freedombone-utils-mesh 18KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # mesh utilities used by the batman and bmx commands
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # File which contains the current protocol in use
  31. MESH_CURRENT_PROTOCOL=/root/.mesh_protocol
  32. MESH_DEFAULT_PROTOCOL=/root/.mesh_protocol_default
  33. function mesh_protocol_stop {
  34. if [ ! -f $MESH_CURRENT_PROTOCOL ]; then
  35. return
  36. fi
  37. if grep -q "bmx6" $MESH_CURRENT_PROTOCOL; then
  38. bmx stop
  39. fi
  40. if grep -q "bmx7" $MESH_CURRENT_PROTOCOL; then
  41. bmxsec stop
  42. fi
  43. if grep -q "batman-adv" $MESH_CURRENT_PROTOCOL; then
  44. batman stop
  45. fi
  46. rm $MESH_CURRENT_PROTOCOL
  47. }
  48. function mesh_protocol_init {
  49. if [[ $1 == "start" ]]; then
  50. # install avahi
  51. sed -i "s|#host-name=.*|host-name=$(hostname)|g" /etc/avahi/avahi-daemon.conf
  52. sed -i "s|host-name=.*|host-name=$(hostname)|g" /etc/avahi/avahi-daemon.conf
  53. sed -i "s|use-ipv4=.*|use-ipv4=yes|g" /etc/avahi/avahi-daemon.conf
  54. sed -i "s|use-ipv6=.*|use-ipv6=no|g" /etc/avahi/avahi-daemon.conf
  55. sed -i "s|#disallow-other-stacks=.*|disallow-other-stacks=yes|g" /etc/avahi/avahi-daemon.conf
  56. sed -i "s|hosts:.*|hosts: files mdns4_minimal dns mdns4 mdns|g" /etc/nsswitch.conf
  57. fi
  58. # Mesh definition
  59. WIFI_SSID='mesh'
  60. if [ -f $COMPLETION_FILE ]; then
  61. if grep -q "WIFI_SSID:" $COMPLETION_FILE; then
  62. WIFI_SSID=$(cat $COMPLETION_FILE | grep "WIFI_SSID:" | awk -F ':' '{print $2}')
  63. fi
  64. sed -i "s|WIFI_SSID:.*|WIFI_SSID:${WIFI_SSID}|g" $COMPLETION_FILE
  65. fi
  66. CELLID='any'
  67. CHANNEL=2
  68. HOTSPOT_CHANNEL=6
  69. if [ -f $COMPLETION_FILE ]; then
  70. if grep -q "Wifi channel:" $COMPLETION_FILE; then
  71. CHANNEL=$(cat $COMPLETION_FILE | grep "Wifi channel:" | awk -F ':' '{print $2}')
  72. fi
  73. sed -i "s|Wifi channel:.*|Wifi channel:${CHANNEL}|g" $COMPLETION_FILE
  74. fi
  75. ZERONET_PORT=15441
  76. IPFS_PORT=4001
  77. TOX_PORT=33445
  78. TRACKER_PORT=6969
  79. LIBREVAULT_PORT=42345
  80. TAHOELAFS_PORT=50213
  81. GIT_SSB_PORT=7718
  82. NGINX_GIT_SSB_PORT=7719
  83. # Ethernet bridge definition (bridged to bat0)
  84. BRIDGE=br-mesh
  85. BRIDGE_HOTSPOT=br-hotspot
  86. IFACE=
  87. IFACE_SECONDARY=
  88. EIFACE=eth0
  89. WLAN_ADAPTORS=$(count_wlan)
  90. if [ $WLAN_ADAPTORS -eq 0 ]; then
  91. echo $'No wlan adaptors found'
  92. exit 0
  93. fi
  94. }
  95. function get_ipv4_wlan {
  96. echo $(ip -o -f inet addr show dev "$IFACE" | awk '{print $4}' | awk 'END {print}' | awk -F '/' '{print $1}')
  97. }
  98. function mesh_hotspot_ip_address {
  99. echo $(ip -o -f inet addr show dev "${BRIDGE}" | awk '{print $4}' | awk 'END {print}' | awk -F '/' '{print $1}')
  100. }
  101. function global_rate_limit {
  102. if ! grep -q "tcp_challenge_ack_limit" /etc/sysctl.conf; then
  103. echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >> /etc/sysctl.conf
  104. echo 'net.ipv6.tcp_challenge_ack_limit = 999999999' >> /etc/sysctl.conf
  105. else
  106. sed -i 's|net.ipv4.tcp_challenge_ack_limit.*|net.ipv4.tcp_challenge_ack_limit = 999999999|g' /etc/sysctl.conf
  107. sed -i 's|net.ipv6.tcp_challenge_ack_limit.*|net.ipv6.tcp_challenge_ack_limit = 999999999|g' /etc/sysctl.conf
  108. fi
  109. sysctl -p -q
  110. }
  111. function assign_peer_address {
  112. for i in {1..6}; do
  113. number=$RANDOM
  114. let "number %= 255"
  115. octet=$(echo "obase=16;$number" | bc)
  116. if [ ${#octet} -lt 2 ]; then
  117. octet="0${octet}"
  118. fi
  119. if [ $i -gt 1 ]; then
  120. echo -n ":"
  121. fi
  122. echo -n "${octet}"
  123. done
  124. }
  125. function mesh_create_app_downloads_page {
  126. if [ ! -d /root/$PROJECT_NAME/image_build/mesh_apps ]; then
  127. return
  128. fi
  129. if [ ! -d /var/www/html ]; then
  130. return
  131. fi
  132. # Don't go straight to cryptpad when navigating to the peer's IP address
  133. if [ -L /etc/nginx/sites-enabled/cryptpad ]; then
  134. rm /etc/nginx/sites-enabled/cryptpad
  135. ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
  136. if [ -d /etc/cryptpad ]; then
  137. systemctl stop cryptpad
  138. systemctl disable cryptpad
  139. fi
  140. systemctl restart nginx
  141. fi
  142. # Don't show the cryptpad icon on the desktop
  143. if [ -f /home/fbone/Desktop/cryptpad.desktop ]; then
  144. mv /home/fbone/Desktop/cryptpad.desktop /home/fbone/.cryptpad.desktop
  145. fi
  146. cp /root/$PROJECT_NAME/website/EN/meshindex.html /var/www/html/index.html
  147. if [ ! -f /var/www/html/ssb.apk ]; then
  148. cp /root/$PROJECT_NAME/image_build/mesh_apps/ssb.apk /var/www/html/ssb.apk
  149. fi
  150. if [ ! -f /var/www/html/trifa.apk ]; then
  151. cp /root/$PROJECT_NAME/image_build/mesh_apps/trifa.apk /var/www/html/trifa.apk
  152. fi
  153. if [ ! -d /var/www/html/images ]; then
  154. mkdir /var/www/html/images
  155. fi
  156. if [ ! -f /var/www/html/images/logo.png ]; then
  157. cp /root/$PROJECT_NAME/img/logo.png /var/www/html/images/logo.png
  158. fi
  159. if [ ! -f /var/www/html/images/ssb.png ]; then
  160. cp /root/$PROJECT_NAME/img/icon_patchwork.png /var/www/html/images/ssb.png
  161. fi
  162. if [ ! -f /var/www/html/images/trifa.png ]; then
  163. cp /root/$PROJECT_NAME/img/trifa.png /var/www/html/images/trifa.png
  164. fi
  165. if [ ! -f /var/www/html/freedombone.css ]; then
  166. cp /root/$PROJECT_NAME/website/freedombone.css /var/www/html/freedombone.css
  167. fi
  168. chown -R www-data:www-data /var/www/html/*
  169. }
  170. function enable_mesh_firewall {
  171. iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  172. iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  173. iptables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT
  174. iptables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT
  175. iptables -A INPUT -p udp --dport 6240 -j ACCEPT
  176. iptables -A INPUT -p tcp --dport 6240 -j ACCEPT
  177. iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  178. iptables -A INPUT -p udp --dport 80 -j ACCEPT
  179. iptables -A INPUT -p tcp --dport 548 -j ACCEPT
  180. iptables -A INPUT -p udp --dport 548 -j ACCEPT
  181. iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
  182. iptables -A INPUT -p udp --dport 5353 -j ACCEPT
  183. iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
  184. iptables -A INPUT -p udp --dport 5354 -j ACCEPT
  185. iptables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT
  186. iptables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT
  187. iptables -A INPUT -p tcp --dport $IPFS_PORT -j ACCEPT
  188. iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT
  189. iptables -A INPUT -p udp --dport $TOX_PORT -j ACCEPT
  190. iptables -A INPUT -p tcp --dport $LIBREVAULT_PORT -j ACCEPT
  191. iptables -A INPUT -p udp --dport $LIBREVAULT_PORT -j ACCEPT
  192. iptables -A INPUT -p tcp --dport $TAHOELAFS_PORT -j ACCEPT
  193. # SSB/Scuttlebot/Patchwork
  194. iptables -A INPUT -p tcp --dport $GIT_SSB_PORT -j ACCEPT
  195. iptables -A INPUT -p udp --dport 8008 -j ACCEPT
  196. iptables -A INPUT -p tcp --dport 8008 -j ACCEPT
  197. iptables -A INPUT -p udp --dport 8010 -j ACCEPT
  198. iptables -A INPUT -p tcp --dport 8010 -j ACCEPT
  199. ip6tables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  200. ip6tables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  201. ip6tables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT
  202. ip6tables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT
  203. ip6tables -A INPUT -p udp --dport 6240 -j ACCEPT
  204. ip6tables -A INPUT -p tcp --dport 6240 -j ACCEPT
  205. ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
  206. ip6tables -A INPUT -p udp --dport 80 -j ACCEPT
  207. ip6tables -A INPUT -p tcp --dport 548 -j ACCEPT
  208. ip6tables -A INPUT -p udp --dport 548 -j ACCEPT
  209. ip6tables -A INPUT -p tcp --dport 5353 -j ACCEPT
  210. ip6tables -A INPUT -p udp --dport 5353 -j ACCEPT
  211. ip6tables -A INPUT -p tcp --dport 5354 -j ACCEPT
  212. ip6tables -A INPUT -p udp --dport 5354 -j ACCEPT
  213. ip6tables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT
  214. ip6tables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT
  215. ip6tables -A INPUT -p tcp --dport $IPFS_PORT -j ACCEPT
  216. ip6tables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT
  217. ip6tables -A INPUT -p udp --dport $TOX_PORT -j ACCEPT
  218. ip6tables -A INPUT -p tcp --dport $LIBREVAULT_PORT -j ACCEPT
  219. ip6tables -A INPUT -p udp --dport $LIBREVAULT_PORT -j ACCEPT
  220. ip6tables -A INPUT -p tcp --dport $TAHOELAFS_PORT -j ACCEPT
  221. # SSB/Scuttlebot/Patchwork
  222. ip6tables -A INPUT -p tcp --dport $GIT_SSB_PORT -j ACCEPT
  223. ip6tables -A INPUT -p udp --dport 8008 -j ACCEPT
  224. ip6tables -A INPUT -p tcp --dport 8008 -j ACCEPT
  225. ip6tables -A INPUT -p udp --dport 8010 -j ACCEPT
  226. ip6tables -A INPUT -p tcp --dport 8010 -j ACCEPT
  227. # vpn over the internet
  228. # Note: the vpn firewall settings are needed in order for Patchwork
  229. # to discover local peers
  230. iptables -A INPUT -p tcp --dport 653 -j ACCEPT
  231. iptables -A INPUT -p udp --dport 653 -j ACCEPT
  232. iptables -A INPUT -i ${EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT
  233. iptables -A INPUT -i tun+ -j ACCEPT
  234. iptables -A FORWARD -i tun+ -j ACCEPT
  235. iptables -A FORWARD -i tun+ -o ${EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT
  236. iptables -A FORWARD -i ${EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
  237. iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ${EIFACE} -j MASQUERADE
  238. iptables -A OUTPUT -o tun+ -j ACCEPT
  239. echo 1 > /proc/sys/net/ipv4/ip_forward
  240. sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf
  241. sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf
  242. sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' /etc/sysctl.conf
  243. }
  244. function disable_mesh_firewall {
  245. iptables -D INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT
  246. iptables -D INPUT -p udp --dport $TRACKER_PORT -j ACCEPT
  247. iptables -D INPUT -p udp --dport 6240 -j ACCEPT
  248. iptables -D INPUT -p tcp --dport 6240 -j ACCEPT
  249. iptables -D INPUT -p tcp --dport 80 -j ACCEPT
  250. iptables -D INPUT -p udp --dport 80 -j ACCEPT
  251. iptables -D INPUT -p tcp --dport 548 -j ACCEPT
  252. iptables -D INPUT -p udp --dport 548 -j ACCEPT
  253. iptables -D INPUT -p tcp --dport 5353 -j ACCEPT
  254. iptables -D INPUT -p udp --dport 5353 -j ACCEPT
  255. iptables -D INPUT -p tcp --dport 5354 -j ACCEPT
  256. iptables -D INPUT -p udp --dport 5354 -j ACCEPT
  257. iptables -D INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT
  258. iptables -D INPUT -p udp --dport $ZERONET_PORT -j ACCEPT
  259. iptables -D INPUT -p tcp --dport $IPFS_PORT -j ACCEPT
  260. iptables -D INPUT -p udp --dport $IPFS_PORT -j ACCEPT
  261. iptables -D INPUT -p tcp --dport $TOX_PORT -j ACCEPT
  262. iptables -D INPUT -p udp --dport $TOX_PORT -j ACCEPT
  263. iptables -D INPUT -p tcp --dport $LIBREVAULT_PORT -j ACCEPT
  264. iptables -D INPUT -p udp --dport $LIBREVAULT_PORT -j ACCEPT
  265. iptables -D INPUT -p tcp --dport $TAHOELAFS_PORT -j ACCEPT
  266. # SSB/Scuttlebot/Patchwork
  267. iptables -D INPUT -p tcp --dport $GIT_SSB_PORT -j ACCEPT
  268. iptables -D INPUT -p udp --dport 8008 -j ACCEPT
  269. iptables -D INPUT -p tcp --dport 8008 -j ACCEPT
  270. iptables -D INPUT -p udp --dport 8010 -j ACCEPT
  271. iptables -D INPUT -p tcp --dport 8010 -j ACCEPT
  272. ip6tables -D INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT
  273. ip6tables -D INPUT -p udp --dport $TRACKER_PORT -j ACCEPT
  274. ip6tables -D INPUT -p udp --dport 6240 -j ACCEPT
  275. ip6tables -D INPUT -p tcp --dport 6240 -j ACCEPT
  276. ip6tables -D INPUT -p tcp --dport 80 -j ACCEPT
  277. ip6tables -D INPUT -p udp --dport 80 -j ACCEPT
  278. ip6tables -D INPUT -p tcp --dport 548 -j ACCEPT
  279. ip6tables -D INPUT -p udp --dport 548 -j ACCEPT
  280. ip6tables -D INPUT -p tcp --dport 5353 -j ACCEPT
  281. ip6tables -D INPUT -p udp --dport 5353 -j ACCEPT
  282. ip6tables -D INPUT -p tcp --dport 5354 -j ACCEPT
  283. ip6tables -D INPUT -p udp --dport 5354 -j ACCEPT
  284. ip6tables -D INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT
  285. ip6tables -D INPUT -p udp --dport $ZERONET_PORT -j ACCEPT
  286. ip6tables -D INPUT -p tcp --dport $IPFS_PORT -j ACCEPT
  287. ip6tables -D INPUT -p udp --dport $IPFS_PORT -j ACCEPT
  288. ip6tables -D INPUT -p tcp --dport $TOX_PORT -j ACCEPT
  289. ip6tables -D INPUT -p udp --dport $TOX_PORT -j ACCEPT
  290. ip6tables -D INPUT -p tcp --dport $LIBREVAULT_PORT -j ACCEPT
  291. ip6tables -D INPUT -p udp --dport $LIBREVAULT_PORT -j ACCEPT
  292. ip6tables -D INPUT -p tcp --dport $TAHOELAFS_PORT -j ACCEPT
  293. # SSB/Scuttlebot/Patchwork
  294. ip6tables -D INPUT -p tcp --dport $GIT_SSB_PORT -j ACCEPT
  295. ip6tables -D INPUT -p udp --dport 8008 -j ACCEPT
  296. ip6tables -D INPUT -p tcp --dport 8008 -j ACCEPT
  297. ip6tables -D INPUT -p udp --dport 8010 -j ACCEPT
  298. ip6tables -D INPUT -p tcp --dport 8010 -j ACCEPT
  299. # vpn over the internet
  300. iptables -D INPUT -p tcp --dport 653 -j ACCEPT
  301. iptables -D INPUT -p udp --dport 653 -j ACCEPT
  302. iptables -D INPUT -i ${EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT
  303. iptables -D INPUT -i tun+ -j ACCEPT
  304. iptables -D FORWARD -i tun+ -j ACCEPT
  305. iptables -D FORWARD -i tun+ -o ${EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT
  306. iptables -D FORWARD -i ${EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
  307. iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o ${EIFACE} -j MASQUERADE
  308. iptables -D OUTPUT -o tun+ -j ACCEPT
  309. echo 0 > /proc/sys/net/ipv4/ip_forward
  310. sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf
  311. }
  312. function enable_mesh_scuttlebot {
  313. if [ -f /etc/scuttlebot/.ssb/config ]; then
  314. ethernet_connected=$(cat /sys/class/net/eth0/carrier)
  315. if [[ "$ethernet_connected" != "0" ]]; then
  316. sed -i "s|\"host\": .*|\"host\": \"$(get_ipv4_wlan)\",|g" /etc/scuttlebot/.ssb/config
  317. systemctl restart scuttlebot
  318. else
  319. if [ ! -f /etc/nginx/sites-available/git_ssb ]; then
  320. systemctl stop scuttlebot
  321. else
  322. systemctl restart scuttlebot
  323. fi
  324. fi
  325. fi
  326. sed -i "s|\"host\":.*|\"host\": \"${HOSTNAME}.local\",|g" /etc/scuttlebot/.ssb/config
  327. systemctl restart scuttlebot
  328. }
  329. function enable_mesh_tor {
  330. # if we have an ethernet connection to an internet router then create
  331. # an onion address for this peer
  332. if [[ "$ethernet_connected" != "0" ]]; then
  333. systemctl enable tor
  334. systemctl start tor
  335. HIDDEN_SERVICE_PATH=/var/lib/tor/hidden_service_
  336. if [ ! -f ${HIDDEN_SERVICE_PATH}mesh/hostname ]; then
  337. echo "HiddenServiceDir ${HIDDEN_SERVICE_PATH}mesh/" >> /etc/tor/torrc
  338. echo "HiddenServicePort 653 127.0.0.1:653" >> /etc/tor/torrc
  339. systemctl restart tor
  340. fi
  341. else
  342. systemctl stop tor
  343. systemctl disable tor
  344. fi
  345. }
  346. function enable_mesh_seconary_wifi {
  347. if [ $secondary_wifi_available ]; then
  348. sed -i 's|#DAEMON_CONF=.*|DAEMON_CONF="/etc/hostapd/hostapd.conf"|g' /etc/default/hostapd
  349. mesh_hotspot_address=$(mesh_hotspot_ip_address)
  350. if [[ "$mesh_hotspot_address" == *'.'* ]]; then
  351. echo "interface=${IFACE_SECONDARY}" > /etc/hostapd/hostapd.conf
  352. echo "bridge=${BRIDGE}" >> /etc/hostapd/hostapd.conf
  353. echo 'driver=nl80211' >> /etc/hostapd/hostapd.conf
  354. echo "country_code=UK" >> /etc/hostapd/hostapd.conf
  355. echo "ssid=${WIFI_SSID}-${mesh_hotspot_address}" >> /etc/hostapd/hostapd.conf
  356. echo 'hw_mode=g' >> /etc/hostapd/hostapd.conf
  357. echo "channel=${HOTSPOT_CHANNEL}" >> /etc/hostapd/hostapd.conf
  358. echo 'wpa=2' >> /etc/hostapd/hostapd.conf
  359. echo "wpa_passphrase=$HOTSPOT_PASSPHRASE" >> /etc/hostapd/hostapd.conf
  360. echo 'wpa_key_mgmt=WPA-PSK' >> /etc/hostapd/hostapd.conf
  361. echo 'wpa_pairwise=TKIP' >> /etc/hostapd/hostapd.conf
  362. echo 'rsn_pairwise=CCMP' >> /etc/hostapd/hostapd.conf
  363. echo 'auth_algs=1' >> /etc/hostapd/hostapd.conf
  364. echo 'macaddr_acl=0' >> /etc/hostapd/hostapd.conf
  365. sed -i "s|#interface=.*|interface=${IFACE_SECONDARY}|g" /etc/dnsmasq.conf
  366. sed -i "s|interface=.*|interface=${IFACE_SECONDARY}|g" /etc/dnsmasq.conf
  367. sed -i "s|listen-address=.*|listen-address=127.0.0.1,$mesh_hotspot_address|g" /etc/dnsmasq.conf
  368. sed -i 's|#listen-address|listen-address|g' /etc/dnsmasq.conf
  369. systemctl enable dnsmasq
  370. systemctl restart dnsmasq
  371. systemctl enable hostapd
  372. systemctl restart hostapd
  373. mesh_create_app_downloads_page
  374. else
  375. secondary_wifi_available=
  376. echo $'WARNING: No IP address could be obtained for the hotspot'
  377. fi
  378. fi
  379. if [ ! $secondary_wifi_available ]; then
  380. systemctl stop hostapd
  381. systemctl disable hostapd
  382. # Recreate the cryptpad symlink
  383. if [ -f /etc/nginx/sites-available/cryptpad ]; then
  384. if [ -L /etc/nginx/sites-enabled/cryptpad ]; then
  385. rm /etc/nginx/sites-enabled/default
  386. fi
  387. systemctl enable cryptpad
  388. systemctl start cryptpad
  389. if [ ! -L /etc/nginx/sites-enabled/cryptpad ]; then
  390. ln -s /etc/nginx/sites-available/cryptpad /etc/nginx/sites-enabled/cryptpad
  391. systemctl restart nginx
  392. fi
  393. fi
  394. if [ -f /home/fbone/.cryptpad.desktop ]; then
  395. mv /home/fbone/.cryptpad.desktop /home/fbone/Desktop/cryptpad.desktop
  396. fi
  397. fi
  398. }
  399. # NOTE: deliberately there is no "exit 0"