forked from noplacenoaddress/OpenBSD
-
Notifications
You must be signed in to change notification settings - Fork 0
/
console
executable file
·1752 lines (1702 loc) · 97.5 KB
/
console
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/bash
# GLOBAL VAR
# IPv6 ULA fc00::/7
# https://howto.lintel.in/speed-ssh-multiplexing/
# curl -s -X GET "https://fw-update.ubnt.com/api/firmware-latest?filter=eq~~platform~~edgerouter&filter=eq~~channel~~release&filter=eq~~product~~e300"
# menu
function menu () {
local LEVEL="${1}"
case "${LEVEL}" in
0)
echo
echo -e $0 "-I (Local Domain Name)"
echo
;;
1)
echo
echo -e $0 "-I ${LDN} -SO [openbsd|mikrotik|edgeos|raspi|ALL] [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -> tools on the workstation"
echo
;;
2)
echo
echo -e $0 "-I ${LDN} -SO [openbsd|mikrotik|edgeos|raspi|ALL] -T -> tmux and SSH to hosts [o]"
echo -e $0 "-I ${LDN} -SO [openbsd|mikrotik|edgeos|raspi|ALL] -P -> syspatch [o]"
echo -e $0 "-I ${LDN} -SO [openbsd|mikrotik|edgeos|ALL] -N -> newhost OpenBSD host [o]"
echo -e $0 "-I ${LDN} -SO [openbsd|mikrotik|edgeos|ALL] -C -> cleanlast [o]"
echo -e $0 "-I ${LDN} -SO [openbsd|edgeos|ALL] -F -> single file update [o]"
echo -e $0 "-I ${LDN} -SO [ALL] -KD -> print all IPsec certificates deadlines [o]"
echo -e $0 "-I ${LDN} -SO [openbsd] -G -> git pull [o]"
echo -e $0 "-I ${LDN} -SO [openbsd] -S -> scripts [o]"
echo -e $0 "-I ${LDN} -SO [openbsd] -D -> dyndnspop [o]"
echo -e $0 "-I ${LDN} -SO [openbsd] -7 -> changes to 7.0 release [o]"
echo -e $0 "-I ${LDN} -SO [openbsd] -PF -> changes to PF firewall [o]"
echo -e $0 "-I ${LDN} -SO [mikrotik] -LTE -> new RouterOS LTE Router instance [o]"
echo -e $0 "-I ${LDN} -SO [mikrotik] -CHR -> new RouterOS Cloud Hosted Router istance [o] "
echo -e $0 "-I ${LDN} -SO [workstation] -GR6 -> add IPv6 ULA to gre tunnel interfaces [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -RS -> repository ssh update [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -Z -> global network domains setup [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -GEO -> get IP address geo group [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -CU -> single certificate upgrade / change [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -U -> update the workstation's user EdDSA certificate [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -CI -> custom installation templates [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -K -> new IKED pk12 archive [o]"
echo -e $0 "-I ${LDN} -SO [workstation] -NDS -> encrypt TXT DNS record [o]"
echo
;;
esac
exit 1
}
# variables
userna=$(id -nu ${UID})
proghome="${HOME}/Sources/Git/OpenBSD"
daterelease=$(date +"%d%m%Y%H%m%S")
TODAY=$(date +"%d%m")
RD="/run/user/${UID}/guerrilla"
# variables from command lines and consequent processing or quit
(: "${1?}") 2>/dev/null || menu 0
(: "${2?}") 2>/dev/null && LDN="${2}"
PDN=$(dig "${LDN}" TXT +short | sed "s|\"||g") && [[ "${PDN}" ]] || ( echo "internal domain name daemon misconfigured or local domain name error" ; exit 1 )
(: "${3?}") 2>/dev/null || menu 1
(: "${3?}") 2>/dev/null && ( [ "${3}" == "-SO" ] || [ "${3}" == "-W" ] ) || menu 1 && (: "${4?}") 2>/dev/null && [ "${4}" == "openbsd" -o "${4}" == "mikrotik" -o "${4}" == "edgeos" -o "${4}" == "raspi" -o "${4}" == "workstation" -o "${4}" == "ALL" ] && SO="${4}" || menu 1
(: "${5?}") 2>/dev/null || menu 2
(: "${5?}") 2>/dev/null && (
[ "${5}" == "-P" -o "${5}" == "-T" ] || \
( [ "${5}" == "-N" -o "${5}" == "-C" -o "${5}" == "-P" ] && [ "${4}" == "openbsd" -o "${4}" == "mikrotik" -o "${4}" == "edgeos" -o "${4}" == "ALL" ] ) || \
( [ "${5}" == "-F" ] && [ "${4}" == "openbsd" -o "${4}" == "edgeos" -o "${4}" == "ALL" ] ) || \
( [ "${5}" == "-KD" ] && [ "${4}" == "ALL" ] ) || \
( [ "${5}" == "-G" -o "${5}" == "-S" -o "${5}" == "-D" -o "${5}" == "-PF" ] && [ "${4}" == "openbsd" ] ) || \
( [ "${5}" == "-LTE" -o "${5}" == "-CHR" ] && [ "${4}" == "mikrotik" ] ) || \
( [ "${5}" == "-GR6" -o "${5}" == "-RS" -o "${5}" == "-Z" -o "${5}" == "-GEO" -o "${5}" == "-CU" -o "${5}" == "-U" -o "${5}" == "-CI" -o "${5}" == "-K" -o "${5}" == "-NSD" ] && [ "${4}" == "workstation" ] )
) && OPT="${5}" || menu 2
# functions
source "lib/foo.sh"
# a work array and a pair of strings
([[ $(typeofvar wa) == "array" ]] && [[ $(echo ${#wa[@]}) != "0" ]]) && ( unset wa && declare -a wa ) || declare -a wa
[[ $(typeofvar ws) == "string" ]] && [[ $(echo ${#ws}) != "0" ]] && ( unset ws && ws="" ) || ws=""
[[ $(typeofvar tf) == "string" ]] && [[ $(echo ${#tf}) != "0" ]] && ( unset tf && tf="" ) || tf=""
# temp files
tf=$(tempfile)
# add another fd to hack a little bit
exec 5>&1
if [[ "${UID}" -eq 0 ]]; then
echo -e $0 "you cannot run $0 as root \n"
exit 1
fi
case "${SO}" in
openbsd|edgeos|mikrotik|raspi|lte)
dnsquery wa "${SO}"
;;
"ALL")
dnsquery wa "-FL"
;;
esac
case "${OPT}" in
# [openbsd|mikrotik|edgeos|raspi|ALL] #
"-T")
TS="${RD}/tmux$RANDOM"
echo -e "Launching TMUX"
tmux -S "${TS}" new-session -d -s "LOBBY"
tmux -S "${TS}" set -g status-justify left
tmux -S "${TS}" set -g status-left-length 40
tmux -S "${TS}" set -g history-limit 5000
#tmux -S "${TS}" set -g default-terminal "xterm-256color"
tmux -S "${TS}" set-option -g status-left '#[fg=white,bold] guerrilla ⚡️ '
tmux -S "${TS}" set-option -g status-right 'Europe/Madrid #[fg=agua]%I:%M:%S'
#tmux -S "${TS}" set -g mouse on
#tmux -S "${TS}" bind -n WheelUpPane if-shell -F -t = "#{mouse_any_flag}" "send-keys -M" "if -Ft= '#{pane_in_mode}' 'send-keys -M' 'copy-mode -e; send-keys -M'"
tmux -S "${TS}" bind -n S-Pageup copy-mode -u
tmux -S "${TS}" bind -n S-Pagedown send-keys Pagedown
# color status bar
tmux -S "${TS}" set -g status-bg black
tmux -S "${TS}" set -g status-fg cyan
# highlight current window
tmux -S "${TS}" setw -g window-status-current-style bg=black,fg=magenta,bold
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Creating ${wa[j]} TMUX windows"
tmux -S "${TS}" rename-window "${wa[j]}"
tmux -S "${TS}" send -t "LOBBY:${wa[j]}" ssh SPACE "${wa[j]}.${LDN}" ENTER
tmux -S "${TS}" new-window
done
tmux -S "${TS}" rename-window "CA"
tmux -S "${TS}" send -t "LOBBY:CA" ssh SPACE "ca.${LDN}" ENTER
tmux -S "${TS}" new-window
tmux -S "${TS}" rename-window $(hostname -s)
tmux -S "${TS}" -2 attach-session -t "LOBBY"
;;
"-P")
for (( j=0; j<${#wa[@]}; j++ )); do
c=$(capa3 ${wa[j]}.${LDN} "wan")
[[ "${c}" == 1 ]] && (
case $(dnsquery -T ${wa[j]}) in
"openbsd")
li=$(ssh ${wa[j]}.${LDN} syspatch -l | tail -n 1)
lw=$(curl -s https://www.openbsd.org/errata70.html | grep patches | tail -n 1)
[[ "${lw}" =~ "${li}" ]] || (echo "New OpenBSD patches found to apply for ${wa[j]}.${LDN}" ; ssh ${wa[j]}.${LDN} doas syspatch) && echo "No OpenBSD patches found to apply for ${wa[j]}.${LDN} "
;;
"edgeos")
echo
li=$(ssh -q ${wa[j]}.${LDN} sudo /usr/bin/ubnt-upgrade --show | grep v[0-9] | awk '{print $1}')
lw=$(curl -s -X GET "https://fw-update.ubnt.com/api/firmware-latest?filter=eq~~platform~~edgerouter&filter=eq~~channel~~release&filter=eq~~product~~e300" | tr \, '\n' | grep -w \"version\": | cut -d : -f2 | sed "s|\"||g")
[[ "${lw}" != "${li}" ]] || echo "No EdgeOS patches found" && ( \
echo "New EdgeOS patches found for ${wa[j]}.${LDN}"
read -p "Download ${lw}?: yes/no " ctrl
case "${ctrl}" in
"yes")
fwuri=$(curl -s -X GET "https://fw-update.ubnt.com/api/firmware-latest?filter=eq~~platform~~edgerouter&filter=eq~~channel~~release&filter=eq~~product~~e300" | tr \, '\n' | grep -w \"data\": | cut -d : -f4 | sed "s|\"||g" | sed -e "s|^//||" -e "s|}$||")
[[ -d "${RD}/download" ]] || mkdir "${RD}/download"
[[ -e "${RD}/download/${lw}.tar" ]] || wget "${fwuri}" -O "${RD}/download/${lw}.tar" && echo "${lw}.tar already downloaded"
sha256w=$(curl -s -X GET "https://fw-update.ubnt.com/api/firmware-latest?filter=eq~~platform~~edgerouter&filter=eq~~channel~~release&filter=eq~~product~~e300" | tr \, '\n'| grep -w \"sha256_checksum\": | cut -d : -f2 | sed "s|\"||g")
sha256l=$(sha256sum "${RD}/download/${lw}.tar" | awk '{print $1}')
[[ "${sha256w}" == "${sha256l}" ]] && echo "SHA256 verified" || (echo "SHA256 incorrect!" ; exit 1)
em=$(ssh -q ${wa[j]}.${LDN} df -m | head -n 2 | tail -n 1 | awk '{print $4}')
fm=$(du -h "${RD}/download/${lw}.tar" | awk '{print $1}' | sed "s|[^0-9]*||g")
(( em > fm )) && (echo "There's sufficient space uploading..." ; scp "${RD}/download/${lw}.tar" ${wa[j]}.${LDN}:/tmp) || (echo "There's insufficient space aborting!" ; exit 1)
#echo "Adding to EdgeOS vyatta subsystem.."
#ssh -q ${wa[j]}.${LDN} "sudo /usr/bin/ubnt-upgrade --upgrade /tmp/${lw}.tar"
;;
"no")
echo "Please read https://help.ui.com/hc/en-us/articles/205146110-EdgeRouter-How-to-Upgrade-the-EdgeOS-Firmware on how to upgrade EdgeOS."
;;
esac
)
;;
"mikrotik")
echo
check=$(ssh -q ${wa[j]}.${LDN} system package update check-for-updates | grep status | tail -n 1 | grep -c "New version is available")
[[ "${check}" ]] && (
iros=$(ssh -q ${wa[j]}.${LDN} system package update check-for-updates | grep installed | sed "s|[^0-9.]*||g" | uniq)
aros=$(ssh -q ${wa[j]}.${LDN} system package update check-for-updates | grep latest | sed "s|[^0-9.]*||g" | tail -n 1)
echo "new RouterOS version found for ${wa[j]}.${LDN}, installed ${iros}, latest ${aros}"
read -p "Download ${aros}?: yes/no " ctrl
case "${ctrl}" in
"yes")
ssh -q ${wa[j]}.${LDN} system package update download
echo "Remember to reboot ${wa[j]}.${LDN}"
;;
"no")
echo "Remember to manually upgrade ${wa[j]}.${LDN}"
;;
esac
)
;;
"raspi")
echo
echo "Upgrading Raspbian OS onto ${wa[j]}.${LDN}..."
check=$(ssh -q ${wa[j]}.${LDN} sudo apt update 2>/dev/null | grep packages | cut -d '.' -f 1 | tee /dev/fd/5)
[[ "upgraded" =~ "${check}" ]] && (
read -p "Upgrade?: yes/no " ctrl
case "${ctrl}" in
"yes")
ssh -q ${wa[j]}.${LDN} sudo apt upgrade 2>/dev/null
echo "Remember to reboot if necessary"
;;
"no")
echo "Remember to manually upgrade ${wa[j]}.${LDN}"
;;
esac
)
;;
esac
) || echo "${wa[j]}.${LDN} unreachable"
done
;;
#[openbsd|mikrotik|edgeos|ALL]
"-N")
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Connecting to ${wa[j]}.${LDN}..."
c=$(capa3 ${wa[j]}.${LDN} "wan")
[[ "${c}" == 1 ]] && (
case $(dnsquery -T ${wa[j]}) in
"openbsd")
ssh ${wa[j]}.${LDN} doas ksh "/home/taglio/Sources/Git/OpenBSD/setup_node -U newhost"
;;
"mikrotik")
openbsd=
while [ -z $openbsd ]
do
echo 'Type the new OpenBSD internal hostname '
read openbsd
done
mkaddr=$(dig A "$(dnsquery -M ${wa[j]}).${PDN}" +short)
mkpublichost="$(dnsquery -M ${wa[j]}).${PDN}"
wget "http://$openbsd.${LDN}/$mkpublichost/$mkpublichost.rsc" -O "/tmp/$mkpublichost.rsc"
scp "/tmp/$mkpublichost.rsc" " ${wa[j]}.${LDN}:/$mkpublichost.rsc"
ssh ${wa[j]}.${LDN} /import file-name=$mkpublichost.rsc
echo -e "Host ${wa[j]}.${LDN} configured into Mikrotik ${wa[j]}.${LDN}"
;;
"edgeos")
openbsd=
while [ -z $openbsd ]
do
echo 'Type the new OpenBSD internal hostname '
read openbsd
done
publicip=$(dig A "$(dnsquery -M ${openbsd}).${PDN}" +short)
publichost=$(dnsquery -M ${openbsd})".${PDN}"
#publicdomainname=$(dig -x $publicip +short | sed "s/$publichost.//" | sed 's/.$//')
publichostname=$(dnsquery -M "${wa[j]}")
phn=$(dnsquery -M "${wa[j]}")
wget "http://$openbsd.$2/$edgehost.tar" -O "/tmp/$edgehost.tar"
cd /tmp
if [[ ! -d "${phn}.${PDN}" ]]; then
mkdir "${phn}.${PDN}"
fi
tar xvf "/tmp/${phn}.${PDN}.tar" -C "/tmp/${phn}.${PDN}"
cd ${phn}.${PDN}
for file in $(ls .); do
if [[ $file = "gre.sh" || $file = "ospf.sh" ]]; then
cat $file | ssh -q ${wa[j]}.${LDN}
elif [[ $file = *updown.sh ]]; then
a=$(echo $file | sed "s/-updown.sh//")
c=$(echo $a | sed "s/-//")
v=$(echo $file | sed "s/$a/$c/")
metric=$(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show protocols static | grep table | awk '{print $2}' | wc -l)
let metric+=1
others=""
for prefix in $(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show protocols static | grep table | awk '{print $2}'); do
others+=$(printf '\t\t%s\\n' '/sbin/ip route add table '"${prefix}"' metric '"${metric}"' scope link default nexthop dev "${TUN_IFACE}"')
done
sed -i "s|/OTHERS/|${others}|" $file
scp -q $file "${wa[j]}.${LDN}:/tmp"
ssh -q ${wa[j]}.${LDN} "sudo mv /tmp/$file /config/ipsec/$v ; chmod +x /config/ipsec/$v"
elif [[ $file = *_netwatch.sh ]]; then
a=$(echo $file | sed "s/_netwatch.sh//")
c=$(echo $a | sed "s/-//")
v=$(echo $file | sed "s/$a/$c/")
scp -q $file "${wa[j]}.${LDN}:/tmp"
ssh -q ${wa[j]}.${LDN} "sudo mv /tmp/$file /config/scripts/$v; chmod +x /config/scripts/$v"
elif [[ $file = *.crt ]]; then
scp -q $file "${wa[j]}.${LDN}:/tmp"
ssh -q ${wa[j]}.${LDN} sudo cp "/tmp/$file" /config/auth; sudo mv "/tmp/$file" /etc/ipsec.d/certs/
elif [[ $file = *.conf ]]; then
if [[ $(ssh -q ${wa[j]}.${LDN} grep -c telecomlobby-$(head -n 1 $file | cut -d \- -f2) /config/ipsec.conf) -eq 0 ]]; then
cat $file | ssh -qt ${wa[j]}.${LDN} "cat - >> /config/ipsec.conf"
fi
fi
done
ssh -q ${wa[j]}.${LDN} echo "cp /config/auth/$publichostname.crt /etc/ipsec.d/certs/" >> /config/scripts/post-config.d/files.sh
ctrl=
while [ -z $ctrl ]
do
echo "Do you want to reread ipsec "
read ctrl
done
rm -rf "/tmp/${phn}.${PDN}"
case $ctrl in
"yes")
ssh -q ${wa[j]}.${LDN} ipsec rereadall
ssh -q ${wa[j]}.${LDN} ipsec reload
;;
"no")
;;
*)
echo 'Reply yes or no'
;;
esac
;;
esac
) || echo "${wa[j]}.${LDN} unreachable"
done
;;
"-C")
read -p "Type the internal hostname to clean: " ihtc
phtc=$(dnsquery -M "${ihtc}")".${PDN}"
[[ "${phtc}" == "" ]] && read -p "Type the external hostname because was deleted: " phtc
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Connecting to ${wa[j]}.${LDN}..."
c=$(capa3 ${wa[j]}.${LDN} "wan")
[[ "${c}" == 1 ]] && (
case $(dnsquery -T ${wa[j]}) in
"openbsd")
echo "${phtc}"
ghtc=$(ssh ${wa[j]}.${LDN} ifconfig gre | grep -wB 1 "${phtc}" | head -n 1 | awk '{print $1}' | sed "s|:$||")
echo "${ghtc}"
ssh ${wa[j]}.${LDN} "echo ${ghtc} > /tmp/cleantmp"
ssh ${wa[j]}.${LDN} doas ksh "/home/taglio/Sources/Git/OpenBSD/setup_node -A cleanlast"
;;
"mikrotik")
#ghtc=$(ssh ${wa[j]}.${LDN} ":put [/int gre get [find comment=xolotl] name;]" | tr -d '\r\n')
cat src/mikrotik/tools/clean_last.rsc > "${tf}"
sed -i "s|/HOSTNAME/|${ihtc}|g" "${tf}"
scp "${tf}" "${wa[j]}"."${LDN}":/clean.rsc
eval "ssh ${wa[j]}.${LDN} :execute \{/import clean.rsc\}"
;;
"edgeos")
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper begin" > "${tf}"
typeset -u uphtc=$(echo "${phtc}" | sed "s|.${PDN}||")
pip=$(dig A "${phtc}" +short)
[[ "${pip}" == "" ]] && read -p "Type the external ip address because was deleted: " pip
irid=$(dig A "${ihtc}".${LDN} +short)
[[ "${irid}" == "" ]] && read -p "Type the router id because was deleted: " irid
for i in $(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show firewall group | grep address-group | awk '{print $2}'); do
ssh -q ${wa[j]}.${LDN} sudo ipset list "${i}" | grep "${pip}" &> /dev/null
if [ $? -eq 0 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete firewall group address-group ${i} address ${pip}" >> $tf
type="${i}"
fi
done
ssh -q ${wa[j]}.${LDN} sudo ipset list ROUTERID | grep "${irid}" &> /dev/null
if [ $? -eq 0 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete firewall group address-group ROUTERID address ${irid}" >> $tf
fi
if [ $(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show firewall modify DMZMARK-"${uphtc}" | wc -l) -gt 1 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete firewall modify DMZMARK-${uphtc}" >> $tf
fi
ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show firewall modify PBR | grep -wB 3 "${uphtc}" &> /dev/null
if [ $? -eq 0 ]; then
ruleid=$(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show firewall modify PBR | grep -wB 3 "${uphtc}" | head -n 1 | awk '{print $2}')
tableid=$(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show firewall modify PBR | grep -wB 1 "${uphtc}" | grep -v "${uphtc}" | awk '{print $2}')
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete firewall modify PBR rule ${ruleid}" >> $tf
fi
ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show policy access-list 10 | grep -wB 3 "${irid}" &> /dev/null
if [ $? -eq 0 ]; then
ruleid=$(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show policy access-list 10 | grep -wB 3 "${irid}" | head -n 1 | awk '{print $2}')
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete policy access-list 10 rule ${ruleid}" >> $tf
fi
greint=$(ssh -q ${wa[j]}.${LDN} ip link show | grep -wB 2 "${phtc}" | head -n 1 | awk '{print $2}' | cut -d @ -f1)
if [[ "${greint}" == tun*[0-9] ]]; then
grenet=$(ssh -q ${wa[j]}.${LDN} ip route | grep -w "dev ${greint} proto kernel"| awk '{print $1}')
if [[ "${grenet}" == "" ]]; then
IFS=. read -r i1 i2 i3 i4 <<< $(ssh -q i${wa[j]}.${LDN} /sbin/ifconfig -a tun5 | grep inet | awk '{print $2}')
IFS=. read -r m1 m2 m3 m4 <<< "255.255.255.252"
grenet=$(printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))")"/30"
fi
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete protocols ospf area 0.0.0.0 network ${grenet}" >> $tf
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete protocols ospf passive-interface-exclude ${greint}" >> $tf
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete interfaces tunnel ${greint}" >> $tf
fi
ssh -q ${wa[j]}.${LDN} ip route | grep -w "${pip}" &> /dev/null
if [ $? -eq 0 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete protocols static interface-route ${pip}/32" >> $tf
fi
if [ $(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show protocols static table "${tableid}" | wc -l) -gt 1 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete protocols static table ${tableid}" >> $tf
fi
if [ $(ssh -q ${wa[j]}.${LDN} /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show system task-scheduler task ES${uphtc} | wc -l) -gt 1 ]; then
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper delete system task-scheduler task ES${uphtc}" >> $tf
fi
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper commit" >> $tf
echo "/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper save" >> $tf
cat "${tf}"
read -p "OK? yes/no " ctrl
case "${ctrl}" in
"yes")
cat "${tf}" | ssh -q ${wa[j]}.${LDN}
;;
"no")
exit 1
;;
*)
exit 1
;;
esac
case "${type}" in
"OPENBSD")
ssh -q ${wa[j]}.${LDN} sudo sed -i -e "/telecomlobby-${uphtc}/,+13d" /config/ipsec.conf
;;
"MIKROTIK")
ssh -q ${wa[j]}.${LDN}sudo sed -i -e "/telecomlobby-${uphtc}/,+11d" /config/ipsec.conf
;;
esac
ssh -q ${wa[j]}.${LDN} sudo cp /config/ipsec.conf /etc
if [ $(ssh -q i${wa[j]}.${LDN} sudo ipsec status telecomlobby-${uphtc} | grep -v Security | grep -c ESTABLISHED) -gt 0 ]; then
ssh -q ${wa[j]}.${LDN} sudo ipsec down telecomlobby-${uphtc}
fi
ssh -q ${wa[j]}.${LDN} [[ -e "/config/ipsec/ES${uphtc}-updown.sh" ]] && rm -rf "/config/ipsec/ES${uphtc}-updown.sh"
ssh -q ${wa[j]}.${LDN} [[ -e "/config/auth/${phtc}.crt" ]] && rm -rf "/config/auth/${phtc}.crt"
ssh -q ${wa[j]}.${LDN} [[ -e "/etc/ipsec.d/certs/${phtc}.crt" ]]
if [ $? -eq 0 ]; then
ssh -q ${wa[j]}.${LDN} sudo rm -rf "/etc/ipsec.d/certs/${phtc}.crt"
fi
if [ $(ssh -q ${wa[j]}.${LDN} grep -wc ${phtc} /config/scripts/post-config.d/files.sh) -gt 0 ]; then
ssh -q ${wa[j]}.${LDN} sudo sed -i "/${phtc}.crt/d" /config/scripts/post-config.d/files.sh
fi
ssh -q ${wa[j]}.${LDN} sudo ipsec rereadall
ssh -q ${wa[j]}.${LDN} sudo ipsec reload
;;
esac
) || echo "${wa[j]}.${LDN} unreachable"
done
;;
#[openbsd|edgeos|ALL]
"-F")
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Connecting to ${wa[j]}.${LDN}..."
c=$(capa3 ${wa[j]}.${LDN} "wan")
[[ "${c}" == 1 ]] && (
case $(dnsquery -T ${wa[j]}) in
"openbsd")
ssh ${wa[j]}.${LDN} doas ksh "/home/taglio/Sources/Git/OpenBSD/setup_node -U file"
;;
"edgeos")
read -p "Type the src/edgeos/config file to update into ${wa[j]}.${LDN}: " fedge
[[ -e "src/edgeos/config/${fedge}" ]] || (echo "file not found" ; exit 1)
scp "src/edgeos/config/${fedge}" "${wa[j]}.${LDN}:/tmp/${fedge}"
ssh "${wa[j]}.${LDN} sudo mv /tmp/${fedge} /config/${fedge}"
echo "Depending on which file you've updated you'll copy to /etc and reload daemons"
;;
esac
) || echo "${wa[j]}.${LDN} unreachable"
done
;;
#[ALL]
"-KD")
echo "Current GMT time is: $(LANG=uk_UK date -u '+%b %d %H:%M:%S %Y GMT')"
echo "Current epoch time is: $(date +"%s")"
echo "Looking at OpenBSD hosts..."
currrentepoch=$(date +"%s")
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Connecting to ${wa[j]}.${LDN}..."
c=$(capa3 ${wa[j]}.${LDN} "wan")
[[ "${c}" == 1 ]] && (
case $(dnsquery -T ${wa[j]}) in
"openbsd")
;;
"mikrotik")
;;
"edgeos")
;;
esac
) || echo "${wa[j]}.${LDN} unreachable"
done
for vpnc_host in $(dig openbsd.${LDN} TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
deadline=$(ssh -o LogLevel=QUIET -t $vpnc_host.${LDN} openssl x509 -in "/etc/iked/certs/local.crt" -noout -enddate | sed "s|^notAfter=||")
echo "IPsec SSL certificate deadline of $vpnc_host is: $deadline"
echo "IPsec SSL certificate epoch deadline of $vpnc_host is: $(date --date "${deadline}" "+%s")"
deadlineepoch=$(date --date "${deadline}" "+%s")
if [ "$deadlineepoch" -lt "$currrentepoch" ]; then
openbsdiked+=("$vpnc_host")
echo "$vpnc_host IPsec SSL certificate has to be upgraded"
fi
done
echo "Looking at Ubiquiti EdgeOS hosts..."
for vpnc_host in $(dig edgeos.${LDN} TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d' | cut -d : -f1); do
deadline=$(ssh -o LogLevel=QUIET -t $vpnc_host.${LDN} openssl x509 -in "/config/auth/local/*.crt" -noout -enddate | sed "s|^notAfter=||")
echo "IPsec SSL certificate deadline of $vpnc_host is: $deadline"
echo "IPsec SSL certificate epoch deadline of $vpnc_host is: $(date --date "${deadline}" "+%s")"
deadlineepoch=$(date --date "${deadline}" "+%s")
if [ "$deadlineepoch" -lt "$currrentepoch" ]; then
edgeosiked+=("$vpnc_host")
echo "$vpnc_host IPsec SSL certificate has to be upgraded"
fi
done
if [ ${#edgeosiked[@]} -gt 0 ]; then
echo "edgeos"
fi
if [ ${#openbsdiked[@]} -gt 0 ]; then
echo "openbsd"
for i in "${openbsdiked[@]}"; do
echo "Working into $i Ipsec SSL certificate upgrade"
ikedpub=
while [ -z $ikedpub ]
do
echo "Type the PATH to the upgraded iked PK12 file for $i "
read ikedpub
done
tmpdir=$(mktemp -d)
pk12=$(basename $ikedpub)
publichost=$(echo $pk12 | sed 's/.p12//')
publichostname=$(echo $publichost | cut -d . -f1)
domainname=$(echo $publichost | sed "s/$publichostname.//")
for a in $(dig ipsec20591.$domainname TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
b=$(echo $a | cut -d : -f1)
if [[ "$b" -eq "$publichostname" ]]; then
srcid=$(echo $a | cut -d : -f2)
fi
done
echo "uploading P12 to /tmp onto $i"
scp $ikedpub "$i.${LDN}:/tmp"
ssh -t $i.${LDN} doas ksh "/home/taglio/Sources/Git/OpenBSD/tools/ikedsslupgade"
scp ca.telecom.lobby:/etc/ssl/ca.telecomlobby.com/certs/$publichost.crt "$tmpdir/$publichost.crt"
echo "uploading .crt to EdgeOS hosts"
for vpnc_host in $(dig edgeos.${LDN} TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d' | cut -d : -f1); do
scp "$tmpdir/$publichost.crt" "$vpnc_host.${LDN}:/config/auth"
ssh $vpnc_host.${LDN} "sudo cp /config/auth/${publichost}.crt /etc/ipsec.d/certs/"
ssh $vpnc_host.${LDN} "sudo ipsec rereadall"
ssh $vpnc_host.${LDN} "sudo ipsec reload"
done
openssl x509 -legacy -pubkey -noout -passin pass:123456789 -in "$tmpdir/$publichost.crt" > src/etc/iked/pubkeys/ufqdn/"$srcid@ca.$domainname"
srm -r "${tmpdir}"
echo -e "$srcid@ca.$domainname created please update repository and all the others Openbsd hosts"
done
fi
;;
#[openbsd]
"-G"|"-S"|"-D"|"-PF"|"-7")
ws="doas ksh /home/taglio/Sources/Git/OpenBSD/setup_node"
[[ "${5}" == "-G" ]] && rcmd="git -C "$proghome" pull"
[[ "${5}" == "-S" ]] && rcmd="${ws} -U scripts"
[[ "${5}" == "-D" ]] && rcmd="${ws} -U dyndnspop"
[[ "${5}" == "-PF" ]] && rcmd="${ws} -U pf"
[[ "${5}" == "-7" ]] && rcmd="doas ksh /home/taglio/Sources/Git/OpenBSD/tools/seven"
for (( j=0; j<${#wa[@]}; j++ )); do
echo -e "Connecting to ${wa[j]}.${LDN}"
eval "ssh ${wa[j]}.${LDN} ${rcmd}"
done
;;
#[mikrotik]
"-CHR")
read -p "Type LTE public hostname: " chr
publichostname=$(echo "${chr}" | cut -d . -f1)
chrpubip=$(dig A "${chr}" +short)
lhn=$(dnsquery -MR $(echo "${publichostname}" | sed "s|.${PDN}||"))
let counter=0
counter=$(expr $counter + $(capa3 "${chr}" "wan"))
if (( counter = 1 )); then
echo "Layer three test passed..."
pwd=$(passcheck "${chr}")
ssh-keygen -f "$HOME/.ssh/known_hosts" -R "${chr}"
if [[ $pwd = "0" ]]; then
echo "no password present"
echo "follow README.md of github" ; exit 1
elif [[ $pwd = "143" ]]; then
echo "with password"
password=$(systemd-ask-password "Enter ${chr} ${userna} password: ")
sshcmd="sshpass -p ${password} ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5"
scpcmd="sshpass -p ${password} scp -o StrictHostKeyChecking=no -o ConnectTimeout=5"
fi
echo "resetting default values"
eval "${scpcmd} src/mikrotik/CHR-reset.rsc ${userna}@${chr}:/"
eval "${sshcmd} ${userna}@${chr} :execute \{/import file-name=CHR-reset.rsc\}"
echo "configuring hostname, timezone, date, time"
eval "${sshcmd} ${userna}@${chr} /sys id set name=${lhn}.${LDN}"
chrtz=$(curl -s "http://ipinfo.io/${chrpubip}" | sed '/readme/d' | grep timezone | awk '{print $2}' | sed -e "s|\"||g" -e "s|,||")
eval "${sshcmd} ${userna}@${chr} /sys clock set time-zone-name=${chrtz}"
chrdate=$(date +%b/%d/%Y)
eval "${sshcmd} ${userna}@${chr} /system clock set date=${chrdate}"
chrtime=$(TZ="${chrtz}" date | awk '{print $5}')
eval "${sshcmd} ${userna}@${chr} /system clock set time=${chrtime}"
echo "adding ${userna} RSA ssh key"
[[ -e "$HOME/.ssh/id_rsa.pub" ]] || ssh-keygen -t rsa -C "${userna}@${LDN}"
eval "${scpcmd} $HOME/.ssh/id_rsa.pub ${userna}@${chr}:/"
eval "${sshcmd} ${userna}@${chr} /user ssh-keys remove [find user=${userna}] \; /user ssh-keys import user=${userna} public-key-file=id_rsa.pub"
sshcmd="ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5"
scpcmd="scp -o StrictHostKeyChecking=no -o ConnectTimeout=5"
echo "adding ${chr} common IPSEC settings"
eval "${sshcmd} ${userna}@${chr} /ip ipsec policy group add name=group_ikev2_cert"
eval "${sshcmd} ${userna}@${chr} /ip ipsec profile add dh-group=ecp384,modp3072 dpd-interval=30s dpd-maximum-failures=1 enc-algorithm=aes-256 hash-algorithm=sha256 name=NSA-RECOMMENDED nat-traversal=no"
eval "${sshcmd} ${userna}@${chr} /ip ipsec proposal add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=1h name=NSA pfs-group=none"
ipsecpeers=$(tempfile)
mkr=$(dnsquery -R "mikrotik")
echo ":foreach P in=[/ip ipsec peer find] do={ /ip ipsec peer remove \$P }" > ${ipsecpeers}
eval "${sshcmd} ${userna}@${mkr}.${LDN} /ip ipsec peer export >> ${ipsecpeers}"
sed -i "s|45.32.144.15|${chrpubip}|g" "${ipsecpeers}"
echo "/ip ipsec peer add name=uma_ikev2_cert address=45.32.144.15 local-address=${chrpubip} exchange-mode=ike2 profile=NSA-RECOMMENDED" >> ${ipsecpeers}
eval "${scpcmd} ${ipsecpeers} ${userna}@${chr}:/ipsec_peers.rsc"
srm "${ipsecpeers}"
eval "${sshcmd} ${userna}@${chr} /import file-name=ipsec_peers.rsc"
echo "installing local private and public key and peers public keys"
read -p "Type local directory with p12 exported IPsec certificates: " p12dir
ssh "${userna}@${chr}" ":foreach C in=[/certificate find] do={/certificate remove \$C}"
eval "${scpcmd} ${p12dir}/${srcid}/${chr}.p12 ${userna}@${chr}:/"
eval "${sshcmd} ${userna}@${chr} /certificate import file-name=${chr}.p12 name=${chr} passphrase=123456789"
eval "${sshcmd} ${userna}@${chr} /certificate set [find name=${chr}_1] name=ca.telecomlobby.com"
for certpath in $(find "${p12dir}" -name "*.p12"); do
certfile=$(basename "${certpath}")
peerpublichostname=$(echo "${certfile}" | sed "s|.p12||")
certdir=$(dirname "${certpath}")
peerlocalhostname=$(echo "${certdir}" | sed "s|${p12dir}/||")
tmpdir=$(mktemp -d)
openssl pkcs12 -nodes -in "${certpath}" -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/$peerlocalhostname.crt"
eval "${scpcmd} $tmpdir/$peerlocalhostname.crt ${userna}@${chr}:/"
eval "${sshcmd} ${userna}@${chr} /certificate import file-name=$peerlocalhostname.crt name=${peerpublichostname} passphrase=123456789"
srm -r "${tmpdir}"
done
ipsecpeers=$(mktemp)
echo ":foreach P in=[/ip ipsec identity find] do={ /ip ipsec identity remove \$P }" > ${ipsecpeers}
eval "${sshcmd} ${userna}@uma.telecom.lobby /ip ipsec identity export >> ${ipsecpeers}"
sed -i "s|fr.telecomlobby.com|ixp.telecomlobby.com|g" "${ipsecpeers}"
eval "${scpcmd} ${ipsecpeers} ${userna}@${chr}:/ipsec_identity.rsc"
eval "${sshcmd} ${userna}@${chr} /import file-name=ipsec_identity.rsc"
eval "${sshcmd} ${userna}@${chr} /ip ipsec identity add peer=uma_ikev2_cert auth-method=digital-signature remote-id=user-fqdn:uma@ca.telecomlobby.com match-by=certificate certificate=ixp.telecomlobby.com remote-certificate=fr.telecomlobby.com generate-policy=no policy-template-group=group_ikev2_cert"
srm "${ipsecpeers}"
ipsecpolicy=$(mktemp)
eval "${sshcmd} ${userna}@uma.telecom.lobby /ip ipsec policy export > ${ipsecpolicy}"
sed -i '/set/d' "${ipsecpolicy}"
sed -i '/policy\ group/d' "${ipsecpolicy}"
sed -i '/group_ikev2_cert/d' "${ipsecpolicy}"
sed -i "s|45.32.144.15|${chrpubip}|g" "${ipsecpolicy}"
echo "/ip ipsec policy add dst-address=45.32.144.15/32 peer=uma_ikev2_cert proposal=NSA protocol=gre src-address=${chrpubip}" >> "${ipsecpolicy}"
eval "${scpcmd} ${ipsecpolicy} ${userna}@${chr}:/ipsec_policy.rsc"
eval "${sshcmd} ${userna}@${chr} /import file-name=ipsec_policy.rsc"
echo "IPSec configured, going ahead..."
srm "${ipsecpolicy}"
echo "Cleaning files"
eval "${scpcmd} src/mikrotik/file_clean.rsc ${userna}@${chr}:/"
eval "${sshcmd} ${userna}@${chr} :execute \{/import file_clean.rsc\}"
fi
echo "start to configure GRE interfaces"
grepeers=$(mktemp)
eval "${sshcmd} ${userna}@uma.telecom.lobby /interface gre export >> ${grepeers}"
sed -i "s|45.32.144.15|${chrpubip}|g" "${grepeers}"
echo "/interface gre add allow-fast-path=no clamp-tcp-mss=no comment=uma keepalive=5s,2 local-address=${chrpubip} mtu=1392 remote-address=45.32.144.15" >> "${grepeers}"
eval "${scpcmd} ${grepeers} ${userna}@${chr}:/interface_gre.rsc"
eval "${sshcmd} ${userna}@${chr} :execute \{/import interface_gre.rsc\}"
srm "${grepeers}"
echo "configuring routing OSPF filters"
rtfilter=$(mktemp)
echo "/routing filter" > "${rtfilter}"
echo "add action=accept chain=ospf-in comment=\"insert HOST 192.168.13.0/24\" prefix=192.168.13.0/24 prefix-length=32" >> "${rtfilter}"
echo "add action=accept chain=ospf-in comment=\"insert NET 172.16.16.0/22\" prefix=172.16.16.0/22 prefix-length=24" >> "${rtfilter}"
echo "add action=accept chain=ospf-in comment=\"insert NET 10.0.0.0/8\" prefix=10.0.0.0/8 prefix-length=8" >> "${rtfilter}"
randomop=$(dig TXT openbsd.telecom.lobby +short | sed "s|\"||g" | tr ";" "\n" | awk NF | shuf -n 1)
for host in $(ssh "${randomop}.telecom.lobby" cat /etc/pf.conf.table.{clientes,ipsec} | grep -v \# | awk NF | uniq); do
echo "add action=accept chain=ospf-in comment=\"insert HOST ${host}\" prefix=${host} prefix-length=32" >> "${rtfilter}"
done
echo "add action=discard chain=ospf-in comment=\"discard ALL\"" >> "${rtfilter}"
echo "add action=accept chain=ospf-out comment=\"insert HOST 192.168.13.0/24\" prefix=192.168.13.0/24 prefix-length=32" >> "${rtfilter}"
echo "add action=accept chain=ospf-out comment=\"insert NET 172.16.16.0/22\" prefix=172.16.16.0/22 prefix-length=24" >> "${rtfilter}"
echo "add action=accept chain=ospf-out comment=\"insert NET 10.0.0.0/8\" prefix=10.0.0.0/8 prefix-length=8" >> "${rtfilter}"
for host in $(ssh "${randomop}.telecom.lobby" cat /etc/pf.conf.table.{clientes,ipsec} | grep -v \# | awk NF | uniq); do
echo "add action=accept chain=ospf-out comment=\"insert HOST ${host}\" prefix=${host} prefix-length=32" >> "${rtfilter}"
done
echo "add action=discard chain=ospf-out comment=\"discard ALL\"" >> "${rtfilter}"
eval "${scpcmd} ${rtfilter} ${userna}@${chr}:/rtfilter.rsc"
eval "${sshcmd} ${userna}@${chr} :execute \{/import rtfilter.rsc\}"
srm "${rtfilter}"
read -p "Type the CHR routerid: " chrid
echo "configuring OSPF daemon"
eval "${sshcmd} ${userna}@${chr} /routing ospf instance set [ find default=yes ] redistribute-connected=as-type-2 redistribute-other-ospf=as-type-1 redistribute-static=as-type-2 router-id=${chrid}"
eval "${sshcmd} ${userna}@${chr} /int bri add name=lo1 comment=\"router-id\" protocol-mode=none"
eval "${sshcmd} ${userna}@${chr} /ip addr add address=${chrid}/32 interface=lo1"
eval "${sshcmd} ${userna}@${chr} /routing ospf interface add authentication-key-id=100 cost=1 interface=lo1 network-type=broadcast passive=yes"
eval "${sshcmd} ${userna}@${chr} /interface list add name=GRE"
let lastnetwork=$(dig TXT gre7058."${domainname}" +short | sed "s|\"||g")+0
ospfinterface=$(mktemp)
for chrgre in $(ssh "${userna}@${chr}" :foreach i in=[/interface gre find] do=\{:put [/interface gre get \$i name]\; \}); do
lastnetwork=$(expr $lastnetwork - 4)
firstip=$(expr $lastnetwork + 1)
eval "${sshcmd} ${userna}@${chr} /ip addr add address=10.10.10.${firstip}/30 interface=${chrgre}"
eval "${sshcmd} ${userna}@${chr} /routing ospf network add area=backbone network=10.10.10.${lastnetwork}/30"
ospfmd5=$(tr -cd '[:alnum:],.' < /dev/random | fold -w 15 | head -n 1)
ssh ${userna}@${chr} routing ospf interface add authentication=md5 authentication-key=${ospfmd5} network-type=point-to-point interface="${chrgre}"
eval "${sshcmd} ${userna}@${chr} /interface list member add list=GRE interface=${chrgre}"
done
echo "configuring RouterOS web server access list and firewall address list"
randomop=$(dig TXT openbsd.telecom.lobby +short | sed "s|\"||g" | tr ";" "\n" | awk NF | shuf -n 1)
acweb=""
for host in $(ssh "${randomop}.telecom.lobby" cat /etc/pf.conf.table.ipsec | grep -v \# | awk NF | uniq); do
acweb+="${host},"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=servers address=${host}"
done
for host in $(ssh "${randomop}.telecom.lobby" cat /etc/pf.conf.table.clientes | grep -v \# | awk NF | uniq); do
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=otherswan address=${host}"
done
acweb=${acweb::-1}
eval "${sshcmd} ${userna}@${chr} /ip service set www address=${acweb}"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=lan address=196.168.13.0/24"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=lan address=172.16.17.0/24"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=lan address=172.16.18.0/24"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=lan address=172.16.19.0/24"
eval "${sshcmd} ${userna}@${chr} /ip firewall address-list add list=lan address=10.10.10.0/24"
cp src/mikrotik/filter.rsc /tmp
sed -i "s|/PUBLICIP/|${chrpubip}|g" /tmp/filter.rsc
eval "${scpcmd} /tmp/filter.rsc ${userna}@${chr}:/filter.rsc"
eval "${sshcmd} ${userna}@${chr} :execute \{/import filter.rsc\}"
srm /tmp/filter.rsc
echo "configuring routing domains"
for chrgre in $(ssh "${userna}@${chr}" :foreach i in=[/interface gre find] do=\{:put [/interface gre get \$i name]\; \}); do
gre=$(echo "${chrgre}"| sed 's/\r//g')
com=$(ssh ixp.telecomlobby.com /int gre print where name="${gre}");
comm=$(echo "${com}" | sed 's/\r//g')
poplocalhostname=$(echo "${comm}" | awk 'NR==2' | sed "s|^.*;;; ||")
echo "/ip firewall mangle add action=mark-connection chain=input connection-mark=no-mark passthrough=yes dst-address=${chrid} in-interface=${gre} new-connection-mark=${poplocalhostname}"
eval "${sshcmd} ${userna}@${chr} /ip firewall mangle add action=mark-connection chain=input connection-mark=no-mark passthrough=yes dst-address=${chrid} in-interface=${gre} new-connection-mark=${poplocalhostname}"
echo "/ip firewall mangle add action=mark-routing chain=output connection-mark=${poplocalhostname} new-routing-mark=${poplocalhostname} out-interface=!${gre} passthrough=yes src-address=${chrid}"
eval "${sshcmd} ${userna}@${chr} /ip firewall mangle add action=mark-routing chain=output connection-mark=${poplocalhostname} new-routing-mark=${poplocalhostname} out-interface=!${gre} passthrough=yes src-address=${chrid}"
echo "/ip route rule add routing-mark=${poplocalhostname} table=${poplocalhostname} action=lookup-only-in-table"
eval "${sshcmd} ${userna}@${chr} /ip route rule add routing-mark=${poplocalhostname} table=${poplocalhostname} action=lookup-only-in-table"
echo "/ip route add distance=1 gateway=${gre} routing-mark=${poplocalhostname} comment=\"from ${poplocalhostname} to ${chrid}\""
eval "${sshcmd} ${userna}@${chr} /ip route add distance=1 gateway=${gre} routing-mark=${poplocalhostname} comment=\"from ${poplocalhostname} to ${chrid}\""
done
echo "starting remote install"
for poplocalhostname in $(dig TXT openbsd.telecom.lobby +short | sed "s|\"||g" | tr ";" "\n" | awk NF); do
ssh "${poplocalhostname}".telecom.lobby install -o "${userna}" -g wheel -m 0750 "${HOME}/Sources/Git/OpenBSD/src/mikrotik/openbsd/newchr.sh ${HOME}/Bin/"
#[[ "${poplocalhostname}" == "varuna" ]] && poplocalhostname="neo"
pophost=$(dig ipsec20591.${domainname} TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d' | grep "${poplocalhostname}" | cut -d : -f1)".${domainname}"
popip=$(dig A "${pophost}" +short)
x="7"
#[[ "${poplocalhostname}" == "neo" ]] && poplocalhostname="varuna"
[[ "${poplocalhostname}" == "bhagavati" ]] && x="8"
popgre=$(ssh ${userna}@${chr} int gre print where comment="${poplocalhostname}" | grep -E "gre-tunnel[0-9]{1,2}" | awk '{print $1}' | sed -e "s|name=||" -e "s|\"||g")
let a=$(ssh ${userna}@${chr} ip addr print where interface="${popgre}" | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | head -n 1 | cut -d . -f4)+0
md5=$(ssh ${userna}@${chr} routing ospf interface pr where interface="${popgre}" | awk '{print $7}' | grep -E '^.{15}$')
greip="10.10.10."${a}
b=$(expr $a + 1)
popgreip="10.10.10."${b}
mkdir "/tmp/${poplocalhostname}"
cp "src/mikrotik/openbsd/"{iked.conf,hostname.enc,hostname.gre,ospfd.conf} "/tmp/${poplocalhostname}"
mv "/tmp/${poplocalhostname}/hostname.gre" "/tmp/${poplocalhostname}/hostname.gre${x}"
mv "/tmp/${poplocalhostname}/hostname.enc" "/tmp/${poplocalhostname}/hostname.enc${x}"
for file in $(find "/tmp/${poplocalhostname}" -maxdepth 1 -type f); do
sed -i "s|/PUBLICHOST/|${chr}|g" $file
sed -i "s|/POPIP/|${popip}|g" $file
sed -i "s|/PUBLICIP/|${chrpubip}|g" $file
sed -i "s|/POPHOST/|${pophost}|g" $file
sed -i "s|/POPLOCALHOSTNAME/|${poplocalhostname}|g" $file
sed -i "s|/HOSTNAME/|${srcid}|g" $file
sed -i "s|/POPGREIP/|${popgreip}|g" $file
sed -i "s|/GREIP/|${greip}|g" $file
sed -i "s|/X/|${x}|g" $file
sed -i "s|/MD5/|${md5}|g" $file
done
tar -cvf /tmp/calli.tar -C /tmp "/tmp/${poplocalhostname}/"
srm -r "/tmp/${poplocalhostname}"
echo "uploading to ${poplocalhostname}..."
scp /tmp/calli.tar "${poplocalhostname}.${localdomainname}:/tmp"
srm "/tmp/calli.tar"
#ssh "${poplocalhostname}.${localdomainname}" doas ksh /home/taglio/Bin/newchr.sh
done
;;
"-LTE")
read -p "Local or remote configuration?: [local|remote|next] " ctrl
case "${ctrl}" in
"local")
read -p "In what world sector do you plan to install the LTE CPE?: [12|34|56] " geo
declare -a ps
dnsquery wa "openbsd"
latencyquery wa ps
ssh-keygen -f "${HOME}/.ssh/known_hosts" -R "192.168.88.1"
cat "src/mikrotik/LTE/lte_basic.rsc" > "${tf}"
read -p "Type the LTE router hostname: " hostname
sed -i "s|/HOSTNAME/|${hostname}|g" "${tf}"
read -p "Type the LTE router LTE provider: [digi|xenet] " provider
sed -i "s|/PROVIDER/|${provider}|g" "${tf}"
case "${provider}" in
"digi")
sed -i "s|/APN/|internet.digimobil.es|g" "${tf}"
sed -i "s|/MMCMNC/|21407|g" "${tf}"
sed -i "s|/MVNO/|DIGI|g" "${tf}"
;;
"xenet")
sed -i "s|/APN/|datos|g" "${tf}"
sed -i "s|/MMCMNC/|21403|g" "${tf}"
sed -i "s|/MVNO/|PTVTELECOM|g" "${tf}"
;;
*)
echo "Available MVNO Mobile Virtual Network Operator in Spain are DIGI or XENET"
exit 1
;;
esac
read -p "Type the LTE SIM PIN: " simpin
sed -i "s|/SIMPIN/|${simpin}|g" "${tf}"
read -p "Type the L2TP POP public hostname: " l2tppop
sed -i "s|/L2TPPOP/|$(dig A ${l2tppop} +short | tr -d '\n')|g" "${tf}"
read -p "Type the L2TP IPv4 binded: " l2tpip
sed -i "s|/L2TPIP/${l2tpip}|g" "${tf}"
sed -i "s|/L2TPPOP/|$(dig A ${l2tppop} +short | tr -d '\n')|g" "${tf}"
l2tppwd=$(systemd-ask-password "Type the L2TP user password: ")
sed -i "s|/L2TPPWD/|${l2tppwd}|g" "${tf}"
l2tpipsec=$(systemd-ask-password "Type the L2TP IPSEC key: ")
sed -i "s|/L2TPIPSEC/|${l2tpipsec}|g" "${tf}"
usrpwd=$(systemd-ask-password "Type the router user password: ")
sed -i "s|/USRPWD/|${usrpwd}|g" "${tf}"
cat "${tf}"
read -p "Go Ahead? [yes/no]: " ctrl
[[ "${ctrl}" == "yes" ]] && (
echo -e "Connecting to ${hostname} for first configuration..."
c=$(capa3 "192.168.88.1" "wan")
[[ "${c}" == 1 ]] && (
scp -q -o StrictHostKeyChecking=no "${tf}" admin@192.168.88.1:/lte_basic.rsc
scp -q -o StrictHostKeyChecking=no "${HOME}/.ssh/id_rsa.pub" admin@192.168.88.1:/
eval "ssh -q -o StrictHostKeyChecking=no admin@192.168.88.1 :execute \{/import lte_basic.rsc\}"
) || echo "${hostname} unreachable at default 192.168.88.1"
)|| exit 1
;;
"next")
echo -e "Getting variables..."
ssh-keygen -f "/home/taglio/.ssh/known_hosts" -R "10.1.10.1"
ddns=$(ssh 10.1.10.1 /ip cloud pr | grep -w dns\-name | awk '{print $2}' | tr -d '\n\r') ; echo -e "DDNS --> ${ddns}"
imei=$(ssh 10.1.10.1 /int lte info lte1 once | grep imei | awk '{print $2}' | tr -d '\n\r') ; echo -e "IMEI --> ${imei}"
imsi=$(ssh 10.1.10.1 /int lte info lte1 once | grep imsi | awk '{print $2}' | tr -d '\n\r') ; echo -e "IMSI --> ${imsi}"
iccid=$(ssh 10.1.10.1 /int lte info lte1 once | grep uicc | awk '{print $2}' | tr -d '\n\r' | sed "s|.$||") ; echo -e "ICCID --> ${iccid}"
hostname=$(ssh 10.1.10.1 /sys id pr | awk '{print $2}' | sed '$d' | cut -d . -f1 | tr -d '\n\r')
l2tppop=$(ssh 10.1.10.1 ":put [/int l2tp-client get [find user=${hostname}] comment;]" | tr -d '\n\r')
l2tpphn=$(echo "${l2tppop}" | cut -d . -f1)
read -p "Type the MSISDN: " msisdn
echo -e "adding DDNS to ${l2tppop}"
l2tplhn=$(dnsquery -MR "${l2tpphn}")
counter=$(ssh "${l2tplhn}"."${LDN}" ":put [/ip firewall address-list get [find comment=${hostname}]] | grep -v such | wc -l")
(( counter = 0 )) && (
ssh "${l2tplhn}"."${LDN}" "/ip fire address-list add list=lte address=${ddns} comment=${hostname}"
) || (
ssh "${l2tplhn}"."${LDN}" "/ip fire address-list remove [ find comment=${hostname} ]"
ssh "${l2tplhn}"."${LDN}" "/ip fire address-list add list=lte address=${ddns} comment=${hostname}"
)
echo "adding comment to MOTD onto ${hostname}"
ssh 10.1.10.1 "/sys note set note=\"\nIMEI: ${imei}\nIMSI: ${imsi}\nICCID: ${iccid}\nMSISDN: ${msisdn}\""
echo "Producing values..."
phn=$(cat /dev/urandom | tr -dc '[:alpha:]' | fold -w 3 | head -n 1 | tr '[:upper:]' '[:lower:]')
echo "The public hostname is ${phn}.${PDN} and must resolve $(ssh 10.1.10.1 /ip addr pr where interface=l2tp-out1 | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | head -n 1 | tr -d '\n\r')"
routerid="192.168.13.$(shuf -i 1-255 -n 1)"
echo "The routerid is ${routerid}"
read -p "Is ${hostname} a LTE router or a LTE CPE?: [router|cpe] " ctrl
case "${ctrl}" in
"router")
lteadm="172.16.$(shuf -i 1-255 -n 1).0/24"
echo "The LTE router ADM vlan is ${lteadm}"
ltedata="172.16.$(shuf -i 1-255 -n 1).0/24"
echo "The LTE router DATA vlan is ${ltedata}"
lteham="172.16.$(shuf -i 1-255 -n 1).0/24"
echo "The LTE router HAM vlan is ${lteham}"
;;
"cpe")
echo "In this case ${hostname} will configured in the remote step as NAT router using 10.1.10.0/24 as ether1 network."
;;
*)
echo "Type router or cpe!" ; exit 1
;;
esac
;;
"remote")
read -p "Type LTE router public hostname: " lte
phn=$(echo "${lte}" | cut -d . -f1)
ltepubip=$(dig A "${lte}" +short)
lhn=$(dnsquery -MR "${phn}")
let counter=0
counter=$(expr $counter + $(capa3 "${lte}" "wan"))
if (( counter = 1 )); then
echo "Layer three test passed..."
pwd=$(passcheck "${lte}")
ssh-keygen -f "$HOME/.ssh/known_hosts" -R "${lte}"
if [[ $pwd = "0" ]]; then
echo "SSH key present and valid"
sshcmd="ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5"
scpcmd="scp -o StrictHostKeyChecking=no -o ConnectTimeout=5"
elif [[ $pwd = "143" ]]; then
echo "with password"
password=$(systemd-ask-password "Enter ${lte} ${userna} password: ")
sshcmd="sshpass -p ${password} ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5"
scpcmd="sshpass -p ${password} scp -o StrictHostKeyChecking=no -o ConnectTimeout=5"
fi
fi
eval "${scpcmd} src/mikrotik/LTE-reset.rsc ${userna}@${lte}:/LTEreset.rsc"
eval "${sshcmd} ${userna}@${lte} /import file-name=LTEreset.rsc"
echo "configuring hostname, timezone, date, time"
eval "${sshcmd} ${userna}@${lte} /sys id set name=${lhn}.${LDN}"
eval "${sshcmd} ${userna}@${lte} /sys clock set time-zone-name=Europe/Madrid"
ltedate=$(date +%b/%d/%Y)
eval "${sshcmd} ${userna}@${lte} /system clock set date=${ltedate}"
ltetime=$(TZ="Europe/Madrid" date | awk '{print $5}')
eval "${sshcmd} ${userna}@${lte} /system clock set time=${ltetime}"
echo "adding ${userna} RSA ssh key"
[[ -e "$HOME/.ssh/id_rsa.pub" ]] || ssh-keygen -t rsa -C "${userna}@${localdomainname}"
eval "${scpcmd} $HOME/.ssh/id_rsa.pub ${userna}@${lte}:/"
eval "${sshcmd} ${userna}@${lte} /user ssh-keys remove [find user=${userna}] \; /user ssh-keys import user=${userna} public-key-file=id_rsa.pub"
sshcmd="ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5"
scpcmd="scp -o StrictHostKeyChecking=no -o ConnectTimeout=5"
echo "adding ${lte} common IPSEC settings"
eval "${sshcmd} ${userna}@${lte} /ip ipsec policy group add name=group_ikev2_cert"
eval "${sshcmd} ${userna}@${lte} /ip ipsec profile add dh-group=ecp384,modp3072 dpd-interval=30s dpd-maximum-failures=1 enc-algorithm=aes-256 hash-algorithm=sha256 name=LTE nat-traversal=yes"
eval "${sshcmd} ${userna}@${lte} /ip ipsec proposal add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=1h name=NSA pfs-group=none"
rtdomain=$(tempfile)
mk=$(dnsquery -R "mikrotik")
mkphn=$(dnsquery -M "${mk}")
mkip=$(dig A "${mkphn}.${PDN}" +short)
for ipipsec in $(ssh ${userna}@${mk}.${LDN} /ip fire addr pr where list=ipsec | sed -e "s|^.*${mkip}.*$||" | awk '{print $3}' | sed -e "/^$/d" | tail -n +3); do
[[ $(dnsquery -TT "${ipipsec}" "openbsd") ]] && echo "/ip fire address-list add list=ipsec address=${ipipsec}" >> "${rtdomain}"
done
echo "/ip firewall mangle add action=mark-connection chain=output dst-address-list=ipsec new-connection-mark=ipsec passthrough=yes" >> "${rtdomain}"
echo "/ip firewall mangle add action=mark-routing chain=output connection-mark=ipsec new-routing-mark=ipsec passthrough=no" >> "${rtdomain}"
echo "/ip route rule add action=lookup-only-in-table routing-mark=ipsec table=ipsec" >> "${rtdomain}"
echo "/ip route add comment=ipsec distance=1 gateway=lte1 routing-mark=ipsec" >> "${rtdomain}"
eval "${scpcmd} ${rtdomain} ${userna}@${lte}:/rtdomains.rsc"
eval "${sshcmd} ${userna}@${lte} /import file-name=rtdomains.rsc"
srm "${rtdomain}"
ipsecpeers=$(tempfile)
echo ":foreach P in=[/ip ipsec peer find where dynamic=no] do={ /ip ipsec peer remove \$P }" > ${ipsecpeers}
eval "${sshcmd} ${userna}@${mk}.${LDN} /ip ipsec peer export >> ${ipsecpeers}"
sed -i "s|local-address=${mkip}||g" "${ipsecpeers}"
sed -i "s|NSA-RECOMMENDED|LTE|g" "${ipsecpeers}"
dnsquery wa "edgeos"
for (( j=0; j<${#wa[@]}; j++ )); do
tac "${ipsecpeers}"| sed '/'"${wa[j]}"'/{n;d;}' | tac | sed '/'"${wa[j]}"'/d' > "${ipsecpeers}"
done
#echo "/ip ipsec peer add name=calli_ikev2_cert address=5.134.119.135 local-address=${ltepubip} exchange-mode=ike2 profile=NSA-RECOMMENDED" >> ${ipsecpeers}
eval "${scpcmd} ${ipsecpeers} ${userna}@${lte}:/ipsec_peers.rsc"
srm "${ipsecpeers}"
eval "${sshcmd} ${userna}@${lte} /import file-name=ipsec_peers.rsc"
echo "installing local private and public key and peers public keys"
read -p "Type local directory with p12 exported IPsec certificates: " p12dir
ssh "${userna}@${lte}" ":foreach C in=[/certificate find] do={/certificate remove \$C}"
eval "${scpcmd} ${p12dir}/${lhn}/${lte}.p12 ${userna}@${lte}:/"
eval "${sshcmd} ${userna}@${lte} /certificate import file-name=${lte}.p12 name=${lte} passphrase=123456789"
eval "${sshcmd} ${userna}@${lte} /certificate set [find name=${lte}_1] name=ca.telecomlobby.com"
for certpath in $(find "${p12dir}" -name "*.p12"); do
certfile=$(basename "${certpath}")
peerpublichostname=$(echo "${certfile}" | sed "s|.p12||")
certdir=$(dirname "${certpath}")
peerlocalhostname=$(echo "${certdir}" | sed "s|${p12dir}/||")
tmpdir=$(mktemp -d)
openssl pkcs12 -nodes -in "${certpath}" -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/$peerlocalhostname.crt"
eval "${scpcmd} $tmpdir/$peerlocalhostname.crt ${userna}@${lte}:/"
eval "${sshcmd} ${userna}@${lte} /certificate import file-name=$peerlocalhostname.crt name=${peerpublichostname} passphrase=123456789"
srm -r "${tmpdir}"
done
ipsecpeers=$(tempfile)
echo ":foreach P in=[/ip ipsec identity find where dynamic=no] do={ /ip ipsec identity remove \$P }" > ${ipsecpeers}
eval "${sshcmd} ${userna}@${mk}.${LDN} /ip ipsec identity export >> ${ipsecpeers}"
sed -i "s|${mkphn}.${PDN}|${lte}|g" "${ipsecpeers}"
sed -i "s|${mk}@|${lhn}@|g" "${ipsecpeers}"
sed -i "s|.p12_[0-9]||" "${ipsecpeers}"
eval "${scpcmd} ${ipsecpeers} ${userna}@${lte}:/ipsec_identity.rsc"
eval "${sshcmd} ${userna}@${lte} /import file-name=ipsec_identity.rsc"
#eval "${sshcmd} ${userna}@${lte} /ip ipsec identity add peer=calli_ikev2_cert auth-method=digital-signature remote-id=user-fqdn:calli@ca.telecomlobby.com match-by=certificate certificate="${lte}"remote-certificate=ixp.telecomlobby.com generate-policy=no policy-template-group=group_ikev2_cert"
srm "${ipsecpeers}"
ipsecpolicy=$(tempfile)
eval "${sshcmd} ${userna}@${mk}.${LDN} /ip ipsec policy export > ${ipsecpolicy}"
sed -i '/set/d' "${ipsecpolicy}"
sed -i '/policy\ group/d' "${ipsecpolicy}"
sed -i '/group_ikev2_cert/d' "${ipsecpolicy}"
sed -i "s|src-address=${mkip}/32||g" "${ipsecpolicy}"
for (( j=0; j<${#wa[@]}; j++ )); do
sed -i '/'"${wa[j]}"'/{n;d;}' "${ipsecpolicy}"
sed -i '/'"${wa[j]}"'/d' "${ipsecpolicy}"
done
#echo "/ip ipsec policy add dst-address=5.134.119.135/32 peer=calli_ikev2_cert proposal=NSA protocol=gre src-address=${ltepubip}" >> "${ipsecpolicy}"
eval "${scpcmd} ${ipsecpolicy} ${userna}@${lte}:/ipsec_policy.rsc"
eval "${sshcmd} ${userna}@${lte} /import file-name=ipsec_policy.rsc"
echo "IPSec configured, going ahead..."
srm "${ipsecpolicy}"
#echo "Cleaning files"
#eval "${scpcmd} src/mikrotik/file_clean.rsc ${userna}@${lte}:/"
#eval "${sshcmd} ${userna}@${lte} :execute \{/import file_clean.rsc\}"
echo "start to configure GRE interfaces"
grepeers=$(tempfile)