#!/bin/sh

interface="$1"
event="$2"

logger="/usr/bin/logger -s -t fix_work_vpn"

$logger "Received $event for $interface"

case $interface in
    tun0) case $event in
              up) $logger "Setting dnsovertls false"
                  resolvectl dnsovertls $interface false;
                  openconnet_pid=$(pgrep -f openconnect)
                  $logger "Setting openconnect PID $openconnet_pid to run outside VPN"
                  mullvad split-tunnel add $openconnet_pid;
                  dns_servers=$(resolvectl dns tun0 | cut -d: -f2- | sed 's/^ *//;s/ /, /')
                  $logger "Found DNS endpoints $dns_servers and setting exemptions in nftables"
                  nft -f - <<< "define RESOLVER_ADDRS = {$dns_servers}
table inet excludeTraffic {
  chain excludeDns {
    type filter hook output priority -10; policy accept;
    ip daddr \$RESOLVER_ADDRS udp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
    ip daddr \$RESOLVER_ADDRS tcp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
  }
}"
                  ;;
              down) $logger "Removing nftables exemptions for DNS entries";
                    nft delete table inet excludeTraffic;;
    esac;;
esac