pia-tools

#!/bin/bash
# Description: Script to automate privateinternetacces port forwarding and
# starting/stopping misc daemons when connected/disconnected and other stuff
# Version: 1.0
# Author: Philipp Schmitt (philipp<at>schmitt.co)
# Documentation: cf. pia-tools.groff
# Dependencies: curl openvpn sudo systemd transmission-cli unzip

# Source config file
test "$PIA_CONF" || PIA_CONF='/etc/pia-tools.conf'
[[ -r "$PIA_CONF" ]] && . $PIA_CONF

# Setup default config if not already set in pia-tools.conf
if [[ -z "$PIA_CONFIG_DIR" ]]; then
    PIA_CONFIG_DIR='/etc/openvpn/pia'
fi
if [[ -z "$PIA_CONFIG_URL" ]]; then
    PIA_CONFIG_URL='https://www.privateinternetaccess.com/openvpn/openvpn.zip'
fi
if [[ -z "$PIA_COMMON_CONFIG" ]]; then
    PIA_COMMON_CONFIG="$PIA_CONFIG_DIR/pia_common"
fi
if [[ -z "$PIA_SERVERS_FILE" ]]; then
    PIA_SERVERS_FILE="$PIA_CONFIG_DIR/piaservers"
fi
if [[ -z "$PIA_SERVERS_IP_FILE" ]]; then
    PIA_SERVERS_IP_FILE="$PIA_CONFIG_DIR/piaserverips"
fi
if [[ -z "$PIA_PASSWD_FILE" ]]; then
    PIA_PASSWD_FILE="$PIA_CONFIG_DIR/passwd"
fi
if [[ -z "$PIA_CLIENT_ID_FILE" ]]; then
    PIA_CLIENT_ID_FILE="$PIA_CONFIG_DIR/clientid"
fi
if [[ -z "$TRANSMISSION_SETTINGS_FILE" ]]; then
    TRANSMISSION_SETTINGS_FILE='/home/dl/.config/transmission-daemon/settings.json'
fi
if [[ -z "$PIA_OPEN_PORT_FILE" ]]; then
    PIA_OPEN_PORT_FILE="$PIA_CONFIG_DIR/open_port"
fi
PIA_OPEN_PORT="$(cat $PIA_OPEN_PORT_FILE 2>/dev/null)"
if [[ -z "$NETWORK_DEVICES" ]]; then
    NETWORK_DEVICES=$(ip route get "$(host privateinternetaccess.com | awk '/has address/ { print $4 }')" | awk '/dev/ { print $5 }')
fi
if [[ -z "$VIRT_NET_DEV" ]]; then
    VIRT_NET_DEV='tun0'
fi

if [[ -z "$DAEMONS" ]]; then
    # daemons holds the list of daemons to stop in case the VPN goes down
    DAEMONS='transmission deluged nzbget sabnzbd'
    # Extended daemon list
    # DAEMONS='transmission deluged nzbget sabnzbd couchpotato sonarr sickbeard sickrage nzbmegasearch pyload'
fi

usage() {
    echo "Usage: $1 [-p] [-a|d] [-u|s|l] [-c] [-h]"
    echo "  -p: Request new port"
    echo "  -a: Block non VPN traffic (iptables)"
    echo "  -d: Unblock non VPN traffic (iptables)"
    echo "  -g: Use PIA DNS (updates resolv.conf)"
    echo "  -l: List available VPN exit point"
    echo "  -u: Update configuration files"
    echo "  -s: Run setup"
    echo "  -c: Ensure OpenVPN is running. If not stop transmission"
    echo "  -h: Display this message"
    echo "  -v: Verbose output"
}

# Checks if executed as root. If not reinvoke self with sudo
check_root() {
    if [[ $EUID -ne 0 ]]; then
        if test "$VERBOSE"; then
            echo -e "This script must be run as root\nInvoking sudo -- $0 $*" 1>&2
        fi
        exec sudo -- "$0" "$@"
    fi
}

_is_running() {
    systemctl is-active "$1" > /dev/null 2>&1
}

_stop_daemon() {
    systemctl stop "$1"
}

_restart_daemon() {
    systemctl restart "$1"
}

# Checks if the OpenVPN service is running
check_ovpn() {
    local d
    if ! _is_running 'pia@*'; then
        echo 'OpenVPN service not running !' >&2
        for d in $DAEMONS
        do
            if _is_running "$d"; then
                echo -n "Stopping $d... "
                _stop_daemon "$d"
                echo 'Done!'
            else
                echo "$d is not running" >&2
            fi
        done
        _ufw_delete_rule "$PIA_OPEN_PORT"
        # ufw_unblock
        return 1
    fi
}

info() {
    local d
    local vpn_exit="$(systemctl -t service --state=active \
                    | awk '/pia@.*/ { print $NF }')"
    if check_ovpn; then
        echo "OpenVPN is running (Exit point: $vpn_exit)"
    else
        echo "OpenVPN stopped"
    fi
    for d in $DAEMONS
    do
        if _is_running "$d"; then
            echo "$d is running"
        else
            echo "$d stopped"
        fi
    done
}

_ufw_port_allowed() {
    ufw status | grep -E "^$1\s+ALLOW" > /dev/null
}

# Delete previous rule from ufw
_ufw_delete_rule() {
    if test "$1" && _ufw_port_allowed "$1"; then
        ufw delete allow "$1"
    fi
}

# Add a new rule to ufw
_ufw_add_new_rule () {
    if test "$1" && ! _ufw_port_allowed "$1"; then
        ufw allow "$1"
    fi
}

# Update ufw rules
ufw_update() {
    # Check if ufw is running
    systemctl is-active ufw > /dev/null 2>&1 || return 1
    echo -n "Updating UFW rules... "
    _ufw_delete_rule "$PIA_OPEN_PORT"
    _ufw_add_new_rule "$PIA_OPEN_PORT_NEW"
    ufw reload > /dev/null
    echo 'Done!'
}

ufw_allow_non_vpn() {
    echo -n 'Allowing non-VPN traffic ... '
    for i in $NETWORK_DEVICES; do
        ufw delete deny out on $i > /dev/null 2>&1
        ufw delete deny in on $i > /dev/null 2>&1
    done
    echo 'Done!'
}

ufw_deny_non_vpn() {
    echo -n 'Denying non-VPN traffic ... '
    for i in $NETWORK_DEVICES; do
        ufw deny out on $i > /dev/null 2>&1
        ufw deny in on $i > /dev/null 2>&1
    done
    echo 'Done!'
}

transmission_peer_port_update() {
    local transmission_peer_port="$(grep 'peer-port\"' $TRANSMISSION_SETTINGS_FILE | grep -Eo '[0-9]+')"
    echo -n "Updating transmission's listening port... "
    # Check if transmission is running
    if _is_running transmission; then
        # get current listening port
        transmission_peer_port="$(transmission-remote -si | grep Listenport | grep -oE '[0-9]+')"
        if [[ "$PIA_OPEN_PORT_NEW" != "$transmission_peer_port" ]]; then
            transmission-remote -p "$PIA_OPEN_PORT_NEW"
            echo 'Checking port...'
            # TODO The sleep timer may need to be adjusted
            sleep 3 && transmission-remote -pt
        fi
    else
        # write new listening port to config
        if test "$PIA_OPEN_PORT_NEW" && \
           [[ "$PIA_OPEN_PORT_NEW" != "$transmission_peer_port" ]]; then
            echo "Writing new peer port to transmission's settings.json..."
            sed -i 's/\(\"peer-port\":\).*,/\1 '"$PIA_OPEN_PORT_NEW"',/' "$TRANSMISSION_SETTINGS_FILE"
        fi
        check_ovpn && _restart_daemon transmission
    fi
    echo 'Done!'
}

# Return a new client ID
new_client_id() {
    head -n 100 /dev/urandom | sha256sum | tr -d " -" | tee $PIA_CLIENT_ID_FILE
}

request_port() {
    local username="$(head -1 $PIA_PASSWD_FILE)"
    local passwd="$(tail -1 $PIA_PASSWD_FILE)"
    local client_id="$1"
    echo -n "Updating port forwarding... "
    if test "$VERBOSE"; then
        echo "Username: $username"
        echo "Client ID: $client_id"
    fi
    PIA_OPEN_PORT_NEW="$(\
        curl -qqs http://209.222.18.222:2000/?client_id=$client_id \
        | grep -oE "[0-9]+" 2>&1)"
    if test "$PIA_OPEN_PORT_NEW"; then
        echo "$PIA_OPEN_PORT_NEW" > "$PIA_OPEN_PORT_FILE"
        echo "Done! Port: $PIA_OPEN_PORT_NEW"
        if [[ "$PIA_OPEN_PORT_NEW" != "$PIA_OPEN_PORT" ]]; then
            test "$PIA_OPEN_PORT" && echo "Previous: $PIA_OPEN_PORT"
        fi
        # Update firewall rules
        ufw_update
        transmission_peer_port_update # Update Transmission's peer port
   else
        echo 'Failed'
   fi
}

setup() {
    if [[ -e $PIA_PASSWD_FILE ]]; then
        echo -en "$PIA_PASSWD_FILE exits.\nRemove it? (y|N) "
        read delete
        if [[ $delete == "y" ]]; then
            rm -f "$PIA_PASSWD_FILE"
        else
            update_config
            return
        fi
    fi
    mkdir -p $PIA_CONFIG_DIR
    echo -n "Username: "
    read username
    echo -ne "Password: "
    read -s password
    echo -e "${username}\n${password}" > $PIA_PASSWD_FILE
    chmod 400 $PIA_PASSWD_FILE
    echo
    update_config
    echo "Now you can connect to the VPN"
    echo "# systemctl start pia@Sweden"
}

list() {
    echo -e "Available VPN endpoints:\n"
    local e
    for e in /etc/openvpn/pia/*.ovpn
    do
        basename "${e//.ovpn//}"
    done
}

update_config() {
    echo -n 'Updating configuration... '
    local ovpn ovpn_spaceless overwrite=$([[ -n "$FORCE" ]] && echo '-o')

    # Fetch server config files
    curl -sL -o "$PIA_CONFIG_DIR/openvpn.zip" "$PIA_CONFIG_URL" || {
        echo 'Could not download openvpn config files'
        exit 4
    }

    # Clean up
    rm -f "$PIA_CONFIG_DIR/ca.crt" "$PIA_CONFIG_DIR"/*.ovpn

    # Extract config files
    unzip $overwrite -d "$PIA_CONFIG_DIR" -q "$PIA_CONFIG_DIR/openvpn.zip"

    # Replace space by underscore in filenames
    local ifs_bak=$IFS
    IFS=$(echo -en "\n\b")
    for ovpn in "$PIA_CONFIG_DIR"/*.ovpn; do
        # Rename files so that do not contain spaces
        ovpn_spaceless=$(sed 's/ /_/g' <<< "$ovpn")
        if [[ "$ovpn" != "$ovpn_spaceless" ]]; then
            mv "$ovpn" "$ovpn_spaceless"
        fi
        # Append up/down scripts to every ovpn file
        cat "$PIA_COMMON_CONFIG" >> "$ovpn_spaceless"
    done
    IFS=$ifs_bak

    # Extract server addresses and resolve hosts
    grep -h "remote " "$PIA_CONFIG_DIR"/*.ovpn | cut -d ' ' -f 2 \
        | sort -u > "$PIA_SERVERS_FILE"
    cat "$PIA_SERVERS_FILE" | nslookup \
        | sed -n 's/Address: \(.*\)/\1/gp' > "$PIA_SERVERS_IP_FILE"

    # why is following dig cmd failing randomly ?
    #dig -f /tmp/piaservers A +short | sort > $PIA_SERVERS_IP_FILE
    echo 'Done!'
}

_dns() {
    local resolv=/etc/resolv.conf
    local resolv_bak=/etc/resolv.conf.orig

    if [[ ! -e $resolv_bak ]]; then
        if mv $resolv $resolv_bak; then
            test "$VERBOSE" && echo "Backed up $resolv to $resolv_bak"
        fi
    fi
    echo -n "Updating $resolv file... "
    echo "# Generated by $(basename $0)" > "$resolv"
    for dns in "$@"; do
        echo "nameserver $dns" >> "$resolv"
    done
    echo 'Done!'
    test "$VERBOSE" && echo -e "New $resolv:\n$(cat $resolv)"
}

pia_dns() {
    _dns '209.222.18.222' '209.222.18.218'
}

google_dns() {
    _dns '8.8.8.8' '8.8.4.4'
}

restore_dns() {
    if [[ ! -f /etc/resolv.conf.orig ]]; then
        echo "Could not find a resolv.conf.orig" >&2
        return 1
    fi
    mv -f /etc/resolv.conf.orig /etc/resolv.conf
}

# If no option -> portfwd
if [[ $# -eq 0 ]]; then
    action_port=portfwd
    #action_fw=disallow
fi

# Every function except help needs root permissions
check_root "$*"

ARGS=$(getopt -o "adpfguscilhv" \
              -l "allow,disallow,\
                  port,pia-dns,google-dns,restore-dns,\
                  restore,force,check,\
                  update,setup,list,info,help,verbose" \
              -n "$0" -- "$@")

[[ $? -ne 0 ]] && { usage "$(basename $0)"; exit 1; }

eval set -- "$ARGS"

while true; do
    case "$1" in
        -a|--allow)
            test "$action_fw" && exit 1
            action_fw=allow
            shift
            ;;
        -d|--disallow)
            test "$action_fw" && exit 1
            action_fw=disallow
            shift
            ;;
        -p|--port)
            test "$action_port" && exit 1
            action_port=portfwd
            shift
            ;;
        -g|--pia-dns)
            test "$action_dns" && exit 1
            action_dns=pia
            shift
            ;;
        --google-dns)
            test "$action_dns" && exit 1
            action_dns=google
            shift
            ;;
        --restore-dns)
            test "$action_dns" && exit 1
            action_dns=restore
            shift
            ;;
        --restore)
            test "$action_dns" && exit 1
            action_dns=restore
            action_check=1
            shift
            ;;
        -f|--force)
            FORCE=1
            shift
            ;;
        -c|--check)
            action_check=1
            shift
            ;;
        -i|--info)
            action_info=1
            shift
            ;;
        -l|--list)
            action_list=1
            shift
            ;;
        -s|--setup)
            action_setup=1
            shift
            ;;
        -u|--update)
            action_update=1
            shift
            ;;
        -h|--help)
            action_help=1
            shift
            ;;
        -v|--verbose)
            VERBOSE=1
            shift
            ;;
        --)
      shift
      break;;
    esac
done

# When started by OpenVPN daemon (up script) this script gets called like this:
# $0 $@ tun0 1500 1542 10.185.1.6 10.185.1.5 init
[[ -n $2 ]] && VIRT_NET_DEV=$1
[[ -n $4 ]] && LOCAL_IP=$4

test "$action_help" && { usage "$(basename $0)"; exit $?; }
test "$action_info" && { info; exit $?; }
test "$action_list" && { list; exit $?; }
test "$action_setup" && { setup; exit $?; }
test "$action_update" && update_config
test "$action_check" && check_ovpn

case "$action_dns" in
    google) google_dns ;;
    restore) restore_dns ;;
    pia) pia_dns ;;
esac

# Block/Unblock non-VPN traffic if requested
case "$action_fw" in
    disallow) ufw_deny_non_vpn ;;
    allow) ufw_allow_non_vpn;;
esac

# Request port forwarding if action_port is set or no other action is
if test "$action_port"; then
    client_id="$(cat $PIA_CLIENT_ID_FILE 2>/dev/null)"
    if [[ -z "$client_id" ]] || [[ "$action_port" == "portfwd" ]]; then
        client_id=$(new_client_id)
    fi
    [[ -z "$FORCE" ]] && check_ovpn
    request_port "$client_id"
    unset client_id action_port
fi


exit 0