#!/bin/bash
# Copyright (C) 2016 Ian Kelling

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#     http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"

source /a/bin/errhandle/errcatch-function
source /a/bin/errhandle/errallow-function
source /a/bin/errhandle/bash-trace-function
errcatch

usage() {
    cat <<'EOF'
Usage: mail-route start|stop|show

Marks tcp packets on port 25 and 143 to be routed through
a vpn ip.
EOF
    exit $1
}

if (( $# != 1 )); then
    usage 1
fi

start() {
    iptables_op=-A
    ip_op=add
    # systemd around stretch release time, would wait until openvpn actually connected,
    # so this was unnecessary, but now it returns immediately.
    found=false
    for ((i=1; i<=30; i++)); do
        tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
        if [[ $tun_dev == tun* ]]; then
            found=true
            break
        fi
        sleep 1
    done
    if ! $found; then
        echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
        exit 1
    fi
    e() { "$@"; }
    _errcatch_cleanup=stop
    modify
}
stop() {
    iptables_op=-D
    ip_op=del
    tun_dev=$(iptables -t nat -S | sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|head -n1) || printf "failed to find tun device.\n"
    e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
    modify
}

show() {
    e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
    e iptables -t mangle -S
    e iptables -t nat -S
    e ip rule
    e ip route show table 1

    tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
    if [[ $tun_dev == tun* ]]; then
        e sysctl net.ipv4.conf.$tun_dev.rp_filter
    else
        echo "$0: note, no tun device found"
    fi
    exit 0
}


# code common to start and stop.
modify() {
    # match source or dest port. note, when we send to a port, it picks a random high port as
    # the source.
    for port in 25 143; do # smtp and imap.
        e iptables -t mangle $iptables_op \
          OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
        e iptables -t mangle $iptables_op \
          OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
          -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
        # note, we could have used a custom chain and returned instead of setting the mark again.
        # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3

    done
    e iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
    e ip rule $ip_op fwmark 1 table 1
    # note, this rule does not persist when the tun interface is deleted
    e ip route $ip_op default via 10.8.0.1 table 1

    # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
    # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
    # so, eh, might as well. some rhel docs recommend using it.
    e sysctl net.ipv4.conf.$tun_dev.rp_filter=2

    exit 0
}

case $1 in
    start|stop|show) $1 ;;
    *) usage 1 ;;
esac


# background: something like this does not work for packets which
# exim is replying to. I don't know why.
#iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1