vpnc-script

   1 #!/bin/sh
   2 #* reason                       -- why this script was called, one of: pre-init connect disconnect
   3 #* VPNGATEWAY                   -- vpn gateway address (always present)
   4 #* TUNDEV                       -- tunnel device (always present)
   5 #* INTERNAL_IP4_ADDRESS         -- address (always present)
   6 #* INTERNAL_IP4_NETMASK         -- netmask (often unset)
   7 #* INTERNAL_IP4_NETMASKLEN      -- netmask length (often unset)
   8 #* INTERNAL_IP4_NETADDR         -- address of network (only present if netmask is set)
   9 #* INTERNAL_IP4_DNS             -- list of dns serverss
  10 #* INTERNAL_IP4_NBNS            -- list of wins servers
  11 #* CISCO_DEF_DOMAIN             -- default domain name
  12 #* CISCO_BANNER                 -- banner from server
  13 #* CISCO_SPLIT_INC              -- number of networks in split-network-list
  14 #* CISCO_SPLIT_INC_%d_ADDR      -- network address
  15 #* CISCO_SPLIT_INC_%d_MASK      -- subnet mask (for example: 255.255.255.0)
  16 #* CISCO_SPLIT_INC_%d_MASKLEN   -- subnet masklen (for example: 24)
  17 #* CISCO_SPLIT_INC_%d_PROTOCOL  -- protocol (often just 0)
  18 #* CISCO_SPLIT_INC_%d_SPORT     -- source port (often just 0)
  19 #* CISCO_SPLIT_INC_%d_DPORT     -- destination port (often just 0)
  20
  21 # FIXMEs:
  22
  23 # Section A: route handling
  24
  25 # 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored
  26 #   In order to use them, we'll probably need os specific solutions
  27 #   * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV
  28 #       This would be an *alternative* to changing the routes (and thus 2) and 3)
  29 #       shouldn't be relevant at all)
  30 # 2) There are two different functions to set routes: generic routes and the
  31 #   default route. Why isn't the defaultroute handled via the generic route case?
  32 # 3) In the split tunnel case, all routes but the default route might get replaced
  33 #   without getting restored later. We should explicitely check and save them just
  34 #   like the defaultroute
  35 # 4) Replies to a dhcp-server should never be sent into the tunnel
  36
  37 # Section B: Split DNS handling
  38
  39 # 1) Maybe dnsmasq can do something like that
  40 # 2) Parse dns packets going out via tunnel and redirect them to original dns-server
  41
  42 #env | sort
  43 #set -x
  44
  45 # =========== script (variable) setup ====================================
  46
  47 PATH=/sbin:/usr/sbin:$PATH
  48
  49 OS="`uname -s`"
  50
  51 DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute
  52 RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup
  53 SCRIPTNAME=`basename $0`
  54
  55 # some systems, eg. Darwin & FreeBSD, prune /var/run on boot
  56 if [ ! -d "/var/run/vpnc" ]; then
  57         mkdir -p /var/run/vpnc
  58 fi
  59
  60 # stupid SunOS: no blubber in /usr/local/bin ... (on stdout)
  61 IPROUTE="`which ip | grep '^/' 2> /dev/null`"
  62
  63 if [ "$OS" = "Linux" ]; then
  64         ifconfig_syntax_ptp="pointopoint"
  65         route_syntax_gw="gw"
  66         route_syntax_del="del"
  67         route_syntax_netmask="netmask"
  68 else
  69         ifconfig_syntax_ptp=""
  70         route_syntax_gw=""
  71         route_syntax_del="delete"
  72         route_syntax_netmask="-netmask"
  73 fi
  74 if [ "$OS" = "SunOS" ]; then
  75     route_syntax_interface="-interface"
  76 else
  77     route_syntax_interface=""
  78 fi
  79
  80 if [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo
  81         MODIFYRESOLVCONF=modify_resolvconf_manager
  82         RESTORERESOLVCONF=restore_resolvconf_manager
  83 elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1
  84         MODIFYRESOLVCONF=modify_resolvconf_suse
  85         RESTORERESOLVCONF=restore_resolvconf_suse
  86 else # Generic for any OS
  87         MODIFYRESOLVCONF=modify_resolvconf_generic
  88         RESTORERESOLVCONF=restore_resolvconf_generic
  89 fi
  90
  91 # =========== tunnel interface handling ====================================
  92
  93 do_ifconfig() {
  94         if [ -n "$INTERNAL_IP4_MTU" ]; then
  95                 MTU=$INTERNAL_IP4_MTU
  96         elif [ -n "$IPROUTE" ]; then
  97                 MTU=$(($($IPROUTE route get "$VPNGATEWAY" | sed -ne 's/^.*mtu \([[:digit:]]\+\).*$/\1/p') - 88))
  98         else
  99                 MTU=1412
 100         fi
 101
 102         # Point to point interface require a netmask of 255.255.255.255 on some systems
 103         ifconfig "$TUNDEV" inet "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up
 104
 105         if [ -n "$INTERNAL_IP4_NETMASK" ]; then
 106                 set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN
 107         fi
 108
 109         # If the netmask is provided, it contains the address _and_ netmask
 110         if [ -n "$INTERNAL_IP6_NETMASK" -a -n "$IPROUTE" ]; then
 111                 $IPROUTE -6 addr add $INTERNAL_IP6_NETMASK dev $TUNDEV
 112         elif [ -n "$INTERNAL_IP6_ADDRESS" -a -n "$IPROUTE" ]; then
 113                 $IPROUTE -6 addr add $INTERNAL_IP6_ADDRESS/128 dev $TUNDEV
 114         fi
 115 }
 116
 117 destroy_tun_device() {
 118         case "$OS" in
 119         NetBSD) # and probably others...
 120                 ifconfig "$TUNDEV" destroy
 121                 ;;
 122         esac
 123 }
 124
 125 # =========== route handling ====================================
 126
 127 if [ -n "$IPROUTE" ]; then
 128         fix_ip_get_output () {
 129                 sed -e 's/ /\n/g' | \
 130                     sed -ne '1p;/via/{N;p};/dev/{N;p};/src/{N;p};/mtu/{N;p}'
 131         }
 132
 133         set_vpngateway_route() {
 134                 $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output`
 135                 $IPROUTE route flush cache
 136         }
 137
 138         del_vpngateway_route() {
 139                 $IPROUTE route $route_syntax_del "$VPNGATEWAY"
 140                 $IPROUTE route flush cache
 141         }
 142
 143         set_default_route() {
 144                 $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
 145                 $IPROUTE route replace default dev "$TUNDEV"
 146                 $IPROUTE route flush cache
 147         }
 148
 149         set_network_route() {
 150                 NETWORK="$1"
 151                 NETMASK="$2"
 152                 NETMASKLEN="$3"
 153                 $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 154                 $IPROUTE route flush cache
 155         }
 156
 157         reset_default_route() {
 158                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 159                         $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"`
 160                         $IPROUTE route flush cache
 161                         rm -f -- "$DEFAULT_ROUTE_FILE"
 162                 fi
 163         }
 164
 165         del_network_route() {
 166                 NETWORK="$1"
 167                 NETMASK="$2"
 168                 NETMASKLEN="$3"
 169                 $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 170                 $IPROUTE route flush cache
 171         }
 172
 173         set_ipv6_default_route() {
 174                 # We don't save/restore IPv6 default route; just add a higher-priority one.
 175                 $IPROUTE -6 route add default dev "$TUNDEV" metric 1
 176                 $IPROUTE -6 route flush cache
 177         }
 178
 179         set_ipv6_network_route() {
 180                 NETWORK="$1"
 181                 NETMASKLEN="$2"
 182                 $IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 183                 $IPROUTE route flush cache
 184         }
 185
 186         reset_ipv6_default_route() {
 187                 $IPROUTE -6 route del default dev "$TUNDEV"
 188                 $IPROUTE route flush cache
 189         }
 190
 191         del_ipv6_network_route() {
 192                 NETWORK="$1"
 193                 NETMASKLEN="$2"
 194                 $IPROUTE -6 route del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 195                 $IPROUTE -6 route flush cache
 196         }
 197 else # use route command
 198         get_default_gw() {
 199                 # isn't -n supposed to give --numeric output?
 200                 # apperently not...
 201                 # Get rid of lines containing IPv6 addresses (':')
 202                 netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }'
 203         }
 204
 205         set_vpngateway_route() {
 206                 route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`"
 207         }
 208
 209         del_vpngateway_route() {
 210                 vpngw_route=`netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }'`
 211                 route $route_syntax_del -host "$VPNGATEWAY" $route_syntax_gw "$vpngw_route"
 212         }
 213
 214         set_default_route() {
 215                 DEFAULTGW="`get_default_gw`"
 216                 echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE"
 217                 route $route_syntax_del default $route_syntax_gw "`get_default_gw`"
 218                 route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 219         }
 220
 221         set_network_route() {
 222                 NETWORK="$1"
 223                 NETMASK="$2"
 224                 NETMASKLEN="$3"
 225                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 226                 route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 227         }
 228
 229         reset_default_route() {
 230                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 231                         route $route_syntax_del default $route_syntax_gw "`get_default_gw`" $route_syntax_interface
 232                         route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"`
 233                         rm -f -- "$DEFAULT_ROUTE_FILE"
 234                 fi
 235         }
 236
 237         del_network_route() {
 238                 case "$OS" in
 239                 Linux|NetBSD|Darwin|SunOS) # and probably others...
 240                         # routes are deleted automatically on device shutdown
 241                         return
 242                         ;;
 243                 esac
 244                 NETWORK="$1"
 245                 NETMASK="$2"
 246                 NETMASKLEN="$3"
 247                 route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS"
 248         }
 249
 250         set_ipv6_default_route() {
 251                 # FIXME
 252                 :
 253         }
 254
 255         set_ipv6_network_route() {
 256                 # FIXME
 257                 :
 258         }
 259
 260         reset_ipv6_default_route() {
 261                 # FIXME
 262                 :
 263         }
 264
 265         del_ipv6_network_route() {
 266                 # FIXME
 267                 :
 268         }
 269
 270 fi
 271
 272 # =========== resolv.conf handling ====================================
 273
 274 # =========== resolv.conf handling for any OS =========================
 275
 276 modify_resolvconf_generic() {
 277         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP"
 278         NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc
 279 # and will be overwritten by vpnc
 280 # as long as the above mark is intact"
 281
 282         # Remember the original value of CISCO_DEF_DOMAIN we need it later
 283         CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN"
 284         # Don't step on INTERNAL_IP4_DNS value, use a temporary variable
 285         INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS"
 286         exec 6< "$RESOLV_CONF_BACKUP"
 287         while read LINE <&6 ; do
 288                 case "$LINE" in
 289                         nameserver*)
 290                                 if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then
 291                                         read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF
 292         $INTERNAL_IP4_DNS_TEMP
 293 EOF
 294                                         LINE="nameserver $ONE_NAMESERVER"
 295                                 else
 296                                         LINE=""
 297                                 fi
 298                                 ;;
 299                         search*)
 300                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 301                                         LINE="$LINE $CISCO_DEF_DOMAIN"
 302                                         CISCO_DEF_DOMAIN=""
 303                                 fi
 304                                 ;;
 305                         domain*)
 306                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 307                                         LINE="domain $CISCO_DEF_DOMAIN"
 308                                         CISCO_DEF_DOMAIN=""
 309                                 fi
 310                                 ;;
 311                 esac
 312                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 313 $LINE"
 314         done
 315         exec 6<&-
 316
 317         for i in $INTERNAL_IP4_DNS_TEMP ; do
 318                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 319 nameserver $i"
 320         done
 321         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 322                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 323 search $CISCO_DEF_DOMAIN"
 324         fi
 325         echo "$NEW_RESOLVCONF" > /etc/resolv.conf
 326
 327         if [ "$OS" = "Darwin" ]; then
 328                 case "`uname -r`" in
 329                         # Skip for pre-10.4 systems
 330                         4.*|5.*|6.*|7.*)
 331                                 ;;
 332                         # 10.4 and later require use of scutil for DNS to work properly
 333                         *)
 334                                 OVERRIDE_PRIMARY=""
 335                                 if [ -n "$CISCO_SPLIT_INC" ]; then
 336                                         if [ $CISCO_SPLIT_INC -lt 1 ]; then
 337                                                 # Must override for correct default route
 338                                                 # Cannot use multiple DNS matching in this case
 339                                                 OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 340                                         fi
 341                                 fi
 342                                 # Uncomment the following if/fi pair to use multiple
 343                                 # DNS matching when available.  When multiple DNS matching
 344                                 # is present, anything reading the /etc/resolv.conf file
 345                                 # directly will probably not work as intended.
 346                                 #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then
 347                                         # Cannot use multiple DNS matching without a domain
 348                                         OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 349                                 #fi
 350                                 scutil >/dev/null 2>&1 <<-EOF
 351                                         open
 352                                         d.init
 353                                         d.add ServerAddresses * $INTERNAL_IP4_DNS
 354                                         set State:/Network/Service/$TUNDEV/DNS
 355                                         d.init
 356                                         # next line overrides the default gateway and breaks split routing
 357                                         # d.add Router $INTERNAL_IP4_ADDRESS
 358                                         d.add Addresses * $INTERNAL_IP4_ADDRESS
 359                                         d.add SubnetMasks * 255.255.255.255
 360                                         d.add InterfaceName $TUNDEV
 361                                         $OVERRIDE_PRIMARY
 362                                         set State:/Network/Service/$TUNDEV/IPv4
 363                                         close
 364                                 EOF
 365                                 if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then
 366                                         scutil >/dev/null 2>&1 <<-EOF
 367                                                 open
 368                                                 get State:/Network/Service/$TUNDEV/DNS
 369                                                 d.add DomainName $CISCO_DEF_DOMAIN_ORIG
 370                                                 d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG
 371                                                 d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG
 372                                                 set State:/Network/Service/$TUNDEV/DNS
 373                                                 close
 374                                         EOF
 375                                 fi
 376                                 ;;
 377                 esac
 378         fi
 379 }
 380
 381 restore_resolvconf_generic() {
 382         if [ ! -e "$RESOLV_CONF_BACKUP" ]; then
 383                 return
 384         fi
 385         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf
 386         rm -f -- "$RESOLV_CONF_BACKUP"
 387
 388         if [ "$OS" = "Darwin" ]; then
 389                 case "`uname -r`" in
 390                         # Skip for pre-10.4 systems
 391                         4.*|5.*|6.*|7.*)
 392                                 ;;
 393                         # 10.4 and later require use of scutil for DNS to work properly
 394                         *)
 395                                 scutil >/dev/null 2>&1 <<-EOF
 396                                         open
 397                                         remove State:/Network/Service/$TUNDEV/IPv4
 398                                         remove State:/Network/Service/$TUNDEV/DNS
 399                                         close
 400                                 EOF
 401                                 ;;
 402                 esac
 403         fi
 404 }
 405 # === resolv.conf handling via /sbin/modify_resolvconf (Suse) =====================
 406
 407 # Suse provides a script that modifies resolv.conf. Use it because it will
 408 # restart/reload all other services that care about it (e.g. lwresd).
 409
 410 modify_resolvconf_suse()
 411 {
 412         FULL_SCRIPTNAME=`readlink -f $0`
 413         RESOLV_OPTS=''
 414         test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\""
 415         test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN"
 416         test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\"
 417 }
 418
 419 # Restore resolv.conf to old contents on Suse
 420 restore_resolvconf_suse()
 421 {
 422         FULL_SCRIPTNAME=`readlink -f $0`
 423         /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV
 424 }
 425
 426 # === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) =========
 427
 428 modify_resolvconf_manager() {
 429         NEW_RESOLVCONF=""
 430         for i in $INTERNAL_IP4_DNS; do
 431                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 432 nameserver $i"
 433         done
 434         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 435                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 436 domain $CISCO_DEF_DOMAIN"
 437         fi
 438         echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV
 439 }
 440
 441 restore_resolvconf_manager() {
 442         /sbin/resolvconf -d $TUNDEV
 443 }
 444
 445 # ========= Toplevel state handling  =======================================
 446
 447 kernel_is_2_6_or_above() {
 448         case `uname -r` in
 449                 1.*|2.[012345]*)
 450                         return 1
 451                         ;;
 452                 *)
 453                         return 0
 454                         ;;
 455         esac
 456 }
 457
 458 do_pre_init() {
 459         if [ "$OS" = "Linux" ]; then
 460                 if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then
 461                         :
 462                 else # can't open /dev/net/tun
 463                         test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null
 464                         # fix for broken devfs in kernel 2.6.x
 465                         if [ "`readlink /dev/net/tun`" = misc/net/tun \
 466                                 -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then
 467                                 ln -sf /dev/misc/net/tun /dev/net/tun
 468                         fi
 469                         # make sure tun device exists
 470                         if [ ! -e /dev/net/tun ]; then
 471                                 mkdir -p /dev/net
 472                                 mknod -m 0640 /dev/net/tun c 10 200
 473                         fi
 474                         # workaround for a possible latency caused by udev, sleep max. 10s
 475                         if kernel_is_2_6_or_above ; then
 476                                 for x in `seq 100` ; do
 477                                         (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break;
 478                                         sleep 0.1
 479                                 done
 480                         fi
 481                 fi
 482         elif [ "$OS" = "FreeBSD" ]; then
 483                 if [ ! -e /dev/tun ]; then
 484                         kldload if_tun
 485                 fi
 486         elif [ "$OS" = "GNU/kFreeBSD" ]; then
 487                 if [ ! -e /dev/tun ]; then
 488                         kldload if_tun
 489                 fi
 490         elif [ "$OS" = "NetBSD" ]; then
 491                 :
 492         elif [ "$OS" = "OpenBSD" ]; then
 493                 :
 494         elif [ "$OS" = "SunOS" ]; then
 495                 :
 496         elif [ "$OS" = "Darwin" ]; then
 497                 :
 498         fi
 499 }
 500
 501 do_connect() {
 502         if [ -n "$CISCO_BANNER" ]; then
 503                 echo "Connect Banner:"
 504                 echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done
 505                 echo
 506         fi
 507
 508         do_ifconfig
 509         set_vpngateway_route
 510         if [ -n "$CISCO_SPLIT_INC" ]; then
 511                 i=0
 512                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 513                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 514                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 515                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 516                         if [ $NETWORK != "0.0.0.0" ]; then
 517                                 set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 518                         else
 519                                 set_default_route
 520                         fi
 521                         i=`expr $i + 1`
 522                 done
 523                 for i in $INTERNAL_IP4_DNS ; do
 524                         if ! echo "$i" | grep -q : ; then
 525                                 set_network_route "$i" "255.255.255.255" "32"
 526                         fi
 527                 done
 528         elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 529                 set_default_route
 530         fi
 531         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 532                 i=0
 533                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 534                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 535                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 536                         if [ $NETMASKLEN -lt 128 ]; then
 537                                 set_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 538                         else
 539                                 set_ipv6_default_route
 540                         fi
 541                         i=`expr $i + 1`
 542                 done
 543                 for i in $INTERNAL_IP4_DNS ; do
 544                         if echo "$i" | grep -q : ; then
 545                                 set_ipv6_network_route "$i" "128"
 546                         fi
 547                 done
 548         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 549                 set_ipv6_default_route
 550         fi
 551
 552         if [ -n "$INTERNAL_IP4_DNS" ]; then
 553                 $MODIFYRESOLVCONF
 554         fi
 555 }
 556
 557 do_disconnect() {
 558         if [ -n "$CISCO_SPLIT_INC" ]; then
 559                 i=0
 560                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 561                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 562                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 563                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 564                         if [ $NETWORK != "0.0.0.0" ]; then
 565                                 # FIXME: This doesn't restore previously overwritten
 566                                 #        routes.
 567                                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 568                         else
 569                                 reset_default_route
 570                         fi
 571                         i=`expr $i + 1`
 572                 done
 573                 for i in $INTERNAL_IP4_DNS ; do
 574                         del_network_route "$i" "255.255.255.255" "32"
 575                 done
 576         else
 577                 reset_default_route
 578         fi
 579         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 580                 i=0
 581                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 582                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 583                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 584                         if [ $NETMASKLEN -eq 128 ]; then
 585                                 del_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 586                         else
 587                                 reset_ipv6_default_route
 588                         fi
 589                         i=`expr $i + 1`
 590                 done
 591                 for i in $INTERNAL_IP6_DNS ; do
 592                         del_ipv6_network_route "$i" "128"
 593                 done
 594         else
 595                 reset_ipv6_default_route
 596         fi
 597
 598         del_vpngateway_route
 599
 600         if [ -n "$INTERNAL_IP4_DNS" ]; then
 601                 $RESTORERESOLVCONF
 602         fi
 603         destroy_tun_device
 604 }
 605
 606 #### Main
 607
 608 if [ -z "$reason" ]; then
 609         echo "this script must be called from vpnc" 1>&2
 610         exit 1
 611 fi
 612
 613 case "$reason" in
 614         pre-init)
 615                 do_pre_init
 616                 ;;
 617         connect)
 618                 do_connect
 619                 ;;
 620         disconnect)
 621                 do_disconnect
 622                 ;;
 623         *)
 624                 echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
 625                 exit 1
 626                 ;;
 627 esac
 628
 629 exit 0