#!/usr/bin/env python3
import subprocess, os

newenv = os.environ.copy()
newenv["LD_PRELOAD"] = "/snacks/wireguard/bin/wireguard-resolve.so"


def default_devices():
    with open("/proc/1/net/dev", "r") as f:
        return f.read()


def vpn_devices():
    with open("/proc/self/net/dev", "r") as f:
        return f.read()


def wireguard():
    try:
        os.mkdir("/run/netns")
    except FileExistsError:
        pass

    try:
        os.symlink("/run/vpn/net", "/run/netns/vpn")
        os.symlink("/proc/1/ns/net", "/run/netns/default")
    except FileExistsError:
        pass

    with open("/proc/sys/net/ipv4/conf/all/forwarding", "w") as f:
        f.write("1")
    with open("/proc/sys/net/ipv6/conf/all/forwarding", "w") as f:
        f.write("1")
    with open("/proc/sys/net/ipv4/ping_group_range", "w") as f:
        f.write("0 2147483647")

    if "veth-inner" in vpn_devices():
        subprocess.run(["ip", "link", "del", "dev", "veth-inner"])
    if "veth-outer" in vpn_devices():
        subprocess.run(["ip", "link", "del", "dev", "veth-outer"])
    if "vpn" in vpn_devices():
        subprocess.run(["ip", "link", "del", "dev", "vpn"])
    if "mynet0" not in vpn_devices():
        subprocess.run(["ip", "link", "add", "name", "mynet0", "type", "bridge"])

    if "veth-inner" in default_devices():
        subprocess.run(
            [
                "nsenter",
                "--net=/proc/1/ns/net",
                "ip",
                "link",
                "del",
                "dev",
                "veth-inner",
            ]
        )
    if "veth-outer" in default_devices():
        subprocess.run(
            [
                "nsenter",
                "--net=/proc/1/ns/net",
                "ip",
                "link",
                "del",
                "dev",
                "veth-outer",
            ]
        )
    if "vpn" in default_devices():
        subprocess.run(
            ["nsenter", "--net=/proc/1/ns/net", "ip", "link", "del", "dev", "vpn"]
        )

    subprocess.run(["modprobe", "wireguard"])
    subprocess.run(
        [
            "nsenter",
            "--net=/proc/1/ns/net",
            "ip",
            "link",
            "add",
            "dev",
            "vpn",
            "type",
            "wireguard",
        ]
    )
    subprocess.run(
        [
            "nsenter",
            "--net=/proc/1/ns/net",
            "ip",
            "link",
            "set",
            "dev",
            "vpn",
            "netns",
            "vpn",
        ]
    )
    subprocess.run(
        ["nsenter", "--net=/run/vpn/net", "/snacks/wireguard/scripts/inner.sh"],
        env=newenv,
    )
    subprocess.run(
        ["nsenter", "--net=/proc/1/ns/net", "/snacks/wireguard/scripts/outer.sh"],
        env=newenv,
    )


try:
    self_ns = os.readlink("/proc/self/ns/net")
    vpn_ns = os.readlink("/run/vpn/net")
except Exception as e:
    print(e)
else:
    if self_ns == vpn_ns:
        wireguard()
    else:
        print("This script should be called from the VPN network namespace.")