vpnclient_ynh/scripts/config

#!/bin/bash

#=================================================
# GENERIC STARTING
#=================================================
# IMPORT GENERIC HELPERS
#=================================================

source _common.sh
source /usr/share/yunohost/helpers

#=================================================
# MANAGE SCRIPT FAILURE
#=================================================

# Exit if an error occurs during the execution of the script
ynh_abort_if_errors

#=================================================
# RETRIEVE ARGUMENTS
#=================================================

final_path=$(ynh_app_setting_get $app final_path)

set_right() {
    if [ -f $1 ]
    then
        chown $app:$app $1
        chmod go=--- $1
    fi
}

#=================================================
# SPECIFIC GETTERS FOR TOML SHORT KEY
#=================================================

get__status() {
    local service_enabled=$(ynh_app_setting_get $app service_enabled)
    if [ -f "/sys/class/net/tun0/operstate" ] && [ "$(cat /sys/class/net/tun0/operstate)" == "up" ]
    then
        if [ $service_enabled -eq 1 ]
        then
            cat << EOF
style: success
ask:
  en: Your VPN is running :)
EOF
        else
            cat << EOF
style: warning
ask:
  en: Your VPN is running, but it shouldn't !
EOF
        fi
    elif [ $service_enabled -eq 1 ]
    then
        cat << EOF
style: danger
ask:
  en: Your VPN is down !
EOF
    else
        cat << EOF
style: info
ask:
  en: Your VPN is down has expected.
EOF

    fi
}

get__login_user() {
    if [ -s /etc/openvpn/keys/credentials ]
    then
        echo "value: $(sed -n 1p /etc/openvpn/keys/credentials)" 
    else
        echo ""
    fi
}

get__login_passphrase() {
    if [ -s /etc/openvpn/keys/credentials ]
    then
        echo "value: $(sed -n 2p /etc/openvpn/keys/credentials)"
    else
        echo ""
    fi
}


#=================================================
# SPECIFIC VALIDATORS FOR TOML SHORT KEYS
#=================================================
validate__login_user() {

    if grep -q '^\s*auth-user-pass' ${config_file}
    then
        if [[ -z "${login_user}" ]]
        then
            echo 'A Username is needed with this configuration file'
        fi
    fi
}

validate__login_passphrase() {
    if grep -q '^\s*auth-user-pass' ${config_file}
    then
        if [[ -z "${login_passphrase}" ]]
        then
            echo 'A Password is needed with this configuration file'
        fi
    fi
}

validate__crt_server_ca() {
    if grep -q '^\s*ca\s' ${config_file}
    then
        if [[ ! -e "${crt_server_ca}" ]]
        then
            echo "A server CA certificate is needed"
        fi
    fi
}

validate__crt_client() {
    if grep -q '^\s*cert\s' ${config_file}
    then
        if [[ ! -e "${crt_client}" ]]
        then
            echo "A Client certificate is needed with this configuration file"
        fi
    fi
}

validate__crt_client_key() {
    if grep -q '^\s*key\s' ${config_file}
    then
        if [[ ! -e "${crt_client_key}" ]]
        then
            echo "A client private key is needed with this configuration file"
        fi
    fi
}

validate__crt_client_ta() {
    if grep -q '^\s*tls-auth\s' ${config_file}
    then
        if [[ ! -e "${crt_client_ta}" ]]
        then
            echo "A TLS auth shared secret is needed with this configuration file"
        fi
    fi
}

validate__nameservers() {
    if [[ "$dns_method" == "custom" ]] && [[ -z "$nameservers" ]]
    then
        echo "You need to choose DNS resolvers or select an other method to provide DNS resolvers"
    fi
}
#=================================================
# SPECIFIC SETTERS FOR TOML SHORT KEYS
#=================================================
set__login_user() {
    if [ -n "${login_user}" ]
    then
        echo "${login_user}\n${login_passphrase}" > /etc/openvpn/keys/credentials
        set_right /etc/openvpn/keys/credentials
    else
        echo "" > /etc/openvpn/keys/credentials
    fi
}

set__login_passphrase() {
    :
}

#=================================================
# OVERWRITING VALIDATE STEP 
#=================================================
ynh_app_config_validate() {
    tmp_dir=$(dirname "${config_file}")
    # Overwrite form response with cube files data before validation process
    if [ -f "${config_file}" ] && [[ $config_file == *.cube ]]
    then
        ynh_print_info --message="Transforming .cube into OVPN file"
        declare -A settings
        settings[server_name]=""
        settings[server_port]=""
        settings[server_proto]=""
        settings[ip6_net]=""
        settings[login_user]=""
        settings[login_passphrase]=""
        settings[dns0]=""
        settings[dns1]=""
        settings[crt_server_ca]="file"
        settings[crt_client]="file"
        settings[crt_client_key]="file"
        settings[crt_client_ta]="file"

        for setting_name in "${!settings[@]}"
        do
            setting_value="$(jq --raw-output ".$setting_name" "${config_file}")"
            if [[ "$setting_value" == "null" ]]
            then
                setting_value=''
            # Save file in tmp dir
            elif [[ "${settings[$setting_name]}" == "file" ]]
            then
                if [ -n "${settings_value}" ]
                then
                    echo "${setting_value}" | sed 's/|/\n/g' > $tmp_dir/$setting_name
                    setting_value="$tmp_dir/$setting_name"
                fi
            fi

            $setting_name="$setting_value"
        done
        dns_method="custom"
        nameservers="$dns0,$dns1" 
        # Build specific OVPN template
        cp -f /etc/openvpn/client.conf.tpl.restore $tmp_dir/client.conf.tpl
        # Remove some lines
        for rm_regex in "$(jq --raw-output '.openvpn_rm[]' "${config_file}")"
        do
            if [ ! -z "${rm_regex}" ] ; then
                sed -i "/$rm_regex/di" $tmp_dir/client.conf.tpl
            fi
        done

        # Add some other lines
        echo "# Custom" >> $tmp_dir/client.conf.tpl
        jq --raw-output ".openvpn_add[]" "${config_file}" >> $tmp_dir/client.conf.tpl

        # Build directly the OVPN file
        cp /etc/openvpn/client.conf.tpl "${config_file}"
        [ "${settings[server_proto]}" == tcp ] && settings[server_proto]=tcp-client
        sed "s|<TPL:SERVER_NAME>|${settings[server_name]}|g" -i "${config_file}"
        sed "s|<TPL:SERVER_PORT>|${settings[server_port]}|g" -i "${config_file}"
        sed "s|<TPL:PROTO>|${settings[server_proto]}|g" -i "${config_file}"
        if [ -e "${settings[crt_client_key]}" ]; then
            sed 's|^<TPL:CERT_COMMENT>||g' -i "${config_file}"
        else
            sed 's|^<TPL:CERT_COMMENT>|;|g' -i "${config_file}"
        fi
        if [ -e "${settings[crt_client_ta]}" ]; then
            sed 's|^<TPL:TA_COMMENT>||' -i "${config_file}"
        else
            sed 's|^<TPL:TA_COMMENT>|;|' -i "${config_file}"
        fi
        if [[ "${settings[server_proto]}" =~ udp ]]; then
            sed 's|^<TPL:UDP_COMMENT>||' -i "${config_file}"
        else
            sed 's|^<TPL:UDP_COMMENT>|;|' -i "${config_file}"
        fi
        if [ -n "${settings[login_user]}" ]; then
            sed 's|^<TPL:LOGIN_COMMENT>||' -i "${config_file}"
        else
            sed 's|^<TPL:LOGIN_COMMENT>|;|' -i "${config_file}"
        fi


    elif [ -f "${config_file}" ] && [[ "${config_file}" =~ ^.*\.(ovpn|conf)$ ]]
    then
        ynh_print_info --message="Extracting TLS keys from .ovpn file"
        if grep -q '^\s*<ca>' ${config_file}
        then
            grep -Poz '(?<=<ca>)(.*\n)*.*(?=</ca>)' ${config_file} > $tmp_dir/crt_server_ca
            crt_server_ca=$tmp_dir/crt_server_ca
            sed -i '/^\s*<ca>/,/\s*<\/ca>/d' ${config_file}
            sed -i '/^\s*ca\s/d' ${config_file}
            echo "ca /etc/openvpn/keys/ca-server.crt" >> ${config_file}
        else
            crt_server_ca=""
        fi
        if grep -q '^\s*<cert>' ${config_file}
        then
            grep -Poz '(?<=<cert>)(.*\n)*.*(?=</cert>)' ${config_file} > $tmp_dir/crt_client
            crt_client=$tmp_dir/crt_client
            sed -i '/^\s*<cert>/,/\s*<\/cert>/d' ${config_file}
            sed -i '/^\s*cert\s/d' ${config_file}
            echo "cert /etc/openvpn/keys/user.crt" >> ${config_file}
        else
            crt_client=""
        fi
        if grep -q '^\s*<key>' ${config_file}
        then
            grep -Poz '(?<=<key>)(.*\n)*.*(?=</key>)' ${config_file} > $tmp_dir/crt_client_key
            crt_client_key=$tmp_dir/crt_client_key
            sed -i '/^\s*<key>/,/\s*<\/key>/d' ${config_file}
            sed -i '/^\s*key\s/d' ${config_file}
            echo "key /etc/openvpn/keys/user.key" >> ${config_file}
        else
            crt_client_key=""
        fi
        if grep -q '^\s*<tls-auth>' ${config_file}
        then
            grep -Poz '(?<=<tls-auth>)(.*\n)*.*(?=</tls-auth>)' ${config_file} > $tmp_dir/crt_client_ta
            crt_client_ta=$tmp_dir/crt_client_ta
            sed -i '/^\s*<tls-auth>/,/\s*<\/tls-auth>/d' ${config_file}
            sed -i '/^\s*tls-auth\s/d' ${config_file}
            echo "tls-auth /etc/openvpn/keys/user_ta.key 1" >> ${config_file}
        else
            crt_client_ta=""
        fi
        sed -i 's@^\s*ca\s.*$@ca /etc/openvpn/keys/ca-server.crt@g' ${config_file}
        sed -i 's@^\s*cert\s.*$@cert /etc/openvpn/keys/user.crt@g' ${config_file}
        sed -i 's@^\s*key\s.*$@key /etc/openvpn/keys/user.key@g' ${config_file}
        sed -i 's@^\s*tls-auth\s.*$@tls-auth /etc/openvpn/keys/user-ta.key@g' ${config_file}
    fi

    # Restrict permission
    if [ -f "${config_file}" ]
    then
        sed -i '/^\s*user\s/d' ${config_file}
        sed -i '/^\s*group\s/d' ${config_file}
        echo "user vpnclient" >> ${config_file}
        echo "group vpnclient" >> ${config_file}
    fi

    _ynh_app_config_validate
}

#=================================================
# OVERWRITING APPLY STEP 
#=================================================
ynh_app_config_apply() {
    
    # Stop vpn client
    ynh_print_info --message="Stopping vpnclient in order to edit files"
    touch /tmp/.ynh-vpnclient-stopped
    /usr/local/bin/ynh-vpnclient stop

    chown $app:$app /etc/openvpn/keys
    chmod go=--- /etc/openvpn/keys
    
    _ynh_app_config_apply
    
    set_right /etc/openvpn/client.conf
    set_right /etc/openvpn/keys/ca-server.crt
    set_right /etc/openvpn/keys/user.crt
    set_right /etc/openvpn/keys/user.key
    set_right /etc/openvpn/keys/user_ta.key
    
    # Start vpn client
    ynh_print_info --message="Starting vpnclient service if needed"
    /usr/local/bin/ynh-vpnclient start
    rm -f /tmp/.ynh-vpnclient-stopped

}

ynh_app_config_run $1