#!/bin/sh
# Automatically sets up OpenVPN access on Debian Squeeze, with
# sending mails over the VPN, gid-based selection of default
# route over the VPN (have one firefox for normal browsing,
# another for VPN browsing), and NetworkManager integration.

echo Packages setup...
apt-get install openvpn network-manager-openvpn

echo Setting up kamvpn group...
echo kamvpn:x:1500:kam >>/etc/group

echo Setting up routing table kamvpn...
echo -e '64\tkamvpn' >>/etc/iproute2/rt_tables

echo Setting up exim4 to send mail over VPN...
sed -i -e "s/dc_eximconfig_configtype='local'/dc_eximconfig_configtype='satellite'/; s/$(hostname)\(.kam.hide*\)*/$(hostname)-vpn.kam.hide/; s/dc_smarthost=.*/dc_smarthost='10.10.8.2'/" /etc/exim4/update-exim4.conf.conf
echo kam.mff.cuni.cz >/etc/mailname
dpkg-reconfigure -f noninteractive exim4-config


echo Setting up iptables configuration...
cat >/etc/network/iptables <<EOT
#!/bin/sh
# This magic was devised by Martin Mares
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark         # if we already have a connection mark, use it (this is needed to get FIN packets right)
iptables -t mangle -A OUTPUT -m mark ! --mark 0 -j RETURN
iptables -t mangle -A OUTPUT -m owner --gid-owner kamvpn -j MARK --set-mark 42    # otherwise set the mark and save it to connmark
iptables -t mangle -A OUTPUT -m mark --mark 0 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
ip rule add pref 5000 fwmark 42 table kamvpn
EOT
chmod a+x /etc/network/iptables
sed -e '/^iface lo/a\	up /etc/network/iptables' -i /etc/network/interfaces
echo "(if you get an error message now, your kernel does not support policy routing - that is fatal for gid-based routing)"
/etc/network/iptables


echo Setting up kamvpn default route configuration...
# Ideally, adding a script /etc/network/if-up.d/kamvpn should work.
# However, Squeeze NetworkManager does not pass enough information
# to if-up.d.
dpkg-divert --rename /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper
cat >/usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper <<EOT
#!/bin/sh
# Sets up gid-based default route for kamvpn
# We rely on iptable rules in /etc/network/iptables.
ip route flush table kamvpn >/dev/null
# Nameservers must still go in the ordinary fashion.
defgw=\$(ip ro show | grep default | perl -lne '/via (.*?) /; print \$1;')
defdev=\$(ip ro show | grep default | perl -lne '/dev (.*?)\$/; print \$1;')
grep nameserver /etc/resolv.conf | cut -d ' ' -f 2 | while read ns; do
	ip route add \$ns via \$defgw dev \$defdev table kamvpn
done
ip route add default via \$ifconfig_remote src \$ifconfig_local table kamvpn
iptables -t nat -A POSTROUTING -o \$dev -j MASQUERADE
exec /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper.distrib "\$@"
EOT
chmod a+x /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper 


echo Adding README chunk...
cat >>/home/kam/Desktop/README <<EOT
KAM VPN:
	You can connect the VPN using the networking applet (near the clock).
	When the VPN is active (little golden lock is shown in the icon),
	you can send mails from the notebook; you can also use
		$ sg kamvpn -c "firefox"
	(or something else inst. of firefox) to start an application that uses
	the VPN for all outbound connections (e.g. to access journals that
	have access enabled from the university network).
EOT


echo Installing keys...
scp kamdal.ms.mff.cuni.cz:/etc/openvpn/keys/ca.crt /etc/openvpn/kam-ca.crt
scp kamdal.ms.mff.cuni.cz:/etc/openvpn/cert/keys/$(hostname).crt /etc/openvpn/kam.crt
scp kamdal.ms.mff.cuni.cz:/etc/openvpn/cert/keys/$(hostname).key /etc/openvpn/kam.key
chmod 0600 /etc/openvpn/kam.key

echo Setting up NetworkManager OpenVPN configuration...
cat >/etc/NetworkManager/system-connections/kam <<EOT
[connection]
id=kam
uuid=cdcbc5fc-b413-4e48-83e0-e0ed18e61008
type=vpn
autoconnect=false

[ipv4]
method=auto
never-default=true

[vpn]
service-type=org.freedesktop.NetworkManager.openvpn
cert=/etc/openvpn/kam.crt
ca=/etc/openvpn/kam-ca.crt
remote=vpn.kam.mff.cuni.cz
connection-type=tls
comp-lzo=yes
key=/etc/openvpn/kam.key
EOT
/etc/init.d/network-manager restart

echo "Everything should work properly now. (Cross your fingers.)"