iankelling.org Git - distro-setup/blob - mail-route

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
  17
  18 source /a/bin/errhandle/errcatch-function
  19 source /a/bin/errhandle/errallow-function
  20 source /a/bin/errhandle/bash-trace-function
  21 errcatch
  22
  23 usage() {
  24     cat <<'EOF'
  25 Usage: mail-route start|stop|show
  26
  27 Marks tcp packets on port 25 and 143 to be routed through
  28 a vpn ip.
  29 EOF
  30     exit $1
  31 }
  32
  33 if (( $# != 1 )); then
  34     usage 1
  35 fi
  36 case $1 in
  37     start)
  38         iptables_op=-A
  39         ip_op=add
  40         # systemd around stretch release time, would wait until openvpn actually connected,
  41         # so this was unnecessary, but now it returns immediately.
  42         while true; do
  43             tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
  44             if [[ $tun_dev == tun* ]]; then
  45                 break
  46             fi
  47             echo "$0: waiting for tun_dev, found: $tun_dev"
  48             sleep 4
  49         done
  50         e() { "$@"; }
  51         ;;
  52     stop)
  53         iptables_op=-D
  54         ip_op=del
  55         tun_dev=$(iptables -t nat -S | sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|head -n1) || printf "failed to find tun device.\n"
  56         e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
  57         ;;
  58     show)
  59         e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
  60         e iptables -t mangle -S
  61         e iptables -t nat -S
  62         e ip rule
  63         e ip route show table 1
  64         exit 0
  65         ;;
  66     *)
  67         usage 1
  68         ;;
  69 esac
  70
  71
  72 # note, something like this does not work for packets which
  73 # exim is replying to. I don't know why.
  74 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
  75
  76 # match source or dest port. when we send to 25, it picks a random high port as
  77 # the source.
  78
  79 for port in 25 143; do # smtp and imap.
  80     e iptables -t mangle $iptables_op \
  81       OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
  82     e iptables -t mangle $iptables_op \
  83       OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
  84       -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
  85     # note, we could have used a custom chain and returned instead of setting the mark again.
  86     # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
  87
  88 done
  89 e iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
  90 e ip rule $ip_op fwmark 1 table 1
  91 # note, this rule does not persist when the tun interface is deleted
  92 e ip route $ip_op default via 10.8.0.1 table 1
  93
  94 exit 0