always-on-openconnect-vpn/run-vpn.sh

#!/bin/bash

# Read from keychain on macOS by default
if [[ "$OSTYPE" == "darwin"* ]]; then
  SERVER=$(security find-generic-password -l "Openconnect VPN Server" -w)
  USERNAME=$(security find-generic-password -l "Openconnect Username" -w)
  SEED=$(security find-generic-password -l "Openconnect TOTP Seed" -w)
  PASSWORD=$(security find-generic-password -l "Openconnect Account Password" -w)
fi

# Allow reading from environment
if [[ -z "$OC_SERVER" ]]; then :; else
  SERVER="$OC_SERVER"
fi
if [[ -z "$OC_USERNAME" ]]; then :; else
  USERNAME="$OC_USERNAME"
fi
if [[ -z "$OC_SEED" ]]; then :; else
  SEED="$OC_SEED"
fi
if [[ -z "$OC_PASSWORD" ]]; then :; else
  PASSWORD="$OC_PASSWORD"
fi

SCRIPT=`realpath $0`
SCRIPTPATH=`dirname $SCRIPT`
ROUTE_FILE=routes.txt

# trap ctrl-c and call ctrl_c()
trap ctrl_c INT

function ctrl_c() {
  killall openconnect
  echo "Bye!"
  exit
}

SCRIPT_INCLUDE=""

while true; do
  echo "Connecting to VPN"

  if test -f "$ROUTE_FILE"; then
    SCRIPT_INCLUDE="--script=\"$SCRIPTPATH/routing.sh\""
  fi

  # If yubikey is not used, use the TOTP seed
  if [[ -z "$OC_YUBIKEY" ]]; then

    if [[ -z "$SEED" ]]; then :; else
      TOTP=$(oathtool --totp=sha1 -b "$SEED")
      PASSWORD="$PASSWORD\n$TOTP"
    fi
  else
    YUBIKEY_TOTP="--token-mode=yubioath --token-secret=$OC_YUBIKEY"
  fi

  if [ -z "$SEED" ] && [ -z "$OC_YUBIKEY" ]; then
      sudo openconnect \
      --csd-wrapper hostscan-bypass.sh \
      --os=mac-intel \
      $SCRIPT_INCLUDE \
      -u $USERNAME \
      $SERVER

  else
    echo -e "$PASSWORD" | sudo openconnect \
      --csd-wrapper hostscan-bypass.sh \
      --os=mac-intel \
      $YUBIKEY_TOTP \
      $SCRIPT_INCLUDE \
      -u $USERNAME \
      $SERVER
  fi

  echo "Openconnect closed. Waiting 3 seconds."
  sleep 3

done