--- /dev/null
+#! /bin/bash
+
+### Script to set up an iodine tunnel route traffic through it
+###
+### Copyright 2008 Barak A. Pearlmutter <bap@debian.org>
+###
+### License: MIT
+###
+### Permission to use, copy, modify, and distribute this software for
+### any purpose with or without fee is hereby granted, provided that
+### the above copyright notice and this permission notice appear in
+### all copies.
+###
+### THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+### WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+### WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+### AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+### CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+### LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+### NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+### CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+## Cause script to bail immediately on failed command
+set -e
+
+## Options for user to set.
+
+## Minimal customization: put the two lines
+## subdomain=your.tunnel.sub.domain
+## passed=password_for_that_tunnel
+## in the file /etc/default/iodine-client.
+
+echo "${iodine_client_rc:=/etc/default/iodine-client}" > /dev/null
+
+if [ -r ${iodine_client_rc} ]; then
+ . ${iodine_client_rc}
+else
+ echo WARNING: Cannot read ${iodine_client_rc}
+fi
+
+if [ -z ${subdomain} ]; then
+ read -p "DNS tunnel DNS subdomain: " subdomain
+fi
+
+if [ -z ${subdomain} ]; then
+ echo ERROR: Must set subdomain.
+ exit 1
+fi
+
+if [ -z ${passwd} ]; then
+ read -p "Password for DNS tunnel over ${subdomain}: " passwd
+fi
+
+## This is a host name used for testing DNS and for pinging
+echo "${testhost:=slashdot.org}" > /dev/null
+
+## Set if local network should be taken down and then up
+echo "${bounce_localnet:=true}" > /dev/null
+
+## Set for testing network availability via ping at various points
+echo "${test_ping_localnet:=true}" > /dev/null
+echo "${test_ping_tunnel:=true}" > /dev/null
+echo "${test_ping_final:=true}" > /dev/null
+
+## Set if the script cannot find and then incorrectly guesses the
+## local network router
+echo "${default_router}" > /dev/null
+
+## Set if script uses the wrong hardware interface
+echo "{interface}" > /dev/null
+
+## Set if the script should continue even if a command fails.
+## Used to test script when running as non-root.
+if [ $(whoami) = root ]; then
+ echo "${continue_on_error:=false}" > /dev/null
+else
+ echo "${continue_on_error:=true}" > /dev/null
+fi
+
+## DEBIAN PACKAGES TO INSTALL: these are needed to run this script
+## iodine (for /usr/sbin/iodine)
+## iproute (for /bin/ip)
+## ipcalc (for /usr/bin/ipcalc)
+## dnsutils (for /usr/bin/dig)
+## fping (for /usr/bin/fping)
+
+## The default tunnel MTU is 1024.
+## If local DNS server restricts to 512 byte packets then do this:
+# ifconfig ${d} mtu 220
+
+## TO DO
+## - avoid double ping when DNS server and local router are the same
+## - option to not kill existing iodine DNS tunnels, in case there
+## are meant to be more than one
+## - sanify check whether default_router is on local network
+
+echo ==== Creating IP-over-DNS tunnel over local network connection...
+
+
+## Find a network interface
+
+if [ -z ${interface} ]; then
+ interface=$(tail --lines=+3 /proc/net/wireless \
+ | head -1 | tr -d : | awk '{print $1}')
+fi
+
+if [ -z ${interface} ]; then
+ interface=$(ifconfig -a | egrep '^[^ ].*encap:Ethernet' \
+ | head -1 | awk '{print $1}')
+fi
+
+if [ -z ${interface} ]; then
+ echo ERROR: No network interface found.
+ exit 1
+fi
+
+echo ==== Local network interface: ${interface}
+
+## Down any existing DNS tunnel (wish there were "approved" way to do this)
+
+echo ==== Killing existing DNS tunnels...
+if killall --quiet --wait --verbose --signal HUP iodine; then
+ sleep 2
+fi
+
+## Stabilize local network
+
+if ${bounce_localnet}; then
+ echo ==== Bouncing local network connection...
+ ifdown --force ${interface} || true
+ ifup ${interface} || ${continue_on_error}
+fi
+
+## Fetch some information about the local network
+
+addr=$(ip -4 addr show dev ${interface} scope global \
+ | tail -1 | awk '{print $2}')
+prefix_len=$(echo ${addr} | sed 'sX^.*/XX')
+local_net=$(ipcalc --nobinary ${addr} | awk '$1=="Network:" {print $2}')
+
+echo ==== Local address: ${addr}
+echo ==== Local network: ${local_net}
+
+router=$(ip -4 route list dev ${interface} \
+ | awk '$1=="default" {print $3}' | head -1)
+if [ -z ${router} ]; then
+ ## This can happen when the default local route is already deleted
+ if [ -z ${default_router} ]; then
+ echo WARNING: no default route, guessing local router IP address.
+ ## Minimum address on local net is usually right
+ router=$(ipcalc --nobinary ${addr} | awk '$1=="HostMin:" {print $2}')
+ else
+ echo WARNING: no default route, using configured default router.
+ ## But sometimes need to hardwire...
+ router=${default_router}
+ fi
+fi
+
+echo ==== Local network router: ${router}
+
+## Test DNS service
+
+testhost_ip=$(dig +short -t A -q ${testhost})
+if [ -z ${testhost_ip} ]; then
+ echo WARNING: Failure on DNS lookup of ${testhost}.
+fi
+
+## fetch DNS servers
+
+nameservers=$(awk '$1=="nameserver" {print $2}' /etc/resolv.conf)
+if [ -n "${nameservers}" ]; then
+ echo ==== DNS servers: ${nameservers}
+else
+ echo ERROR: No DNS servers found.
+ exit 1
+fi
+
+## Test if local network is up
+
+if ${test_ping_localnet}; then
+ echo ==== Ping test of local network router and DNS servers...
+ fping -C1 ${router} ${nameservers} \
+ || echo WARNING: Ping test failed.
+fi
+
+## Add point-to-point routes for any non-local DNS servers
+
+for n in ${nameservers}; do
+ n_net=$(ipcalc --nobinary ${n}/${prefix_len} | awk '$1=="Network:" {print $2}')
+ if [ "${n_net}" != "${local_net}" ]; then
+ echo ==== Adding point-to-point route for DNS server ${n}
+ ip -4 route add ${n}/32 via ${router} || ${continue_on_error}
+ fi
+done
+
+## Bring up DNS tunnel
+
+echo ==== Creating IP-over-DNS tunnel...
+iodine -P ${passwd} ${subdomain} || ${continue_on_error}
+
+## Find DNS tunnel interface
+
+tunnel_interface=$(ifconfig -a | egrep '^dns' | awk '{print $1}' | head -1)
+if [ -z "${tunnel_interface}" ]; then
+ echo WARNING: Cannot find DNS tunnel interface, using default.
+ tunnel_interface=dns0
+fi
+echo ==== DNS tunnel interface: ${tunnel_interface}
+
+## Figure out router at other end of tunnel, assuming router uses final octet .1
+## (There should be some way to get this information out of iodine, since
+## it *prints* it as it sets up the tunnel, so it does know it.)
+
+tunnel_remote=$(ip -4 address show dev ${tunnel_interface} \
+ | awk '$1=="inet" {print gensub("[.][0-9]*/.*", ".1", 1, $2)}' | head -1)
+
+if [ -z ${tunnel_remote} ]; then
+ echo ERROR: Cannot find DNS tunnel remote endpoint.
+ ${continue_on_error}
+ ## set something random if debugging
+ echo WARNING: Confabulating DNS tunnel remote endpoint.
+ tunnel_remote=192.168.253.1
+fi
+
+echo ==== DNS tunnel remote endpoint: ${tunnel_remote}
+
+if ${test_ping_tunnel}; then
+ echo ==== Ping test of local router, nameserver, and DNS tunnel...
+ fping -C1 ${router} ${nameservers} ${tunnel_remote} \
+ || echo WARNING: Ping test failed.
+fi
+
+## Modify routing table to send trafic via DNS tunnel
+
+echo ==== Setting default route through DNS tunnel...
+
+## Remove default route via local router
+ip -4 route del default via ${router} || ${continue_on_error}
+## Add default via tunnel
+ip -4 route add default via ${tunnel_remote} || ${continue_on_error}
+
+## Test if all is well
+
+if ${test_ping_final}; then
+ echo ==== Ping test of local router, nameserver, DNS tunnel, external test host...
+ fping -C1 ${router} ${nameservers} ${tunnel_remote} ${testhost_ip:-${testhost}} \
+ || echo WARNING: Ping test failed.
+fi
projects / bin.git / blobdiff