647 lines
23 KiB
Bash
Executable File
647 lines
23 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CONFIG_DIR="${LEMANA_VPN_CONFIG_DIR:-$HOME/.config/lemana-vpn}"
|
|
CONFIG_FILE="$CONFIG_DIR/env"
|
|
|
|
if [[ -f "$CONFIG_FILE" ]]; then
|
|
# shellcheck disable=SC1090
|
|
source "$CONFIG_FILE"
|
|
fi
|
|
|
|
OC_VENV="${LEMANA_VPN_OC_VENV:-$HOME/.local/pipx/venvs/openconnect-lite}"
|
|
OC_PYTHON="${LEMANA_VPN_OC_PYTHON:-$OC_VENV/bin/python}"
|
|
OC_BIN="${LEMANA_VPN_OC_BIN:-$HOME/.local/bin/openconnect-lite}"
|
|
BW_ITEM_NAME="${LEMANA_VPN_BW_ITEM:-LM LDAP}"
|
|
KC_USERNAME="${LEMANA_VPN_USERNAME:-60103293}"
|
|
KC_FP="${LEMANA_VPN_KEYCHAIN_FINGERPRINT:-$HOME/bin/keychain-fingerprint}"
|
|
USE_BITWARDEN="${LEMANA_VPN_USE_BITWARDEN:-1}"
|
|
USE_TOUCHID="${LEMANA_VPN_USE_TOUCHID:-1}"
|
|
CACHE_BW_SESSION="${LEMANA_VPN_CACHE_BW_SESSION:-0}"
|
|
DNS_CLEANUP="${LEMANA_VPN_DNS_CLEANUP:-/usr/local/sbin/lemana-vpn-dns-cleanup}"
|
|
APP_DIR="${LEMANA_VPN_APP_DIR:-$HOME/Applications/LemanaVPN.app}"
|
|
LAUNCH_AGENT="${LEMANA_VPN_LAUNCH_AGENT:-$HOME/Library/LaunchAgents/ru.dokops.LemanaVPN.plist}"
|
|
BW_KC_SERVICE="${LEMANA_VPN_BW_KC_SERVICE:-vpn-lemanapro}"
|
|
BW_KC_ACCOUNT_SESSION="${LEMANA_VPN_BW_KC_ACCOUNT_SESSION:-bw-session}"
|
|
BW_KC_ACCOUNT_MASTER="${LEMANA_VPN_BW_KC_ACCOUNT_MASTER:-bw-master}"
|
|
STATUS_DIR="${LEMANA_VPN_STATUS_DIR:-$HOME/.local/state/vpn-lemanapro}"
|
|
STATUS_FILE="$STATUS_DIR/status.json"
|
|
PATCH_BACKUP_DIR="${LEMANA_VPN_PATCH_BACKUP_DIR:-$CONFIG_DIR/patch-backups}"
|
|
|
|
DEBUG=false
|
|
JSON_MODE=false
|
|
STATUS_MODE=false
|
|
CONFIGURE_KEYCHAIN_MODE=false
|
|
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--debug) DEBUG=true ;;
|
|
--json) JSON_MODE=true ;;
|
|
--status) STATUS_MODE=true ;;
|
|
--configure-keychain) CONFIGURE_KEYCHAIN_MODE=true ;;
|
|
--help|-h)
|
|
cat <<'HELP'
|
|
Usage: vpn-lemanapro.sh [--debug] [--json] [--status] [--configure-keychain]
|
|
|
|
--status Show current VPN status without connecting
|
|
--status --json Show current VPN status as JSON
|
|
--debug Run visible browser and passthrough debug logs
|
|
--json Emit JSON Lines events for UI wrappers
|
|
--configure-keychain Prompt for LDAP password and TOTP secret, then save them to Keychain
|
|
HELP
|
|
exit 0
|
|
;;
|
|
esac
|
|
done
|
|
|
|
_emit() {
|
|
local json="$1" human="$2"
|
|
if $JSON_MODE; then
|
|
printf '%s\n' "$json"
|
|
else
|
|
printf '%s\n' "$human"
|
|
fi
|
|
}
|
|
|
|
_write_status() {
|
|
mkdir -p "$STATUS_DIR"
|
|
printf '%s\n' "$1" > "$STATUS_FILE"
|
|
}
|
|
|
|
_clear_status() {
|
|
_write_status "{\"pid\":$$,\"state\":\"disconnected\",\"updated_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"
|
|
}
|
|
|
|
_json_get() {
|
|
local key="$1"
|
|
python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$key',''))" 2>/dev/null || true
|
|
}
|
|
|
|
_find_webengine_process() {
|
|
if [[ -n "${LEMANA_VPN_WEBENGINE_PROCESS:-}" ]]; then
|
|
printf '%s\n' "$LEMANA_VPN_WEBENGINE_PROCESS"
|
|
return 0
|
|
fi
|
|
find "$OC_VENV/lib" -path '*/site-packages/openconnect_lite/browser/webengine_process.py' -print -quit 2>/dev/null
|
|
}
|
|
|
|
_module_bool() {
|
|
if "$@" >/dev/null 2>&1; then
|
|
printf true
|
|
else
|
|
printf false
|
|
fi
|
|
}
|
|
|
|
_patches_active() {
|
|
local wep
|
|
wep="$(_find_webengine_process)"
|
|
[[ -n "$wep" && -f "$wep" ]] || return 1
|
|
grep -q '"offscreen"' "$wep" \
|
|
&& grep -q 'new Event("input", {{bubbles: true}})' "$wep" \
|
|
&& grep -q 'new RegExp' "$wep"
|
|
}
|
|
|
|
_keychain_has() {
|
|
security find-generic-password -s "$1" -a "$2" >/dev/null 2>&1
|
|
}
|
|
|
|
_module_status_json() {
|
|
local openconnect_installed openconnect_lite_installed bitwarden_installed touchid_installed dns_cleanup_installed
|
|
local app_installed app_autostart
|
|
local config_present oc_config_present patch_backup_present patches_active keychain_password keychain_totp_seed
|
|
openconnect_installed="$(_module_bool command -v openconnect)"
|
|
openconnect_lite_installed="$(_module_bool test -x "$OC_BIN")"
|
|
bitwarden_installed="$(_module_bool command -v bw)"
|
|
touchid_installed="$(_module_bool test -x "$KC_FP")"
|
|
dns_cleanup_installed="$(_module_bool test -x "$DNS_CLEANUP")"
|
|
app_installed="$(_module_bool test -x "$APP_DIR/Contents/MacOS/LemanaVPN")"
|
|
app_autostart="$(_module_bool test -f "$LAUNCH_AGENT")"
|
|
config_present="$(_module_bool test -f "$CONFIG_FILE")"
|
|
oc_config_present="$(_module_bool test -f "$HOME/.config/openconnect-lite/config.toml")"
|
|
patch_backup_present="$(_module_bool test -f "$PATCH_BACKUP_DIR/webengine_process.py.before-lemana-vpn")"
|
|
patches_active="$(_module_bool _patches_active)"
|
|
keychain_password="$(_module_bool _keychain_has openconnect-lite "$KC_USERNAME")"
|
|
keychain_totp_seed="$(_module_bool _keychain_has openconnect-lite "totp/$KC_USERNAME")"
|
|
|
|
printf '{"core":{"openconnect":%s,"openconnect_lite":%s,"config":%s,"openconnect_lite_config":%s},"bitwarden":{"enabled":%s,"installed":%s,"item":"%s"},"touchid":{"enabled":%s,"installed":%s},"keychain":{"password":%s,"totp_seed":%s},"dns_cleanup":{"installed":%s},"patches":{"active":%s,"backup":%s},"app":{"installed":%s,"autostart":%s}}' \
|
|
"$openconnect_installed" \
|
|
"$openconnect_lite_installed" \
|
|
"$config_present" \
|
|
"$oc_config_present" \
|
|
"$([[ "$USE_BITWARDEN" == "1" ]] && printf true || printf false)" \
|
|
"$bitwarden_installed" \
|
|
"$BW_ITEM_NAME" \
|
|
"$([[ "$USE_TOUCHID" == "1" ]] && printf true || printf false)" \
|
|
"$touchid_installed" \
|
|
"$keychain_password" \
|
|
"$keychain_totp_seed" \
|
|
"$dns_cleanup_installed" \
|
|
"$patches_active" \
|
|
"$patch_backup_present" \
|
|
"$app_installed" \
|
|
"$app_autostart"
|
|
}
|
|
|
|
_module_human_part() {
|
|
local name="$1" enabled="$2" installed="$3"
|
|
if [[ "$enabled" == "0" ]]; then
|
|
printf '⏭️ %s=off' "$name"
|
|
elif [[ "$installed" == "true" ]]; then
|
|
printf '✅ %s=on' "$name"
|
|
else
|
|
printf '⚠️ %s=missing' "$name"
|
|
fi
|
|
}
|
|
|
|
_module_status_human() {
|
|
local core bitwarden_installed touchid_installed dns_cleanup_installed patches_active keychain_password keychain_totp_seed
|
|
local app_installed app_autostart
|
|
if command -v openconnect >/dev/null 2>&1 && [[ -x "$OC_BIN" && -f "$HOME/.config/openconnect-lite/config.toml" ]]; then
|
|
core="core=ok"
|
|
else
|
|
core="core=missing"
|
|
fi
|
|
|
|
bitwarden_installed="$(_module_bool command -v bw)"
|
|
touchid_installed="$(_module_bool test -x "$KC_FP")"
|
|
dns_cleanup_installed="$(_module_bool test -x "$DNS_CLEANUP")"
|
|
patches_active="$(_module_bool _patches_active)"
|
|
keychain_password="$(_module_bool _keychain_has openconnect-lite "$KC_USERNAME")"
|
|
keychain_totp_seed="$(_module_bool _keychain_has openconnect-lite "totp/$KC_USERNAME")"
|
|
app_installed="$(_module_bool test -x "$APP_DIR/Contents/MacOS/LemanaVPN")"
|
|
app_autostart="$(_module_bool test -f "$LAUNCH_AGENT")"
|
|
|
|
printf 'Modules: %s %s, ' "$([[ "$core" == "core=ok" ]] && printf '✅' || printf '⚠️')" "$core"
|
|
_module_human_part "bitwarden" "$USE_BITWARDEN" "$bitwarden_installed"
|
|
printf ', '
|
|
_module_human_part "touchid" "$USE_TOUCHID" "$touchid_installed"
|
|
printf ', %s dns=%s, %s app=%s, %s autostart=%s, %s patches=%s, %s keychain=password:%s/totp_seed:%s\n' \
|
|
"$([[ "$dns_cleanup_installed" == "true" ]] && printf '✅' || printf '⚠️')" \
|
|
"$([[ "$dns_cleanup_installed" == "true" ]] && printf on || printf missing)" \
|
|
"$([[ "$app_installed" == "true" ]] && printf '✅' || printf '⚠️')" \
|
|
"$([[ "$app_installed" == "true" ]] && printf on || printf missing)" \
|
|
"$([[ "$app_autostart" == "true" ]] && printf '✅' || printf '⏭️')" \
|
|
"$([[ "$app_autostart" == "true" ]] && printf on || printf off)" \
|
|
"$([[ "$patches_active" == "true" ]] && printf '✅' || printf '⚠️')" \
|
|
"$([[ "$patches_active" == "true" ]] && printf active || printf pending)" \
|
|
"$([[ "$keychain_password" == "true" && "$keychain_totp_seed" == "true" ]] && printf '✅' || printf '⚠️')" \
|
|
"$([[ "$keychain_password" == "true" ]] && printf yes || printf no)" \
|
|
"$([[ "$keychain_totp_seed" == "true" ]] && printf yes || printf no)"
|
|
}
|
|
|
|
_check_status() {
|
|
local modules_json
|
|
modules_json="$(_module_status_json)"
|
|
|
|
if [[ ! -f "$STATUS_FILE" ]]; then
|
|
if $JSON_MODE; then
|
|
printf '{"state":"disconnected","reason":"no status file","modules":%s}\n' "$modules_json"
|
|
else
|
|
_module_status_human
|
|
printf '%s\n' "VPN disconnected (нет status-файла)"
|
|
fi
|
|
return 0
|
|
fi
|
|
|
|
local status_json pid state ip expires dns_target
|
|
status_json="$(cat "$STATUS_FILE")"
|
|
pid="$(printf '%s' "$status_json" | _json_get pid)"
|
|
state="$(printf '%s' "$status_json" | _json_get state)"
|
|
ip="$(printf '%s' "$status_json" | _json_get ip)"
|
|
expires="$(printf '%s' "$status_json" | _json_get expires)"
|
|
dns_target="$(printf '%s' "$status_json" | _json_get dns_target)"
|
|
|
|
local process_alive=false
|
|
if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
|
|
process_alive=true
|
|
fi
|
|
|
|
if [[ "$state" != "connected" ]] || ! $process_alive; then
|
|
if $JSON_MODE; then
|
|
printf '{"state":"disconnected","reason":"%s","modules":%s}\n' "$(! $process_alive && printf 'process dead (pid=%s)' "$pid" || printf '%s' "$state")" "$modules_json"
|
|
else
|
|
_module_status_human
|
|
printf '%s\n' "VPN disconnected"
|
|
fi
|
|
return 0
|
|
fi
|
|
|
|
local healthy=false
|
|
if [[ -n "$dns_target" ]] && ping -c 1 -W 2000 "$dns_target" >/dev/null 2>&1; then
|
|
healthy=true
|
|
fi
|
|
|
|
local remaining_sec=0 hours=0 mins=0
|
|
if [[ -n "$expires" ]]; then
|
|
local exp_ts now_ts
|
|
exp_ts="$(date -jf "%Y-%m-%dT%H:%M:%SZ" "$expires" "+%s" 2>/dev/null || true)"
|
|
now_ts="$(date "+%s")"
|
|
if [[ -n "$exp_ts" ]]; then
|
|
remaining_sec=$((exp_ts - now_ts))
|
|
hours=$((remaining_sec / 3600))
|
|
mins=$(((remaining_sec % 3600) / 60))
|
|
fi
|
|
fi
|
|
|
|
if $JSON_MODE; then
|
|
printf '{"state":"connected","ip":"%s","healthy":%s,"remaining_sec":%s,"expires":"%s","pid":%s,"dns_target":"%s","modules":%s}\n' \
|
|
"$ip" "$healthy" "$remaining_sec" "$expires" "$pid" "$dns_target" "$modules_json"
|
|
else
|
|
_module_status_human
|
|
printf 'VPN connected - %s (session: %sh %sm, tunnel: %s)\n' \
|
|
"$ip" "$hours" "$mins" "$($healthy && printf healthy || printf unhealthy)"
|
|
fi
|
|
}
|
|
|
|
_patch_oc() {
|
|
local wep
|
|
wep="$(_find_webengine_process)"
|
|
if [[ -z "$wep" || ! -f "$wep" ]]; then
|
|
printf 'webengine_process.py not found. Run: pipx install openconnect-lite\n' >&2
|
|
return 1
|
|
fi
|
|
|
|
"$OC_PYTHON" - "$wep" "$PATCH_BACKUP_DIR" <<'PY'
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
path = Path(sys.argv[1])
|
|
backup_dir = Path(sys.argv[2])
|
|
backup_file = backup_dir / "webengine_process.py.before-lemana-vpn"
|
|
src = path.read_text()
|
|
before = src
|
|
original = src
|
|
messages = []
|
|
|
|
src = src.replace('argv += ["-platform", "minimal"]', 'argv += ["-platform", "offscreen"]')
|
|
if src != original:
|
|
messages.append("minimal -> offscreen")
|
|
original = src
|
|
|
|
old_fill = 'elem.dispatchEvent(new Event("focus")); elem.value = {value}; elem.dispatchEvent(new Event("blur"));'
|
|
new_fill = 'elem.dispatchEvent(new Event("focus")); elem.value = {value}; elem.dispatchEvent(new Event("input", {{bubbles: true}})); elem.dispatchEvent(new Event("change", {{bubbles: true}})); elem.dispatchEvent(new Event("blur"));'
|
|
if old_fill in src:
|
|
src = src.replace(old_fill, new_fill)
|
|
messages.append("input/change events")
|
|
|
|
if "new RegExp" not in src:
|
|
old_block = ''' script.setSourceCode(
|
|
f"""
|
|
// ==UserScript==
|
|
// @include {url_pattern}
|
|
// ==/UserScript==
|
|
|
|
function autoFill() {{
|
|
{get_selectors(rules, credentials)}
|
|
setTimeout(autoFill, 1000);
|
|
}}
|
|
autoFill();
|
|
"""
|
|
)'''
|
|
new_block = ''' regex_str = "^" + url_pattern.replace(".", "\\\\.").replace("*", ".*") + "$"
|
|
js_regex_str = json.dumps(regex_str)
|
|
script.setSourceCode(
|
|
f"""
|
|
// ==UserScript==
|
|
// @include {url_pattern}
|
|
// ==/UserScript==
|
|
|
|
var _afUrlPattern = new RegExp({js_regex_str});
|
|
var _afRun = 0;
|
|
function autoFill() {{
|
|
if (!_afUrlPattern.test(location.href.split('?')[0]) && !_afUrlPattern.test(location.href)) {{
|
|
_afRun++;
|
|
return;
|
|
}}
|
|
_afRun++;
|
|
|
|
{get_selectors(rules, credentials)}
|
|
setTimeout(autoFill, 1000);
|
|
}}
|
|
autoFill();
|
|
"""
|
|
)'''
|
|
if old_block not in src:
|
|
print("Cannot apply URL guard patch: unsupported openconnect-lite source", file=sys.stderr)
|
|
sys.exit(1)
|
|
src = src.replace(old_block, new_block)
|
|
messages.append("URL guard")
|
|
|
|
if src != before:
|
|
backup_dir.mkdir(parents=True, exist_ok=True)
|
|
if not backup_file.exists():
|
|
backup_file.write_text(before)
|
|
path.write_text(src)
|
|
for message in messages:
|
|
print(f"Patch applied: {message}")
|
|
PY
|
|
}
|
|
|
|
_store_keychain() {
|
|
local password="$1" totp_secret="$2"
|
|
KC_USERNAME="$KC_USERNAME" _VPN_PASS="$password" _VPN_TOTP_SECRET="$totp_secret" "$OC_PYTHON" - <<'PY'
|
|
import keyring
|
|
import os
|
|
|
|
username = os.environ["KC_USERNAME"]
|
|
password = os.environ.get("_VPN_PASS", "")
|
|
totp_secret = os.environ.get("_VPN_TOTP_SECRET", "")
|
|
|
|
if password:
|
|
keyring.set_password("openconnect-lite", username, password)
|
|
if totp_secret:
|
|
keyring.set_password("openconnect-lite", "totp/" + username, totp_secret)
|
|
PY
|
|
}
|
|
|
|
_can_prompt() {
|
|
[[ -t 0 ]]
|
|
}
|
|
|
|
_configure_keychain() {
|
|
local password totp_secret
|
|
local password_present=false totp_present=false
|
|
_keychain_has openconnect-lite "$KC_USERNAME" && password_present=true
|
|
_keychain_has openconnect-lite "totp/$KC_USERNAME" && totp_present=true
|
|
|
|
printf 'Manual LDAP credentials setup for Lemana VPN\n'
|
|
printf 'User: %s\n' "$KC_USERNAME"
|
|
printf 'LDAP password: your corporate LDAP/domain password, not the Bitwarden master password.\n'
|
|
printf 'TOTP seed: permanent BASE32 secret from 2FA setup, not the current 6-digit code.\n'
|
|
printf 'Saved values go to macOS Keychain service openconnect-lite.\n\n'
|
|
|
|
if $password_present; then
|
|
read -rsp "Corporate LDAP password for $KC_USERNAME [leave empty to keep saved password]: " password
|
|
else
|
|
read -rsp "Corporate LDAP password for $KC_USERNAME: " password
|
|
fi
|
|
printf '\n'
|
|
if $totp_present; then
|
|
read -rsp "TOTP seed BASE32 [leave empty to keep saved seed]: " totp_secret
|
|
else
|
|
read -rsp "TOTP seed BASE32 from 2FA setup: " totp_secret
|
|
fi
|
|
printf '\n'
|
|
|
|
if [[ -z "$password" && "$password_present" != "true" ]]; then
|
|
printf 'LDAP password is required because no saved password was found.\n' >&2
|
|
return 1
|
|
fi
|
|
if [[ -z "$totp_secret" && "$totp_present" != "true" ]]; then
|
|
printf 'TOTP seed is required because no saved seed was found. Use the BASE32 setup secret, not the current 6-digit code.\n' >&2
|
|
return 1
|
|
fi
|
|
|
|
_store_keychain "$password" "$totp_secret"
|
|
printf 'Credentials are ready in macOS Keychain for openconnect-lite/%s.\n' "$KC_USERNAME"
|
|
}
|
|
|
|
_ensure_keychain_credentials() {
|
|
local password_present=false totp_present=false
|
|
_keychain_has openconnect-lite "$KC_USERNAME" && password_present=true
|
|
_keychain_has openconnect-lite "totp/$KC_USERNAME" && totp_present=true
|
|
|
|
if [[ "$password_present" == "true" && "$totp_present" == "true" ]]; then
|
|
if [[ "$USE_BITWARDEN" == "1" ]]; then
|
|
_emit '{"event":"keychain_ready","source":"keychain"}' "LDAP credentials are ready in macOS Keychain for $KC_USERNAME."
|
|
else
|
|
_emit '{"event":"keychain_ready","source":"keychain","bitwarden":false}' "Bitwarden is disabled. Using saved LDAP password and TOTP seed from macOS Keychain for $KC_USERNAME."
|
|
fi
|
|
return 0
|
|
fi
|
|
|
|
if [[ "$USE_BITWARDEN" == "1" ]]; then
|
|
_emit '{"event":"keychain_required","bitwarden":true}' "Bitwarden sync did not produce complete Keychain credentials."
|
|
else
|
|
_emit '{"event":"keychain_required","bitwarden":false}' "Bitwarden is disabled and saved LDAP credentials are incomplete."
|
|
fi
|
|
|
|
if ! _can_prompt; then
|
|
_emit '{"event":"error","message":"LDAP credentials are missing. Run vpn --configure-keychain in Terminal, or reinstall with --configure-keychain."}' \
|
|
"LDAP credentials are missing. Run: vpn --configure-keychain"
|
|
return 1
|
|
fi
|
|
|
|
_configure_keychain
|
|
}
|
|
|
|
_bw_cache_session() {
|
|
[[ "$CACHE_BW_SESSION" == "1" ]] || return 0
|
|
local session="$1"
|
|
security delete-generic-password -s "$BW_KC_SERVICE" -a "$BW_KC_ACCOUNT_SESSION" >/dev/null 2>&1 || true
|
|
security add-generic-password -s "$BW_KC_SERVICE" -a "$BW_KC_ACCOUNT_SESSION" -w "$session" -U >/dev/null 2>&1 || true
|
|
}
|
|
|
|
_bw_unlock() {
|
|
[[ "$USE_BITWARDEN" == "1" ]] || return 1
|
|
|
|
if ! command -v bw >/dev/null 2>&1; then
|
|
printf 'Bitwarden CLI is not installed. Using existing Keychain credentials.\n' >&2
|
|
return 1
|
|
fi
|
|
|
|
if [[ "$CACHE_BW_SESSION" == "1" ]]; then
|
|
local cached_session
|
|
cached_session="$(security find-generic-password -s "$BW_KC_SERVICE" -a "$BW_KC_ACCOUNT_SESSION" -w 2>/dev/null || true)"
|
|
if [[ -n "$cached_session" ]] && bw status --session "$cached_session" 2>/dev/null | grep -q '"status":"unlocked"'; then
|
|
BW_SESSION="$cached_session"
|
|
_emit '{"event":"bw_cached"}' "Bitwarden: cached session"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if [[ "$USE_TOUCHID" == "1" && -x "$KC_FP" ]]; then
|
|
local master_pw
|
|
master_pw="$("$KC_FP" get "$BW_KC_SERVICE" "$BW_KC_ACCOUNT_MASTER" 2>/dev/null || true)"
|
|
if [[ -n "$master_pw" ]]; then
|
|
_emit '{"event":"bw_touchid"}' "Bitwarden: unlocking via Touch ID..."
|
|
BW_SESSION="$(BW_PASSWORD="$master_pw" bw unlock --passwordenv BW_PASSWORD --raw 2>/dev/null || true)"
|
|
unset master_pw
|
|
if [[ -n "${BW_SESSION:-}" ]]; then
|
|
_bw_cache_session "$BW_SESSION"
|
|
return 0
|
|
fi
|
|
printf 'Touch ID password was rejected. Falling back to manual unlock.\n' >&2
|
|
fi
|
|
fi
|
|
|
|
local manual_pw
|
|
if ! _can_prompt; then
|
|
printf 'Bitwarden vault is locked and no interactive terminal is available. Using existing Keychain credentials.\n' >&2
|
|
return 1
|
|
fi
|
|
|
|
_emit '{"event":"bw_manual"}' "Bitwarden vault is locked. Enter Bitwarden master password to sync LDAP credentials."
|
|
read -rsp "Bitwarden master password (not LDAP password): " manual_pw
|
|
printf '\n'
|
|
if [[ -z "$manual_pw" ]]; then
|
|
printf 'Empty Bitwarden password. Using existing Keychain credentials.\n' >&2
|
|
return 1
|
|
fi
|
|
|
|
BW_SESSION="$(BW_PASSWORD="$manual_pw" bw unlock --passwordenv BW_PASSWORD --raw 2>/dev/null || true)"
|
|
if [[ -z "${BW_SESSION:-}" ]]; then
|
|
unset manual_pw
|
|
printf 'Failed to unlock Bitwarden. Using existing Keychain credentials.\n' >&2
|
|
return 1
|
|
fi
|
|
_bw_cache_session "$BW_SESSION"
|
|
|
|
if [[ "$USE_TOUCHID" == "1" && -x "$KC_FP" ]]; then
|
|
local save_choice
|
|
read -rp "Save Bitwarden master password behind Touch ID for next VPN unlock? [Y/n] " save_choice
|
|
if [[ "${save_choice:-y}" =~ ^[Yy]?$ ]]; then
|
|
printf '%s' "$manual_pw" | "$KC_FP" set "$BW_KC_SERVICE" "$BW_KC_ACCOUNT_MASTER" >/dev/null 2>&1 \
|
|
&& printf 'Saved. Next unlock can use Touch ID.\n' \
|
|
|| printf 'Could not save Bitwarden master password.\n' >&2
|
|
fi
|
|
fi
|
|
|
|
unset manual_pw
|
|
return 0
|
|
}
|
|
|
|
_sync_bitwarden() {
|
|
if ! _bw_unlock; then
|
|
return 0
|
|
fi
|
|
|
|
local bw_password bw_item bw_totp_secret
|
|
bw_password="$(bw get password "$BW_ITEM_NAME" --session "$BW_SESSION" 2>/dev/null || true)"
|
|
bw_item="$(bw get item "$BW_ITEM_NAME" --session "$BW_SESSION" 2>/dev/null || true)"
|
|
bw_totp_secret="$(printf '%s' "$bw_item" | python3 -c '
|
|
import json
|
|
import re
|
|
import sys
|
|
|
|
try:
|
|
data = json.load(sys.stdin)
|
|
totp = data.get("login", {}).get("totp", "") or ""
|
|
if totp.startswith("otpauth://"):
|
|
match = re.search(r"secret=([A-Z2-7]+)", totp, re.IGNORECASE)
|
|
print(match.group(1) if match else "")
|
|
else:
|
|
print(totp.strip())
|
|
except Exception:
|
|
print("")
|
|
')"
|
|
|
|
if [[ -n "$bw_password" ]]; then
|
|
_store_keychain "$bw_password" "$bw_totp_secret"
|
|
_emit '{"event":"bw_synced"}' "Credentials synced from Bitwarden to Keychain"
|
|
else
|
|
printf 'Could not fetch Bitwarden item "%s". Using existing Keychain credentials.\n' "$BW_ITEM_NAME" >&2
|
|
fi
|
|
}
|
|
|
|
_dns_cleanup() {
|
|
_emit '{"event":"dns_cleanup"}' "Cleaning up VPN DNS..."
|
|
if [[ -x "$DNS_CLEANUP" ]]; then
|
|
sudo "$DNS_CLEANUP" || true
|
|
return 0
|
|
fi
|
|
|
|
for svc in "Wi-Fi" "USB 10/100/1000 LAN" "Ethernet"; do
|
|
local dns
|
|
dns="$(networksetup -getdnsservers "$svc" 2>/dev/null || true)"
|
|
if printf '%s\n' "$dns" | grep -q '^10\.'; then
|
|
sudo networksetup -setdnsservers "$svc" empty >/dev/null 2>&1 || true
|
|
fi
|
|
done
|
|
sudo dscacheutil -flushcache >/dev/null 2>&1 || true
|
|
sudo killall -HUP mDNSResponder >/dev/null 2>&1 || true
|
|
}
|
|
|
|
_filter_output() {
|
|
local vpn_ip=""
|
|
while IFS= read -r line; do
|
|
if $DEBUG; then
|
|
printf '%s\n' "$line"
|
|
fi
|
|
|
|
if [[ "$line" =~ Configured\ as\ ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+) ]]; then
|
|
vpn_ip="${BASH_REMATCH[1]}"
|
|
fi
|
|
|
|
if [[ "$line" =~ Session\ authentication\ will\ expire\ at\ (.+) ]]; then
|
|
local expiry_str="${BASH_REMATCH[1]}"
|
|
local expiry_ts expiry_local expiry_iso now_ts remaining hours mins
|
|
expiry_ts="$(date -jf "%a %b %d %H:%M:%S %Y" "$expiry_str" "+%s" 2>/dev/null || true)"
|
|
expiry_iso=""
|
|
if [[ -n "$expiry_ts" ]]; then
|
|
expiry_local="$(date -jf "%a %b %d %H:%M:%S %Y" "$expiry_str" "+%H:%M" 2>/dev/null || true)"
|
|
expiry_iso="$(date -r "$expiry_ts" -u "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || true)"
|
|
now_ts="$(date "+%s")"
|
|
remaining=$((expiry_ts - now_ts))
|
|
hours=$((remaining / 3600))
|
|
mins=$(((remaining % 3600) / 60))
|
|
fi
|
|
|
|
if [[ -n "$vpn_ip" ]]; then
|
|
_emit "{\"event\":\"connected\",\"ip\":\"$vpn_ip\",\"expires\":\"$expiry_iso\"}" "VPN connected - $vpn_ip"
|
|
else
|
|
_emit '{"event":"connected"}' "VPN connected"
|
|
fi
|
|
if [[ -n "${expiry_ts:-}" ]]; then
|
|
_emit "{\"event\":\"session_info\",\"ip\":\"${vpn_ip:-}\",\"expires\":\"$expiry_iso\",\"remaining_sec\":$remaining}" "Session until $expiry_local (${hours}h ${mins}m)"
|
|
fi
|
|
|
|
local dns_target
|
|
dns_target="$(scutil --dns 2>/dev/null | awk '/Supplemental/{found=1} found && /nameserver\[0\]/{split($0,a," : "); if(a[2] ~ /^10\./) {print a[2]; exit}}' || true)"
|
|
_write_status "{\"pid\":$$,\"state\":\"connected\",\"ip\":\"${vpn_ip:-}\",\"expires\":\"${expiry_iso:-}\",\"started_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"dns_target\":\"${dns_target:-}\",\"updated_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"
|
|
|
|
$DEBUG || $JSON_MODE || printf '%s\n' "Ctrl+C to disconnect"
|
|
fi
|
|
done
|
|
}
|
|
|
|
if $STATUS_MODE; then
|
|
_check_status
|
|
exit 0
|
|
fi
|
|
|
|
if $CONFIGURE_KEYCHAIN_MODE; then
|
|
_configure_keychain
|
|
exit 0
|
|
fi
|
|
|
|
if ! $JSON_MODE; then
|
|
_module_status_human
|
|
else
|
|
printf '{"event":"modules","modules":%s}\n' "$(_module_status_json)"
|
|
fi
|
|
|
|
_sync_bitwarden
|
|
_ensure_keychain_credentials
|
|
_patch_oc
|
|
|
|
_emit '{"event":"connecting"}' "Connecting to VPN (lemanapro)..."
|
|
_write_status "{\"pid\":$$,\"state\":\"connecting\",\"updated_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"
|
|
trap '_dns_cleanup; _clear_status' EXIT
|
|
|
|
display_mode="hidden"
|
|
log_level=""
|
|
if $DEBUG; then
|
|
display_mode="shown"
|
|
log_level="--log-level debug"
|
|
fi
|
|
|
|
reconnect_count=0
|
|
while true; do
|
|
QTWEBENGINE_CHROMIUM_FLAGS="--disable-gpu" \
|
|
"$OC_BIN" --browser-display-mode "$display_mode" $log_level 2>&1 \
|
|
| _filter_output
|
|
exit_code=${PIPESTATUS[0]}
|
|
|
|
if [[ $exit_code -eq 0 ]]; then
|
|
_emit '{"event":"disconnected","reason":"user"}' "VPN disconnected"
|
|
break
|
|
fi
|
|
|
|
reconnect_count=$((reconnect_count + 1))
|
|
_emit "{\"event\":\"reconnecting\",\"attempt\":$reconnect_count,\"delay\":5}" "VPN exited with $exit_code. Reconnecting in 5s..."
|
|
sleep 5
|
|
_emit '{"event":"connecting"}' "Reconnecting..."
|
|
done
|