You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

99 lines
3.1 KiB

  1. #!/bin/sh
  2. yggConfig="/etc/config/yggdrasil"
  3. first_boot_genConfig()
  4. {
  5. . /usr/share/libubox/jshn.sh
  6. boardcfg=$(ubus call system board)
  7. touch ${yggConfig}
  8. yggdrasil -genconf -json | ygguci set
  9. json_load "$boardcfg"
  10. json_get_var kernel kernel
  11. json_get_var system system
  12. json_get_var model model
  13. json_get_var board_name board_name
  14. nodeinfo='{"kernel": "'$kernel'", "hostname":"'OpenWrt'", "system": "'$system'", "model": "'$model'", "board_name": "'$board_name'"}'
  15. uci set yggdrasil.yggdrasil.IfName="ygg0"
  16. uci set yggdrasil.yggdrasil.NodeInfo="$nodeinfo"
  17. uci commit yggdrasil
  18. }
  19. if [ -e /etc/yggdrasil.conf ]; then
  20. echo "config: import config from /etc/yggdrasil.conf to /etc/config/yggdrasil" | logger -t yggdrasil
  21. touch ${yggConfig}
  22. cat /etc/yggdrasil.conf | ygguci set
  23. mv /etc/yggdrasil.conf /etc/yggdrasil.conf.bak
  24. elif [ ! -e ${yggConfig} ]; then
  25. echo "first_boot: adding system board details to NodeInfo[] in NEW config: ${yggConfig}" | logger -t yggdrasil
  26. first_boot_genConfig
  27. # create the network interface
  28. uci -q batch <<-EOF >/dev/null
  29. set network.yggdrasil=interface
  30. set network.yggdrasil.ifname=ygg0
  31. set network.yggdrasil.proto=none
  32. EOF
  33. # create the firewall zone
  34. uci -q batch <<-EOF >/dev/null
  35. set firewall.yggdrasil=zone
  36. set firewall.yggdrasil.name=yggdrasil
  37. add_list firewall.yggdrasil.network=yggdrasil
  38. set firewall.yggdrasil.input=REJECT
  39. set firewall.yggdrasil.output=ACCEPT
  40. set firewall.yggdrasil.forward=REJECT
  41. set firewall.yggdrasil.conntrack=1
  42. EOF
  43. # allow ICMP from yggdrasil zone, e.g. ping6
  44. uci -q batch <<-EOF >/dev/null
  45. add firewall rule
  46. set firewall.@rule[-1].name='Allow-ICMPv6-yggdrasil'
  47. set firewall.@rule[-1].src=yggdrasil
  48. set firewall.@rule[-1].proto=icmp
  49. add_list firewall.@rule[-1].icmp_type=echo-request
  50. add_list firewall.@rule[-1].icmp_type=echo-reply
  51. add_list firewall.@rule[-1].icmp_type=destination-unreachable
  52. add_list firewall.@rule[-1].icmp_type=packet-too-big
  53. add_list firewall.@rule[-1].icmp_type=time-exceeded
  54. add_list firewall.@rule[-1].icmp_type=bad-header
  55. add_list firewall.@rule[-1].icmp_type=unknown-header-type
  56. set firewall.@rule[-1].limit='1000/sec'
  57. set firewall.@rule[-1].family=ipv6
  58. set firewall.@rule[-1].target=ACCEPT
  59. EOF
  60. # allow SSH from yggdrasil zone, needs to be explicitly enabled
  61. uci -q batch <<-EOF >/dev/null
  62. add firewall rule
  63. set firewall.@rule[-1].enabled=0
  64. set firewall.@rule[-1].name='Allow-SSH-yggdrasil'
  65. set firewall.@rule[-1].src=yggdrasil
  66. set firewall.@rule[-1].proto=tcp
  67. set firewall.@rule[-1].dest_port=22
  68. set firewall.@rule[-1].target=ACCEPT
  69. EOF
  70. # allow LuCI access from yggdrasil zone, needs to be explicitly enabled
  71. uci -q batch <<-EOF >/dev/null
  72. add firewall rule
  73. set firewall.@rule[-1].enabled=0
  74. set firewall.@rule[-1].name='Allow-HTTP-yggdrasil'
  75. set firewall.@rule[-1].src=yggdrasil
  76. set firewall.@rule[-1].proto=tcp
  77. set firewall.@rule[-1].dest_port=80
  78. set firewall.@rule[-1].target=ACCEPT
  79. EOF
  80. uci commit firewall
  81. uci commit network
  82. else
  83. :
  84. fi
  85. exit 0