X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup-local;h=e7ebd38d7137914515fa36b7130e9de30f51e989;hp=f465da5a75ceef8e8da54932133943a5c4c1dbb1;hb=HEAD;hpb=917fa30617ccafa3a7ed5218a418cf058948b729 diff --git a/wrt-setup-local b/wrt-setup-local index f465da5..3d2edb8 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -15,31 +15,151 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f + +usage() { + cat <&2; usage 1 ;; + esac + ;; + y) + zblock=false + rm -f /root/zblock + ;; + z) + zblock=true + touch /root/zblock + ;; + m) mac=$OPTARG ;; + *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; + esac +done +shift "$((OPTIND-1))" # Discard the options and sentinel -- + +if [[ $1 ]]; then + h=$1 +elif [[ $hostname ]]; then + h=$hostname +else + h=cmc +fi + +if [[ ! $hostname ]]; then + hostname=$h +fi + + +secrets=false +if [[ -e /root/router-secrets ]]; then + secrets=true + source /root/router-secrets +fi + +if [[ ! $mac ]] && ! $test && $secrets; then + # if we wanted to increment it + #mac=${mac:0: -1}$((${mac: -1} + 2)) + mac=${rwmac[$h]} +fi + +if (( $# != 0 )); then + usage 1 fi + +macpre=${mac:0: -1} +macsuf=${mac: -1} + + +p_updated=false pmirror() { + if $p_updated; then + return + fi # background: upgrading all packages is not recommended because it # doesn't go into the firmware. build new firmware if you want # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location. f=(/var/opkg-lists/*) if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then - opkg update + if ! opkg update; then + echo "$0: warning: opkg update failed" >&2 + fi + p_updated=true fi } pi() { - for x in "$@"; do - if [[ ! $(opkg list-installed "$x") ]]; then + to_install=() + for p in "$@"; do + pname=${p##*/} + pname=${pname%%_*} + if [[ ! $(opkg list-installed "$pname") ]]; then + to_install+=($p) pmirror - opkg install "$@" fi done + if [[ $to_install ]]; then + opkg install ${to_install[@]} + fi } v() { @@ -60,6 +180,7 @@ v() { ####### end uci example ##### uset() { + printf "+ uset %s\n" "$*" local key="$1" local val="$2" local service="${key%%.*}" @@ -74,19 +195,57 @@ uset() { fi } +udel() { + printf "+ udel %s\n" "$*" + local key="$1" + local val="$2" + local service="${key%%.*}" + restart_var=${service}_restart + if [[ ! ${!restart_var} ]]; then + eval $restart_var=false + fi + if uci get "$key" &>/dev/null; then + v uci set "$key"="$val" + uci commit $service + eval $restart_var=true + fi +} +cedit() { + v command cedit -v "$@" +} + ### network config ### -ssid="check out gnu.org" lan=10.0.0.0 -if $dev2; then - ssid="gnuv3" +if $test; then lan=10.1.0.0 +elif [[ $hostname == cmc || $hostname == cmcap ]]; then + lan=10.2.0.0 +elif $client; then + lan=10.3.0.0 +fi + +if $test; then + ssid="gnuv3" +elif $secrets; then + ssid=${rssid[$h]} +fi + +: ${ssid:=librecmc} + + +if $secrets; then + key=${rkey[$h]} fi +: ${key:=pictionary49} + mask=255.255.0.0 +cidr=16 l=${lan%.0} -passwd -l root ||: #already locked fails +# why did we lock this? i don't know +#passwd -l root ||: #already locked fails sed -ibak '/^root:/d' /etc/shadow # /root/router created by manually running passwd then copying the resulting @@ -96,6 +255,7 @@ cat /root/router >>/etc/shadow uset system.@system[0].ttylogin 1 + cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER' #!/bin/bash # symlinks are collapsed for nfs mount points, so use a bind mount. @@ -114,11 +274,163 @@ EOFOUTER chmod +x /usr/bin/archlike-pxe-mount sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ - tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk +uset dropbear.@dropbear[0].PasswordAuth 0 +uset dropbear.@dropbear[0].RootPasswordAuth 0 +uset dropbear.@dropbear[0].Port 2220 +if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then + cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key + dropbear_restart=true +fi + +if $dropbear_restart; then + v /etc/init.d/dropbear restart +fi + + +uset network.lan.ipaddr $l.$lanip +uset network.lan.netmask $mask +if $dev2 || $client || $ap; then + if $dev2 || $ap; then + uset network.lan.gateway $l.1 + uset network.wan.proto none + uset network.wan6.proto none + fi + /etc/init.d/dnsmasq stop + /etc/init.d/dnsmasq disable + /etc/init.d/odhcpd stop + /etc/init.d/odhcpd disable + rm -f /etc/resolv.conf + if $ap; then + cat >/etc/resolv.conf </etc/resolv.conf <<'EOF' +nameserver 8.8.8.8 +nameserver 8.8.4.4 +EOF + fi + + # things i tried to keep dnsmasq running but not enabled except local dns, + # but it didnt work right and i dont need it anyways. + # uset dhcp.wan.ignore $dev2 # default is false + # uset dhcp.lan.ignore $dev2 # default is false + # uset dhcp.@dnsmasq[0].interface lo + # uset dhcp.@dnsmasq[0].localuse 0 + # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf + # uset dhcp.@dnsmasq[0].noresolv 1 + # todo: populate /etc/resolv.conf with a static value + +else + # these are the defaults + + # this is not needed unless switching from the above condition. + # disabling just to debug + #uset network.lan.gateway '' + + uset network.wan.proto dhcp + uset network.wan6.proto dhcpv6 + /etc/init.d/dnsmasq start + # todo: figure out why this returns 1 + /etc/init.d/dnsmasq enable ||: + /etc/init.d/odhcpd start + /etc/init.d/odhcpd enable +fi + +wireless_restart=false + +if $client; then + uset wireless.default_radio0.network 'wwan' + uset wireless.default_radio0.ssid ${rclientssid[$h]} + uset wireless.default_radio0.encryption 'psk2' + uset wireless.default_radio0.device 'radio0' + uset wireless.default_radio0.mode 'sta' + uset wireless.default_radio0.bssid ${rclientbssid[$h]} + # todo: look into whether 5g network is available. + uset wireless.default_radio0.key ${rclientkey[$h]} + uset wireless.radio0.disabled false + uset wireless.radio1.disabled true +else + # defaults, just reseting in case client config ran + uset wireless.default_radio0.network lan + uset wireless.default_radio0.mode ap + for x in 0 1; do + uset wireless.default_radio$x.ssid "$ssid" + uset wireless.default_radio$x.key $key + uset wireless.default_radio$x.encryption psk2 + if [[ $mac ]]; then + uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) + fi + # disable/enable. secondary device has wireless disabled + uset wireless.radio$x.disabled $dev2 + done +fi + +if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc/os-release &>/dev/null; then + # todo, I also enabled irqbalance, didnt script it though + # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28 + cat >/etc/rc.local <<'EOF' +echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu +echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu +exit 0 +EOF + chmod +x /etc/rc.local + /etc/rc.local + uset wireless.radio0.disassoc_low_ack 0 + uset wireless.radio1.disassoc_low_ack 0 +fi + + +# found with https://openwrt.org/docs/guide-user/network/wifi/iwchan. +# However, the default also chooses 11, and better to let it choose in case things change. +# case $HOSTNAME in +# cmc) +# uset wireless.radio0.channel 11 +# ;; +# esac + + +# usb, screen, relay are for libremanage +# rsync is for brc +# +# relay package temporarily disabled +# /root/relay_1.0-1_mips_24kc.ipk +# +# note: prometheus-node-exporter-lua-openwrt seems to be a dependency of +# prometheus-node-exporter-lua in practice. + +pkgs=( + tcpdump + screen + rsync + kmod-usb-storage + block-mount + kmod-fs-ext4 + prometheus-node-exporter-lua-openwrt + prometheus-node-exporter-lua +) + +if ! $ap; then + pkgs+=( + unbound-daemon + unbound-checkconf + ) +fi + +v pi "${pkgs[@]}" +# nfs-kernel-server \ + # openvpn-openssl adblock libusb-compat \ + # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \ + + +cat >/etc/libremanage.conf </dev/null) ]]; then - v uci delete wireless.radio$x.disabled - wireless_restart=true - fi -done - -if $wireless_restart; then - v wifi -fi - ########## openvpn exampl ########## missing firewall settings for routing lan @@ -223,162 +525,576 @@ fi # # I did, and I had to restart the vpn afterwards. # # This maps a uci interface to a real interface which is # # managed outside of uci. -# v cedit /etc/config/network <<'EOF' ||: +# cedit /etc/config/network <<'EOF' ||: # config interface 'tun0' # option ifname 'tun0' # option proto 'none' # EOF -# v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart +# cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart # config openvpn my_client_config # option enabled 1 # option config /etc/openvpn/client.conf # EOF +wgip4=10.3.0.1/24 +wgip6=fdfd::1/64 +wgport=26000 +network_restart=false +if $client; then + cedit wific /etc/config/network </dev/null; then +# # cant mix cedit plus uci +# echo | cedit /etc/config/firewall ||: +# uci add_list firewall.@zone[1].network=wg0 +# uci commit firewall +# firewall-cedit ||: +# firewall_restart=true +# fi -dnsmasq_restart=false -v cedit /etc/hosts </dev/null) ]]; then - # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of - # /etc/resolv.conf. not sure why I did this. - v uci delete dhcp.@dnsmasq[0].resolvfile - uci commit dhcp - dnsmasq_restart=true -fi - uset dhcp.@dnsmasq[0].domain b8.nz -uset dhcp.@dnsmasq[0].local /b8.nz/ -uset system.@system[0].hostname wrt +uset system.@system[0].hostname $hostname +uset dhcp.@dnsmasq[0].local + +# uci doesnt seem to have a way to set an empty value, +# if you delete it, it goes back to the default. this seems +# to be a decent workaround. +# todo: setup /etc/resolv.conf to point to 127.0.0.1 +# later note: disabled, I dunno why I set this. +# uset dhcp.@dnsmasq[0].resolvfile /dev/null + +# if dnsmasq happens to not send out a dns server, +# odhcpd will send one out like this: +# NetworkManager[953]: [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' +# but i dont want ipv6 dns, just keep it simple to ipv4. +# I know my isp doesnt have ipv6 right now, +# so just stop this thing. +# note: tried this, it didn't do anything: +# uset dhcp.@odhcpd[0].dns 10.2.0.1 + +# iank, disablde while debugging. +#/etc/init.d/odhcpd stop +#/etc/init.d/odhcpd disable + +# todo: make the above conditional on which server this is. + +## left commented in case we have ipv6 problems in the future +# avoid errors in log. current isp doesnt have ipv6 +#uset unbound.@unbound[0].protocol ip4_only + +# todo: im not sure all these are needed, but they all look +# like good options. +# https://blog.cloudflare.com/dns-over-tls-for-openwrt/ +# https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 +#https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ +# +# # i found that the zone example was having no effect on the config +# # here: +# https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md +# +# # todo: unbound-control, i'm not sure what the purpose of that thing is, some +# # kind of coordination with dhcp of dnsmasq, but what? +# +# note: for debugging, edit /etc/init.d/unbound, change +# procd_set_param command $PROG -d -c $UB_TOTAL_CONF +# to: +# procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF + +if ! $ap; then + { + cat <<'EOF' +do-tcp: yes +prefetch: yes +qname-minimisation: yes +rrset-roundrobin: yes +use-caps-for-id: yes +do-ip6: no +private-domain: b8.nz +local-zone: "10.in-addr.arpa." transparent +access-control-view: 10.2.0.31/32 "youtube" +EOF -if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then - v uci set adblock.global.adb_enabled=1 - uci commit adblock - /etc/init.d/adblock restart -fi -# https://github.com/openwrt/packages/tree/master/net/adblock/files -cat >/etc/crontabs/root <<'EOF' -0 06 * * * /etc/init.d/adblock reload + if $zblock; then + cat <<'EOF' +# no sy until that dongle is used by ziva + +# syw +#access-control-view: 10.2.0.7/32 "youtube" +# bow +access-control-view: 10.2.0.29/32 "youtube" +# samsungtab +access-control-view: 10.2.0.32/32 "youtube" EOF + fi + } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true + + + # dns based blocking vs ip based. with ip, same + # server can have multiple domains. in dns, + # you have to make sure clients to use the local dns. + # https dns will need to be blocked by ip in + # order to be comprehensive + + + cedit /etc/unbound/unbound_ext.conf <&2 + exit 1 + fi + fi +fi # end if $ap + +# # disabled for now. i want to selectively enable it +# # for specific hosts. +# if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then +# v uci set adblock.global.adb_enabled=0 +# uci commit adblock +# /etc/init.d/adblock restart +# fi +# # https://github.com/openwrt/packages/tree/master/net/adblock/files +# cat >/etc/crontabs/root <<'EOF' +# 0 06 * * * /etc/init.d/adblock reload +# EOF # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq @@ -387,16 +1103,31 @@ EOF # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot -v cedit /etc/dnsmasq.conf < +# or on cmc, +# /etc/init.d/dnsmasq stop +# vi /tmp/dhcp.leases +# /etc/init.d/dnsmasq start + # default dhcp range is 100-150 -# bottom port, iPXE (PCI 03:00.0) in seabios boot menu -dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd -# top port, iPXE (PCI 04:00.0) in seabios boot menu -#dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd -dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo -dhcp-host=10:78:d2:da:29:22,set:htpc,$l.4,htpc -dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2 -# This is so fai can have an explicit name to use for testing, -# or else any random machine which did a pxe boot would get -# reformatted. The mac is from doing a virt-install, cancelling it, -# and copying the generated mac, so it should be randomish. -dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.6,demohost -dhcp-host=00:1f:16:14:01:d8,set:tp,$l.7,x3 -dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp - -# faiserver vm -dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver - -# This is the ip it picks by default if dhcp fails, -# so might as well use it. -# hostname is the name it uses according to telnet -dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca # template # dhcp-host=,$l., -# Just leave the tftp server up even if we aren't doing pxe boot. -# It has no sensitive info. -enable-tftp=br-lan -tftp-root=/mnt/usb/tftpboot +# pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant +# access /mnt/usb/tftpboot due to ujail sandbox +#enable-tftp=br-lan +#tftp-root=/mnt/usb/tftpboot +#tftp-root=/var/run/dnsmasq/tftpboot + + +dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf + +# for debugging dhcp +#log-queries=extra EOF -if $dnsmasq_restart; then + +if $dnsmasq_restart && ! $dev2 && ! $ap; then + # todo: can our ptr records be put in /etc/hosts? + # eg: user normal /etc/hosts records, and they wont be used for A resolution + # due to the other settings, but will be used for ptr? then maybe + # we dont have to restart dnsmasq for a dns update? + # + # interesing link: + # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1 + # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80. + # also we can turn off dnssec in systemd-resolved if we know the router is doing it. + # + # Also, reload of dnsmasq seems to break things, wifi + # clients were not getting internet connectivity. + v /etc/init.d/dnsmasq restart fi -if $firewall_restart; then +if $ap; then + v /etc/init.d/firewall disable + v /etc/init.d/firewall stop +elif $firewall_restart; then v /etc/init.d/firewall restart fi -uset network.lan.ipaddr $l.1 -uset network.lan.netmask $mask +## turn off luci +# if already stopped, gives error we want to ignore +/etc/init.d/uhttpd stop |& sed '1{/^Command failed/d}' +/etc/init.d/uhttpd disable |& sed '1{/^Command failed/d}' +# this may just restart the network and take care of the network_restart below. +if $wireless_restart; then + v wifi +fi + +# todo: we should catch errors and still run this if needed if $network_restart; then reboot fi -if $dropbear_restart; then - v /etc/init.d/dropbear restart -fi -exit 0 +v exit 0