cjdns: uci-defaults: work around missing lan interface
[feed/routing.git] / cjdns / files / cjdns.defaults
1 #!/bin/sh
2
3 # if there is an existing config, our work is already done
4 uci get cjdns.cjdns.ipv6 >/dev/null 2>&1
5 if [ $? -ne 0 ]; then
6
7 # register commit handler
8 uci -q batch <<-EOF >/dev/null
9 delete ucitrack.@cjdns[-1]
10 add ucitrack cjdns
11 set ucitrack.@cjdns[-1].init=cjdns
12 commit ucitrack
13 EOF
14
15 # generate configuration
16 touch /etc/config/cjdns
17 cjdroute --genconf | cjdroute --cleanconf | cjdrouteconf set
18
19 # make sure config is present (might fail for any reason)
20 uci get cjdns.cjdns.ipv6 >/dev/null 2>&1
21 if [ $? -ne 0 ]; then
22 exit 1
23 fi
24
25 # enable auto-peering on ethernet interface lan, if existing
26 uci get network.lan | grep interface >/dev/null 2>&1
27 if [ $? -eq 0 ]; then
28 uci get network.lan.type | grep bridge >/dev/null 2>&1
29 if [ $? -eq 0 ]; then
30 # most routers will set up an ethernet bridge for the lan
31 ifname="br-lan"
32 else
33 # docker containers don't have permission to create bridges by default,
34 # so we bind to the underlying interface instead (likely eth0)
35 ifname=`uci get network.lan.ifname`
36 fi
37 uci -q batch <<-EOF >/dev/null
38 add cjdns eth_interface
39 set cjdns.@eth_interface[-1].beacon=2
40 set cjdns.@eth_interface[-1].bind=$ifname
41 EOF
42 fi
43 # set the tun interface name
44 uci set cjdns.cjdns.tun_device=tuncjdns
45
46 # create the network interface
47 uci -q batch <<-EOF >/dev/null
48 set network.cjdns=interface
49 set network.cjdns.ifname=tuncjdns
50 set network.cjdns.proto=none
51 EOF
52
53 # firewall rules by @dangowrt -- thanks <3
54
55 # create the firewall zone
56 uci -q batch <<-EOF >/dev/null
57 add firewall zone
58 set firewall.@zone[-1].name=cjdns
59 add_list firewall.@zone[-1].network=cjdns
60 set firewall.@zone[-1].input=REJECT
61 set firewall.@zone[-1].output=ACCEPT
62 set firewall.@zone[-1].forward=REJECT
63 set firewall.@zone[-1].conntrack=1
64 set firewall.@zone[-1].family=ipv6
65 EOF
66
67 # allow ICMP from cjdns zone, e.g. ping6
68 uci -q batch <<-EOF >/dev/null
69 add firewall rule
70 set firewall.@rule[-1].name='Allow-ICMPv6-cjdns'
71 set firewall.@rule[-1].src=cjdns
72 set firewall.@rule[-1].proto=icmp
73 add_list firewall.@rule[-1].icmp_type=echo-request
74 add_list firewall.@rule[-1].icmp_type=echo-reply
75 add_list firewall.@rule[-1].icmp_type=destination-unreachable
76 add_list firewall.@rule[-1].icmp_type=packet-too-big
77 add_list firewall.@rule[-1].icmp_type=time-exceeded
78 add_list firewall.@rule[-1].icmp_type=bad-header
79 add_list firewall.@rule[-1].icmp_type=unknown-header-type
80 set firewall.@rule[-1].limit='1000/sec'
81 set firewall.@rule[-1].family=ipv6
82 set firewall.@rule[-1].target=ACCEPT
83 EOF
84
85 # allow SSH from cjdns zone, needs to be explicitly enabled
86 uci -q batch <<-EOF >/dev/null
87 add firewall rule
88 set firewall.@rule[-1].enabled=0
89 set firewall.@rule[-1].name='Allow-SSH-cjdns'
90 set firewall.@rule[-1].src=cjdns
91 set firewall.@rule[-1].proto=tcp
92 set firewall.@rule[-1].dest_port=22
93 set firewall.@rule[-1].target=ACCEPT
94 EOF
95
96 # allow LuCI access from cjdns zone, needs to be explicitly enabled
97 uci -q batch <<-EOF >/dev/null
98 add firewall rule
99 set firewall.@rule[-1].enabled=0
100 set firewall.@rule[-1].name='Allow-HTTP-cjdns'
101 set firewall.@rule[-1].src=cjdns
102 set firewall.@rule[-1].proto=tcp
103 set firewall.@rule[-1].dest_port=80
104 set firewall.@rule[-1].target=ACCEPT
105 EOF
106
107 # allow UDP peering from wan zone, if it exists
108 uci show network.wan >/dev/null 2>&1
109 if [ $? -eq 0 ]; then
110 peeringPort=`uci get cjdns.@udp_interface[0].port`
111 uci -q batch <<-EOF >/dev/null
112 add firewall rule
113 set firewall.@rule[-1].name='Allow-cjdns-wan'
114 set firewall.@rule[-1].src=wan
115 set firewall.@rule[-1].proto=udp
116 set firewall.@rule[-1].dest_port=$peeringPort
117 set firewall.@rule[-1].target=ACCEPT
118 EOF
119 fi
120
121 uci commit cjdns
122 uci commit firewall
123 uci commit network
124
125 fi
126
127 exit 0