iankelling.org Git - distro-setup/blob - mail-route

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
  17
  18 source /a/bin/errhandle/errcatch-function
  19 source /a/bin/errhandle/errallow-function
  20 source /a/bin/errhandle/bash-trace-function
  21 errcatch
  22
  23 usage() {
  24     cat <<'EOF'
  25 Usage: mail-route up|down|show
  26
  27 Marks tcp packets on port 25 and 143 to be routed through
  28 a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the
  29 tun_dev, and action is from $script_type.
  30
  31 Is idempotent.
  32 EOF
  33     exit $1
  34 }
  35
  36 if (( $# < 1 )); then
  37     usage 1
  38 fi
  39
  40 up() {
  41     start=true
  42     stop=false
  43     iptables_op=-A
  44     ip_op=add
  45     if [[ ! $tun_dev ]]; then
  46         # delays because I was running this outside of openvpn before
  47         found=false
  48         for ((i=1; i<=30; i++)); do
  49             tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  50             if [[ $tun_dev == tun* ]]; then
  51                 found=true
  52                 break
  53             fi
  54             sleep 1
  55         done
  56         if ! $found; then
  57             echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
  58             exit 1
  59         fi
  60     fi
  61     e() { echo "$0: $*"; "$@"; }
  62     _errcatch_cleanup=stop
  63     modify
  64     # we leave it as is even when stopping, because we would like it to be default, but the only way
  65     # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
  66     e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
  67 }
  68 down() {
  69     start=false
  70     stop=true
  71     iptables_op=-D
  72     ip_op=del
  73     # note, this is not going to work if the interface has been deleted.
  74     # we could also check for an iptable rule that on some tun interface like the one
  75     # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
  76     if [[ ! tun_dev ]]; then
  77     tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  78     fi
  79     e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
  80     modify
  81 }
  82
  83 show() {
  84     e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
  85     e iptables -t mangle -S
  86     e iptables -t nat -S
  87     e ip rule
  88     e ip route show table 1
  89
  90     tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  91     if [[ $tun_dev == tun* ]]; then
  92         e sysctl net.ipv4.conf.$tun_dev.rp_filter
  93     else
  94         echo "$0: note, no tun device found"
  95     fi
  96     exit 0
  97 }
  98
  99 runtest() {
 100     # debugging:
 101     #echo start=$start stop=$stop exists=$exists
 102     { $start && ! $exists; } || { $stop && $exists; }
 103 }
 104
 105 iptmod() { #iptables modify
 106     local check cmd="$*" exists=true
 107     ${cmd/-[AD]/-C} &>/dev/null || exists=false
 108     if runtest; then e $cmd; fi
 109 }
 110
 111 # code common to start and stop.
 112 modify() {
 113     # match source or dest port. note, when we send to a port, it picks a random high port as
 114     # the source.
 115     for port in 25 143; do # smtp and imap.
 116         iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
 117         iptmod iptables -t mangle $iptables_op $iptcommon 0x1
 118         iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 119         # note, we could have used a custom chain and returned instead of setting the mark again.
 120         # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
 121     done
 122
 123     if [[ $tun_dev ]]; then
 124         # when $tun_dev goes away, so does this rul
 125         iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
 126     fi
 127
 128
 129     iprulecmd="fwmark 1 table 1"
 130     exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
 131     if runtest; then e ip rule $ip_op $iprulecmd; fi
 132
 133     iproutecmd="default via 10.8.0.1 table 1"
 134     exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
 135     if runtest; then e ip route $ip_op $iproutecmd; fi
 136
 137     # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
 138     # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
 139     # so, eh, might as well. some rhel docs recommend using it.
 140
 141
 142 }
 143
 144 if (( $# > 1 )); then
 145 tun_dev=$1
 146 $script_type
 147 else
 148     case $1 in
 149         up|down|show) $1 ;;
 150         *) usage 1 ;;
 151     esac
 152 fi
 153
 154
 155
 156 exit 0
 157
 158
 159 # background: something like this does not work for packets which
 160 # exim is replying to. I don't know why.
 161 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1