1ce27acd64afb8eae9d0fb8a5cd666c882ec511b
[distro-setup] / mail-route
1 #!/bin/bash
2 # I, Ian Kelling, follow the GNU license recommendations at
3 # https://www.gnu.org/licenses/license-recommendations.en.html. They
4 # recommend that small programs, < 300 lines, be licensed under the
5 # Apache License 2.0. This file contains or is part of one or more small
6 # programs. If a small program grows beyond 300 lines, I plan to switch
7 # its license to GPL.
8
9 # Copyright 2024 Ian Kelling
10
11 # Licensed under the Apache License, Version 2.0 (the "License");
12 # you may not use this file except in compliance with the License.
13 # You may obtain a copy of the License at
14
15 # http://www.apache.org/licenses/LICENSE-2.0
16
17 # Unless required by applicable law or agreed to in writing, software
18 # distributed under the License is distributed on an "AS IS" BASIS,
19 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 # See the License for the specific language governing permissions and
21 # limitations under the License.
22
23
24 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
25
26 #set -x
27 #exec &> >(logger)
28
29 source /a/bin/bash-bear-trap/bash-bear
30
31 usage() {
32 cat <<'EOF'
33 Usage: mail-route up|down|show
34
35 Marks tcp packets on port 25, 143 and 587 to be routed through
36 a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the
37 tun_dev, and action is from $script_type env variable, openvpn sets this.
38
39 It is idempotent.
40
41 I'm not using this script currently:
42 The problem with this approach is that if we dont have a non-vpn global
43 ipv6 address and route, we need to send all ipv6 traffic through the
44 vpn. Using a network namespace for the vpn fixes that, so I've switched
45 over to that. We could still use this script inside the network
46 namespace, and I have tested it, but it is just unneeded
47 complexity. Simpler to just have a default route to the vpn. This script
48 does separate out lan ip ranges for ipv4, but we could also do that with
49 a simple route.
50
51 EOF
52 exit $1
53 }
54
55 if (( $# < 1 )); then
56 usage 1
57 fi
58
59 up() {
60 start=true
61 stop=false
62 iptables_op=-A
63 ip_op=add
64 timeout_secs=20
65 if [[ ! $tun_dev ]]; then
66 # delays because I was running this outside of openvpn before
67 found=false
68 for ((i=1; i<=timeout_secs; i++)); do
69 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
70 if [[ $tun_dev == tun* ]]; then
71 found=true
72 break
73 fi
74 sleep 1
75 done
76 if ! $found; then
77 echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
78 exit 1
79 fi
80 fi
81 e() { echo "$0: $*"; "$@"; }
82 err-cleanup() { stop; }
83 modify
84 # we leave it as is even when stopping, because we would like it to be default, but the only way
85 # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
86 val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
87 if [[ $val != 2 ]]; then
88 echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
89 e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
90 fi
91
92 }
93 down() {
94 start=false
95 stop=true
96 iptables_op=-D
97 ip_op=del
98 # note, this is not going to work if the interface has been deleted.
99 # we could also check for an iptable rule that on some tun interface like the one
100 # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
101 if [[ ! $tun_dev ]]; then
102 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
103 fi
104 e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
105 modify
106 }
107
108 show() {
109 e() { printf "=================================\n# %s\n\n" "$*"; "$@"; }
110 e iptables -t mangle -S
111 e ip6tables -t mangle -S
112 e iptables -t nat -S
113 e ip rule
114 e ip -6 rule
115 e ip route show table 1
116 e ip -6 route show table 1
117 e ip -6 route show default
118
119 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
120 if [[ $tun_dev == tun* ]]; then
121 e sysctl net.ipv4.conf.$tun_dev.rp_filter
122 else
123 echo "$0: note, no tun device found"
124 fi
125 exit 0
126 }
127
128 runtest() {
129 # debugging:
130 #echo start=$start stop=$stop exists=$exists
131 { $start && ! $exists; } || { $stop && $exists; }
132 }
133
134 iptmod() { #iptables modify
135 local cmd="$*"
136 local exists=true
137 ${cmd/-[AD]/-C} &>/dev/null || exists=false
138 if runtest; then e $cmd; fi
139 }
140
141 # code common to start and stop.
142 modify() {
143 # match source or dest port. note, when we send to a port, it picks a random high port as
144 # the source.
145
146 if [[ $HOSTNAME == bk ]]; then
147 ports=25
148 ipsuf=5
149 else
150 ports=25,143,587
151 ipsuf=4
152 fi
153 iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $ports -j MARK --set-mark"
154 iptmod iptables -t mangle $iptables_op $iptcommon 0x1
155 iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
156 # note, we could have used a custom chain and returned instead of setting the mark again.
157 # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
158 iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3
159
160 if [[ $tun_dev ]]; then
161 # when $tun_dev goes away, so does this rule.
162 iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.$ipsuf
163 iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e002:3800::$ipsuf
164 fi
165
166
167 iprulecmd="fwmark 1 table 1"
168 for v in -4 -6; do
169 exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false
170 if runtest; then e ip $v rule $ip_op $iprulecmd; fi
171 done
172
173 iproutecmd="default via 10.8.0.1 table 1"
174 exists=true; ip route show $iproutecmd 2>/dev/null | grep . &>/dev/null || exists=false
175 if runtest; then e ip route $ip_op $iproutecmd; fi
176 if [[ $tun_dev ]]; then
177 # when $tun_dev goes away, so does this route.
178 iproutecmd="default dev $tun_dev table 1"
179 exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
180 if runtest; then e ip -6 route $ip_op $iproutecmd; fi
181
182 # We have to ensure we have a normal default ipv6 route, or else linux will
183 # refuse to do send ipv6 packets at all. When running in a network namespace,
184 # having the table 1 route is totally redundant since I dont setup a
185 # normal default ipv6 route. But maybe I will someday.
186 #
187 # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but
188 # metric seems to be perfectly good. 6000 because on my home comp,
189 # its about 6 times slower to ping google than the default 1024 metric.
190 # See commit 572dd5847440e58481ee2d7b9080 for using an ipv6 test.
191 iproutecmd="default dev $tun_dev"
192 exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
193 if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi
194 fi
195 # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
196 # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
197 # so, eh, might as well. some rhel docs recommend using it.
198
199
200 }
201
202 if (( $# > 1 )); then
203 tun_dev=$1
204 # environment var from openvpn
205 # shellcheck disable=SC2154
206 $script_type
207 else
208 case $1 in
209 up|down|show) $1 ;;
210 *) usage 1 ;;
211 esac
212 fi
213
214 exit 0
215
216
217 # background: something like this does not work for packets which
218 # exim is replying to. I don't know why.
219 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
220 #
221 # note: exim will misreport the I= interface for remote hosts that would
222 # not use the default route. It still goes through the vpn, you can
223 # verify with tcpdump.