ffs-make-gw

#!/bin/bash
# Referenz: https://wiki.freifunk-stuttgart.net/technik:gateways:gateway-einrichten

set -e
export LC_ALL=C
CALL="$*"

print_help() {
cat <<EOF >&2
usage: $0 --gwid N [--vpnkey=xxxx] [--no-systemd] [--no-apt-update] [--no-apt-key] [--othergw=172.21.16.1] [--directtcp="443[ 995][...]"] [--with-lihas-firewall] [--segments N] [--gws N] [--no-log-call] [--www=/var/www/html]
Verwandelt einen Debian Jessie Server mit systemd in ein Freifunk-GW
--help:          Dieser Text
--name:          Gatewayname
--gwid:          Gateway ID (1-10)
--gwsubid:       Gateway Sub-ID
--vpnkey:        use this fastd private key (string)
--directtcp:     Liste der TCP-Ports die direkt ausgeleitet werden, durch Leerzeichen getrennt (Quoting nicht vergessen)
--fastdsplit:    2 fastd Instanzen pro Segment: IPv4 und IPv6 getrennt
--gws:           Maximale Anzahle Gateways, nur fuer batman Namensaufloesung, Default 10
--no-apt-key:    keine neuen APT-Keys hinzufuegen
--dhcp-relay-servers: DHCP Relay Server die dieses GW benutzt, Default "10.190.128.251 10.191.255.252 10.191.255.253"
--no-apt-update: apt-get update nicht ausfuehren
--no-systemd:    Nicht aufd systemd bestehen, dann muss man alles int-Zeugs von hand machen
--othergw:       IP eines anderen GWs fuer ausgehenden Traffic, z.B. 172.21.16.1 (gw04)
--segments:      Anzahl Segmente, Default 4
--segmentlist:   Liste der Segmente, bitte in " angeben, Default "00 01 02 03 04"
--email:         Mailadresse an die Meldungen geschickt werden sollen
--with-lihas-firewall: Installiere LiHAS Firewall fuer policy routing
--with-checkmk:  Installiere checkmk agent aus LiHAS Repos
--with-backbone-vpn: wird ignoriert
--www:           Webroot
--no-public:     GW hat keine fixe offizielle IP (fastd --remote nicht nutzen)
--provider-mode: Alles direkt ausleiten
--no-log-call:   Aufruf nicht unter /var/log/$0 speichern
--local-segment: Segment das lokal verwendet wird
--local-segment-interfaces: Interfaces die lokal Mesh haben
--ip6:           IPv6 Netz fuer Clients (dumm, konkateniert einfach Segment in hex dran)
--ip6-seg:       Segmente in denen IPv6 RAs verschickt werden, default alle
EOF
}
CONFIRM=1
DHCPRELAYSERVERS="10.190.128.251 10.191.255.252 10.191.255.253"
DIRECTTCP=""
GWS=10
GWSUBID="1"
LOG_CALL=1
NOPUBLICIP=0
NEEDS_APTKEY=1
NEEDS_APTUPDATE=1
NEEDS_SYSTEMD=1
OPT_FWLIHAS=0
OPT_CHECKMK=0
SEGMENTS=4
SEGMENTLIST=""
PROVIDERMODE=0
VPNKEY="Wird generiert"
WWWPFAD="/var/www/html"
FFSGIT=/var/lib/ffs/git
LOCAL_SEGMENT=""
LOCAL_SEGMENT_INTERFACES=""
IP6=""
error() {
  print_help
  echo "$*"
  exit 1
}
TEMP=`getopt -o h --long help,dhcp-relay-servers:,directtcp:,email:,fastdsplit,gwid:,gws:,gwsubid:,ip:,name:,no-apt-key,no-apt-update,no-public,no-log-call,no-systemd,othergw:,segmentlist:,segments:,vpnkey:,with-backbone-vpn,with-lihas-firewall,provider-mode,local-segment:,local-segment-interfaces:,ip6:,ip6segs: -- "$@"`
if [ $? != 0 ] ; then print_help >&2 ; exit 1 ; fi
eval set -- "$TEMP"
while true ; do
  case "$1" in
    --dhcp-relay-servers)	DHCPRELAYSERVERS="$2"; shift 2;;
    --directtcp)		DIRECTTCP="$2"; shift 2;;
    --email)			EMAIL="$2"; shift 2;;
    --fastdsplit)		FASTD_SPLIT="1"; shift 1;;
    --gwid)			GWID=$2; shift 2;;
    --gws)			GWS=$2; shift 2;;
    --gwsubid)			GWSUBID=$2; shift 2;;
    --local-segment)		LOCAL_SEGMENT=$(printf "%02i" $2); shift 2;;
    --local-segment-interfaces)	LOCAL_SEGMENT_INTERFACES=$2; shift 2;;
    --name)								GWNAME=$2; shift 2;;
    --no-apt-key)					NEEDS_APTKEY=0; shift 1;;
    --no-apt-update)			NEEDS_APTUPDATE=0; shift 1;;
    --no-confirm)					CONFIRM=0; shift 1;;
    --no-log-call)					LOG_CALL=0; shift 1;;
    --no-public)					NOPUBLICIP=1; shift 1;;
    --no-systemd)					NEEDS_SYSTEMD=0; shift 1;;
    --othergw)						OTHERGW_IP=$2; shift 2;;
    --provider-mode)      PROVIDERMODE=1; shift 1;;
    --segmentlist)				SEGMENTLIST="$2"; shift 2;;
    --segments)						SEGMENTS="$2"; shift 2;;
    --vpnkey)             VPNKEY=$2; shift 2;;
    --with-backbone-vpn) shift 1;; # for compatibility, no longer supported
    --with-lihas-firewall) OPT_FWLIHAS=1; shift 1;;
    --with-checkmk) OPT_CHECKMK=1; shift 1;;
    --www)                WWWPFAD=$2; shift 2;;
    --ip6)                IP6=$2; shift 2;;
    --ip6segs)            IP6_SEGMENTS=$2; shift 2;;
    --help|-h) print_help; exit 1;;
    --) shift ; break ;;
    *) echo "Unknown parameter $1, try -h" ; exit 1 ;;
  esac
done
. ensureline.sh
if [ $LOG_CALL -eq 1 ]; then
  echo $CALL >> "/var/log/${0##*/}"
fi
if [ x"$GWID" == "x" ]; then
	echo "Keine GatewayID -> kein Gateway"
	exit 1
fi
if [ x"$SEGMENTLIST" == x ]; then
	SEGMENTLIST=$(
    for segment in $(seq 1 $SEGMENTS); do
      printf '%02i ' $segment
    done
  )
else
  # Alle Segmente zweistellig
  SEGMENTLIST=$(
    for segment in $(sed 's/\b0//' <<< $SEGMENTLIST); do
      printf '%02i ' $segment
    done
  )
fi
GWLID=$(printf "%02i" $GWID)
GWLSUBID=$(printf "%02i" $GWSUBID)
LEGIP=172.21.$((4*$GWID)).$GWSUBID
EXT_IF_V4=$(ip r l table main | sed -n '/default/{s/^.*dev //; s/ .*//; p}' | head -n1)
EXT_IP_V4=$(ip -4 a l dev $EXT_IF_V4 | sed -n '/ inet /{s/.*inet //; s/[\/ ].*//;p}' | head -n1)
EXT_GW_V4=$(ip r l table main | sed -n '/default/{s/.*via //; s/ .*//; p}' | head -n1)
EXT_IF_V6=$(ip -6 r l table main | sed -n '/default/{s/^.*dev //; s/ .*//; p}' | head -n1)
EXT_IPS_V6=$(ip -6 a l dev $EXT_IF_V6 | sed -n '/inet6/{s/.*inet6 //; s/\/.*//; /fe80/d; p}' | head -n1)
HOSTNAME=gw${GWLID}n${GWLSUBID}
segmentlistv6="$IP6_SEGMENTS"
if [ -z "$IP6_SEGMENTS" ]; then
	segmentlistv6="(alle)"
fi
if [ "x$IP6" != "x" ]; then
	if egrep -q '[0-9a-fA-F]{4}$' <<<$IP6; then
		IP6="$IP6:00"
	fi
fi
cat <<EOF
GatewayID (GWID): $GWID
Gateway Long ID (GWLID): $GWLID
Gateway Sub ID (GWLSUBID): $GWLSUBID
Hostname: $HOSTNAME
Legacy Net IP (LEGIP): $LEGIP
Externes Interface v4 (EXT_IF_V4): $EXT_IF_V4
Externe IP v4 (EXT_IP_V4): $EXT_IP_V4
Externes Interface v6 (EXT_IF_V6): $EXT_IF_V6
Externe IPs v6 (EXT_IP_V6): $EXT_IPS_V6
IP6 Ausleitung (IP6): $IP6::/56
Segmente: $SEGMENTLIST
Segments mit IPv6: $segmentlistv6
Email: $EMAIL
fastd VPN Key: $VPNKEY
EOF
if [ $CONFIRM -eq 1 ]; then
	echo "Wenn alles richtig ist, Eingabe druecken, sonst Abbrechen mit Strg-C"
	read x
fi
hostname $HOSTNAME
if ! grep -qw $HOSTNAME /etc/hosts; then
	sed '/^127.0.0.1/{s/^/#/}' /etc/hosts
	ensureline "127.0.0.1 ${HOSTNAME}.freifunk-stuttgart.de $HOSTNAME localhost" /etc/hosts
fi
if ! grep -qw $HOSTNAME /etc/hostname; then
	echo $HOSTNAME > /etc/hostname
fi
export HOSTNAME

show_progress() {
	printf 'Status: %s - %s\n' "$(date)" "$1"
}
if ! dpkg -S /sbin/init | awk -F: '$1 != "systemd-sysv" {exit 1}' && [ $NEEDS_SYSTEMD -eq 1 ]; then
	echo "/sbin/init is not systemd-sysv" >&2
	echo "use --no-systemd to overwrite" >&2
	exit 1
fi

if [ ! -d /etc/apt/sources.list.d ]; then
	mkdir -p /etc/apt/sources.list.d
fi

. add_repositories.sh
. setup_batman.sh
. setup_bird.sh
. setup_fastd.sh
. setup_firewall.sh
. setup_interface.sh
. setup_logging.sh
. setup_monitoring_ubuntu.sh
. setup_monitoring.sh
. setup_radvd_ubuntu.sh
. setup_system.sh
. setup_backbone.sh

add_apt_repositories
add_apt_preference
if [ x"$NEEDS_APTKEY" == x1 ]; then add_apt_keys; fi
if [ x"$NEEDS_APTUPDATE" == x1 ]; then apt-get update; fi

# batadv-vis ist nicht in backports

apt-get -y install resolvconf bind9 build-essential bridge-utils git batctl fastd openvpn vnstat vnstati python3-pip bind9 radvd conntrack $([ "x$OPT_FWLIHAS" == "x1" ] && echo firewall-lihas) dhcp-helper apt-transport-https libjson-xs-perl libdata-dump-perl sysfsutils $([ "x$OPT_CHECKMK" == "x1" ] && echo check-mk-agent) jq xinetd bird equivs socat apache2 python3-psutil psmisc etckeeper netcat-openbsd prometheus-node-exporter python3-dnspython

show_progress setup_batman_dkms
setup_batman_dkms
show_progress setup_system_sysctl
setup_system_sysctl
show_progress setup_system_sysfs
setup_system_sysfs
setup_system_routing
show_progress setup_system_routing
setup_fastd
show_progress setup_fastd

# Networking
ensureline "source-directory interfaces.d" /etc/network/interfaces

rm -f /etc/network/interfaces.d/br[0-8][0-9]
setup_interface_segxx
show_progress setup_interface_segxx

setup_backbone
show_progress setup_backbone

setup_fastd_loadbalancer
if [ ! -d $FFSGIT/peers-ffs/.git ]; then
  mkdir -p $FFSGIT
  git clone https://github.com/freifunk-stuttgart/peers-ffs $FFSGIT/peers-ffs
else
  ( cd $FFSGIT/peers-ffs && git pull )
fi
setup_fastd_config
show_progress setup_fastd_config
setup_fastd_key
show_progress setup_fastd_key

setup_firewall
show_progress setup_firewall

# batman Namen
setup_batman_names
show_progress setup_batman_names

systemctl daemon-reload
update-rc.d fastd disable
for seg in $SEGMENTLIST; do
  if [ x$FASTD_SPLIT == x1 ]; then
    systemctl enable fastd@vpn${seq}ip6.service
  fi
  systemctl enable fastd@vpn${seg}.service 
  systemctl enable fastd@vpy${seg}.service 
  systemctl enable fastd@bb${seg}.service 
done
# remove obsolete fastd
ls /etc/systemd/system/multi-user.target.wants/fastd@* 2>/dev/null | sed 's/.*@//; s/.service$//' | while read fastdinstance; do
  if [ ! -e /etc/fastd/$fastdinstance ]; then
		systemctl stop fastd@$fastdinstance.service || true
		systemctl disable fastd@$fastdinstance.service
  fi
done

# fastd /usr/local/bin/fastd-update + cronjob
setup_fastd_update
show_progress setup_fastd_update
setup_fastd_bb
show_progress setup_fastd_bb

# DHCP Relay
helper_options=""
for s in $DHCPRELAYSERVERS; do
	helper_options+="-s $s "
done
for seg in $SEGMENTLIST; do
	helper_options+="-i br$(printf %02d ${seg#0}) "
done
echo '# generated by ffs-make-gw' > /etc/default/dhcp-helper
echo "DHCPHELPER_OPTS=\"$helper_options\"" >> /etc/default/dhcp-helper
systemctl enable dhcp-helper.service
systemctl restart dhcp-helper.service

# bird
setup_bird
show_progress setup_bird
setup_radvd
show_progress setup_radvd
systemctl enable radvd

# Monitoring
setup_monitoring_updateff
show_progress setup_monitoring_updateff
setup_monitoring_statuspl # setup_monitoring_ubuntu.sh
show_progress setup_monitoring_statuspl
setup_monitoring_vnstat
show_progress setup_monitoring_vnstat

setup_monitoring
show_progress setup_monitoring

setup_logrotate
show_progress setup_logging

# Uplink VPN
cat <<'EOF' >/usr/local/bin/openvpn-freifunk
#!/bin/bash
# cmd tun_dev tun_mtu link_mtu ifconfig_local_ip ifconfig_remote_ip [ init | restart ]
cmd=$0
tun_dev=$1
tun_mtu=$2
link_mtu=$3
ifconfig_local_ip=$4
ifconfig_remote_ip=$5
method=$6
grep "route-gateway $ifconfig_local_ip" /var/log/syslog | sed 's/^.*route-gateway //; s/,.*//' | tail -n1
gw=$(egrep "route-gateway .*$ifconfig_local_ip" /var/log/syslog | sed 's/^.*route-gateway //; s/,.*//' | tail -n1)
if [ "x$gw" != "x" ]; then
  ip route add default via $gw table ffsdefault || true
else
  ip route add default via $ifconfig_remote_ip table ffsdefault || true
fi
EOF
chmod +x /usr/local/bin/openvpn-freifunk

if [ x"$OPT_FWLIHAS" == x1 ]; then
  echo systemctl start firewall-lihas
fi
for i in $SEGMENTLIST; do
  seg=${i##0}
  if [ x$FASTD_SPLIT == x1 ]; then
    echo -n systemctl start fastd@vpn$(printf "%02i" $seg)ip6.service"; "
  fi
  echo -n systemctl start fastd@vpn$(printf "%02i" $seg).service"; "
  echo -n systemctl start fastd@bb$(printf "%02i" $seg).service"; "
  echo -n systemctl start fastd@vpy$(printf "%02i" $seg).service"; "
done
echo
echo systemctl start bird
echo systemctl start radvd

echo "fastd Public Key: $(fastd -c /etc/fastd/secret_vpn.conf --show-key --machine-readable)"
# vim: ts=2 sw=2 sts=2 sr noet