1141 lines
39 KiB
Bash
Executable File
1141 lines
39 KiB
Bash
Executable File
#!/bin/bash
|
|
# -*- mode: sh; tab-width: 8; coding: utf-8-unix -*-
|
|
|
|
. /usr/local/bin/usr_local_tput.bash || exit 2
|
|
PREFIX=/usr/local
|
|
ROLE=proxy
|
|
PYVER=3
|
|
|
|
# DEBUG=1
|
|
# TRACE=1
|
|
|
|
. /usr/local/bin/proxy_ping_lib.bash || \
|
|
{ ERROR loading /usr/local/bin/proxy_ping_lib.bash ; exit 6; }
|
|
[ -f $PREFIX/etc/testforge/testforge.bash ] && \
|
|
. /usr/local/etc/testforge/testforge.bash >/dev/null || exit 1
|
|
PL=/usr/local/bin/proxy_libvirt_lib.bash
|
|
|
|
declare -a tests
|
|
|
|
which traceroute 2>/dev/null >/dev/null && HAVE_TRACEROUTE=1 || HAVE_TRACEROUTE=0
|
|
which dig 2>/dev/null >/dev/null && HAVE_DIG=1 || HAVE_DIG=0
|
|
which nslookup 2>/dev/null >/dev/null && HAVE_NSLOOKUP=1 || HAVE_NSLOOKUP=0
|
|
which tor-resolve 2>/dev/null >/dev/null && HAVE_TOR_RESOLVE=1 || HAVE_TOR_RESOLVE=0
|
|
|
|
[ -z "$prog" ] || prog=proxy_ping_test
|
|
SOCKS_PAIR=`proxy_ping_get_socks`
|
|
[ -z "$SOCKS_HOST" ] && SOCKS_HOST=`echo $SOCKS_PAIR|sed -e 's/:.*//'`
|
|
[ -z "$SOCKS_PORT" ] && SOCKS_PORT=`echo $SOCKS_PAIR|sed -e 's/.*://'`
|
|
[ -z "$SOCKS_DNS" ] && SOCKS_DNS=9053
|
|
HTTPS_PORT=`echo $HTTPS_PAIR|sed -e 's/.*://'`
|
|
HTTPS_HOST=`echo $HTTPS_PAIR|sed -e 's/:.*//'`
|
|
HTTPS_PAIR=`proxy_ping_get_https`
|
|
[ -z "$HTTPS_HOST" ] && HTTPS_HOST=127.0.0.1
|
|
HTTP_PAIR=`proxy_ping_get_http`
|
|
HTTP_PORT=`echo $HTTP_PAIR|sed -e 's/.*://'`
|
|
HTTP_HOST=`echo $HTTP_PAIR|sed -e 's/:.*//'`
|
|
[ -z "$HTTP_HOST" ] && HTTP_HOST=127.0.0.1
|
|
|
|
P="BASE_PYTHON${PYVER}_MINOR"
|
|
PYTHON_MINOR="$(eval echo \$$P)"
|
|
[ -n "$PYTHON_MINOR" ] || \
|
|
PYTHON_MINOR=$( python$PYVER --version 2>&1| sed -e 's@^.* @@' -e 's@\.[0-9]*$@@' )
|
|
[ -n "$PYTHON_MINOR" ] || exit 4
|
|
|
|
if [ -z "$LIB" -a -d /usr/lib/python$PYTHON_MINOR ] ; then
|
|
LIB=lib
|
|
elif [ -z "$LIB" -a -d /usr/lib64/python$PYTHON_MINOR ] ; then
|
|
LIB=lib64
|
|
elif [ -n "$LIB" -a ! -d /usr/$LIB/python$PYTHON_MINOR ] ; then
|
|
#? ERROR LIB=$LIB but no /usr/$LIB/python$PYTHON_MINOR
|
|
exit 5
|
|
fi
|
|
|
|
THOPS=40
|
|
NEEDED_BINS="ping traceroute nmap dig nslookup tor-resolve"
|
|
NEEDED_SCRIPTS="
|
|
/usr/local/bin/proxy_ping_lib.bash
|
|
/usr/local/bin/proxy_ping_test.bash
|
|
"
|
|
|
|
grep -q Debian /etc/os-release
|
|
DEBIAN=$?
|
|
TIMEOUT=30
|
|
[ -n "$GATEW_DOM" ] || GATEW_DOM="$( proxy_testforge_get_gateway_dom )"
|
|
[ -n "$GATEW_DOM" ] || GATEW_DOM="Whonix-Gateway"
|
|
|
|
DNS_HOST1="208.67.220.220"
|
|
DNS_HOST2="1.1.1.1"
|
|
[ -n "$DNS_TARGET" ] || DNS_TARGET=www.whatismypublicip.com # 108.160.151.39
|
|
[ -n "$HTTP_TARGET" ] || HTTP_TARGET=www.whatismypublicip.com # 108.160.151.39
|
|
HTTP_TARGET=www.whatismypublicip.com
|
|
|
|
# time.nist.gov 132.163.97.3
|
|
NTP_HOST1=132.163.97.3
|
|
# pool.ntp.org 78.46.53.2 205.206.70.7
|
|
NTP_HOST2=78.46.53.2
|
|
# --no-check-certificate
|
|
WGET="wget --tries=1 --max-redirect=0 --timeout=$TIMEOUT -O /dev/null"
|
|
CURL="curl -o /dev/null $CURL_ARGS"
|
|
SCURL="/usr/local/bin/scurl.bash --output /dev/null"
|
|
NSL='nslookup -querytype=A -debug'
|
|
NETS='netstat -nl4e'
|
|
ALL=""
|
|
USAGE="$prog without arguments tests the current MODE=$MODE,
|
|
or with 0 to list the tests by number,
|
|
or one or more of the groups:
|
|
|
|
"
|
|
|
|
[ -z "$USER" ] && USER=$(id -un )
|
|
[ $USER = root -a -n "$TRACE" -a "$TRACE" != '0' ] && DMESG_LINES=1 || DMESG_LINES=0
|
|
|
|
[ -n "$PROXY_WLAN" ] || PROXY_WLAN=`proxy_ping_get_wlan`
|
|
# fixme - required
|
|
PROXY_WLAN=$( echo $PROXY_WLAN | grep ^wlan |sed -e 's/:.*//' )
|
|
|
|
[ -n "$PROXY_WLAN_GW" ] || PROXY_WLAN_GW=`proxy_ping_get_wlan_gw`
|
|
# fixme - required
|
|
PROXY_WLAN_GW=$( echo $PROXY_WLAN_GW | grep ^wlan |sed -e 's/:.*//' )
|
|
MODE=$( proxy_ping_mode )
|
|
|
|
DNS_HOST=$SOCKS_HOST
|
|
[ -z "$PRIV_BIN_OWNER" ] && PRIV_BIN_OWNER=bin
|
|
[ -z "$PRIV_BIN_GID" ] && PRIV_BIN_GID=$( grep ^$PRIV_BIN_OWNER /etc/passwd|cut -d: -f 4 )
|
|
|
|
PROXY_GPG_KEYSERVER=keys.openpgp.org
|
|
declare -a GPG_KEYSERVERS=(
|
|
hkp://$PROXY_GPG_KEYSERVER
|
|
hkp://gpg.mit.edu
|
|
hkp://keys.gnupg.net
|
|
)
|
|
## proxy_test_dirmngr
|
|
proxy_test_dirmngr () {
|
|
[ $# -eq 0 ] && set -- "${GPG_KEYSERVERS[@]}"
|
|
DBUG proxy_test_dirmngr MODE=$MODE $* ;
|
|
# shellcheck disable=SC2154
|
|
[ -z "$ELOG" ] && ELOG=/tmp/proxy_test_dirmngr$$.err
|
|
# shellcheck disable=SC2154
|
|
[ -z "$WLOG" ] && WLOG=/tmp/proxy_test_dirmngr$$.log
|
|
|
|
[ -h /usr/bin/dirmngr ] || {
|
|
WARN /usr/bin/dirmngr not a symlink
|
|
#fixed? return 2
|
|
}
|
|
|
|
grep ^hkp-cacert /etc/dirmngr/dirmngr.conf | while read a b; do
|
|
[ -f $b ] || WARN file not found $b in /etc/dirmngr/dirmngr.conf
|
|
done
|
|
/usr/bin/dirmngr --version </dev/null >/dev/null && \
|
|
INFO /usr/bin/dirmngr working --version || {
|
|
ERROR /usr/bin/dirmngr not working --version
|
|
return 3
|
|
}
|
|
# grep ^OK
|
|
DM=`grep ' keyserver ' /etc/dirmngr/dirmngr.conf | head -1 | sed -e 's/.* //'`
|
|
|
|
grep -q "^wlan[1-9][ ]00000000" /proc/net/route || {
|
|
DBUG not connected
|
|
return 0
|
|
}
|
|
|
|
echo 'loadswdb --force' /bye | \
|
|
gpg-connect-agent --dirmngr \
|
|
>/tmp/GpgL$$.tmp 2>&1
|
|
retval=$?
|
|
[ $retval -ne 0 ] && \
|
|
WARN gpg-connect-agent --dirmngr 'loadswdb --force' /bye /tmp/GpgL$$.tmp && \
|
|
cat /tmp/GpgL$$.tmp && \
|
|
# return 5$retval
|
|
! grep -q OK /tmp/GpgL$$.tmp && \
|
|
WARN gpg-connect-agent --dirmngr 'loadswdb --force' /bye OK not found /tmp/GpgL$$.tmp && \
|
|
# return 6$retval
|
|
|
|
INFO elt=gpg-connect-agent --dirmngr 'loadswdb --force' OK
|
|
rm -f /tmp/GpgL$$.tmp
|
|
|
|
# gpg-connect-agent --dirmngr 'help keyserver' /bye
|
|
echo 'keyserver --resolve' /bye | \
|
|
gpg-connect-agent --dirmngr \
|
|
>/tmp/GpgG$$.tmp 2>&1
|
|
retval=$?
|
|
grep 'ERR\|failed:' /tmp/GpgG$$.tmp >> $ELOG && \
|
|
ERROR gpg-connect-agent $elt `tail -1 $ELOG` && \
|
|
return 10
|
|
grep -q ^S /tmp/GpgG$$.tmp || { \
|
|
WARN gpg-connect-agent 'keyserver' no S /tmp/GpgG$$.tmp && \
|
|
return 8$retval
|
|
}
|
|
INFO elt=gpg-connect-agent 'keyserver --resolve' S
|
|
cat /tmp/GpgG$$.tmp
|
|
rm -f /tmp/GpgG$$.tmp
|
|
|
|
if [ ! -d /root/.emacs.d/elpa/gnupg ] || \
|
|
! ps ax | grep -q -e '--homedir /root/.emacs.d/elpa/gnupg' ; then
|
|
WARN no running /root/.emacs.d/elpa/gnupg agent
|
|
else
|
|
INFO running /root/.emacs.d/elpa/gnupg agent
|
|
echo keyserver --resolve | \
|
|
gpg-connect-agent --dirmngr \
|
|
--homedir /root/.emacs.d/elpa/gnupg \
|
|
>/tmp/GpgC$$.tmp 2>&1
|
|
retval=$?
|
|
if grep 'ERR\|failed:' /tmp/GpgC$$.tmp >> $ELOG ; then
|
|
WARN /root/.emacs.d/elpa/gnupg gpg-connect-agent `tail -1 $ELOG` && \
|
|
cat /tmp/GpgC$$.tmp
|
|
else
|
|
INFO elt=gpg-connect-agent
|
|
cat /tmp/GpgC$$.tmp
|
|
rm -f /tmp/GpgC$$.tmp
|
|
fi
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
## proxy_test_privoxy_test
|
|
proxy_test_privoxy_test () { DBUG proxy_test_privoxy_test $* ;
|
|
return 0
|
|
/etc/init.d/privoxy status || /etc/init.d/privoxy start
|
|
/etc/init.d/privoxy status && \
|
|
DBUG /etc/init.d/privoxy running || {
|
|
WARN /etc/init.d/privoxy not running $PROXY_HTTP_PROXY_PORT
|
|
}
|
|
# /usr/local/bin/proxy_ping_test.bash 3128
|
|
netstat -nlpe4 | grep -q :$PROXY_HTTP_PROXY_PORT || {
|
|
ERROR /etc/init.d/privoxy not working $PROXY_HTTP_PROXY_PORT
|
|
return 4
|
|
}
|
|
INFO elt=/etc/init.d/privoxy working $PROXY_HTTP_PROXY_PORT
|
|
return 0
|
|
}
|
|
|
|
## proxy_test_netstat_dns
|
|
proxy_test_netstat_dns () { DBUG proxy_test_netstat_dns $* ;
|
|
$NETS | grep -q ":53"
|
|
retval=$?
|
|
[ $retval -eq 0 ] && return 0
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" dns not running
|
|
[ -z "$ALL" ] && exit $ARG$retval || return 1
|
|
}
|
|
|
|
## proxy_test_traceroute_icmp_gw
|
|
proxy_test_traceroute_icmp_gw () { DBUG proxy_test_traceroute_icmp_gw $* ;
|
|
[ -n "$PROXY_WLAN_GW" ] || PROXY_WLAN_GW=`proxy_ping_get_wlan_gw` || return 1
|
|
traceroute --icmp $PROXY_WLAN_GW
|
|
retval=$?
|
|
[ $retval -eq 0 ] && return 0
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval traceroute --icmp $PROXY_WLAN_GW
|
|
[ -z "$ALL" ] && exit "$ARG$retval" || return 1
|
|
# works
|
|
GREP="-i icmp"
|
|
return 0
|
|
}
|
|
|
|
## proxy_test_dig_direct
|
|
proxy_test_dig_direct () { DBUG proxy_test_dig_direct $* ;
|
|
|
|
dig @$DNS_HOST1 $NTP_HOST2 +timeout=$TIMEOUT >/dev/null
|
|
retval=$?
|
|
[ $retval -eq 0 ] && return 0
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval dig @$DNS_HOST1
|
|
[ -z "$ALL" ] && exit $ARG$retval || return 1
|
|
|
|
INFO $prog test=$ARG "${tests[$ARG]}" dig @$DNS_HOST1
|
|
# works
|
|
GREP="53"
|
|
return 0
|
|
}
|
|
|
|
## proxy_test_curl_firewall_asbin
|
|
proxy_test_curl_firewall_asbin () { DBUG proxy_test_curl_firewall_asbin $* ;
|
|
su -c "$CURL -k --noproxy '*' https://$HTTP_TARGET" -s /bin/sh $PRIV_BIN_OWNER >/dev/null
|
|
retval=$?
|
|
[ $retval -eq 0 ] && return 0
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval \
|
|
su -c "$CURL -k --noproxy '*' https://$HTTP_TARGET" -s /bin/sh $PRIV_BIN_OWNER
|
|
proxy_iptables_save|tail|grep PTABLES_filter_DROP-o
|
|
[ -z "$ALL" ] && exit $ARG$retval || return $retval
|
|
}
|
|
|
|
## proxy_ping_curl
|
|
proxy_ping_curl () { DBUG proxy_ping_curl $* ;
|
|
local retval
|
|
timeout -k $TIMEOUT $TIMEOUT $CURL "$@"
|
|
retval=$?
|
|
# "DEBUG: wierd failure curl: (35) Encountered end of file"
|
|
[ $retval -eq 0 -o $retval -eq 35 ] && return 0
|
|
return $retval
|
|
}
|
|
|
|
## proxy_ping_make_help
|
|
proxy_ping_make_help () {
|
|
grep 'tests\[[0-9][0-9]*\]=' /usr/local/bin/proxy_ping_test.bash \
|
|
> /tmp/proxy_ping_test-$USER.hlp
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_test_virbr
|
|
proxy_ping_test_virbr () {
|
|
local n=$1
|
|
[ -z "$n" ] && n=1
|
|
[ -z "$CONN" ] || proxy_whonix_get_conn
|
|
[ "$CONN" = guest ] && return 0
|
|
[ -e /proc/sys/net/ipv4/conf/virbr$n ] || return 0
|
|
proxy_ifconfig virbr$n >/dev/null && return 0
|
|
return 0
|
|
}
|
|
|
|
## proxy_ping_broken
|
|
proxy_ping_broken () { DBUG proxy_ping_broken PROXY_WLAN=$PROXY_WLAN $* ;
|
|
# 0 is true
|
|
local a=$MODE
|
|
if [ "$a" = vda -o "$a" = ws ]; then
|
|
# grep 10.152.152.10 /etc/resolv.conf &&
|
|
PING_BROKEN=0
|
|
return 0
|
|
elif [ "$a" = gateway ]; then
|
|
PING_BROKEN=0
|
|
return 0
|
|
elif [ -z "$PROXY_WLAN_GW" ] ; then
|
|
PING_BROKEN=0
|
|
return 0
|
|
fi
|
|
|
|
[ -n "$PING_BROKEN" ] && return $PING_BROKEN
|
|
|
|
DBUG $prog proxy_ping_mode=$a PROXY_WLAN=$PROXY_WLAN PROXY_WLAN_GW=$PROXY_WLAN_GW
|
|
ping -4 -I $PROXY_WLAN -c 1 -W $TIMEOUT $PROXY_WLAN_GW # 10.16.238.1
|
|
if [ $? -ne 0 ] ; then
|
|
PING_BROKEN=0
|
|
else
|
|
PING_BROKEN=1
|
|
fi
|
|
return $PING_BROKEN
|
|
}
|
|
|
|
## proxy_do_ping
|
|
proxy_do_ping () { DBUG proxy_do_ping $* ;
|
|
proxy_route_check || { ERROR $prog route not connected ; return 1$? ; }
|
|
|
|
proxy_ping_broken && return 0
|
|
|
|
[ -n "$PROXY_WLAN" ] || PROXY_WLAN=`proxy_get_if` || {
|
|
ERROR $prog unable to get wlan $? ; return 2 ;
|
|
}
|
|
|
|
ping -4 -I $PROXY_WLAN -c 1 -W $TIMEOUT $DNS_HOST2 >/tmp/P$$.log 2>&1
|
|
retval=$?
|
|
if [ $retval -eq 1 ] ; then
|
|
# false negatives
|
|
sleep 4
|
|
ping -4 -I $PROXY_WLAN -c 1 -W $TIMEOUT $DNS_HOST2 >/tmp/P$$.log 2>&1
|
|
retval=$?
|
|
fi
|
|
[ $retval -lt 1 ] || {
|
|
ERROR $prog do_ping $PROXY_WLAN retval=$retval
|
|
rm /tmp/P$$.log
|
|
PING_BROKEN=0
|
|
return 3$retval
|
|
}
|
|
grep -q ' 0% ' /tmp/P$$.log || \
|
|
{ ERROR $prog retval=$? test=$1 ping retval=$retval ; rm /tmp/P$$.log ; return 4 ; }
|
|
PING=1
|
|
grep 'packet\|bytes from' /tmp/P$$.log
|
|
rm /tmp/P$$.log
|
|
return 0
|
|
}
|
|
|
|
proxy_run_as_root () { DBUG proxy_run_as_root $* ;
|
|
[ $( id -u ) -eq 0 ] && return 0
|
|
ERROR must be root
|
|
[ -z "$ALL" ] && exit 9
|
|
return 1
|
|
}
|
|
|
|
# could pull these out as tests and add them to
|
|
## proxy_test_pretest_exit
|
|
proxy_test_pretest_exit () {
|
|
proxy_route_test || { ERROR $prog route not connected ; exit 1$? ; }
|
|
if [ "$1" = panic -o "$1" = firewall ] ; then
|
|
: dont ping on panic
|
|
proxy_ping_broken || proxy_do_ping || \
|
|
{ WARN ping failed for panic so skipping ; exit 0 ; }
|
|
elif [ "$1" = direct -o "$1" = gateway -o "$1" = vda -o "$1" = kick ] ; then
|
|
proxy_ping_broken || proxy_do_ping || exit 3$?
|
|
proxy_ping_test_resolv $MODE ||\
|
|
{ WARN $prog proxy_ping_test_resolv=$? 'echo nameserver 127.0.0.1 > /etc/resolv.conf' ; exit 4 ; }
|
|
proxy_ping_firewall_start || { ERROR "proxy_ping_firewall_start ret=$?" ; exit 5 ; }
|
|
elif [ "$1" = nat ] ; then
|
|
proxy_route_test || { ERROR $prog route not connected ; exit 1$? ; }
|
|
else
|
|
proxy_do_ping || exit 4$?
|
|
proxy_ping_test_resolv $MODE || \
|
|
{ WARN "$prog proxy_ping_test_resolv=$? /etc/resolv.conf.$dire" MODE=$MODE
|
|
exit 4 ; }
|
|
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
## proxy_test_help_args
|
|
proxy_test_help_args () {
|
|
declare -a elts=()
|
|
declare -a ret=()
|
|
local elt
|
|
if [ "$1" = selektor -o "$1" = torhost ] ; then
|
|
elts=($1 socks dns http https dirmngr tordns firefail)
|
|
elif [ "$1" = torlibvirthost -o "$1" = whonix ] ; then
|
|
elts=(libvirthost socks http https dirmngr tordns firefail)
|
|
elts+=($MODE)
|
|
elif [ "$1" = gateway -o "$1" = nat ] ; then
|
|
elts=($1 libvirtguest socks dns http https dirmngr firefail)
|
|
else
|
|
elts=($1)
|
|
fi
|
|
for elt in "${elts[@]}" ; do
|
|
# DBUG proxy_test_help_args $elt $1 >&2
|
|
ret+=( $(grep " -.* $elt " /tmp/proxy_ping_test-$USER.hlp | \
|
|
sed -e 's/.=.*//' -e 's/.*tests.//') )
|
|
done
|
|
DBUG proxy_test_help_args "${ret[@]}" >&2
|
|
echo "${ret[@]}"
|
|
return 0
|
|
}
|
|
|
|
ALL=0
|
|
## proxy_ping_test_set_args
|
|
proxy_ping_test_set_args () {
|
|
local args="$@"
|
|
local val="$@"
|
|
declare -a aret=()
|
|
rm -f /tmp/proxy_ping_test-$USER.hlp
|
|
[ -f /tmp/proxy_ping_test-$USER.hlp ] || proxy_ping_make_help
|
|
|
|
## to_tor - tor with the firewall host side client setup tor server - gateway
|
|
[ "$1" = to_tor -o "$1" = test_tor -o "$1" = test_to ] &&
|
|
aret=( 6 13 16 ) && \
|
|
! proxy_ping_test_env && WARN to_tor and no proxy in env - use noenv
|
|
|
|
## kick - open firewall with tor running - call dns,polipo +tor in addition
|
|
[ "$1" = kick -o "$1" = host ] &&
|
|
aret=( 24 31 13 16 6 )# 30 24 31 6 13 16
|
|
|
|
# aliases
|
|
# socks defines http as the target of a user using socks
|
|
[ "$1" = "$SOCKS_PORT" ] && set -- socks
|
|
# http defines http as the target of a user using http
|
|
[ "$1" = "$HTTP_PORT" ] && set -- http
|
|
# https defines http as the target of a user using https
|
|
[ "$1" = "$HTTPS_PORT" ] && set -- https
|
|
# dns defines http as the target of a user using dns
|
|
[ "$1" = "53" ] && set -- dns
|
|
# tordns defines http as the target of a user using tordns
|
|
[ "$1" = "9053" ] && set -- tordns
|
|
|
|
# old aliases
|
|
[ "$1" = scan ] && set -- iwlist
|
|
[ "$1" = panic ] && set -- firewall
|
|
[ "$1" = asbin ] && set -- firewall
|
|
|
|
[ "$1" = to_gateway ] && set -- whonix
|
|
[ "$1" = from_tor ] && set -- whonix
|
|
[ "$1" = from_gateway ] && set -- gateway
|
|
[ "$1" = to_tor ] && set -- gateway
|
|
[ "$1" = workstation ] && set -- ws
|
|
|
|
[ "$1" = traceroute ] && set -- = trace
|
|
[ "$1" = connected ] && set -- wifi
|
|
[ "$1" = clear ] && set -- direct
|
|
[ "$1" = tor ] && set -- torhost
|
|
|
|
# scenarios - modes: nat selektor
|
|
# wifi?
|
|
## nat - through the Gateway via the nat
|
|
if [ "$1" = nat ] ; then
|
|
set -- $1 ping dns socks http https dirmngr tordns firefail libvirtguest
|
|
[ -n "$SOCKS_PORT" ] || WARN empty "$SOCKS_PORT"
|
|
## vda - through the Gateway with the firewall - also polipo,panic - uses env
|
|
## ws - through the Gateway with the firewall - it is a vda
|
|
[ -n "$SOCKS_PORT" ] || WARN empty "$SOCKS_PORT"
|
|
elif [ "$1" = vda -o "$1" = ws ] ; then
|
|
# Fixme - guessing
|
|
# was aret=( 35 3 20 )
|
|
set -- ping dns socks http https dirmngr tordns firefail libvirtguest
|
|
## gateway - ssh to the whonix gateway from the torhost
|
|
elif [ "$1" = gateway ] ; then
|
|
## gateway - on the Gateway, trans firewall with tor running -
|
|
#? looks like it had direct in gateway;
|
|
#? aret=( 23 25 4 5 30 24 17 3 21 ) # 31 6 16
|
|
set -- ping dns socks http https dirmngr tordns firefail libvirtguest
|
|
[ -n "$SOCKS_PORT" ] || WARN empty "$SOCKS_PORT"
|
|
## whonix - whonix torhost with libvirt container running gateway behind firewa
|
|
elif [ "$1" = whonix ] ; then
|
|
set -- ping libvirtguest tordns dns socks http https dirmngr torhost tordns firefail gw
|
|
[ -n "$SOCKS_PORT" ] || WARN empty "$SOCKS_PORT"
|
|
## torhost - running tor with the firewall
|
|
[ "$1" = torhost -o "$1" = selektor ] && \
|
|
set -- ping torhost tordns dns trace nmap gw
|
|
[ -n "$SOCKS_PORT" ] || WARN empty "$SOCKS_PORT"
|
|
#? tor with the firewall to test the host side tor server - call to_tor,dns,ntp in addition
|
|
## direct - assume no firewall and no proxy - but may work depend on env
|
|
elif [ "$1" = direct -o "$1" = '' ] ; then
|
|
set -- ping dns trace nmap gw
|
|
|
|
## all - all tests not stopping on the first error
|
|
elif [ "$1" = all ] ; then
|
|
ALL=1
|
|
# aret="${#tests[@]}"
|
|
fi
|
|
|
|
## gw - test if we are connected to the gateway
|
|
## env - from the cmdline with a properly setup env
|
|
## firefail - test the proxy without env vars to expect failure
|
|
## http - assumes torhost or whonix and env setup
|
|
## https - assumes torhost or whonix and env setup
|
|
## socks - assumes torhost or whonix and env setup
|
|
## tordns - test 9053 for dns using tor-resolve
|
|
## dns - dns using tor or the gateway, with the firewall - does not assume env
|
|
## ping - connected routed test the ping to DNS hosts
|
|
## ntp - ntpdate through the firewall
|
|
## nmap - nmap sgid through the firewall - does not assume env
|
|
## iwlist - wlan scan of a wifi host
|
|
## firewall - test that the firewall blocks
|
|
## virbr1 - looks for virbr1 on a libvirt host torhost or whonix
|
|
## trace - traceroute to DNSHOST - icmp is allowed by the firewall, except on vda
|
|
## wifi - test if we are connected - call scan in addition
|
|
## libvirthost - hosting a libvirt container
|
|
## libvirtguest - in a libvirt container
|
|
|
|
for elt in "$@" ; do
|
|
if [ "$elt" = gw -o "$elt" = env -o \
|
|
"$elt" = https -o "$elt" = http -o "$elt" = socks -o "$elt" = dns -o \
|
|
"$elt" = torhost -o "$elt" = 'nat' -o "$elt" = whonix -o "$elt" = selektor -o \
|
|
"$elt" = tordns -o \
|
|
"$elt" = libvirthost -o "$elt" = torlibvirthost -o \
|
|
"$elt" = libvirtguest -o "$elt" = virbr1 -o \
|
|
"$elt" = ping -o "$elt" = trace -o "$elt" = ntp -o "$elt" = nmap -o \
|
|
"$elt" = iwlist -o "$elt" = firefail -o "$elt" = direct -o \
|
|
"$elt" = trace -o "$elt" = wifi -o "$elt" = 'dirmngr' -o "$elt" = 'test' \
|
|
] ; then
|
|
aret+=( `proxy_test_help_args $elt` )
|
|
else
|
|
WARN unrecognized: $elt >&2
|
|
fi
|
|
done
|
|
|
|
DBUG "${aret[@]}" >&2
|
|
echo "${aret[@]}"
|
|
return 0
|
|
}
|
|
|
|
# -I $PROXY_WLAN -c 1 $DNS_HOST2
|
|
if [ "$#" = 0 ] ; then
|
|
# default to mode
|
|
set -- $MODE
|
|
fi
|
|
if [ "$1" = '-h' -o $1 = '--help' ] ; then
|
|
echo USAGE: $USAGE | sed -e 's/[0-9][0-9]*)/\n&/g'
|
|
grep '^## [a-oq-z]' $0 | sed -e 's/^## / /'
|
|
exit 0
|
|
elif [ "$1" = 0 ] ; then
|
|
INFO $prog PROXY_WLAN=$PROXY_WLAN MODE=$MODE
|
|
echo 0 help /tmp/proxy_ping_test-$USER.hlp
|
|
[ -f /tmp/proxy_ping_test-$USER.hlp ] || proxy_ping_make_help
|
|
. /tmp/proxy_ping_test-$USER.hlp
|
|
for elt in "${!tests[@]}" ; do
|
|
echo $elt "${tests[$elt]}"
|
|
done
|
|
exit 0
|
|
elif [[ $1 =~ ^[0-9] ]] ; then
|
|
: passthrough
|
|
elif [ $1 = 'test' -o $1 = '--test' ] ; then
|
|
set -- 99
|
|
else
|
|
set -- `proxy_ping_test_set_args "$@"`
|
|
DBUG running tests numbered "$@"
|
|
fi
|
|
|
|
proxy_test_pretest_exit "$1"
|
|
|
|
# https://stackoverflow.com/questions/8290046/icmp-sockets-linux/20105379#20105379
|
|
if [ $( id -u ) -eq 0 ] ; then
|
|
proxy_ping_chattr
|
|
fi
|
|
|
|
DBUG $prog PROXY_WLAN=$PROXY_WLAN MODE=$MODE $*
|
|
# $( sysctl net.ipv4.ping_group_range )
|
|
|
|
# proxy_iptables_save|grep 216
|
|
|
|
while [ "$#" -gt 0 ] ; do
|
|
# DBUG $prog $1
|
|
ARG=$1 ; shift
|
|
|
|
GREP=""
|
|
if [ -z "$ARG" ] ; then
|
|
continue
|
|
|
|
elif ! [ "$ARG" -ge 0 ] ; then
|
|
ERROR $prog called with an unrecognized argument $ARG from $0
|
|
exit 9
|
|
|
|
elif [ $ARG -le 0 ] ; then
|
|
# do the ping and resov.conf
|
|
true
|
|
|
|
elif [ $ARG -eq 1 ] ; then
|
|
tests[1]="wget_https_as_user wget ${HTTPS_PORT} - https "
|
|
[ -n "$https_proxy" ] && LARGS="" || \
|
|
LARGS="env https_proxy=https://${HTTPS_HOST}:${HTTPS_PORT}"
|
|
$LARGS $WGET https://$HTTP_TARGET 2>/dev/null
|
|
retval=$?
|
|
if [ $retval -eq 8 -o $retval -eq 0 ] ; then
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
else
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval test=$ARG
|
|
[ -z "$ALL" ] && continue
|
|
fi
|
|
# works with fix
|
|
GREP="${HTTPS_PORT}"
|
|
|
|
elif [ $ARG -eq 2 ] ; then
|
|
[ -n "$https_proxy" ] && LARGS="--proxy $https_proxy" || \
|
|
LARGS="--proxy https://${HTTPS_HOST}:${HTTPS_PORT}"
|
|
tests[2]="curl_https_as_user curl $LARGS https://$HTTP_TARGET - https "
|
|
proxy_ping_curl $LARGS https://$HTTP_TARGET >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl $LARGS https://$HTTP_TARGET
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works with fix
|
|
GREP="${HTTPS_PORT}"
|
|
|
|
elif [ $ARG -eq 3 ] ; then
|
|
tests[3]="curl_socks_virbr1_as_user $SOCKS_HOST $SOCKS_PORT - torhost "
|
|
# proxy_dest_port_wlan_config || { ERROR DEST=$DEST ; continue ; }
|
|
|
|
# curl: (4) A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision
|
|
[ $DEBIAN -eq 0 ] && continue
|
|
|
|
[ -z "$socks_proxy" ] && socks_proxy=socks5h://${SOCKS_HOST}:$SOCKS_PORT
|
|
# mode whonix implies torhost
|
|
if [ $MODE = whonix ] ; then
|
|
ssh -o ForwardX11=no user@10.0.2.15 netstat -nl4e| grep 15:$SOCKS_PORT || {
|
|
retval=$?
|
|
ERROR ssh -o ForwardX11=no user@10.0.2.15 netstat
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue ;
|
|
}
|
|
socks_proxy=socks5h://${SOCKS_HOST}:$SOCKS_PORT
|
|
proxy_ping_curl -x $socks_proxy \
|
|
--interface virbr1 n--dns-interface virbr1 https://$HTTP_TARGET >/dev/null || {
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl -x $socks_proxy --interface virbr1 --dns-interface virbr1 https://$HTTP_TARGET
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
else
|
|
socks_proxy=socks5h://${SOCKS_HOST}:$SOCKS_PORT
|
|
proxy_ping_curl -x $socks_proxy https://$HTTP_TARGET >/dev/null \
|
|
|| { retval=$? ; ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl ${SOCKS_HOST} $SOCKS_PORT
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue ; }
|
|
fi
|
|
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works with user/pass
|
|
GREP="$SOCKS_PORT"
|
|
|
|
elif [ $ARG -eq 4 ] ; then
|
|
tests[4]="dig_socks_through_as_user @${SOCKS_HOST} -p $SOCKS_DNS $DNS_TARGET - tordns "
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
if [ $MODE = whonix ] ; then
|
|
# test ssh to the whonix_gateway libvirt container
|
|
# and make sure that the socks proxy is runninh
|
|
ssh -o ForwardX11=no user@10.0.2.15 netstat -nl4e | grep 15:$SOCKS_DNS
|
|
fi
|
|
dig @${SOCKS_HOST} -p $SOCKS_DNS $DNS_TARGET +timeout=$TIMEOUT >/dev/null || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval dig @${SOCKS_HOST} -p $SOCKS_DNS $DNS_TARGET
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works with fix
|
|
GREP="$SOCKS_DNS"
|
|
|
|
elif [ $ARG -eq 5 ] ; then
|
|
tests[5]="nslookup_socks_as_user - tordns "
|
|
[ $HAVE_NSLOOKUP = 1 ] || continue
|
|
desc="$NSL -port=$SOCKS_DNS $DNS_TARGET ${DNS_HOST}"
|
|
$desc >/dev/null || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval $desc
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}" $desc
|
|
# works with fix
|
|
GREP="$SOCKS_DNS"
|
|
|
|
elif [ $ARG -eq 6 ] ; then
|
|
tests[6]="curl_https_as_user - https "
|
|
proxy=`proxy_ping_get_https`
|
|
desc="curl --proxy http://${proxy}"
|
|
proxy_ping_curl --proxy http://${proxy} \
|
|
--proxy-insecure https://$HTTP_TARGET || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval $desc
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}" $desc
|
|
# works
|
|
GREP="$HTTP_PORT"
|
|
|
|
elif [ $ARG -eq 7 ] ; then
|
|
tests[8]="traceroute_icmp_dns_as_root --icmp - trace "
|
|
[ $USER = root ] || continue
|
|
[ -n "$PROXY_WLAN" ] || proxy_get_if || continue
|
|
[ $HAVE_TRACEROUTE = 1 ] || continue
|
|
traceroute -i $PROXY_WLAN --icmp $DNS_TARGET -m $THOPS || { \
|
|
retval=$?
|
|
ERROR $retval traceroute --icmp -m $THOPS
|
|
[ -z "$ALL" ] && exit 7$retval
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="-i icmp"
|
|
|
|
elif [ $ARG -eq 8 ] ; then
|
|
tests[8]="traceroute_tcp_dns_as_root -i $PROXY_WLAN -p 53 -T4 - trace "
|
|
[ $USER = root ] || continue
|
|
[ -n "$PROXY_WLAN" ] || proxy_get_if || continue
|
|
[ $HAVE_TRACEROUTE = 1 ] || continue
|
|
traceroute -i $PROXY_WLAN -p 53 -T4 $DNS_TARGET -m $THOPS || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval traceroute -T4 -p 53 -m $THOPS
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 9 ] ; then
|
|
tests[9]="traceroute_icmp_dns_as_user -p 53 - trace "
|
|
[ $USER = root ] || continue
|
|
[ -n "$PROXY_WLAN" ] || proxy_get_if || continue
|
|
[ $HAVE_TRACEROUTE = 1 ] || continue
|
|
traceroute -i $PROXY_WLAN --icmp $DNS_TARGET -p 53 -m $THOPS || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval traceroute -i $PROXY_WLAN --icmp -m $THOPS
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 10 ] ; then
|
|
tests[10]="wget_http_as_user $HTTP_PORT - http "
|
|
proxy=`proxy_ping_get_http`
|
|
env http_proxy=http://${proxy} \
|
|
$WGET -S http://$HTTP_TARGET 2>/dev/null
|
|
retval=$?
|
|
# 8 is an oddball
|
|
if [ $retval -eq 8 -o $retval -eq 0 ] ; then
|
|
INFO $prog test=$ARG "${tests[$ARG]}" wget $HTTP_PORT
|
|
else
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval wget $HTTP_PORT
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
fi
|
|
GREP="$HTTP_PORT"
|
|
|
|
elif [ $ARG -eq 11 ] ; then
|
|
tests[11]="curl_https_as_user - https "
|
|
proxy=`proxy_ping_get_https`
|
|
proxy_ping_curl --proxy http://${proxy} \
|
|
--proxy-insecure https://$HTTP_TARGET || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl $HTTP_PORT
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="$HTTP_PORT"
|
|
|
|
elif [ $ARG -eq 12 ] ; then
|
|
tests[12]="nmap_dns_as_root --privileged --send-eth -Pn -sU -p U:53 $DNS_HOST1 - nmap direct "
|
|
[ $USER = root ] || continue
|
|
which nmap 2>/dev/null >/dev/null || continue
|
|
nmap --privileged --send-eth -Pn -sU -p U:53 "$DNS_HOST1" || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval nmap 53
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 13 ] ; then
|
|
tests[13]="curl_firewall_bin - firewall "
|
|
[ $USER = root ] || continue
|
|
proxy_test_curl_firewall_asbin || continue
|
|
INFO $prog test=$ARG "${tests[$ARG]}" curl bin
|
|
# works
|
|
GREP="443"
|
|
|
|
elif [ $ARG -eq 14 ] ; then
|
|
tests[14]="traceroute_icmp_gw_as_root --icmp $PROXY_WLAN_GW - gw wifi "
|
|
[ $USER = root ] || continue
|
|
[ $HAVE_TRACEROUTE = 1 ] || continue
|
|
proxy_test_traceroute_icmp_gw || continue
|
|
# works
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="-i icmp"
|
|
|
|
elif [ $ARG -eq 15 ] ; then
|
|
tests[15]="test_dig_direct - direct "
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
proxy_test_dig_direct || continue
|
|
INFO $prog test=$ARG "${tests[$ARG]}" proxy_test_dig_direct
|
|
|
|
elif [ $ARG -eq 16 ] ; then
|
|
tests[16]="nslookup_as_root nslookup ${DNS_HOST1} $PRIV_BIN_OWNER - firewall "
|
|
[ $USER = root ] || continue
|
|
[ $HAVE_NSLOOKUP = 1 ] || continue
|
|
su -c "$NSL $DNS_TARGET $DNS_HOST1" -s /bin/sh $PRIV_BIN_OWNER >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval "$NSL $DNS_TARGET $DNS_HOST1" -s /bin/sh $PRIV_BIN_OWNER
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works /fails but maybe a noop
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 17 ] ; then
|
|
tests[17]="ntpdate_as_root ntpdate without service - ntp "
|
|
proxy_run_as_root || exit 9
|
|
[ -x /usr/sbin/ntpdate ] || continue
|
|
# Curious: even though sgid 2755 ntp it fails as su ntp
|
|
# 12 Nov 23:28:35 ntpdate[17341]: bind() fails: Permission denied
|
|
/usr/sbin/ntpdate "$NTP_HOST1" || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval ntpdate
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="123"
|
|
elif [ $ARG -eq 18 ] ; then
|
|
tests[18]="ntpdate_as_root ntpdate with servie - ntp "
|
|
proxy_run_as_root || exit 9
|
|
proxy_rc_service ntpd status >/dev/null && \
|
|
proxy_rc_service ntpd stop >/dev/null && sleep 2
|
|
/usr/sbin/ntpdate $NTP_HOST1 || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval ntpdate
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
proxy_rc_service ntpd status >/dev/null || proxy_rc_service ntpd start
|
|
GREP="123"
|
|
elif [ $ARG -eq 19 ] ; then
|
|
tests[19]="curl_noproxy_http_as_user curl raw noproxy - firefail "
|
|
timeout -k $TIMEOUT $TIMEOUT env - $CURL \
|
|
--noproxy "'*.*'" --connect-timeout $TIMEOUT \
|
|
http://$HTTP_TARGET >/dev/null && {
|
|
retval=$?
|
|
ERROR PANIC: $prog test=$ARG "${tests[$ARG]}" curl raw --noproxy
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP=80
|
|
|
|
elif [ $ARG -eq 20 ] ; then
|
|
tests[20]="curl_socksproxy_as_user curl $SOCKS_PORT - socks "
|
|
# needs dns
|
|
[ $DEBIAN -eq 0 ] && continue
|
|
|
|
socks_proxy=socks5h://${SOCKS_HOST}:$SOCKS_PORT
|
|
proxy_ping_curl -x $socks_proxy https://$HTTP_TARGET >/dev/null || {
|
|
retval=$? ;
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl $SOCKS_PORT
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works with user/pass
|
|
GREP="$SOCKS_PORT"
|
|
|
|
elif [ $ARG -eq 21 ] ; then
|
|
tests[21]="curl_httpsproxy_as_user - https "
|
|
[ -z "$https_proxy" ] && https_proxy=http://${HTTPS_PROXY_HOST}:${HTTPS_PORT}
|
|
proxy_ping_curl -x $https_proxy https://$HTTP_TARGET >/dev/null || { \
|
|
if [ "$MODE" = gateway ] ; then
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval curl ${HTTPS_HOST} ${HTTPS_PORT}
|
|
continue
|
|
else
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl ${HTTPS_HOST} HTTPS_PORT=${HTTPS_PORT}
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
fi
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}" curl ${HTTPS_HOST} ${HTTPS_PORT}
|
|
GREP="${HTTPS_PORT}"
|
|
|
|
elif [ $ARG -eq 22 ] ; then
|
|
tests[22]="iwlist_scan_as_user iwlist $PROXY_WLAN scan - iwlist "
|
|
[ $USER = root ] || continue
|
|
which iwlist 2>/dev/null || continue
|
|
[ -n "$PROXY_WLAN" ] || proxy_get_if || continue
|
|
iwlist $PROXY_WLAN scan >/dev/null || {
|
|
ERROR $prog retval=$? test=$ARG $PROXY_WLAN scan
|
|
[ -z "$ALL" ] && exit $ARG$1 || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
|
|
elif [ $ARG -eq 23 ] ; then
|
|
tests[23]="curl_proxy_as_user - direct "
|
|
proxy_ping_curl --insecure https://$HTTP_TARGET >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl direct
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
|
|
elif [ $ARG -eq 24 ] ; then
|
|
tests[24]="dig_direct_or_dnsmasq dig -b $IP $DNS_TARGET - direct "
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
[ -n "$PROXY_WLAN" -a -n "$IP" ] || proxy_ping_get_wlan_gw || continue
|
|
[ -n "$IP" ] || continue
|
|
dig -b $IP $DNS_TARGET +timeout=$TIMEOUT >/dev/null || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval dig -b $IP
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}" dig -b $IP
|
|
|
|
elif [ $ARG -eq 25 ] ; then
|
|
tests[25]="nslookup_as_user - direct "
|
|
[ $HAVE_NSLOOKUP = 1 ] || continue
|
|
# noenv with or without proxy
|
|
# @$DNS_HOST1 should fail for firewall unless dnsmasq is working
|
|
$NSL >/dev/null $DNS_TARGET ${DNS_HOST} || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval nslookup $DNS_TARGET
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}" nslookup
|
|
|
|
elif [ $ARG -eq 26 ] ; then
|
|
tests[26]="route_connected_ping_scan - direct "
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
#? done already in proxy_test_pretest_exit
|
|
proxy_do_ping && \
|
|
INFO $prog test=$ARG "${tests[$ARG]}" retval=$retval dig -b $IP || \
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval dig -b $IP
|
|
|
|
elif [ $ARG -eq 27 ] ; then
|
|
tests[27]="dns_as_user dig -b 127.0.0.1 - direct "
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
[ -n "$PROXY_WLAN" -a -n "$IP" ] || proxy_ping_get_wlan_gw || continue
|
|
dig -b 127.0.0.1 $DNS_TARGET +timeout=$TIMEOUT >/dev/null || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval dig -b $IP
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
|
|
elif [ $ARG -eq 28 ] ; then
|
|
tests[28]="wget_as_user - direct "
|
|
proxy_ping_test_env || { WARN $prog test=$ARG "${tests[$ARG]}" no proxy in env ; }
|
|
$WGET -S https://$HTTP_TARGET 2>/dev/null
|
|
retval=$?
|
|
if [ $retval -eq 8 -o $retval -eq 0 ] ; then
|
|
INFO $prog test=$ARG "${tests[$ARG]}" wget
|
|
else
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval wget
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
fi
|
|
|
|
elif [ $ARG -eq 29 ] ; then
|
|
tests[29]="curl_as_user - direct "
|
|
proxy_ping_test_env || { WARN $prog test=$ARG "${tests[$ARG]}" no proxy in env ; }
|
|
proxy_ping_curl https://$HTTP_TARGET >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval curl
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
|
|
elif [ $ARG -eq 30 ] ; then
|
|
tests[30]="tor_bootstrap_check_as_root tor_bootstrap_check.py - torhost "
|
|
[ $MODE = tor -o $MODE = whonix -o $MODE = gateway -o $MODE = selektor ] || {
|
|
# are there other roles that run tor?
|
|
WARN $prog MODE != tor test=$ARG
|
|
}
|
|
port=$SOCKS_PORT
|
|
$NETS | grep -q :$port || {
|
|
ERROR $prog retval=$? test=$ARG tor not running on $port
|
|
[ -z "$ALL" ] && exit $ARG || continue
|
|
}
|
|
[ $USER = root ] || continue
|
|
|
|
# was /usr/local/bin/tor_bootstrap_check.bash
|
|
[ -f /usr/local/src/helper-scripts/tor_bootstrap_check.py ] || return 1
|
|
python3.sh /usr/local/src/helper-scripts/tor_bootstrap_check.py
|
|
# morons 100%
|
|
retval=$?
|
|
[ $retval -eq 0 -o $retval -eq 100 ] || { \
|
|
retval=$?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval tor_bootstrap_check
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
|
|
elif [ $ARG -eq 31 ] ; then
|
|
tests[31]="curl_noproxy_as_root polipo http pages $HTTP_PORT - direct http "
|
|
timeout -k $TIMEOUT $TIMEOUT env - $CURL \
|
|
--noproxy '*' http://${HTTP_TARGET} && { \
|
|
retval=$?
|
|
ERROR PANIC: $prog test=$ARG "${tests[$ARG]}" retval=$retval $HTTP_TARGET
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
GREP="$HTTP_PORT"
|
|
|
|
elif [ $ARG -eq 32 ] ; then
|
|
tests[32]="ping_nmap_direct_as_root nmap 53 - direct "
|
|
[ $USER = root ] || continue
|
|
which nmap 2>/dev/null >/dev/null || continue
|
|
[ -n "$PROXY_WLAN" -a -n "$PROXY_WLAN_GW" ] || proxy_ping_get_wlan_gw || continue
|
|
proxy_ping_nmap_direct $DNS_HOST1 "$PROXY_WLAN_GW" U:67 || {
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval nmapd 53
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 33 ] ; then
|
|
tests[33]="host_virbr_as_user proxy_ping_test_virbr 1 - libvirthost "
|
|
proxy_ping_test_virbr 1 || {
|
|
retval=$?
|
|
ERROR $CONN virbr1 not running
|
|
[ -z "$ALL" ] && exit 1 || continue
|
|
}
|
|
# * Immediate connect fail for 10.0.2.15: Connection refused
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
|
|
elif [ $ARG -eq 34 ] ; then
|
|
tests[34]="python_ping_as_root traceroute --icmp $PROXY_WLAN_GW - wifi "
|
|
[ $USER = root ] || continue
|
|
[ -n "$PROXY_WLAN_GW" -a -n "$IP" ] || PROXY_WLAN_GW=`proxy_ping_get_wlan_gw` || continue
|
|
[ -f /usr/local/bin/ping2.py ] || continue
|
|
/usr/local/bin/ping2.py $IP $DNS_HOST1 $PROXY_WLAN_GW || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval ping2.py $DNS_HOST1
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
# works
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP="-i icmp"
|
|
|
|
elif [ $ARG -eq 35 ] ; then
|
|
tests[35]="dig_as_root - firewall dig @$DNS_HOST1 - torhost dns "
|
|
[ $USER = root ] || continue
|
|
[ $HAVE_DIG = 1 ] || continue
|
|
# @$DNS_HOST1
|
|
su -c "dig $NTP_HOST2 +timeout=$TIMEOUT" -s /bin/sh $PRIV_BIN_OWNER >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval dig $NTP_HOST2 $PRIV_BIN_OWNER
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
GREP="53"
|
|
|
|
elif [ $ARG -eq 36 ] ; then
|
|
tests[36]="tor_resolve_as_user tor-resolve $NTP_HOST2 - tordns "
|
|
[ $HAVE_TOR_RESOLVE = 1 ] || continue
|
|
tor-resolve $NTP_HOST2 >/dev/null || { \
|
|
retval=$?
|
|
# dunno Failed parsing SOCKS5 response conf?
|
|
WARN $prog test=$ARG "${tests[$ARG]}" retval=$retval tor-resolve $NTP_HOST2
|
|
continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
# works
|
|
GREP="9053"
|
|
|
|
elif [ $ARG -eq 37 ] ; then
|
|
tests[37]="qemu_guest_agent_ports - libvirtguest "
|
|
ser=qemu-guest-agent
|
|
proxy_rc_service $ser status >/dev/null || proxy_rc_service $ser start
|
|
proxy_rc_service $ser status >/dev/null || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval $ser status
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
[ -d /dev/virtio-ports ] || { \
|
|
retval=$?
|
|
ERROR $prog test=$ARG "${tests[$ARG]}" retval=$retval /dev/virtio-ports
|
|
[ -z "$ALL" ] && exit $ARG$retval || continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
GREP=""
|
|
|
|
elif [ $ARG -eq 38 ] ; then
|
|
tests[38]="check_libvirt_running - libvirthost "
|
|
[ $USER = root ] || continue
|
|
$PL proxy_libvirt_list
|
|
aret=$?
|
|
if [ $aret -eq 10 ] ;then
|
|
WARN proxy_libvirt_status hung
|
|
elif [ $aret -ne 10 -a $aret -ne 0 ] ; then
|
|
DBUG proxy_libvirt_status aret=$aret
|
|
else
|
|
# was $GATEW_DOM but now can be gentoo_vm-2 etc
|
|
$PL proxy_libvirt_list 2>&1| grep -q "running" || {
|
|
WARN MODE=$MODE and nothing libvirt running
|
|
continue
|
|
}
|
|
INFO $prog test=$ARG "${tests[$ARG]}"
|
|
fi
|
|
|
|
elif [ $ARG -eq 39 ] ; then
|
|
tests[39]="proxy_test_dirmngr - dirmngr "
|
|
[ $USER = root ] || continue
|
|
proxy_test_dirmngr
|
|
|
|
elif [ $ARG -eq 99 ] ; then
|
|
tests[99]="test_all_modes unfinished not sure"
|
|
[ $USER = root ] || continue
|
|
for elt in vda selektor ws gateway nat tor whonix; do
|
|
INFO testing $elt
|
|
if [ "$MODE" = vda ] ; then
|
|
: vda
|
|
elif [ "$MODE" = selektor ] ; then
|
|
: selektor
|
|
elif [ "$MODE" = ws ] ; then
|
|
: ws
|
|
elif [ "$MODE" = gateway ] ; then
|
|
: gateway
|
|
elif [ "$MODE" = nat ] ; then
|
|
: nat
|
|
elif [ "$MODE" = tor ] ; then
|
|
: tor
|
|
elif [ "$MODE" = whonix ] ; then
|
|
: whonix
|
|
else
|
|
WARN unrecognized mode MODE=$elt
|
|
fi
|
|
done
|
|
|
|
elif false ; then
|
|
if ! grep -q '10.152.152.10\|127.0.0.1' /etc/resolv.conf ; then
|
|
$NETS | grep -q :53 || {
|
|
ERROR $prog retval=$? test=$ARG local resolv.conf but :53 not running
|
|
[ -z "$ALL" ] && exit 1 || continue
|
|
}
|
|
fi
|
|
|
|
fi
|
|
[ -n "$GREP" ] && [ $DMESG_LINES -gt 0 ] && \
|
|
DBUG `dmesg|tail|grep $GREP|tail -$DMESG_LINES`
|
|
|
|
done
|
|
exit 0
|