|
Xdev Host Manager
authored
2 days ago
|
1
|
#!/usr/bin/env bash
|
|
|
2
|
#
|
|
|
3
|
# sync_local_hosts.sh - Sync local madagascar DNS records to is-vpn-gw and as01.
|
|
|
4
|
#
|
|
|
5
|
|
|
|
6
|
set -euo pipefail
|
|
|
7
|
|
|
|
8
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
9
|
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
|
|
|
10
|
CONFIG_FILE="$PROJECT_DIR/config/local-hosts.tsv"
|
|
|
11
|
IS_VPN_GW="is-vpn-gw"
|
|
|
12
|
AS01="admin@192.168.2.2"
|
|
|
13
|
APPLY=false
|
|
|
14
|
VERIFY=false
|
|
|
15
|
TARGET="all"
|
|
|
16
|
NEGATIVE_NAME="nohost.madagascar.xdev.ro"
|
|
|
17
|
|
|
|
18
|
usage() {
|
|
|
19
|
cat << EOF
|
|
|
20
|
Usage: $0 [--apply] [--verify] [--target all|is-vpn-gw|as01] [-c file]
|
|
|
21
|
|
|
|
22
|
Default mode is dry-run. Use --apply to change remote resolvers.
|
|
|
23
|
|
|
|
24
|
Examples:
|
|
|
25
|
$0
|
|
|
26
|
$0 --apply --verify
|
|
|
27
|
$0 --target as01 --apply
|
|
|
28
|
EOF
|
|
|
29
|
}
|
|
|
30
|
|
|
|
31
|
log() {
|
|
|
32
|
printf '[INFO] %s\n' "$*"
|
|
|
33
|
}
|
|
|
34
|
|
|
|
35
|
die() {
|
|
|
36
|
printf '[ERROR] %s\n' "$*" >&2
|
|
|
37
|
exit 1
|
|
|
38
|
}
|
|
|
39
|
|
|
|
40
|
while [[ $# -gt 0 ]]; do
|
|
|
41
|
case "$1" in
|
|
|
42
|
--apply) APPLY=true; shift ;;
|
|
|
43
|
--verify) VERIFY=true; shift ;;
|
|
|
44
|
--target) TARGET="${2:-}"; shift 2 ;;
|
|
|
45
|
-c|--config) CONFIG_FILE="${2:-}"; shift 2 ;;
|
|
|
46
|
-h|--help) usage; exit 0 ;;
|
|
|
47
|
*) die "Unknown option: $1" ;;
|
|
|
48
|
esac
|
|
|
49
|
done
|
|
|
50
|
|
|
|
51
|
case "$TARGET" in
|
|
|
52
|
all|is-vpn-gw|as01) ;;
|
|
|
53
|
*) die "Invalid target: $TARGET" ;;
|
|
|
54
|
esac
|
|
|
55
|
|
|
|
56
|
[[ -f "$CONFIG_FILE" ]] || die "Missing config file: $CONFIG_FILE"
|
|
|
57
|
|
|
|
58
|
WORK_DIR="$(mktemp -d)"
|
|
|
59
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
60
|
|
|
|
61
|
HOSTS_ROWS="$WORK_DIR/hosts.rows"
|
|
|
62
|
CLOAK_ROWS="$WORK_DIR/cloak.rows"
|
|
|
63
|
NAMES_FILE="$WORK_DIR/names.txt"
|
|
|
64
|
MIKROTIK_RSC="$WORK_DIR/as01.rsc"
|
|
|
65
|
VERIFY_ROWS="$WORK_DIR/verify.rows"
|
|
|
66
|
|
|
|
67
|
touch "$HOSTS_ROWS" "$CLOAK_ROWS" "$NAMES_FILE" "$MIKROTIK_RSC" "$VERIFY_ROWS"
|
|
|
68
|
|
|
|
69
|
quote_ros() {
|
|
|
70
|
printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
|
|
|
71
|
}
|
|
|
72
|
|
|
Xdev Host Manager
authored
2 days ago
|
73
|
is_local_is_vpn_gw() {
|
|
|
74
|
local host_name
|
|
|
75
|
host_name="$(hostname -f 2>/dev/null || hostname 2>/dev/null || true)"
|
|
|
76
|
[[ "$host_name" == "jumper.madagascar.xdev.ro" ]] && return 0
|
|
|
77
|
ip addr show 2>/dev/null | grep -q '192\.168\.2\.100' && return 0
|
|
|
78
|
return 1
|
|
|
79
|
}
|
|
|
80
|
|
|
|
81
|
run_is_vpn_gw_payload() {
|
|
|
82
|
local remote_dir="$1"
|
|
|
83
|
if is_local_is_vpn_gw; then
|
|
|
84
|
REMOTE_DIR="$remote_dir" bash -s
|
|
|
85
|
else
|
|
|
86
|
ssh "$IS_VPN_GW" "REMOTE_DIR='$remote_dir' bash -s"
|
|
|
87
|
fi
|
|
|
88
|
}
|
|
|
89
|
|
|
Xdev Host Manager
authored
2 days ago
|
90
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
|
91
|
[[ -z "${line//[[:space:]]/}" ]] && continue
|
|
|
92
|
[[ "$line" =~ ^[[:space:]]*# ]] && continue
|
|
|
93
|
|
|
|
94
|
read -r hosts_ip dns_ip names <<< "$line"
|
|
|
95
|
[[ -n "${hosts_ip:-}" && -n "${dns_ip:-}" && -n "${names:-}" ]] || die "Invalid row: $line"
|
|
|
96
|
|
|
|
97
|
printf '%s %s\n' "$hosts_ip" "$names" >> "$HOSTS_ROWS"
|
|
|
98
|
|
|
|
99
|
for name in $names; do
|
|
|
100
|
printf '%s\n' "$name" >> "$NAMES_FILE"
|
|
|
101
|
printf '%-40s %s\n' "$name" "$dns_ip" >> "$CLOAK_ROWS"
|
|
|
102
|
if [[ "$name" == *.xdev.ro ]]; then
|
|
|
103
|
printf '%s %s\n' "$name" "$dns_ip" >> "$VERIFY_ROWS"
|
|
|
104
|
fi
|
|
|
105
|
|
|
|
106
|
ros_name="$(quote_ros "$name")"
|
|
|
107
|
ros_ip="$(quote_ros "$dns_ip")"
|
|
|
108
|
{
|
|
|
109
|
printf '/ip dns static remove [find name="%s"]\n' "$ros_name"
|
|
|
110
|
printf '/ip dns static add name="%s" type=A address=%s comment="xdev-local managed"\n' "$ros_name" "$ros_ip"
|
|
|
111
|
} >> "$MIKROTIK_RSC"
|
|
|
112
|
done
|
|
|
113
|
done < "$CONFIG_FILE"
|
|
|
114
|
|
|
|
115
|
sort -u "$NAMES_FILE" -o "$NAMES_FILE"
|
|
|
116
|
printf '/ip dns cache flush\n' >> "$MIKROTIK_RSC"
|
|
|
117
|
printf ':put "xdev local dns sync complete"\n' >> "$MIKROTIK_RSC"
|
|
|
118
|
|
|
|
119
|
sync_is_vpn_gw() {
|
|
|
120
|
if ! $APPLY; then
|
|
|
121
|
log "Dry-run for $IS_VPN_GW: generated /etc/hosts block"
|
|
|
122
|
sed -n '1,80p' "$HOSTS_ROWS"
|
|
|
123
|
log "Dry-run for $IS_VPN_GW: generated cloaking-rules block"
|
|
|
124
|
sed -n '1,120p' "$CLOAK_ROWS"
|
|
|
125
|
return
|
|
|
126
|
fi
|
|
|
127
|
|
|
|
128
|
log "Syncing $IS_VPN_GW"
|
|
|
129
|
remote_dir="/tmp/xdev-local-dns.$$"
|
|
Xdev Host Manager
authored
2 days ago
|
130
|
if is_local_is_vpn_gw; then
|
|
|
131
|
mkdir -p "$remote_dir"
|
|
|
132
|
cp "$HOSTS_ROWS" "$CLOAK_ROWS" "$NAMES_FILE" "$remote_dir/"
|
|
|
133
|
else
|
|
|
134
|
ssh "$IS_VPN_GW" "mkdir -p '$remote_dir'"
|
|
|
135
|
scp "$HOSTS_ROWS" "$CLOAK_ROWS" "$NAMES_FILE" "$IS_VPN_GW:$remote_dir/" >/dev/null
|
|
|
136
|
fi
|
|
|
137
|
run_is_vpn_gw_payload "$remote_dir" <<'REMOTE'
|
|
Xdev Host Manager
authored
2 days ago
|
138
|
set -euo pipefail
|
|
|
139
|
stamp="$(date +%Y%m%d_%H%M%S)"
|
|
|
140
|
cp /etc/hosts "/etc/hosts.bak.$stamp"
|
|
|
141
|
cp /etc/dnscrypt-proxy/cloaking-rules.txt "/etc/dnscrypt-proxy/cloaking-rules.txt.bak.$stamp"
|
|
|
142
|
|
|
|
143
|
awk '
|
|
|
144
|
NR == FNR { names[$1] = 1; next }
|
|
|
145
|
/^# BEGIN XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 1; next }
|
|
|
146
|
/^# END XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 0; next }
|
|
|
147
|
in_managed { next }
|
|
|
148
|
/^[[:space:]]*#/ || /^[[:space:]]*$/ { print; next }
|
|
|
149
|
{
|
|
|
150
|
keep = 1
|
|
|
151
|
for (i = 2; i <= NF; i++) {
|
|
|
152
|
if ($i in names) keep = 0
|
|
|
153
|
}
|
|
|
154
|
if (keep) print
|
|
|
155
|
}
|
|
|
156
|
' "$REMOTE_DIR/names.txt" /etc/hosts > "$REMOTE_DIR/hosts.new"
|
|
|
157
|
{
|
|
|
158
|
cat "$REMOTE_DIR/hosts.new"
|
|
|
159
|
printf "\n# BEGIN XDEV LOCAL DNS MANAGED BLOCK\n"
|
|
|
160
|
cat "$REMOTE_DIR/hosts.rows"
|
|
|
161
|
printf "# END XDEV LOCAL DNS MANAGED BLOCK\n"
|
|
|
162
|
} > /etc/hosts
|
|
|
163
|
|
|
|
164
|
awk '
|
|
|
165
|
NR == FNR { names[$1] = 1; next }
|
|
|
166
|
/^# BEGIN XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 1; next }
|
|
|
167
|
/^# END XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 0; next }
|
|
|
168
|
in_managed { next }
|
|
|
169
|
/^[[:space:]]*#/ || /^[[:space:]]*$/ { print; next }
|
|
|
170
|
{
|
|
|
171
|
if (!($1 in names)) print
|
|
|
172
|
}
|
|
|
173
|
' "$REMOTE_DIR/names.txt" /etc/dnscrypt-proxy/cloaking-rules.txt > "$REMOTE_DIR/cloak.new"
|
|
|
174
|
{
|
|
|
175
|
cat "$REMOTE_DIR/cloak.new"
|
|
|
176
|
printf "\n# BEGIN XDEV LOCAL DNS MANAGED BLOCK\n"
|
|
|
177
|
cat "$REMOTE_DIR/cloak.rows"
|
|
|
178
|
printf "# END XDEV LOCAL DNS MANAGED BLOCK\n"
|
|
|
179
|
} > /etc/dnscrypt-proxy/cloaking-rules.txt
|
|
|
180
|
|
|
|
181
|
resolved_backup=""
|
|
|
182
|
if ! grep -Eq '^ReadEtcHosts=no$' /etc/systemd/resolved.conf; then
|
|
|
183
|
cp /etc/systemd/resolved.conf "/etc/systemd/resolved.conf.bak.$stamp"
|
|
|
184
|
resolved_backup=" /etc/systemd/resolved.conf.bak.$stamp"
|
|
|
185
|
if grep -Eq '^ReadEtcHosts=' /etc/systemd/resolved.conf; then
|
|
|
186
|
sed -i 's/^ReadEtcHosts=.*/ReadEtcHosts=no/' /etc/systemd/resolved.conf
|
|
|
187
|
else
|
|
|
188
|
printf "\nReadEtcHosts=no\n" >> /etc/systemd/resolved.conf
|
|
|
189
|
fi
|
|
|
190
|
fi
|
|
|
191
|
|
|
|
192
|
if grep -Eq '^DNSStubListenerExtra=' /etc/systemd/resolved.conf; then
|
|
|
193
|
if [[ -z "$resolved_backup" ]]; then
|
|
|
194
|
cp /etc/systemd/resolved.conf "/etc/systemd/resolved.conf.bak.$stamp"
|
|
|
195
|
resolved_backup=" /etc/systemd/resolved.conf.bak.$stamp"
|
|
|
196
|
fi
|
|
|
197
|
sed -i 's/^DNSStubListenerExtra=/#DNSStubListenerExtra=/' /etc/systemd/resolved.conf
|
|
|
198
|
fi
|
|
|
199
|
|
|
|
200
|
dnscrypt_resolved_conf="/etc/systemd/resolved.conf.d/20-dnscrypt.conf"
|
|
|
201
|
mkdir -p /etc/systemd/resolved.conf.d
|
|
|
202
|
if [[ ! -f "$dnscrypt_resolved_conf" ]] || ! grep -Eq '^DNS=127\.0\.0\.1:5300$' "$dnscrypt_resolved_conf"; then
|
|
|
203
|
if [[ -f "$dnscrypt_resolved_conf" ]]; then
|
|
|
204
|
cp "$dnscrypt_resolved_conf" "$dnscrypt_resolved_conf.bak.$stamp"
|
|
|
205
|
resolved_backup="$resolved_backup $dnscrypt_resolved_conf.bak.$stamp"
|
|
|
206
|
fi
|
|
|
207
|
cat > "$dnscrypt_resolved_conf" <<'EOF'
|
|
|
208
|
[Resolve]
|
|
|
209
|
# Send LAN DNS traffic through dnscrypt-proxy so cloaking-rules are authoritative locally.
|
|
|
210
|
DNS=127.0.0.1:5300
|
|
|
211
|
FallbackDNS=
|
|
|
212
|
EOF
|
|
|
213
|
fi
|
|
|
214
|
|
|
|
215
|
dnscrypt_conf="/etc/dnscrypt-proxy/dnscrypt-proxy.toml"
|
|
|
216
|
expected_listen="listen_addresses = ['127.0.0.1:5300', '192.168.2.100:53']"
|
|
|
217
|
dnscrypt_backup=""
|
|
|
218
|
if ! grep -Fqx "$expected_listen" "$dnscrypt_conf"; then
|
|
|
219
|
cp "$dnscrypt_conf" "$dnscrypt_conf.bak.$stamp"
|
|
|
220
|
dnscrypt_backup=" $dnscrypt_conf.bak.$stamp"
|
|
|
221
|
sed -i "s|^listen_addresses = .*|$expected_listen|" "$dnscrypt_conf"
|
|
|
222
|
fi
|
|
|
223
|
|
|
|
224
|
allowed_names_file="/etc/dnscrypt-proxy/allowed-names.txt"
|
|
|
225
|
if ! grep -Eq "^allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'$" "$dnscrypt_conf"; then
|
|
|
226
|
if [[ -z "$dnscrypt_backup" ]]; then
|
|
|
227
|
cp "$dnscrypt_conf" "$dnscrypt_conf.bak.$stamp"
|
|
|
228
|
dnscrypt_backup=" $dnscrypt_conf.bak.$stamp"
|
|
|
229
|
fi
|
|
|
230
|
if grep -Eq '^[#[:space:]]*allowed_names_file =' "$dnscrypt_conf"; then
|
|
|
231
|
sed -i "s|^[#[:space:]]*allowed_names_file = .*|allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'|" "$dnscrypt_conf"
|
|
|
232
|
else
|
|
|
233
|
sed -i "/^\\[allowed_names\\]/a allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'" "$dnscrypt_conf"
|
|
|
234
|
fi
|
|
|
235
|
fi
|
|
|
236
|
|
|
|
237
|
for allowed_name in google.com www.google.com; do
|
|
|
238
|
grep -Fxq "$allowed_name" "$allowed_names_file" || printf "%s\n" "$allowed_name" >> "$allowed_names_file"
|
|
|
239
|
done
|
|
|
240
|
|
|
|
241
|
resolvectl flush-caches || true
|
|
|
242
|
systemctl restart systemd-resolved
|
|
|
243
|
|
|
|
244
|
systemctl restart dnscrypt-proxy
|
|
|
245
|
rm -rf "$REMOTE_DIR"
|
|
|
246
|
printf "backups: /etc/hosts.bak.%s /etc/dnscrypt-proxy/cloaking-rules.txt.bak.%s%s%s\n" "$stamp" "$stamp" "$resolved_backup" "$dnscrypt_backup"
|
|
|
247
|
REMOTE
|
|
|
248
|
}
|
|
|
249
|
|
|
|
250
|
sync_as01() {
|
|
|
251
|
if ! $APPLY; then
|
|
|
252
|
log "Dry-run for as01: generated RouterOS commands"
|
|
|
253
|
sed -n '1,160p' "$MIKROTIK_RSC"
|
|
|
254
|
return
|
|
|
255
|
fi
|
|
|
256
|
|
|
|
257
|
log "Syncing as01"
|
|
|
258
|
ssh "$AS01" "/ip dns static remove [find comment=\"xdev-local managed\"]"$'\n'"$(cat "$MIKROTIK_RSC")"
|
|
|
259
|
}
|
|
|
260
|
|
|
|
261
|
verify_resolver() {
|
|
|
262
|
local resolver="$1"
|
|
|
263
|
local failures=0
|
|
|
264
|
|
|
|
265
|
log "Verifying resolver $resolver"
|
|
|
266
|
while read -r name expected_ip; do
|
|
|
267
|
answers="$(dig @"$resolver" "$name" +short || true)"
|
|
|
268
|
if ! grep -Fxq "$expected_ip" <<< "$answers"; then
|
|
|
269
|
compact_answers="$(paste -s -d ',' - <<< "$answers")"
|
|
|
270
|
printf '[FAIL] %s %s expected %s got %s\n' "$resolver" "$name" "$expected_ip" "${compact_answers:-<empty>}" >&2
|
|
|
271
|
failures=$((failures + 1))
|
|
|
272
|
fi
|
|
|
273
|
done < "$VERIFY_ROWS"
|
|
|
274
|
|
|
|
275
|
dns_status="$(dig @"$resolver" "$NEGATIVE_NAME" +noall +comments | awk '/status:/ {print $6}' | tr -d ',' || true)"
|
|
|
276
|
if [[ "$dns_status" != "NXDOMAIN" ]]; then
|
|
|
277
|
printf '[FAIL] %s %s expected NXDOMAIN got %s\n' "$resolver" "$NEGATIVE_NAME" "${dns_status:-<empty>}" >&2
|
|
|
278
|
failures=$((failures + 1))
|
|
|
279
|
fi
|
|
|
280
|
|
|
|
281
|
[[ "$failures" -eq 0 ]]
|
|
|
282
|
}
|
|
|
283
|
|
|
|
284
|
if $APPLY || ! $VERIFY; then
|
|
|
285
|
case "$TARGET" in
|
|
|
286
|
all)
|
|
|
287
|
sync_is_vpn_gw
|
|
|
288
|
sync_as01
|
|
|
289
|
;;
|
|
|
290
|
is-vpn-gw) sync_is_vpn_gw ;;
|
|
|
291
|
as01) sync_as01 ;;
|
|
|
292
|
esac
|
|
|
293
|
fi
|
|
|
294
|
|
|
|
295
|
if $VERIFY; then
|
|
|
296
|
case "$TARGET" in
|
|
|
297
|
all)
|
|
|
298
|
verify_resolver 192.168.2.100
|
|
|
299
|
verify_resolver 192.168.2.2
|
|
|
300
|
;;
|
|
|
301
|
is-vpn-gw) verify_resolver 192.168.2.100 ;;
|
|
|
302
|
as01) verify_resolver 192.168.2.2 ;;
|
|
|
303
|
esac
|
|
|
304
|
fi
|