X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-route;h=11f92c60513709bd9b400bb61a00879745034edd;hp=81a3ccb73dcc7b1f797353df5c6ea56ba546aa09;hb=2d3ce30754a3f24d922635647bab4990b60f5c27;hpb=2cff2dd2b8040e6cbd721932ae09142881d7e0a6

diff --git a/mail-route b/mail-route
index 81a3ccb..11f92c6 100755
--- a/mail-route
+++ b/mail-route
@@ -1,6 +1,6 @@
 #!/bin/bash
 # Copyright (C) 2016 Ian Kelling
-
+set -x
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -15,13 +15,10 @@
 
 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
 
-source /a/bin/errhandle/errcatch-function
-source /a/bin/errhandle/errallow-function
-source /a/bin/errhandle/bash-trace-function
-errcatch
+source /a/bin/errhandle/err
 
 usage() {
-    cat <<'EOF'
+  cat <<'EOF'
 Usage: mail-route up|down|show
 
 Marks tcp packets on port 25 and 143 to be routed through
@@ -30,125 +27,131 @@ tun_dev, and action is from $script_type.
 
 Is idempotent.
 EOF
-    exit $1
+  exit $1
 }
 
 if (( $# < 1 )); then
-    usage 1
+  usage 1
 fi
 
 up() {
-    start=true
-    stop=false
-    iptables_op=-A
-    ip_op=add
-    if [[ ! $tun_dev ]]; then
-        # delays because I was running this outside of openvpn before
-        found=false
-        for ((i=1; i<=30; i++)); do
-            tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
-            if [[ $tun_dev == tun* ]]; then
-                found=true
-                break
-            fi
-            sleep 1
-        done
-        if ! $found; then
-            echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
-            exit 1
-        fi
+  start=true
+  stop=false
+  iptables_op=-A
+  ip_op=add
+  timeout_secs=20
+  if [[ ! $tun_dev ]]; then
+    # delays because I was running this outside of openvpn before
+    found=false
+    for ((i=1; i<=timeout_secs; i++)); do
+      tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+      if [[ $tun_dev == tun* ]]; then
+        found=true
+        break
+      fi
+      sleep 1
+    done
+    if ! $found; then
+      echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
+      exit 1
     fi
-    e() { echo "$0: $*"; "$@"; }
-    _errcatch_cleanup=stop
-    modify
-    # we leave it as is even when stopping, because we would like it to be default, but the only way
-    # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+  fi
+  e() { echo "$0: $*"; "$@"; }
+  _errcatch_cleanup=stop
+  modify
+  # we leave it as is even when stopping, because we would like it to be default, but the only way
+  # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+  val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
+  if [[ $val != 2 ]]; then
+    echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
     e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
+  fi
+
 }
 down() {
-    start=false
-    stop=true
-    iptables_op=-D
-    ip_op=del
-    # note, this is not going to work if the interface has been deleted.
-    # we could also check for an iptable rule that on some tun interface like the one
-    # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
-    if [[ ! tun_dev ]]; then
+  start=false
+  stop=true
+  iptables_op=-D
+  ip_op=del
+  # note, this is not going to work if the interface has been deleted.
+  # we could also check for an iptable rule that on some tun interface like the one
+  # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
+  if [[ ! tun_dev ]]; then
     tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
-    fi
-    e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
-    modify
+  fi
+  e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
+  modify
 }
 
 show() {
-    e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
-    e iptables -t mangle -S
-    e iptables -t nat -S
-    e ip rule
-    e ip route show table 1
-
-    tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
-    if [[ $tun_dev == tun* ]]; then
-        e sysctl net.ipv4.conf.$tun_dev.rp_filter
-    else
-        echo "$0: note, no tun device found"
-    fi
-    exit 0
+  e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
+  e iptables -t mangle -S
+  e iptables -t nat -S
+  e ip rule
+  e ip route show table 1
+
+  tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+  if [[ $tun_dev == tun* ]]; then
+    e sysctl net.ipv4.conf.$tun_dev.rp_filter
+  else
+    echo "$0: note, no tun device found"
+  fi
+  exit 0
 }
 
 runtest() {
-    # debugging:
-    #echo start=$start stop=$stop exists=$exists
-    { $start && ! $exists; } || { $stop && $exists; }
+  # debugging:
+  #echo start=$start stop=$stop exists=$exists
+  { $start && ! $exists; } || { $stop && $exists; }
 }
 
 iptmod() { #iptables modify
-    local check cmd="$*" exists=true
-    ${cmd/-[AD]/-C} &>/dev/null || exists=false
-    if runtest; then e $cmd; fi
+  local check cmd="$*" exists=true
+  ${cmd/-[AD]/-C} &>/dev/null || exists=false
+  if runtest; then e $cmd; fi
 }
 
 # code common to start and stop.
 modify() {
-    # match source or dest port. note, when we send to a port, it picks a random high port as
-    # the source.
-    for port in 25 143; do # smtp and imap.
-        iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
-        iptmod iptables -t mangle $iptables_op $iptcommon 0x1
-        iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
-        # note, we could have used a custom chain and returned instead of setting the mark again.
-        # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
-    done
+  # match source or dest port. note, when we send to a port, it picks a random high port as
+  # the source.
+  for port in 25 143; do # smtp and imap.
+    iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
+    iptmod iptables -t mangle $iptables_op $iptcommon 0x1
+    iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    # note, we could have used a custom chain and returned instead of setting the mark again.
+    # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+  done
 
-    if [[ $tun_dev ]]; then
-        # when $tun_dev goes away, so does this rul
-        iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
-    fi
+  if [[ $tun_dev ]]; then
+    # when $tun_dev goes away, so does this rul
+    iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+  fi
 
 
-    iprulecmd="fwmark 1 table 1"
-    exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
-    if runtest; then e ip rule $ip_op $iprulecmd; fi
+  iprulecmd="fwmark 1 table 1"
+  exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
+  if runtest; then e ip rule $ip_op $iprulecmd; fi
 
-    iproutecmd="default via 10.8.0.1 table 1"
-    exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
-    if runtest; then e ip route $ip_op $iproutecmd; fi
+  iproutecmd="default via 10.8.0.1 table 1"
+  exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
+  if runtest; then e ip route $ip_op $iproutecmd; fi
 
-    # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
-    # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
-    # so, eh, might as well. some rhel docs recommend using it.
+  # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
+  # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
+  # so, eh, might as well. some rhel docs recommend using it.
 
 
 }
 
 if (( $# > 1 )); then
-tun_dev=$1
-$script_type
+  tun_dev=$1
+  $script_type
 else
-    case $1 in
-        up|down|show) $1 ;;
-        *) usage 1 ;;
-    esac
+  case $1 in
+    up|down|show) $1 ;;
+    *) usage 1 ;;
+  esac
 fi