#!/bin/bash
green="\e[32m"
red="\e[31m"
blue="\e[34m"
norm="\e[0m"
#IFS='\n'
hostname="$(hostname)"
export LOG_DIR="/home/lucas/.LOG"
export VPN_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/VPN/"
export SCRIPTS_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/scripts"
ls ${SCRIPTS_DIR} >>/dev/null 2>&1
if [ $? -ne 0 ]; then
	export VPN_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/VPN/"
	export SCRIPTS_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/scripts"
	ls ${SCRIPTS_DIR} >>/dev/null 2>&1
	if [ $? -ne 0 ]; then
		echo "Script Dir Not present"
		exit
	fi
fi
 
date=$(date +"%m%d%H%M%S")
SINGLE=false
EXPRESSVPN=false
SHARKVPN=true
LOG=false
DELUGE_MODE=false
GATEWAY_MODE=false
NORMAL_MODE=false;
QUIT=false;
LIST=false
usage(){
	printf "Usage:
	-n\t\tNormal Mode
	-del\t\tDeluge Mode	
	-list\t\tList ovpn Files
	-all\t\tUse all Files(FreeVPN)
	-std\t\tTry a default vpn first
	-gw\t\tGateway Mode(Raspberry)
	-q\t\tQuit VPN
	-l\t\tLog Output
	-s <param>\tSearch Mode
	-tu\t\tConnect to TU Wien VPN
	-tud\t\tDisconnect from TU Wien VPN
	-h\t\tHelp\n"
}

display_ip() {
	if [ "$1" == "duser" ]; then
		OBJ_duser_cmd="sudo -u deluge-user -i -- "
	else
		OBJ_duser_cmd=""
	fi
	echo whoami
	OBJ_USER=$(${OBJ_duser_cmd}whoami)
	OBJ_PUB_COUNTRY="Austria"
	count=0
        while true; do
	        sleep 1
		OBJ_PUBIP=$(${OBJ_duser_cmd}wget -T 10 -qO- ifconfig.co)
		OBJ_PUB_COUNTRY=$(${OBJ_duser_cmd}wget -T 10 -qO- ifconfig.co/country)
	       	if [[ "${DELUGE_MODE}" == "true" ]] || [[ "${OBJ_PUB_COUNTRY}" != "Austria" ]] && [[ "${OBJ_PUB_COUNTRY}" != "" ]] || [[ "${OBJ_PUBIP}" != "${STDIP}" ]] && [[ "${OBJ_PUBIP}" != "" ]];  then
			break
		fi
		printf ". "
		if [ ${count} -gt 20 ]; then
			echo "Timeout... VPN Failed"
			break
		fi
		((count++))
	done
	printf "User: ${OBJ_USER}"
	for ((i=${#OBJ_USER};i<20;i++)); do
		printf " "
	done
	printf "IP: $OBJ_PUBIP\tCountry: $OBJ_PUB_COUNTRY\n"
}
connect_tuwien() {
if [  "$(pgrep openvpn)" != "" ]; then
		printf "VPN already existing --- Killed\n"
		kill $(pgrep openvpn)
		sleep 1
		pgrep openvpn
	fi
	printf "VPN \t\t\t\t[${green}DOWN${norm}]\n"
	if [ $(/opt/cisco/anyconnect/bin/vpn state | grep Disconnected | wc -l) -gt 0 ]; then
		sudo -u lucas /opt/cisco/anyconnect/bin/vpn -s < /home/lucas/.vpn_creds connect vpn.tuwien.ac.at
		echo "Disconnect with vpn -tud"
	else
		echo "TU VPN not disconnected"
	fi
}
disconnect_tuwien() {
	/opt/cisco/anyconnect/bin/vpn disconnect
	/home/lucas/Documents/Dokumente/Projekte/Server/scripts/network/networksettings.sh -std
}
get_config() {
while [[ ${1:0:1} == - ]]; do
        echo "Param: $1"
    	[[ $1 == -n ]] && {
                                NORMAL_MODE=true;
                                shift 1;
                                continue;
                        };    
		[[ $1 == -del ]] && {
                                DELUGE_MODE=true;
                                shift 1;
                                continue;
                        };
        [[ $1 == -std ]] && {
                                SINGLE=true
				SEARCH="austria"
                                shift 1;
                                continue;
                        };
        [[ $1 == -list ]] && {
                                LIST=true;
                                shift 1;
                                continue;
                        };
        [[ $1 == -all ]] && {
                                EXPRESSVPN=false;
                                shift 1;
                                continue;
                        };
        [[ $1 == -gw ]] && {
                                GATEWAY_MODE=true;
                                shift 1;
                                continue;
                        };
        [[ $1 == -q ]] && {
                                QUIT=true;
                                shift 1;
                                continue;
                        };
        [[ $1 == -l ]] && {
                                LOG=true;
                                shift 1;
                                continue;
                        };
        [[ $1 == -h ]] && {
                                usage;
         			exit;
	 		};
		[[ $1 == -tu ]] && {
                                connect_tuwien;
         			exit;
	 		};
		[[ $1 == -tud ]] && {
                                disconnect_tuwien;
         			exit;
	 		};
	[[ $1 == -s ]] && {
                                if [ "$2" == "" ]; then 
					echo "Search Parameter Missing"
					usage;
					exit;
				fi
				SINGLE=true;
				SEARCH="$2"
                                shift 2;
                                continue;
                        };
	echo "Parameter $1 wrong"
	usage
	exit 1;
done
}

connect_vpn() {
	export STDIP=$(wget -T 10 -qO- ifconfig.co)
	export NETIF="$(lshw -class network | grep -A6 "Ethernet interface" | grep name | awk -F': ' '{print $2}')"
	if [ "${hostname}" == "raspberry" ]; then 
		export NETIF="$(lshw -class network | grep -A6 "Wireless interface" | grep name | awk -F': ' '{print $2}')"
	fi
	find ${LOG_DIR}/log_* -mtime +1 -type f -delete
	1>${LOG_DIR}/log_${hostname}_$date.log
	IFS=$'\n'; set -f
	if $EXPRESSVPN; then
		SEARCH_EXPRESS="my_expressvpn_"
	elif $SHARKVPN; then
		SEARCH_EXPRESS="surfshark"
	else 
		SEARCH_EXPRESS=""
	fi
	if $SINGLE; then 
		VPN_arr=($(find ${VPN_DIR} -name '*.ovpn' | grep "${SEARCH_EXPRESS}" | grep -i "${SEARCH}"))
		filename="${VPN_arr[0]}"
	else
		VPN_arr=($(find ${VPN_DIR} -name '*.ovpn' | grep "${SEARCH_EXPRESS}"))
		NUM=$(($RANDOM % ${#VPN_arr[@]}))
		filename="${VPN_arr[${NUM}]}"
	fi
	unset IFS; set +f
	export PUBIP=($(dig +short $(cat $filename | grep "remote " | cut -d' ' -f2)))
	if [  "$(pgrep openvpn)" != "" ]; then
		printf "VPN already existing --- Killed\n"
		kill $(pgrep openvpn)
		sleep 1
		pgrep openvpn
	fi
	printf "VPN \t\t\t\t[${green}DOWN${norm}]\n"

	while [ -z ${VPNIF} ] && [ ${#VPN_arr[@]} -ge 1 ] ; do
		printf "OpenVPN: Connect to: $blue$( echo $filename | rev | cut -f1 -d'/' | rev)${norm}, ${NUM} of ${#VPN_arr[@]} VPNs\n"
		if $DELUGE_MODE; then
			filename_buffer="$(echo ${filename} | sed 's/\.ovpn/BUFF.ovpn/g')"
			 if $EXPRESSVPN; then
				cat ${filename} | grep -v 'pull' | sed 's/dev tun/client\ndev tun/g' | sed 's/<cert>/route-nopull\nscript-security 2\ndown '$(echo ${SCRIPTS_DIR} | sed 's/\//\\\//g')'\/network\/rev_routing.sh\n<cert>/g' > ${filename_buffer}
			 elif $SHARKVPN; then
				cat ${filename} | grep -v 'pull' | sed 's/<ca>/route-nopull\nscript-security 2\ndown '$(echo ${SCRIPTS_DIR} | sed 's/\//\\\//g')'\/network\/rev_routing.sh\n<ca>/g' > ${filename_buffer}
			 fi
			filename=${filename_buffer}
		fi
		if ${LOG}; then
			exec  3>&1 4>&2 1>>${LOG_DIR}/log_${hostname}_$date.log  2>&1
		fi
		echo "${SCRIPTS_DIR}/network/openvpn.sh $filename"
		bash ${SCRIPTS_DIR}/network/openvpn.sh $filename  
#		if ${LOG}; then
#			exec 1>&3 2>&4
#		fi
		
		printf "Load tun interface " 
		count=0
		while [ -z ${VPNIF} ] && [ -z ${VPNIP} ] && [ -z ${P2PIP} ];  do
			sleep 1
			export VPNIF="$(ip -br link | cut -f1 -d' ' | grep -o tun[0-9])"
			if [ ! -z ${VPNIF} ]; then
			      export VPNIP=$(ip addr show ${VPNIF} | grep -Po '(?<=inet )([0-9\.]+)')
			      export P2PIP=$(ip addr show ${VPNIF} | grep -Po '(?<=peer )([0-9\.]+)')
			      export P2PIP=$VPNIP
			fi
			printf ". "
			if [ ${count} -gt 20 ]; then 
				echo "Timeout... VPN Failed"
				break
			fi
			((count++))
		done
		echo ""	
		echo "VPN IF: ${VPNIF}, VPN IP: ${VPNIP}, P2P IP: ${P2PIP}"
		export MARK_ID="0x32"
		export VPNIF="$(ip -br link | cut -f1 -d' ' | grep -o tun[0-9])"
		export VPNUSER="deluge-user"
		export LOCALIP=$(ip addr show ${NETIF} | grep -Po '(?<= inet )([0-9\.]+)')
		if [ ! -z ${VPNIF} ]; then
			export VPNIP=$(ip addr show ${VPNIF} | grep -Po '(?<=inet )([0-9\.]+)')
			export P2PIP=$(ip addr show ${VPNIF} | grep -Po '(?<=peer )([0-9\.]+)')
			export P2PIP=$VPNIP
		fi
		

		if [ -z ${VPNIF} ] || [ -z ${VPNIP} ]; then
			if ${LOG}; then
				exec 1>&3 2>&4
			fi
			echo "VPN IF: ${VPNIF}, VPN IP: ${VPNIP}, P2P IP: ${P2PIP}"
			printf "VPN\t\t\t\t[${red}FAIL${norm}]\n"
			unset VPN_arr[${NUM}]
			VPN_arr=("${VPN_arr[@]}")
			if [ ${#VPN_arr[@]} -lt 1 ]; then break; fi
			NUM=$(($RANDOM % ${#VPN_arr[@]}))
			filename="${VPN_arr[$NUM]}"	
			echo "VPN arr size: ${#VPN_arr[@]}, NUM: $NUM, filename: $filename"	
			pkill openvpn
		fi
		if ${DELUGE_MODE}; then 
			rm ${filename_buffer}
			if [ "$(ls $(echo ${filename_buffer} | rev | cut -f2- -d'/' | rev) | grep "BUFF\.ovpn")" != "" ]; then 			
				rm $(echo ${filename_buffer} | rev | cut -f2- -d'/' | rev)/*BUFF.ovpn
			fi
		fi
	done

	if [ -z ${VPNIF} ] || [ -z ${VPNIP} ] ; then
		printf "VPN\t\t\t\t[${red}FAIL${norm}]\n"
		printf "VPN Script failed: IF: ${VPNIF}\n" >>${LOG_DIR}/log_${hostname}_$date.log
		pkill openvpn
		exit 0
	fi

	printf "VPN\t\t\t\t[${green}OK${norm}]\n"

	if ${DELUGE_MODE}; then 
		printf "${LOCALIP} at ${NETIF}\n"  >>${LOG_DIR}/log_${hostname}_$date.log
		printf "${VPNIP} at VPN IP: ${VPNIF} and P2P IP: ${P2PIP}, User: $VPNUSER, Mark ID: $MARK_ID\n" >>${LOG_DIR}/log_${hostname}_$date.log
		for PUB_IP_ADDR in ${PUBIP[@]}; do
			echo "Public VPN IP: ${PUB_IP_ADDR}" >>${LOG_DIR}/log_${hostname}_$date.log
		done
		printf "${VPNIF}: ${VPNIP}\n";
		if ${LOG}; then
			exec  3>&1 4>&2 1>>${LOG_DIR}/log_${hostname}_$date.log  2>&1
		fi
		printf "Execute IPTables.sh\n"
		bash ${SCRIPTS_DIR}/network/iptables_basic.sh -deluge-mode #>>${LOG_DIR}/log_${hostname}_$date.log
		printf "Execute routing.sh\n"
		bash ${SCRIPTS_DIR}/network/routing.sh #>>${LOG_DIR}/log_${hostname}_$date.log
		printf "Modified IP Route List\n"
		ip route list
		printf "Modified ip route list table deluge-user\n"
		ip route list table deluge-user

		printf "Set reverse path source validation to lose mode\n"
		sysctl_var=("net.ipv4.conf.all.rp_filter" "net.ipv4.conf.default.rp_filter" "net.ipv4.conf.${VPNIF}.rp_filter" "net.ipv4.conf.lo.rp_filter" "net.ipv4.conf.${NETIF}.rp_filter")
		for ((i=0;i<${#sysctl_var[@]};i++)); do
			echo $1: ${sysctl_var[$i]}, $(sysctl -n ${sysctl_var[$i]})
			if [ $(sysctl -n ${sysctl_var[$i]}) -ne 2 ]; then
				echo $i
				sysctl -w ${sysctl_var[$i]}=2
			fi
		done
		if ${LOG}; then
			exec 1>&3 2>&4
		fi
		printf "IPtables:\t\t\t[${green}OK${norm}]\n"
		printf "IProute:\t\t\t[${green}OK${norm}]\n"
		printf "RPFilter:\t\t\t[${green}OK${norm}]\n"

		if [ "$userIP" != "$duserIP" ] && [ "$duserIP" != "" ] ; then
		printf "VPN Settings:\t\t\t[${green}OK${norm}]\n$(whoami)IP: $userIP\nduserIP: $duserIP \n"
		fi

		printf "deluged service:\t\t"
		if [ "$(ps -elf | grep deluged | grep 'deluge-+')" == "" ]; then
			sudo -u deluge-user -i -- deluged
			sleep 0.3
			if [ $(ip addr | grep "127.0.0.2" | wc -l) -eq 0 ]; then
				ip addr add 127.0.0.2 dev lo 
			fi
		fi
		if [ "$(pgrep deluged)" != "" ]; then 
			printf "[${blue}UP${norm}]\n"
		else
			printf "[${red}FAIL${norm}]\n"
		fi
	elif ${GATEWAY_MODE}; then
		SUBNETIF="eth0"
		sysctl -w net.ipv4.ip_forward=1
		iptables -t nat -A POSTROUTING -o ${VPNIF} -j MASQUERADE
		iptables -A FORWARD -i ${SUBNETIF} -o ${VPNIF} -j ACCEPT
		iptables -A FORWARD -i ${VPNIF} -o ${SUBNETIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
		iptables -D FORWARD -i eth0 -o wlan0 -j ACCEPT
		iptables -D FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
		printf "${VPNIP} at VPN IP: ${VPNIF} \nP2P IP: ${P2PIP}\nUser: $VPNUSER\n"
		for PUB_IP_ADDR in ${PUBIP[@]}; do
			echo "Public VPN IP: ${PUB_IP_ADDR}"
		done
		printf "${VPNIF}: ${VPNIP}\n";
	else 
		printf "${VPNIP} at VPN IP: ${VPNIF}\nP2P IP: ${P2PIP}\nUser: $VPNUSER\n"
		for PUB_IP_ADDR in ${PUBIP[@]}; do
                        echo "Public VPN IP: ${PUB_IP_ADDR}"
                done
		printf "${VPNIF}: ${VPNIP}\n";
		printf "IF: ${NETIF}\n"
	fi
}

printf "Timestamp: $date\n" 
get_config "$@"
if { [ "${NORMAL_MODE}" == "false" ] && [ "${DELUGE_MODE}" == "false" ] && [ "${GATEWAY_MODE}" == "false" ]; } || [ $# -eq 0 ]; then 
	echo "No Mode Argument passed, choose by host"
	if [ "$(hostname)" == "quiethost" ]; then
		NORMAL_MODE=true
	fi 
	if [ "$(hostname)" == "serverhost" ]; then
		DELUGE_MODE=true
	fi 
	if [ "$(hostname)" == "raspberry" ]; then
		GATEWAY_MODE=true
	fi 
fi
if ${QUIT}; then 
	if [  "$(pgrep openvpn)" == "" ]; then
		printf "VPN not active\n"
	else
		echo "Disable VPN"
		pkill openvpn
		su - lucas -c "bash ${SCRIPTS_DIR}/profile_motd2.sh"
	fi
	display_ip
	exit 0
fi
if ${LIST}; then 
	find ${VPN_DIR} -name '*.ovpn'
	exit
fi
if ${DELUGE_MODE} && [ "$(hostname)" != "serverhost" ]; then 
	echo "Deluge Mode"
	printf "Hostname is %s, continue?(y/*)" "$(hostname)" 
	read -t 10 -n 1 choice
	if [ "$choice" != "y" ]; then
		printf "\nAbort\n"
		exit
	fi
elif ${DELUGE_MODE}; then
	printf "${blue}Deluge Mode${norm}\n"
fi	
if ${GATEWAY_MODE} && [ "$(hostname)" != "raspberry" ]; then 
	echo "Gateway Mode"
	printf "Hostname is %s, continue?(y/*)" "$(hostname)" 
	read -t 10 -n 1 choice
	if [ "$choice" != "y" ]; then
		printf "\nAbort\n"
		exit
	fi
elif ${GATEWAY_MODE}; then
	printf "${blue}Gateway Mode${norm}\n"
fi
if ${NORMAL_MODE}; then
	printf "${blue}Normal Mode${norm}\n"
fi
connect_vpn
sleep 2
display_ip

if ${DELUGE_MODE}; then
	display_ip "duser"
	if [[ "$(ps -elf | grep -v grep | grep noip)" == "" ]] ; then
		if [[ "$(service noip-duc status | grep 'active (running)')" == "" ]]; then
			#/usr/local/bin/noip2 &
			# Install noip service
			#
			echo "Install noip service"
		fi
	fi
elif ${GATEWAY_MODE}; then
	if [ "$(hostname)" == "quiethost" ]; then
		bash "${SCRIPTS_DIR}/profile_motd2.sh"
	fi 
fi
if [ "$(hostname)" == "quiethost" ]; then
	su - lucas -c "bash ${SCRIPTS_DIR}/quiethost/servertunnel.sh"
fi