X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup-local;h=e7ebd38d7137914515fa36b7130e9de30f51e989;hp=4cad00c1797158040c6ec1f66dc90d9a321eaf70;hb=HEAD;hpb=53db7c23cb11661c98a08d69295bb315c392003b diff --git a/wrt-setup-local b/wrt-setup-local index 4cad00c..3d2edb8 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -15,21 +15,20 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f usage() { cat <&2; usage 1 ;; esac ;; + y) + zblock=false + rm -f /root/zblock + ;; + z) + zblock=true + touch /root/zblock + ;; m) mac=$OPTARG ;; *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; esac done shift "$((OPTIND-1))" # Discard the options and sentinel -- +if [[ $1 ]]; then + h=$1 +elif [[ $hostname ]]; then + h=$hostname +else + h=cmc +fi + +if [[ ! $hostname ]]; then + hostname=$h +fi + + +secrets=false +if [[ -e /root/router-secrets ]]; then + secrets=true + source /root/router-secrets +fi + if [[ ! $mac ]] && ! $test && $secrets; then # if we wanted to increment it #mac=${mac:0: -1}$((${mac: -1} + 2)) - mac=${rwmac[$rmac]} + mac=${rwmac[$h]} fi if (( $# != 0 )); then @@ -182,7 +210,9 @@ udel() { eval $restart_var=true fi } - +cedit() { + v command cedit -v "$@" +} ### network config @@ -190,21 +220,23 @@ udel() { lan=10.0.0.0 if $test; then lan=10.1.0.0 -elif [[ $hostname == cmc ]]; then +elif [[ $hostname == cmc || $hostname == cmcap ]]; then lan=10.2.0.0 +elif $client; then + lan=10.3.0.0 fi if $test; then ssid="gnuv3" elif $secrets; then - ssid=${rssid[$rmac]} + ssid=${rssid[$h]} fi : ${ssid:=librecmc} if $secrets; then - key=${rkey[$rmac]} + key=${rkey[$h]} fi : ${key:=pictionary49} @@ -212,7 +244,8 @@ mask=255.255.0.0 cidr=16 l=${lan%.0} -passwd -l root ||: #already locked fails +# why did we lock this? i don't know +#passwd -l root ||: #already locked fails sed -ibak '/^root:/d' /etc/shadow # /root/router created by manually running passwd then copying the resulting @@ -259,19 +292,27 @@ fi uset network.lan.ipaddr $l.$lanip uset network.lan.netmask $mask -if $dev2; then - uset network.lan.gateway $l.1 - uset network.wan.proto none - uset network.wan6.proto none +if $dev2 || $client || $ap; then + if $dev2 || $ap; then + uset network.lan.gateway $l.1 + uset network.wan.proto none + uset network.wan6.proto none + fi /etc/init.d/dnsmasq stop /etc/init.d/dnsmasq disable /etc/init.d/odhcpd stop /etc/init.d/odhcpd disable rm -f /etc/resolv.conf - cat >/etc/resolv.conf <<'EOF' + if $ap; then + cat >/etc/resolv.conf </etc/resolv.conf <<'EOF' nameserver 8.8.8.8 nameserver 8.8.4.4 EOF + fi # things i tried to keep dnsmasq running but not enabled except local dns, # but it didnt work right and i dont need it anyways. @@ -285,7 +326,11 @@ EOF else # these are the defaults - uset network.lan.gateway '' + + # this is not needed unless switching from the above condition. + # disabling just to debug + #uset network.lan.gateway '' + uset network.wan.proto dhcp uset network.wan6.proto dhcpv6 /etc/init.d/dnsmasq start @@ -296,28 +341,90 @@ else fi wireless_restart=false -for x in 0 1; do - uset wireless.default_radio$x.ssid "$ssid" - uset wireless.default_radio$x.key $key - uset wireless.default_radio$x.encryption psk2 - if [[ $mac ]]; then - uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) - fi - # secondary device has wireless disabled - uset wireless.radio$x.disabled $dev2 -done -if $wireless_restart; then - v wifi +if $client; then + uset wireless.default_radio0.network 'wwan' + uset wireless.default_radio0.ssid ${rclientssid[$h]} + uset wireless.default_radio0.encryption 'psk2' + uset wireless.default_radio0.device 'radio0' + uset wireless.default_radio0.mode 'sta' + uset wireless.default_radio0.bssid ${rclientbssid[$h]} + # todo: look into whether 5g network is available. + uset wireless.default_radio0.key ${rclientkey[$h]} + uset wireless.radio0.disabled false + uset wireless.radio1.disabled true +else + # defaults, just reseting in case client config ran + uset wireless.default_radio0.network lan + uset wireless.default_radio0.mode ap + for x in 0 1; do + uset wireless.default_radio$x.ssid "$ssid" + uset wireless.default_radio$x.key $key + uset wireless.default_radio$x.encryption psk2 + if [[ $mac ]]; then + uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) + fi + # disable/enable. secondary device has wireless disabled + uset wireless.radio$x.disabled $dev2 + done +fi + +if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc/os-release &>/dev/null; then + # todo, I also enabled irqbalance, didnt script it though + # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28 + cat >/etc/rc.local <<'EOF' +echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu +echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu +exit 0 +EOF + chmod +x /etc/rc.local + /etc/rc.local + uset wireless.radio0.disassoc_low_ack 0 + uset wireless.radio1.disassoc_low_ack 0 fi +# found with https://openwrt.org/docs/guide-user/network/wifi/iwchan. +# However, the default also chooses 11, and better to let it choose in case things change. +# case $HOSTNAME in +# cmc) +# uset wireless.radio0.channel 11 +# ;; +# esac + # usb, screen, relay are for libremanage # rsync is for brc -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ - tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk \ - screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync +# +# relay package temporarily disabled +# /root/relay_1.0-1_mips_24kc.ipk +# +# note: prometheus-node-exporter-lua-openwrt seems to be a dependency of +# prometheus-node-exporter-lua in practice. + +pkgs=( + tcpdump + screen + rsync + kmod-usb-storage + block-mount + kmod-fs-ext4 + prometheus-node-exporter-lua-openwrt + prometheus-node-exporter-lua +) + +if ! $ap; then + pkgs+=( + unbound-daemon + unbound-checkconf + ) +fi + +v pi "${pkgs[@]}" +# nfs-kernel-server \ + # openvpn-openssl adblock libusb-compat \ + # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \ + cat >/etc/libremanage.conf </dev/null; then - # cant mix cedit plus uci - echo | cedit /etc/config/firewall ||: - uci add_list firewall.@zone[1].network=wg0 - uci commit firewall - firewall-cedit ||: - firewall_restart=true -fi +# firewall comment: +# not using and in newer wrt, fails, probably due to nonexistent file, error output +# on: + +# Reference error: left-hand side expression is not an array or object +# In [anonymous function](), file /usr/share/ucode/fw4.uc, line 3137, byte 12: +# called from function [arrow function] (/usr/share/ucode/fw4.uc:733:71) +# called from function foreach ([C]) +# called from function [anonymous function] (/usr/share/ucode/fw4.uc:733:72) +# called from function render_ruleset (/usr/share/firewall4/main.uc:56:24) +# called from anonymous function (/usr/share/firewall4/main.uc:143:29) +# +# ` if (!inc.enabled) {` +# Near here -------^ +# +# +# The rendered ruleset contains errors, not doing firewall restart. +# /usr/bin/wrt-setup-local:160:error: ""$@"" returned 1 + +## include a file with users custom iptables rules +#config include +# option path /etc/firewall.user +# option type 'restore' +# option family 'ipv4' + + + +# not using wireguard for now +# if ! uci get firewall.@zone[1].network | grep wg0 &>/dev/null; then +# # cant mix cedit plus uci +# echo | cedit /etc/config/firewall ||: +# uci add_list firewall.@zone[1].network=wg0 +# uci commit firewall +# firewall-cedit ||: +# firewall_restart=true +# fi -v cedit /etc/hosts </etc/crontabs/root <<'EOF' -0 06 * * * /etc/init.d/adblock reload +# later note: disabled, I dunno why I set this. +# uset dhcp.@dnsmasq[0].resolvfile /dev/null + +# if dnsmasq happens to not send out a dns server, +# odhcpd will send one out like this: +# NetworkManager[953]: [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' +# but i dont want ipv6 dns, just keep it simple to ipv4. +# I know my isp doesnt have ipv6 right now, +# so just stop this thing. +# note: tried this, it didn't do anything: +# uset dhcp.@odhcpd[0].dns 10.2.0.1 + +# iank, disablde while debugging. +#/etc/init.d/odhcpd stop +#/etc/init.d/odhcpd disable + +# todo: make the above conditional on which server this is. + +## left commented in case we have ipv6 problems in the future +# avoid errors in log. current isp doesnt have ipv6 +#uset unbound.@unbound[0].protocol ip4_only + +# todo: im not sure all these are needed, but they all look +# like good options. +# https://blog.cloudflare.com/dns-over-tls-for-openwrt/ +# https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 +#https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ +# +# # i found that the zone example was having no effect on the config +# # here: +# https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md +# +# # todo: unbound-control, i'm not sure what the purpose of that thing is, some +# # kind of coordination with dhcp of dnsmasq, but what? +# +# note: for debugging, edit /etc/init.d/unbound, change +# procd_set_param command $PROG -d -c $UB_TOTAL_CONF +# to: +# procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF + +if ! $ap; then + { + cat <<'EOF' +do-tcp: yes +prefetch: yes +qname-minimisation: yes +rrset-roundrobin: yes +use-caps-for-id: yes +do-ip6: no +private-domain: b8.nz +local-zone: "10.in-addr.arpa." transparent +access-control-view: 10.2.0.31/32 "youtube" EOF + if $zblock; then + cat <<'EOF' +# no sy until that dongle is used by ziva + +# syw +#access-control-view: 10.2.0.7/32 "youtube" +# bow +access-control-view: 10.2.0.29/32 "youtube" +# samsungtab +access-control-view: 10.2.0.32/32 "youtube" +EOF + fi + } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true + + + # dns based blocking vs ip based. with ip, same + # server can have multiple domains. in dns, + # you have to make sure clients to use the local dns. + # https dns will need to be blocked by ip in + # order to be comprehensive + + + cedit /etc/unbound/unbound_ext.conf <&2 + exit 1 + fi + fi +fi # end if $ap + +# # disabled for now. i want to selectively enable it +# # for specific hosts. +# if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then +# v uci set adblock.global.adb_enabled=0 +# uci commit adblock +# /etc/init.d/adblock restart +# fi +# # https://github.com/openwrt/packages/tree/master/net/adblock/files +# cat >/etc/crontabs/root <<'EOF' +# 0 06 * * * /etc/init.d/adblock reload +# EOF + # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq @@ -729,26 +1103,31 @@ EOF # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot -v cedit /etc/dnsmasq.conf < +# or on cmc, +# /etc/init.d/dnsmasq stop +# vi /tmp/dhcp.leases +# /etc/init.d/dnsmasq start + # default dhcp range is 100-150 -# bottom port, iPXE (PCI 03:00.0) in seabios boot menu -dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd -# top port, iPXE (PCI 04:00.0) in seabios boot menu -#dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd -dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo -# 4 is reserved for a staticly configured host wrt2 -# old x2 with bad fan -#dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2 -dhcp-host=f0:de:f1:81:ec:88,set:x2,$l.5,x2 -dhcp-host=c4:8e:8f:44:f5:63,set:x2w,$l.6,x2w -# This is so fai can have an explicit name to use for testing, -# or else any random machine which did a pxe boot would get -# reformatted. The mac is from doing a virt-install, cancelling it, -# and copying the generated mac, so it should be randomish. -dhcp-host=fa:08:f8:4c:14:1c,set:tp,$l.7,rp -dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp -dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.12,demohost -dhcp-host=62:03:cb:a8:3e:a3,set:trp,$1.13,trp -dhcp-host=00:1f:16:14:01:d8,set:tp,$l.18,x3 -# BRN001BA98CA823 in dhcp logs -dhcp-host=00:1b:a9:8c:a8:23,set:tp,$l.19,brother -dhcp-host=00:26:b6:f6:0f:e9,set:frodow,$l.28,frodow - - -# faiserver vm -dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver - -# This is the ip it picks by default if dhcp fails, -# so might as well use it. -# hostname is the name it uses according to telnet -dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca # template # dhcp-host=,$l., -# Just leave the tftp server up even if we aren't doing pxe boot. -# It has no sensitive info. -enable-tftp=br-lan -tftp-root=/mnt/usb/tftpboot -dhcp-optsfile=/etc/dnsmasq-dhcpopts.conf +# pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant +# access /mnt/usb/tftpboot due to ujail sandbox +#enable-tftp=br-lan +#tftp-root=/mnt/usb/tftpboot +#tftp-root=/var/run/dnsmasq/tftpboot + + +dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf +# for debugging dhcp #log-queries=extra EOF +if $dnsmasq_restart && ! $dev2 && ! $ap; then + # todo: can our ptr records be put in /etc/hosts? + # eg: user normal /etc/hosts records, and they wont be used for A resolution + # due to the other settings, but will be used for ptr? then maybe + # we dont have to restart dnsmasq for a dns update? + # + # interesing link: + # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1 + # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80. + # also we can turn off dnssec in systemd-resolved if we know the router is doing it. + # + # Also, reload of dnsmasq seems to break things, wifi + # clients were not getting internet connectivity. - -if $dnsmasq_restart && ! $dev2; then v /etc/init.d/dnsmasq restart fi -if $firewall_restart; then +if $ap; then + v /etc/init.d/firewall disable + v /etc/init.d/firewall stop +elif $firewall_restart; then v /etc/init.d/firewall restart fi +## turn off luci +# if already stopped, gives error we want to ignore +/etc/init.d/uhttpd stop |& sed '1{/^Command failed/d}' +/etc/init.d/uhttpd disable |& sed '1{/^Command failed/d}' + +# this may just restart the network and take care of the network_restart below. +if $wireless_restart; then + v wifi +fi # todo: we should catch errors and still run this if needed if $network_restart; then reboot fi -exit 0 +v exit 0