#!/bin/bash # _____ _ _ # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___ # | __| _| -_| -_| . | . | | . | . | | -_| # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___| # # Freedom in the Cloud # # Installs mesh applications. This avoids duplicated functions # within freedombone and freedombone-image-customize and also # for client installs # # License # ======= # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . PROJECT_NAME='freedombone' COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt export TEXTDOMAIN=${PROJECT_NAME}-mesh-install export TEXTDOMAINDIR="/usr/share/locale" # for mesh installs TRACKER_PORT=6969 WIFI_CHANNEL=2 WIFI_INTERFACE='wlan0' # B.A.T.M.A.N settings BATMAN_CELLID='02:BA:00:00:03:01' WIFI_SSID='mesh' rootdir='' FN= CHROOT_PREFIX='' # To avoid confusions these are obtained from the main project file TOXID_REPO= TOX_PORT= TOXCORE_REPO= TOXIC_REPO= TOXCORE_COMMIT= TOXIC_COMMIT= # These are some default nodes, but you can replace them with trusted nodes # as you prefer. See https://wiki.tox.im/Nodes TOX_NODES= #TOX_NODES=( # '192.254.75.102,2607:5600:284::2,33445,951C88B7E75C867418ACDB5D273821372BB5BD652740BCDF623A4FA293E75D2F,Tox RELENG,US' # '144.76.60.215,2a01:4f8:191:64d6::1,33445,04119E835DF3E78BACF0F84235B300546AF8B936F035185E2A8E9E0A67C8924F,sonOfRa,DE' #) # To avoid confusions these are obtained from the main project file ZERONET_REPO= ZERONET_COMMIT= ZERONET_PORT= # Directory where source code is downloaded and compiled INSTALL_DIR=$HOME/build MESH_INSTALL_DIR=/var/lib REMOVE='no' source /usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-git function show_help { echo '' echo $"${PROJECT_NAME}-mesh-install -f [function] -r [rootdir]" echo '' echo $'Runs a mesh network install function' echo '' echo $' -h --help Show help' echo $' -f --function [name] Name of the function to be run' echo $' -r --rootdir [directory] Root directory' echo $' -w --wifi [interface] e.g. wlan0' echo '' exit 0 } function mesh_avahi { $CHROOT_PREFIX apt-get -yq install avahi-utils avahi-dnsconfd decarray=( 1 2 3 4 5 6 7 8 9 0 ) PEER_ID=${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]} sed -i "s|#host-name=.*|host-name=P$PEER_ID|g" $rootdir/etc/avahi/avahi-daemon.conf if [ ! -d $rootdir/etc/avahi/services ]; then mkdir -p $rootdir/etc/avahi/services fi # remove an avahi service which isn't used if [ -f $rootdir/etc/avahi/services/udisks.service ]; then rm $rootdir/etc/avahi/services/udisks.service fi # Add a mesh routing protocol service { echo ''; echo ''; echo ''; echo ' %h routing'; echo ' '; echo ' _bmx6._tcp'; echo ' '; echo ''; } > "$rootdir/etc/avahi/services/routing.service" # keep the daemon running WATCHDOG_SCRIPT_NAME="keepon" { echo ''; echo '# keep avahi daemon running'; echo "AVAHI_RUNNING=\$(pgrep avahi-daemon > /dev/null && echo Running)"; echo "if [ ! \$AVAHI_RUNNING ]; then"; echo ' systemctl start avahi-daemon'; echo " echo -n \$CURRENT_DATE >> \$LOGFILE"; echo " echo \" Avahi daemon restarted\" >> \$LOGFILE"; echo 'fi'; } >> "$rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME" chmod +x "$rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME" } function install_batman_remove { systemctl stop batman rm $rootdir/var/lib/batman rm $rootdir/etc/systemd/system/batman.service } function install_batman { $CHROOT_PREFIX apt-get -yq install iproute bridge-utils libnetfilter-conntrack3 batctl $CHROOT_PREFIX apt-get -yq install python-dev libevent-dev ebtables python-pip git $CHROOT_PREFIX apt-get -yq install wireless-tools rfkill if ! grep -q "batman_adv" "$rootdir/etc/modules"; then echo 'batman_adv' >> "$rootdir/etc/modules" fi if ! grep -q "tunnel6" "$rootdir/etc/modules"; then echo 'tunnel6' >> "$rootdir/etc/modules" fi if ! grep -q "ip6_tunnel" "$rootdir/etc/modules"; then echo 'ip6_tunnel' >> "$rootdir/etc/modules" fi BATMAN_SCRIPT=$rootdir/var/lib/batman if [ -f /usr/local/bin/${PROJECT_NAME}-mesh-batman ]; then cp /usr/local/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT else cp /usr/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT fi BATMAN_DAEMON=$rootdir/etc/systemd/system/batman.service { echo '[Unit]'; echo 'Description=B.A.T.M.A.N. Advanced'; echo 'After=network.target'; echo ''; echo '[Service]'; echo 'RemainAfterExit=yes'; echo "ExecStart=/var/lib/batman start"; echo "ExecStop=/var/lib/batman stop"; echo 'Restart=on-failure'; echo 'SuccessExitStatus=3 4'; echo 'RestartForceExitStatus=3 4'; echo ''; echo '# Allow time for the server to start/stop'; echo 'TimeoutSec=300'; echo ''; echo '[Install]'; echo 'WantedBy=multi-user.target'; } > "$BATMAN_DAEMON" $CHROOT_PREFIX systemctl enable batman } function mesh_firewall { FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall { echo '#!/bin/bash'; echo 'iptables -P INPUT ACCEPT'; echo 'ip6tables -P INPUT ACCEPT'; echo 'iptables -F'; echo 'ip6tables -F'; echo 'iptables -t nat -F'; echo 'ip6tables -t nat -F'; echo 'iptables -X'; echo 'ip6tables -X'; echo 'iptables -P INPUT DROP'; echo 'ip6tables -P INPUT DROP'; echo 'iptables -A INPUT -i lo -j ACCEPT'; echo 'ip6tables -A INPUT -i lo -j ACCEPT'; echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT'; echo 'ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT'; echo ''; echo '# Make sure incoming tcp connections are SYN packets'; echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP'; echo 'ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP'; echo ''; echo '# Drop packets with incoming fragments'; echo 'iptables -A INPUT -f -j DROP'; echo 'ip6tables -A INPUT -f -j DROP'; echo ''; echo '# Drop bogons'; echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP'; echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP'; echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP'; echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP'; echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP'; echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP'; echo ''; echo '# Incoming malformed NULL packets:'; echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP'; echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP'; echo ''; echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT"; echo "ip6tables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT"; echo "iptables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT"; echo "ip6tables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT"; echo "iptables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT"; echo "ip6tables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT"; echo "iptables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT"; echo "ip6tables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT"; echo "iptables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT"; echo "ip6tables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT"; echo "iptables -A INPUT -p udp --dport 1900 -j ACCEPT"; echo "ip6tables -A INPUT -p udp --dport 1900 -j ACCEPT"; echo '# OLSR2/MANET'; echo 'iptables -A INPUT -p udp --dport 269 -j ACCEPT'; echo 'ip6tables -A INPUT -p udp --dport 269 -j ACCEPT'; echo 'iptables -A INPUT -p tcp --dport 138 -j ACCEPT'; echo 'ip6tables -A INPUT -p tcp --dport 138 -j ACCEPT'; echo '# Babel'; echo 'iptables -A INPUT -p udp --dport 6696 -j ACCEPT'; echo 'ip6tables -A INPUT -p udp --dport 6696 -j ACCEPT'; } > "$MESH_FIREWALL_SCRIPT" chmod +x $MESH_FIREWALL_SCRIPT { echo '[Unit]'; echo 'Description=Mesh Firewall'; echo ''; echo '[Service]'; echo 'Type=oneshot'; echo 'ExecStart=/usr/bin/mesh-firewall'; echo 'RemainAfterExit=no'; echo ''; echo 'TimeoutSec=30'; echo ''; echo '[Install]'; echo 'WantedBy=multi-user.target'; } > $FIREWALL_FILENAME chmod +x $FIREWALL_FILENAME $CHROOT_PREFIX systemctl enable meshfirewall } function enable_tox_repo { sudo sh -c "echo 'deb http://download.opensuse.org/repositories/home:/antonbatenev:/tox/Debian_9.0/ /' > /etc/apt/sources.list.d/tox.list" wget http://download.opensuse.org/repositories/home:antonbatenev:tox/Debian_9.0/Release.key sudo sh -c "apt-key add - < Release.key" sudo apt-get update echo "Tox Repository Installed." } function mesh_tox_client_qtox { enable_tox_repo sudo apt-get -yq install qtox echo "qTox Installed." } function mesh_tox_client_toxic_from_repo { enable_tox_repo sudo apt-get -yq install toxic echo "Toxic Installed." } while [ $# -gt 1 ] do key="$1" case $key in -h|--help) show_help ;; -f|--function) shift FN="$1" ;; -r|--rootdir) shift rootdir="$1" CHROOT_PREFIX="chroot \"\${rootdir}\"" ;; -w|--wifi|--interface) shift WIFI_INTERFACE="$1" ;; --remove) shift REMOVE="$1" ;; *) # unknown option ;; esac shift done if [[ $FN == 'avahi' ]]; then mesh_avahi fi if [[ $FN == 'firewall' ]]; then mesh_firewall fi if [[ $FN == 'batman' ]]; then if [[ $REMOVE != 'yes' ]]; then install_batman else install_batman_remove fi fi if [[ $FN == 'qtox' ]]; then mesh_tox_client_qtox fi if [[ $FN == 'toxic' ]]; then mesh_tox_client_toxic_from_repo fi exit 0