better arg checking
[distro-setup] / mail-route
1 #!/bin/bash
2 # Copyright (C) 2016 Ian Kelling
3 set -x
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7
8 # http://www.apache.org/licenses/LICENSE-2.0
9
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
17
18 source /a/bin/errhandle/err
19
20 usage() {
21 cat <<'EOF'
22 Usage: mail-route up|down|show
23
24 Marks tcp packets on port 25, 143 and 587 to be routed through
25 a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the
26 tun_dev, and action is from $script_type.
27
28 Is idempotent.
29 EOF
30 exit $1
31 }
32
33 if (( $# < 1 )); then
34 usage 1
35 fi
36
37 up() {
38 start=true
39 stop=false
40 iptables_op=-A
41 ip_op=add
42 timeout_secs=20
43 if [[ ! $tun_dev ]]; then
44 # delays because I was running this outside of openvpn before
45 found=false
46 for ((i=1; i<=timeout_secs; i++)); do
47 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
48 if [[ $tun_dev == tun* ]]; then
49 found=true
50 break
51 fi
52 sleep 1
53 done
54 if ! $found; then
55 echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
56 exit 1
57 fi
58 fi
59 e() { echo "$0: $*"; "$@"; }
60 _errcatch_cleanup=stop
61 modify
62 # we leave it as is even when stopping, because we would like it to be default, but the only way
63 # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
64 val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
65 if [[ $val != 2 ]]; then
66 echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
67 e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
68 fi
69
70 }
71 down() {
72 start=false
73 stop=true
74 iptables_op=-D
75 ip_op=del
76 # note, this is not going to work if the interface has been deleted.
77 # we could also check for an iptable rule that on some tun interface like the one
78 # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
79 if [[ ! tun_dev ]]; then
80 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
81 fi
82 e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
83 modify
84 }
85
86 show() {
87 e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
88 e iptables -t mangle -S
89 e iptables -t nat -S
90 e ip rule
91 e ip route show table 1
92
93 tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
94 if [[ $tun_dev == tun* ]]; then
95 e sysctl net.ipv4.conf.$tun_dev.rp_filter
96 else
97 echo "$0: note, no tun device found"
98 fi
99 exit 0
100 }
101
102 runtest() {
103 # debugging:
104 #echo start=$start stop=$stop exists=$exists
105 { $start && ! $exists; } || { $stop && $exists; }
106 }
107
108 iptmod() { #iptables modify
109 local check cmd="$*" exists=true
110 ${cmd/-[AD]/-C} &>/dev/null || exists=false
111 if runtest; then e $cmd; fi
112 }
113
114 # code common to start and stop.
115 modify() {
116 # match source or dest port. note, when we send to a port, it picks a random high port as
117 # the source.
118 for port in 25 143 587; do # smtp and imap.
119 iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
120 iptmod iptables -t mangle $iptables_op $iptcommon 0x1
121 iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
122 # note, we could have used a custom chain and returned instead of setting the mark again.
123 # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
124 done
125
126 if [[ $tun_dev ]]; then
127 # when $tun_dev goes away, so does this rul
128 iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
129 fi
130
131
132 iprulecmd="fwmark 1 table 1"
133 exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
134 if runtest; then e ip rule $ip_op $iprulecmd; fi
135
136 iproutecmd="default via 10.8.0.1 table 1"
137 exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
138 if runtest; then e ip route $ip_op $iproutecmd; fi
139
140 # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
141 # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
142 # so, eh, might as well. some rhel docs recommend using it.
143
144
145 }
146
147 if (( $# > 1 )); then
148 tun_dev=$1
149 $script_type
150 else
151 case $1 in
152 up|down|show) $1 ;;
153 *) usage 1 ;;
154 esac
155 fi
156
157
158
159 exit 0
160
161
162 # background: something like this does not work for packets which
163 # exim is replying to. I don't know why.
164 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1