#!/bin/bash

OPTION=$1

if [ -z $OPTION ]
then
	echo "Please use:"
	echo "./whonix_vpn.sh start"
	echo "./whonix_vpn.sh stop"
	
elif [ $OPTION == "start" ]
then
	echo "Startins..."
	if [ ! `id -u` = 0 ] ; then
			echo "This script needs to be run using 'sudo SCRIPT' or in 'root terminal'"
	  read -n1 -r -p "Press any key to exit..." key
	  exit 1
	fi
	
	if [ ! -f /sbin/resolvconf ]
	then
	  echo
	  echo
	  echo "    **********************  OpenVPN install  **********************"
	  echo
	  apt-get update
	  apt-get install -y resolvconf firefox-esr
	fi
	
	  echo
	  echo
	  echo "    **********************  OpenVPN install  **********************"
	  echo
	  apt-get update
	  apt-get purge openvpn -y
	  
	OPENVPN_F=`echo openvpn*`
	if [ ! -f $OPENVPN_F ]; then
	    echo "File openvpn not found!"
	fi

	LIBLZO_F=`echo liblzo*`
	if [ ! -f $LIBLZO_F ]; then
	    echo "File liblzo not found!"
	fi

	LIBPK_F=`echo libpkcs*`
	if [ ! -f $LIBPK_F ]; then
	    echo "File libpkcs not found!"
	fi
	LIBSSL_F=`echo libssl*`
	if [ ! -f $LIBSSL_F ]; then
	    echo "File libssl not found!"
	fi

	dpkg -i $LIBSSL_F
	dpkg -i $LIBPK_F
	dpkg -i $LIBLZO_F
	dpkg -i $OPENVPN_F
	
	if [[ ! $(cat /usr/local/etc/whonix_firewall.d/50_user.conf| grep "vpnsn") ]]
	then
	  sudo mkdir -p /usr/local/etc/whonix_firewall.d
	  echo "WORKSTATION_FIREWALL=1" > /usr/local/etc/whonix_firewall.d/50_user.conf
	  echo "TUNNEL_FIREWALL_ENABLE=true" >> /usr/local/etc/whonix_firewall.d/50_user.conf
	  echo "#vpnsn" >> /usr/local/etc/whonix_firewall.d/50_user.conf
	fi
	
	if [[ ! $(cat /etc/sudoers.d/tunnel_unpriv | grep "vpnsn") ]]
	then
	  echo "tunnel ALL=(ALL) NOPASSWD: /bin/ip" > /etc/sudoers.d/tunnel_unpriv
	  echo "tunnel ALL=(ALL) NOPASSWD: /usr/sbin/openvpn *" >> /etc/sudoers.d/tunnel_unpriv
	  
	  echo "Defaults:tunnel !requiretty" >> /etc/sudoers.d/tunnel_unpriv
	  echo "Defaults:tunnel env_keep += script_type" >> /etc/sudoers.d/tunnel_unpriv
	  echo "Defaults:tunnel env_keep += dev" >> /etc/sudoers.d/tunnel_unpriv
	  echo "#vpnsn" >> /etc/sudoers.d/tunnel_unpriv
	fi
	
	if [[ ! $(cat /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf | grep "vpnsn") ]]
	then
	  echo "d /run/openvpn 0775 tunnel tunnel - -" > /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf
	  echo "d /run/resolvconf 0775 root tunnel - -" >> /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf
	  
	  echo "d /run/resolvconf/interface 0775 root tunnel - -" >> /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf
	  echo "#vpnsn" >> /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf
	fi
	
	
	cp *.crt *.key vpn.ovpn auth.txt /etc/openvpn
	
	cd /etc/openvpn
	
	cp vpn.ovpn openvpn.conf
	
	rm vpn.ovpn
	
	if [[ ! $(cat /etc/openvpn/openvpn.conf | grep "auth.txt") ]]
	then
	  sed -i -e 's/auth-user-pass/auth-user-pass auth.txt/g' /etc/openvpn/openvpn.conf
	fi
	
	if [[ ! $(cat /etc/openvpn/openvpn.conf | grep "tun0") ]]
	then
	  sed -i -e 's/dev tun/dev tun0/g' /etc/openvpn/openvpn.conf
	fi
	
	if [[ ! $(cat /etc/openvpn/openvpn.conf | grep "user tunnel") ]]
	then
	  echo "user tunnel" >> /etc/openvpn/openvpn.conf
	fi
	
	if [[ ! $(cat /etc/openvpn/openvpn.conf | grep "ip_unpriv") ]]
	then
	  echo "iproute /usr/bin/ip_unpriv" >> /etc/openvpn/openvpn.conf
	fi
	
	if [[ ! $(cat /etc/openvpn/openvpn.conf | grep "update-resolv-conf") ]]
	then
	  echo "#up \"/etc/openvpn/update-resolv-conf script_type=up dev=tun0\"" >> /etc/openvpn/openvpn.conf
	  echo "#down \"/etc/openvpn/update-resolv-conf script_type=down dev=tun0\"" >> /etc/openvpn/openvpn.conf
	fi

	rm /etc/resolv.conf
	touch /etc/resolv.conf

	if [[ ! $(cat /etc/resolv.conf | grep "10.8.1.1") ]]
	then
	  echo "nameserver 10.8.1.1" > /etc/resolv.conf
	  echo "nameserver 10.8.0.1" >> /etc/resolv.conf
	fi

	chattr +i /etc/resolv.conf
	
	if [[ ! $(cat /etc/whonix.d/50_user.conf | grep "vpnsn") ]]
	then
		
		echo "whonixcheck_skip_functions+=\" check_tor_bootstrap \"" > /etc/whonix.d/50_user.conf 
		echo "whonixcheck_skip_functions+=\" check_tor_socks_port_reachability \"" >> /etc/whonix.d/50_user.conf 
		echo "whonixcheck_skip_functions+=\" check_tor_socks_port \"" >> /etc/whonix.d/50_user.conf 
		echo "whonixcheck_skip_functions+=\" check_tor_trans_port \"" >> /etc/whonix.d/50_user.conf 
		echo "whonixcheck_skip_functions+=\" check_stream_isolation \"" >> /etc/whonix.d/50_user.conf 
		echo "whonixcheck_skip_functions+=\" download_whonix_news \"" >> /etc/whonix.d/50_user.conf 
	    echo "" >> /etc/whonix.d/50_user.conf
		
		echo "## {{ Alternative to disabling check_tor_trans_port." >> /etc/whonix.d/50_user.conf
		echo "#CHECK_TOR_RESULT_SOCKS_PORT=0" >> /etc/whonix.d/50_user.conf
		echo "#WHONIXCHECK_NO_EXIT_ON_TRANS_PORT_DETECTION_FAILURE=1" >> /etc/whonix.d/50_user.conf
		echo "## }}" >> /etc/whonix.d/50_user.conf
		echo "## {{ Alternative to download_whonix_news." >> /etc/whonix.d/50_user.conf
		echo "#CURL_PROXY_WHONIX_NEWS="--fail"" >> /etc/whonix.d/50_user.conf
		echo "## }}" >> /etc/whonix.d/50_user.conf
		echo "#vpnsn" >> /etc/whonix.d/50_user.conf
	fi
	
	
	chown --recursive root:tunnel /run/resolvconf
	chmod --recursive 775 /run/resolvconf

	chown -R tunnel:tunnel /etc/openvpn
	
	chown -R tunnel:tunnel /run/openvpn
	
	whonix_firewall
	
	sudo cp /lib/systemd/system/openvpn@.service /lib/systemd/system/openvpn@openvpn.service

	systemctl enable openvpn@openvpn
	
	systemctl start openvpn@openvpn
	

	
	
	  echo
	  echo
	  echo "    **********************  VPN Success CONNECTED  **********************"
	  echo

	
elif [ $OPTION == "stop" ]
then
	echo "Stopping..."
	

	rm /usr/local/etc/whonix_firewall.d/50_user.conf
	
	rm /etc/sudoers.d/tunnel_unpriv

	chattr -i /etc/resolv.conf

	rm /etc/resolv.conf
	
	rm /usr/lib/tmpfiles.d/50_openvpn_unpriv.conf
	
	rm /etc/whonix.d/50_user.conf
	
	cd /etc/openvpn
	rm  *.crt *.key openvpn.conf auth.txt
	
	systemctl disable openvpn@openvpn
	
	service openvpn@openvpn stop

	echo
	  echo
	  echo "    **********************  VPN Success DELETED  **********************"
	  echo
fi
