freedombone-utils-onion 19KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584
  1. #!/bin/bash
  2. # _____ _ _
  3. # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
  4. # | __| _| -_| -_| . | . | | . | . | | -_|
  5. # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
  6. #
  7. # Freedom in the Cloud
  8. #
  9. # Onion functions
  10. #
  11. # License
  12. # =======
  13. #
  14. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  15. #
  16. # This program is free software: you can redistribute it and/or modify
  17. # it under the terms of the GNU Affero General Public License as published by
  18. # the Free Software Foundation, either version 3 of the License, or
  19. # (at your option) any later version.
  20. #
  21. # This program is distributed in the hope that it will be useful,
  22. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  23. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  24. # GNU Affero General Public License for more details.
  25. #
  26. # You should have received a copy of the GNU Affero General Public License
  27. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  28. # The maximum amount of traffic per day in gigabytes
  29. TOR_MAX_TRAFFIC_PER_MONTH_GB=10
  30. USE_V2_ONION_ADDRESS=
  31. HIDDEN_SERVICE_PATH='/var/lib/tor/hidden_service_'
  32. ONION_SERVICES_FILE=/etc/torrc.d/${PROJECT_NAME}
  33. function torrc_migrate {
  34. if [ -f "$ONION_SERVICES_FILE" ]; then
  35. if grep -q "#%include /etc/torrc.d" /etc/tor/torrc; then
  36. sed -i 's|#%include /etc/torrc.d|%include /etc/torrc.d|g' /etc/tor/torrc
  37. systemctl restart tor
  38. fi
  39. return
  40. fi
  41. systemctl stop tor
  42. mkdir /etc/torrc.d
  43. grep "HiddenServiceDir\\|HiddenServiceVersion\\|HiddenServicePort" /etc/tor/torrc | grep -v "#HiddenServiceDir" >> "$ONION_SERVICES_FILE"
  44. if ! grep "HiddenServiceVersion" "$ONION_SERVICES_FILE"; then
  45. systemctl restart tor
  46. return
  47. fi
  48. if grep -q "#%include /etc/torrc.d" /etc/tor/torrc; then
  49. sed -i 's|#%include /etc/torrc.d|%include /etc/torrc.d|g' /etc/tor/torrc
  50. else
  51. echo "%include /etc/torrc.d" >> /etc/tor/torrc
  52. fi
  53. { echo 'DNSPort 5300';
  54. echo 'DNSListenAddress 127.0.0.1';
  55. echo 'AutomapHostsOnResolve 1'; } > /etc/torrc.d/dns
  56. sed -i '/DNSPort 5300/d' /etc/tor/torrc
  57. sed -i '/DNSListenAddress 127.0.0./d' /etc/tor/torrc
  58. sed -i '/AutomapHostsOnResolve 1/d' /etc/tor/torrc
  59. sed -i '/HiddenServiceDir/d' /etc/tor/torrc
  60. sed -i '/HiddenServiceVersion/d' /etc/tor/torrc
  61. sed -i '/HiddenServicePort/d' /etc/tor/torrc
  62. systemctl restart tor
  63. }
  64. function add_email_hostname {
  65. extra_email_hostname="$1"
  66. email_hostnames=$(grep "dc_other_hostnames" /etc/exim4/update-exim4.conf.conf | awk -F "'" '{print $2}')
  67. if [[ "$email_hostnames" != *"$extra_email_hostname"* ]]; then
  68. sed -i "s|dc_other_hostnames=.*|dc_other_hostnames='$email_hostnames;$extra_email_hostname'|g" /etc/exim4/update-exim4.conf.conf
  69. update-exim4.conf
  70. dpkg-reconfigure --frontend noninteractive exim4-config
  71. systemctl restart saslauthd
  72. fi
  73. }
  74. function onion_update {
  75. # update so that new onion services appear
  76. systemctl restart tor
  77. }
  78. function wait_for_onion_service_base {
  79. onion_service_name="$1"
  80. sleep_ctr=0
  81. while [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; do
  82. sleep 1
  83. sleep_ctr=$((sleep_ctr + 1))
  84. if [ $sleep_ctr -gt 10 ]; then
  85. break
  86. fi
  87. done
  88. }
  89. function wait_for_onion_service {
  90. onion_service_name="$1"
  91. wait_for_onion_service_base "${onion_service_name}"
  92. if [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  93. # try a second time
  94. onion_update
  95. wait_for_onion_service_base "${onion_service_name}"
  96. fi
  97. sync
  98. }
  99. function remove_onion_service {
  100. onion_service_name="$1"
  101. onion_service_port_to=$2
  102. nick="$3"
  103. if [ ${#nick} -gt 0 ]; then
  104. sed -i "/stealth ${nick}/d" "$ONION_SERVICES_FILE"
  105. fi
  106. sed -i "/hidden_service_${onion_service_name}/,+1 d" "$ONION_SERVICES_FILE"
  107. sed -i "/hidden_service_${onion_service_name}_mobile/,+1 d" "$ONION_SERVICES_FILE"
  108. sed -i "/127.0.0.1:${onion_service_port_to}/d" "$ONION_SERVICES_FILE"
  109. if [ "$3" ]; then
  110. sed -i "/127.0.0.1:${3}/d" "$ONION_SERVICES_FILE"
  111. if [ "$4" ]; then
  112. sed -i "/127.0.0.1:${4}/d" "$ONION_SERVICES_FILE"
  113. if [ "$5" ]; then
  114. sed -i "/127.0.0.1:${5}/d" "$ONION_SERVICES_FILE"
  115. fi
  116. fi
  117. fi
  118. if [ -d "${HIDDEN_SERVICE_PATH}${onion_service_name}" ]; then
  119. rm -rf "${HIDDEN_SERVICE_PATH}${onion_service_name}"
  120. fi
  121. if [ -d "${HIDDEN_SERVICE_PATH}${onion_service_name}_mobile" ]; then
  122. rm -rf "${HIDDEN_SERVICE_PATH}${onion_service_name}_mobile"
  123. fi
  124. remove_completion_param "${onion_service_name} onion domain"
  125. onion_update
  126. }
  127. function add_onion_service {
  128. onion_service_name="$1"
  129. onion_service_port_from=$2
  130. onion_service_port_to=$3
  131. onion_stealth_name="$4"
  132. if [ -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  133. cat "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname"
  134. USE_V2_ONION_ADDRESS=
  135. return
  136. fi
  137. if [ ! -d /var/lib/tor ]; then
  138. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  139. USE_V2_ONION_ADDRESS=
  140. exit 877367
  141. fi
  142. if ! grep -q "hidden_service_${onion_service_name}" "$ONION_SERVICES_FILE"; then
  143. echo "HiddenServiceDir ${HIDDEN_SERVICE_PATH}${onion_service_name}/" >> "$ONION_SERVICES_FILE"
  144. if [ ! $USE_V2_ONION_ADDRESS ]; then
  145. echo 'HiddenServiceVersion 3' >> "$ONION_SERVICES_FILE"
  146. else
  147. echo 'HiddenServiceVersion 2' >> "$ONION_SERVICES_FILE"
  148. fi
  149. echo "HiddenServicePort ${onion_service_port_from} 127.0.0.1:${onion_service_port_to}" >> "$ONION_SERVICES_FILE"
  150. if [ ${#onion_stealth_name} -gt 0 ]; then
  151. echo "HiddenServiceAuthorizeClient stealth ${onion_stealth_name}" >> "$ONION_SERVICES_FILE"
  152. fi
  153. fi
  154. USE_V2_ONION_ADDRESS=
  155. onion_update
  156. function_check wait_for_onion_service
  157. wait_for_onion_service "${onion_service_name}"
  158. if [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  159. ls -lh "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname"
  160. echo $"${onion_service_name} onion site hostname not found"
  161. exit 763624
  162. fi
  163. onion_address=$(cat "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname")
  164. # Record the domain in the completion file
  165. set_completion_param "${onion_service_name} onion domain" "${onion_address}"
  166. echo "$onion_address"
  167. }
  168. function set_default_onion_domains {
  169. # If sites are only visible via Tor then for installation
  170. # purposes assign them some default domain names
  171. if [[ $ONION_ONLY == "no" ]]; then
  172. return
  173. fi
  174. POSTACTIV_DOMAIN_NAME='postactiv.local'
  175. GNUSOCIAL_DOMAIN_NAME='gnusocial.local'
  176. HTMLY_DOMAIN_NAME='htmly.local'
  177. BLUDIT_DOMAIN_NAME='bludit.local'
  178. DOKUWIKI_DOMAIN_NAME='dokuwiki.local'
  179. DEFAULT_DOMAIN_NAME="${LOCAL_NAME}.local"
  180. GOGS_DOMAIN_NAME='gogs.local'
  181. }
  182. function create_avahi_onion_domains {
  183. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  184. return
  185. fi
  186. if [ ! -d /etc/avahi/services ]; then
  187. return
  188. fi
  189. if [ $GNUSOCIAL_DOMAIN_NAME ]; then
  190. function_check create_avahi_service
  191. create_avahi_service gnusocial http tcp "$GNUSOCIAL_ONION_PORT"
  192. fi
  193. if [ $HTMLY_DOMAIN_NAME ]; then
  194. function_check create_avahi_service
  195. create_avahi_service blog http tcp "$HTMLY_ONION_PORT"
  196. fi
  197. if [ $GOGS_DOMAIN_NAME ]; then
  198. function_check create_avahi_service
  199. create_avahi_service git http tcp "$GIT_ONION_PORT"
  200. fi
  201. if [ $DOKUWIKI_DOMAIN_NAME ]; then
  202. function_check create_avahi_service
  203. create_avahi_service dokuwiki http tcp "$DOKUWIKI_ONION_PORT"
  204. fi
  205. }
  206. function allow_ssh_to_onion_address {
  207. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  208. return
  209. fi
  210. if [ ! -d "/home/$MY_USERNAME/.ssh" ]; then
  211. mkdir "/home/$MY_USERNAME/.ssh"
  212. fi
  213. if [ ! -d /etc/tor ]; then
  214. echo $'Tor not found when updating ssh'
  215. exit 528257
  216. fi
  217. if ! grep -q "onion" "/home/$MY_USERNAME/.ssh/config"; then
  218. echo 'Host *.onion' >> "/home/$MY_USERNAME/.ssh/config"
  219. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> "/home/$MY_USERNAME/.ssh/config"
  220. fi
  221. }
  222. function enable_ssh_via_onion {
  223. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  224. return
  225. fi
  226. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  227. return
  228. fi
  229. echo 'N' | apt-get -yq -t stretch-backports install tor
  230. apt-get -yq install connect-proxy
  231. if ! grep -q 'Host *.onion' "/home/$MY_USERNAME/.ssh/config"; then
  232. if [ ! -d "/home/$MY_USERNAME/.ssh" ]; then
  233. mkdir "/home/$MY_USERNAME/.ssh"
  234. fi
  235. echo 'Host *.onion' >> "/home/$MY_USERNAME/.ssh/config"
  236. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> "/home/$MY_USERNAME/.ssh/config"
  237. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.ssh"
  238. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.ssh/config"
  239. fi
  240. if ! grep -q 'Host *.onion' /root/.ssh/config; then
  241. if [ ! -d /root/.ssh ]; then
  242. mkdir /root/.ssh
  243. fi
  244. echo 'Host *.onion' >> /root/.ssh/config
  245. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /root/.ssh/config
  246. fi
  247. if ! grep -q 'Host *.onion' /etc/skel/.ssh/config; then
  248. if [ ! -d /etc/skel/.ssh ]; then
  249. mkdir /etc/skel/.ssh
  250. fi
  251. echo 'Host *.onion' >> /etc/skel/.ssh/config
  252. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /etc/skel/.ssh/config
  253. fi
  254. mark_completed "${FUNCNAME[0]}"
  255. }
  256. function configure_ssh_onion {
  257. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  258. return
  259. fi
  260. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  261. return
  262. fi
  263. SSH_ONION_HOSTNAME=$(add_onion_service ssh "${SSH_PORT}" "${SSH_PORT}")
  264. if [[ "$SSH_ONION_HOSTNAME" != *'.onion' ]]; then
  265. echo $'ssh onion site not generated'
  266. exit 624128
  267. fi
  268. set_completion_param "ssh onion domain" "${SSH_ONION_HOSTNAME}"
  269. add_email_hostname "${SSH_ONION_HOSTNAME}"
  270. mark_completed "${FUNCNAME[0]}"
  271. }
  272. function check_tor_health {
  273. { echo '#!/bin/bash';
  274. echo "status=\$(${PROJECT_NAME}-tor-health)";
  275. echo "ADMIN_USER=\$(grep \"MY_USERNAME=\" ~/${PROJECT_NAME}.cfg | awk -F '=' '{print \$2}')";
  276. echo "if [[ \"\$status\" == 'G'* ]]; then";
  277. echo ' if [ -f /tmp/.torfailed ]; then';
  278. echo ' rm /tmp/.torfailed';
  279. echo " tail -n 3 /var/log/tor/notices.log | mail -s \"[${PROJECT_NAME}] Tor status is now \$status\" \$ADMIN_USER@\$HOSTNAME";
  280. echo ' fi';
  281. echo ' exit 0';
  282. echo 'fi';
  283. echo 'if [ ! -f /tmp/.torfailed ]; then';
  284. echo " tail -n 3 /var/log/tor/notices.log | mail -s \"[${PROJECT_NAME}] Tor status is \$status\" \$ADMIN_USER@\$HOSTNAME";
  285. echo " echo \"\$status\" > /tmp/.torfailed";
  286. echo 'else';
  287. echo " prev_status=\$(cat /tmp/.torfailed)";
  288. echo " if [[ \"\$prev_status\" != \"\$status\" ]]; then";
  289. echo " tail -n 3 /var/log/tor/notices.log | mail -s \"[${PROJECT_NAME}] Tor status is \$status\" \$ADMIN_USER@\$HOSTNAME";
  290. echo " echo \"\$status\" > /tmp/.torfailed";
  291. echo ' fi';
  292. echo 'fi'; } > /usr/bin/check_tor_health
  293. chmod +x /usr/bin/check_tor_health
  294. if ! grep -q 'check_tor_health' /etc/crontab; then
  295. cron_add_mins 10 "/usr/bin/check_tor_health"
  296. fi
  297. }
  298. function install_tor {
  299. if [[ $SYSTEM_TYPE == "mesh*" ]]; then
  300. return
  301. fi
  302. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  303. return
  304. fi
  305. apt-get -yq -t stretch-backports install tor
  306. if [ ! -f /etc/tor/torrc ]; then
  307. echo 'Tor failed to install'
  308. exit 38259
  309. fi
  310. # For torify
  311. apt-get -yq install torsocks
  312. if [ ! -d /etc/torrc.d ]; then
  313. mkdir /etc/torrc.d
  314. fi
  315. sed -i 's|#%include /etc/torrc.d|%include /etc/torrc.d|g' /etc/tor/torrc
  316. if ! grep -q '%include /etc/torrc.d' /etc/tor/torrc; then
  317. echo '%include /etc/torrc.d' >> /etc/tor/torrc
  318. fi
  319. echo 'Log notice file /var/log/tor/notices.log' > /etc/torrc.d/logging
  320. echo "AccountingMax $TOR_MAX_TRAFFIC_PER_MONTH_GB GBytes" > /etc/torrc.d/maxtraffic
  321. mark_completed "${FUNCNAME[0]}"
  322. }
  323. # see https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
  324. # Local Redirection and Anonymizing Middlebox
  325. function route_outgoing_traffic_through_tor {
  326. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  327. return
  328. fi
  329. if [[ $ROUTE_THROUGH_TOR != "yes" ]]; then
  330. return
  331. fi
  332. echo 'N' | apt-get -yq -t stretch-backports install tor
  333. echo 'N' | apt-get -yq -t stretch-backports install tor-arm
  334. ### set variables
  335. # Destinations you don't want routed through Tor
  336. _non_tor="192.168.1.0/24 192.168.0.0/24"
  337. # The user that Tor runs as
  338. _tor_uid="debian-tor"
  339. # Tor's TransPort
  340. _trans_port="9040"
  341. # Your internal interface
  342. _int_if="eth0"
  343. ### Set iptables *nat
  344. iptables -t nat -A OUTPUT -o lo -j RETURN
  345. iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
  346. iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
  347. # Allow clearnet access for hosts in $_non_tor
  348. for _clearnet in $_non_tor; do
  349. iptables -t nat -A OUTPUT -d "$_clearnet" -j RETURN
  350. iptables -t nat -A PREROUTING -i $_int_if -d "$_clearnet" -j RETURN
  351. done
  352. # Redirect all other pre-routing and output to Tor
  353. iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
  354. iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53
  355. iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
  356. ### set iptables *filter
  357. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  358. # Allow clearnet access for hosts in $_non_tor
  359. for _clearnet in $_non_tor 127.0.0.0/8; do
  360. iptables -A OUTPUT -d "$_clearnet" -j ACCEPT
  361. done
  362. # Allow only Tor output
  363. iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
  364. iptables -A OUTPUT -j REJECT
  365. function_check save_firewall_settings
  366. save_firewall_settings
  367. if ! grep -q "fs.file-max" /etc/sysctl.conf; then
  368. echo "fs.file-max=100000" >> /etc/sysctl.conf
  369. /sbin/sysctl -p -q
  370. fi
  371. resolvconf=/etc/resolvconf/resolv.conf.d/head
  372. echo 'domain localdomain' > $resolvconf
  373. echo 'search localdomain' >> $resolvconf
  374. echo 'nameserver 127.0.0.1' >> $resolvconf
  375. resolvconf -u
  376. if ! grep -q "VirtualAddrNetworkIPv4" /etc/tor/torrc; then
  377. echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc
  378. fi
  379. if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
  380. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  381. fi
  382. if ! grep -q "TransPort" /etc/tor/torrc; then
  383. echo 'TransPort 9040' >> /etc/tor/torrc
  384. fi
  385. if ! grep -q "TransListenAddress 127.0.0.1" /etc/tor/torrc; then
  386. echo 'TransListenAddress 127.0.0.1' >> /etc/tor/torrc
  387. fi
  388. if ! grep -q "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  389. echo "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  390. fi
  391. if ! grep -q "DNSPort" /etc/tor/torrc; then
  392. echo 'DNSPort 53' >> /etc/tor/torrc
  393. fi
  394. if ! grep -q "DNSListenAddress 127.0.0.1" /etc/tor/torrc; then
  395. echo 'DNSListenAddress 127.0.0.1' >> /etc/tor/torrc
  396. fi
  397. if ! grep -q "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  398. echo "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  399. fi
  400. mark_completed "${FUNCNAME[0]}"
  401. }
  402. function get_app_onion_address {
  403. app_name="$1"
  404. mobilestr="$2"
  405. if [ ${#mobilestr} -gt 0 ]; then
  406. app_name="mobile${app_name}"
  407. fi
  408. if grep -q "${app_name} onion domain" "$COMPLETION_FILE"; then
  409. if grep -q "${app_name} onion domain" "$COMPLETION_FILE"; then
  410. grep "${app_name} onion domain" "${COMPLETION_FILE}" | head -n 1 | awk -F ':' '{print $2}'
  411. return
  412. fi
  413. fi
  414. echo ""
  415. }
  416. function tor_add_bridge {
  417. bridge_ip_address="$1"
  418. bridge_port="$2"
  419. bridge_key="$3"
  420. bridge_type='obfs4'
  421. if [[ "$bridge_ip_address" != *"."* ]]; then
  422. return
  423. fi
  424. if [ ${#bridge_port} -eq 0 ]; then
  425. return
  426. fi
  427. if [ ${#bridge_key} -eq 0 ]; then
  428. return
  429. fi
  430. apt-get -yq install obfs4proxy
  431. if [ ! -f /etc/torrc.d/bridges ]; then
  432. { echo 'ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed';
  433. echo 'UseBridges 1';
  434. echo "Bridge $bridge_type ${bridge_ip_address}:${bridge_port} ${bridge_key}"; } > /etc/torrc.d/bridges
  435. else
  436. if ! grep -q "Bridge $bridge_type ${bridge_ip_address}:${bridge_port} ${bridge_key}" /etc/torrc.d/bridges; then
  437. echo "Bridge $bridge_type ${bridge_ip_address}:${bridge_port} ${bridge_key}" >> /etc/torrc.d/bridges
  438. fi
  439. fi
  440. systemctl restart tor
  441. }
  442. function tor_remove_bridge {
  443. bridge_ip_address="$1"
  444. bridge_type='obfs4'
  445. if [[ "$bridge_ip_address" == *"."* ]]; then
  446. bridge_str="Bridge $bridge_type ${bridge_ip_address}"
  447. else
  448. if grep -q " ${bridge_ip_address}" /etc/torrc.d/bridges; then
  449. bridge_str=" ${bridge_ip_address}"
  450. else
  451. return
  452. fi
  453. fi
  454. if grep -q "${bridge_str}" /etc/torrc.d/bridges; then
  455. sed -i "/${bridge_str}/d" /etc/torrc.d/bridges
  456. fi
  457. # If there are no bridges remaining then remove the file
  458. if ! grep -q "Bridge " /etc/torrc.d/bridges; then
  459. rm /etc/torrc.d/bridges
  460. fi
  461. systemctl restart tor
  462. }
  463. function tor_create_bridge_relay {
  464. read_config_param 'TOR_BRIDGE_PORT'
  465. read_config_param 'TOR_BRIDGE_NICKNAME'
  466. read_config_param 'MY_EMAIL_ADDRESS'
  467. if [ ! "$TOR_BRIDGE_PORT" ]; then
  468. return
  469. fi
  470. if [ ${#TOR_BRIDGE_PORT} -eq 0 ]; then
  471. return
  472. fi
  473. if [ ${#TOR_BRIDGE_NICKNAME} -eq 0 ]; then
  474. return
  475. fi
  476. apt-get -yq install obfs4proxy
  477. { echo 'BridgeRelay 1';
  478. echo 'ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy';
  479. echo "ExtORPort $TOR_BRIDGE_PORT";
  480. echo "ContactInfo $MY_EMAIL_ADDRESS";
  481. echo "Nickname $TOR_BRIDGE_NICKNAME"; } > /etc/torrc.d/bridgerelay
  482. firewall_add tor_bridge "$TOR_BRIDGE_PORT" tcp
  483. systemctl restart tor
  484. }
  485. function tor_remove_bridge_relay {
  486. if [ -f /etc/torrc.d/bridgerelay ]; then
  487. rm /etc/torrc.d/bridgerelay
  488. fi
  489. read_config_param 'TOR_BRIDGE_PORT'
  490. firewall_remove "$TOR_BRIDGE_PORT" tcp
  491. systemctl restart tor
  492. }
  493. # NOTE: deliberately no exit 0