98-vpn

#!/bin/sh -e
#
# 98-vpn - Automatically bring up VPN on listed WiFi UUIDs
#
# Copyright (c) 2019 Preston Kutzner <pkutzner at gmail dot com>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License (GPL) as published
# by the Free Software Foundation (FSF), either version 3 of the License,
# or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GPL for
# more details.
#
# You should have received a copy of the GPL along with this program.
# If not, see <http://www.gnu.org/licenses/>.
#
# Usage: 98-vpn IFACE ACTION

DEBUG=true         # Verbose output in logger for debugging (true|false)
STATUS_WAIT=2       # Seconds to wait to check connection status
STATUS_TRIES=15     # Num times to try checking connection status

MYNAME=${0##*/}     # Bash shorthand for 'basename $0'
MYDIR=${0%\/*}      # Bash shorthand for 'dirname $0'

FILENAME="${MYDIR}/trusted_nets.txt"
VPN_NAME="Home"

[ $# -ne 2 ] && { $DEBUG && logger -p user.info -t "${MYNAME}[$$]" "Wrong number of arguments (need 2, got $#)"; exit 0; }

IFACE=$1
ACTION=$2
shift 2

[ "$ACTION" = "connectivity-change" ] && exit 0

log() { logger -p user.info -t "${MYNAME}[$$]" "$*"; }

contains() {
    local n=$#
    local value="${!n}"
    for (( i=1; i<$#; i++ )); do
        if [ "${!i}" == "${value}" ]; then
            return 0
        fi
    done
    return 1
}

get_conn_uuid() {
    nmcli -t connection show $1 2>/dev/null | perl -n -E 'say $1 if /^connection\.uuid:(.*)$/'
}

get_ssid() {
    nmcli -t device show "$1" 2>/dev/null | perl -n -E 'say $1 if /^GENERAL.CONNECTION:(.*)$/'
}

get_conn_status() {
    nmcli networking connectivity check
}

# Fake ifupdown environment
export IFACE
export LOGICAL="$1"
export METHOD="NetworkManager"
export VERBOSITY="0"

$DEBUG && log "script called with arguments: $IFACE $ACTION"
$DEBUG && log "connection UUID: $CONNECTION_UUID"

# Read file and strip comments
UUIDS=($(sed '/^#/d;s/#.*//' "$FILENAME"))
VPN_UUID=$(get_conn_uuid $VPN_NAME)

case "$ACTION" in
    up)
        if [ ! -e "/sys/class/net/$IFACE/wireless" ]; then
            $DEBUG && log "$IFACE is not a wireless interface -- ignoring."
            exit 0
        fi
        if ! contains "${UUIDS[@]}" "${CONNECTION_UUID}"; then
            $DEBUG && log "$(get_ssid $IFACE) is not a trusted network"
            $DEBUG && log "getting connectivity status"
            CONN_STATUS=$(get_conn_status)
            $DEBUG && log "connection status: $CONN_STATUS"
            TRIES=0
            while [ "$TRIES" -lt "$STATUS_TRIES" ] && [ ! "$CONN_STATUS" = "full" ]; do
                $DEBUG && "connection status is $CONN_STATUS"
                $DEBUG && "waiting $STATUS_WAIT seconds to status again"
                wait $STAUS_WAIT
                CONN_STATUS=$(get_conn_status)
                ((TRIES++))
            done
            log "attempting to bring up $VPN_NAME"
            # This command needs to be 'forked', otherwise it will hang for
            # the 90-second timeout, then fail with an exit code of '3' even
            # if the connection is ultimately successful.
            nmcli c u $VPN_UUID &
        fi
        ;;
    *)
        $DEBUG && log "noop" || : # NOOP
        ;;
esac

exit 0