freedombone-utils-onion 19KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Onion functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. # The maximum amount of traffic per day in gigabytes
  31. TOR_MAX_TRAFFIC_PER_MONTH_GB=10
  32. USE_V2_ONION_ADDRESS=
  33. HIDDEN_SERVICE_PATH='/var/lib/tor/hidden_service_'
  34. function add_email_hostname {
  35. extra_email_hostname="$1"
  36. email_hostnames=$(grep "dc_other_hostnames" /etc/exim4/update-exim4.conf.conf | awk -F "'" '{print $2}')
  37. if [[ "$email_hostnames" != *"$extra_email_hostname"* ]]; then
  38. sed -i "s|dc_other_hostnames=.*|dc_other_hostnames='$email_hostnames;$extra_email_hostname'|g" /etc/exim4/update-exim4.conf.conf
  39. update-exim4.conf
  40. dpkg-reconfigure --frontend noninteractive exim4-config
  41. systemctl restart saslauthd
  42. fi
  43. }
  44. function onion_update {
  45. # update so that new onion services appear
  46. systemctl restart tor
  47. }
  48. function wait_for_onion_service_base {
  49. onion_service_name="$1"
  50. sleep_ctr=0
  51. while [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; do
  52. sleep 1
  53. sleep_ctr=$((sleep_ctr + 1))
  54. if [ $sleep_ctr -gt 10 ]; then
  55. break
  56. fi
  57. done
  58. }
  59. function wait_for_onion_service {
  60. onion_service_name="$1"
  61. wait_for_onion_service_base "${onion_service_name}"
  62. if [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  63. # try a second time
  64. onion_update
  65. wait_for_onion_service_base "${onion_service_name}"
  66. fi
  67. sync
  68. }
  69. function remove_onion_service {
  70. onion_service_name="$1"
  71. onion_service_port_to=$2
  72. nick="$3"
  73. if [ ${#nick} -gt 0 ]; then
  74. sed -i "/stealth ${nick}/d" /etc/tor/torrc
  75. fi
  76. sed -i "/hidden_service_${onion_service_name}/,+1 d" /etc/tor/torrc
  77. sed -i "/hidden_service_${onion_service_name}_mobile/,+1 d" /etc/tor/torrc
  78. sed -i "/127.0.0.1:${onion_service_port_to}/d" /etc/tor/torrc
  79. if [ "$3" ]; then
  80. sed -i "/127.0.0.1:${3}/d" /etc/tor/torrc
  81. if [ "$4" ]; then
  82. sed -i "/127.0.0.1:${4}/d" /etc/tor/torrc
  83. if [ "$5" ]; then
  84. sed -i "/127.0.0.1:${5}/d" /etc/tor/torrc
  85. fi
  86. fi
  87. fi
  88. if [ -d "${HIDDEN_SERVICE_PATH}${onion_service_name}" ]; then
  89. shred -zu "${HIDDEN_SERVICE_PATH}${onion_service_name}/"*
  90. rm -rf "${HIDDEN_SERVICE_PATH}${onion_service_name}"
  91. fi
  92. if [ -d "${HIDDEN_SERVICE_PATH}${onion_service_name}_mobile" ]; then
  93. shred -zu "${HIDDEN_SERVICE_PATH}${onion_service_name}_mobile/"*
  94. rm -rf "${HIDDEN_SERVICE_PATH}${onion_service_name}_mobile"
  95. fi
  96. remove_completion_param "${onion_service_name} onion domain"
  97. onion_update
  98. }
  99. function add_onion_service {
  100. onion_service_name="$1"
  101. onion_service_port_from=$2
  102. onion_service_port_to=$3
  103. onion_stealth_name="$4"
  104. if [ -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  105. cat "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname"
  106. USE_V2_ONION_ADDRESS=
  107. return
  108. fi
  109. if [ ! -d /var/lib/tor ]; then
  110. echo $"No Tor installation found. ${onion_service_name} onion site cannot be configured."
  111. USE_V2_ONION_ADDRESS=
  112. exit 877367
  113. fi
  114. if ! grep -q "hidden_service_${onion_service_name}" /etc/tor/torrc; then
  115. echo "HiddenServiceDir ${HIDDEN_SERVICE_PATH}${onion_service_name}/" >> /etc/tor/torrc
  116. if [ ! $USE_V2_ONION_ADDRESS ]; then
  117. echo 'HiddenServiceVersion 3' >> /etc/tor/torrc
  118. else
  119. echo 'HiddenServiceVersion 2' >> /etc/tor/torrc
  120. fi
  121. echo "HiddenServicePort ${onion_service_port_from} 127.0.0.1:${onion_service_port_to}" >> /etc/tor/torrc
  122. if [ ${#onion_stealth_name} -gt 0 ]; then
  123. echo "HiddenServiceAuthorizeClient stealth ${onion_stealth_name}" >> /etc/tor/torrc
  124. fi
  125. fi
  126. USE_V2_ONION_ADDRESS=
  127. onion_update
  128. function_check wait_for_onion_service
  129. wait_for_onion_service "${onion_service_name}"
  130. if [ ! -f "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname" ]; then
  131. ls -lh "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname"
  132. echo $"${onion_service_name} onion site hostname not found"
  133. exit 763624
  134. fi
  135. onion_address=$(cat "${HIDDEN_SERVICE_PATH}${onion_service_name}/hostname")
  136. # Record the domain in the completion file
  137. set_completion_param "${onion_service_name} onion domain" "${onion_address}"
  138. echo "$onion_address"
  139. }
  140. function set_default_onion_domains {
  141. # If sites are only visible via Tor then for installation
  142. # purposes assign them some default domain names
  143. if [[ $ONION_ONLY == "no" ]]; then
  144. return
  145. fi
  146. POSTACTIV_DOMAIN_NAME='postactiv.local'
  147. GNUSOCIAL_DOMAIN_NAME='gnusocial.local'
  148. HTMLY_DOMAIN_NAME='htmly.local'
  149. BLUDIT_DOMAIN_NAME='bludit.local'
  150. DOKUWIKI_DOMAIN_NAME='dokuwiki.local'
  151. DEFAULT_DOMAIN_NAME="${LOCAL_NAME}.local"
  152. GIT_DOMAIN_NAME='gogs.local'
  153. }
  154. function create_avahi_onion_domains {
  155. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  156. return
  157. fi
  158. if [ ! -d /etc/avahi/services ]; then
  159. return
  160. fi
  161. if [ $GNUSOCIAL_DOMAIN_NAME ]; then
  162. function_check create_avahi_service
  163. create_avahi_service gnusocial http tcp "$GNUSOCIAL_ONION_PORT"
  164. fi
  165. if [ $HTMLY_DOMAIN_NAME ]; then
  166. function_check create_avahi_service
  167. create_avahi_service blog http tcp "$HTMLY_ONION_PORT"
  168. fi
  169. if [ $GIT_DOMAIN_NAME ]; then
  170. function_check create_avahi_service
  171. create_avahi_service git http tcp "$GIT_ONION_PORT"
  172. fi
  173. if [ $DOKUWIKI_DOMAIN_NAME ]; then
  174. function_check create_avahi_service
  175. create_avahi_service dokuwiki http tcp "$DOKUWIKI_ONION_PORT"
  176. fi
  177. }
  178. function allow_ssh_to_onion_address {
  179. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  180. return
  181. fi
  182. if [ ! -d "/home/$MY_USERNAME/.ssh" ]; then
  183. mkdir "/home/$MY_USERNAME/.ssh"
  184. fi
  185. if [ ! -d /etc/tor ]; then
  186. echo $'Tor not found when updating ssh'
  187. exit 528257
  188. fi
  189. if ! grep -q "onion" "/home/$MY_USERNAME/.ssh/config"; then
  190. echo 'Host *.onion' >> "/home/$MY_USERNAME/.ssh/config"
  191. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> "/home/$MY_USERNAME/.ssh/config"
  192. fi
  193. }
  194. function enable_ssh_via_onion {
  195. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  196. return
  197. fi
  198. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  199. return
  200. fi
  201. echo 'N' | apt-get -yq -t stretch-backports install tor
  202. apt-get -yq install connect-proxy
  203. if ! grep -q 'Host *.onion' "/home/$MY_USERNAME/.ssh/config"; then
  204. if [ ! -d "/home/$MY_USERNAME/.ssh" ]; then
  205. mkdir "/home/$MY_USERNAME/.ssh"
  206. fi
  207. echo 'Host *.onion' >> "/home/$MY_USERNAME/.ssh/config"
  208. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> "/home/$MY_USERNAME/.ssh/config"
  209. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.ssh"
  210. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.ssh/config"
  211. fi
  212. if ! grep -q 'Host *.onion' /root/.ssh/config; then
  213. if [ ! -d /root/.ssh ]; then
  214. mkdir /root/.ssh
  215. fi
  216. echo 'Host *.onion' >> /root/.ssh/config
  217. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /root/.ssh/config
  218. fi
  219. if ! grep -q 'Host *.onion' /etc/skel/.ssh/config; then
  220. if [ ! -d /etc/skel/.ssh ]; then
  221. mkdir /etc/skel/.ssh
  222. fi
  223. echo 'Host *.onion' >> /etc/skel/.ssh/config
  224. echo 'ProxyCommand connect -R remote -5 -S 127.0.0.1:9050 %h %p' >> /etc/skel/.ssh/config
  225. fi
  226. mark_completed "${FUNCNAME[0]}"
  227. }
  228. function configure_ssh_onion {
  229. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  230. return
  231. fi
  232. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  233. return
  234. fi
  235. SSH_ONION_HOSTNAME=$(add_onion_service ssh "${SSH_PORT}" "${SSH_PORT}")
  236. if [[ "$SSH_ONION_HOSTNAME" != *'.onion' ]]; then
  237. echo $'ssh onion site not generated'
  238. exit 624128
  239. fi
  240. set_completion_param "ssh onion domain" "${SSH_ONION_HOSTNAME}"
  241. add_email_hostname "${SSH_ONION_HOSTNAME}"
  242. mark_completed "${FUNCNAME[0]}"
  243. }
  244. function install_tor {
  245. if [[ $SYSTEM_TYPE == "mesh*" ]]; then
  246. return
  247. fi
  248. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  249. return
  250. fi
  251. apt-get -yq -t stretch-backports install tor
  252. if [ ! -f /etc/tor/torrc ]; then
  253. echo 'Tor failed to install'
  254. exit 38259
  255. fi
  256. # For torify
  257. apt-get -yq install torsocks
  258. # turn off logging
  259. sed -i 's|#Log notice file.*|Log notice file /dev/null|g' /etc/tor/torrc
  260. sed -i 's|Log notice file.*|Log notice file /dev/null|g' /etc/tor/torrc
  261. # Restrict traffic
  262. sed -i "s|#AccountingMax.*|AccountingMax $TOR_MAX_TRAFFIC_PER_MONTH_GB GBytes|g" /etc/tor/torrc
  263. sed -i "s|AccountingMax.*|AccountingMax $TOR_MAX_TRAFFIC_PER_MONTH_GB GBytes|g" /etc/tor/torrc
  264. mark_completed "${FUNCNAME[0]}"
  265. }
  266. function resolve_dns_via_tor {
  267. if [[ $SYSTEM_TYPE == "mesh"* ]]; then
  268. return
  269. fi
  270. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  271. return
  272. fi
  273. if [ ! -f /etc/tor/torrc ]; then
  274. echo $'tor was not installed'
  275. exit 52952
  276. fi
  277. # resolve DNS via tor
  278. if ! grep -q 'DNSPort 53' /etc/tor/torrc; then
  279. { echo 'DNSPort 53';
  280. echo 'AutomapHostsOnResolve 1';
  281. echo 'AutomapHostsSuffixes .exit,.onion'; } >> /etc/tor/torrc
  282. onion_update
  283. fi
  284. # don't change resolv.conf
  285. sed -i 's|, domain-name-servers||g' /etc/dhcp/dhclient.conf
  286. # point resolv.conf to tor
  287. resolvconf=/etc/resolvconf/resolv.conf.d/head
  288. echo 'nameserver 127.0.0.1:53' > $resolvconf
  289. resolvconf -u
  290. mark_completed "${FUNCNAME[0]}"
  291. }
  292. # see https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
  293. # Local Redirection and Anonymizing Middlebox
  294. function route_outgoing_traffic_through_tor {
  295. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  296. return
  297. fi
  298. if [[ $ROUTE_THROUGH_TOR != "yes" ]]; then
  299. return
  300. fi
  301. echo 'N' | apt-get -yq -t stretch-backports install tor
  302. echo 'N' | apt-get -yq -t stretch-backports install tor-arm
  303. ### set variables
  304. # Destinations you don't want routed through Tor
  305. _non_tor="192.168.1.0/24 192.168.0.0/24"
  306. # The user that Tor runs as
  307. _tor_uid="debian-tor"
  308. # Tor's TransPort
  309. _trans_port="9040"
  310. # Your internal interface
  311. _int_if="eth0"
  312. ### Set iptables *nat
  313. iptables -t nat -A OUTPUT -o lo -j RETURN
  314. iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
  315. iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
  316. # Allow clearnet access for hosts in $_non_tor
  317. for _clearnet in $_non_tor; do
  318. iptables -t nat -A OUTPUT -d "$_clearnet" -j RETURN
  319. iptables -t nat -A PREROUTING -i $_int_if -d "$_clearnet" -j RETURN
  320. done
  321. # Redirect all other pre-routing and output to Tor
  322. iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
  323. iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53
  324. iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
  325. ### set iptables *filter
  326. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  327. # Allow clearnet access for hosts in $_non_tor
  328. for _clearnet in $_non_tor 127.0.0.0/8; do
  329. iptables -A OUTPUT -d "$_clearnet" -j ACCEPT
  330. done
  331. # Allow only Tor output
  332. iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
  333. iptables -A OUTPUT -j REJECT
  334. function_check save_firewall_settings
  335. save_firewall_settings
  336. if ! grep -q "fs.file-max" /etc/sysctl.conf; then
  337. echo "fs.file-max=100000" >> /etc/sysctl.conf
  338. /sbin/sysctl -p -q
  339. fi
  340. resolvconf=/etc/resolvconf/resolv.conf.d/head
  341. echo 'domain localdomain' > $resolvconf
  342. echo 'search localdomain' >> $resolvconf
  343. echo 'nameserver 127.0.0.1' >> $resolvconf
  344. resolvconf -u
  345. if ! grep -q "VirtualAddrNetworkIPv4" /etc/tor/torrc; then
  346. echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc
  347. fi
  348. if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
  349. echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
  350. fi
  351. if ! grep -q "TransPort" /etc/tor/torrc; then
  352. echo 'TransPort 9040' >> /etc/tor/torrc
  353. fi
  354. if ! grep -q "TransListenAddress 127.0.0.1" /etc/tor/torrc; then
  355. echo 'TransListenAddress 127.0.0.1' >> /etc/tor/torrc
  356. fi
  357. if ! grep -q "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  358. echo "TransListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  359. fi
  360. if ! grep -q "DNSPort" /etc/tor/torrc; then
  361. echo 'DNSPort 53' >> /etc/tor/torrc
  362. fi
  363. if ! grep -q "DNSListenAddress 127.0.0.1" /etc/tor/torrc; then
  364. echo 'DNSListenAddress 127.0.0.1' >> /etc/tor/torrc
  365. fi
  366. if ! grep -q "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" /etc/tor/torrc; then
  367. echo "DNSListenAddress $LOCAL_NETWORK_STATIC_IP_ADDRESS" >> /etc/tor/torrc
  368. fi
  369. mark_completed "${FUNCNAME[0]}"
  370. }
  371. function get_app_onion_address {
  372. app_name="$1"
  373. mobilestr="$2"
  374. if [ ${#mobilestr} -gt 0 ]; then
  375. app_name="mobile${app_name}"
  376. fi
  377. if grep -q "${app_name} onion domain" "$COMPLETION_FILE"; then
  378. if grep -q "${app_name} onion domain" "$COMPLETION_FILE"; then
  379. grep "${app_name} onion domain" "${COMPLETION_FILE}" | head -n 1 | awk -F ':' '{print $2}'
  380. return
  381. fi
  382. fi
  383. echo ""
  384. }
  385. function tor_add_bridge {
  386. bridge_ip_address="$1"
  387. bridge_port="$2"
  388. bridge_key="$3"
  389. bridge_type='obfs4'
  390. if [[ "$bridge_ip_address" != *"."* ]]; then
  391. return
  392. fi
  393. if [ ${#bridge_port} -eq 0 ]; then
  394. return
  395. fi
  396. if [ ${#bridge_key} -eq 0 ]; then
  397. return
  398. fi
  399. apt-get -yq install obfs4proxy
  400. if grep -q "ClientTransportPlugin" /etc/tor/torrc; then
  401. sed -i 's|#ClientTransportPlugin|ClientTransportPlugin|g' /etc/tor/torrc
  402. sed -i 's|# ClientTransportPlugin|ClientTransportPlugin|g' /etc/tor/torrc
  403. sed -i 's|ClientTransportPlugin.*|ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed|g' /etc/tor/torrc
  404. else
  405. echo 'ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed' >> /etc/tor/torrc
  406. fi
  407. if grep -q "UseBridges" /etc/tor/torrc; then
  408. sed -i 's|#UseBridges|UseBridges|g' /etc/tor/torrc
  409. sed -i 's|# UseBridges|UseBridges|g' /etc/tor/torrc
  410. sed -i 's|UseBridges.*|UseBridges 1|g' /etc/tor/torrc
  411. else
  412. echo 'UseBridges 1' >> /etc/tor/torrc
  413. fi
  414. bridge_str="Bridge $bridge_type ${bridge_ip_address}:${bridge_port} ${bridge_key}"
  415. if ! grep -q "${bridge_str}" /etc/tor/torrc; then
  416. sed -i "/UseBridges/a ${bridge_str}" >> /etc/tor/torrc
  417. fi
  418. systemctl restart tor
  419. }
  420. function tor_remove_bridge {
  421. bridge_ip_address="$1"
  422. bridge_type='obfs4'
  423. if [[ "$bridge_ip_address" == *"."* ]]; then
  424. bridge_str="Bridge $bridge_type ${bridge_ip_address}"
  425. else
  426. if grep -q " ${bridge_ip_address}" /etc/tor/torrc; then
  427. bridge_str=" ${bridge_ip_address}"
  428. else
  429. return
  430. fi
  431. fi
  432. if grep -q "${bridge_str}" /etc/tor/torrc; then
  433. sed -i "/${bridge_str}/d" /etc/tor/torrc
  434. fi
  435. # If there are no bridges remaining then remove UseBridges
  436. if ! grep -q "Bridge " /etc/tor/torrc; then
  437. if ! grep -q "#UseBridges" /etc/tor/torrc; then
  438. sed -i 's|UseBridges|#UseBridges|g' /etc/tor/torrc
  439. fi
  440. if ! grep -q "#ClientTransportPlugin" /etc/tor/torrc; then
  441. sed -i 's|ClientTransportPlugin|#ClientTransportPlugin|g' /etc/tor/torrc
  442. fi
  443. fi
  444. systemctl restart tor
  445. }
  446. function tor_create_bridge_relay {
  447. read_config_param 'TOR_BRIDGE_PORT'
  448. read_config_param 'TOR_BRIDGE_NICKNAME'
  449. if [ ! "$TOR_BRIDGE_PORT" ]; then
  450. return
  451. fi
  452. if [ ${#TOR_BRIDGE_PORT} -eq 0 ]; then
  453. return
  454. fi
  455. if [ ${#TOR_BRIDGE_NICKNAME} -eq 0 ]; then
  456. return
  457. fi
  458. apt-get -yq install obfs4proxy
  459. sed -i 's|#BridgeRelay.*|BridgeRelay 1|g' /etc/tor/torrc
  460. sed -i 's|BridgeRelay.*|BridgeRelay 1|g' /etc/tor/torrc
  461. sed -i 's|#ServerTransportPlugin.*|ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy|g' /etc/tor/torrc
  462. sed -i 's|ServerTransportPlugin.*|ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy|g' /etc/tor/torrc
  463. if ! grep -q 'ExtORPort ' /etc/tor/torrc; then
  464. echo "ExtORPort $TOR_BRIDGE_PORT" >> /etc/tor/torrc
  465. else
  466. sed -i "s|#ExtORPort .*|ExtORPort $TOR_BRIDGE_PORT|g" /etc/tor/torrc
  467. sed -i "s|ExtORPort .*|ExtORPort $TOR_BRIDGE_PORT|g" /etc/tor/torrc
  468. fi
  469. read_config_param 'MY_EMAIL_ADDRESS'
  470. sed -i "s|#ContactInfo.*|ContactInfo $MY_EMAIL_ADDRESS|g" /etc/tor/torrc
  471. if [ "$TOR_BRIDGE_NICKNAME" ]; then
  472. sed -i "s|#Nickname.*|Nickname $TOR_BRIDGE_NICKNAME|g" /etc/tor/torrc
  473. sed -i "s|Nickname.*|Nickname $TOR_BRIDGE_NICKNAME|g" /etc/tor/torrc
  474. fi
  475. firewall_add tor_bridge "$TOR_BRIDGE_PORT" tcp
  476. systemctl restart tor
  477. }
  478. function tor_remove_bridge_relay {
  479. if ! grep -q '#BridgeRelay ' /etc/tor/torrc; then
  480. sed -i 's|BridgeRelay |#BridgeRelay |g' /etc/tor/torrc
  481. fi
  482. if ! grep -q '#ServerTransportPlugin ' /etc/tor/torrc; then
  483. sed -i 's|ServerTransportPlugin |#ServerTransportPlugin |g' /etc/tor/torrc
  484. fi
  485. if ! grep -q '#ExtORPort ' /etc/tor/torrc; then
  486. sed -i 's|ExtORPort |#ExtORPort |g' /etc/tor/torrc
  487. fi
  488. if ! grep -q '#ContactInfo ' /etc/tor/torrc; then
  489. sed -i "s|ContactInfo |#ContactInfo |g" /etc/tor/torrc
  490. fi
  491. if ! grep -q '#Nickname ' /etc/tor/torrc; then
  492. sed -i "s|Nickname |#Nickname |g" /etc/tor/torrc
  493. fi
  494. read_config_param 'TOR_BRIDGE_PORT'
  495. firewall_remove "$TOR_BRIDGE_PORT" tcp
  496. systemctl restart tor
  497. }
  498. # NOTE: deliberately no exit 0