#!/usr/bin/env bash

. ${HOME}/code/bashtools/bashtools.sh
if [[ -z $HAVE_BASHTOOLS ]]; then
    echo "ERROR: bashtools not installed download from https://git.nethack.net/rob/bashtools" >/dev/stderr
    exit 1
fi
CONFDIR=${HOME}/.vpn
LOGFILE=${CONFDIR}/log
VPNPIDFILE=${CONFDIR}/vpnpid
DEFAULTCONF=${CONFDIR}/config
CONFFILE=${DEFAULTCONF}

cp -p "$LOGFILE" "${LOGFILE}.0"
cp /dev/null "$LOGFILE"

err=0
OPENCONNECT=$(which openconnect 2>/dev/null)
if [[ $? -ne 0 ]]; then
    error "Can't find openconnect binary"
    err=$((err + 1))
fi
VPNSLICE=$(which vpn-slice 2>/dev/null)
if [[ $? -ne 0 ]]; then
    error "Can't find vpn-slice binary"
    err=$((err + 1))
fi
if [[ $ree -ne 0 ]]; then
    exit 1
fi

mkdir -p "${CONFDIR}"

function alias_to_cmd() {
    local input="$1"
    local output="$input"

    case $input in
        "l") output="list";;
        "ls") output="list";;
        "start") output="on";;
        "u") output="on";;
        "up") output="on";;
        "stop") output="off";;
        "d") output="off";;
        "down") output="off";;
        "check") output="status";;
        "stat") output="status";;
        "info") output="status";;
        "i") output="status";;
    esac
    echo "$output"
}

function load_config() {
    local CONFLINES line thisprofile thisuser thispw thisgroup thisroutes thisservercert
    DEFAULTPROFILE=""
    if [[ -e ${CONFFILE} ]]; then
        DEFAULTPROFILE=$(grep '^#default:' "${CONFFILE}" | sed 's/^#default://')
        CONFLINES=$(egrep -v "^#" ${CONFFILE} 2>/dev/null | awk NF)
        nvpns=0
        while read line; do
            [[ $line =~ ^# ]] && continue
            thisprofile=$(cut -d, -f1 <<< "${line}")
            thisuser=$(cut -d, -f2 <<< "${line}")
            thispw=$(cut -d, -f3 <<< "${line}")
            thisgroup=$(cut -d, -f4 <<< "${line}")
            thisvpntype=$(cut -d, -f5 <<< "${line}")
            thisserver=$(cut -d, -f6 <<< "${line}")
            thisroutes=$(cut -d, -f7 <<< "${line}")
            thisservercert=$(cut -d, -f8 <<< "${line}")
            case $thisvpntype in
                "") thisvpntype="anyconnect";
                "cisco") thisvpntype="anyconnect";
                "bigip") thisvpntype="anyconnect";
            esac
            if [[ -z $thisserver ]]; then
                error "Missing server IP for profile '$thisprofile'"
                cecho -s "$RED" "^bBad line:^p  $line"
                exit 1
            fi
            profile[$nvpns]="${thisprofile}"
            user[$nvpns]="${thisuser}"
            pw[$nvpns]="${thispw}"
            group[$nvpns]="${thisgroup}"
            vpntype[$nvpns]="${thisvpntype}"
            server[$nvpns]="${thisserver}"
            routes[$nvpns]="${thisroutes}"
            servercert[$nvpns]="${thisservercert}"
            nvpns=$((nvpns + 1))
        done <<< "${CONFLINES}"
    else
        error "Config file '$CONFFILE' not found"
        return 1
    fi
    return 0
}

function usage() {
    echo "$0 [OPTIONS] on|off|status|list [vpnname]"
    echo
    echo "Wrapper for openconnect to support multiple VPN profiles."
    echo
    echo "       -h            show this help"
    echo "       -p profile    Use selected connection profile"
    echo "       -c file       Use selected config file (default is ${DEFAULTCONF})"
    echo
    echo "Config file format:"
    echo "   #Specify default profile like this:"
    echo "   #default:myvpn2"
    echo "   #Profile,Username,Password,VPNGroup,VPNType,ServerIP,VPNRoutes,ServerCert(script will obtain this and auto-update config file)"
    echo "   myvpn1,username_1,password_1,vpngroup_1,anyconnect,3.3.3.3,10.0.0.0/24 192.168.0.0/24,"
    echo "   myvpn2,username_2,password_2,vpngroup_2,anyconnect,1.1.1.1,172.16.0.0/12,"
    echo "   myvpn3,username_3,password_3,,f5,1.1.1.1,172.16.0.0/12,"
    echo
}

function get_profile_id() {  #1=profile_to_check
    local x lookfor="$1"
    for x in ${!profile[@]}; do
        if [[ ${profile[$x],,} == ${lookfor,,} ]]; then
            echo "${x}"
            return 0
        fi
    done
    error "No credentials found for the VPN profile ^b${PROFILE}^p." >&2
    csecho "$RED" "Add a line of this format to ^b${CONFFILE}^p:" >&2
    csecho "$RED" "${PROFILE},^iusername^p,^ipassword^p[,^igroup]^p" >&2
    return 1
}

function get_vpn_status() { # populates vprofile vuser vstatus vserver vvpntype, return 0 if vpn up
    local rv=0 vpnpid pname
    vprofile=""
    vuser=""
    vstatus="Disconnected"
    vserver=""
    vvpntype=""

    if [[ -e $VPNPIDFILE ]]; then
        vpnpid=$(cat $VPNPIDFILE 2>/dev/null)
        pname=$(ps -p $vpnpid -o command="" 2>/dev/null)
        vstatus="Connected"
        vserver=$(echo "$pname" | awk '{ print $NF }')
        vuser=$(echo "$pname" | sed 's/^.*-u //;s/ .*//g')
        vvpntype=$(echo "$pname" | sed 's/^.*--protocol=//;s/ .*//g')
    else
        rv=1
    fi

    if [[ $vstatus == "Connected" ]]; then
        # find matching profile
        for x in ${!profile[@]}; do
            if [[ $vserver == ${server[$x]} ]]; then
                vprofile="${profile[$x]}"
                [[ -z $vuser ]] && vuser=${user[$x]}
                [[ -z $vvpntype ]] && vvpntype=${vvpntype[$x]}
            fi
        done
    fi
    return $rv
}

PROFILE=""

ARGS="hp:"
while getopts "$ARGS" i; do
	case "$i" in
		p)
			profile="$OPTARG";
                        exit 1;
			;;
		h)
			usage;
                        exit 1;
			;;
		*)
			error "invalid argument:  $i";
			usage;
			;;
	esac
done
shift $((OPTIND - 1))

if [[ $# -lt 1 ]]; then
	usage
	exit 1
fi

cmd=$(alias_to_cmd "$1")

load_config || exit 1

usingdefault=0
PROFILE="$2"
if [[ -z $PROFILE ]]; then
    if [[ -n ${DEFAULTPROFILE} ]]; then
        PROFILE="${DEFAULTPROFILE}"
        usingdefault=1
    fi
fi

if [[ $cmd == "list" ]]; then
    F="%s,%s,%s,%s,%s,%s\n"
    table=$(
        (
            printf "${F}" "Profile" "Username" "Password" "Group" "Server" "Type"
            for x in ${!profile[@]}; do
            p="${pw[$x]:0:2}....${pw[$x]: (-2)}"
            prof="${profile[$x]}"
            [[ $prof == $DEFAULTPROFILE ]] && prof="*${prof}"
                printf "${F}" "${prof}" "${user[$x]}" "${p}"  "${group[$x]:-(n/a)}" "${server[$x]:-(n/a)}" "${vpntype[$x]}"
            done
        ) | column -s, -t
    )
    table=$(echo "$table" | sed "s/^\(Profile.*\)$/^b^u\1^p/;s/\(n\/a\)/^i\1^p/g")
    csecho "$WHITE" "$table"
    echo
    echo "(* = default VPN)"
    exit 0
elif [[ $cmd == "on" ]]; then
    [[ $usingdefault -eq 1 ]] && inform "[using default VPN: ^b$DEFAULTPROFILE^p]"
    get_vpn_status
    if [[ $vstatus == "Connected" ]]; then
        error "VPN profile $vprofile is already connected"
        exit 1
    fi

    if [[ -z ${PROFILE} ]]; then
        error "No VPN profile provided and no default VPN profile set."
        csecho "$RED" "Either specify on commandline, or add this to ^b${CONFFILE}^p:"
        csecho "$RED" "#default:^ivpn_name^p"
        exit 1
    fi
    id=$(get_profile_id "${PROFILE}")
    if [[ -n $id ]]; then
        curprofile=${profile[$id]}
        curuser=${user[$id]}
        curpw=${pw[$id]}
        curgroup=${group[$id]}
        curvpntype=${vpntype[$id]}
        curserver=${server[$id]}
        curservercert=${servercert[$id]}
        curroutes=${routes[$id]}
    else
        error "Could not determine VPN ID for profile ^b${PROFILE}^p."
        exit 1
    fi

    if [[ -n $curgroup ]]; then
        grouparg="--authgroup=$curgroup"
    else
        grouparg=""
    fi

    if [[ -z $curservercert ]]; then
        inform "No server certificate is defined for ^b$curprofile^p."
        notify "Trying to obtain server certificate"
        foundcert=$(sudo ${OPENCONNECT} --non-inter --protocol=anyconnect -u "$curuser" $grouparg "$curserver" 2>&1 | grep -- --servercert | awk '{ print $NF }')
        if [[ -n $foundcert ]]; then
            ok
            inform "Got server certificate '^b${foundcert}^p'"
            notify "Updating configuration file ^b$CONFFILE^p"
            bakfile="${CONFFILE}".backup
            prevlines=$(cat "$CONFFILE" | awk NF | wc -l | bc)
            newconfig=$(cat "${CONFFILE}" | awk -v p="$curprofile" -v c="$foundcert" -F, '{ OFS=","; if ($1 == p) { $8 = c; } print }')
            newlines=$(echo "$newconfig" | awk NF | wc -l | bc)

            err=""
            if [[ $newlines -ne $prevlines ]]; then
                err="line count different"
            elif ! grep -q pin-sha256 <<<"$newconfig"; then
                err="new config missing server cert"
            fi

            if [[ -z $err ]]; then
                ok
                cp -p "${CONFFILE}" "${bakfile}"
                echo "$newconfig" > ${CONFFILE}
                curservercert="$foundcert"
            else
                fail
                error "Regenerated config file seems wrong ($err)"
                cecho -s "$RED" "Current config:"
                cecho -s "$RED" "$(cat "$CONFFILE")" | sed 's/^/   /'
                echo
                cecho -s "$RED" "Newly generated config:"
                cecho -s "$RED" "$newconfig" | sed 's/^/   /'
                echo
                exit 1
            fi
        else
            fail
            exit 1
        fi
    fi

    nstr="Connecting to ^b${PROFILE}^p as user ^b${curuser}^p"
    [[ -n $curgroup ]] && nstr="${nstr} group ${curgroup}"
    [[ -n $curserver ]] && nstr="${nstr} server ${curserver}"

    notify "${nstr}"

    rm -f "$VPNPIDFILE"
    if [[ -n $curroutes ]]; then
        printf '%s' "$curpw" | sudo ${OPENCONNECT} --background --non-inter --protocol=$vpntype -u "$curuser" --passwd-on-stdin $grouparg -s "$VPNSLICE $curroutes" --servercert "$curservercert" "$curserver"  >"${LOGFILE}" 2>&1
    else
        printf '%s' "$curpw" | sudo ${OPENCONNECT} --background --non-inter --protocol=$vpntype -u "$curuser" --passwd-on-stdin $grouparg --servercert "$curservercert" "$curserver"  >"${LOGFILE}" 2>&1
    fi
    rv=$?
    res=$(cat "$LOGFILE")
    if [[ $rv -eq 0 ]]; then
        cpid=$(pgrep openconnect)
        if [[ $? -eq 0 ]]; then
            echo "$cpid" > "$VPNPIDFILE"
        else
            rv=1
        fi
    fi
    if [[ $rv -eq 0 ]]; then
        ok "connected"
    else
        fail
        error "Connection failed, logs are below:"
        cecho -s "$RED" "$res" | sed 's/^/   /'
    fi
elif [[ $cmd == "status" ]]; then
    BASECOL="$ORANGE"
    notify "Checking VPN status"
    get_vpn_status
    [[ $? -eq 0 ]] && ok || fail
    if [[ $vstatus == "Connected" ]]; then
        col="$GREEN"
    else
        col="$RED"
    fi
    csecho -n "$BASECOL" "VPN status:  ${col}${BOLD}${vstatus}^p"
    if [[ ${vstatus,,} =~ "connected" ]]; then
        [[ -n $vserver ]] && csecho "$BASECOL" " to ^b${vprofile}^p (${vvpntype}:${vuser}@${vserver})" || echo
    fi
elif [[ $cmd == "off" ]]; then
    rv=1
    get_vpn_status
    if [[ $vstatus == "Connected" ]]; then
        notify "Disconnecting from ${vvpntype} VPN ^b${vprofile}^p"
        errstring=""
        errdata=""

        thepid=$(cat $VPNPIDFILE)
        if [[ -n $thepid ]]; then
            sudo kill $thepid
            sleep 2 # give it some time
            res=$(ps -p $thepid 2>&1)
            if [[ $? -ne 0 ]]; then
                rm -f "${VPNPIDFILE}"
                rv=0
            else
                errstring="could not kill pid $thepid:"
                errdata="$res"
                rv=1
            fi
        else
            errstring="Cannot determine current VPN PID to kill."
            rv=1
        fi

        if [[ $rv -eq 0 ]]; then
            ok
        else
            fail
            error "$errstring"
            [[ -n $errdata ]] && cecho -s "$RED" "$errdata" | sed 's/^/   /'
        fi
    else
        fail
        error "All VPNs are already disconnected"
    fi
else
    usage
    exit 1
fi