#!/bin/bash

# Get current status of a VPN connection with options to connect/disconnect.
# Working with OpenConnect, but can work with any executable VPN. Commands
# that require admin permissions should be whitelisted with 'visudo', e.g.:
#
#joesmith ALL=(ALL) NOPASSWD: /usr/local/bin/openconnect
#joesmith ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect

# <xbar.title>VPN Status</xbar.title>
# <xbar.version>v1.2</xbar.version>
# <xbar.author>Thomas Schmauder</xbar.author>
# <xbar.author.github>itssct</xbar.author.github>
# <xbar.desc>Displays status of a VPN interface with option to connect/disconnect.</xbar.desc>
# <xbar.image>http://i.imgur.com/RkmptwO.png</xbar.image>
# <xbar.dependencies>openconnect</xbar.dependencies>
# <xbar.about>https://git.bib.de/itssct/OpenFortiVPN_macOS</xbar.about>
# <swiftbar.hideAbout>true</swiftbar.hideAbout>
# <swiftbar.hideRunInTerminal>true</swiftbar.hideRunInTerminal>
# <swiftbar.hideLastUpdated>false</swiftbar.hideLastUpdated>
# <swiftbar.hideDisablePlugin>true</swiftbar.hideDisablePlugin>
# <swiftbar.hideSwiftBar>true</swiftbar.hideSwiftBar>
###################
#### Variables ####
###################
VERSION=1.2.1
WORKDIR="/Users/$USER/.openconnect"
mkdir -p $WORKDIR
logfile="$WORKDIR/bibVPN.log"
echo -e "\nStart: $(date)" >>$logfile
echo "Run $0 $@" >> $logfile
PATH=$PATH:/usr/local/bin
VPN_EXECUTABLE=$(which openconnect)
OC_PIDFILE="$WORKDIR/vpn.bib.de.pid"
SETTINGSFILE="$WORKDIR/settings.csv"
ACCOUNTFILE="$WORKDIR/accounts.csv"
VPN_USERNAME="$2"
VPN_HOST="$3"

#### Settings ####
SHOW_SETTINGS='ON'
SHOW_ICONS='ON'
NET_FILTER='inet 172.[123][0-9].1[67][80].'
FONT=( 'size=14' 'font=UbuntuMono' )


# A command that will result in your VPN password.
GET_VPN_PASSWORD="security find-generic-password -g -a $VPN_USERNAME 2>&1 >/dev/null | cut -d'\"' -f2"
# Command to determine if VPN is connected or disconnected
VPN_CONNECTED="ifconfig | egrep -A1 '$NET_FILTER' |cut -d' ' -f2"
# Command to run to disconnect VPN
VPN_DISCONNECT_CMD="sudo killall -2 openconnect"

# Get IP of Current VPN Tunnel
IP=$(ifconfig | egrep -A1 "$NET_FILTER" |cut -d' ' -f2)

###################
#### Functions ####
###################
function askFor(){
    osascript="$1 buttons {\"Cancel\",\"OK\"} default button {\"OK\"} with title \"Neuen User für das VPN anlegen\""
    echo $osascript
    results=$( /usr/bin/osascript -e "$osascript")

    theButton=$( echo "$results" | /usr/bin/awk -F "button returned:|," '{print $2}' )
    theText=$( echo "$results" | /usr/bin/awk -F "text returned:" '{print $2}' )

    if [[ $theButton == "OK" ]] ;then
        echo $theText;
    fi
}

function showSettings()
{
    if [[ $SHOW_SETTINGS == "ON" ]]; then
        echo "---"
        echo "Settings"
        echo "--$SETTINGSFILE"
        echo "--Farbige Icons aus (not ready)"
        echo "--Neuen User anlegen| shell='$0' param1=newuser terminal=true refresh=true"
        echo "---"
        echo "--$(basename -- "$0") v$VERSION"
    fi
}
###################
###### MAIN #######
###################
case "$1" in
    connect)
        VPN_PASSWORD=$(eval "$GET_VPN_PASSWORD")
        # Passwort checken
        #if [[ -z VPN_PASSWORD ]]; then VPN_PASSWORD=$(askFor 'display dialog "Es ist kein Passwort im Schlüsselbund vorhanden. Wie lautet das Passwort? " default answer "vpn.bib.de"'); fi
        #security add-generic-password -a $VPN_USERNAME -s openconnect -w $keychainPW
        VPN_EXECUTABLE_PARAMS="--servercert $4 --protocol=fortinet" # Optional

        # Verbindung aufbauen
        echo "echo <pseudeoPW> | sudo $VPN_EXECUTABLE $VPN_EXECUTABLE_PARAMS --user $VPN_USERNAME --passwd-on-stdin $VPN_HOST --pid-file=$OC_PIDFILE --background" > $logfile 2>&1
        echo "$VPN_PASSWORD" | sudo $VPN_EXECUTABLE $VPN_EXECUTABLE_PARAMS --user $VPN_USERNAME --passwd-on-stdin $VPN_HOST --pid-file=$OC_PIDFILE --background > $logfile 2>&1
        IP=$(ifconfig | egrep -A1 "$NET_FILTER" |cut -d' ' -f2)
        while [ -z $IP ]; do echo "noch keine IP" ; sleep 0.5 ; IP=$(ifconfig | egrep -A1 "$NET_FILTER"|cut -d' ' -f2) ; done
        msg='display notification "Erfolgreich verbunden \nConnected User: '$VPN_USERNAME'" with title "OpenFortiVPN" subtitle "Deine IP lautet: '$IP'" sound name "Brise"'
        errmsg='display notification "Verbindungsversuch nicht erfolgreich" with title "OpenFortiVPN" subtitle "Schade" sound name "Brise"'
        if  [[ $IP =~ 172 ]] ; then osascript -e "$msg" ; else osascript -e "$errmsg" ; fi
        # Wait for connection so menu item refreshes instantly
        until eval "$VPN_CONNECTED"; do sleep 1; done
        ;;
    disconnect)
        eval "$VPN_DISCONNECT_CMD"
        # Wait for disconnection so menu item refreshes instantly
        until [ -z "$(eval "$VPN_CONNECTED")" ]; do sleep 1; eval "$VPN_CONNECTED" ;done
        osascript -e 'display notification "VPN Tunnel erfolgreich geschlossen" with title "OpenFortiVPN" subtitle "Mach Feierabend" sound name "Submarine"'
        ;;
    newuser)
        echo "Sie wollen einen weiteren Benutzer für das VPN anlegen. Geben Sie dazu die folgenden Dinge ein."
        askFor 'display dialog "Sie wollen einen weiteren Benutzer für das VPN anlegen. Geben Sie dazu die folgenden Dinge ein."'
        NEW_VPN_NAME=$(askFor 'display dialog "Wie soll die neue Verbindung heißen?" default answer "bib | eduUP | FHDW"' )
        NEW_VPN_USERNAME=$(askFor 'display dialog "Wie lautet die E-Mail des Benutzers, der zum Verbinden verwendet werden soll?" default answer "vorname.nachname@bib.de"' )
        NEW_VPN_HOST=$(askFor 'display dialog "Wie lautet der Servername?" default answer "vpn.bib.de"')
        if [[ -z $NEW_VPN_NAME ]] ; then echo -n "Wie lautet der Name der neuen Verbindung? " ; read NEW_VPN_NAME ; fi
        if [[ -z $NEW_VPN_HOST ]] ; then echo -n "Wie lautet der VPN-Server? "; read NEW_VPN_HOST ; fi
        if [[ -z $NEW_VPN_USERNAME ]] ; then echo -n "Wie lautet die E-Mail des Benutzers? " ; read NEW_VPN_USERNAME ; fi

        NEW_VPN_PUBKEY=$(gnutls-cli --print-cert $NEW_VPN_HOST |grep -e 'pin-.*:'|awk '{$1=$1;print}')
        NEW_VPN_PASSWORD=$(security find-generic-password -g -a $NEW_VPN_USERNAME 2>&1 >/dev/null)
        if [[ $NEW_VPN_PASSWORD =~ password ]] ; then
            echo "Es ist bereits ein Passwort im Schlüsselbund für $NEW_VPN_USERNAME hinterlegt."
        else
            echo -n "Es ist noch kein Passwort im Schlüsselbund hinterlegt Bitte einmal das Passwort angeben : " ;
            NEW_VPN_PASS = $(read )
            security add-generic-password -a $NEW_VPN_USERNAME -s openconnect -w $NEW_VPN_PASS
        fi
        echo "$NEW_VPN_NAME,$NEW_VPN_USERNAME,$NEW_VPN_HOST,$NEW_VPN_PUBKEY" #>> $ACCOUNTFILE
        ;;
esac

if [ -f $OC_PIDFILE ]; then
    if [ $SHOW_ICONS == 'ON' ]; then echo "| sfimage=firewall.fill | sfcolor=green" ; else echo "VPN ✔ |$FONT color=green" ; fi
    echo '---'
    echo "Disconnect VPN | bash='$0' param1=disconnect terminal=false refresh=true"
    aUser=$(ps -ef | grep -e '--user\ ' | cut -d' ' -f 32)
    if [[ $aUser =~ .*@.* ]]; then echo "User: $aUser" ; fi
    echo "IP: $IP"
    echo "Verbunden seit: $(stat $OC_PIDFILE | cut -d'"' -f4)"
    showSettings
    exit
else
    if [ $SHOW_ICONS == 'ON' ] ; then echo "| sfimage=firewall" ; else echo "VPN ❌ | $FONT color=Crimson" ; fi
    echo '---'
    # Alle User aus der accounts.csv auslesen und dann zur Auswahl anbieten.
    cat "$ACCOUNTFILE" | while IFS= read config; 
    do
        [[ $config =~ ^#.* ]] && continue
        cfgName=$(echo $config|cut -d',' -f1)
        cfgMail=$(echo $config|cut -d',' -f2)
        cfgHost=$(echo $config|cut -d',' -f3)
        cfgPubKey=$(echo $config|cut -d',' -f4)
        echo "Connect $cfgName VPN | shell='$0' param1=connect param2=$cfgMail param3=$cfgHost param4=$cfgPubKey terminal=false refresh=true"
    done
    showSettings
    exit
fi