ffs-make-gw

#!/bin/bash
# Referenz: https://wiki.freifunk-stuttgart.net/technik:gateways:gateway-einrichten

set -e
export LC_ALL=C
CALL="$*"

print_help() {
cat <<EOF >&2
usage: $0 --gwid N [--vpnkey=xxxx] [--no-systemd] [--no-apt-update] [--no-apt-key] [--othergw=172.21.16.1] [--directtcp="443[ 995][...]"] [--with-lihas-firewall] [--segments N] [--gws N] [--with-backbone-vpn] [--no-log-call]
Verwandelt einen Debian Jessie Server mit systemd in ein Freifunk-GW
--help:          Dieser Text
--name:          Gatewayname
--gwid:          Gateway ID (1-10)
--vpnkey:        use this fastd private key (string)
--dhcp-relay-servers: DHCP Relay Server die dieses GW benutzt, Default "172.21.16.1 172.21.20.1"
--directtcp:     Liste der TCP-Ports die direkt ausgeleitet werden, durch Leerzeichen getrennt (Quoting nicht vergessen)
--fastdsplit:    2 fastd Instanzen pro Segment: IPv4 und IPv6 getrennt
--gws:           Maximale Anzahle Gateways, nur fuer batman Namensaufloesung, Default 10
--gwsubid:       Gateway Sub-ID
--no-apt-key:    keine neuen APT-Keys hinzufuegen
--no-apt-update: apt-get update nicht ausfuehren
--no-systemd:    Nicht aufd systemd bestehen, dann muss man alles int-Zeugs von hand machen
--othergw:       IP eines anderen GWs fuer ausgehenden Traffic, z.B. 172.21.16.1 (gw04)
--segments:      Anzahl Segmente, Default 4
--with-lihas-firewall: Installiere LiHAS Firewall fuer policy routing
--with-backbone-vpn: Nimm das backbone-tinc, github-Schreibzugriff auf git+ssh://git@github.com/freifunk-stuttgart/tinc-ffsbb wird benoetigt
--no-log-call:   Aufruf nicht unter /var/log/$0 speichern
EOF
}
CONFIRM=1
DHCPRELAYSERVERS="172.21.16.1 172.21.20.1"
DIRECTTCP=""
GWS=10
GWSUBID="1"
LOG_CALL=1
NEEDS_APTKEY=1
NEEDS_APTUPDATE=1
NEEDS_SYSTEMD=1
OPT_FWLIHAS=0
SEGMENTS=4
TINC_BB=0
VPNKEY="Wird generiert"
error() {
  print_help
  echo "$*"
  exit 1
}
TEMP=`getopt -o h --long help,dhcp-relay-servers:,name:,ip:,gwid:,gwsubid:,gws:,vpnkey:,with-backbone-vpn,with-lihas-firewall,othergw:,directtcp:,no-systemd,no-apt-update,no-apt-key,no-log-call,segments:,fastdsplit -- "$@"`
if [ $? != 0 ] ; then print_help >&2 ; exit 1 ; fi
eval set -- "$TEMP"
while true ; do
  case "$1" in
    --name)             GWNAME=$2; shift 2;;
    --gwid)             GWID=$2; shift 2;;
    --gwsubid)          GWSUBID=$2; shift 2;;
    --gws)              GWS=$2; shift 2;;
    --dhcp-relay-servers) DHCPRELAYSERVERS="$2"; shift 2;;
    --vpnkey)           VPNKEY=$2; shift 2;;
    --with-lihas-firewall) OPT_FWLIHAS=1; shift 1;;
    --othergw)		OTHERGW_IP=$2; shift 2;;
    --directtcp)	DIRECTTCP="$2"; shift 2;;
    --fastdsplit)	FASTD_SPLIT="1"; shift 1;;
    --no-systemd)	NEEDS_SYSTEMD=0; shift 1;;
    --no-apt-update)	NEEDS_APTUPDATE=0; shift 1;;
    --no-apt-key)	NEEDS_APTKEY=0; shift 1;;
    --no-log-call)	LOG_CALL=0; shift 1;;
    --no-confirm)	CONFIRM=0; shift 1;;
    --with-backbone-vpn) TINC_BB=1; shift 1;;
    --segments)		SEGMENTS="$2"; shift 2;;
    --help|-h) print_help; exit 1;;
    --) shift ; break ;;
    *) echo "Unknown parameter $1, try -h" ; exit 1 ;;
  esac
done
. ensureline.sh
if [ $LOG_CALL -eq 1 ]; then
  echo $CALL >> "/var/log/${0##*/}"
fi
if [ x"$GWID" == "x" ]; then
	echo "Keine GatewayID -> kein Gateway"
	exit 1
fi
GWLID=$(printf "%02i" $GWID)
GWLSUBID=$(printf "%02i" $GWSUBID)
LEGIP=172.21.$((4*$GWID)).$GWSUBID
EXT_IF_V4=$(ip r l table main | sed -n '/default/{s/^.*dev //; s/ .*//; p}')
EXT_IP_V4=$(ip -4 a l dev $EXT_IF_V4 | sed -n '/ inet /{s/.*inet //; s/[\/ ].*//;p}')
EXT_GW_V4=$(ip r l table main | sed -n '/default/{s/.*via //; s/ .*//; p}')
EXT_IF_V6=$(ip -6 r l table main | sed -n '/default/{s/^.*dev //; s/ .*//; p}')
EXT_IPS_V6=$(ip -6 a l dev $EXT_IF_V6 | sed -n '/inet6/{s/.*inet6 //; s/\/.*//; /fe80/d; p}')
HOSTNAME=gw${GWLID}n${GWLSUBID}
cat <<EOF
GatewayID (GWID): $GWID
Gateway Long ID (GWLID): $GWLID
Gateway Sub ID (GWLSUBID): $GWLSUBID
Hostname: $HOSTNAME
Legacy Net IP (LEGIP): $LEGIP
Externes Interface v4 (EXT_IF_V4): $EXT_IF_V4
Externe IP v4 (EXT_IP_V4): $EXT_IP_V4
Externes Interface v6 (EXT_IF_V6): $EXT_IF_V6
Externe IPs v6 (EXT_IP_V6): $EXT_IPS_V6
fastd VPN Key: $VPNKEY
EOF
if [ $CONFIRM -eq 1 ]; then
	echo "Wenn alles richtig ist, Eingabe druecken, sonst Abbrechen mit Strg-C"
	read x
fi
hostname $HOSTNAME
if ! grep -qw $HOSTNAME /etc/hosts; then
	sed '/^127.0.0.1/{s/^/#/}' /etc/hosts
	ensureline "127.0.0.1 ${HOSTNAME}.freifunk-stuttgart.de $HOSTNAME localhost" /etc/hosts
fi
if ! grep -qw $HOSTNAME /etc/hostname; then
	echo $HOSTNAME > /etc/hostname
fi
export HOSTNAME

show_progress() {
	printf 'Status: %s - %s\n' "$(date)" "$1"
}
if ! dpkg -S /sbin/init | awk -F: '$1 != "systemd-sysv" {exit 1}' && [ $NEEDS_SYSTEMD -eq 1 ]; then
	echo "/sbin/init is not systemd-sysv" >&2
	echo "use --no-systemd to overwrite" >&2
	exit 1
fi

if [ ! -d /etc/apt/sources.list.d ]; then
	mkdir -p /etc/apt/sources.list.d
fi

. add_repositories.sh
. setup_alfred.sh
. setup_batman.sh
. setup_bird.sh
. setup_fastd.sh
. setup_ffsconfiggenerator.sh
. setup_firewall.sh
. setup_interface.sh
. setup_monitoring.sh
. setup_system.sh
. setup_tinc.sh

add_apt_repositories
add_apt_preference
if [ x"$NEEDS_APTKEY" == x1 ]; then add_apt_keys; fi
if [ x"$NEEDS_APTUPDATE" == x1 ]; then apt-get update; fi

# batadv-vis ist nicht in backports

printf 'isc-dhcp-relay\tisc-dhcp-relay/servers\tstring\t%s\n' "$DHCPRELAYSERVERS" | debconf-set-selections
printf 'isc-dhcp-relay\tisc-dhcp-relay/interfaces\tstring\t\n' | debconf-set-selections
printf 'isc-dhcp-relay\tisc-dhcp-relay/options\tstring\t-q -a\n' | debconf-set-selections
apt-get -y install resolvconf bind9 build-essential bridge-utils git batctl fastd alfred alfred-json openvpn tinc vnstat vnstati python-pip bind9 radvd conntrack $([ "x$OPT_FWLIHAS" == "x1" ] && echo firewall-lihas) isc-dhcp-relay apt-transport-https libjson-xs-perl libdata-dump-perl sysfsutils check-mk-agent jq xinetd bird equivs socat apache2

show_progress setup_batman_dkms
setup_batman_dkms
show_progress setup_system_sysctl
setup_system_sysctl
show_progress setup_system_sysfs
setup_system_sysfs
setup_system_routing
show_progress setup_system_routing
setup_fastd
show_progress setup_fastd

# Networking
ensureline "source-directory interfaces.d" /etc/network/interfaces
# Legacy Segment
setup_interface_seg00
show_progress setup_interface_seg00

OLDDIR=$(pwd)
mkdir -p /root/git
cd /root/git
# Patch and run FfsConfigGenerator
setup_ffsconfiggenerator_config
show_progress setup_ffsconfiggenerator_config
./gen_config.py --gwnum $GWID --instance $GWSUBID
show_progress ./gen_config.py --gwnum $GWID --instance $GWSUBID
# Deploy FfsConfigGenerator results
rsync -rlHpogDtvx --exclude etc/fastd etc /
sed -i "s/\([0-9a-f]\{2\}\):\([0-9a-f]\{2\}\):\([0-9a-f]\{2\}\):\([0-9a-f]\{2\}\):$GWLID:00/\1:\2:\3:\4:$GWLID:$GWLSUBID/" /etc/network/interfaces.d/ffs-seg*
sed -i '/listen-on/d' /etc/bind/named.conf.options
cd "$OLDPWD"

TINCBASE=/etc/tinc/ffsbb
setup_tinc_base
show_progress setup_tinc_base
cd $TINCBASE
setup_tinc_config
show_progress setup_tinc_config
setup_tinc_key
show_progress setup_tinc_key
if [ x"$TINCBASE" != x"/etc/tinc/ffsbb" ]; then
    rsync -rlHpogDtSvx /etc/tinc/ffsbb/hosts/$HOSTNAME  $TINCBASE/ffsbb/hosts/
fi
setup_tinc_git_push
show_progress setup_tinc_git_push
setup_tinc_interface
show_progress setup_tinc_interface
# Disabled, fast bbNN macht das nun
#setup_tinc_segments
#show_progress setup_tinc_segments

if [ ! -d /root/git/peers-ffs/.git ]; then
  mkdir -p /root/git
  git clone https://github.com/freifunk-stuttgart/peers-ffs /root/git/peers-ffs
else
  ( cd /root/git/peers-ffs && git pull )
fi
setup_fastd_config
show_progress setup_fastd_config
setup_fastd_key
show_progress setup_fastd_key

setup_firewall
show_progress setup_firewall

# batman Namen
setup_batman_names
show_progress setup_batman_names

systemctl daemon-reload
update-rc.d fastd disable
systemctl enable fastd@vpn00.service 
systemctl enable fastd@bb00.service 
for seg in $(seq 1 $SEGMENTS); do
  systemctl enable fastd@vpn$(printf "%02i" $seg).service 
  systemctl enable fastd@bb$(printf "%02i" $seg).service 
done
setup_alfred_startup
show_progress setup_alfred_startup

# fastd /usr/local/bin/fastd-update + cronjob
setup_fastd_update
show_progress setup_fastd_update
setup_fastd_bb
show_progress setup_fastd_bb
# /usr/local/bin/fastd-status
setup_fastd_status
show_progress setup_fastd_status

# sysfs
system_setup_sysfs
show_progress system_setup_sysfs

# DHCP Relay
ensureline "SERVERS=\"$DHCPRELAYSERVERS\"" /etc/default/isc-dhcp-relay
systemctl restart isc-dhcp-relay

# bird
setup_bird
show_progress setup_bird

# Monitoring
setup_monitoring
show_progress setup_monitoring

# Uplink VPN
cat <<'EOF' >/usr/local/bin/openvpn-freifunk
#!/bin/bash
# cmd tun_dev tun_mtu link_mtu ifconfig_local_ip ifconfig_remote_ip [ init | restart ]
cmd=$0
tun_dev=$1
tun_mtu=$2
link_mtu=$3
ifconfig_local_ip=$4
ifconfig_remote_ip=$5
method=$6
grep "route-gateway $ifconfig_local_ip" /var/log/syslog | sed 's/^.*route-gateway //; s/,.*//' | tail -n1
gw=$(egrep "route-gateway .*$ifconfig_local_ip" /var/log/syslog | sed 's/^.*route-gateway //; s/,.*//' | tail -n1)
if [ "x$gw" != "x" ]; then
  ip route add default via $gw table stuttgart || true
else
  ip route add default via $ifconfig_remote_ip table stuttgart || true
fi
EOF
chmod +x /usr/local/bin/openvpn-freifunk

if [ x"$OPT_FWLIHAS" == x1 ]; then
  echo systemctl start firewall-lihas
fi
for i in $(seq 0 4); do
  echo -n systemctl start fastd@vpn$(printf "%02i" $seg).service"; "
  echo -n systemctl start fastd@bb$(printf "%02i" $seg).service"; "
done
echo
echo systemctl start bird

echo "fastd Public Key: $(fastd -c /etc/fastd/ffs-vpn/secret.conf --show-key --machine-readable)"
# vim: ts=2 sw=2 sts=2 sr noet