#!/bin/bash
##########################################################################
# Tor over OpenVPN
#
# requirements: 
#   - must be run as root
#   - openvpn config file named "zorrrovpn.ovpn" in /home/amnesia/Persistent
#   - openvpn must be configured to use an IP as remote host (vs. host name) 
#   - openvpn must be configured to use tun (vs. tap)
#   - IPv4 in LAN, this script disables IPv6 (remove this, if you need IPv6)
##########################################################################
#
# check necessary rights
if [ ! `id -u` = 0 ] ; then
        echo "error: This script needs to be run using 'sudo SCRIPT' or in 'root terminal'" >&2
  echo "exiting now" >&2
  exit 1
fi

sudo ln -fs /home/amnesia/Persistent/"Tor Browser"/zorrovpn/*.pem /etc/openvpn
sudo ln -fs /home/amnesia/Persistent/"Tor Browser"/zorrovpn/zorrovpn.ovpn /etc/openvpn/zorrovpn.ovpn
sudo cp /live/persistence/TailsData_unlocked/Persistent/Scripts/restart-tor /usr/local/sbin/
#sudo /etc/init.d/tor restart
awk '/nameserver 192.168.0.1/{ print "nameserver 10.200.0.2"} !/nameserver 192.168.0.1/{print $0}' /etc/resolv-over-clearnet.conf > /tmp/resolv-over-clearnet.conf && mv /tmp/resolv-over-clearnet.conf /etc/
sudo cp /etc/resolv-over-clearnet.conf /tmp/ && mkdir -p 775 /live/persistence/TailsData_unlocked/Persistent/Scripts/tmp
sudo /etc/init.d/networking restart
sudo /etc/init.d/network restart
sudo /etc/init.d/network-manager restart
# clean tov.ovpn from DOS line breaks if necessary
if `grep -r $'\r' /etc/openvpn/zorrovpn.ovpn >/dev/null`
then
  unset tovcfgperm
  tovcfgperm=`stat -c%a /etc/openvpn/zorrovpn.ovpn`
  tr -d $'\r' < /etc/openvpn/zorrovpn.ovpn >/tmp/tov.ovpn && mv /tmp/tov.ovpn /etc/openvpn
  chmod "$tovcfgperm" /etc/openvpn/zorrovpn.ovpn
  unset tovcfgperm
fi

# disable IPv6 - IPv6 is exploited to circumvent default IPv4-routes to VPN server to reveal users real IP(v6) address
grep "net.ipv6.conf.all.disable_ipv6 = 0" /etc/sysctl.conf || echo net.ipv6.conf.all.disable_ipv6 = 0 >> /etc/sysctl.conf 
sysctl -p

# populate vars
unset vpnserver_ip
unset vpnserver_port
unset vpnserver_proto
vpnserver_ip=`cat /etc/openvpn/zorrovpn.ovpn | grep "^remote " | awk '{print $2}'`
if [[ -z "$vpnserver_ip" ]] ; then echo 'error: VPN server IP not found in tov.ovpn!' >&2; exit 1; fi
if ! [[ "$vpnserver_ip" =~ ^[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+$ ]] ; then echo "error: 'remote' appears not to be an IP address in tov.ovpn" >&2; exit 1; fi
vpnserver_port=`cat /etc/openvpn/zorrovpn.ovpn | grep "^remote " | awk '{print $3}'`
if [[ -z "$vpnserver_port" ]] 
then
  vpnserver_port=`cat /etc/openvpn/zorrovpn.ovpn | grep "^port " | awk '{print $2}'`
fi
if [[ -z "$vpnserver_port" ]] ; then echo 'error: VPN server port not found in tov.ovpn!' >&2; exit 1; fi
if ! [[ "$vpnserver_port" =~ ^[0-9]+$ ]] ; then echo "error: 'port' appears not to be an integer (number)e in tov.ovpn" >&2; exit 1; fi
vpnserver_proto=`cat /etc/openvpn/zorrovpn.ovpn | grep "^remote " | awk '{print $4}'`
if [[ -z "$vpnserver_proto" ]] 
then
  vpnserver_proto=`cat /etc/openvpn/zorrovpn.ovpn | grep "^proto " | awk '{print $2}'`
  vpnserver_proto="tcp"
fi
if [[ -z "$vpnserver_proto" ]] ; then echo 'info: VPN server protocol not found in tov.ovpn, using UDP' >&2; vpnserver_proto=udp; fi

# install openvpn
if [ ! -f /usr/sbin/openvpn ]
then
  apt-cache search openvpn 2>/dev/nul | grep "openvpn - virtual private network daemon" || apt-get update
  apt-get install -y openvpn
fi

# configure ferm.conf to allow access to vpnserver_ip:vpnserver_port using vpnserver_proto for user root
if [[ ! $(cat /etc/ferm/ferm.conf | grep "White-list access to Openvpnserver:port for user root") ]]
then
  awk '/White-list access to local resources/{print "            # White-list access to Openvpnserver:port for user root" RS "            daddr '$vpnserver_ip' proto '$vpnserver_proto' dport '$vpnserver_port' {" RS "                    mod owner uid-owner root ACCEPT;" RS "            }"  RS RS $0;next}1' /etc/ferm/ferm.conf >/tmp/ferm.conf && mv /tmp/ferm.conf /etc/ferm
else
  if [[ $(cat /etc/ferm/ferm.conf | grep "White-list access to Openvpnserver:port for user root") ]]
  then 
  awk '/White-list access to local resources/{print "            # White-list access to Openvpnserver:port for user root" RS "            daddr '$vpnserver_ip' proto '$vpnserver_proto' dport '$vpnserver_port' {" RS "                    mod owner uid-owner root ACCEPT;" RS "            }"  RS RS $0;next}1' /etc/ferm/ferm.conf >/tmp/ferm.conf && mv /tmp/ferm.conf /etc/ferm
fi
fi
# restrict debian-tor from "everything" to "everything using interface tun0"
if [[ ! $(cat /etc/ferm/ferm.conf | grep "# But only when using tun0.") ]]
then
   awk '/mod owner uid-owner debian-tor ACCEPT;/{print "            # But only when using tun0." RS "            outerface tun0 mod owner uid-owner debian-tor ACCEPT;";next}1' /etc/ferm/ferm.conf >/tmp/ferm.conf && mv /tmp/ferm.conf /etc/ferm
fi
# delete ferm cache
rm -f /var/cache/ferm/*
# reload ferm
/etc/init.d/ferm reload

echo "Editable/Custromize resolv-conf"
sudo mv /tmp/resolv-over-clearnet.conf /etc/
sudo cat /etc/resolv-over-clearnet.conf
# start openvpn in foreground (so it's easier to kill or for interactive login)
sudo openvpn --client --cd /etc/openvpn/ --script-security 2 --up /usr/local/sbin/restart-tor --up-delay --up-restart --fast-io --config /home/amnesia/Persistent/"Tor Browser"/zorrovpn/zorrovpn.ovpn --proto tcp --verb 6 
# start openvpn in background (bc you hate that additional window ;))
#openvpn /home/amnesia/Persistent/tov.ovpn --script-security 2 --up /usr/local/sbin/restart-tor --config /home/amnesia/Persistent/tov.ovpn &
sudo awk '/nameserver 10.200.0.2/{ print "nameserver 192.168.0.1"} !/nameserver 10.200.0.2/{print $0}' /etc/resolv-over-clearnet.conf > /tmp/resolv-over-clearnet.conf && mv /tmp/resolv-over-clearnet.conf /etc/

