678 lines
18 KiB
Bash
678 lines
18 KiB
Bash
|
#!/bin/bash
|
||
|
|
# -*- mode: sh; fill-column: 75; tab-width: 8; coding: utf-8-unix -*-
|
||
|
|
|
||
|
|
ROLE=proxy
|
||
|
|
export PATH=$PATH:/usr/local/sbin:/usr/local/bin
|
||
|
|
|
||
|
|
# . /usr/local/sbin/proxy_whonix_lib.bash || { echo ERROR: loading /usr/local/sbin/proxy_whonix_lib.bash ; exit 2; }
|
||
|
|
. /usr/local/bin/proxy_ping_lib.bash || \
|
||
|
|
{ echo ERROR: loading /usr/local/bin/proxy_ping_lib.bash ; exit 2; }
|
||
|
|
|
||
|
|
## proxy_guest_firewall_config -- /etc/firewall.conf.ws.new
|
||
|
|
proxy_guest_firewall_config () {
|
||
|
|
. /usr/local/sbin/proxy_whonix_guest_workstation-firewall.bash || return 2$?
|
||
|
|
source_config_folder
|
||
|
|
iptables_cmd="echo iptables"
|
||
|
|
ip6tables_cmd="echo # ip6tables"
|
||
|
|
main > /etc/firewall.conf.ws.new
|
||
|
|
|
||
|
|
return $?
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_guest_config
|
||
|
|
proxy_whonix_guest_config () {
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_guest_start
|
||
|
|
proxy_whonix_guest_start () {
|
||
|
|
local dire=$1
|
||
|
|
|
||
|
|
[ ! -f /etc/init.d/qemu-guest-agent ] || \
|
||
|
|
proxy_rc_service qemu-guest-agent status >/dev/null \
|
||
|
|
|| proxy_rc_service qemu-guest-agent start || return 2$?
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_guest_test
|
||
|
|
proxy_whonix_guest_test () {
|
||
|
|
[ -e /dev/virtio-ports/org.qemu.guest_agent.0 ] || \
|
||
|
|
echo WARN: /dev/virtio-ports/org.qemu.guest_agent.0 not created
|
||
|
|
proxy_rc_service qemu-guest-agent status
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_gateway_config
|
||
|
|
proxy_whonix_gateway_config () {
|
||
|
|
proxy_whonix_dnsmasq_config gateway 10.0.2.15
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_dnsmasq_config
|
||
|
|
proxy_whonix_dnsmasq_config () {
|
||
|
|
local dire
|
||
|
|
|
||
|
|
[ "$#" -eq 0 ] || dire=$1
|
||
|
|
[ -z "$dire" ] && MODE="$( proxy_whonix_mode )" && dire=$MODE
|
||
|
|
[ -n "$MODE" ] || MODE=host
|
||
|
|
|
||
|
|
proxy_dest_port_wlan_config
|
||
|
|
[ -z "$PORT" -o -z "$DEST" ] && return 1
|
||
|
|
|
||
|
|
# 9040 - no wgetrc polipo
|
||
|
|
# need dnsmasq to 127
|
||
|
|
file=/etc/dnsmasq.conf
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
log-facility=/var/log/dnsmasq.log
|
||
|
|
no-resolv
|
||
|
|
listen-address=127.0.0.1
|
||
|
|
server=${DEST}#$PORT
|
||
|
|
port=53
|
||
|
|
# wlan4
|
||
|
|
interface=$PROXY_WLAN
|
||
|
|
bind-interfaces
|
||
|
|
no-dhcp-interface=$PROXY_WLAN
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_polipo_config
|
||
|
|
proxy_whonix_polipo_config () {
|
||
|
|
local dire
|
||
|
|
local file
|
||
|
|
[ "$#" -eq 0 ] && { echo ERROR: proxy_whonix_polipo_config no dire ; return 1; }
|
||
|
|
dire=$1
|
||
|
|
|
||
|
|
file=/etc/polipo/config
|
||
|
|
if [ $dire = whonix ]; then
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
proxyAddress=127.0.0.1
|
||
|
|
proxyPort=3128
|
||
|
|
proxyName=127.0.0.1
|
||
|
|
socksParentProxy=10.0.2.15:9050
|
||
|
|
socksProxyType=socks5
|
||
|
|
#?ssocksUserName=foo
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
proxyAddress=127.0.0.1
|
||
|
|
proxyPort=3128
|
||
|
|
proxyName=127.0.0.1
|
||
|
|
socksParentProxy=${DEST}:$PORT
|
||
|
|
socksProxyType=socks5
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_polipo_config
|
||
|
|
proxy_whonix_polipo_config () {
|
||
|
|
local dire
|
||
|
|
local file
|
||
|
|
dire=$1 ; shift
|
||
|
|
|
||
|
|
file=/etc/polipo/config
|
||
|
|
if [ $dire = whonix ]; then
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
proxyAddress=127.0.0.1
|
||
|
|
proxyPort=3128
|
||
|
|
proxyName=127.0.0.1
|
||
|
|
socksParentProxy=10.0.2.15:9050
|
||
|
|
socksProxyType=socks5
|
||
|
|
#?ssocksUserName=foo
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
proxyAddress=127.0.0.1
|
||
|
|
proxyPort=3128
|
||
|
|
proxyName=127.0.0.1
|
||
|
|
socksParentProxy=${DEST}:$PORT
|
||
|
|
socksProxyType=socks5
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_privoxy_config
|
||
|
|
proxy_whonix_privoxy_config () {
|
||
|
|
local dire
|
||
|
|
local file
|
||
|
|
dire=$1 ; shift
|
||
|
|
|
||
|
|
file=/etc/privoxy/config
|
||
|
|
if [ $dire = whonix ]; then
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
listen-address 127.0.0.1:3128
|
||
|
|
forward-socks5t / 10.0.2.15:9050 .
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.conf <<EOF
|
||
|
|
listen-address 127.0.0.1:3128
|
||
|
|
forward-socks5t / 127.0.0.1:9050 .
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_dnsmasq_config
|
||
|
|
proxy_whonix_dnsmasq_config () {
|
||
|
|
local dire
|
||
|
|
|
||
|
|
[ "$#" -eq 0 ] && set - tor
|
||
|
|
dire=$1 ; shift
|
||
|
|
proxy_dest_port_wlan_config $*
|
||
|
|
[ -z "$PORT" -o -z "$DEST" ] && return 1
|
||
|
|
|
||
|
|
# 9040 - no wgetrc
|
||
|
|
# need dnsmasq to 127
|
||
|
|
file=/etc/dnsmasq.conf
|
||
|
|
if [ ! -f $file.$dire ] ; then
|
||
|
|
cp -p $file $file.$dire
|
||
|
|
cat >> $file.$dire <<EOF
|
||
|
|
log-facility=/var/log/dnsmasq.log
|
||
|
|
no-resolv
|
||
|
|
listen-address=127.0.0.1
|
||
|
|
server=${DEST}#$PORT
|
||
|
|
port=53
|
||
|
|
# wlan4
|
||
|
|
interface=$PROXY_WLAN
|
||
|
|
bind-interfaces
|
||
|
|
no-dhcp-interface=$PROXY_WLAN
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_tor_config
|
||
|
|
proxy_whonix_tor_config () {
|
||
|
|
proxy_host_tor_config tor 127.0.0.1
|
||
|
|
return $?
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_host_tor_config
|
||
|
|
proxy_host_tor_config () {
|
||
|
|
local dir
|
||
|
|
local file
|
||
|
|
dire=tor
|
||
|
|
DEST=127.0.0.1
|
||
|
|
PORT=9050
|
||
|
|
|
||
|
|
#? [ -z "$DEST" ] && proxy_dest_port_wlan_config || return 1$?
|
||
|
|
|
||
|
|
[ -z "$PORT" -o -z "$DEST" ] && return 2
|
||
|
|
proxy_whonix_polipo_config $dire || return 3$?
|
||
|
|
proxy_whonix_dnsmasq_config $dire || return 4$?
|
||
|
|
|
||
|
|
if proxy_ping_online ; then
|
||
|
|
proxy_ping_test_resolv $dire || { echo ERROR: proxy_host_tor_config 5$?; return 5 ; }
|
||
|
|
fi
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_host_from_config
|
||
|
|
proxy_host_whonix_config () {
|
||
|
|
local dire=whonix
|
||
|
|
local file
|
||
|
|
|
||
|
|
proxy_dest_port_wlan_config || return 1$?
|
||
|
|
DEST=10.0.2.15
|
||
|
|
PORT=9053
|
||
|
|
[ -z "$PORT" -o -z "$DEST" ] && return 2
|
||
|
|
proxy_whonix_polipo_config $dire
|
||
|
|
proxy_ping_test_resolv $dire || return 4$?
|
||
|
|
proxy_whonix_dnsmasq_config $dire || return 5$?
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_host_gateway
|
||
|
|
proxy_whonix_gateway () {
|
||
|
|
local dire=gateway
|
||
|
|
debug proxy_whonix_gateway $dire
|
||
|
|
|
||
|
|
PROXY_WLAN=$( proxy_get_if ) || return 1$?
|
||
|
|
proxy_whonix_config $dire || return 2$?
|
||
|
|
|
||
|
|
# works?
|
||
|
|
proxy_ping_set_resolv gateway
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_from_config
|
||
|
|
proxy_whonix_config () {
|
||
|
|
local dire=$1
|
||
|
|
[ -z "$DEST" ] && proxy_dest_port_wlan_config
|
||
|
|
|
||
|
|
if [ ! -f /etc/tor/torsocks.conf.$dire ] ; then
|
||
|
|
cp -p /etc/tor/torsocks.conf /etc/tor/torsocks.conf.$dire
|
||
|
|
# TorAddress 127.0.0.1
|
||
|
|
# TorPort 9050
|
||
|
|
fi
|
||
|
|
sed -e "s@^#* *TorAddress.*@TorAddress $DEST@" -i /etc/tor/torsocks.conf
|
||
|
|
sed -e "s@^#* *TorPort.*@TorPort 9050@" -i /etc/tor/torsocks.conf
|
||
|
|
|
||
|
|
# proxy_whonix_start_wget
|
||
|
|
|
||
|
|
proxy_host_${dire}_config
|
||
|
|
|
||
|
|
return $?
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_ws_whonix_config
|
||
|
|
proxy_ws_whonix_config () {
|
||
|
|
local dir=ws
|
||
|
|
|
||
|
|
DEST=10.152.152.10
|
||
|
|
PROXY_WLAN=eth0
|
||
|
|
proxy_host_whonix_config $dire $DEST 9053 $PROXY_WLAN
|
||
|
|
|
||
|
|
return $?
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_libvirt_status
|
||
|
|
proxy_whonix_libvirt_status () {
|
||
|
|
proxy_rc_service libvirtd status >/dev/null || \
|
||
|
|
proxy_rc_service libvirtd start || \
|
||
|
|
echo WARN: libvirtd crashed - see /var/log/libvirt/libvirtd.log # 2>&1|tee $WLOG
|
||
|
|
proxy_libvirt_status
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_libvirt_start
|
||
|
|
proxy_whonix_libvirt_start () {
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_libvirt_start
|
||
|
|
proxy_whonix_libvirt_start () {
|
||
|
|
local domain
|
||
|
|
[ "$#" -ge 1 ] && domain=$1
|
||
|
|
|
||
|
|
if [ ! -e /run/libvirt/libvirt-sock ] || ! proxy_rc_service libvirtd status >/dev/null ; then
|
||
|
|
cp /dev/null /var/log/libvirt/libvirtd.log
|
||
|
|
/etc/init.d/libvirtd status
|
||
|
|
retval=$?
|
||
|
|
[ $retval -eq 32 ] && WARN libvirtd crashed - zapping && /etc/init.d/libvirtd zap
|
||
|
|
[ $retval -eq 0 ] || /etc/init.d/libvirtd start || return 5$? # error: Failed to start livirtd
|
||
|
|
proxy_rc_service libvirtd start || return 3
|
||
|
|
sleep $DELAY
|
||
|
|
fi
|
||
|
|
proxy_libvirt_no_autostart
|
||
|
|
proxy_libvirt_start
|
||
|
|
proxy_libvirt_status
|
||
|
|
proxy_virsh net-list | grep -q Whonix-Internal || virsh net-start Whonix-Internal || return 3
|
||
|
|
proxy_virsh net-list | grep -q Whonix-External || virsh net-start Whonix-External || return 4
|
||
|
|
|
||
|
|
[ -z "$domain" ] && domain="$( proxy_testforge_get_gateway_dom )"
|
||
|
|
[ -z "$domain" ] && echo WARN: null proxy_testforge_get_gateway_dom && \
|
||
|
|
domain=Whonix-Gateway && \
|
||
|
|
echo INFO: set proxy_testforge_get_gateway_dom $domain
|
||
|
|
proxy_libvirt_list | grep -v grep | grep "$domain" || \
|
||
|
|
virsh start $domain || {
|
||
|
|
ret=$?
|
||
|
|
echo ERROR: proxy_whonix_libvirt_start failed virsh start $domain ret=$ret
|
||
|
|
return 5$ret
|
||
|
|
}
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_test
|
||
|
|
proxy_whonix_test () {
|
||
|
|
local dire
|
||
|
|
DEBUG proxy_whonix_test $dire
|
||
|
|
[ "$#" -eq 0 ] && dire=$MODE || dire=$1
|
||
|
|
|
||
|
|
[ $dire = ws -o $dire = workstation ] && dire=vda
|
||
|
|
|
||
|
|
if [ $dire = client ] ; then
|
||
|
|
:
|
||
|
|
# dunno - look at netstat? -nle4
|
||
|
|
|
||
|
|
elif [ $dire = vda -o $dire = gateway ] ; then
|
||
|
|
proxy_whonix_guest_test
|
||
|
|
|
||
|
|
elif [ $dire = tor ] ; then
|
||
|
|
proxy_rc_service tor status >/dev/null || \
|
||
|
|
{ echo ERROR: $prog tor is not running ; return 2 ; }
|
||
|
|
|
||
|
|
/usr/local/bin/proxy_ping_test.bash to_tor || return 6$?
|
||
|
|
|
||
|
|
elif [ $dire = whonix ] ; then
|
||
|
|
proxy_libvirt_no_autostart
|
||
|
|
proxy_libvirt_clean_virbr1_rules
|
||
|
|
|
||
|
|
proxy_whonix_get_gateway_dom
|
||
|
|
[ -z "$GATEW_DOM" ] && echo WARN: $prog DOM proxy_whonix_get_gateway_dom assuming Whonix-Gateway && DOM=Whonix-Gateway || DOM=$GATEW_DOM
|
||
|
|
|
||
|
|
proxy_virsh list | grep -q $DOM || { echo ERROR: $prog $DOM not running ; return 2 ; }
|
||
|
|
|
||
|
|
/usr/local/bin/proxy_ping_test.bash from_tor || return 6$?
|
||
|
|
fi
|
||
|
|
|
||
|
|
#? gateway
|
||
|
|
if [ $dire = whonix -o $dire = vda -o $dire = tor ] ; then
|
||
|
|
proxy_rc_service polipo status >/dev/null >/dev/null || \
|
||
|
|
{ echo ERROR: $prog polipo not running ; return 4 ; }
|
||
|
|
/usr/local/bin/proxy_ping_test.bash polipo || return 9$?
|
||
|
|
elif [ $dire = host -o $dire = tor ] ; then
|
||
|
|
proxy_rc_service privoxy status >/dev/null >/dev/null || \
|
||
|
|
{ echo ERROR: $prog privoxy not running ; return 4 ; }
|
||
|
|
/usr/local/bin/proxy_ping_test.bash privoxy || return 9$?
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ $dire = vda -o $dire = ws -o $dire = workstation ] ; then
|
||
|
|
proxy_clobber_resolv_local 10.152.152.10
|
||
|
|
elif [ $dire = gateway -o $dire = whonix -o $dire = tor ] ; then
|
||
|
|
proxy_rc_service dnsmasq status 2>/dev/null >/dev/null || \
|
||
|
|
{ echo ERROR: $prog dnsmasq not running ; return 5 ; }
|
||
|
|
proxy_clobber_resolv_local 127.0.0.1
|
||
|
|
fi
|
||
|
|
/usr/local/bin/proxy_ping_test.bash dns # || return 9$?
|
||
|
|
|
||
|
|
/usr/local/bin/proxy_ping_test.bash $dire || return 6$?
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
# Weher was this
|
||
|
|
## rc_host_symlink_etc_fstab
|
||
|
|
rc_host_symlink_etc_fstab () {
|
||
|
|
grep -q root=/dev/vda /proc/cmdline
|
||
|
|
PROXY_IS_VDA=$?
|
||
|
|
if [ $PROXY_IS_VDA -eq 0 ] ; then
|
||
|
|
[ -h /etc/fstab ] && [ -f /etc/fstab.vda ] && \
|
||
|
|
rm -f /etc/fstab && ln -s /etc/fstab.vda /etc/fstab
|
||
|
|
return 1
|
||
|
|
# else
|
||
|
|
# [ -h /etc/fstab ] && [ -f /etc/fstab.4TA ] && \
|
||
|
|
# rm -f /etc/fstab && ln -s /etc/fstab.4TA /etc/fstab
|
||
|
|
fi
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_vda_config
|
||
|
|
proxy_vda_config () {
|
||
|
|
|
||
|
|
rc_host_symlink_etc_fstab
|
||
|
|
sed -e 's/^#x1/x1/' -i /etc/inittab #
|
||
|
|
|
||
|
|
if false ; then
|
||
|
|
sed -e 's/^#//' -i $PREFIX/etc/modules_load.d/vda*conf
|
||
|
|
if [ ! -h /etc/modules_load.d/vda_mods.conf ] ; then
|
||
|
|
ln -s $PREFIX/etc/modules_load.d/vda*conf /etc/modules_load.d/
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
if false ; then
|
||
|
|
[ -f /etc/firewall.conf.vda ] && \
|
||
|
|
cp -p /etc/firewall.conf.vda /etc/firewall.conf
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
##
|
||
|
|
old_proxy_vda_config () {
|
||
|
|
|
||
|
|
[ -f /etc/inittab ] && sed -e 's/^#x1/x1/' -i /etc/inittab
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_vda_whonix_config
|
||
|
|
proxy_vda_whonix_config () {
|
||
|
|
local dir=vda
|
||
|
|
|
||
|
|
DEST=10.152.152.10
|
||
|
|
PROXY_WLAN=eth0
|
||
|
|
proxy_host_whonix_config $dire $DEST 9053 $PROXY_WLAN
|
||
|
|
|
||
|
|
return $?
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_quest_config
|
||
|
|
proxy_quest_config () {
|
||
|
|
|
||
|
|
proxy_vda_config
|
||
|
|
|
||
|
|
sed -e 's/^#//' -i $PREFIX/etc/modules_load.d/vda*conf
|
||
|
|
if [ ! -h /etc/modules_load.d/vda_mods.conf ] ; then
|
||
|
|
cp -np $PREFIX/etc/modules_load.d/vda*conf /etc/modules-load.d/
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_dnsmasq_start
|
||
|
|
proxy_whonix_dnsmasq_start () {
|
||
|
|
local dire
|
||
|
|
local service=dnsmasq
|
||
|
|
|
||
|
|
[ "$#" -eq 0 ] || dire=$1
|
||
|
|
[ -z "$dire" ] && MODE="$( proxy_whonix_mode )" && dire=$MODE
|
||
|
|
[ -n "$MODE" ] || MODE=host
|
||
|
|
|
||
|
|
DEBUG proxy_whonix_dnsmasq_start $dire $PROXY_WLAN
|
||
|
|
|
||
|
|
proxy_whonix_config $dire || return 1$?
|
||
|
|
|
||
|
|
PROXY_WLAN=$( proxy_get_if )
|
||
|
|
[ -z "$PROXY_WLAN" ] && echo ERROR: $prog empty PROXY_WLAN && return 4
|
||
|
|
|
||
|
|
sed -e "s/wlan[0-9]/$PROXY_WLAN/" -i /etc/dnsmasq.conf.$dire
|
||
|
|
if diff /etc/dnsmasq.conf.$dire /etc/dnsmasq.conf >/dev/null ; then
|
||
|
|
proxy_rc_service dnsmasq status >/dev/null || \
|
||
|
|
proxy_ping_dnsmasq_start || return 8$?
|
||
|
|
else
|
||
|
|
proxy_rc_service dnsmasq status >/dev/null && \
|
||
|
|
proxy_ping_dnsmasq_stop
|
||
|
|
cp -p /etc/dnsmasq.conf.$dire /etc/dnsmasq.conf
|
||
|
|
proxy_ping_dnsmasq_start || return 8$?
|
||
|
|
fi
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_privoxy_start
|
||
|
|
proxy_whonix_polipo_start () {
|
||
|
|
local dire
|
||
|
|
local service=polipo
|
||
|
|
|
||
|
|
[ $# -eq 1 ] && dire=$1
|
||
|
|
[ -z "$dire" ] && dire="$( proxy_whonix_mode )"
|
||
|
|
DEBUG proxy_whonix_start_$service $dire
|
||
|
|
|
||
|
|
proxy_whonix_config $dire || \
|
||
|
|
echo WARN: proxy_whonix_polipo_start proxy_whonix_config $dire $? # return 1$?
|
||
|
|
|
||
|
|
sed -e "s/wlan[0-9]/$PROXY_WLAN/" -e "s/eth[0-9]/$PROXY_WLAN/" -i /etc/polipo/config.$dire
|
||
|
|
|
||
|
|
if ! diff /etc/polipo/config.$dire /etc/polipo/config ; then
|
||
|
|
cp -p /etc/polipo/config.$dire /etc/polipo/config
|
||
|
|
proxy_rc_service $service restart || return 2$?
|
||
|
|
else
|
||
|
|
proxy_rc_service $service status >/dev/null || \
|
||
|
|
proxy_rc_service $service start||return 3$
|
||
|
|
fi
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_host_prepare_blocks
|
||
|
|
proxy_whonix_host_prepare_blocks () {
|
||
|
|
if [ ! -s /etc/firewall.conf.block ] ; then
|
||
|
|
if [ -f /usr/local/etc/firewall.conf.block ] ; then
|
||
|
|
echo "WARN: $prog copying /usr/local/etc/firewall.conf.block"
|
||
|
|
cp -p /usr/local/etc/firewall.conf.block /etc/firewall.conf.block
|
||
|
|
else
|
||
|
|
echo "ERROR: $prog missing /usr/local/etc/firewall.conf.block"
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_host_add_block
|
||
|
|
proxy_whonix_host_add_block () {
|
||
|
|
local elt tab ip
|
||
|
|
|
||
|
|
# PROXY_WLAN=$( proxy_get_if )
|
||
|
|
# [ $? -ne 0 -o -z "$PROXY_WLAN" ] && echo ERROR: $prog null interface && return 1
|
||
|
|
if [ "$#" -eq 0 ] ; then
|
||
|
|
proxy_whonix_host_prepare_blocks \| return 1$?
|
||
|
|
set - $( cat /etc/firewall.conf.block )
|
||
|
|
fi
|
||
|
|
# DEBUG "$prog adding $*"
|
||
|
|
[ -f /etc/firewall.conf.newer ] || \
|
||
|
|
cp -p /etc/firewall.conf /etc/firewall.conf.newer
|
||
|
|
for elt in wlan virbr1 ; do
|
||
|
|
[ $elt = wlan ] && tab=INPUT || tab=LIBVIRT_FWI
|
||
|
|
grep -q "^# blocks $elt" /etc/firewall.conf.newer || {
|
||
|
|
echo ERROR: maker not found "^# blocks $elt" in /etc/firewall.conf.newer
|
||
|
|
return 2
|
||
|
|
}
|
||
|
|
sed -e "/^# blocks $elt/,\$d" /etc/firewall.conf.newer > /etc/firewall.conf.$$
|
||
|
|
echo "# blocks $elt" >> /etc/firewall.conf.$$
|
||
|
|
for ip in $* ; do
|
||
|
|
grep -q $ip /etc/firewall.conf.block || \
|
||
|
|
grep -q $ip /etc/firewall.conf.block.newer || \
|
||
|
|
echo $ip >> /etc/firewall.conf.block.newer
|
||
|
|
grep -q -e "A $tab -s $ip" /etc/firewall.conf.newer && continue
|
||
|
|
echo "-A $tab -s $ip -p tcp -j DROP" >> /etc/firewall.conf.$$
|
||
|
|
DEBUG "$prog -A $tab -s $ip -m tcp -p tcp -j DROP"
|
||
|
|
done
|
||
|
|
sed -e "1,/^# blocks $elt/d" /etc/firewall.conf.newer >> /etc/firewall.conf.$$
|
||
|
|
mv /etc/firewall.conf.$$ /etc/firewall.conf.newer
|
||
|
|
done
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_host_online
|
||
|
|
proxy_whonix_host_online () {
|
||
|
|
[ -n "$PROXY_WLAN" ] || PROXY_WLAN=$( proxy_get_if ) || return 1$?
|
||
|
|
[ -z "$PROXY_WLAN" ] && echo ERROR: empty PROXY_WLAN && return 2
|
||
|
|
if [ -x /etc/init.d/NetworkManager ] ; then
|
||
|
|
/etc/init.d/NetworkManager status || /etc/init.d/NetworkManager start || return 3
|
||
|
|
else
|
||
|
|
proxy_rc_service NetworkManager status >/dev/null \
|
||
|
|
|| proxy_rc_service NetworkManager start || return 3$?
|
||
|
|
fi
|
||
|
|
nm-online -t 0 -x || return 4$?
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_down - call when the network goes down
|
||
|
|
proxy_whonix_down () {
|
||
|
|
# $PREFIX/bin/proxy_ping_test.bash "$MODE" || return 1$?
|
||
|
|
proxy_ping_online && return 0 # dont do anything
|
||
|
|
# nothing to do?
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_up - call when the network comes up
|
||
|
|
proxy_whonix_up () {
|
||
|
|
# $PREFIX/bin/proxy_ping_test.bash "$MODE" || return 1$?
|
||
|
|
proxy_ping_online || return 0 # dont do anything
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
## proxy_whonix_start_wget
|
||
|
|
proxy_whonix_start_wget () {
|
||
|
|
return 0
|
||
|
|
if [ -f /etc/wgetrc ] ; then
|
||
|
|
sp=https://127.0.0.1:3128
|
||
|
|
grep -q ^https_proxy /etc/wgetrc && \
|
||
|
|
sed -e "s@https_proxy.*@https_proxy = $sp@" -i /etc/wgetrc
|
||
|
|
grep -q ^https_proxy /etc/wgetrc && \
|
||
|
|
echo "https_proxy = $sp" >> /etc/wgetrc
|
||
|
|
grep -q ^http_proxy /etc/wgetrc && \
|
||
|
|
sed -e "s@http_proxy.*@http_proxy = $sp@" -i /etc/wgetrc
|
||
|
|
grep -q ^http_proxy /etc/wgetrc || \
|
||
|
|
echo "http_proxy = $sp" >> /etc/wgetrc
|
||
|
|
fi
|
||
|
|
|
||
|
|
sp=http://127.0.0.1:3128
|
||
|
|
for elt in http https ; do
|
||
|
|
grep -q ^$elt_proxy /etc/wgetrc && \
|
||
|
|
sed -e "s@$elt_proxy.*@$elt_proxy = $sp@" -i /etc/wgetrc || \
|
||
|
|
echo "$elt_proxy = $sp" >> /etc/wgetrc
|
||
|
|
done
|
||
|
|
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
proxy_libvirt_clean_iptables () {
|
||
|
|
local i int dir dcp prot port
|
||
|
|
|
||
|
|
for dir in i ; do
|
||
|
|
for int in virbr2 virbr1; do
|
||
|
|
dcp=67
|
||
|
|
[ $dir = i ] || dcp=68
|
||
|
|
for port in 53 $dcp ; do
|
||
|
|
[ $dir = i ] && table=INP || table=OUT
|
||
|
|
for prot in udp tcp; do
|
||
|
|
proxy_iptables_save | grep -q -e "-A LIBVIRT_$table -i $int -p $prot -m $prot --dport $port -j ACCEPT" || continue
|
||
|
|
iptables -D LIBVIRT_$table -$dir $int -p $prot -m $prot --dport $port -j ACCEPT || \
|
||
|
|
echo WARN: $? -D LIBVIRT_$table -$dir $int -p $prot -m $prot --dport $port -j ACCEPT
|
||
|
|
done
|
||
|
|
done
|
||
|
|
done
|
||
|
|
done
|
||
|
|
|
||
|
|
for dir in o ; do
|
||
|
|
for int in virbr2 virbr1; do
|
||
|
|
dcp=68
|
||
|
|
[ $dir = o ] || dcp=67
|
||
|
|
for port in 53 68 ; do
|
||
|
|
table=OUT
|
||
|
|
[ $dir = i ] && table=INP
|
||
|
|
for prot in udp tcp; do
|
||
|
|
proxy_iptables_save | grep -q -e "-A LIBVIRT_$table -i $int -p $prot -m $prot --dport $port -j ACCEPT" || continue
|
||
|
|
iptables -D LIBVIRT_$table -$dir $int -p $prot -m $prot --dport $port -j ACCEPT || \
|
||
|
|
echo WARN: $? -D LIBVIRT_$table -$dir $int -p $prot -m $prot --dport $port -j ACCEPT
|
||
|
|
done
|
||
|
|
done
|
||
|
|
done
|
||
|
|
done
|
||
|
|
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
base=proxy_whonix_lib
|
||
|
|
if [ -x /usr/bin/basename ] && [ $( /usr/bin/basename -- $0 .bash ) = $base ] ; then
|
||
|
|
[ "$#" -eq 0 ] && exit 0
|
||
|
|
[ "$#" -eq 1 ] && [ "$1" = '-h' -o "$1" = '--help' ] && \
|
||
|
|
echo USAGE: $0 && grep '^[a-z].*()\|^## ' $0 | sed -e 's/().*//'|sort && \
|
||
|
|
exit 0
|
||
|
|
DEBUG $base "$@"
|
||
|
|
eval "$@"
|
||
|
|
exit $?
|
||
|
|
fi
|