#!/bin/bash
# Copyright (C) 2016 Ian Kelling
-
+set -x
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
-source /a/bin/errhandle/errcatch-function
-source /a/bin/errhandle/errallow-function
-source /a/bin/errhandle/bash-trace-function
-errcatch
+source /a/bin/errhandle/err
usage() {
- cat <<'EOF'
+ cat <<'EOF'
Usage: mail-route up|down|show
Marks tcp packets on port 25 and 143 to be routed through
Is idempotent.
EOF
- exit $1
+ exit $1
}
if (( $# < 1 )); then
- usage 1
+ usage 1
fi
up() {
- start=true
- stop=false
- iptables_op=-A
- ip_op=add
- if [[ ! $tun_dev ]]; then
- # delays because I was running this outside of openvpn before
- found=false
- for ((i=1; i<=30; i++)); do
- tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
- if [[ $tun_dev == tun* ]]; then
- found=true
- break
- fi
- sleep 1
- done
- if ! $found; then
- echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
- exit 1
- fi
+ start=true
+ stop=false
+ iptables_op=-A
+ ip_op=add
+ timeout_secs=20
+ if [[ ! $tun_dev ]]; then
+ # delays because I was running this outside of openvpn before
+ found=false
+ for ((i=1; i<=timeout_secs; i++)); do
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ found=true
+ break
+ fi
+ sleep 1
+ done
+ if ! $found; then
+ echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
+ exit 1
fi
- e() { echo "$0: $*"; "$@"; }
- _errcatch_cleanup=stop
- modify
- # we leave it as is even when stopping, because we would like it to be default, but the only way
- # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+ fi
+ e() { echo "$0: $*"; "$@"; }
+ _errcatch_cleanup=stop
+ modify
+ # we leave it as is even when stopping, because we would like it to be default, but the only way
+ # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+ val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
+ if [[ $val != 2 ]]; then
+ echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
+ fi
+
}
down() {
- start=false
- stop=true
- iptables_op=-D
- ip_op=del
- # note, this is not going to work if the interface has been deleted.
- # we could also check for an iptable rule that on some tun interface like the one
- # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
- if [[ ! tun_dev ]]; then
+ start=false
+ stop=true
+ iptables_op=-D
+ ip_op=del
+ # note, this is not going to work if the interface has been deleted.
+ # we could also check for an iptable rule that on some tun interface like the one
+ # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
+ if [[ ! tun_dev ]]; then
tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
- fi
- e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
- modify
+ fi
+ e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
+ modify
}
show() {
- e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
- e iptables -t mangle -S
- e iptables -t nat -S
- e ip rule
- e ip route show table 1
-
- tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
- if [[ $tun_dev == tun* ]]; then
- e sysctl net.ipv4.conf.$tun_dev.rp_filter
- else
- echo "$0: note, no tun device found"
- fi
- exit 0
+ e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
+ e iptables -t mangle -S
+ e iptables -t nat -S
+ e ip rule
+ e ip route show table 1
+
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ e sysctl net.ipv4.conf.$tun_dev.rp_filter
+ else
+ echo "$0: note, no tun device found"
+ fi
+ exit 0
}
runtest() {
- # debugging:
- #echo start=$start stop=$stop exists=$exists
- { $start && ! $exists; } || { $stop && $exists; }
+ # debugging:
+ #echo start=$start stop=$stop exists=$exists
+ { $start && ! $exists; } || { $stop && $exists; }
}
iptmod() { #iptables modify
- local check cmd="$*" exists=true
- ${cmd/-[AD]/-C} &>/dev/null || exists=false
- if runtest; then e $cmd; fi
+ local check cmd="$*" exists=true
+ ${cmd/-[AD]/-C} &>/dev/null || exists=false
+ if runtest; then e $cmd; fi
}
# code common to start and stop.
modify() {
- # match source or dest port. note, when we send to a port, it picks a random high port as
- # the source.
- for port in 25 143; do # smtp and imap.
- iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
- iptmod iptables -t mangle $iptables_op $iptcommon 0x1
- iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
- # note, we could have used a custom chain and returned instead of setting the mark again.
- # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
- done
+ # match source or dest port. note, when we send to a port, it picks a random high port as
+ # the source.
+ for port in 25 143; do # smtp and imap.
+ iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
+ iptmod iptables -t mangle $iptables_op $iptcommon 0x1
+ iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+ # note, we could have used a custom chain and returned instead of setting the mark again.
+ # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+ done
- if [[ $tun_dev ]]; then
- # when $tun_dev goes away, so does this rul
- iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
- fi
+ if [[ $tun_dev ]]; then
+ # when $tun_dev goes away, so does this rul
+ iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+ fi
- iprulecmd="fwmark 1 table 1"
- exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
- if runtest; then e ip rule $ip_op $iprulecmd; fi
+ iprulecmd="fwmark 1 table 1"
+ exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip rule $ip_op $iprulecmd; fi
- iproutecmd="default via 10.8.0.1 table 1"
- exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
- if runtest; then e ip route $ip_op $iproutecmd; fi
+ iproutecmd="default via 10.8.0.1 table 1"
+ exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip route $ip_op $iproutecmd; fi
- # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
- # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
- # so, eh, might as well. some rhel docs recommend using it.
+ # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
+ # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
+ # so, eh, might as well. some rhel docs recommend using it.
}
if (( $# > 1 )); then
-tun_dev=$1
-$script_type
+ tun_dev=$1
+ $script_type
else
- case $1 in
- up|down|show) $1 ;;
- *) usage 1 ;;
- esac
+ case $1 in
+ up|down|show) $1 ;;
+ *) usage 1 ;;
+ esac
fi
iankelling.org / git / distro-setup / blobdiff