iankelling.org Git - distro-setup/blob - mail-route

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6
   7 #     http://www.apache.org/licenses/LICENSE-2.0
   8
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12 # See the License for the specific language governing permissions and
  13 # limitations under the License.
  14
  15 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
  16
  17 source /a/bin/errhandle/err
  18
  19 usage() {
  20   cat <<'EOF'
  21 Usage: mail-route up|down|show
  22
  23 Marks tcp packets on port 25, 143 and 587 to be routed through
  24 a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the
  25 tun_dev, and action is from $script_type.
  26
  27 Is idempotent.
  28
  29
  30 todo: Need to give mail.iankelling.org an ipv6 dns address.
  31
  32 EOF
  33   exit $1
  34 }
  35
  36 if (( $# < 1 )); then
  37   usage 1
  38 fi
  39
  40 up() {
  41   start=true
  42   stop=false
  43   iptables_op=-A
  44   ip_op=add
  45   timeout_secs=20
  46   if [[ ! $tun_dev ]]; then
  47     # delays because I was running this outside of openvpn before
  48     found=false
  49     for ((i=1; i<=timeout_secs; i++)); do
  50       tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  51       if [[ $tun_dev == tun* ]]; then
  52         found=true
  53         break
  54       fi
  55       sleep 1
  56     done
  57     if ! $found; then
  58       echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
  59       exit 1
  60     fi
  61   fi
  62   e() { echo "$0: $*"; "$@"; }
  63   _errcatch_cleanup=stop
  64   modify
  65   # we leave it as is even when stopping, because we would like it to be default, but the only way
  66   # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
  67   val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
  68   if [[ $val != 2 ]]; then
  69     echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
  70     e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
  71   fi
  72
  73 }
  74 down() {
  75   start=false
  76   stop=true
  77   iptables_op=-D
  78   ip_op=del
  79   # note, this is not going to work if the interface has been deleted.
  80   # we could also check for an iptable rule that on some tun interface like the one
  81   # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
  82   if [[ ! $tun_dev ]]; then
  83     tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  84   fi
  85   e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
  86   modify
  87 }
  88
  89 show() {
  90   printf "$(tput setaf 5)█$(tput sgr0)%.0s" $(seq ${COLUMNS:-60});
  91   echo
  92   e() { printf "=================================\n# %s\n\n" "$*"; "$@"; }
  93   e iptables -t mangle -S
  94   e ip6tables -t mangle -S
  95   e iptables -t nat -S
  96   e ip rule
  97   e ip -6 rule
  98   e ip route show table 1
  99   e ip -6 route show table 1
 100   e ip -6 route show default
 101
 102   tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
 103   if [[ $tun_dev == tun* ]]; then
 104     e sysctl net.ipv4.conf.$tun_dev.rp_filter
 105   else
 106     echo "$0: note, no tun device found"
 107   fi
 108   exit 0
 109 }
 110
 111 runtest() {
 112   # debugging:
 113   #echo start=$start stop=$stop exists=$exists
 114   { $start && ! $exists; } || { $stop && $exists; }
 115 }
 116
 117 iptmod() { #iptables modify
 118   local cmd="$*"
 119   local exists=true
 120   ${cmd/-[AD]/-C} &>/dev/null || exists=false
 121   if runtest; then e $cmd; fi
 122 }
 123
 124 # code common to start and stop.
 125 modify() {
 126   # match source or dest port. note, when we send to a port, it picks a random high port as
 127   # the source.
 128
 129   iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports 25,143,587 -j MARK --set-mark"
 130   iptmod iptables -t mangle $iptables_op $iptcommon 0x1
 131   iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
 132   # note, we could have used a custom chain and returned instead of setting the mark again.
 133   # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
 134   iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3
 135
 136   if [[ $tun_dev ]]; then
 137     # when $tun_dev goes away, so does this rule.
 138     iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
 139     iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e000:280::2
 140
 141   fi
 142
 143
 144   iprulecmd="fwmark 1 table 1"
 145   for v in -4 -6; do
 146     exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false
 147     if runtest; then e ip $v rule $ip_op $iprulecmd; fi
 148   done
 149
 150   iproutecmd="default via 10.8.0.1 table 1"
 151   exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
 152   if runtest; then e ip route $ip_op $iproutecmd; fi
 153   if [[ $tun_dev ]]; then
 154     # when $tun_dev goes away, so does this route.
 155     iproutecmd="default dev $tun_dev table 1"
 156     exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
 157     if runtest; then e ip -6 route $ip_op $iproutecmd; fi
 158
 159     # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but
 160     # metric seems to be perfectly good. 6000 because on my home comp,
 161     # its about 6 times slower to ping google, than the default 1024 metric.
 162     iproutecmd="default dev $tun_dev"
 163     exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
 164     if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi
 165   fi
 166   # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
 167   # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
 168   # so, eh, might as well. some rhel docs recommend using it.
 169
 170
 171 }
 172
 173 if (( $# > 1 )); then
 174   tun_dev=$1
 175   $script_type
 176 else
 177   case $1 in
 178     up|down|show) $1 ;;
 179     *) usage 1 ;;
 180   esac
 181 fi
 182
 183 exit 0
 184
 185
 186 # background: something like this does not work for packets which
 187 # exim is replying to. I don't know why.
 188 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
 189 #
 190 # note: exim will misreport the I= interface for remote hosts that would
 191 # not use the default route. It still goes through the vpn, you can
 192 # verify with tcpdump.