428 lines
12 KiB
Bash
Executable File
428 lines
12 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# general dependencies:
|
|
# bash (to run this script)
|
|
# util-linux (for getopt)
|
|
# hostapd
|
|
# iproute2
|
|
# iw
|
|
# haveged (optional)
|
|
|
|
# dependencies for 'nat' or 'none' Internet sharing method
|
|
# dnsmasq
|
|
# iptables
|
|
|
|
# dependencies for 'bridge' Internet sharing method
|
|
# bridge-utils
|
|
# dhclient
|
|
|
|
usage() {
|
|
echo "Usage: $(basename $0) [options] <wifi-interface> [<interface-with-internet>] [<access-point-name> [<passphrase>]]"
|
|
echo
|
|
echo "Options:"
|
|
echo " -h, --help Show this help"
|
|
echo " -c <channel> Channel number (default: 1)"
|
|
echo " -w <WPA version> Use 1 for WPA, use 2 for WPA2, use 1+2 for both (default: 1+2)"
|
|
echo " -n Disable Internet sharing (if you use this, don't pass"
|
|
echo " the <interface-with-internet> argument)"
|
|
echo " -m <method> Method for Internet sharing."
|
|
echo " Use: 'nat' for NAT (default)"
|
|
echo " 'bridge' for bridging"
|
|
echo " 'none' for no Internet sharing (equivalent to -n)"
|
|
echo " --hidden Make the Access Point hidden (do not broadcast the SSID)"
|
|
echo " --driver Choose your WiFi adapter driver (default: nl80211)"
|
|
echo
|
|
echo "Non-Bridging Options:"
|
|
echo " -g <gateway> IPv4 Gateway for the Access Point (default: 192.168.12.1)"
|
|
echo " -d DNS server will take into account /etc/hosts"
|
|
echo
|
|
echo "Useful informations:"
|
|
echo " * You can create an AP with the same interface you are getting your Internet connection."
|
|
echo " * You can pass your SSID and password through pipe or through arguments (see examples)."
|
|
echo
|
|
echo "Examples:"
|
|
echo " $(basename $0) wlan0 eth0 MyAccessPoint MyPassPhrase"
|
|
echo " echo -e 'MyAccessPoint\nMyPassPhrase' | $(basename $0) wlan0 eth0"
|
|
echo " $(basename $0) wlan0 eth0 MyAccessPoint"
|
|
echo " echo 'MyAccessPoint' | $(basename $0) wlan0 eth0"
|
|
echo " $(basename $0) wlan0 wlan0 MyAccessPoint MyPassPhrase"
|
|
echo " $(basename $0) -n wlan0 MyAccessPoint MyPassPhrase"
|
|
echo " $(basename $0) -m bridge wlan0 eth0 MyAccessPoint MyPassPhrase"
|
|
echo " $(basename $0) --driver rtl871xdrv wlan0 eth0 MyAccessPoint MyPassPhrase"
|
|
}
|
|
|
|
get_macaddr() {
|
|
ip link show "$1" | grep ether | grep -Eo '([0-9a-f]{2}:){5}[0-9a-f]{2}[[:space:]]' | tr -d '[[:space:]]'
|
|
}
|
|
|
|
get_avail_bridge() {
|
|
for i in {0..100}; do
|
|
curr_bridge=$(brctl show | grep "br$i" | cut -s -f1)
|
|
if [[ -z $curr_bridge ]]; then
|
|
echo "br$i"
|
|
return
|
|
fi
|
|
done
|
|
}
|
|
|
|
get_new_macaddr() {
|
|
OLDMAC=$(get_macaddr "$1")
|
|
for i in {20..255}; do
|
|
NEWMAC="${OLDMAC%:*}:$(printf %02x $i)"
|
|
(ip link | grep "ether ${NEWMAC}" > /dev/null 2>&1) || break
|
|
done
|
|
echo $NEWMAC
|
|
}
|
|
|
|
ADDED_UNMANAGED=0
|
|
NETWORKMANAGER_CONF=/etc/NetworkManager/NetworkManager.conf
|
|
|
|
networkmanager_add_unmanaged() {
|
|
[[ ! -f ${NETWORKMANAGER_CONF} ]] && return
|
|
if [[ -z "$2" ]]; then
|
|
MAC=$(get_macaddr "$1")
|
|
else
|
|
MAC="$2"
|
|
fi
|
|
UNMANAGED=$(grep -m1 -Eo "^unmanaged-devices=.*" ${NETWORKMANAGER_CONF})
|
|
[[ $UNMANAGED == *mac:${MAC}* ]] && return
|
|
echo -n "Network Manager config found, set $1 as unmanaged device... "
|
|
grep -E '^\[keyfile\]' ${NETWORKMANAGER_CONF} > /dev/null 2>&1 || echo -e '\n\n[keyfile]' >> ${NETWORKMANAGER_CONF}
|
|
if [[ -z ${UNMANAGED} ]]; then
|
|
sed -e "s/^\(\[keyfile\].*\)$/\1\nunmanaged-devices=mac:${MAC}/" -i ${NETWORKMANAGER_CONF}
|
|
else
|
|
NEW_UNMANAGED=$(echo "${UNMANAGED}" | sed -e "s/^\([[:alnum:]=:;-]*\)/\1;mac:${MAC}/")
|
|
sed -e "s/^${UNMANAGED}/${NEW_UNMANAGED}/" -i ${NETWORKMANAGER_CONF}
|
|
fi
|
|
ADDED_UNMANAGED=1
|
|
sleep 2
|
|
echo "DONE"
|
|
}
|
|
|
|
networkmanager_rm_unmanaged() {
|
|
[[ $ADDED_UNMANAGED -eq 0 ]] && return
|
|
[[ ! -f ${NETWORKMANAGER_CONF} ]] && return
|
|
if [[ -z "$2" ]]; then
|
|
MAC=$(get_macaddr "$1")
|
|
else
|
|
MAC="$2"
|
|
fi
|
|
UNMANAGED=$(grep -m1 -Eo "^unmanaged-devices=.*" ${NETWORKMANAGER_CONF})
|
|
if [[ $UNMANAGED != *\;* ]]; then
|
|
sed -e "/^unmanaged-devices=mac:${MAC}/d" -i ${NETWORKMANAGER_CONF}
|
|
else
|
|
NEW_UNMANAGED=$(echo ${UNMANAGED} | sed -e "s/;mac:${MAC}//")
|
|
sed -e "s/^${UNMANAGED}/${NEW_UNMANAGED}/" -i ${NETWORKMANAGER_CONF}
|
|
fi
|
|
sleep 2
|
|
}
|
|
|
|
CHANNEL=1
|
|
GATEWAY=192.168.12.1
|
|
WPA_VERSION=1+2
|
|
ETC_HOSTS=0
|
|
HIDDEN=0
|
|
SHARE_METHOD=nat
|
|
DRIVER=nl80211
|
|
|
|
CONFDIR=
|
|
VWIFI_IFACE=
|
|
INTERNET_IFACE=
|
|
BRIDGE_IFACE=
|
|
OLD_IP_FORWARD=
|
|
OLD_BRIDGE_IPTABLES=
|
|
OLD_MACADDR=
|
|
|
|
cleanup() {
|
|
echo
|
|
echo "Doing cleanup..."
|
|
|
|
# exiting
|
|
for x in $CONFDIR/*.pid; do
|
|
# even if the $CONFDIR is empty, the for loop will assign
|
|
# a value in $x. so we need to check if the value is a file
|
|
[[ -f $x ]] && kill -9 $(cat $x)
|
|
done
|
|
rm -rf $CONFDIR
|
|
|
|
if [[ "$SHARE_METHOD" != "none" ]]; then
|
|
if [[ "$SHARE_METHOD" == "nat" ]]; then
|
|
iptables -t nat -D POSTROUTING -o ${INTERNET_IFACE} -j MASQUERADE
|
|
iptables -D FORWARD -i ${VWIFI_IFACE} -s ${GATEWAY%.*}.0/24 -j ACCEPT
|
|
iptables -D FORWARD -i ${INTERNET_IFACE} -d ${GATEWAY%.*}.0/24 -j ACCEPT
|
|
[[ -n $OLD_IP_FORWARD ]] && echo $OLD_IP_FORWARD > /proc/sys/net/ipv4/ip_forward
|
|
elif [[ "$SHARE_METHOD" == "bridge" ]]; then
|
|
ip link set down $BRIDGE_IFACE
|
|
brctl delbr $BRIDGE_IFACE
|
|
[[ -n $OLD_BRIDGE_IPTABLES ]] && echo $OLD_BRIDGE_IPTABLES > /proc/sys/net/bridge/bridge-nf-call-iptables
|
|
fi
|
|
fi
|
|
|
|
if [[ "$SHARE_METHOD" != "bridge" ]]; then
|
|
iptables -D INPUT -p tcp -m tcp --dport 53 -j ACCEPT
|
|
iptables -D INPUT -p udp -m udp --dport 53 -j ACCEPT
|
|
iptables -D INPUT -p udp -m udp --dport 67 -j ACCEPT
|
|
fi
|
|
|
|
ip link set down dev ${VWIFI_IFACE}
|
|
ip addr flush ${VWIFI_IFACE}
|
|
networkmanager_rm_unmanaged ${VWIFI_IFACE} ${OLD_MACADDR}
|
|
iw dev ${VWIFI_IFACE} del
|
|
}
|
|
|
|
die() {
|
|
[[ -n "$1" ]] && echo -e "\nERROR: $1\n"
|
|
cleanup
|
|
exit 1
|
|
}
|
|
|
|
# if the user press ctrl+c then execute die()
|
|
trap "die" SIGINT
|
|
|
|
ARGS=$(getopt -o hc:w:g:dnm: -l "help","hidden","driver:" -n $(basename $0) -- "$@")
|
|
[[ $? -ne 0 ]] && exit 1
|
|
eval set -- "$ARGS"
|
|
|
|
while :; do
|
|
case "$1" in
|
|
-h|--help)
|
|
usage
|
|
exit 1
|
|
;;
|
|
--hidden)
|
|
shift
|
|
HIDDEN=1
|
|
;;
|
|
-c)
|
|
shift
|
|
CHANNEL="$1"
|
|
shift
|
|
;;
|
|
-w)
|
|
shift
|
|
WPA_VERSION="$1"
|
|
shift
|
|
;;
|
|
-g)
|
|
shift
|
|
GATEWAY="$1"
|
|
shift
|
|
;;
|
|
-d)
|
|
shift
|
|
ETC_HOSTS=1
|
|
;;
|
|
-n)
|
|
shift
|
|
SHARE_METHOD=none
|
|
;;
|
|
-m)
|
|
shift
|
|
SHARE_METHOD="$1"
|
|
shift
|
|
;;
|
|
--driver)
|
|
shift
|
|
DRIVER="$1"
|
|
shift
|
|
;;
|
|
--)
|
|
shift
|
|
break
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ $# -lt 1 ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $(id -u) -ne 0 ]]; then
|
|
echo "You must run it as root."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$SHARE_METHOD" != "nat" && "$SHARE_METHOD" != "bridge" && "$SHARE_METHOD" != "none" ]]; then
|
|
echo "ERROR: Wrong Internet sharing method"
|
|
echo
|
|
usage
|
|
exit 1
|
|
fi
|
|
|
|
WIFI_IFACE=$1
|
|
VWIFI_IFACE=${WIFI_IFACE}ap
|
|
WIFI_IFACE_CHANNEL=$(iw ${WIFI_IFACE} info | grep channel | awk '{print $2}')
|
|
|
|
if [[ -n $WIFI_IFACE_CHANNEL && $WIFI_IFACE_CHANNEL -ne $CHANNEL ]]; then
|
|
echo "hostapd will fail to use channel $CHANNEL because $WIFI_IFACE is already set to channel $WIFI_IFACE_CHANNEL, fallback to channel $WIFI_IFACE_CHANNEL."
|
|
CHANNEL=$WIFI_IFACE_CHANNEL
|
|
fi
|
|
|
|
if [[ "$SHARE_METHOD" == "bridge" ]]; then
|
|
OLD_BRIDGE_IPTABLES=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables)
|
|
BRIDGE_IFACE=$(get_avail_bridge)
|
|
if [[ -z $BRIDGE_IFACE ]]; then
|
|
echo "ERROR: No availabe bridges < br100"
|
|
exit 1
|
|
fi
|
|
elif [[ "$SHARE_METHOD" == "nat" ]]; then
|
|
OLD_IP_FORWARD=$(cat /proc/sys/net/ipv4/ip_forward)
|
|
fi
|
|
|
|
if [[ "$SHARE_METHOD" != "none" ]]; then
|
|
MIN_REQUIRED_ARGS=2
|
|
else
|
|
MIN_REQUIRED_ARGS=1
|
|
fi
|
|
|
|
if [[ $# -gt $MIN_REQUIRED_ARGS ]]; then
|
|
if [[ "$SHARE_METHOD" != "none" ]]; then
|
|
if [[ $# -ne 3 && $# -ne 4 ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
INTERNET_IFACE=$2
|
|
SSID=$3
|
|
PASSPHRASE=$4
|
|
else
|
|
if [[ $# -ne 2 && $# -ne 3 ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
SSID=$2
|
|
PASSPHRASE=$3
|
|
fi
|
|
else
|
|
if [[ "$SHARE_METHOD" != "none" ]]; then
|
|
if [[ $# -ne 2 ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
INTERNET_IFACE=$2
|
|
fi
|
|
if tty -s; then
|
|
read -p "SSID: " SSID
|
|
while :; do
|
|
read -p "Passphrase: " -s PASSPHRASE
|
|
echo
|
|
read -p "Retype passphrase: " -s PASSPHRASE2
|
|
echo
|
|
if [[ "$PASSPHRASE" != "$PASSPHRASE2" ]]; then
|
|
echo "Passphrases do not match."
|
|
else
|
|
break
|
|
fi
|
|
done
|
|
else
|
|
read SSID
|
|
read PASSPHRASE
|
|
fi
|
|
fi
|
|
|
|
CONFDIR=$(mktemp -d /tmp/create_ap.${WIFI_IFACE}.conf.XXXXXXXX)
|
|
echo "Config dir: $CONFDIR"
|
|
|
|
echo -n "Creating a virtual WiFi interface... "
|
|
iw dev ${VWIFI_IFACE} del > /dev/null 2>&1
|
|
if iw dev ${WIFI_IFACE} interface add ${VWIFI_IFACE} type __ap; then
|
|
echo "${VWIFI_IFACE} created."
|
|
else
|
|
die "Failed to create a virtual WiFi interface from ${WIFI_IFACE}."
|
|
fi
|
|
|
|
OLD_MACADDR=$(get_macaddr ${VWIFI_IFACE})
|
|
NEW_MACADDR=$(get_new_macaddr ${VWIFI_IFACE})
|
|
networkmanager_add_unmanaged ${VWIFI_IFACE}
|
|
|
|
[[ $HIDDEN -eq 1 ]] && echo "Access Point's SSID is hidden!"
|
|
|
|
# hostapd config
|
|
cat << EOF > $CONFDIR/hostapd.conf
|
|
ssid=${SSID}
|
|
interface=${VWIFI_IFACE}
|
|
driver=${DRIVER}
|
|
hw_mode=g
|
|
channel=${CHANNEL}
|
|
|
|
ctrl_interface=$CONFDIR/hostapd_ctrl
|
|
ctrl_interface_group=0
|
|
ignore_broadcast_ssid=$HIDDEN
|
|
EOF
|
|
|
|
if [[ -n "$PASSPHRASE" ]]; then
|
|
[[ "$WPA_VERSION" == "1+2" || "$WPA_VERSION" == "2+1" ]] && WPA_VERSION=3
|
|
cat << EOF >> $CONFDIR/hostapd.conf
|
|
wpa=${WPA_VERSION}
|
|
wpa_passphrase=$PASSPHRASE
|
|
wpa_key_mgmt=WPA-PSK
|
|
wpa_pairwise=TKIP
|
|
rsn_pairwise=CCMP
|
|
EOF
|
|
fi
|
|
|
|
if [[ "$SHARE_METHOD" == "bridge" ]]; then
|
|
echo "bridge=${BRIDGE_IFACE}" >> $CONFDIR/hostapd.conf
|
|
else
|
|
# dnsmasq config (dhcp + dns)
|
|
cat << EOF > $CONFDIR/dnsmasq.conf
|
|
interface=${VWIFI_IFACE}
|
|
bind-interfaces
|
|
dhcp-range=${GATEWAY%.*}.1,${GATEWAY%.*}.254,255.255.255.0,24h
|
|
dhcp-option=option:router,${GATEWAY}
|
|
EOF
|
|
[[ $ETC_HOSTS -eq 0 ]] && echo no-hosts >> $CONFDIR/dnsmasq.conf
|
|
fi
|
|
|
|
# initialize WiFi interface
|
|
ip link set dev ${VWIFI_IFACE} address ${NEW_MACADDR} || die
|
|
ip link set down dev ${VWIFI_IFACE} || die
|
|
ip addr flush ${VWIFI_IFACE} || die
|
|
if [[ "$SHARE_METHOD" != "bridge" ]]; then
|
|
ip link set up dev ${VWIFI_IFACE} || die
|
|
ip addr add ${GATEWAY}/24 broadcast ${GATEWAY%.*}.255 dev ${VWIFI_IFACE} || die
|
|
fi
|
|
|
|
# enable Internet sharing
|
|
if [[ "$SHARE_METHOD" != "none" ]]; then
|
|
echo "Sharing Internet using method: $SHARE_METHOD"
|
|
if [[ "$SHARE_METHOD" == "nat" ]]; then
|
|
iptables -t nat -I POSTROUTING -o ${INTERNET_IFACE} -j MASQUERADE || die
|
|
iptables -I FORWARD -i ${VWIFI_IFACE} -s ${GATEWAY%.*}.0/24 -j ACCEPT || die
|
|
iptables -I FORWARD -i ${INTERNET_IFACE} -d ${GATEWAY%.*}.0/24 -j ACCEPT || die
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward || die
|
|
elif [[ "$SHARE_METHOD" == "bridge" ]]; then
|
|
# disable iptables rules for bridged interfaces
|
|
echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables || die
|
|
# create and initialize bridged interface
|
|
brctl addbr ${BRIDGE_IFACE} || die
|
|
brctl addif ${BRIDGE_IFACE} ${INTERNET_IFACE} || die
|
|
dhclient -pf $CONFDIR/dhclient.pid ${BRIDGE_IFACE} || die
|
|
fi
|
|
else
|
|
echo "No Internet sharing"
|
|
fi
|
|
|
|
# boost low-entropy
|
|
if [[ $(cat /proc/sys/kernel/random/entropy_avail) -lt 1000 ]]; then
|
|
which haveged > /dev/null 2>&1 && {
|
|
haveged -w 1024 -p $CONFDIR/haveged.pid
|
|
}
|
|
fi
|
|
|
|
# start dns + dhcp server
|
|
if [[ "$SHARE_METHOD" != "bridge" ]]; then
|
|
iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT || die
|
|
iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT || die
|
|
iptables -I INPUT -p udp -m udp --dport 67 -j ACCEPT || die
|
|
dnsmasq -C $CONFDIR/dnsmasq.conf -x $CONFDIR/dnsmasq.pid || die
|
|
fi
|
|
|
|
# start access point
|
|
echo "hostapd command-line interface: hostapd_cli -p $CONFDIR/hostapd_ctrl"
|
|
trap - SIGINT # reset trap
|
|
hostapd $CONFDIR/hostapd.conf || die "Failed to run hostapd, maybe a program is interfering."
|
|
|
|
cleanup
|
|
exit 0
|