x2w,$l.6,x2w dhcp-host=10:51:07:f5:f1:b8,set:syw,$l.7,syw dhcp-host=80:fa:5b:1c:6e:cf,set:amy,$l.8,amy dhcp-host=a0:ce:c8:9f:7a:f3,set:sy,$l.12,sy # alternate dongle #dhcp-host=94:05:bb:1e:2c:2e,set:sy,$l.12,sy dhcp-host=00:1f:16:16:39:24,set:x2,$l.13,x2 ## for using different dhcp server #dhcp-host=52:54:00:9c:ef:ad,ignore # 14 = wrt3 dhcp-host=ac:d1:b8:5c:eb:d7,set:x3w,$l.17,x3w dhcp-host=00:1f:16:14:01:d8,set:x3,$l.18,x3 # BRN001BA98CA823 in dhcp logs dhcp-host=00:1b:a9:8c:a8:23,set:brother,$l.19,brother dhcp-host=00:26:b6:f7:d4:d8,set:amyw,$l.23,amyw dhcp-host=9a:c6:52:6f:ce:7c,set:onep9,$l.24,onep9 dhcp-host=38:63:bb:07:5a:f9,set:hp,$l.25,hp dhcp-host=70:a6:cc:3a:bb:b4,set:bow,$l.29,bow dhcp-host=6c:56:97:88:7b:74,set:amazontab,$l.31,amazontab dhcp-host=0a:8a:9b:cf:b5:ec,set:samsungtab,$l.32,samsungtab dhcp-host=14:dd:a9:d5:31:7a,set:frodo,$l.34,frodo #dhcp-host=00:26:b6:f6:0f:e9,set:frodow,$l.34,frodow # server d16: dhcp-host=38:2c:4a:c9:33:13,set:bigs,$l.48,bigs dhcp-host=e4:5f:01:07:50:40,set:pi4,$l.49,pi4 dhcp-host=e4:5f:01:07:50:3f,set:pi4w,$l.50,pi4w # samsung phone dhcp-host=a8:79:8d:71:54:68,set:s22,$l.52,s22 # This is so fai can have an explicit name to use for testing, # or else any random machine which did a pxe boot would get # reformatted. The mac is from doing a virt-install, cancelling it, # and copying the generated mac, so it should be randomish. dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.88,demohost # faiserver vm #dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver # template # dhcp-host=,$l., # pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant # access /mnt/usb/tftpboot due to ujail sandbox #enable-tftp=br-lan #tftp-root=/mnt/usb/tftpboot #tftp-root=/var/run/dnsmasq/tftpboot dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf # for debugging dhcp #log-queries=extra EOF if $dnsmasq_restart && ! $dev2 && ! $ap; then # todo: can our ptr records be put in /etc/hosts? # eg: user normal /etc/hosts records, and they wont be used for A resolution # due to the other settings, but will be used for ptr? then maybe # we dont have to restart dnsmasq for a dns update? # # interesing link: # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1 # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80. # also we can turn off dnssec in systemd-resolved if we know the router is doing it. # # Also, reload of dnsmasq seems to break things, wifi # clients were not getting internet connectivity. v /etc/init.d/dnsmasq restart fi if $ap; then v /etc/init.d/firewall disable v /etc/init.d/firewall stop elif $firewall_restart; then v /etc/init.d/firewall restart fi ## turn off luci # if already stopped, gives error we want to ignore /etc/init.d/uhttpd stop |& sed '1{/^Command failed/d}' /etc/init.d/uhttpd disable |& sed '1{/^Command failed/d}' # this may just restart the network and take care of the network_restart below. if $wireless_restart; then v wifi fi # todo: we should catch errors and still run this if needed if $network_restart; then reboot fi v exit 0