#!/bin/sh

# we'd like the user of this script to have root privilege
if [ "$(id -u)" != "0" ]; then
    echo "This script must be run as root" 1>&2
    exit 1
fi

case $1 in
"stop" | "no" | "off")
    killall openvpn
    exit 0
    ;;
"status")
    pid=`ps -e|grep openvpn`
    if [ -z "$pid" ]; then
        echo "The openvpn process is not running"
    else
        echo "Openvpn is running with id $pid"
        ip=`ifconfig tun | gawk '(/netmask /) {print( $2);}'`
        echo "Local vpn tunnel address is $ip"
    fi
    exit 0
    ;;
    
esac

# we'd like for passwords authentication to be turned off
grep -E^.*PasswordAuthentication.*[Yy]es /etc/ssh/sshd_conf
if [ "$1" != "test" ] && [ $# -eq 0];then
	if [ $? -eq 0 ]; then
		echo "Openvpn is only safe when public/private keys are used"
		echo " And when passwords are turned off in /etc/ssh/sshd_conf"
		exit 1
	fi
fi

# openvpn config file directory
dir=/etc/openvpn

cmd=$1
case $cmd in
"test" | "unsafe" | "on")
# load TUN/TAP kernel module
    modprobe tun

	# make sure the wan is functioning
	# 8.8.8.8 is one of google's dns servers
	ping -c 3 -i 3 8.8.8.8
	if [ $? -ne 0 ]; then
		echo "internet is not available, tunnel not possible"
		exit 1
	fi
	
	# check the vpn tunnel
	ping -c 5 -i 5 10.8.0.1
	# a zero return means the tunnel is up
	if [ $? -ne "0" ]; then
		echo "Stopping any openvpn instance"
		killall openvpn
		sleep 10
		echo "Starting openvpn and waiting 10 seconds for daemon to become ready"
    		openvpn --cd $dir --daemon --config roadwarrior-client.conf
	fi
	sleep 10 
	echo "Testing VPN connection"
	ping -c 4 -i 4 10.8.0.1
	if [ $? -eq 0 ]; then
		echo "vpn tunnel established"
	else
		echo "vpn connection failed"
	fi

    ;;
esac
