X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup-local;h=e7ebd38d7137914515fa36b7130e9de30f51e989;hp=fcab6e5a265920b0c8fe159681df978b5ef2d3a3;hb=HEAD;hpb=21353fd35096ba6786c1bae3046b763bfeac5890 diff --git a/wrt-setup-local b/wrt-setup-local index fcab6e5..3d2edb8 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -16,13 +16,11 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR - +f=/usr/local/lib/bash-bear;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f usage() { cat <&2; usage 1 ;; esac ;; + y) + zblock=false + rm -f /root/zblock + ;; + z) + zblock=true + touch /root/zblock + ;; m) mac=$OPTARG ;; *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; esac done shift "$((OPTIND-1))" # Discard the options and sentinel -- +if [[ $1 ]]; then + h=$1 +elif [[ $hostname ]]; then + h=$hostname +else + h=cmc +fi + +if [[ ! $hostname ]]; then + hostname=$h +fi + + +secrets=false +if [[ -e /root/router-secrets ]]; then + secrets=true + source /root/router-secrets +fi + if [[ ! $mac ]] && ! $test && $secrets; then # if we wanted to increment it #mac=${mac:0: -1}$((${mac: -1} + 2)) - mac=${rwmac[$rmac]} + mac=${rwmac[$h]} fi if (( $# != 0 )); then @@ -187,7 +210,9 @@ udel() { eval $restart_var=true fi } - +cedit() { + v command cedit -v "$@" +} ### network config @@ -195,7 +220,7 @@ udel() { lan=10.0.0.0 if $test; then lan=10.1.0.0 -elif [[ $hostname == cmc ]]; then +elif [[ $hostname == cmc || $hostname == cmcap ]]; then lan=10.2.0.0 elif $client; then lan=10.3.0.0 @@ -204,14 +229,14 @@ fi if $test; then ssid="gnuv3" elif $secrets; then - ssid=${rssid[$rmac]} + ssid=${rssid[$h]} fi : ${ssid:=librecmc} if $secrets; then - key=${rkey[$rmac]} + key=${rkey[$h]} fi : ${key:=pictionary49} @@ -219,7 +244,8 @@ mask=255.255.0.0 cidr=16 l=${lan%.0} -passwd -l root ||: #already locked fails +# why did we lock this? i don't know +#passwd -l root ||: #already locked fails sed -ibak '/^root:/d' /etc/shadow # /root/router created by manually running passwd then copying the resulting @@ -266,8 +292,8 @@ fi uset network.lan.ipaddr $l.$lanip uset network.lan.netmask $mask -if $dev2 || $client; then - if $dev2; then +if $dev2 || $client || $ap; then + if $dev2 || $ap; then uset network.lan.gateway $l.1 uset network.wan.proto none uset network.wan6.proto none @@ -277,10 +303,16 @@ if $dev2 || $client; then /etc/init.d/odhcpd stop /etc/init.d/odhcpd disable rm -f /etc/resolv.conf - cat >/etc/resolv.conf <<'EOF' + if $ap; then + cat >/etc/resolv.conf </etc/resolv.conf <<'EOF' nameserver 8.8.8.8 nameserver 8.8.4.4 EOF + fi # things i tried to keep dnsmasq running but not enabled except local dns, # but it didnt work right and i dont need it anyways. @@ -294,7 +326,11 @@ EOF else # these are the defaults - uset network.lan.gateway '' + + # this is not needed unless switching from the above condition. + # disabling just to debug + #uset network.lan.gateway '' + uset network.wan.proto dhcp uset network.wan6.proto dhcpv6 /etc/init.d/dnsmasq start @@ -308,13 +344,13 @@ wireless_restart=false if $client; then uset wireless.default_radio0.network 'wwan' - uset wireless.default_radio0.ssid ${rclientssid[$rmac]} + uset wireless.default_radio0.ssid ${rclientssid[$h]} uset wireless.default_radio0.encryption 'psk2' uset wireless.default_radio0.device 'radio0' uset wireless.default_radio0.mode 'sta' - uset wireless.default_radio0.bssid ${rclientbssid[$rmac]} + uset wireless.default_radio0.bssid ${rclientbssid[$h]} # todo: look into whether 5g network is available. - uset wireless.default_radio0.key ${rclientkey[$rmac]} + uset wireless.default_radio0.key ${rclientkey[$h]} uset wireless.radio0.disabled false uset wireless.radio1.disabled true else @@ -328,13 +364,33 @@ else if [[ $mac ]]; then uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x)) fi - # secondary device has wireless disabled + # disable/enable. secondary device has wireless disabled uset wireless.radio$x.disabled $dev2 done fi +if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc/os-release &>/dev/null; then + # todo, I also enabled irqbalance, didnt script it though + # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28 + cat >/etc/rc.local <<'EOF' +echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu +echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu +exit 0 +EOF + chmod +x /etc/rc.local + /etc/rc.local + uset wireless.radio0.disassoc_low_ack 0 + uset wireless.radio1.disassoc_low_ack 0 +fi +# found with https://openwrt.org/docs/guide-user/network/wifi/iwchan. +# However, the default also chooses 11, and better to let it choose in case things change. +# case $HOSTNAME in +# cmc) +# uset wireless.radio0.channel 11 +# ;; +# esac # usb, screen, relay are for libremanage @@ -342,9 +398,33 @@ fi # # relay package temporarily disabled # /root/relay_1.0-1_mips_24kc.ipk -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ - tcpdump openvpn-openssl adblock libusb-compat \ - screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync +# +# note: prometheus-node-exporter-lua-openwrt seems to be a dependency of +# prometheus-node-exporter-lua in practice. + +pkgs=( + tcpdump + screen + rsync + kmod-usb-storage + block-mount + kmod-fs-ext4 + prometheus-node-exporter-lua-openwrt + prometheus-node-exporter-lua +) + +if ! $ap; then + pkgs+=( + unbound-daemon + unbound-checkconf + ) +fi + +v pi "${pkgs[@]}" +# nfs-kernel-server \ + # openvpn-openssl adblock libusb-compat \ + # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \ + cat >/etc/libremanage.conf </dev/null; then # # cant mix cedit plus uci @@ -712,17 +933,9 @@ firewall-cedit || firewall_restart=true -v cedit /etc/hosts </etc/crontabs/root <<'EOF' -0 06 * * * /etc/init.d/adblock reload +# later note: disabled, I dunno why I set this. +# uset dhcp.@dnsmasq[0].resolvfile /dev/null + +# if dnsmasq happens to not send out a dns server, +# odhcpd will send one out like this: +# NetworkManager[953]: [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' +# but i dont want ipv6 dns, just keep it simple to ipv4. +# I know my isp doesnt have ipv6 right now, +# so just stop this thing. +# note: tried this, it didn't do anything: +# uset dhcp.@odhcpd[0].dns 10.2.0.1 + +# iank, disablde while debugging. +#/etc/init.d/odhcpd stop +#/etc/init.d/odhcpd disable + +# todo: make the above conditional on which server this is. + +## left commented in case we have ipv6 problems in the future +# avoid errors in log. current isp doesnt have ipv6 +#uset unbound.@unbound[0].protocol ip4_only + +# todo: im not sure all these are needed, but they all look +# like good options. +# https://blog.cloudflare.com/dns-over-tls-for-openwrt/ +# https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 +#https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ +# +# # i found that the zone example was having no effect on the config +# # here: +# https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md +# +# # todo: unbound-control, i'm not sure what the purpose of that thing is, some +# # kind of coordination with dhcp of dnsmasq, but what? +# +# note: for debugging, edit /etc/init.d/unbound, change +# procd_set_param command $PROG -d -c $UB_TOTAL_CONF +# to: +# procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF + +if ! $ap; then + { + cat <<'EOF' +do-tcp: yes +prefetch: yes +qname-minimisation: yes +rrset-roundrobin: yes +use-caps-for-id: yes +do-ip6: no +private-domain: b8.nz +local-zone: "10.in-addr.arpa." transparent +access-control-view: 10.2.0.31/32 "youtube" EOF + if $zblock; then + cat <<'EOF' +# no sy until that dongle is used by ziva + +# syw +#access-control-view: 10.2.0.7/32 "youtube" +# bow +access-control-view: 10.2.0.29/32 "youtube" +# samsungtab +access-control-view: 10.2.0.32/32 "youtube" +EOF + fi + } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true + + + # dns based blocking vs ip based. with ip, same + # server can have multiple domains. in dns, + # you have to make sure clients to use the local dns. + # https dns will need to be blocked by ip in + # order to be comprehensive + + + cedit /etc/unbound/unbound_ext.conf <&2 + exit 1 + fi + fi +fi # end if $ap + +# # disabled for now. i want to selectively enable it +# # for specific hosts. +# if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then +# v uci set adblock.global.adb_enabled=0 +# uci commit adblock +# /etc/init.d/adblock restart +# fi +# # https://github.com/openwrt/packages/tree/master/net/adblock/files +# cat >/etc/crontabs/root <<'EOF' +# 0 06 * * * /etc/init.d/adblock reload +# EOF + # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq @@ -760,31 +1103,31 @@ EOF # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot -v cedit /etc/dnsmasq.conf < +# or on cmc, +# /etc/init.d/dnsmasq stop +# vi /tmp/dhcp.leases +# /etc/init.d/dnsmasq start + # default dhcp range is 100-150 -# bottom port, iPXE (PCI 03:00.0) in seabios boot menu -dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd -# top port, iPXE (PCI 04:00.0) in seabios boot menu -#dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd -dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo -# 4 is reserved for a staticly configured host wrt2 -# old x2 with bad fan -#dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2 -dhcp-host=f0:de:f1:81:ec:88,set:x2,$l.5,x2 -dhcp-host=c4:8e:8f:44:f5:63,set:x2w,$l.6,x2w -# This is so fai can have an explicit name to use for testing, -# or else any random machine which did a pxe boot would get -# reformatted. The mac is from doing a virt-install, cancelling it, -# and copying the generated mac, so it should be randomish. -dhcp-host=fa:08:f8:4c:14:1c,set:tp,$l.7,rp -dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp -dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.12,demohost -dhcp-host=62:03:cb:a8:3e:a3,set:trp,$1.13,trp -dhcp-host=00:1f:16:14:01:d8,set:tp,$l.18,x3 -# BRN001BA98CA823 in dhcp logs -dhcp-host=00:1b:a9:8c:a8:23,set:tp,$l.19,brother -dhcp-host=38:63:bb:07:5a:f9,set:tp,$l.25,hp -dhcp-host=00:26:b6:f6:0f:e9,set:frodow,$l.28,frodow - - -# faiserver vm -dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver - -# This is the ip it picks by default if dhcp fails, -# so might as well use it. -# hostname is the name it uses according to telnet -dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca # template # dhcp-host=,$l., -# Just leave the tftp server up even if we aren't doing pxe boot. -# It has no sensitive info. -enable-tftp=br-lan -tftp-root=/mnt/usb/tftpboot -dhcp-optsfile=/etc/dnsmasq-dhcpopts.conf +# pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant +# access /mnt/usb/tftpboot due to ujail sandbox +#enable-tftp=br-lan +#tftp-root=/mnt/usb/tftpboot +#tftp-root=/var/run/dnsmasq/tftpboot + +dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf + +# for debugging dhcp #log-queries=extra EOF -if $dnsmasq_restart && ! $dev2; then +if $dnsmasq_restart && ! $dev2 && ! $ap; then # todo: can our ptr records be put in /etc/hosts? # eg: user normal /etc/hosts records, and they wont be used for A resolution # due to the other settings, but will be used for ptr? then maybe # we dont have to restart dnsmasq for a dns update? # - # todo: according to this + # interesing link: # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1 - # we should turn on dnssec validation when wrt gets version > 2.80. currently at 2.80. - # todo: download https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/dnsmasq_2.84~~test3-1_mipsel_24kc.ipk - # and install it. then we can turn off dnssec in systemd-resolved + # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80. + # also we can turn off dnssec in systemd-resolved if we know the router is doing it. # # Also, reload of dnsmasq seems to break things, wifi # clients were not getting internet connectivity. + v /etc/init.d/dnsmasq restart fi -if $firewall_restart; then +if $ap; then + v /etc/init.d/firewall disable + v /etc/init.d/firewall stop +elif $firewall_restart; then v /etc/init.d/firewall restart fi +## turn off luci +# if already stopped, gives error we want to ignore +/etc/init.d/uhttpd stop |& sed '1{/^Command failed/d}' +/etc/init.d/uhttpd disable |& sed '1{/^Command failed/d}' + # this may just restart the network and take care of the network_restart below. if $wireless_restart; then v wifi @@ -891,4 +1225,4 @@ if $network_restart; then reboot fi -exit 0 +v exit 0