nordvpn

#!/bin/bash

main() {
    while [ $# -ne 0 ]
    do
        case "$1" in
            -v|--verbose)
                set -x
                shift
                ;;
            -h|--help)
                print_usage
                break
                ;;
            status)
                service=$(get_service)
                test -z "$service" || systemctl status $service
                break
                ;;
            update)
                check_root
                update_files
                break
                ;;
            disconnect)
                check_root
                stop_service > /dev/null
                reenable_ipv6
                break
                ;;
            connect)
                shift
                check_root
                service=$(stop_service)

                server=$(find_server "$@")
                if [[ $? != 0
                      || ! -f /etc/openvpn/client/nordvpn_${server}_udp.conf ]]; then
                    if [[ "$service" == "" ]]; then
                        exit_msg 1 "'No valid nordvpn server found. Exiting."
                    else
                        echo "No valid nordvpn server found."\
                             "Resuming previous connection."
                        systemctl start "$service"
                        break
                    fi
                fi

                disable_ipv6
                systemctl start openvpn-client@nordvpn_${server}_udp
                break
                ;;
            *)
                print_usage
                exit 1
                ;;
        esac
    done
}

disable_ipv6() {
    ## Disable ipv6 on every interface during the connection
    #sysctl -w net.ipv6.conf.all.disable_ipv6=1 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.default.disable_ipv6=1 > /dev/null 2>&1 

    ## Interfaces can be found by running `ip link`
    #sysctl -w net.ipv6.conf.lo.disable_ipv6=1 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.tun0.disable_ipv6=1 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.YOUR_INTERFACE.disable_ipv6=1 > /dev/null 2>&1 
    return 0
}

reenable_ipv6() {
    #sysctl -w net.ipv6.conf.all.disable_ipv6=0 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.default.disable_ipv6=0 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.lo.disable_ipv6=0 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.tun0.disable_ipv6=0 > /dev/null 2>&1 
    #sysctl -w net.ipv6.conf.YOUR_INTERFACE.disable_ipv6=0 > /dev/null 2>&1 
    return 0
}

stop_service() {
    service=$(get_service)
    if [[ ! -z "$service" ]]; then
        systemctl stop $service
        systemctl restart iptables.service
    fi
    echo "$service"
}

exit_msg() {
    (>&2 echo "$2")
    exit $1
}

get_service() {
    systemctl --type=service --plain | grep openvpn-client@nordvpn | awk '{print $1}'
}

check_root() {
    if [ $(id -u) -ne 0 ]
    then
        exit_msg 1 "This command requires super-user privileges."
    fi
}

update_files() {
    local remote_url=https://nordvpn.com/api/files/zipv2

    local targetdir=/etc/openvpn/client/nordvpn
    mkdir -p $targetdir

    local tmpdir=$(mktemp -d)
    cd $tmpdir

    updown=/etc/openvpn/client/nordvpn/updown
    if [ -x /etc/openvpn/vpnfailsafe.sh ]; then
        ln -fs /etc/openvpn/vpnfailsafe.sh $updown
    else
        msg_exit 2 "Install vpnfailsafe.sh to proceed."
    fi

    echo "Downloading nordvpn config files..."
    curl -sSL -o nordvpn.zip  $remote_url || exit 1
    mkdir conf
    if ! unzip -q nordvpn.zip -d conf
    then
        msg_exit 2 "unzip failed"
    fi

    echo "Patching and installing files..."
    test -f $targetdir/credentials.conf && cp $targetdir/credentials.conf .
    find /etc/openvpn/client -name 'nordvpn_*.conf' | xargs -r rm
    rm -rf $targetdir/conf && mkdir -p $targetdir/conf

    export -f patch_config_file
    find conf -name '*.ovpn' | xargs -P $(($(nproc --all)-1)) -n1 -I{} bash -c "patch_config_file {} $targetdir"

    local cred_file=$targetdir/credentials.conf
    if [ -f credentials.conf ]; then
        cp credentials.conf $cred_file
    else
        echo "login" > $cred_file
        echo "password" >> $cred_file
        chmod 400 $cred_file
        echo "Please update $cred_file"
    fi

    rm -rf $tmpdir
}

find_server() {
    var="$@"
    if [[ "$var" =~ [0-9] ]]; then
        echo "$var"
        return 0
    fi

    url_countries="https://api.nordvpn.com/v1/servers/countries"
    url_recommendations="https://api.nordvpn.com/v1/servers/recommendations"

    if [[ -z $var ]]; then
        res=$(curl --silent "$url_recommendations?limit=1" \
            | jq -Mr '.[].hostname')
        echo ${res%%\.*}
        return 0
    fi

    country=$(curl --silent $url_countries | jq -Mr --arg var "$var" \
        '.[] | select(.code | test($var;"i")) | .id')
    if [[ -z $country ]]; then
        country=$(curl --silent $url_countries | jq -Mr --arg var "$var" \
            '.[] | select(.name | test($var;"i")) | .id')
    fi
    if [[ -z $country ]]; then
        return 1
    fi
    res=$(curl --silent "$url_recommendations?filters\[country_id\]=$country&limit=1" \
        | jq -Mr '.[].hostname')
    echo ${res%%\.*}
} 

patch_config_file() {
    local -r f=$1
    local -r targetdir=$2

    sed 's/^auth-user-pass.*$/auth-user-pass \/etc\/openvpn\/client\/nordvpn\/credentials.conf/g' -i $f
    echo "" >> $f
    echo "script-security 2" >> $f
    echo "up /etc/openvpn/client/nordvpn/updown" >> $f
    echo "down /etc/openvpn/client/nordvpn/updown" >> $f
    echo "route-noexec" >> $f
    install -D -m 444 $f $targetdir/conf/$(basename $f)
    local -a tok=($(basename $f | tr '.' ' '))
    ln -s $targetdir/conf/$(basename $f) $targetdir/../nordvpn_${tok[0]}_${tok[3]:0:3}.conf
}

print_usage() {
    cat <<EOF
usage: $(basename $0) [options] command [args]

Available options:
    -h, --help
        Print this help and exit.

Available commands:
    status
        Show current systemd service status, if any.
    connect [arg]
        If no 'arg' is supplied connects to a recommended server. If 'arg' is
        a server code connects to it. Otherwise 'arg' is assumed to be a
        country code ("us", "de", etc.) or name. The command then connects to
        a recommended server in this country.
    disconnect
        Disconnect from VPN service if it is running.
    update
        Download and install nordvpn config files.
EOF
}

main "$@"