From 866a0cbd9127386520def96ff49bdc8424df8112 Mon Sep 17 00:00:00 2001 From: Ian Kelling Date: Mon, 19 Feb 2018 19:30:04 -0500 Subject: [PATCH] fixup mail route going down, and switch mail with no internet --- mail-route | 65 ++++++++++++++--------- mail-setup | 151 +++++++++++++++++++++++++++-------------------------- 2 files changed, 117 insertions(+), 99 deletions(-) diff --git a/mail-route b/mail-route index 2e08a83..81a3ccb 100755 --- a/mail-route +++ b/mail-route @@ -22,37 +22,41 @@ errcatch usage() { cat <<'EOF' -Usage: mail-route start|stop|show +Usage: mail-route up|down|show Marks tcp packets on port 25 and 143 to be routed through -a vpn ip. Is idempotent. +a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the +tun_dev, and action is from $script_type. + +Is idempotent. EOF exit $1 } -if (( $# != 1 )); then +if (( $# < 1 )); then usage 1 fi -start() { +up() { start=true stop=false iptables_op=-A ip_op=add - # systemd around stretch release time, would wait until openvpn actually connected, - # so this was unnecessary, but now it returns immediately. - found=false - for ((i=1; i<=30; i++)); do - tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') - if [[ $tun_dev == tun* ]]; then - found=true - break + if [[ ! $tun_dev ]]; then + # delays because I was running this outside of openvpn before + found=false + for ((i=1; i<=30; i++)); do + tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') + if [[ $tun_dev == tun* ]]; then + found=true + break + fi + sleep 1 + done + if ! $found; then + echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev" + exit 1 fi - sleep 1 - done - if ! $found; then - echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev" - exit 1 fi e() { echo "$0: $*"; "$@"; } _errcatch_cleanup=stop @@ -61,12 +65,17 @@ start() { # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might. e sysctl net.ipv4.conf.$tun_dev.rp_filter=2 } -stop() { +down() { start=false stop=true iptables_op=-D ip_op=del + # note, this is not going to work if the interface has been deleted. + # we could also check for an iptable rule that on some tun interface like the one + # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn + if [[ ! tun_dev ]]; then tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') + fi e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; } modify } @@ -113,7 +122,7 @@ modify() { if [[ $tun_dev ]]; then # when $tun_dev goes away, so does this rul - iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4 + iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4 fi @@ -130,13 +139,21 @@ modify() { # so, eh, might as well. some rhel docs recommend using it. - exit 0 } -case $1 in - start|stop|show) $1 ;; - *) usage 1 ;; -esac +if (( $# > 1 )); then +tun_dev=$1 +$script_type +else + case $1 in + up|down|show) $1 ;; + *) usage 1 ;; + esac +fi + + + +exit 0 # background: something like this does not work for packets which diff --git a/mail-setup b/mail-setup index 5ad953a..a0bba6d 100755 --- a/mail-setup +++ b/mail-setup @@ -290,31 +290,20 @@ else # begin exim. has debian specific stuff for now fi if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. # to put the hostname in the known hosts - : - #ssh -o StrictHostKeyChecking=no root@li.iankelling.org : - #/a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + fi fi - cat >/etc/systemd/system/mailroute.service </etc/systemd/system/offlineimapsync.timer <<'EOF' [Unit] Description=Run offlineimap-sync once every min @@ -337,7 +326,6 @@ Type=oneshot ExecStart=/a/bin/log-quiet/sysd-mail-once offlineimap-sync /a/bin/distro-setup/offlineimap-sync EOF systemctl daemon-reload - systemctl enable mailroute # wording of question from dpkg-reconfigure exim4-config # 1. internet site; mail is sent and received directly using SMTP @@ -390,8 +378,21 @@ if [[ $HOSTNAME == $MAIL_HOST ]]; then local_mx=mail.iankelling.org rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ret=$? ${rsync_common}privkey.pem /etc/exim4/exim.key + new_ret=$? + if [[ $ret != $new_ret ]]; then + echo "$0: error: differing rsync returns, $ret, $new_ret" + exit 1 + fi fi +if [[ $new_ret != 0 ]]; then + if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 + fi +fi +exit 0 EOF chmod 755 $f @@ -416,7 +417,7 @@ OnCalendar=daily WantedBy=timers.target EOF systemctl daemon-reload - #systemctl start mailcert + systemctl start mailcert systemctl restart mailcert.timer systemctl enable mailcert.timer @@ -899,63 +900,63 @@ EOF systemctl restart exim4 -fi #### end if exim4 + fi #### end if exim4 -# /etc/alias setup is debian specific, and -# exim config sets up an /etc/alias from root to the postmaster, which i -# config to ian, as long as there exists an entry for root, or there was -# no preexisting aliases file. based on the postinst file. postfix -# won\'t set up a root to $postmaster alias if it\'s already installed. -# Since postfix is not the greatest, just set it ourselves. -if [[ $postmaster != root ]]; then - sed -i --follow-symlinks -f - /etc/aliases </dev/null; then - if [[ $HOSTNAME == $MAIL_HOST ]]; then - systemctl restart radicale - systemctl enable radicale - if [[ -e /etc/logrotate.d/radicale.disabled ]]; then - mv /etc/logrotate.d/radicale{.disabled,} - fi - else - systemctl stop radicale - systemctl disable radicale + newaliases + fi + + # put spool dir in directory that spans multiple distros. + # based on http://www.postfix.org/qmgr.8.html and my notes in gnus + # + # todo: I\'m suspicious of uids for Debian-exim being the same across + # distros. It would be good to test this. + dir=/nocow/$type + sdir=/var/spool/$type + # we only do this if our system has $dir + if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then + systemctl stop $type + if [[ ! -e $dir && -d $sdir ]]; then + mv $sdir $dir + fi + /a/exe/lnf -T $dir $sdir + fi + + systemctl restart $type + systemctl enable $type + + # MAIL_HOST also does radicale, and easier to start and stop it here + # for when MAIL_HOST changes, so radicale gets the synced files and + # does not stop us from remounting /o. + if dpkg -s radicale &>/dev/null; then + if [[ $HOSTNAME == $MAIL_HOST ]]; then + systemctl restart radicale + systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi + else + systemctl stop radicale + systemctl disable radicale # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. if [[ -e /etc/logrotate.d/radicale ]]; then mv /etc/logrotate.d/radicale{,.disabled} fi - fi -fi -exit 0 + fi + fi + exit 0 -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload + # if I wanted the from address to be renamed and sent to a different address, + # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical + # sudo postmap hash:/etc/postfix/recipient_canonical + # sudo service postfix reload -- 2.30.2