net

#!/usr/bin/env python2.7
import os, sys, time, subprocess, re, random, yaml, json, resource

# Based on https://git.pwnies.dk/IdolfHatler/vcsh-wifi

DEFAULT_CONFIG_FILE = '~/.net.conf'

CONFIG_FILE = None
CONFIG      = None
COMMON      = None
IFACE       = None
VERBOSE     = False
IGNORED_IFACES = set()
IGNORED_SSIDS  = set()
VPN_TMPSTOP_DELAY = 60*5

# Valid config file keys:
KNOWN_KEYS = (
  'ssid',
  'psk',
  'mac',
  'dns',
  'wpa',
  'hostname',
  'interface',
  'addr',
  'gateway',
  'vpn',
  'routes',
  'udhcpc-config',
  'ap-addr',
)


# Use these if they are not defined in the configuration file
FALLBACK_CONFIG = {
    'ignored': {
        'interfaces': [
            r'docker[0-9]+',
            r'br[0-9]+',
            r'vboxnet[0-9]+',
            r'tap[0-9]+',
            r'tun[0-9]+',
            r'vmnet[0-9]+',
            ],
        'ssids': [],
        },
    'wired': {
        'dns'     : 'dhcp',
        'mac'     : 'default',
        'hostname': None,
        },
    }

def die(msg='', exitcode=1):
    if msg:
        print >>sys.stderr, msg
    sys.exit(exitcode)

def log(msg):
    print >>sys.stderr, msg

def logv(msg):
    if VERBOSE:
        log(msg)

def usage():
    die(\
    '''usage: net [<command>] [<args>] [--config=<config>] [--iface=<interface>]
           [--no-vpn] [--verbose] [-h] [--help]

Shorthands:
  If no positional arguments are given the command is "list".
  If one positional argument is given the command is "connect".

Commands:
  list:
    List available connections.
  scan:
    Scan for access points.
  connect <connection> [<password>]:
    If <connection> is present in the configuration file then use that,
    otherwise connect to an access point with SSID <connection>, using the
    password <password> if specified.
  stop [<interface> [<interface> ...]]:
    Bring down the connection.  Brings down all interfaces if called with no
    arguments.
  dns [<dns> [<dns> ...]]:
    Change DNS server.  No argument or "dhcp" requests DNS servers via DHCP.
  mac [<mac>]:
    Change the MAC address of the interface specified by --iface.  If no address
    is given, one is chosen at random.
  vpn <name> [stop|tmpstop [delay]]:
    Connect to, or disconnect (temporarily [default = 5m] in case of tmpstop)
    from, VPN.
  genkey:
    Generate a WireGuard key pair.
  show [<connection>]:
    Show configuration options.  If no connection is specified, all are show.
  help:
    You're reading it.

Options:
  --config=<config>:
    Select configurations file.  If <config> is "-" no configuration file is
    used.  Defaults to "~/.net.conf".
  --iface=<interface>:
    Select networking interface.  Overridden by configuration file if specified.
    Defaults to first WiFi capable interface found.
  --no-vpn:
    Don't connect to a VPN.  Acts as if the connection configuration did not
    have a `vpn` field.
  --verbose:
    Print every executed command (and the result) to stdout.''')

ANSI_ESC = '\x1b[%dm'
ANSI_RESET = ANSI_ESC % 0
def ansi(s, esc):
    s = esc + s
    if not s.endswith(ANSI_RESET):
        s += ANSI_RESET
    return s

def red(s):
    return ansi(s, ANSI_ESC % 31)

def green(s):
    return ansi(s, ANSI_ESC % 32)

def optlist(s, opts, default = None, abbrevs = None):
    # Option list:
    #  [(key, altkey1, altkey2, ..., value), ...]
    #  [key, ...]
    def conv(opt):
        if isinstance(opt, (str, unicode)):
            return ((opt,),opt)
        return (opt[:-1], opt[-1])
    opts = map(conv, opts)

    abbrevs = abbrevs or {}
    for ks, _ in opts:
        k = ks[0]
        abbrevs.setdefault(k, k[0])

    if len(set(abbrevs.values())) != len(opts):
        die('Ambiguous options')

    ls = map(len, abbrevs.values())
    if max(ls) > 1 or min(ls) < 1:
        die('Abbreviation must be exactly one character')

    abbrs = []
    pabbrs = []
    for ks, v in opts:
        k = ks[0]
        abbr = abbrevs[k]
        abbrs.append(abbr)
        if default in (k, v):
            abbr = green(abbr.upper())
        pabbrs.append(abbr)
    prompt = '%s [%s]: ' % (s, '/'.join(pabbrs))

    while True:
        opt = raw_input(prompt).lower()
        if opt == '':
            return default
        for ks, v in opts:
            abbr = abbrevs[ks[0]]
            if opt == abbr or opt in ks:
                return v
        print 'Please select one of %s' % ', '.join(abbrs)

def yesno (s, default):
    optlist = green('Y') + '/n' if default else 'y/' + green('N')
    prompt = '%s [%s]: ' % (s, optlist)
    while True:
        opt = raw_input(prompt).lower()
        if opt == '':
            return default
        if opt in ('yes', 'y'):
            return True
        if opt in ('no', 'n'):
            return False
        print 'Please answer yes or no'

def run(cmd, exit_on_error = False):
    if VERBOSE:
        print '+', cmd
    p = subprocess.Popen(cmd,
                         stdin  = file('/dev/null'),
                         stdout = subprocess.PIPE,
                         stderr = subprocess.PIPE,
                         shell = True,
                         )
    o, e = p.communicate()
    status = p.poll()
    if status != 0:
        if exit_on_error or VERBOSE:
            print 'Failed (status: %d): %s' % (status, cmd)
        if exit_on_error:
            die(e)
        else:
            return None
    if VERBOSE:
        if o:
            print o.rstrip()
        if e:
            print red(e.strip())
    return o

def run_or_die(cmd):
    return run(cmd, exit_on_error = True)

def daemon():
    try:
        pid = os.fork()
        if pid > 0:
            # Return as parent
            return False
    except OSError, e:
        die('fork failed')

    # decouple from parent environment
    os.chdir('/')
    os.setsid()
    os.umask(0)

    # do second fork
    try:
        pid = os.fork()
        if pid > 0:
            # exit from second parent
            sys.exit(0)
    except OSError, e:
        die('fork failed')

    # Close file descriptors
    # sys.stdout.flush()
    # sys.stderr.flush()
    # for i in range(1024):
    #     os.close(i)

    # Return as daemon
    return True

def run_daemon(argv):
    if VERBOSE:
        print '+ (DAEMON)', ' '.join(argv)
    if daemon():
        os.execvp(argv[0], argv)
        die('exec failed')

def rm(*paths):
    for p in paths:
        try:
            os.unlink(p)
        except OSError:
            pass

def expand(path):
    if path.startswith('~/'):
        user = os.environ.get('SUDO_USER', '')
        path = '~%s/%s' % (user, path[2:])
    return os.path.expanduser(path)

def become_root():
    if os.getuid() != 0:
        os.execlp('sudo', 'sudo', 'python', *sys.argv)

def write_root_file(path, mode, data):
    with open(path, 'w') as fd:
        os.fchown(fd.fileno(), 0, 0)
        os.fchmod(fd.fileno(), mode)
        fd.write(data)

def ignore(iface):
    return any(ign.match(iface) for ign in IGNORED_IFACES)

def get_ifaces(only_up = False):
    ifaces = []
    for iface, parms in re.findall(r'^\d+: (\S+?)(?:@\S+)?: <([^>]*)>',
                                   run_or_die('ip link show'),
                                   re.MULTILINE):
        if 'LOOPBACK' in parms:
            continue
        if only_up and 'UP' not in parms:
            continue
        if not ignore(iface):
            ifaces.append(iface)
    return ifaces

def get_ifaces_up():
    return get_ifaces(True)

def is_wifi_iface(iface):
    return run('iw dev %s info' % iface) != None

def get_wifi_ifaces():
    return [iface for iface in
            run_or_die('ls -d /sys/class/net/*/wireless 2>/dev/null | cut -d/ -f5').strip().split('\n')
            if not ignore(iface)]

def get_wifi_iface_up():
    for iface in get_ifaces_up():
        if is_wifi_iface(iface):
            return iface

def get_default_wifi_iface():
    ifaces = get_wifi_ifaces()
    if ifaces:
        iface = ifaces[0]
        if len(ifaces) > 1:
            print 'Using interface "%s"' % iface
        return iface
    die('Could not find any WiFi interfaces')

def get_default_wired_iface():
    # This is an ugly hack, but is there any better way?  We get the
    # non-wireless, non-loopback interfaces and select the first one. Hopefully
    # that is good enough.
    ifaces = [iface for iface in get_ifaces() if not is_wifi_iface(iface)]
    if ifaces:
        iface = ifaces[0]
        if len(ifaces) > 1:
            print 'Using interface "%s"' % iface
        return iface
    die('Could not find any wired interfaces')

def normalize_net_or_host(sel):
    if sel == 'default':
        sel = '0.0.0.0/0'
    if '/' in sel:
        addr, mask = sel.split('/')
        mask = int(mask)
    else:
        addr = sel
        mask = 32
    return addr, mask

def get_routes():
    become_root()
    output = run_or_die('ip -4 route')
    routes = []
    for line in output.splitlines():
        fields = line.split()
        target = fields[0]
        attrs = fields[1:]
        target, netmask = normalize_net_or_host(target)
        route = {'target': target,
                 'netmask': netmask,
        }
        for i in xrange(0, len(attrs), 2):
            route[attrs[i]] = attrs[i + 1]
        routes.append(route)
    return routes

def get_default_route():
    for route in get_routes():
        if route['netmask'] == 0:
            return route

def get_addrs4(iface, with_netmask=False):
    output = run_or_die('ip addr show %s' % iface)
    addrs = re.findall(r'inet (\d+\.\d+\.\d+\.\d+)(?:/(\d+))?', output)
    if not with_netmask:
        addrs = [addr[0] for addr in addrs]
    return addrs

def get_addr4(iface, with_netmask=False):
    addrs = get_addrs4(iface, with_netmask=with_netmask)
    if addrs:
        return addrs[0]

def get_vpns():
    read_config()
    return VPN.keys()

def bash_complete(xs):
    # XXX: Make this robust
    def quote(s):
        return s.encode('utf8').replace(' ', r'\\ ')
    print '\n'.join(map(quote, xs))
    sys.exit(0)

def parse_args():
    global CONFIG_FILE, IFACE, VERBOSE, NOVPN

    optional = {}
    args = sys.argv[1:][::]
    i = 0
    while i < len(args):
        arg = args[i]
        if arg.startswith('--'):
            if '=' in arg:
                key, val = arg.split('=', 1)
            else:
                key = arg
                val = True
            optional[key] = val
            args.pop(i)
        elif arg.startswith('-'):
            for key in arg[1:]:
                optional['-' + key] = True
            args.pop(i)
        else:
            i += 1

    CONFIG_FILE = optional.pop('--config', DEFAULT_CONFIG_FILE)
    if CONFIG_FILE == '-':
        CONFIG_FILE = None

    if '-h' in optional or '--help' in optional or (args and args[0] == 'help'):
        usage()

    read_config()
    if '--internal-list-all' in optional:
        bash_complete(CONFIG.keys())
    if '--internal-list-up' in optional:
        bash_complete(get_ifaces_up())
    if '--internal-list-vpn' in optional:
        bash_complete(get_vpns())
    if '--internal-scan-cache' in optional:
        try:
            bash_complete(json.load(open('/tmp/.net-scan')))
        except:
            die('')

    IFACE   = optional.pop('--iface', None)
    VERBOSE = optional.pop('--verbose', False)
    NOVPN   = optional.pop('--no-vpn', False)

    if optional:
        die('Unknown argument: %s' % optional.keys()[0])

    if len(args) == 0:
        return 'list', []

    if args[0] in ('list', 'scan', 'connect', 'mac', 'dns', 'stop', 'show', 'vpn', 'genkey'):
        cmd = args.pop(0)
    else:
        cmd = 'connect'

    return cmd, args

def parse_wpa_conf(raw_conf):
    stack = []
    obj = {}
    for line in raw_conf.split('\n'):
        line = line.strip()
        if not line:
            continue
        if line == '}':
            try:
                obj = stack.pop()
            except IndexError:
                die('Unmatched }')
            continue
        if '=' not in line:
            die('Expected = in line: %s' % line)
        key, val = line.split('=', 1)
        key = key.strip()
        val = val.strip()
        if val == '{':
            child = {}
            obj[key] = child
            stack.append(obj)
            obj = child
        else:
            obj[key] = val
    if len(stack) > 0:
        die('Unmatched {')
    return obj

def write_wpa_conf(conf):
    def loop(obj):
        out = []
        for k, v in obj.items():
            if isinstance(v, str):
                out.append('%s=%s' % (k, v))
            else:
                out.append('%s={' % k)
                out += ['  ' + line for line in loop(v)]
                out.append('}')
        return out
    return '\n'.join(loop(conf)) + '\n'

def read_config(reraise = False):
    global CONFIG, COMMON, IGNORED_IFACES, IGNORED_SSIDS, VPN
    if CONFIG is not None:
        return
    CONFIG = {}
    COMMON = {}
    if CONFIG_FILE is None:
        return
    try:
        with open(expand(CONFIG_FILE)) as fd:
            raw_config = yaml.load(fd)
    except Exception as e:
        if reraise:
            raise
        die(e)
    if raw_config is None:
        if reraise:
            raise
        die('Empty configuration')
    for k, v in FALLBACK_CONFIG.items():
        raw_config.setdefault(k, v)

    IGN = raw_config.pop('ignored', {})
    IGNORED_IFACES = set(re.compile(ign) for ign in IGN.get('interfaces') or [])
    IGNORED_SSIDS = set(re.compile(ign) for ign in IGN.get('ssids') or [])
    VPN = raw_config.pop('vpn', {})

    for name, raw_conn in raw_config.items():
        conn = {}
        for key, val in (raw_conn or {}).items():
            # Assume UTF-8 encoding
            if isinstance(val, unicode):
                val = val.encode('utf8')
            if key == 'wpa':
                val = parse_wpa_conf(val)
            if key not in KNOWN_KEYS:
                die('Unknown key: %s' % key)
            if isinstance(val, unicode):
                # The yaml decoder will convert
                # non-ascii strings into unicode
                # This is not what we want. We want
                # e.g. '\xc3' in the yaml file to become b'\xc3',
                # not u'\xc3'.
                # This is an ugly hack to fix it.
                val = val.encode('iso-8859-1')
            conn[key] = val
        if name == 'common':
            COMMON = conn
        else:
            CONFIG[name] = conn

    # Set common settings
    for name, conn in CONFIG.items():
        for key, val in COMMON.items():
            conn.setdefault(key, val)

def do_show(k = None):
    read_config()
    if k:
        if k not in CONFIG:
            die('No such key: %s' % k)
        v = CONFIG[k]
    else:
        v = CONFIG
    die(yaml.dump(v), 0)

def do_list():
    read_config()
    connections = CONFIG.keys()
    c2if = get_connection_to_iface_map()
    width = max(len(c) for c in connections)
    for conn in sorted(connections):
        if conn in c2if:
            iface = c2if[conn]
            print '%s (%s: %s)' % (conn.ljust(width), iface,
                                   get_addr4(iface) or 'no address')
            del c2if[conn]
        else:
            print conn
    if c2if:
        print
        for c, i in c2if.items():
            print '%s: "%s", %s' % (i, c, get_addr4(i) or 'no address')

def unescape_c_str(data):
    return re.sub(
        r'\\x([0-9a-f]{2})',
        lambda x: x.group(1).decode('hex'),
        data
    )

def escape_c_str(data):
    return re.sub(
        r'[^a-zA-Z0-9!#$%&()*+,./:;<=>?@\[\]^_`{|}~ -]|(\s*$)|(^\s*)',
        lambda x: ''.join(r'\x%02x' % ord(c) for c in x.group(0)),
        data
    )

def parse_iw_scan_tree(iface):
    while True:
        data = run_or_die('iw dev %s scan | expand' % iface).strip('\n')
        if data:
            break
        else:
            print "Scan failed, re-running"
            time.sleep(0.5)
    parents = [(-1, {})]
    last = None

    def popold(curindent):
        obj = None
        while parents and curindent <= parents[-1][0]:
            _, obj = parents.pop()
            for key, val in obj.items():
                if isinstance(val, dict) and val.keys() == [None]:
                    obj[key] = val[None]
        return obj

    for line in data.split('\n'):
        curindent = len(line) - len(line.lstrip(' '))
        popold(curindent)

        line = line.lstrip(' ')
        if line.startswith('* '):
            line = line[2:].lstrip(' ')

        if ': ' in line:
            key, value = line.split(': ', 1)
            obj = {None: value.lstrip(' ')}
        else:
            key = line
            obj = {}
        parents[-1][1][key] = obj
        parents.append((curindent, obj))
    return popold(-1)

def do_scan():
    become_root()
    iface = IFACE or get_wifi_iface_up() or get_default_wifi_iface()

    # Make sure iface is up
    run_or_die('ip link set dev %s up' % iface)

    aps = {}
    signal_re = re.compile(r'^([0-9.-]*) dBm$')
    addr_re = re.compile(r'BSS (([0-9a-f]{2}:?){6})')

    for addr, ap in parse_iw_scan_tree(iface).items():
        addr = addr_re.match(addr).group(1)

        ok = True
        for key in ['SSID', 'signal']:
            if key not in ap or ap[key] == '':
                ok = False

        if 'SSID' not in ap:
            continue

        ap['SSID'] = unescape_c_str(ap['SSID'])
        try:
            ssid = ap['SSID'].decode('utf8')
        except UnicodeDecodeError:
            ssid = escape_c_str(ap['SSID'])

        quality = float(signal_re.match(ap['signal']).group(1))
        crypto = ap.get('RSN', ap.get('WPA', ''))
        if crypto:
            crypto = crypto.get('Authentication suites', 'UNKNOWN')

        if ap['SSID'] == '':
            continue

        if ssid in aps:
            aps[ssid][1].append(quality)
            aps[ssid][2].append(addr)
        else:
            aps[ssid] = [crypto, [quality], [addr]]
    if len(aps) == 0:
        print 'Found no access points'
        return
    with open('/tmp/.net-scan', 'w') as fd:
        json.dump(aps.keys(), fd)
    ssid_align = max(map(len, aps.keys()))
    for ssid, (crypto, qualities, addrs) in \
        sorted(aps.items(), key=lambda x: -max(x[1][1])):
        ssid = ssid.strip('\x00')
        print '%s %d dBm %s' % ((ssid or '(hidden)').ljust(ssid_align),
                                max(qualities),
                                crypto
                                )
        if len(addrs) > 1 or ssid == '':
            for addr, quality in zip(addrs, qualities):
                print '  - %s %d dBm' % (addr, quality)

def start_dhcp_cmd(iface, hostname = None, udhcpc_config = None):
    cmd = 'udhcpc -R -i %s' % iface
    if hostname:
        cmd += ' -x hostname:%s' % hostname
    if udhcpc_config:
        cmd += ' -s %s' % udhcpc_config
    return cmd

def stop_dhcp_cmd(iface):
    pattern = start_dhcp_cmd(iface)
    return 'pkill -f "^%s"' % pattern

def stop_dhcp(iface):
    run(stop_dhcp_cmd(iface))

def renew_dhcp_cmd():
    # It would be nice only notify the "right one". But what *is* the right one?
    # We only call this function in `do_dns', and this function is not aware of
    # which interface we are talking about. So: We renew them all and accept the
    # race condition.
    return 'pkill -SIGUSR1 udhcpc'

def renew_dhcp():
    run(renew_dhcp_cmd())

def start_openvpn_cmd(name):
    return 'openvpn --config /tmp/%s.ovpn --log /tmp/%s.ovpn.log' % \
        (name, name)

def create_wg_iface(iface = 'wg1337', addr = '192.168.255.1/24'):
    become_root()
    run_or_die('ip link add dev %s type wireguard' % iface)
    run_or_die('ip address add dev %s %s' % (iface, addr))

def destroy_wg_iface(iface = 'wg1337'):
    become_root()
    run('ip link set dev %s down' % iface)
    run('ip link del dev %s' % iface)

def wg_setconf(name, iface = 'wg1337'):
    become_root()
    run_or_die('ip link set dev %s down' % iface)
    conf = VPN[name]['config']
    path_conf = '/tmp/%s-wg.conf' % name
    write_root_file(path_conf, 0o600, conf)
    run_or_die('wg setconf %s %s' % (iface, path_conf))
    rm(path_conf)

def set_wg_dgw(name):
    cfg_ep = [x for x in VPN[name]['config'].split('\n') if 'Endpoint' in x or 'endpoint' in x]

    if not cfg_ep:
        stop_vpn(name)
        die('No endpoint set for VPN: %s' % name)

    dgwaddr = [x for x in run_or_die('ip route show').split('\n') if 'default' in x]

    endpoint = ''.join(re.findall(r'[0-9]+(?:\.[0-9]+){3}', str(cfg_ep)))
    dgwaddress = ''.join(re.findall(r'[0-9]+(?:\.[0-9]+){3}', str(dgwaddr)))

    become_root()
    run('ip route del 0.0.0.0/1 dev %s' % VPN[name]['interface'])
    run('ip route del 128.0.0.0/1 dev %s' % VPN[name]['interface'])
    run('ip route del %s/32 via %s' % (endpoint, dgwaddress))
    run_or_die('ip route add 0.0.0.0/1 dev %s' % VPN[name]['interface'])
    run_or_die('ip route add 128.0.0.0/1 dev %s' % VPN[name]['interface'])
    run_or_die('ip route add %s/32 via %s' % (endpoint, dgwaddress))

def start_vpn(name):
    print 'Starting VPN (%s)' % name

    try:
        type = VPN[name]['type']
        conf = VPN[name]['config']
    except (KeyError, TypeError):
        die('%s is misconfigured - check .net.conf.example' % name)

    if type == 'openvpn':
        path_conf = '/tmp/%s.ovpn' % name
        path_log = path_conf + '.log'
        write_root_file(path_conf, 0o600, conf)
        rm(path_log)
        run_daemon(start_openvpn_cmd(name).split())

        # Wait for OpenVPN to start
        while True:
            try:
                fd = open(path_log)
                break
            except IOError:
                time.sleep(0.1)

        # Now we can remove the config file
        rm(path_conf)

        # Wait for the connection to be established
        line = ''
        marker = 'Initialization Sequence Completed'
        while True:
            s = fd.readline()
            line += s
            if not s or s[-1] != '\n':
                time.sleep(0.05)
                continue
            line = line.rstrip()
            if VERBOSE:
                print line
            if marker in line:
                break
            line = ''

    elif type == 'wireguard':
        internaddr = ''
        ifacename = ''
        d_gateway = False

        try:
            internaddr = VPN[name]['address']
            ifacename = VPN[name]['interface']
            d_gateway = VPN[name]['gateway']
        except:
            pass

        if internaddr and ifacename:
            create_wg_iface(iface = ifacename, addr = internaddr)
            wg_setconf(name, iface = ifacename)
            run_or_die('ip link set dev %s up' % ifacename)
        elif internaddr:
            create_wg_iface(addr = internaddr)
            wg_setconf(name)
            run_or_die('ip link set dev wg1337 up')
        elif ifacename:
            create_wg_iface(iface = ifacename)
            wg_setconf(name, iface = ifacename)
            run_or_die('ip link set dev %s up' % ifacename)
        else:
            create_wg_iface()
            wg_setconf(name)
            run_or_die('ip link set dev wg1337 up')

        if d_gateway == True:
            set_wg_dgw(name)

    else:
        die('Unknown VPN type selected for: %s\
\nSupported VPN types: openvpn, wireguard' % name)

def stop_vpn(name):
    print 'Stopping VPN (%s)' % name

    try:
        type = VPN[name]['type']
    except (KeyError, TypeError):
        die('%s is misconfigured - check .net.conf.example' % name)

    if type == 'openvpn':
        pattern = start_openvpn_cmd(name)
        run('pkill -9 -f "^%s"' % pattern)

    elif type == 'wireguard':
        try:
            if VPN[name]['interface']:
                destroy_wg_iface(iface = VPN[name]['interface'])
        except KeyError:
           destroy_wg_iface()

    else:
        die('Unknown VPN type selected for: %s\
\nSupported VPN types: openvpn, wireguard' % name)

def tmp_stop_vpn(name, delay):
    print 'Temporarily:',
    stop_vpn(name)
    # Daemonize
    if os.fork():
        os._exit(0)
    # Detach from terminal and create own PG
    os.setsid()
    # Close FD's
    for fd in range(resource.getrlimit(resource.RLIMIT_NOFILE)[0]):
        try:
            os.close(fd)
        except OSError:
            pass
    # Attach /dev/null to std{in,out,err}
    devnull = os.open('/dev/null', os.O_RDWR)
    os.dup2(devnull, 0)
    os.dup2(devnull, 1)
    os.dup2(devnull, 2)
    os.close(devnull)
    # Wait
    time.sleep(delay)
    # Restart VPN
    start_vpn(name)

def add_route_cmd(route, default_gw=None):
    # Format:
    #   <dst>[/prefix] [-> {<addr>,<interface>,<connection>)]
    if not route:
        die('no route given')

    fields = route.split()
    dst = fields[0]
    if len(fields) == 1:
        gw = default_gw

    elif len(fields) == 3:
        if fields[1] != '->':
            die('Bad route format: %s' % route)
        sel = fields[2]

        # Determine gateway from (in this order):
        #  - Concrete address
        #  - Interface
        #  - Interface of active connection
        #  - Configured connection:
        #    - Gateway
        #    - Address
        #    - Interface
        def get_gw(sel):
            if validate_ipv4(sel):
                return sel

            def from_addr(addr, netmask):
                if not netmask:
                    logv('(Guessed netmask: 255.255.255.0)')
                    netmask = '24'
                return guess_gateway_ipv4(addr, netmask)

            def from_iface(iface):
                return from_addr(*get_addr4(sel, with_netmask=True))

            ifaces = get_ifaces_up()

            if sel in ifaces:
                return from_iface(sel)

            c2if = get_connection_to_iface_map()
            if sel in c2if:
                return from_iface(c2if[sel])

            read_config()
            conf = CONFIG.get(sel)
            if conf:
                gw = conf.get('gateway')
                if gw:
                    return gw

                addr = conf.get('addr')
                if addr:
                    return from_addr(
                        re.findall(r'inet (\d+\.\d+\.\d+\.\d+)(?:/(\d+))?',
                                   addr)
                    )

                iface = conf.get('interface')
                if iface:
                    return from_iface(iface)

        gw = get_gw(sel)
        if not gw:
            die('No gateway matches "%s"' % sel)

    addr, netmask = normalize_net_or_host(dst)
    cmd = 'ip route add %s/%d via %s' % (addr, netmask, gw)
    return cmd

def finalize_hostname(hostname):
    names = ('Jonas', 'Noah', 'Liam', 'Jacob', 'Mason', 'William', 'Ethan',
             'Michael', 'Alexander', 'Jayden', 'Daniel', 'Elijah', 'Aiden',
             'James', 'Benjamin', 'Matthew', 'Jackson', 'Logan', 'David',
             'Anthony', 'Joseph', 'Joshua', 'Andrew', 'Lucas', 'Gabriel',
             'Samuel', 'Christopher', 'John', 'Dylan', 'Isaac', 'Ryan',
             'Nathan', 'Carter', 'Caleb', 'Luke', 'Christian', 'Hunter',
             'Henry', 'Owen', 'Landon', 'Jack', 'Wyatt', 'Jonathan', 'Eli',
             'Isaiah', 'Sebastian', 'Jaxon', 'Julian', 'Brayden', 'Gavin',
             'Levi', 'Aaron', 'Oliver', 'Jordan', 'Nicholas', 'Evan', 'Connor',
             'Charles', 'Jeremiah', 'Cameron', 'Adrian', 'Thomas', 'Robert',
             'Tyler', 'Colton', 'Austin', 'Jace', 'Angel', 'Dominic', 'Josiah',
             'Brandon', 'Ayden', 'Kevin', 'Zachary', 'Parker', 'Blake', 'Jose',
             'Chase', 'Grayson', 'Jason', 'Ian', 'Bentley', 'Adam', 'Xavier',
             'Cooper', 'Justin', 'Nolan', 'Hudson', 'Easton', 'Jase', 'Carson',
             'Nathaniel', 'Jaxson', 'Kayden', 'Brody', 'Lincoln', 'Luis',
             'Tristan', 'Damian', 'Camden', 'Juan', 'Sophia', 'Emma', 'Olivia',
             'Isabella', 'Ava', 'Mia', 'Emily', 'Abigail', 'Madison',
             'Elizabeth', 'Charlotte', 'Avery', 'Sofia', 'Chloe', 'Ella',
             'Harper', 'Amelia', 'Aubrey', 'Addison', 'Evelyn', 'Natalie',
             'Grace', 'Hannah', 'Zoey', 'Victoria', 'Lillian', 'Lily',
             'Brooklyn', 'Samantha', 'Layla', 'Zoe', 'Audrey', 'Leah',
             'Allison', 'Anna', 'Aaliyah', 'Savannah', 'Gabriella', 'Camila',
             'Aria', 'Kaylee', 'Scarlett', 'Hailey', 'Arianna', 'Riley',
             'Alexis', 'Nevaeh', 'Sarah', 'Claire', 'Sadie', 'Peyton', 'Aubree',
             'Serenity', 'Ariana', 'Genesis', 'Penelope', 'Alyssa', 'Bella',
             'Taylor', 'Alexa', 'Kylie', 'Mackenzie', 'Caroline', 'Kennedy',
             'Autumn', 'Lucy', 'Ashley', 'Madelyn', 'Violet', 'Stella',
             'Brianna', 'Maya', 'Skylar', 'Ellie', 'Julia', 'Sophie',
             'Katherine', 'Mila', 'Khloe', 'Paisley', 'Annabelle', 'Alexandra',
             'Nora', 'Melanie', 'London', 'Gianna', 'Naomi', 'Eva', 'Faith',
             'Madeline', 'Lauren', 'Nicole', 'Ruby', 'Makayla', 'Kayla',
             'Lydia', 'Piper', 'Sydney', 'Jocelyn', 'Morgan')
    while '<name>' in hostname:
        hostname = hostname.replace('<name>', random.choice(names), 1)
    return hostname

def stop_wpa(iface):
    for pattern in ('wpa_supplicant .* -i *%s' % iface,
                    'wpa_cli .* -i *%s' % iface):
        run('pkill -f "^%s"' % pattern)

def stop(iface):
    conns = read_connections()
    if iface in conns:
        conn = conns[iface]
        if conn in CONFIG:
            vpn = CONFIG[conn].get('vpn')
        elif 'vpn' in COMMON:
            vpn = COMMON['vpn']
        else:
            vpn = None
        if vpn:
            stop_vpn(vpn)

    if is_wifi_iface(iface):
        stop_wpa(iface)
        rm('/var/run/wpa_supplicant/%s' % iface,
           '/tmp/wpa_cli.%s.sh' % iface,
           '/tmp/wpa_cli.%s.log' % iface,
           '/tmp/wpa_supplicant.%s.conf' % iface)

    stop_dhcp(iface)
    run('ip addr flush dev %s' % iface)
    run_or_die('ip link set dev %s down' % iface)
    del_connection(iface)

def set_dns(dns, append=False):
    become_root()
    run('chattr -i /etc/resolv.conf')
    if dns:
        if isinstance(dns, (str, unicode)):
            dns = [dns]
        with open('/etc/resolv.conf', 'a' if append else 'w') as fd:
            fd.write('\n') # Just to be sure, if appending
            for server in dns:
                fd.write('nameserver %s\n' % server)
        run('chattr +i /etc/resolv.conf')

connections_path = '/tmp/.net-connections'
def read_connections():
    try:
        with open(connections_path, 'r') as fd:
            return json.load(fd)
    except:
        return {}

def write_connections(cs):
    with open(connections_path, 'w') as fd:
        json.dump(cs, fd)

def add_connection(iface, conn):
    conns = read_connections()
    conns[iface] = conn
    write_connections(conns)

def del_connection(iface):
    conns = read_connections()
    if iface in conns:
        del conns[iface]
    write_connections(conns)

def get_connection_to_iface_map():
    if2c = read_connections()
    c2if = {}
    for iface, conn in if2c.items():
        c2if[conn] = iface
    return c2if

def validate_ipv4(address):
    octets = address.split('.')
    if len(octets) != 4:
        return False
    for octet in octets:
        if not octet.isdigit():
            return False
        number = int(octet)
        if number < 0 or number > 255:
            return False
    return True

def guess_gateway_ipv4(ip, cidr):
        dec_ip      = int(''.join([ '%02x' % int(x) for x in ip.split('.') ]), 16)
        dec_cidr    = (0xffffffff << (32 - int(cidr))) & 0xffffffff
        dec_netaddr = dec_ip & dec_cidr
        dec_gateway = dec_netaddr + 1
        return ".".join(map(str, [(dec_gateway >> (8*i)) & 0xff for i in range(4)])[::-1])

def do_connect(conn, psk=None):
    become_root()
    read_config()

    ssid = None
    ap_addr = None

    if conn not in CONFIG:
        if re.match('^([0-9a-fA-F]:){5}[0-9a-fA-F]$', conn):
            ap_addr = conn
        else:
            ssid = unescape_c_str(conn)
        def get(key, default = None):
            return COMMON.get(key, default)
    else:
        ssid = CONFIG[conn].get('ssid')
        def get(key, default = None):
            return CONFIG[conn].get(key, default)

    psk           = get('psk', psk)
    ap_addr       = get('ap-addr', ap_addr)
    dns           = get('dns')
    mac           = get('mac')
    wpa           = get('wpa')
    vpn           = get('vpn')
    hostname      = get('hostname')
    addr          = get('addr')
    gateway       = get('gateway')
    iface         = get('interface', IFACE)
    routes        = get('routes', [])
    udhcpc_config = get('udhcpc-config')

    is_wifi = any([psk, ssid, wpa, ap_addr])
    if not iface:
        if is_wifi:
            iface = get_default_wifi_iface()
        else:
            iface = get_default_wired_iface()

    stop(iface)
    up = get_ifaces_up()
    if up:
        a = optlist('Stop connection on other interfaces?',
                    ('yes', 'no', 'all'), default = 'all')
        if a == 'yes':
            for i in up:
                if yesno('Stop connection on %s?' % i, True):
                    stop(i)
        elif a == 'all':
            map(stop, up)

    # Evaluate configuration
    if psk and wpa:
        die('Both psk and wpa is set')

    if psk:
        wpa = {'network': {'key_mgmt' : 'WPA-PSK',
                           'psk'      : '"%s"' % psk}
               }

    if dns == 'dhcp':
        dns = None

    if dns:
        dns = [dns.strip() for dns in dns.split(',')]

    if mac == 'default':
        mac = None

    if hostname:
        hostname = finalize_hostname(hostname)

    if wpa:
        if 'network' not in wpa:
            die('No network section in wpa_supplicant')
        wpa_ssid = wpa['network'].get('ssid', '').strip('"')
        if wpa_ssid and ssid and wpa_ssid != ssid:
            die('SSID mismatch')
        if not ssid:
            if wpa_ssid:
                ssid = wpa_ssid
            else:
                ssid = conn

        wpa['network']['ssid'] = ssid.encode('hex')
        wpa['network'].setdefault('scan_ssid', '0')
        wpa['ctrl_interface'] = '/var/run/wpa_supplicant'
        wpa['ctrl_interface_group'] = '0'
        wpa_conf = '/tmp/wpa_supplicant.%s.conf' % iface
        wpa_log = '/tmp/wpa_supplicant.%s.log' % iface
        write_root_file(wpa_conf, 0o600, write_wpa_conf(wpa))

    if addr:
        try:
            ip, netmask = re.findall(r'(\d+\.\d+\.\d+\.\d+)(/\d+)?', addr)[0]
        except:
            die('Invalid address: %s' % addr)

        if not validate_ipv4(ip):
            die('Invalid address: %s' % ip)

        if not netmask:
            logv('(Guessed netmask: 255.255.255.0)')
            netmask = '/24'

        if not gateway:
            gateway = guess_gateway_ipv4(ip, netmask[1:])
            logv('(Guessed gateway: %s)' % gateway)

        network = ['ip addr add %s%s dev %s' % (ip, netmask, iface)]

        default_route = get_default_route()
        # Add default route if none exists
        add_default = True
        if default_route:
            if 'default' in routes or \
               yesno('Override default route via %s dev %s?' % \
                     (default_route['via'], default_route['dev']),
                     False):
                logv('Flusing default route via %s dev %s' % \
                     (default_route['via'], default_route['dev']))
                run_or_die('ip route flush default via %s' % \
                           default_route['via'])
            else:
                add_default = False

        if gateway != 'none' and add_default and 'default' not in routes:
            network.append('ip route add default via %s dev %s' % \
                           (gateway, iface)
            )

        network.append('ip link set %s up' % iface)

    else:
        network = [start_dhcp_cmd(iface, hostname, udhcpc_config)]

    # Additional routes
    for route in routes:
        logv('Adding route: %s' % route)
        network.append(add_route_cmd(route, default_gw=gateway))

    # Run configuration
    set_mac(iface, mac)
    set_dns(dns)

    # If wired
    if not is_wifi_iface(iface):
        if is_wifi:
            die('WiFi options set on wired interface!')
        if not addr:
            print 'Sending DHCP request'
        for cmd in network:
            run_or_die(cmd)
    # Else WiFi
    else:
        # If Open WiFi with fallthrough--always use wpa_supplicant
        if not wpa:
            wpa = {'network': {'key_mgmt': 'NONE'}}
            wpa['network']['ssid'] = ssid.encode('hex')
            wpa['network'].setdefault('scan_ssid', '0')
            wpa['ctrl_interface'] = '/var/run/wpa_supplicant'
            wpa['ctrl_interface_group'] = '0'
            wpa_conf = '/tmp/wpa_supplicant.%s.conf' % iface
            wpa_log = '/tmp/wpa_supplicant.%s.log' % iface
            write_root_file(wpa_conf, 0o600, write_wpa_conf(wpa))

        wpa_cli_sh  = '/tmp/wpa_cli.%s.sh' % iface
        wpa_cli_log = '/tmp/wpa_cli.%s.log' % iface
        beg_marker = '[[[BEG]]]'
        end_marker = '[[[END]]]'
        write_root_file(wpa_cli_sh, 0o700, '''
#!/bin/sh

LOGFILE=%s
exec 1>$LOGFILE 2>&1
chmod og-rwx $LOGFILE

IFNAME=$1
CMD=$2

if [ "$CMD" != "CONNECTED" ]; then
    exit 0
fi

echo %s

%s
rm -f /tmp/wpa_ctrl_*-1
%s

echo %s
'''.lstrip() % (wpa_cli_log,
                beg_marker,
                stop_dhcp_cmd(iface),
                '\n'.join(network),
                end_marker))

        print 'Connecting to %s' % ssid
        cmd = 'wpa_supplicant -B -i %s -c %s -f %s' % (iface, wpa_conf, wpa_log)
        if VERBOSE:
            cmd += ' -d'
        rm(wpa_log)
        run_or_die(cmd)
        run_or_die('wpa_cli -B -i %s -a %s' % (iface, wpa_cli_sh))

        # Wait for wpa_cli
        while True:
            try:
                fd = open(wpa_cli_log)
                break
            except IOError:
                time.sleep(0.1)

        line = ''
        while True:
            s = fd.readline()
            line += s
            if not s or s[-1] != '\n':
                time.sleep(0.05)
                continue
            line = line.rstrip()
            if line == beg_marker:
                print 'Sending DHCP request'
                if VERBOSE:
                    print '\n'.join('+ %s' % cmd for cmd in network)
            elif line == end_marker:
                break
            elif VERBOSE:
                print line
            line = ''

    print 'Address acquired: %s' % get_addr4(iface)

    if vpn and not NOVPN:
        print 'Just to be safe:',
        stop_vpn(vpn)
        start_vpn(vpn)

    add_connection(iface, conn)

def parse_mac(mac_arg):
    # Borrowed from SpoofMAC
    mac_re = r'[:-\\.]?'.join(['([0-9A-F\\?]{1,2})'] * 6)
    cisco_mac_re = r'\\.'.join(['([0-9A-F\\?]{,4})'] * 3)
    mac = mac_arg.upper()
    m = re.match(cisco_mac_re, mac)
    def fmt(grps):
        grps = ''.join(grps)
        return ':'.join(grps[i:i+2] for i in range(0, 12, 2))
    if m:
        return fmt(g.zfill(4) for g in m.groups())
    m = re.match(mac_re, mac)
    if m:
        return fmt(g.zfill(2) for g in m.groups())
    die('Invalid MAC address: %s' % mac_arg)

def finalize_mac(iface, mac):
    if mac == 'native':
       mac = run_or_die("ethtool -P " + iface).split()[2]

    if mac and mac != 'random':
        mac = parse_mac(mac)
    else:
        # Inside one of the Macbook Pro wifi ranges
        mac = '80:e6:50:??:??:??'
    while '?' in mac:
        mac = mac.replace('?', random.choice('0123456789abcdef'), 1)
    return mac

def set_mac(iface, mac):
    mac = finalize_mac(iface, mac)
    become_root()
    run_or_die('ip link set dev %s down' % iface)
    run_or_die('ip link set dev %s address %s up' % (iface, mac))

def do_mac(mac = None):
    if not IFACE:
        die('You must specify an interface with --iface=<interface>')

    set_mac(IFACE, mac)

def do_dns(*dns):
    if dns == ('dhcp', ):
        dns = None

    append = False
    if dns:
        if dns[0] == '+':
            dns = dns[1:]
            append = True
        elif dns[0][0] == '+':
            dns = (dns[0][1:], ) + dns[1:]
            append = True
    else:
        renew_dhcp()

    set_dns(dns, append=append)

def do_stop(*args):
    read_config()

    if IFACE and args:
        die('Cannot use --iface')

    if IFACE:
        ifaces = [IFACE]

    elif args:
        ifaces = []
        all_ifaces = get_ifaces()
        c2if = get_connection_to_iface_map()

        def get_iface(arg):
            if arg in all_ifaces:
                return arg
            if arg in c2if:
                return c2if[arg]
            if arg in CONFIG:
                conf = CONFIG[arg]
                if 'interface' in conf:
                    return conf['interface']

        for arg in args:
            iface = get_iface(arg)
            if not iface:
                die('No interface matches "%s"' % arg)
            ifaces.append(iface)
    else:
        ifaces = get_ifaces_up()

    if not ifaces:
        die('No interfaces are up')

    become_root()
    if len(ifaces) > 1:
        for iface in ifaces:
            if yesno('Stop %s?' % iface, True):
                stop(iface)
    else:
        stop(ifaces[0])

def do_vpn(vpn, cmd='start', delay=VPN_TMPSTOP_DELAY):
    become_root()
    if cmd == 'start':
        read_config()
        start_vpn(vpn)
    elif cmd == 'stop':
        stop_vpn(vpn)
    elif cmd == 'tmpstop':
        read_config()
        try:
            delay = int(delay)
        except:
            die('Delay must be a number')
        print 'Temporarily (%ds) stopping VPN (%s)' % (delay, vpn)
        tmp_stop_vpn(vpn, delay)
    else:
        die('Unknown VPN command: %s' % cmd)

def do_genkey():
    pk = run('wg genkey').strip()
    pubkey = run_or_die('echo %s | wg pubkey' % pk).strip()
    print '======================WireGuard keys======================'
    print 'Private key:  ' + pk + '\n Public key:  ' + pubkey

def main():
    cmd, args = parse_args()
    if   cmd == 'list':
        if len(args) > 0:
            die('Command "list" takes no arguments')
        do_list()
    elif cmd == 'scan':
        if len(args) > 0:
            die('Command "scan" takes no arguments')
        do_scan()
    elif cmd == 'connect':
        if len(args) not in (1, 2):
            die('Command "connect" takes one or two arguments')
        do_connect(*args)
    elif cmd == 'mac':
        if len(args) > 1:
            die('Command "mac" takes one or no arguments')
        do_mac(*args)
    elif cmd == 'dns':
        do_dns(*args)
    elif cmd == 'stop':
        do_stop(*args)
    elif cmd == 'vpn':
        if not args:
            die('Command "vpn" needs a VPN name')
        do_vpn(*args)
    elif cmd == 'show':
        if len(args) > 1:
            die('Command "show" takes one or no arguments')
        do_show(*args)
    elif cmd == 'genkey':
        if len(args) > 0:
            die('Command "genkey" takes no arguments')
        do_genkey()

if __name__ == '__main__':
    try:
        main()
    except KeyboardInterrupt:
        pass