net/travelmate/files/travelmate.vpn

   1 #!/bin/sh
   2 # vpn switch for travelmate
   3 # Copyright (c) 2020 Dirk Brenken (dev@brenken.org)
   4 # This is free software, licensed under the GNU General Public License v3.
   5
   6 # set (s)hellcheck exceptions
   7 # shellcheck disable=1091,2016,2039,2059,2086,2143,2181,2188
   8
   9 # Please note: you have to setup the package 'wireguard' or 'openvpn' before using this script
  10
  11 LC_ALL=C
  12 PATH="/usr/sbin:/usr/bin:/sbin:/bin"
  13
  14 . "/lib/functions.sh"
  15 trm_action="${1}"
  16 trm_vpnservice="$(uci_get travelmate global trm_vpnservice)"
  17 trm_vpniface="$(uci_get travelmate global trm_vpniface)"
  18 trm_landevice="$(uci_get travelmate global trm_landevice)"
  19 trm_maxwait="$(uci_get travelmate global trm_maxwait "30")"
  20 trm_captiveurl="$(uci_get travelmate global trm_captiveurl "http://captive.apple.com")"
  21 trm_useragent="$(uci_get travelmate global trm_useragent "Mozilla/5.0 (Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0")"
  22 trm_iptrule_accept="FORWARD -i ${trm_landevice} -p tcp  --match multiport --dports 80,443 -j ACCEPT"
  23 trm_iptrule_drop="FORWARD -i ${trm_landevice} -j DROP"
  24 trm_iptables="$(command -v iptables)"
  25 trm_logger="$(command -v logger)"
  26 trm_fetch="$(command -v curl)"
  27
  28 f_log()
  29 {
  30         local class="${1}" log_msg="${2}"
  31
  32         if [ -x "${trm_logger}" ]
  33         then
  34                 "${trm_logger}" -p "${class}" -t "trm-vpn  [${$}]" "${log_msg}"
  35         else
  36                 printf "%s %s %s\\n" "${class}" "trm-vpn  [${$}]" "${log_msg}"
  37         fi
  38 }
  39
  40 f_net()
  41 {
  42         local IFS json_raw json_rc result="net nok"
  43
  44         json_raw="$(${trm_fetch} --user-agent "${trm_useragent}" --referer "http://www.example.com" --write-out "%{json}" --silent --show-error --connect-timeout $((trm_maxwait/10)) "${trm_captiveurl}" 2>/dev/null)"
  45         json_raw="${json_raw#*\{}"
  46         if [ -n "${json_raw}" ]
  47         then
  48                 json_rc="$(printf "%s" "{${json_raw}" | jsonfilter -l1 -e '@.response_code' 2>/dev/null)"
  49                 if [ "${json_rc}" = "200" ] || [ "${json_rc}" = "204" ]
  50                 then
  51                         result="net ok"
  52                 fi
  53         fi
  54         printf "%s" "${result}"
  55 }
  56
  57 if [ -n "${trm_vpnservice}" ] && [ -n "${trm_vpniface}" ] && [ -n "${trm_landevice}" ] && [ -f "/tmp/trm_runtime.json" ]
  58 then
  59         status="$(jsonfilter -i "/tmp/trm_runtime.json" -l1 -e '@.data.travelmate_status' 2>/dev/null)"
  60         vpn_status="$(ubus -S call network.interface."${trm_vpniface}" status 2>/dev/null | jsonfilter -l1 -e '@.up')"
  61         if [ "${trm_action}" = "disable" ] && [ "${vpn_status}" = "true" ]
  62         then
  63                 if [ -n "$("${trm_iptables}" "-w $((trm_maxwait/6))" -C ${trm_iptrule_drop} 2>&1)" ]
  64                 then
  65                         "${trm_iptables}" "-w $((trm_maxwait/6))" -I ${trm_iptrule_drop} 2>&1
  66                         f_log "info" "lan forward blocked for device '${trm_landevice}'"
  67                 fi
  68                 if [ "${status%% (net cp *}" = "connected" ]
  69                 then
  70                         if [ -n "$("${trm_iptables}" "-w $((trm_maxwait/6))" -C ${trm_iptrule_accept} 2>&1)" ]
  71                         then
  72                                 "${trm_iptables}" "-w $((trm_maxwait/6))" -I ${trm_iptrule_accept} 2>&1
  73                                 f_log "info" "lan forward on ports 80/443 freed for device '${trm_landevice}'"
  74                         fi
  75                 fi
  76         fi
  77
  78         case "${trm_vpnservice}" in
  79                 "wireguard")
  80                         if [ "${trm_action}" = "enable" ] && [ "${vpn_status}" != "true" ]
  81                         then
  82                                 ubus call network.interface."${trm_vpniface}" up
  83                         elif [ "${trm_action}" = "disable" ] && [ "${vpn_status}" = "true" ]
  84                         then
  85                                 ubus call network.interface."${trm_vpniface}" down
  86                                 f_log "info" "${trm_vpnservice} client connection disabled"
  87                         fi
  88                 ;;
  89                 "openvpn")
  90                         if [ "${trm_action}" = "enable" ] && [ "${vpn_status}" != "true" ]
  91                         then
  92                                 ubus call network.interface."${trm_vpniface}" up
  93                                 /etc/init.d/openvpn restart >/dev/null 2>&1
  94                         elif [ "${trm_action}" = "disable" ] && [ "${vpn_status}" = "true" ]
  95                         then
  96                                 ubus call network.interface."${trm_vpniface}" down
  97                                 /etc/init.d/openvpn stop >/dev/null 2>&1
  98                                 f_log "info" "${trm_vpnservice} client connection disabled"
  99                         fi
 100                 ;;
 101         esac
 102
 103         if [ "${trm_action}" = "enable" ] && [ "${vpn_status}" != "true" ]
 104         then
 105                 cnt=0
 106                 while true
 107                 do
 108                         vpn_status="$(ubus -S call network.interface."${trm_vpniface}" status 2>/dev/null | jsonfilter -l1 -e '@.up')"
 109                         if [ "${vpn_status}" = "true" ]
 110                         then
 111                                 net_status="$(f_net)"
 112                                 if [ "${net_status}" = "net ok" ]
 113                                 then
 114                                         f_log "info" "${trm_vpnservice} client connection enabled"
 115                                         if [ -z "$("${trm_iptables}" "-w $((trm_maxwait/6))" -C ${trm_iptrule_drop} 2>&1)" ]
 116                                         then
 117                                                 "${trm_iptables}" "-w $((trm_maxwait/6))" -D ${trm_iptrule_drop} 2>&1
 118                                                 if [ -z "$("${trm_iptables}" "-w $((trm_maxwait/6))" -C ${trm_iptrule_accept} 2>&1)" ]
 119                                                 then
 120                                                         "${trm_iptables}" "-w $((trm_maxwait/6))" -D ${trm_iptrule_accept} 2>&1
 121                                                 fi
 122                                                 f_log "info" "lan forward freed for device '${trm_landevice}'"
 123                                         fi
 124                                         if [ -f "/etc/init.d/sysntpd" ]
 125                                         then
 126                                                 /etc/init.d/sysntpd restart >/dev/null 2>&1
 127                                         fi
 128                                         break
 129                                 fi
 130                         fi
 131                         if [ "${cnt}" -ge "$((trm_maxwait/6))" ]
 132                         then
 133                                 f_log "info" "${trm_vpnservice} restart failed, lan forward for device '${trm_landevice}' still blocked"
 134                                 ubus call network.interface."${trm_vpniface}" down
 135                                 break
 136                         fi
 137                         sleep 1
 138                         cnt="$((cnt+1))"
 139                 done
 140         fi
 141 fi