openvpn-netns-shell

#!/bin/sh

script_dir="$(dirname "`readlink -f "$0"`")"/openvpn-scripts

: ${NETNS:=vpn}

usage () {
    prog="${0##*/}"
    cat >&2 <<EOF
Start openvpn connection and run command in network namespace. When
the command terminates, openvpn connection is closed. Network
namespace name is given in the environment variable NETNS, or if it is
not set, the default name "vpn" is used.

usage:
    $prog [<options>] <openvpn_options> ...               (starts shell)
    $prog [<options>] <openvpn_options> ... -- <command> [<args> ...]

Options for this program start with + to separate them from OpenVPN
options. They must be before any OpenVPN options.
    +h, ++help        show this help
    +q, ++quiet       don't show messages or OpenVPN output
    +d, ++dbus        start D-Bus session bus proxy
EOF
}

if [ $# -eq 0 ]; then
    usage
    exit 2
elif [ $# -eq 1 ] && [ "$1" = "-h"  -o  "$1" = "--help" ]; then
    usage
    exit
fi


# handle our own options, which are first and start with + or ++
quiet=
netns_exec=netns-exec
_handle_option () {
    opt=
    case "$1" in
        q|++quiet)  quiet=true ;;
        d|++dbus)  netns_exec=netns-exec-dbus ;;
        h|++help)
            usage
            exit
            ;;
        '?')
            echo "Unrecognized option: +$OPTARG" >&2
            exit 2
            ;;
        *)
            echo "Unrecognized option: $1" >&2
            exit 2
            ;;
    esac
}

while [ $# -gt 0  -a  "${1#+}" != "$1" ]; do
    case "$1" in
        ++?*)  # long option
            _handle_option "$1"
            ;;
        +?*)  # one or more short options
            OPTIND=1
            while getopts :qdh opt -"${1#+}"; do
                _handle_option "$opt"
            done
            ;;
        *)
            echo "Unrecognized option: $1" >&2
            exit 2
            ;;
    esac
    shift
done



# make fifo for signaling command termination
tmpdir=/dev/shm
[ -d "$tmpdir" ] || tmpdir=/tmp
fifo="$tmpdir/openvpn-netns-$$-fifo"
mkfifo "$fifo"  || exit


# separate openvpn arguments into list of positional argument
# references for eval
openvpn_args_eval=
num_openvpn_args=0
_openvpn_args () {
    while [ $# -gt 0  -a  "$1" != "--" ]; do
        num_openvpn_args=$(( num_openvpn_args + 1 ))
        openvpn_args_eval="$openvpn_args_eval \"\${$num_openvpn_args}\""
        shift
    done
}
_openvpn_args "$@"

# Run the following as background job. Start openvpn as root, wait for
# command termination message, and then terminate openvpn. (sudo
# password prompt seems to work ok with this background-stdin-redirect
# mess.)
eval sudo /bin/sh -s '"$quiet" "$NETNS" "$script_dir"/netns "$fifo" "$tmpdir"' \
     "$openvpn_args_eval" <<'EOF' &
    quiet="$1"
    netns="$2"
    script="$3"
    fifo="$4"
    tmpdir="$5"
    shift 5

    IFS='
'

    pidfile="$tmpdir/openvpn-netns-$$-openvpn.pid"

    trap 'rm "$fifo" "$pidfile" 2>/dev/null' EXIT
    trap 'exit 0' CHLD

    openvpn \
        --writepid "$pidfile" \
        --ifconfig-noexec --route-noexec \
        --script-security 2 \
        --setenv NETNS "$netns" \
        --up "$script" \
        --route-up "$script" \
        --down "$script" \
        "$@" \
        | \
        while read -r line; do
            [ -z "$quiet" ] && echo "openvpn: $line"
        done &

    # close stderr to suppress "interrupted system call" error
    # messages from read if openvpn terminates on its own
    exec 2>&-
    # wait for command termination message from main script
    read dummy_var < "$fifo"

    # terminate openvpn
    trap - CHLD
    kill -TERM $(cat "$pidfile")
    wait
EOF
sudo_pid=$!


# shift out openvpn arguments
shift $num_openvpn_args
# and "--" if any
[ $# -gt 0 ] && shift

# wait for netns creation
until [ -e "/var/run/netns/$NETNS" ]; do
    sleep 1
    # if the openvpn background job exited before creating the netns, exit
    [ -e "/proc/$sudo_pid" ] || exit 125
done

# in the netns, wait for default IPv4 route, then run the command
$netns_exec -- "$NETNS" /bin/sh -c '
    NETNS="$1"
    quiet="$2"
    shift 2

    while [ -z "`ip route show to exact 0.0.0.0/0`" ]; do sleep 1; done

    if [ -z "$quiet" ]; then
        echo
        echo "Connection established. Using netns \"$NETNS\"."
        echo "Your IP address:" $(
            ip -4 address show \
                | sed -ne '\''s|^.*inet \([0-9]\+\(\.[0-9]\+\)\{3\}\)[^0-9].*$|\1|p'\'' \
                | grep -v "^127\." )
        echo "Starting $*"
        echo
    fi

    if [ $# -gt 0 ]; then
        exec "$@"
    else
        exec "${SHELL:-/bin/sh}"
    fi
    ' '<wait-for-connection>' "$NETNS" "$quiet" "$@"
status=$?

if [ -z "$quiet" ]; then
    echo
    echo 'Command exited.'
fi

# send message to root subshell to terminate openvpn
echo done > "$fifo"

if [ -z "$quiet" ]; then
    echo 'Waiting for openvpn to terminate.'
fi
wait

exit $status