1501 lines
43 KiB
Bash
Executable File
1501 lines
43 KiB
Bash
Executable File
#!/bin/bash
|
|
# -*- mode: sh; tab-width: 8; coding: utf-8-unix -*-
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$prog" ] && prog=proxy_ping_lib
|
|
. /usr/local/bin/usr_local_tput.bash || exit 2
|
|
PREFIX=/usr/local
|
|
ROLE=proxy
|
|
base=proxy_ping_lib
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$USER" ] && USER=$(id -un )
|
|
# /sbin/ifconfig on Debian morons and /bin/ifconfig on Gentoo
|
|
BASE_SRC_ANSIBLE=/g/TestForge/src/ansible
|
|
PROXY_GPG_KEYSERVER=keys.openpgp.org
|
|
|
|
PROXY_IFCONFIG=/sbin/ifconfig
|
|
[ -x /sbin/ifconfig ] && PROXY_IFCONFIG=/sbin/ifconfig
|
|
[ -x /bin/ifconfig ] && PROXY_IFCONFIG=/bin/ifconfig
|
|
proxy_ifconfig () {
|
|
if [ $# -gt 0 ] && [[ $1 =~ .*DBUG:.* ]] ; then
|
|
dbug PANIC: $PROXY_IFCONFIG $*
|
|
exit 1
|
|
elif [ $# -gt 0 ] && [[ $1 =~ .*:.* ]] ; then
|
|
dbug WARN: proxy_ifconfig $PROXY_IFCONFIG $*
|
|
set -- $( echo $* |sed -e 's/:.*//' )
|
|
elif [ $# -eq 0 ] || [[ $1 =~ .*-a.* ]] ; then
|
|
:
|
|
elif [ $1 = wlan4 -o $1 = wlan6 -o $1 = wlan7 ] || [[ $1 =~ wlan[0-9] ]] ; then
|
|
:
|
|
else
|
|
dbug proxy_ifconfig $PROXY_IFCONFIG $*
|
|
# fixme - required
|
|
set -- $( echo $1 |sed -e 's/:.*//' )
|
|
fi
|
|
$PROXY_IFCONFIG $*
|
|
}
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_HTTP_PROXY_PORT" ] || PROXY_HTTP_PROXY_PORT=3128
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_HTTP_PROXY_HOST" ] || PROXY_HTTP_PROXY_HOST="127.0.0.1"
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PRIV_BIN_OWNER" ] && PRIV_BIN_OWNER=bin
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PRIV_BIN_GID" ] && PRIV_BIN_GID=$( grep ^$PRIV_BIN_OWNER /etc/passwd|cut -d: -f 4 )
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PRIV_TOR_OWNER" ] && [ -d /etc/portage ] && PRIV_TOR_OWNER=tor
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PRIV_TOR_OWNER" ] && [ -d /etc/apt ] && PRIV_TOR_OWNER=debian-tor
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PRIV_TOR_GID" ] && PRIV_TOR_GID=$( grep ^$PRIV_TOR_OWNER /etc/passwd|cut -d: -f 4 )
|
|
|
|
set -o pipefail || { ERROR bash is required ; exit 1 ; }
|
|
|
|
declare -a PROXY_WLAN_FILES
|
|
PROXY_WLAN_FILES=(
|
|
/etc/conf.d/hostapd
|
|
/etc/conf.d/net
|
|
/etc/connman/main.conf
|
|
/etc/default/macchanger
|
|
/etc/dnsmasq.conf
|
|
/etc/firewall.conf
|
|
/etc/pdnsd/pdnsd.conf
|
|
/etc/wicd/manager-settings.conf
|
|
/usr/local/etc/testforge/testforge.bash
|
|
/usr/local/etc/testforge/testforge.ini
|
|
/usr/local/etc/testforge/testforge.yml
|
|
/etc/snort/snort.debian.conf
|
|
)
|
|
|
|
|
|
# [ "$USER" != root ] && export PATH=/sbin:$PATH
|
|
export PATH=/bin:$PATH
|
|
|
|
grep -q 'Debian\|Devuan' /etc/os-release
|
|
DEBIAN=$?
|
|
|
|
DNS_HOST1="208.67.220.220"
|
|
DNS_HOST2="8.8.8.8"
|
|
HTTP_TARGET=172.217.169.14
|
|
CURL_ARGS="--connect-timeout 15 -s -S"
|
|
|
|
TRIES=10
|
|
DELAY=10
|
|
|
|
export PATH=$PATH:$PREFIX/sbin
|
|
|
|
declare -a PROXY_WHONIX_FILES
|
|
PROXY_WHONIX_FILES=(
|
|
$HOME/.gitconfig
|
|
/etc/dirmngr/dirmngr.conf
|
|
/etc/dnsmasq.conf
|
|
/etc/firewall.conf
|
|
/etc/freshclam.conf
|
|
/etc/gnupg/gpgconf.conf
|
|
/etc/java-11-openjdk/net.properties
|
|
/etc/polipo/config
|
|
/etc/privoxy/config
|
|
/etc/resolv.conf
|
|
/etc/tor/torsocks.conf
|
|
/var/local/etc/testforge/firefox/proxy.js
|
|
)
|
|
|
|
. /usr/local/etc/local.d/local.bash || { ERROR /usr/local/etc/local.d/local.bash ; exit 2 ; }
|
|
## proxy_rc_service
|
|
proxy_rc_service () { DBUG proxy_rc_service MODE=$MODE $* ;
|
|
local svc=$1
|
|
if [ -x /etc/init.d/$svc ] ; then
|
|
shift
|
|
/etc/init.d/$svc "$@"
|
|
else
|
|
local_rc_service $*
|
|
fi
|
|
return $?
|
|
}
|
|
proxy_rc_update () { local_rc_update MODE=$MODE $* ; }
|
|
|
|
## proxy_ping_online - true/0 iff ifconfig and nm-online
|
|
proxy_ping_online () { proxy_whonix_get_gateway_dom_bad ; }
|
|
|
|
GATEW_DOM=
|
|
## proxy_whonix_get_gateway_dom_bad
|
|
proxy_whonix_get_gateway_dom_bad () {
|
|
local host
|
|
# shellcheck disable=SC2154
|
|
[ -n "$GATEW_DOM" ] && echo -n "$GATEW_DOM" && return 0
|
|
|
|
if [ -e /usr/local/bin/testforge_get_inventory.bash ] ; then
|
|
host=$(/usr/local/bin/testforge_get_inventory.bash BOX_WHONIX_PROXY_HOST) || return 1
|
|
[ -n "$host" ] && GATEW_DOM=$host
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$GATEW_DOM" ] && GATEW_DOM=Whonix-Gateway
|
|
return 0
|
|
}
|
|
|
|
proxy_test_dirmngr () { DBUG proxy_test_dirmngr MODE=$MODE $* ;
|
|
[ $# -eq 0 ] && set -- \
|
|
hkp://$PROXY_GPG_KEYSERVER \
|
|
hkp://gpg.mit.edu hkp://keys.gnupg.net
|
|
# shellcheck disable=SC2154
|
|
[ -z "$ELOG" ] && ELOG=/tmp/proxy_test_dirmngr$$.err
|
|
# shellcheck disable=SC2154
|
|
[ -z "$WLOG" ] && WLOG=/tmp/proxy_test_dirmngr$$.log
|
|
|
|
[ -h /usr/bin/dirmngr ] || {
|
|
ERROR /usr/bin/dirmngr not a symlink
|
|
return 2
|
|
}
|
|
grep ^hkp-cacert /etc/dirmngr/dirmngr.conf | while read a b; do
|
|
[ -f $b ] || WARN file not found $b
|
|
done
|
|
/usr/bin/dirmngr --version </dev/null || {
|
|
ERROR /usr/bin/dirmngr not working --version
|
|
return 3
|
|
}
|
|
# grep ^OK
|
|
DBUG /usr/bin/dirmngr working --version
|
|
|
|
/etc/init.d/privoxy status || /etc/init.d/privoxy start
|
|
/etc/init.d/privoxy status || {
|
|
WARN /etc/init.d/privoxy not running $PROXY_HTTP_PROXY_PORT
|
|
}
|
|
# /usr/local/bin/proxy_ping_test.bash 3128
|
|
netstat -nlpe4 | grep -q :$PROXY_HTTP_PROXY_PORT || {
|
|
ERROR /etc/init.d/privoxy not working $PROXY_HTTP_PROXY_PORT
|
|
return 4
|
|
}
|
|
DBUG /etc/init.d/privoxy working $PROXY_HTTP_PROXY_PORT
|
|
route | grep -q ^default || return 0
|
|
|
|
gpg-connect-agent --dirmngr 'loadswdb --force' /bye </dev/null >/tmp/GpgL$$.tmp 2>&1
|
|
retval=$?
|
|
[ $retval -ne 0 ] && \
|
|
ERROR gpg-connect-agent 'loadswdb --force' /tmp/GpgL$$.tmp && \
|
|
cat /tmp/GpgL$$.tmp && \
|
|
return 5$retval
|
|
! grep -q OK /tmp/GpgL$$.tmp && \
|
|
ERROR gpg-connect-agent 'loadswdb --force' not OK `cat /tmp/GpgL$$.tmp` && \
|
|
rm -f /tmp/GpgL$$.tmp && \
|
|
return 6$retval
|
|
DBUG gpg-connect-agent OK `cat /tmp/GpgL$$.tmp`
|
|
rm -f /tmp/GpgL$$.tmp
|
|
|
|
gpg-connect-agent </dev/null --dirmngr 'keyserver' /bye >/tmp/GpgG$$.tmp 2>&1
|
|
retval=$?
|
|
[ $retval -ne 0 ] && \
|
|
ERROR gpg-connect-agent 'keyserver' `cat /tmp/GpgG$$.tmp` && \
|
|
rm -f /tmp/GpgG$$.tmp && \
|
|
return 7$retval
|
|
grep -q ^S /tmp/GpgG$$.tmp || { \
|
|
ERROR gpg-connect-agent 'keyserver' no S `cat /tmp/GpgG$$.tmp` && \
|
|
rm -f /tmp/GpgG$$.tmp && \
|
|
return 8$retval
|
|
}
|
|
DBUG gpg-connect-agent 'keyserver' S `cat /tmp/GpgG$$.tmp`
|
|
|
|
if [ -d /root/.emacs.d/elpa/gnupg ] && \
|
|
ps ax | grep -q -e '--homedir /root/.emacs.d/elpa/gnupg' ; then
|
|
|
|
for elt in "$@" ; do
|
|
echo keyserver --resolve $elt /bye > /tmp/GpgR$$.tmp
|
|
gpg-connect-agent </dev/null --dirmngr --homedir /root/.emacs.d/elpa/gnupg \
|
|
-r /tmp/GpgR$$.tmp >/tmp/GpgC$$.tmp 2>&1
|
|
retval=$?
|
|
[ $retval -ne 0 ] && \
|
|
ERROR gpg-connect-agent $elt `cat /tmp/GpgC$$.tmp` | tee -a $ELOG && \
|
|
rm -f /tmp/GpgC$$.tmp && \
|
|
return 9$retval
|
|
grep -q 'ERR\|failed:' /tmp/GpgC$$.tmp && \
|
|
ERROR gpg-connect-agent $elt `tail -1 $ELOG` && \
|
|
rm -f /tmp/GpgC$$.tmp && \
|
|
return 10
|
|
INFO gpg-connect-agent $elt
|
|
done
|
|
rm -f /tmp/GpgC$$.tmp
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_get_gateway_dom
|
|
proxy_whonix_get_gateway_dom () {
|
|
# shellcheck disable=SC2154
|
|
[ -n "$GATEW_DOM" ] && echo -n "$GATEW_DOM" && return 0
|
|
proxy_testforge_get_gateway_dom "$@" && return 0
|
|
GATEW_DOM=Whonix-Gateway
|
|
echo -n "$GATEW_DOM"
|
|
return 0
|
|
}
|
|
|
|
## proxy_testforge_get_gateway_dom
|
|
proxy_testforge_get_gateway_dom () {
|
|
local host
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -n "$GATEW_DOM" ] && echo -n "$GATEW_DOM" && return 0
|
|
|
|
[ -f /usr/local/etc/testforge/testforge.bash ] && . /usr/local/etc/testforge/testforge.bash
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -n "$BASE_SRC_ANSIBLE" ] && \
|
|
[ -d $BASE_SRC_ANSIBLE ] &&
|
|
[ -x /usr/local/bin/testforge_get_inventory.bash ] ; then
|
|
host=$(/usr/local/bin/testforge_get_inventory.bash BOX_WHONIX_PROXY_HOST) || return 1
|
|
[ $? -eq 0 -a -n "$host" ] && GATEW_DOM=$host
|
|
fi
|
|
echo -n "$GATEW_DOM"
|
|
return 0
|
|
}
|
|
|
|
#move later
|
|
## proxy_whonix_mode
|
|
proxy_whonix_mode () { #
|
|
proxy_ping_mode
|
|
return $?
|
|
}
|
|
|
|
## proxy_ping_mode
|
|
proxy_ping_mode () { #
|
|
# shellcheck disable=SC2154
|
|
[ -n "$MODE" ] && echo "$MODE" && return 0
|
|
|
|
proxy_ifconfig -a > /tmp/ipconfig-a.$$
|
|
if grep -q /dev/vda /proc/cmdline ; then
|
|
MODE=vda
|
|
elif ps ax | grep -v grep | grep -q 'tor -f /var/lib/tor/.SelekTOR/3xx' ; then
|
|
# must come before ws gw
|
|
MODE=selektor
|
|
elif cat /tmp/ipconfig-a.$$ | grep -A 1 eth1| grep -q 10.152.152.11 ; then
|
|
MODE=ws
|
|
elif cat /tmp/ipconfig-a.$$ | grep -A 1 eth0| grep -q 10.0.2.15 ; then
|
|
MODE=gateway
|
|
elif cat /tmp/ipconfig-a.$$ | grep -A 1 eth0| grep -q 10.0.2. ; then
|
|
MODE=nat
|
|
elif [ -d /var/log/tor ] && proxy_rc_service tor status >/dev/null 2>/dev/null ; then
|
|
# a runing tor takes precedence over whonix
|
|
MODE=tor
|
|
elif [ -f $PREFIX/bin/testforge_get_inventory.bash ] ; then
|
|
mode=$( $PREFIX/bin/testforge_get_inventory.bash BOX_PROXY_MODE )
|
|
if [ -n "$mode" ] ; then
|
|
MODE=$mode
|
|
else
|
|
host=$( $PREFIX/bin/testforge_get_inventory.bash BOX_WHONIX_PROXY_HOST )
|
|
[ -n "$host" ] && MODE=whonix
|
|
fi
|
|
fi
|
|
|
|
rm -f /tmp/ipconfig-a.$$
|
|
echo -n $MODE
|
|
|
|
return 0
|
|
}
|
|
|
|
proxy_wlan_modules_reload () {
|
|
local wlan7
|
|
wlan7=$1
|
|
# may be empty
|
|
proxy_wlan_modules_unload $wlan7 || return 1$?
|
|
proxy_wlan_modules_load $wlan7 || return 2$?
|
|
return 0
|
|
}
|
|
|
|
base_wlan_modules_load () { proxy_wlan_modules_load ; }
|
|
## proxy_wlan_modules_load
|
|
proxy_wlan_modules_load () { DBUG proxy_wlan_modules_load MODE=$MODE $* ;
|
|
local wlan7
|
|
wlan7=$1
|
|
|
|
proxy_ping_check_root || return 0
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$wlan7" ] ; then
|
|
wlan7=$PROXY_WLAN
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$wlan7" ] ; then
|
|
WARN proxy_wlan_modules_load empty wlan7 PROXY_WLAN
|
|
return 3
|
|
else
|
|
# failsafe
|
|
wlan7=$( echo $wlan7 | grep '^eth\|^wlan' |sed -e 's/[: ].*//' )
|
|
fi
|
|
if [ $wlan7 = wlan7 ] ; then
|
|
modprobe iwlmvm
|
|
elif [ $wlan7 = wlan6 ] ; then
|
|
modprobe iwlmvm
|
|
elif [ $wlan7 = wlan4 ] ; then
|
|
# this is right but sometimes does not pull in the rest
|
|
# modprobe ath ath9k_hw ath9k_common ath9k_htc
|
|
modprobe ath9k_htc
|
|
else
|
|
# no default
|
|
return 3
|
|
fi
|
|
|
|
sleep 5
|
|
proxy_ifconfig $wlan7 >/dev/null || { return 8 ; }
|
|
proxy_ifconfig $wlan7 | grep -qi up && \
|
|
proxy_ifconfig $wlan7 down >/dev/null
|
|
|
|
t=`python2 -c "from random import Random;print ':'.join(['%02x' % Random().randint(0,255) for i in range(6)])"`
|
|
# macchanger $wlan7 -m $t
|
|
macchanger $wlan7 -A >/dev/null || return 1
|
|
old=""
|
|
macchanger -s $wlan7 | while read a b ; do
|
|
[ "$old" = "" ] && old=$b && continue ;
|
|
[ "$old" != "$b" ] && dbug "$old $b" && break
|
|
ERROR "$old = $b"
|
|
return 2
|
|
done
|
|
|
|
return 0
|
|
}
|
|
|
|
proxy_base_wlan_modules_unload () { proxy_wlan_modules_unload ; }
|
|
base_wlan_modules_unload () { proxy_wlan_modules_unload ; }
|
|
## base_wlan_modules_unload
|
|
proxy_wlan_modules_unload () { DBUG proxy_wlan_modules_unload ;
|
|
local wlan7
|
|
wlan7=$1
|
|
proxy_ping_check_root || return 0
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$wlan7" ] ; then
|
|
[ $# -eq 0 ] && return 1 || wlan7=$1
|
|
fi
|
|
if [ "$wlan7" = eth2 ] ; then
|
|
PROXY_WLAN=$( proxy_set_if ) || return 1$?
|
|
wlan7=$PROXY_WLAN
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$wlan7" ] && return 2
|
|
|
|
macchanger=macchanger
|
|
|
|
pkill /sbin/dhclient
|
|
|
|
proxy_ifconfig $wlan7 down >/dev/null || true
|
|
proxy_ifconfig $wlan7 | grep -qi "up" && proxy_ifconfig $wlan7 down >/dev/null
|
|
|
|
a=`ps ax | grep -v grep | grep dnscrypt-proxy`
|
|
if [ $? -eq 0 ] ; then
|
|
b=`sed -e 's/^ *//' -e 's/ .*$//' <<< $a`
|
|
# shellcheck disable=SC2154
|
|
[ -z "$b" ] || kill $b
|
|
fi
|
|
|
|
rm -f /var/lib/NetworkManager/*lease
|
|
|
|
if [ "$wlan7" = wlan7 ] ; then
|
|
rmmod iwlmvm iwlwifi # 2>/dev/null
|
|
elif [ "$wlan7" = wlan4 ] ; then
|
|
rmmod iwlmvm iwlwifi # 2>/dev/null
|
|
else
|
|
rmmod ath9k_htc ath9k_common ath9k_hw ath 2>/dev/null
|
|
fi
|
|
sleep 5
|
|
return 0
|
|
}
|
|
|
|
## proxy_get_if
|
|
proxy_get_wlan_ip () {
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] ; then
|
|
PROXY_WLAN=$( proxy_set_if )
|
|
[ $? -eq 0 -a -n "$PROXY_WLAN" ] || { return 1$? ; }
|
|
fi
|
|
# fixme - required
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep '^eth\|^wlan' |sed -e 's/:.*//' )
|
|
|
|
PROXY_WLAN_IP=$( proxy_ifconfig $PROXY_WLAN | grep -v '127.0.0.1\|grep' | grep 'inet.*broadcast' | sed -e 's/.*inet //' -e 's/ .*//' ) || return 2$?
|
|
|
|
# REQUIRED!
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep '^eth\|^wlan\|^en' |sed -e 's/:.*//' )
|
|
# may be empty
|
|
echo -n $PROXY_WLAN_IP
|
|
return 0
|
|
}
|
|
|
|
proxy_get_wlan_if () { proxy_get_if ; }
|
|
## proxy_get_if
|
|
proxy_get_if () { #
|
|
local wlan7
|
|
wlan7=$( proxy_set_if )
|
|
# shellcheck disable=SC2154
|
|
[ $? -ne 0 -o -z "$wlan7" ] && \
|
|
DEBUG=1 dbug proxy_get_if empty wlan7 && return 1
|
|
|
|
proxy_ifconfig $wlan7 >/dev/null || \
|
|
proxy_wlan_modules_load $wlan7
|
|
|
|
proxy_ifconfig $wlan7 >/dev/null || \
|
|
{ DEBUG=1 dbug proxy_get_if errored proxy_ifconfig $wlan7 ; return 1 ; }
|
|
|
|
# fixme - required
|
|
PROXY_WLAN=$( echo $wlan7 | grep '^eth\|^wlan' |sed -e 's/:.*//' )
|
|
|
|
echo -n $PROXY_WLAN
|
|
return 0
|
|
}
|
|
|
|
## proxy_route_check
|
|
proxy_route_check () { DBUG proxy_route_check MODE=$MODE $* ;
|
|
# PATH=$PATH:/sbin ip
|
|
route|grep -q ^def || {
|
|
retval=$?
|
|
WARN $prog proxy_route_check retval=$retval
|
|
return 2$retval
|
|
}
|
|
return 0
|
|
}
|
|
|
|
## proxy_route_test
|
|
proxy_route_test () { DBUG proxy_route_test MODE=$MODE $* ;
|
|
PATH=$PATH:/sbin ip route | grep -q ^def || {
|
|
WARN no route
|
|
exit 0
|
|
}
|
|
proxy_route_check||return $?
|
|
return 0
|
|
}
|
|
|
|
## proxy_set_if
|
|
proxy_set_if () { #
|
|
# stdout
|
|
# shellcheck disable=SC2154
|
|
[ -n "$MODE" ] || MODE="$( proxy_ping_mode )"
|
|
proxy_ifconfig -a > /tmp/ipconfig-a.$$
|
|
|
|
if [ "$MODE" = workstation -o "$MODE" = ws -o "$MODE" = vda ] ; then
|
|
PROXY_WLAN=eth0
|
|
|
|
elif [ "$MODE" = nat ] || [ "$MODE" = gateway ] ; then
|
|
PROXY_WLAN=eth0
|
|
|
|
# elif [ "$MODE" = whonix -o "$MODE" = tor -o "$MODE" = host -o "$MODE" = selektor -o "$MODE" = client ] ; then
|
|
else
|
|
if ip route | grep -q ^defa ; then
|
|
PROXY_WLAN=$( ip route | grep ^defa|sed -e 's/.*dev //' -e 's/ .*//' )
|
|
fi
|
|
if [ -z "$PROXY_WLAN" ] ; then
|
|
PROXY_WLAN=`ifconfig|grep -B 1 inet.*broadcast|grep ^wlan|sed -e 's/ .*//'`
|
|
fi
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] && [ -d "$BASE_SRC_ANSIBLE" ] ; then
|
|
# do we really want this in inventory or live?
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$BOX_DEFAULT_OUTPUT_IF" ] ; then
|
|
BOX_DEFAULT_OUTPUT_IF=$( /usr/local/bin/testforge_get_inventory.bash BOX_DEFAULT_OUTPUT_IF )
|
|
# shellcheck disable=SC2154
|
|
[ $? -ne 0 -o -z "$BOX_DEFAULT_OUTPUT_IF" ] && return 1
|
|
#? recurse
|
|
fi
|
|
PROXY_WLAN="$BOX_DEFAULT_OUTPUT_IF"
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] && cat /tmp/ipconfig-a.$$ | grep -q '^wlan\|^eth' ; then
|
|
# there may be not a route yet
|
|
# there may be 2!!!
|
|
PROXY_WLAN=$( cat /tmp/ipconfig-a.$$ | grep '^eth\|^wlan' |head -1 |sed -e 's/:.*//' )
|
|
fi
|
|
fi
|
|
rm -f /tmp/ipconfig-a.$$
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN" ] && return 2
|
|
# fixme - required
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep '^eth\|^wlan' |sed -e 's/:.*//' )
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN" ] && return 3
|
|
|
|
echo -n $PROXY_WLAN
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_get_https
|
|
proxy_ping_get_https () {
|
|
# shellcheck disable=SC2154
|
|
if [ -n "$https_proxy" ] ; then
|
|
HTTPS_HOST=$( echo $https_proxy|sed -e 's@.*//@@' -e 's@:[0-9]*@@' )
|
|
HTTPS_PORT=$( echo $https_proxy|sed -e 's@.*//[^:]*:@@' )
|
|
# DBUG $prog $https_proxy HTTPS_PORT=$HTTPS_PORT HTTPS_HOST=$HTTPS_HOST
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTPS_HOST" ] && [ "$MODE" = whonix ] && HTTPS_HOST=10.0.2.15
|
|
if [ -z "$HTTPS_HOST" ] && [ "$MODE" = nat ] ; then
|
|
[ -z "$external"] && \
|
|
external=`grep external$ /etc/hosts|sed -e 's/ .*//'`
|
|
HTTPS_HOST=$external
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTPS_HOST" ] && HTTPS_HOST=127.0.0.1
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTPS_PORT" ] && HTTPS_PORT=9128
|
|
fi
|
|
echo -n "$HTTPS_HOST:$HTTPS_PORT"
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_get_http
|
|
proxy_ping_get_http () {
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -n "$http_proxy" ] ; then
|
|
HTTP_HOST=$( echo $http_proxy | sed -e 's@.*//@@' -e 's@:[0-9]*@@' )
|
|
HTTP_PORT=$( echo $http_proxy | sed -e 's@.*//[^:]*:@@' )
|
|
# DBUG $prog $http_proxy HTTP_PORT=$HTTP_PORT HTTP_HOST=$HTTP_HOST
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTP_HOST" -a "$MODE" = whonix ] && HTTP_HOST=127.0.0.1
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTP_HOST" -a "$MODE" = tor ] && HTTP_HOST=127.0.0.1
|
|
if [ -z "$HTTP_HOST" ] && [ "$MODE" = nat ] ; then
|
|
[ -z "$external"] && \
|
|
external=`grep external$ /etc/hosts|sed -e 's/ .*//'`
|
|
HTTP_HOST=$external
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$HTTP_PORT" ] && HTTP_PORT=3128
|
|
fi
|
|
echo -n "$HTTP_HOST:$HTTP_PORT"
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_get_socks_host
|
|
proxy_ping_get_socks_host () {
|
|
# shellcheck disable=SC2154
|
|
if [ -n "$socks_proxy" ] ; then
|
|
SOCKS_HOST=$( echo $socks_proxy|sed -e 's@.*//@@' -e 's/.*@//' -e 's@:[0-9]*@@' )
|
|
# DBUG $prog $socks_proxy SOCKS_PORT=$SOCKS_PORT SOCKS_HOST=$SOCKS_HOST
|
|
fi
|
|
echo -n $SOCKS_HOST:9050
|
|
}
|
|
|
|
## proxy_ping_get_socks_port
|
|
proxy_ping_get_socks_port () {
|
|
# shellcheck disable=SC2154
|
|
if [ -n "$socks_proxy" ] ; then
|
|
SOCKS_PORT=$( echo $socks_proxy|sed -e 's@.*//[^:]*:@@' )
|
|
# DBUG $prog $socks_proxy SOCKS_PORT=$SOCKS_PORT SOCKS_HOST=$SOCKS_HOST
|
|
fi
|
|
# echo -n $SOCKS_PORT
|
|
}
|
|
|
|
## proxy_ping_get_socks
|
|
proxy_ping_get_socks () {
|
|
# let socks_proxy override
|
|
proxy_ping_get_socks_host
|
|
proxy_ping_get_socks_port
|
|
# shellcheck disable=SC2154
|
|
[ -z "$SOCKS_HOST" ] || return 0
|
|
if [ "$MODE" = whonix ] ; then
|
|
SOCKS_HOST=10.0.2.15 && SOCKS_PORT=9050
|
|
elif [ "$MODE" = gateway ] ; then
|
|
SOCKS_HOST=10.0.2.15 && SOCKS_PORT=9050
|
|
elif [ "$MODE" = nat ] ; then
|
|
SOCKS_HOST=10.0.2.2 && SOCKS_PORT=9050
|
|
elif [ "$MODE" = tor ] || [ "$MODE" = selektor ]; then
|
|
SOCKS_HOST=127.0.0.1 && SOCKS_PORT=9050
|
|
elif [ "$MODE" = vda ] ; then
|
|
SOCKS_HOST=10.152.152.10 && SOCKS_PORT=9050
|
|
elif [ "$MODE" = nat ] ; then
|
|
[ -z "$external"] && \
|
|
external=`grep external$ /etc/hosts|sed -e 's/ .*//'`
|
|
SOCKS_HOST=$external && SOCKS_PORT=9050
|
|
fi
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -z "$SOCKS_DNS" ] && SOCKS_DNS=9053
|
|
echo -n $SOCKS_HOST:$SOCKS_PORT
|
|
return 0
|
|
}
|
|
|
|
# proxy_ping_chattr
|
|
proxy_ping_chattr () { DBUG proxy_ping_chattr MODE=$MODE $* ;
|
|
local elt
|
|
|
|
[ -f /etc/sysctl.d/70_testforge_ping.conf ] || \
|
|
{ echo 'net.ipv4.ping_group_range=0 1000' > /etc/sysctl.d/70_testforge_ping.conf ; \
|
|
sysctl net.ipv4.ping_group_range="0 1000" >/dev/null ; }
|
|
|
|
# setcap not supported on ext2?
|
|
mount | grep -q ' / .*type ext2' && return 0
|
|
|
|
# https://github.com/DietPi/issues/1012
|
|
for elt in ping traceroute ; do
|
|
EXE=$(which $elt) || continue
|
|
# shellcheck disable=SC2154
|
|
[ -z "$EXE" ] && continue
|
|
[ -h $EXE ] && EXE=$(readlink $EXE)
|
|
[ -h $EXE ] && continue
|
|
getcap $EXE | grep -q 'cap_net_admin' && continue
|
|
setcap 'cap_net_admin,cap_net_raw+ep' $(which $elt)
|
|
done
|
|
return 0
|
|
}
|
|
|
|
proxy_tor_update_wlan_ip () { DBUG proxy_tor_update_wlan_ip MODE=$MODE $* ;
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN_IP" ] ; then
|
|
PROXY_WLAN_IP=`proxy_get_wlan_ip`
|
|
[ $? -ne 0 ] && return 1
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN_IP" ] && return 2
|
|
[ -f /etc/tor/torrc-defaults ] || return 0
|
|
sed -e "s@^SocksPolicy accept 10.16.*@SocksPolicy accept $PROXY_WLAN_IP@" \
|
|
-i /etc/tor/torrc-defaults
|
|
return 0
|
|
}
|
|
|
|
## proxy_tor_set_socks_accept
|
|
proxy_tor_set_socks_accept () { DBUG proxy_tor_set_socks_accept MODE=$MODE $* ;
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN" ] && PROXY_WLAN=`proxy_ping_get_wlan`
|
|
retval=$?
|
|
[ $retval -eq 0 -a -n "$PROXY_WLAN" ] || {
|
|
ERROR proxy_tor_set_socks_accept empty wlan retval=$retval
|
|
return 2
|
|
}
|
|
wlan7=$PROXY_WLAN
|
|
if [ -n "$wlan7" ] ; then
|
|
ip=`proxy_get_wlan_ip`
|
|
anet="${ip:0:3}"
|
|
for file in /etc/tor/torrc-defaults /etc/tor/torrc ; do
|
|
[ -f $file ] || continue
|
|
DBUG $file
|
|
if grep -q "^SocksPolicy accept $anet" $file ; then
|
|
sed -e "s@^SocksPolicy accept ${anet}.*@SocksPolicy accept $ip@" \
|
|
-i $file
|
|
INFO updated $anet $file
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_get_ip_gw
|
|
proxy_ping_get_ip_gw () { proxy_ping_get_wlan_gw ; }
|
|
|
|
## proxy_ping_get_wlan_gw
|
|
proxy_ping_get_wlan_gw () {
|
|
|
|
PROXY_WLAN=`proxy_ping_get_wlan`
|
|
retval=$?
|
|
[ $retval -eq 0 -a -n "$PROXY_WLAN" ] || {
|
|
ERROR proxy_ping_get_wlan_gw empty wlan retval=$retval
|
|
return 2
|
|
}
|
|
|
|
# can be up without having an address
|
|
a=$( proxy_ifconfig $PROXY_WLAN | grep 'inet.*broadcast' )
|
|
[ $? -ne 0 -o -z "$a" ] && return 2
|
|
|
|
IP=$( echo $a | sed -e 's/.*inet //' -e 's/ .*//' )
|
|
# | grep -v '127.0.0.1\|grep'
|
|
[ -z "$IP" ] && return 2
|
|
PROXY_WLAN_GW=$( echo -n $IP | sed -e 's/[0-9]*$//' )1
|
|
echo -n $PROXY_WLAN_GW
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_get_wlan
|
|
proxy_ping_get_wlan () {
|
|
local retval
|
|
PROXY_WLAN=$( proxy_get_if )
|
|
retval=$?
|
|
[ $retval -eq 0 -a -n "$PROXY_WLAN" ] || {
|
|
ERROR proxy_get_if empty wlan7 retval=$retval
|
|
return 2$retval
|
|
}
|
|
# REQUIRED!
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep '^eth\|^wlan' |sed -e 's/:.*//' )
|
|
echo -n $PROXY_WLAN
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_test_env
|
|
proxy_ping_test_env () { DBUG proxy_ping_test_env MODE=$MODE $* ;
|
|
# shellcheck disable=SC2154
|
|
[ -n "$https_proxy" ] && return 0
|
|
# shellcheck disable=SC2154
|
|
[ -n "$socks_proxy" ] && return 0
|
|
# shellcheck disable=SC2154
|
|
[ -n "$http_proxy" ] && return 0
|
|
return 1
|
|
}
|
|
|
|
## proxy_whonix_get_conn
|
|
proxy_whonix_get_conn () {
|
|
# shellcheck disable=SC2154
|
|
[ -n "$CONN" ] && echo -n $CONN && return 0
|
|
[ -f /etc/rc.local ] && return 0
|
|
for elt in Gateway Host Vda Workstation ; do
|
|
if grep -q Whonix-$elt.rc /etc/rc.local && \
|
|
[ -f /usr/local/etc/local.d/Whonix-$elt.rc ] ; then
|
|
CONN=$elt
|
|
break
|
|
fi
|
|
done
|
|
|
|
[ "$CONN" = Vda -o "$CONN" = Gateway -o "$CONN" = Workstation ] && CHORG=guest
|
|
[ -e /dev/virtio-ports/org.qemu.guest_agent.0 ] || CHORG=guest
|
|
[ -z "$CONN" -a "$CONN" = "Host" ] && CHORG=host
|
|
# giggle host in host?
|
|
#? [ -e /run/libvirt/libvirt-sock ] && CHORG=host
|
|
|
|
echo -n $CONN
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_curl_privoxy
|
|
proxy_ping_curl_privoxy () { DBUG proxy_ping_curl_privoxy MODE=$MODE $* ;
|
|
curl $CURL_ARGS --insecure \
|
|
--proxy http://"$PROXY_HTTP_PROXY_HOST":$PROXY_HTTP_PROXY_PORT \
|
|
--proxy-insecure https://$HTTP_TARGET
|
|
}
|
|
|
|
## proxy_ping_curl_polipo
|
|
proxy_ping_curl_polipo () { DBUG proxy_ping_curl_polipo MODE=$MODE $* ;
|
|
curl $CURL_ARGS --insecure --proxy http://"$PROXY_HTTP_PROXY_HOST":$PROXY_HTTP_PROXY_PORT --proxy-insecure https://$HTTP_TARGET
|
|
}
|
|
|
|
## proxy_ping_curl_bin
|
|
proxy_ping_curl_bin () { DBUG proxy_ping_curl_bin MODE=$MODE $* ;
|
|
su -c "curl $CURL_ARGS --insecure --noproxy '*' https://$HTTP_TARGET" -s /bin/sh $PRIV_BIN_OWNER
|
|
}
|
|
|
|
## proxy_nmap_guid_$PRIV_BIN_OWNER
|
|
proxy_nmap_guid_bin () { DBUG proxy_nmap_guid_bin MODE=$MODE $* ;
|
|
# must be suid bin
|
|
if [ -z "$( find /usr/bin/nmap -perm 2755 )" ] ; then
|
|
chgrp $PRIV_BIN_OWNER /usr/bin/nmap
|
|
chmod 2755 /usr/bin/nmap
|
|
fi
|
|
}
|
|
|
|
## proxy_ping_nmap_direct
|
|
proxy_ping_nmap_direct () { DBUG proxy_ping_nmap_direct MODE=$MODE $* ;
|
|
local i
|
|
local target
|
|
proxy_nmap_guid_bin
|
|
[ "$#" -eq 1 ] && target=$1 || target="$DNS_HOST1"
|
|
shift
|
|
[ "$#" -eq 1 ] && p=$1 || p="U:53"
|
|
|
|
i=0
|
|
while [ $i -lt $TRIES ] ; do
|
|
#su -s /bin/bash -c 'ping -c 1 8.8.8.8' $PRIV_BIN_OWNER && break
|
|
nmap -Pn -sU -p $p $target && break
|
|
sleep $DELAY
|
|
i=$( expr $i + 1 )
|
|
done
|
|
[ $i -ge $TRIES ] && echo "ERROR: proxy_ping_nmap_direct nmap -Pn -sU -p U:53 $target failed" && return 5
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_copy_dir_file
|
|
proxy_whonix_copy_dir_file () { DBUG proxy_whonix_copy_dir_file PROXY_WLAN=$PROXY_WLAN MODE=$MODE $* ;
|
|
[ "$#" -le 1 ] && { ERROR proxy_whonix_copy_dir_file from empty: MODE=$MODE $* ; return 1 ; }
|
|
[ "$#" -eq 2 ] || { ERROR to empty ; return 2 ; }
|
|
local file=$1
|
|
local to=$2
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] ; then
|
|
PROXY_WLAN=$( proxy_get_if )
|
|
[ $? -ne 0 -o -z "$PROXY_WLAN" ] && ERROR empty PROXY_WLAN && return 2
|
|
fi
|
|
# fixme - required
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep '^eth\|^wlan' |sed -e 's/:.*//' )
|
|
|
|
[ -f $to ] || return 0
|
|
[ -f $file ] || return 0
|
|
diff -q $to $file && return 0
|
|
proxy_ping_check_root || return 0
|
|
if ! diff -q $to $file && false ; then
|
|
INFO proxy_whonix_copy_files cp -p $to $file
|
|
cp -p $to $file || { ERROR copying $file.dire ; }
|
|
fi
|
|
grep -q wlan $file || \
|
|
sed -e "s@wlan[0-9]@$PROXY_WLAN@" \
|
|
-i $file
|
|
# -e "s@eth[0-9]@$PROXY_WLAN@"
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_copy_files
|
|
proxy_whonix_copy_files () { DBUG proxy_whonix_copy_files PROXY_WLAN=$PROXY_WLAN MODE=$MODE $* ;
|
|
local dire
|
|
[ "$#" -eq 1 ] || { ERROR dire empty ; return 1 ; }
|
|
dire=$1
|
|
proxy_ping_check_root || { WARN must be root to copy files && return 0 ; }
|
|
|
|
# DBUG proxy_whonix_copy_files $dire ${PROXY_WHONIX_FILES[*]}
|
|
|
|
for file in "${PROXY_WHONIX_FILES[@]}" ; do
|
|
proxy_whonix_copy_dir_file $file.$dire $file
|
|
done
|
|
|
|
if [ -d /etc/apt/apt.conf.f ] ; then
|
|
for file in /etc/apt/*.conf.$dire ; do
|
|
to=`sed -e "s/.$dire//" <<< $file`
|
|
proxy_whonix_copy_dir_file $file $to
|
|
done
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_firewall_check
|
|
proxy_ping_firewall_check () { DBUG proxy_ping_firewall_check PROXY_WLAN=$PROXY_WLAN MODE=$MODE $* ;
|
|
if [ "$MODE" = workstation -o "$MODE" = ws -o "$MODE" = vda ] ; then
|
|
:
|
|
elif [ "$MODE" = nat -o "$MODE" = gateway -o "$MODE" = host ] ; then
|
|
:
|
|
elif [ "$MODE" = tor -o "$MODE" = selektor ] ; then
|
|
[ -s /etc/firewall.conf ] || {
|
|
ERROR "proxy_ping_firewall_check /etc/firewall.conf empty "
|
|
return 1
|
|
}
|
|
grep -q -i reject /etc/firewall.conf || {
|
|
ERROR "proxy_ping_firewall_check no reject in /etc/firewall.conf"
|
|
return 2
|
|
}
|
|
grep -q -e "--gid-owner $PRIV_BIN_GID .* ACCEPT" /etc/firewall.conf || {
|
|
WARN "proxy_ping_firewall_check no bin --gid-owner $PRIV_BIN_GID in /etc/firewall.conf"
|
|
# return 3
|
|
}
|
|
grep -q -e "--gid-owner $PRIV_TOR_GID .* ACCEPT" /etc/firewall.conf || {
|
|
WARN "proxy_ping_firewall_check no tor --gid-owner $PRIV_TOR_GID in /etc/firewall.conf"
|
|
# return 4
|
|
}
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_wlan_config
|
|
proxy_ping_wlan_config () { DBUG proxy_ping_wlan_config MODE=$MODE $* ;
|
|
local file gid
|
|
|
|
# shellcheck disable=SC2154
|
|
[ -n "$PROXY_WLAN" ] || PROXY_WLAN=$( proxy_get_if ) || {
|
|
ERROR proxy_whonix_wlan_config null interface && return 1
|
|
}
|
|
for file in "${PROXY_WLAN_FILES[@]}" ; do
|
|
[ -f "$file" ] || continue
|
|
sed -e "s@wlan[0-9]@$PROXY_WLAN@" -i $file
|
|
done
|
|
if ! grep -q -e "-m owner --gid-owner $PRIV_BIN_GID -j ACCEPT" /etc/firewall.conf ; then
|
|
sed -e "s@-m owner --gid-owner [1-9] -j ACCEPT@-m owner --gid-owner $PRIV_BIN_GID -j ACCEPT@" -i /etc/firewall.conf
|
|
fi
|
|
|
|
grep -q -e "-m owner --gid-owner $PRIV_BIN_GID -j ACCEPT" /etc/firewall.conf || {
|
|
return 2
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_firewall_sysctl_ipv6
|
|
proxy_ping_firewall_sysctl_ipv6 () {
|
|
if [ ! -e /proc/net/if_inet6 ] ; then
|
|
sed -i -e 's/^net.ipv6.conf/#net.ipv6.conf/' /etc/sysctl.d/70_testforge_harden_lynis.conf
|
|
else
|
|
sed -i -e 's/^#net.ipv6.conf/net.ipv6.conf/' /etc/sysctl.d/70_testforge_harden_lynis.conf
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_iptables_rename
|
|
proxy_iptables_rename () { DBUG proxy_iptables_rename MODE=$MODE $* ;
|
|
local wd=$PWD
|
|
cd /usr/sbin/
|
|
for file in iptables* ; do
|
|
base=$( basename $file .bin )
|
|
[ $base = $file ] || continue
|
|
[ -e $file.bin ] || mv $file $file.bin
|
|
[ ! -e $file.bash ] && \
|
|
echo "#!/bin/sh" > $file.bash && \
|
|
echo "exec $file.bin \"\$@\"" >> $file.bash && \
|
|
chmod 755 $file.bash
|
|
done
|
|
return 0
|
|
}
|
|
|
|
IPT_LEGACY="iptables-legacy"
|
|
## proxy_iptables
|
|
proxy_iptables () { DBUG proxy_iptables MODE=$MODE $* ;
|
|
if [ "$IPT_LEGACY" = "" ] ;then
|
|
# DEBIAN -eq 0
|
|
which iptables-legacy 2>/dev/null >/dev/null && \
|
|
IPT_LEGACY=iptables-legacy || IPT_LEGACY=iptables
|
|
fi
|
|
$IPT_LEGACY $*
|
|
return $?
|
|
}
|
|
|
|
IPT_SAVE_LEGACY="iptables-legacy-save"
|
|
## proxy_iptables_save
|
|
proxy_iptables_save () { DBUG proxy_iptables_save MODE=$MODE $* ;
|
|
if [ "$IPT_SAVE_LEGACY" = "" ] ; then
|
|
# DEBIAN -eq 0
|
|
which iptables-legacy-save 2>/dev/null >/dev/null && \
|
|
IPT_SAVE_LEGACY=iptables-legacy-save || IPT_SAVE_LEGACY=iptables-save
|
|
fi
|
|
$IPT_SAVE_LEGACY $*
|
|
return $?
|
|
}
|
|
|
|
IPT_RESTORE_LEGACY="iptables-legacy-restore"
|
|
## proxy_iptables_restore
|
|
proxy_iptables_restore () { DBUG proxy_iptables_restore MODE=$MODE $* ;
|
|
local retval
|
|
proxy_iptables -F -t filter ;proxy_iptables -F -t nat ; proxy_iptables -F -t mangle;
|
|
|
|
if [ "$IPT_RESTORE_LEGACY" = "" ] ; then
|
|
which iptables-legacy-restore 2>/dev/null >/dev/null && \
|
|
IPT_RESTORE_LEGACY=iptables-legacy-restore || \
|
|
IPT_RESTORE_LEGACY=iptables-restore
|
|
fi
|
|
$IPT_RESTORE_LEGACY $*
|
|
retval=$?
|
|
if [ $retval -eq 0 ] ; then
|
|
DBUG proxy_iptables_restored $*
|
|
else
|
|
ERROR proxy_iptables_restore retval=$retval $*
|
|
fi
|
|
# /usr/local/bin/proxy_firewall_restore_iptable.bash
|
|
|
|
return $?
|
|
}
|
|
|
|
## proxy_ping_firewall_modules
|
|
proxy_ping_firewall_modules () { DBUG proxy_ping_firewall_modules MODE=$MODE $* ;
|
|
local elt kern
|
|
|
|
proxy_ping_check_root || return 0
|
|
if [ $MODE = nat ] ; then
|
|
lsmod|grep -q virtio_console || \
|
|
modprobe virtio_console
|
|
return $?
|
|
fi
|
|
|
|
# /etc/modules-load.d/vda*.conf
|
|
for file in /etc/modules-load.d/firewall.conf ; do
|
|
grep -v '#\|floppy' $file | xargs modprobe --all
|
|
done
|
|
|
|
kern=$( uname -r )
|
|
if [ -d "/lib/modules/$kern" ] ; then
|
|
# bpfilter
|
|
for elt in xt_MASQUERADE nf_nat_ipv4 ; do
|
|
if grep -q -i $elt "/lib/modules/$kern"/*der ; then
|
|
lsmod | grep -qi $elt || modprobe $elt || return 5$?
|
|
# else # 5.0.8 kernel
|
|
# WARN $elt not in "/lib/modules/$kern"/*der # 2>&1|tee $WLOG
|
|
fi
|
|
done
|
|
fi
|
|
|
|
lsmod | grep -q nf_conntrack || modprobe nf_conntrack
|
|
lsmod | grep -q nft_masq || modprobe nft_masq
|
|
lsmod | grep -q bridge|| modprobe bridge
|
|
return 0
|
|
}
|
|
|
|
proxy_ping_check_root () {
|
|
[ $USER = root ] || {
|
|
# WARN proxy_ping_check_root - not root
|
|
return 2
|
|
}
|
|
return 0
|
|
}
|
|
## proxy_ping_firewall_start
|
|
proxy_ping_firewall_start () { DBUG proxy_ping_firewall_start PROXY_WLAN=$PROXY_WLAN MODE=$MODE $* ;
|
|
[ -n "$MODE" ] || MODE="$( proxy_ping_mode )"
|
|
[ $MODE = direct -o $MODE = nat ] && {
|
|
WARN no proxy_ping_firewall_start MODE=$MODE
|
|
return 0
|
|
}
|
|
proxy_ping_check_root || { WARN must be root to copy files && return 0 ; }
|
|
proxy_ping_firewall_modules
|
|
proxy_ping_firewall_check || {
|
|
ret=$?
|
|
ERROR failed proxy_ping_firewall_start ret=$ret
|
|
return 1$ret
|
|
}
|
|
[ $MODE = tor -o $MODE = selektor -o $MODE = ws ] || {
|
|
ERROR failed proxy_ping_firewall_check MODE=$MODE
|
|
return 1$ret
|
|
}
|
|
proxy_ping_check_root || return 0
|
|
proxy_iptables_save 2>&1 | grep -iq reject && return 0
|
|
proxy_ping_firewall_restart || return 3$?
|
|
return 0
|
|
}
|
|
|
|
proxy_ping_firewall_set () { proxy_ping_firewall_restart ; }
|
|
## proxy_ping_firewall_restart
|
|
proxy_ping_firewall_restart () { DBUG proxy_ping_firewall_restart MODE=$MODE $* ;
|
|
local gid
|
|
proxy_ping_check_root || return 2
|
|
# shellcheck disable=SC2154
|
|
[ -n "$MODE" ] || MODE="$( proxy_ping_mode )"
|
|
|
|
proxy_ping_check_root || { WARN must be root to copy files && return 0 ; }
|
|
proxy_ping_firewall_modules
|
|
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] ; then
|
|
PROXY_WLAN=$( proxy_get_if )
|
|
retval=$?
|
|
[ $retval -eq 0 -a -n "$PROXY_WLAN" ] || {
|
|
ERROR proxy_ping_get_wlan empty wlan retval=$retval
|
|
return 1
|
|
}
|
|
fi
|
|
proxy_ping_wlan_config
|
|
|
|
proxy_iptables_restore /etc/firewall.conf || {
|
|
ERROR $prog proxy_iptables_restore failed
|
|
[ -x /usr/local/bin/proxy_wall.bash ] && \
|
|
/usr/local/bin/proxy_wall.bash ERROR: $prog proxy_iptables_restore failed
|
|
return 3
|
|
}
|
|
|
|
proxy_whonix_copy_files "$MODE" || {
|
|
ERROR "proxy_ping_firewall_restart failed proxy_whonix_copy_files"
|
|
return 4
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsmasq_config
|
|
proxy_ping_dnsmasq_config () { DBUG proxy_ping_dnsmasq_config MODE=$MODE $* ;
|
|
# fixme: NEEDS dire
|
|
local dire
|
|
local retval=0
|
|
|
|
if [ "$#" -gt 0 ] ; then
|
|
dire=$1
|
|
DEBUG=1 dbug proxy_ping_dnsmasq_config "$@"
|
|
else
|
|
WARN proxy_ping_dnsmasq_config no args - defaulting $MODE
|
|
dire=$MODE
|
|
fi
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN" ] && PROXY_WLAN=`proxy_get_if` && retval=$?
|
|
[ $retval -ne 0 -o -z "$PROXY_WLAN" ] && {
|
|
ERROR proxy_ping_dnsmasq_config null PROXY_WLAN=$PROXY_WLAN
|
|
return 3
|
|
}
|
|
|
|
[ -e /etc/dnsmasq.conf ] || {
|
|
ERROR proxy_ping_dnsmasq_config not /etc/dnsmasq.conf ; return 2 ;
|
|
}
|
|
if [ ! -f /etc/dnsmasq.conf.$dire ] ; then
|
|
cp -p /etc/dnsmasq.conf /etc/dnsmasq.conf.$dire
|
|
fi
|
|
|
|
sed -e "s/wlan[0-9]/$PROXY_WLAN/" -e "s/eth[0-9]/$PROXY_WLAN/" \
|
|
-i /etc/dnsmasq.conf
|
|
INFO proxy_ping_dnsmasq_config setting PROXY_WLAN=$PROXY_WLAN
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_gw_check
|
|
proxy_ping_gw_check () { DBUG proxy_ping_gw_check MODE=$MODE $* ;
|
|
PROXY_WLAN_GW=`proxy_ping_get_ip_gw`
|
|
# shellcheck disable=SC2154
|
|
[ -z "$ELOG" ] && ELOG=/tmp/proxy_test_gw$$.err
|
|
# shellcheck disable=SC2154
|
|
[ -z "$WLOG" ] && WLOG=/tmp/proxy_test_gw$$.log
|
|
if [ $? -eq 0 -a -n "$PROXY_WLAN_GW" ] ; then
|
|
a=`traceroute -m 10 $PROXY_WLAN_GW | wc -l`
|
|
[ $? -eq 0 -a -n "$a" -a "$a" -gt 4 ] && \
|
|
echo ERROR: traceroute $PROXY_WLAN_GW >> $ELOG && \
|
|
traceroute -m 10 $PROXY_WLAN_GW >> $ELOG && \
|
|
nmap -A -T4 $PROXY_WLAN_GW |tee -a $WLOG | grep -A 1 HOP | grep -v ^1
|
|
# /usr/local/bin/base_wall.bash $prog CRIT: traceroute $PROXY_WLAN_GW '>10'
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsd_check
|
|
proxy_ping_dnsd_check () { DBUG proxy_ping_dnsd_check MODE=$MODE $* ;
|
|
# fixme: decide which
|
|
proxy_ping_dnsmasq_check $*
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsmasq_status
|
|
proxy_ping_dnsmasq_status () { DBUG proxy_ping_dnsmasq_status MODE=$MODE $* ;
|
|
proxy_rc_service dnsmasq status >/dev/null || return 2$?
|
|
[ -s /var/log/dnsmasq.log ] || {
|
|
WARN proxy_ping_dnsmasq_status no file /var/log/dnsmasq.log
|
|
return 3
|
|
}
|
|
tail /var/log/dnsmasq.log | grep 'using nameserver ' || \
|
|
WARN proxy_ping_dnsmasq_status no using in /var/log/dnsmasq.log
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsmasq_start
|
|
proxy_ping_dnsmasq_start () { DBUG proxy_ping_dnsmasq_start MODE=$MODE $* ;
|
|
local ret
|
|
# fixme: need dire
|
|
[ "$#" -eq 0 ] && set -- $MODE
|
|
|
|
proxy_ping_dnsmasq_config $* || {
|
|
ret=$?
|
|
WARN proxy_ping_dnsmasq_start dnsmasq not configing $ret
|
|
return 1$ret
|
|
}
|
|
proxy_ping_dnsmasq_status && return 0
|
|
cp /dev/null /var/log/dnsmasq.log
|
|
proxy_rc_service dnsmasq start || {
|
|
WARN proxy_ping_dnsmasq_start dnsmasq not starting
|
|
tail /var/log/dnsmasq.log
|
|
return 3$?
|
|
}
|
|
sleep $DELAY
|
|
netstat -nlp4e | grep :53 || {
|
|
WARN proxy_ping_dnsmasq_start dnsmasq not running
|
|
tail /var/log/dnsmasq.log
|
|
return 4
|
|
}
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsmasq_stop
|
|
proxy_ping_dnsmasq_stop () { DBUG proxy_ping_dnsmasq_stop MODE=$MODE $* ;
|
|
proxy_ping_dnsmasq_status || return 0
|
|
proxy_rc_service dnsmasq stop >/dev/null || return 2$?
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_pdnsd_check
|
|
proxy_ping_pdnsd_check () { DBUG proxy_ping_pdnsd_check MODE=$MODE $* ;
|
|
ps ax | grep -v grep | grep -q pdnsd && return 0
|
|
[ -e /etc/pdnsd/pdnsd.conf ] || return 0
|
|
proxy_rc_service pdnsd start || return 1$?
|
|
sleep $DELAY
|
|
tail /var/log/pdnsd.log | grep -q 'All threads started successfully' || return 4
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_dnsmasq_check
|
|
proxy_ping_dnsmasq_check () { DBUG proxy_ping_dnsmasq_check MODE=$MODE $* ;
|
|
ps ax | grep -v grep | grep -q dnsmasq && return 0
|
|
[ -e /etc/dnsmasq.conf ] && return 0
|
|
proxy_rc_service dnsmasq start || return 1$?
|
|
sleep $DELAY
|
|
tail /var/log/dnsmasq.log | grep -q 'started, ' || return 4
|
|
return 0
|
|
}
|
|
|
|
## proxy_dest_port_wlan_config
|
|
proxy_dest_port_wlan_config () { DBUG proxy_dest_port_wlan_config MODE=$MODE $* ;
|
|
# shellcheck disable=SC2154
|
|
[ -z "$DEST" -a "$#" -gt 0 ] && DEST=$1 && shift
|
|
# shellcheck disable=SC2154
|
|
[ -z "$DEST" ] && DEST=127.0.0.1
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PORT" -a "$#" -gt 0 ] && PORT=$1 && shift
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PORT" ] && PORT=9053
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PROXY_WLAN" -a "$#" -gt 0 ] && PROXY_WLAN=$1 && shift
|
|
# shellcheck disable=SC2154
|
|
if [ -z "$PROXY_WLAN" ] ; then
|
|
PROXY_WLAN=$( proxy_get_if )
|
|
retval=$?
|
|
[ $retval -eq 0 -a -n "$PROXY_WLAN" ] || {
|
|
ERROR proxy_get_if empty wlan7 retval=$retval
|
|
return 2$retval
|
|
}
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_polipo_config
|
|
proxy_whonix_polipo_config () { DBUG proxy_whonix_polipo_config MODE=$MODE $* ;
|
|
local dire
|
|
local file
|
|
dire=$1 ; shift
|
|
|
|
file=/etc/polipo/config
|
|
if [ $dire = whonix ]; then
|
|
if [ ! -f $file.$dire ] ; then
|
|
cp -p $file $file.$dire
|
|
cat >> $file.conf <<EOF
|
|
proxyAddress=127.0.0.1
|
|
proxyPort=3128
|
|
proxyName=127.0.0.1
|
|
socksParentProxy=10.0.2.15:9050
|
|
socksProxyType=socks5
|
|
#?ssocksUserName=foo
|
|
EOF
|
|
fi
|
|
else
|
|
if [ ! -f $file.$dire ] ; then
|
|
cp -p $file $file.$dire
|
|
cat >> $file.conf <<EOF
|
|
proxyAddress=127.0.0.1
|
|
proxyPort=3128
|
|
proxyName=127.0.0.1
|
|
socksParentProxy=${DEST}:$PORT
|
|
socksProxyType=socks5
|
|
EOF
|
|
fi
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_privoxy_config
|
|
proxy_whonix_privoxy_config () { DBUG proxy_whonix_privoxy_config MODE=$MODE $* ;
|
|
local dire
|
|
local file
|
|
dire=$1 ; shift
|
|
|
|
file=/etc/privoxy/config
|
|
if [ $dire = whonix ]; then
|
|
SOCKS_HOST=10.0.2.15
|
|
SOCKS_PORT=9050
|
|
elif [ $dire = selaktor ]; then
|
|
SOCKS_HOST=127.0.0.1
|
|
SOCKS_PORT=9050
|
|
else
|
|
SOCKS_HOST=127.0.0.1
|
|
SOCKS_PORT=9050
|
|
fi
|
|
if [ ! -f $file.$dire ] ; then
|
|
cp -p $file $file.$dire
|
|
cat >> $file.conf <<EOF
|
|
listen-address 127.0.0.1:3128
|
|
forward-socks5t / $SOCKS_HOST:$SOCKS_PORT .
|
|
EOF
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_whonix_dnsmasq_config
|
|
proxy_whonix_dnsmasq_config () { DBUG proxy_whonix_dnsmasq_config MODE=$MODE $* ;
|
|
local dire
|
|
|
|
[ "$#" -eq 0 ] && set -- tor
|
|
dire=$1 ; shift
|
|
proxy_dest_port_wlan_config $*
|
|
# shellcheck disable=SC2154
|
|
[ -z "$PORT" -o -z "$DEST" ] && return 1
|
|
|
|
# 9040 - no wgetrc
|
|
# need dnsmasq to 127
|
|
file=/etc/dnsmasq.conf
|
|
if [ ! -f $file.$dire ] ; then
|
|
cp -p $file $file.$dire
|
|
cat >> $file.$dire <<EOF
|
|
log-facility=/var/log/dnsmasq.log
|
|
no-resolv
|
|
listen-address=127.0.0.1
|
|
server=${DEST}#$PORT
|
|
port=53
|
|
# wlan4
|
|
interface=$PROXY_WLAN
|
|
bind-interfaces
|
|
no-dhcp-interface=$PROXY_WLAN
|
|
EOF
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# unused
|
|
## proxy_testssl_lib_update
|
|
proxy_testssl_lib_update () { DBUG proxy_testssl_lib_update MODE=$MODE $* ;
|
|
[ ! -s /usr/local/bin/proxy_testssl_lib.bash -o \
|
|
/usr/bin/testssl.sh -nt /usr/local/bin/proxy_testssl_lib.bash ] && \
|
|
sed -e '/^##* main ##/,$d' /usr/bin/testssl.sh > /usr/local/bin/proxy_testssl_lib.bash
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_wait_for_tor
|
|
proxy_ping_wait_for_tor () { DBUG proxy_ping_wait_for_tor MODE=$MODE $* ;
|
|
local i
|
|
|
|
i=0
|
|
while [ $i -lt $TRIES ] ; do
|
|
sleep $DELAY
|
|
tail -20 /var/log/tor/notice.log | grep 100% && break
|
|
i=$( expr $i + 1 )
|
|
done
|
|
[ $i -ge $TRIES ] && echo "ERROR: proxy_ping_wait_for_tor tor failed" && return 3
|
|
return 0
|
|
}
|
|
|
|
|
|
## proxy_ping_dig_test
|
|
proxy_ping_dig_test () { DBUG proxy_ping_dig_test MODE=$MODE $* ;
|
|
proxy_ping_wait_for_dig $*
|
|
return $?
|
|
}
|
|
|
|
## proxy_ping_wait_for_dig
|
|
proxy_ping_wait_for_dig () { DBUG proxy_ping_wait_for_dig MODE=$MODE $* ;
|
|
local i
|
|
|
|
i=0
|
|
while [ $i -lt $TRIES ] ; do
|
|
su -s /bin/bash -c 'dig google.com' $PRIV_BIN_OWNER 2>&1 | grep -v grep | grep -A 1 ANSWER && break
|
|
sleep $DELAY
|
|
i=$( expr $i + 1 )
|
|
done
|
|
[ $i -ge $TRIES ] && echo "ERROR: proxy_ping_wait_for_dig dig failed" && return 2
|
|
}
|
|
|
|
## proxy_ping_set_resolv
|
|
proxy_ping_set_resolv () { DBUG proxy_ping_set_resolv MODE=$MODE $* ;
|
|
local dire
|
|
[ "$#" -gt 0 ] && dire=$1 || dire=$MODE
|
|
|
|
proxy_ping_test_resolv $dire
|
|
ret=$?
|
|
[ $ret -eq 0 ] && return 0
|
|
[ $ret -eq 1 ] && return 1
|
|
proxy_clobber_resolv_local $DEST
|
|
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_test_resolv
|
|
proxy_ping_test_resolv () { DBUG proxy_ping_test_resolv MODE=$MODE $* ;
|
|
local dire
|
|
[ "$#" -gt 0 ] && dire=$1 || dire=$MODE
|
|
[ -z "$dire" ] && return 1
|
|
# fixme - has polipo?
|
|
#? proxy_whonix_polipo_config $dire
|
|
if [ $dire = whonix ] ; then
|
|
# PROXY_DNS_IP="10.0.2.15#9053"
|
|
PROXY_DNS_IP=127.0.0.1
|
|
elif [ $dire = gateway ] ; then
|
|
PROXY_DNS_IP=10.0.2.15
|
|
elif [ $dire = nat ] ; then
|
|
PROXY_DNS_IP=10.0.2.2
|
|
elif [ $dire = vda -o $dire = ws -o $dire = workstation ] ; then
|
|
PROXY_DNS_IP=10.152.152.10
|
|
elif [ $dire = tor -o $dire = selektor -o $dire = host ] ; then
|
|
PROXY_DNS_IP=127.0.0.1
|
|
else
|
|
WARN proxy_ping_test_resolv unexpected dire=$dire
|
|
PROXY_DNS_IP=127.0.0.1
|
|
#?
|
|
return 1
|
|
fi
|
|
|
|
grep -q $PROXY_DNS_IP /etc/resolv.conf && return 0
|
|
#? grep '^nameserver *[2-9]' /etc/resolv.conf && return 2
|
|
if [ "$USER" = root ] ; then
|
|
[ -f /etc/resolv.conf.$dire ] && \
|
|
sed -e "s@nameserver.*@nameserver $PROXY_DNS_IP@" -i /etc/resolv.conf.$dire \
|
|
|| echo nameserver $PROXY_DNS_IP > /etc/resolv.conf.$dire
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_clobber_resolv_local
|
|
proxy_clobber_resolv_local () { DBUG proxy_clobber_resolv_local MODE=$MODE $* ;
|
|
local ip
|
|
[ "$#" -eq 0 ] && ip=127.0.0.1 || ip=$1
|
|
|
|
# FixMe: /etc/resolv.conf resolvconf
|
|
|
|
grep -q "^nameserver $ip" /etc/resolv.conf && return 0
|
|
proxy_ping_check_root || return 0
|
|
grep -q "^nameserver" /etc/resolv.conf && \
|
|
sed -e "s/^nameserver.*/nameserver $ip/" -i /etc/resolv.conf || \
|
|
echo "nameserver $ip" >> /etc/resolv.conf
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_status
|
|
proxy_ping_status () { DBUG proxy_ping_status MODE=$MODE $* ;
|
|
/usr/local/bin/proxy_libvirt_lib.bash proxy_libvirt_status
|
|
return 0
|
|
}
|
|
|
|
## proxy_virsh
|
|
proxy_virsh () { DBUG proxy_virsh MODE=$MODE $* ;
|
|
timeout --kill-after=10 20 virsh $*
|
|
# timeout=124
|
|
return $?
|
|
}
|
|
|
|
|
|
## proxy_ping_update_cacert
|
|
proxy_ping_update_cacert () {
|
|
# echos filename answer
|
|
local WD=$PWD
|
|
local DIR=/usr/local/etc/ssl
|
|
local URL=https://curl.se/ca/cacert.pem
|
|
local curls='curl.bash'
|
|
local RARGS
|
|
local retval=0
|
|
|
|
[ -d $DIR ] || return 0
|
|
cd $DIR
|
|
if [ -w $DIR ] ; then
|
|
if [ -f cacert-curl.se.pem ] ; then
|
|
$curls -o $DIR/cacert-curl.se.pem -z cacert-curl.se.pem $RARGS $URL \
|
|
>/dev/null
|
|
else
|
|
$curls -o $DIR/cacert-curl.se.pem $RARGS $URL \
|
|
>/dev/null
|
|
fi
|
|
retval=$?
|
|
# [ $? -ne 0 ] && exit $?
|
|
fi
|
|
for file in cacert-curl.se.pem cacert-testforge.pem; do
|
|
if [ -s $DIR/$file ] ; then
|
|
echo -n $DIR/$file
|
|
break
|
|
fi
|
|
done
|
|
cd $WD
|
|
|
|
return $retval
|
|
}
|
|
|
|
starbucks_pdnsd () {
|
|
# shellcheck disable=SC2154
|
|
[ -z "$pdnsd" ] && return 0
|
|
if [ "$pdnsd" = "dnscrypt" ] && \
|
|
! ps ax | grep -v grep | grep -q /dnscrypt-proxy ; then
|
|
cp /dev/null /var/local/var/log/dnscrypt-proxy.log
|
|
$HARDEN_VAR_LOCAL/bin/dnscrypt-proxy --config $HARDEN_VAR_LOCAL/etc/dnscrypt-proxy.toml &
|
|
sleep $DELAY
|
|
[ ! -s /var/local/var/log/dnscrypt-proxy.log ] || \
|
|
! grep -q 'No servers configured' $HARDEN_VAR_LOCAL/var/log/dnscrypt-proxy.log || return 11
|
|
ps ax | grep -v grep | grep -q /dnscrypt-proxy || return 12
|
|
elif [ "$pdnsd" = "pdnsd" ] && ! ps ax | grep -v grep | grep -q /pdnsd ; then
|
|
if [ -x /bin/systemctl ] ; then
|
|
[ -e /etc/pdnsd.conf ] && /bin/systemctl stop pdnsd >/dev/null
|
|
else
|
|
[ -e /etc/pdnsd.conf ] && /etc/init.d/pdnsd stop
|
|
fi
|
|
fi
|
|
}
|
|
|
|
base=proxy_ping_lib
|
|
# DBUG 0=$0
|
|
if [ -x /usr/bin/basename ] && \
|
|
[ $( basename -- "$0" .bash ) = $base \
|
|
-o $( basename -- "$0" .sh ) = $base ] ; then
|
|
[ "$#" -eq 1 ] && [ "$1" = '-h' -o "$1" = '--help' ] && \
|
|
echo USAGE: $0 && grep '^[a-z].*()\|^## ' $0 | sed -e 's/().*//' && exit 0
|
|
"$@"
|
|
exit $?
|
|
fi
|