OpenConnect_macOS_Bar/bibVPN.sh

#!/bin/bash

# Get current status of a VPN connection with options to connect/disconnect.
# Working with OpenConnect, but can work with any executable VPN. Commands
# that require admin permissions should be whitelisted with 'visudo', e.g.:
#
#joesmith ALL=(ALL) NOPASSWD: /usr/local/bin/openconnect
#joesmith ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect

# <xbar.title>VPN Status</xbar.title>
# <xbar.version>v1.1</xbar.version>
# <xbar.author>Jesse Jarzynka</xbar.author>
# <xbar.author.github>jessejoe</xbar.author.github>
# <xbar.desc>Displays status of a VPN interface with option to connect/disconnect.</xbar.desc>
# <xbar.image>http://i.imgur.com/RkmptwO.png</xbar.image>
###################
#### Variables ####
###################
WORKDIR="/Users/$USER/.openconnect"
mkdir -p $WORKDIR
logfile="$WORKDIR/bibVPN.log"
echo -e "\nStart: $(date)" >>$logfile
echo "Run $0 $@" >> $logfile
PATH=$PATH:/usr/local/bin
VPN_EXECUTABLE=$(which openconnect)
OC_PIDFILE="$WORKDIR/vpn.bib.de.pid"
SETTINGSFILE="$WORKDIR/settings.csv"
ACCOUNTFILE="$WORKDIR/accounts.csv"
VPN_USERNAME="$2"
VPN_HOST="$3"
# A command that will result in your VPN password.
GET_VPN_PASSWORD="security find-generic-password -g -a $VPN_USERNAME 2>&1 >/dev/null | cut -d'\"' -f2"
# Command to determine if VPN is connected or disconnected
VPN_CONNECTED="ifconfig | egrep -A1 '$NET_FILTER' |cut -d' ' -f2"
# Command to run to disconnect VPN
VPN_DISCONNECT_CMD="sudo killall -2 openconnect"
# Get IP of Current VPN Tunnel
IP=$(ifconfig | egrep -A1 "$NET_FILTER" |cut -d' ' -f2)

#### Settings ####
SHOW_SETTINGS='OFF'
SET_ICONS='no'
NET_FILTER='inet 172.[123][0-9].1[67][80].'
FONT=( 'size=14' 'font=UbuntuMono' )

#### Icons ####
ICON_connected="iVBORw0KGgoAAAANSUhEUgAAABgAAAAWCAYAAAGtemweAAAACXBIWXMAAAsSAAALEgHS3X78AAAA+klEQVR4nNRUwQ2DMAzMKy8WYIZOwb8LtUtAJSZp34zBCn3y4Y3cWLEr13KSllKhnnRKcvHZ4AScS6BJbUSMgRCncfJcaBG0KMcvMIj83ircWcUh9VTI46onO1A75sC2FIjpT0qHwMUy4AZSzuU6a7D2smDzLRu1Fi11aKRGJOHVyzKHlGExXu5MmlkJ6HpfRHbWx5SBR+tMtjNYOuQMfGV5Lecm8HSLQf8BH9iLC2BxoRiM/Qi9SnSlS1MRG9VLIM/bH4NM7Cgp/rImYkeaU4XQW8QsDBVpk9GeSRRnDb1FyCSWVtovYpcCtZG83rLALzwvuKskSNT2xwMAAP//L6vzxgAAAAJJREFUAwBX1u55AAAAAElFTkSuQmCC"
ICON_disconnected="iVBORw0KGgoAAAANSUhEUgAAABgAAAAWCAYAAAGtemweAAAACXBIWXMAAAsSAAALEgHS3X78AAAA2klEQVR4nNxTQQ6DMAyrqvGAXfeK7Uh5wHbgyhlxaP//hDXClbLOXUHqhDZLFsGJEzUUYwq4lBIrpsiwhirQEDHxRSw69mFU/a1OJNHh+ZYILMHibThjHUtkXyuU9tdMD5GeGSQh1LF+/2hguQPRY0MTFlGEzQ6bOJYMnhzuBo1OCrjejqx0KhnSk32TdgamhyaGP4SNHNQFYPSokdpdGLJGd1yaDpT4kdWIZ/PPoBsLTriRM+igmWyQeKtYlKGDNpP1iGZQkzTxVqGbMK2Wr+KQAU09Xx/wW3gCAAD//+SvwXMAAAACSURBVAMAV9bueQAAAABJRU5ErkJggg=="

###################
#### Functions ####
###################
function askFor(){
    osascript=$1+' buttons {"Cancel","OK"} default button {"OK"} with title "Neuen User für das VPN anlegen"'
    results=$( /usr/bin/osascript -e $osascript)

    theButton=$( echo "$results" | /usr/bin/awk -F "button returned:|," '{print $2}' )
    theText=$( echo "$results" | /usr/bin/awk -F "text returned:" '{print $2}' )

    if [[ $theButton == "OK" ]] ;then
        echo $theText;
    fi
}

function showSettings()
{
    if [[ $SHOW_SETTINGS == "ON" ]]; then
        echo "---"
        echo "Settings"
        echo "--$SETTINGSFILE"
        echo "--Farbige Icons aus"
        echo "--Tunnelblick Icons aus"
        echo "--Neuen User anlegen| shell='$0' param1=newuser terminal=false refresh=true"
    fi
}
###################
###### MAIN #######
###################
case "$1" in
    connect)
        VPN_PASSWORD=$(eval "$GET_VPN_PASSWORD")
        # Passwort checken
        #if [[ -z VPN_PASSWORD ]]; then VPN_PASSWORD=$(askFor 'display dialog "Es ist kein Passwort im Schlüsselbund vorhanden. Wie lautet das Passwort? " default answer "vpn.bib.de"'); fi
        #security add-generic-password -a $VPN_USERNAME -s openconnect -w $keychainPW
        VPN_EXECUTABLE_PARAMS="--servercert $4 --protocol=fortinet" # Optional

        # Verbindung aufbauen
        echo "echo <pseudeoPW> | sudo $VPN_EXECUTABLE $VPN_EXECUTABLE_PARAMS --user $VPN_USERNAME --passwd-on-stdin $VPN_HOST --pid-file=$OC_PIDFILE --background" > $logfile 2>&1
        echo "$VPN_PASSWORD" | sudo $VPN_EXECUTABLE $VPN_EXECUTABLE_PARAMS --user $VPN_USERNAME --passwd-on-stdin $VPN_HOST --pid-file=$OC_PIDFILE --background > $logfile 2>&1
        IP=$(ifconfig | egrep -A1 "$NET_FILTER" |cut -d' ' -f2)
        while [ -z $IP ]; do echo "noch keine IP" ; sleep 0.5 ; IP=$(ifconfig | egrep -A1 "$NET_FILTER"|cut -d' ' -f2) ; done
        msg='display notification "Erfolgreich verbunden \nConnected User: '$VPN_USERNAME'" with title "OpenFortiVPN" subtitle "Deine IP lautet: '$IP'" sound name "Brise"'
        errmsg='display notification "Verbindungsversuch nicht erfolgreich" with title "OpenFortiVPN" subtitle "Schade" sound name "Brise"'
        if  [[ $IP =~ 172 ]] ; then osascript -e "$msg" ; else osascript -e "$errmsg" ; fi
        # Wait for connection so menu item refreshes instantly
        until eval "$VPN_CONNECTED"; do sleep 1; done
        ;;
    disconnect)
        eval "$VPN_DISCONNECT_CMD"
        # Wait for disconnection so menu item refreshes instantly
        until [ -z "$(eval "$VPN_CONNECTED")" ]; do sleep 1; done
        osascript -e 'display notification "VPN Tunnel erfolgreich geschlossen" with title "OpenFortiVPN" subtitle "Mach Feierabend" sound name "Submarine"'
        ;;
    newuser)
        echo "Sie wollen einen weiteren Benutzer für das VPN anlegen. Geben Sie dazu die folgenden Dinge ein."
        #echo -n "Wie lautet der Name der neuen Verbindung? " ; read NEW_VPN_NAME
        NEW_VPN_NAME=$(askFor 'display dialog "Wie lautet die E-Mail des Benutzers, der zum Verbinden verwendet werden soll?" default answer "vorname.nachname@bib.de"' )
        NEW_VPN_HOST=$(askFor 'display dialog "Wie lautet der Servername?" default answer "vpn.bib.de"')
        echo -n "Wie lautet der VPN-Server? "; read NEW_VPN_HOST
        echo -n "Wie lautet die E-Mail des Benutzers? " ; read NEW_VPN_USERNAME
        NEW_VPN_PUBKEY=$(gnutls-cli --print-cert $NEW_VPN_HOST |grep -e 'pin-.*:'|awk '{$1=$1;print}')
        NEW_VPN_PASSWORD=$(security find-generic-password -g -a $NEW_VPN_USERNAME 2>&1 >/dev/null)
        if [[ $NEW_VPN_PASSWORD =~ password ]] ; then
            echo "Es ist bereits ein Passwort im Schlüsselbund für $NEW_VPN_USERNAME hinterlegt."
        else
            echo -n "Es ist noch kein Passwort im Schlüsselbund hinterlegt Bitte einmal das Passwort angeben : " ;
            NEW_VPN_PASS = $(read )
            security add-generic-password -a $NEW_VPN_USERNAME -s openconnect -w $NEW_VPN_PASS
        fi
        echo "$NEW_VPN_NAME,$NEW_VPN_USERNAME,$NEW_VPN_HOST,$NEW_VPN_PUBKEY" #>> $ACCOUNTFILE
        ;;
esac

#if [ -n "$(eval "$VPN_CONNECTED")" ]; then
if [ -f $OC_PIDFILE ]; then
    if [ $SET_ICONS == 'yes' ]; then echo "| templateImage=$ICON_connected" ; else echo "VPN ✔ |$FONT color=green" ; fi
    echo '---'
    echo "Disconnect VPN | bash='$0' param1=disconnect terminal=false refresh=true"
    aUser=$(ps -ef | grep -e '--user\ ' | cut -d' ' -f 32)
    if [[ $aUser =~ .*@.* ]]; then echo "User: $aUser" ; fi
    echo "IP: $IP"
    showSettings
    exit
else
    if [ $SET_ICONS == 'yes' ] ; then echo "| templateImage=$ICON_disconnected" ; else echo "VPN ❌ | $FONT color=Crimson" ; fi
    echo '---'
    # Alle User aus der accounts.csv auslesen und dann zur Auswahl anbieten.
    cat "$ACCOUNTFILE" | while IFS= read config; 
    do
        [[ $config =~ ^#.* ]] && continue
        cfgName=$(echo $config|cut -d',' -f1)
        cfgMail=$(echo $config|cut -d',' -f2)
        cfgHost=$(echo $config|cut -d',' -f3)
        cfgPubKey=$(echo $config|cut -d',' -f4)
        echo "Connect $cfgName VPN | shell='$0' param1=connect param2=$cfgMail param3=$cfgHost param4=$cfgPubKey terminal=false refresh=true"
    done
    showSettings
    exit
fi