#!/bin/bash

OPENVPN_CONF_ROOT=/etc/openvpn

grep -ohq "dh2048" /etc/openvpn/*.conf
exit_status=`echo $?`
#exit_status=1
echo $exit_status

IPLIST=`ip addr show | egrep -v '\blo|inet6' | egrep ':[0-9]+$' | awk '{print $2}' | sed -e 's/\/.*//g' | sort -r`
CONFIGID=0
c=0

if [[ $exit_status == 0 ]]; then

    echo "country `hostname -s` is AES-256"
    sleep 5
    cd /tmp
    wget -r -nH --cut-dirs=1 --no-parent http://hub.nvpn.eu:8000/x86_64/keys1024/
    /bin/cp -Rp /tmp/keys1024 /etc/openvpn/easy-rsa/2.0/
    /bin/chmod 700 /etc/openvpn/easy-rsa/2.0/keys/server.key /etc/openvpn/easy-rsa/2.0/keys1024/server.key

    for ip in $IPLIST; do
	CONF_NAME="$(echo $ip | awk -F "." '{print $3"_"$4}')"	
	found_proto=`grep -hE "proto" /etc/openvpn/$CONF_NAME.conf | awk '{ print $2 }'`
	if [[ $(grep -cE "1400|1300" /etc/openvpn/$CONF_NAME.conf) -ne 0 ]]; then
		found_port=`grep -hE "fragment" /etc/openvpn/$CONF_NAME.conf | awk '{ print $2 }'`
		echo "we found fragment $found_port with: $ip and 256 Bit AES"
		sed -i -e 's/keys/keys1024/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e "s/dh[0-9]*\.pem/dh1024\.pem/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e "s/fragment $found_port/fragment 1300/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e "s/mssfix $found_port/mssfix 1300/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e '/auth SHA512/d' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e 's/cipher AES-256-CBC/cipher BF-CBC/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	elif  [ $found_proto == "udp" ]; then
                echo "inside normal $found_proto protocol with $ip and 256 Bit AES"
                sed -i -e "s/fragment 0/fragment 1400/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e "s/mssfix 0/mssfix 1400/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	fi
	sed -i -e 's/14400/43200/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	c=$((c+1))
    done

  else
	echo "country `hostname -s` is Blowfish-128"
   	sleep 5
	cd /tmp
	wget -r -nH --cut-dirs=1 --no-parent http://hub.nvpn.eu:8000/x86_64/keys/
	mv /etc/openvpn/easy-rsa/2.0/keys /etc/openvpn/easy-rsa/2.0/keys1024
	/bin/cp -Rp /tmp/keys /etc/openvpn/easy-rsa/2.0/
	/bin/chmod 700 /etc/openvpn/easy-rsa/2.0/keys/server.key /etc/openvpn/easy-rsa/2.0/keys1024/server.key

    for ip in $IPLIST; do
        CONF_NAME="$(echo $ip | awk -F "." '{print $3"_"$4}')"
	found_proto=`grep -hE "proto" /etc/openvpn/$CONF_NAME.conf | awk '{ print $2 }'`
        if [[ $(grep -cE "1400|1300" /etc/openvpn/$CONF_NAME.conf) -ne 0 ]]; then
                found_port=`grep -hE "fragment" /etc/openvpn/$CONF_NAME.conf | awk '{ print $2 }'`
		echo "we found fragment $found_port with: $ip and 128 Bit Blowfish"
        	sed -i -e 's/keys/keys1024/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e "s/fragment $found_port/fragment 1300/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e "s/mssfix $found_port/mssfix 1300/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	elif  [ $found_proto == "udp" ]; then
                echo "inside normal $found_proto protocol with $ip and 128 Bit Blowfish"
                sed -i -e "s/dh[0-9]*\.pem/dh2048\.pem/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e "s/fragment 0/fragment 1400/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e "s/mssfix 0/mssfix 1400/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		sed -i -e '/14400/ a\auth SHA512' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
		echo "sed -i -e '/14400/ a\auth SHA512' $OPENVPN_CONF_ROOT/$CONF_NAME.conf"
		sed -i -e 's/cipher BF-CBC/cipher AES-256-CBC/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	elif  [ $found_proto == "tcp" ]; then
                echo "inside normal $found_proto protocol with $ip and 128 Bit Blowfish"
                sed -i -e "s/dh[0-9]*\.pem/dh2048\.pem/" $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e '/14400/ a\auth SHA512' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
                sed -i -e 's/cipher BF-CBC/cipher AES-256-CBC/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
	fi
	sed -i -e 's/14400/43200/' $OPENVPN_CONF_ROOT/$CONF_NAME.conf
        c=$((c+1))
    done

fi

service monit stop
service openvpn stop
sleep 20
killall openvpn
sleep 20
service openvpn restart
service monit restart
