freedombone-mesh-install 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Installs mesh applications. This avoids duplicated functions
  12. # within freedombone and freedombone-image-customize and also
  13. # for client installs
  14. #
  15. # License
  16. # =======
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. PROJECT_NAME='freedombone'
  31. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  32. export TEXTDOMAIN=${PROJECT_NAME}-mesh-install
  33. export TEXTDOMAINDIR="/usr/share/locale"
  34. # for mesh installs
  35. TRACKER_PORT=6969
  36. WIFI_CHANNEL=2
  37. WIFI_INTERFACE='wlan0'
  38. # B.A.T.M.A.N settings
  39. BATMAN_CELLID='02:BA:00:00:03:01'
  40. WIFI_SSID='mesh'
  41. rootdir=''
  42. FN=
  43. CHROOT_PREFIX=''
  44. # To avoid confusions these are obtained from the main project file
  45. TOXID_REPO=
  46. TOX_PORT=
  47. TOXCORE_REPO=
  48. TOXIC_REPO=
  49. TOXCORE_COMMIT=
  50. TOXIC_COMMIT=
  51. # These are some default nodes, but you can replace them with trusted nodes
  52. # as you prefer. See https://wiki.tox.im/Nodes
  53. TOX_NODES=
  54. #TOX_NODES=(
  55. # '192.254.75.102,2607:5600:284::2,33445,951C88B7E75C867418ACDB5D273821372BB5BD652740BCDF623A4FA293E75D2F,Tox RELENG,US'
  56. # '144.76.60.215,2a01:4f8:191:64d6::1,33445,04119E835DF3E78BACF0F84235B300546AF8B936F035185E2A8E9E0A67C8924F,sonOfRa,DE'
  57. #)
  58. # To avoid confusions these are obtained from the main project file
  59. ZERONET_REPO=
  60. ZERONET_COMMIT=
  61. ZERONET_PORT=
  62. # Directory where source code is downloaded and compiled
  63. INSTALL_DIR=$HOME/build
  64. MESH_INSTALL_DIR=/var/lib
  65. REMOVE='no'
  66. source /usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-git
  67. function show_help {
  68. echo ''
  69. echo $"${PROJECT_NAME}-mesh-install -f [function] -r [rootdir]"
  70. echo ''
  71. echo $'Runs a mesh network install function'
  72. echo ''
  73. echo $' -h --help Show help'
  74. echo $' -f --function [name] Name of the function to be run'
  75. echo $' -r --rootdir [directory] Root directory'
  76. echo $' -w --wifi [interface] e.g. wlan0'
  77. echo ''
  78. exit 0
  79. }
  80. function mesh_avahi {
  81. $CHROOT_PREFIX apt-get -yq install avahi-utils avahi-dnsconfd
  82. decarray=( 1 2 3 4 5 6 7 8 9 0 )
  83. PEER_ID=${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}${decarray[$RANDOM%10]}
  84. sed -i "s|#host-name=.*|host-name=P$PEER_ID|g" $rootdir/etc/avahi/avahi-daemon.conf
  85. if [ ! -d $rootdir/etc/avahi/services ]; then
  86. mkdir -p $rootdir/etc/avahi/services
  87. fi
  88. # remove an avahi service which isn't used
  89. if [ -f $rootdir/etc/avahi/services/udisks.service ]; then
  90. rm $rootdir/etc/avahi/services/udisks.service
  91. fi
  92. # Add a mesh routing protocol service
  93. { echo '<?xml version="1.0" standalone="no"?><!--*-nxml-*-->';
  94. echo '<!DOCTYPE service-group SYSTEM "avahi-service.dtd">';
  95. echo '<service-group>';
  96. echo ' <name replace-wildcards="yes">%h routing</name>';
  97. echo ' <service>';
  98. echo ' <type>_bmx6._tcp</type>';
  99. echo ' </service>';
  100. echo '</service-group>'; } > "$rootdir/etc/avahi/services/routing.service"
  101. # keep the daemon running
  102. WATCHDOG_SCRIPT_NAME="keepon"
  103. { echo '';
  104. echo '# keep avahi daemon running';
  105. echo "AVAHI_RUNNING=\$(pgrep avahi-daemon > /dev/null && echo Running)";
  106. echo "if [ ! \$AVAHI_RUNNING ]; then";
  107. echo ' systemctl start avahi-daemon';
  108. echo " echo -n \$CURRENT_DATE >> \$LOGFILE";
  109. echo " echo \" Avahi daemon restarted\" >> \$LOGFILE";
  110. echo 'fi'; } >> "$rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME"
  111. chmod +x "$rootdir/usr/bin/$WATCHDOG_SCRIPT_NAME"
  112. }
  113. function install_batman_remove {
  114. systemctl stop batman
  115. rm $rootdir/var/lib/batman
  116. rm $rootdir/etc/systemd/system/batman.service
  117. }
  118. function install_batman {
  119. $CHROOT_PREFIX apt-get -yq install iproute bridge-utils libnetfilter-conntrack3 batctl
  120. $CHROOT_PREFIX apt-get -yq install python-dev libevent-dev ebtables python-pip git
  121. $CHROOT_PREFIX apt-get -yq install wireless-tools rfkill
  122. if ! grep -q "batman_adv" $rootdir/etc/modules; then
  123. echo 'batman_adv' >> $rootdir/etc/modules
  124. fi
  125. BATMAN_SCRIPT=$rootdir/var/lib/batman
  126. if [ -f /usr/local/bin/${PROJECT_NAME}-mesh-batman ]; then
  127. cp /usr/local/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT
  128. else
  129. cp /usr/bin/${PROJECT_NAME}-mesh-batman $BATMAN_SCRIPT
  130. fi
  131. BATMAN_DAEMON=$rootdir/etc/systemd/system/batman.service
  132. { echo '[Unit]';
  133. echo 'Description=B.A.T.M.A.N. Advanced';
  134. echo 'After=network.target';
  135. echo '';
  136. echo '[Service]';
  137. echo 'RemainAfterExit=yes';
  138. echo "ExecStart=/var/lib/batman start";
  139. echo "ExecStop=/var/lib/batman stop";
  140. echo 'Restart=on-failure';
  141. echo 'SuccessExitStatus=3 4';
  142. echo 'RestartForceExitStatus=3 4';
  143. echo '';
  144. echo '# Allow time for the server to start/stop';
  145. echo 'TimeoutSec=300';
  146. echo '';
  147. echo '[Install]';
  148. echo 'WantedBy=multi-user.target'; } > "$BATMAN_DAEMON"
  149. $CHROOT_PREFIX systemctl enable batman
  150. }
  151. function mesh_firewall {
  152. FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
  153. MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall
  154. { echo '#!/bin/bash';
  155. echo 'iptables -P INPUT ACCEPT';
  156. echo 'ip6tables -P INPUT ACCEPT';
  157. echo 'iptables -F';
  158. echo 'ip6tables -F';
  159. echo 'iptables -t nat -F';
  160. echo 'ip6tables -t nat -F';
  161. echo 'iptables -X';
  162. echo 'ip6tables -X';
  163. echo 'iptables -P INPUT DROP';
  164. echo 'ip6tables -P INPUT DROP';
  165. echo 'iptables -A INPUT -i lo -j ACCEPT';
  166. echo 'ip6tables -A INPUT -i lo -j ACCEPT';
  167. echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT';
  168. echo 'ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT';
  169. echo '';
  170. echo '# Make sure incoming tcp connections are SYN packets';
  171. echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP';
  172. echo 'ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP';
  173. echo '';
  174. echo '# Drop packets with incoming fragments';
  175. echo 'iptables -A INPUT -f -j DROP';
  176. echo 'ip6tables -A INPUT -f -j DROP';
  177. echo '';
  178. echo '# Drop bogons';
  179. echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP';
  180. echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP';
  181. echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP';
  182. echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP';
  183. echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP';
  184. echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP';
  185. echo '';
  186. echo '# Incoming malformed NULL packets:';
  187. echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP';
  188. echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP';
  189. echo '';
  190. echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT";
  191. echo "ip6tables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT";
  192. echo "iptables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT";
  193. echo "ip6tables -A INPUT -p udp --dport $ZERONET_PORT -j ACCEPT";
  194. echo "iptables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT";
  195. echo "ip6tables -A INPUT -p tcp --dport $ZERONET_PORT -j ACCEPT";
  196. echo "iptables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT";
  197. echo "ip6tables -A INPUT -p udp --dport $TRACKER_PORT -j ACCEPT";
  198. echo "iptables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT";
  199. echo "ip6tables -A INPUT -p tcp --dport $TRACKER_PORT -j ACCEPT";
  200. echo "iptables -A INPUT -p udp --dport 1900 -j ACCEPT";
  201. echo "ip6tables -A INPUT -p udp --dport 1900 -j ACCEPT";
  202. echo '# OLSR2/MANET';
  203. echo 'iptables -A INPUT -p udp --dport 269 -j ACCEPT';
  204. echo 'ip6tables -A INPUT -p udp --dport 269 -j ACCEPT';
  205. echo 'iptables -A INPUT -p tcp --dport 138 -j ACCEPT';
  206. echo 'ip6tables -A INPUT -p tcp --dport 138 -j ACCEPT';
  207. echo '# Babel';
  208. echo 'iptables -A INPUT -p udp --dport 6696 -j ACCEPT';
  209. echo 'ip6tables -A INPUT -p udp --dport 6696 -j ACCEPT'; } > "$MESH_FIREWALL_SCRIPT"
  210. chmod +x $MESH_FIREWALL_SCRIPT
  211. { echo '[Unit]';
  212. echo 'Description=Mesh Firewall';
  213. echo '';
  214. echo '[Service]';
  215. echo 'Type=oneshot';
  216. echo 'ExecStart=/usr/bin/mesh-firewall';
  217. echo 'RemainAfterExit=no';
  218. echo '';
  219. echo 'TimeoutSec=30';
  220. echo '';
  221. echo '[Install]';
  222. echo 'WantedBy=multi-user.target'; } > $FIREWALL_FILENAME
  223. chmod +x $FIREWALL_FILENAME
  224. $CHROOT_PREFIX systemctl enable meshfirewall
  225. }
  226. function enable_tox_repo {
  227. sudo sh -c "echo 'deb http://download.opensuse.org/repositories/home:/antonbatenev:/tox/Debian_9.0/ /' > /etc/apt/sources.list.d/tox.list"
  228. wget http://download.opensuse.org/repositories/home:antonbatenev:tox/Debian_9.0/Release.key
  229. sudo sh -c "apt-key add - < Release.key"
  230. sudo apt-get update
  231. echo "Tox Repository Installed."
  232. }
  233. function mesh_tox_client_qtox {
  234. enable_tox_repo
  235. sudo apt-get -yq install qtox
  236. echo "qTox Installed."
  237. }
  238. function mesh_tox_client_toxic_from_repo {
  239. enable_tox_repo
  240. sudo apt-get -yq install toxic
  241. echo "Toxic Installed."
  242. }
  243. while [ $# -gt 1 ]
  244. do
  245. key="$1"
  246. case $key in
  247. -h|--help)
  248. show_help
  249. ;;
  250. -f|--function)
  251. shift
  252. FN="$1"
  253. ;;
  254. -r|--rootdir)
  255. shift
  256. rootdir="$1"
  257. CHROOT_PREFIX="chroot \"\${rootdir}\""
  258. ;;
  259. -w|--wifi|--interface)
  260. shift
  261. WIFI_INTERFACE="$1"
  262. ;;
  263. --remove)
  264. shift
  265. REMOVE="$1"
  266. ;;
  267. *)
  268. # unknown option
  269. ;;
  270. esac
  271. shift
  272. done
  273. if [[ $FN == 'avahi' ]]; then
  274. mesh_avahi
  275. fi
  276. if [[ $FN == 'firewall' ]]; then
  277. mesh_firewall
  278. fi
  279. if [[ $FN == 'batman' ]]; then
  280. if [[ $REMOVE != 'yes' ]]; then
  281. install_batman
  282. else
  283. install_batman_remove
  284. fi
  285. fi
  286. if [[ $FN == 'qtox' ]]; then
  287. mesh_tox_client_qtox
  288. fi
  289. if [[ $FN == 'toxic' ]]; then
  290. mesh_tox_client_toxic_from_repo
  291. fi
  292. exit 0