iankelling.org Git - distro-setup/blob - trusted-network

   1 #!/bin/bash
   2
   3 # Usage: run to trust or untrust dns. public wifi sometimes needs to
   4 # trust dns initially to log in.
   5
   6
   7 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
   8
   9 source /a/bin/errhandle/err
  10
  11 readonly this_file=$(readlink -f -- "${BASH_SOURCE[0]}")
  12 readonly this_dir="${this_file%/*}"
  13 script_name="${BASH_SOURCE[0]}"
  14 script_name="${script_name##*/}"
  15
  16 # removes malware and adult content
  17 servers=(1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003)
  18
  19 servers=(1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001)
  20
  21 ## trying out google
  22 servers=(8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844)
  23
  24
  25
  26 m() { printf "%s\n" "$*";  "$@"; }
  27 e() { printf "%s\n" "$@"; }
  28 i() { # install file
  29   local tmp tmpdir dest="$1"
  30   local base="${dest##*/}"
  31   mkdir -p ${dest%/*}
  32   ir=false # i result
  33   tmpdir=$(mktemp -d)
  34   cat >$tmpdir/"$base"
  35   tmp=$(rsync -ic $tmpdir/"$base" "$dest")
  36   if [[ $tmp ]]; then
  37     printf "%s\n" "$tmp"
  38     ir=true
  39   fi
  40   rm -rf $tmpdir
  41 }
  42
  43 # i symlinked the script to another name to make it work different
  44 trust=true
  45 case $script_name in
  46   untrusted-network)
  47     trust=false
  48     ;;
  49 esac
  50
  51
  52 if $trust; then
  53   if [[ -e /etc/NetworkManager/conf.d/dns.conf ]]; then
  54     rm -fv /etc/NetworkManager/conf.d/dns.conf
  55     if [[ $(systemctl is-active NetworkManager) == active ]]; then
  56       m systemctl restart NetworkManager
  57     fi
  58   fi
  59
  60   rm -fv /etc/systemd/resolved.conf.d/untrusted-network.conf
  61 else  #untrusted
  62   # https://wiki.archlinux.org/index.php/Systemd-resolved#Manually
  63   cat >/etc/systemd/resolved.conf.d/untrusted-network.conf <<EOF
  64 [Resolve]
  65 DNS=${servers[@]}
  66 Domains=b8.nz
  67 DNSOverTLS=yes
  68 EOF
  69
  70   i /etc/NetworkManager/conf.d/dns.conf <<'EOF'
  71 [main]
  72 dns=none
  73 systemd-resolved=false
  74 EOF
  75
  76   if $ir && [[ $(systemctl is-active NetworkManager) == active ]]; then
  77     m systemctl restart NetworkManager
  78   fi
  79 fi
  80
  81 dhclient_restart=false
  82 # man dhclient.conf
  83 if ! grep -qP '\bdomain-name-servers\b' /etc/dhcp/dhclient.conf; then
  84   sed -i 's/^ *request/request domain-name-servers,/' /etc/dhcp/dhclient.conf
  85   dhclient_restart=true
  86   e $0: dhclient_restart=true
  87 fi
  88
  89
  90 # wait for networkmanager to come back
  91 for f in {1..20}; do
  92   if read -r _ _ _ _  gateway_if _ < <(ip route get 8.8.8.8); then
  93     break
  94   fi
  95   m sleep 2
  96 done
  97
  98
  99 if [[ $gateway_if ]]; then
 100   # we could do this, but dhclient is still running and will use its old settings
 101   # from dependencies of ifupdown,
 102   # from man dhclient-script
 103   # from /etc/dhcp/dhclient-enter-hooks.d/resolved
 104   # rm -f /run/systemd/resolved.conf.d/*$gateway_if*
 105
 106
 107   if $dhclient_restart && grep -Pq "^ *auto ($gateway_if|.* $gateway_if( |$))" /etc/network/interfaces; then
 108     m ifdown $gateway_if
 109     m ifup $gateway_if
 110   fi
 111
 112   # At least on systemd 237 ifupdown it sets a global and this is not
 113   # needed. we are way past that, but I dont think it hurts.
 114   resolvectl revert $gateway_if
 115 else
 116   e $0: no gateway_if found
 117 fi
 118
 119 m systemctl restart systemd-resolved
 120
 121
 122
 123 # just for curiosity i did a
 124 # wrapper around dhclient, then ifdown eth0; ifup eth0:
 125
 126 # Tue Mar  9 18:29:05 EST 2021
 127 # args -4 -v -r -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
 128 # env
 129 # ADDRFAM=inet
 130 # PHASE=pre-down
 131 # VERBOSITY=0
 132 # PWD=/sbin
 133 # IFACE=eth0
 134 # METHOD=dhcp
 135 # SHLVL=1
 136 # LOGICAL=eth0
 137 # MODE=stop
 138 # PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 139 # IFUPDOWN_eth0=pre-down
 140 # _=/usr/bin/env
 141 # Tue Mar  9 18:29:07 EST 2021
 142 # args -1 -4 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
 143 # env
 144 # ADDRFAM=inet
 145 # PHASE=post-up
 146 # VERBOSITY=0
 147 # PWD=/sbin
 148 # IFACE=eth0
 149 # METHOD=dhcp
 150 # SHLVL=1
 151 # LOGICAL=eth0
 152 # MODE=start
 153 # PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 154 # IFUPDOWN_eth0=post-up
 155 # _=/usr/bin/env