vpnc-script

   1 #!/bin/sh
   2 #
   3 # Originally part of vpnc source code:
   4 # © 2005-2012 Maurice Massar, Jörg Mayer, Antonio Borneo et al.
   5 # © 2009-2012 David Woodhouse <dwmw2@infradead.org>
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 2 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program; if not, write to the Free Software
  19 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  20 #
  21 ################
  22 #
  23 # List of parameters passed through environment
  24 #* reason                       -- why this script was called, one of: pre-init connect disconnect reconnect
  25 #* VPNGATEWAY                   -- vpn gateway address (always present)
  26 #* TUNDEV                       -- tunnel device (always present)
  27 #* INTERNAL_IP4_ADDRESS         -- address (always present)
  28 #* INTERNAL_IP4_MTU             -- mtu (often unset)
  29 #* INTERNAL_IP4_NETMASK         -- netmask (often unset)
  30 #* INTERNAL_IP4_NETMASKLEN      -- netmask length (often unset)
  31 #* INTERNAL_IP4_NETADDR         -- address of network (only present if netmask is set)
  32 #* INTERNAL_IP4_DNS             -- list of dns servers
  33 #* INTERNAL_IP4_NBNS            -- list of wins servers
  34 #* INTERNAL_IP6_ADDRESS         -- IPv6 address
  35 #* INTERNAL_IP6_NETMASK         -- IPv6 netmask
  36 #* INTERNAL_IP6_DNS             -- IPv6 list of dns servers
  37 #* CISCO_DEF_DOMAIN             -- default domain name
  38 #* CISCO_BANNER                 -- banner from server
  39 #* CISCO_SPLIT_DNS              -- comma-separated list of domain names with split DNS
  40 #* CISCO_SPLIT_INC              -- number of networks in split-network-list
  41 #* CISCO_SPLIT_INC_%d_ADDR      -- network address
  42 #* CISCO_SPLIT_INC_%d_MASK      -- subnet mask (for example: 255.255.255.0)
  43 #* CISCO_SPLIT_INC_%d_MASKLEN   -- subnet masklen (for example: 24)
  44 #* CISCO_SPLIT_INC_%d_PROTOCOL  -- protocol (often just 0)
  45 #* CISCO_SPLIT_INC_%d_SPORT     -- source port (often just 0)
  46 #* CISCO_SPLIT_INC_%d_DPORT     -- destination port (often just 0)
  47 #* CISCO_IPV6_SPLIT_INC         -- number of networks in IPv6 split-network-list
  48 #* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address
  49 #* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen
  50
  51 # FIXMEs:
  52
  53 # Section A: route handling
  54
  55 # 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored
  56 #   In order to use them, we'll probably need os specific solutions
  57 #   * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV
  58 #       This would be an *alternative* to changing the routes (and thus 2) and 3)
  59 #       shouldn't be relevant at all)
  60 # 2) There are two different functions to set routes: generic routes and the
  61 #   default route. Why isn't the defaultroute handled via the generic route case?
  62 # 3) In the split tunnel case, all routes but the default route might get replaced
  63 #   without getting restored later. We should explicitely check and save them just
  64 #   like the defaultroute
  65 # 4) Replies to a dhcp-server should never be sent into the tunnel
  66
  67 # Section B: Split DNS handling
  68
  69 # 1) Maybe dnsmasq can do something like that
  70 # 2) Parse dns packets going out via tunnel and redirect them to original dns-server
  71
  72 #env | sort
  73 #set -x
  74
  75 # =========== script (variable) setup ====================================
  76
  77 PATH=/sbin:/usr/sbin:$PATH
  78
  79 OS="`uname -s`"
  80
  81 HOOKS_DIR=/etc/vpnc
  82 DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute
  83 RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup
  84 SCRIPTNAME=`basename $0`
  85
  86 # some systems, eg. Darwin & FreeBSD, prune /var/run on boot
  87 if [ ! -d "/var/run/vpnc" ]; then
  88         mkdir -p /var/run/vpnc
  89         [ -x /sbin/restorecon ] && /sbin/restorecon /var/run/vpnc
  90 fi
  91
  92 # stupid SunOS: no blubber in /usr/local/bin ... (on stdout)
  93 IPROUTE="`which ip 2> /dev/null | grep '^/'`"
  94
  95 if ifconfig --help 2>&1 | grep BusyBox > /dev/null; then
  96         ifconfig_syntax_inet=""
  97 else
  98         ifconfig_syntax_inet="inet"
  99 fi
 100
 101 if [ "$OS" = "Linux" ]; then
 102         ifconfig_syntax_ptp="pointopoint"
 103         route_syntax_gw="gw"
 104         route_syntax_del="del"
 105         route_syntax_netmask="netmask"
 106 else
 107         ifconfig_syntax_ptp=""
 108         route_syntax_gw=""
 109         route_syntax_del="delete"
 110         route_syntax_netmask="-netmask"
 111 fi
 112 if [ "$OS" = "SunOS" ]; then
 113         route_syntax_interface="-interface"
 114         ifconfig_syntax_ptpv6="$INTERNAL_IP6_ADDRESS"
 115 else
 116         route_syntax_interface=""
 117         ifconfig_syntax_ptpv6=""
 118 fi
 119
 120 if [ -r /etc/openwrt_release ] && [ -n "$OPENWRT_INTERFACE" ]; then
 121         . /etc/functions.sh
 122         include /lib/network
 123         MODIFYRESOLVCONF=modify_resolvconf_openwrt
 124         RESTORERESOLVCONF=restore_resolvconf_openwrt
 125 elif [ -x /sbin/resolvconf ] && [ "$OS" != "FreeBSD" ]; then # Optional tool on Debian, Ubuntu, Gentoo - but not FreeBSD, it seems to work different
 126         MODIFYRESOLVCONF=modify_resolvconf_manager
 127         RESTORERESOLVCONF=restore_resolvconf_manager
 128 elif [ -x /sbin/netconfig ]; then # tool on Suse after 11.1
 129         MODIFYRESOLVCONF=modify_resolvconf_suse_netconfig
 130         RESTORERESOLVCONF=restore_resolvconf_suse_netconfig
 131 elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1
 132         MODIFYRESOLVCONF=modify_resolvconf_suse
 133         RESTORERESOLVCONF=restore_resolvconf_suse
 134 else # Generic for any OS
 135         MODIFYRESOLVCONF=modify_resolvconf_generic
 136         RESTORERESOLVCONF=restore_resolvconf_generic
 137 fi
 138
 139
 140 # =========== script hooks =================================================
 141
 142 run_hooks() {
 143         HOOK="$1"
 144
 145         if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then
 146             for script in ${HOOKS_DIR}/${HOOK}.d/* ; do
 147                 [ -f $script ] && . $script
 148             done
 149         fi
 150 }
 151
 152 # =========== tunnel interface handling ====================================
 153
 154 do_ifconfig() {
 155         if [ -n "$INTERNAL_IP4_MTU" ]; then
 156                 MTU=$INTERNAL_IP4_MTU
 157         elif [ -n "$IPROUTE" ]; then
 158                 MTUDEV=`$IPROUTE route get "$VPNGATEWAY" | sed -ne 's/^.*dev \([a-z0-9]*\).*$/\1/p'`
 159                 MTU=`$IPROUTE link show "$MTUDEV" | sed -ne 's/^.*mtu \([[:digit:]]\+\).*$/\1/p'`
 160                 if [ -n "$MTU" ]; then
 161                         MTU=`expr $MTU - 88`
 162                 fi
 163         fi
 164
 165         if [ -z "$MTU" ]; then
 166                 MTU=1412
 167         fi
 168
 169         # Point to point interface require a netmask of 255.255.255.255 on some systems
 170         if [ -n "$IPROUTE" ]; then
 171                 $IPROUTE link set dev "$TUNDEV" up mtu "$MTU"
 172                 $IPROUTE addr add "$INTERNAL_IP4_ADDRESS/32" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
 173         else
 174                 ifconfig "$TUNDEV" ${ifconfig_syntax_inet} "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up
 175         fi
 176
 177         if [ -n "$INTERNAL_IP4_NETMASK" ]; then
 178                 set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN
 179         fi
 180
 181         # If the netmask is provided, it contains the address _and_ netmask
 182         if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
 183             INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
 184         fi
 185         if [ -n "$INTERNAL_IP6_NETMASK" ]; then
 186             if [ -n "$IPROUTE" ]; then
 187                 $IPROUTE -6 addr add $INTERNAL_IP6_NETMASK dev $TUNDEV
 188             else
 189                 # Unlike for Legacy IP, we don't specify the dest_address
 190                 # here on *BSD. OpenBSD for one will refuse to accept
 191                 # incoming packets to that address if we do.
 192                 # OpenVPN does the same (gives dest_address for Legacy IP
 193                 # but not for IPv6).
 194                 # Only Solaris needs it; hence $ifconfig_syntax_ptpv6
 195                 ifconfig "$TUNDEV" inet6 $INTERNAL_IP6_NETMASK $ifconfig_syntax_ptpv6 mtu $MTU up
 196             fi
 197         fi
 198 }
 199
 200 destroy_tun_device() {
 201         case "$OS" in
 202         NetBSD|OpenBSD) # and probably others...
 203                 ifconfig "$TUNDEV" destroy
 204                 ;;
 205         FreeBSD)
 206                 ifconfig "$TUNDEV" destroy > /dev/null 2>&1 &
 207                 ;;
 208         esac
 209 }
 210
 211 # =========== route handling ====================================
 212
 213 if [ -n "$IPROUTE" ]; then
 214         fix_ip_get_output () {
 215                 sed -e 's/ /\n/g' | \
 216                     sed -ne '1p;/via/{N;p};/dev/{N;p};/src/{N;p};/mtu/{N;p}'
 217         }
 218
 219         set_vpngateway_route() {
 220                 $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output`
 221                 $IPROUTE route flush cache
 222         }
 223
 224         del_vpngateway_route() {
 225                 $IPROUTE route $route_syntax_del "$VPNGATEWAY"
 226                 $IPROUTE route flush cache
 227         }
 228
 229         set_default_route() {
 230                 $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
 231                 $IPROUTE route replace default dev "$TUNDEV"
 232                 $IPROUTE route flush cache
 233         }
 234
 235         set_network_route() {
 236                 NETWORK="$1"
 237                 NETMASK="$2"
 238                 NETMASKLEN="$3"
 239                 $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 240                 $IPROUTE route flush cache
 241         }
 242
 243         reset_default_route() {
 244                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 245                         $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"`
 246                         $IPROUTE route flush cache
 247                         rm -f -- "$DEFAULT_ROUTE_FILE"
 248                 fi
 249         }
 250
 251         del_network_route() {
 252                 NETWORK="$1"
 253                 NETMASK="$2"
 254                 NETMASKLEN="$3"
 255                 $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 256                 $IPROUTE route flush cache
 257         }
 258
 259         set_ipv6_default_route() {
 260                 # We don't save/restore IPv6 default route; just add a higher-priority one.
 261                 $IPROUTE -6 route add default dev "$TUNDEV" metric 1
 262                 $IPROUTE -6 route flush cache
 263         }
 264
 265         set_ipv6_network_route() {
 266                 NETWORK="$1"
 267                 NETMASKLEN="$2"
 268                 $IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 269                 $IPROUTE route flush cache
 270         }
 271
 272         reset_ipv6_default_route() {
 273                 $IPROUTE -6 route del default dev "$TUNDEV"
 274                 $IPROUTE route flush cache
 275         }
 276
 277         del_ipv6_network_route() {
 278                 NETWORK="$1"
 279                 NETMASKLEN="$2"
 280                 $IPROUTE -6 route del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 281                 $IPROUTE -6 route flush cache
 282         }
 283 else # use route command
 284         get_default_gw() {
 285                 # isn't -n supposed to give --numeric output?
 286                 # apperently not...
 287                 # Get rid of lines containing IPv6 addresses (':')
 288                 netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }'
 289         }
 290
 291         set_vpngateway_route() {
 292                 route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`"
 293         }
 294
 295         del_vpngateway_route() {
 296                 route $route_syntax_del -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`"
 297         }
 298
 299         set_default_route() {
 300                 DEFAULTGW="`get_default_gw`"
 301                 echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE"
 302                 route $route_syntax_del default $route_syntax_gw "$DEFAULTGW"
 303                 route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 304         }
 305
 306         set_network_route() {
 307                 NETWORK="$1"
 308                 NETMASK="$2"
 309                 NETMASKLEN="$3"
 310                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 311                 route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 312         }
 313
 314         reset_default_route() {
 315                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 316                         route $route_syntax_del default $route_syntax_gw "`get_default_gw`" $route_syntax_interface
 317                         route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"`
 318                         rm -f -- "$DEFAULT_ROUTE_FILE"
 319                 fi
 320         }
 321
 322         del_network_route() {
 323                 case "$OS" in
 324                 Linux|NetBSD|OpenBSD|Darwin|SunOS) # and probably others...
 325                         # routes are deleted automatically on device shutdown
 326                         return
 327                         ;;
 328                 esac
 329                 NETWORK="$1"
 330                 NETMASK="$2"
 331                 NETMASKLEN="$3"
 332                 route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS"
 333         }
 334
 335         set_ipv6_default_route() {
 336                 route add -inet6 default "$INTERNAL_IP6_ADDRESS" $route_syntax_interface
 337         }
 338
 339         set_ipv6_network_route() {
 340                 NETWORK="$1"
 341                 NETMASK="$2"
 342                 route add -inet6 -net "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS" $route_syntax_interface
 343                 :
 344         }
 345
 346         reset_ipv6_default_route() {
 347                 route $route_syntax_del -inet6 default "$INTERNAL_IP6_ADDRESS"
 348                 :
 349         }
 350
 351         del_ipv6_network_route() {
 352                 NETWORK="$1"
 353                 NETMASK="$2"
 354                 route $route_syntax_del -inet6 "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS"
 355                 :
 356         }
 357
 358 fi
 359
 360 # =========== resolv.conf handling ====================================
 361
 362 # =========== resolv.conf handling for any OS =========================
 363
 364 modify_resolvconf_generic() {
 365         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP"
 366         NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc
 367 # and will be overwritten by vpnc
 368 # as long as the above mark is intact"
 369
 370         # Remember the original value of CISCO_DEF_DOMAIN we need it later
 371         CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN"
 372         # Don't step on INTERNAL_IP4_DNS value, use a temporary variable
 373         INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS"
 374         exec 6< "$RESOLV_CONF_BACKUP"
 375         while read LINE <&6 ; do
 376                 case "$LINE" in
 377                         nameserver*)
 378                                 if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then
 379                                         read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF
 380         $INTERNAL_IP4_DNS_TEMP
 381 EOF
 382                                         LINE="nameserver $ONE_NAMESERVER"
 383                                 else
 384                                         LINE=""
 385                                 fi
 386                                 ;;
 387                         search*)
 388                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 389                                         LINE="$LINE $CISCO_DEF_DOMAIN"
 390                                         CISCO_DEF_DOMAIN=""
 391                                 fi
 392                                 ;;
 393                         domain*)
 394                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 395                                         LINE="domain $CISCO_DEF_DOMAIN"
 396                                         CISCO_DEF_DOMAIN=""
 397                                 fi
 398                                 ;;
 399                 esac
 400                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 401 $LINE"
 402         done
 403         exec 6<&-
 404
 405         for i in $INTERNAL_IP4_DNS_TEMP ; do
 406                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 407 nameserver $i"
 408         done
 409         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 410                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 411 search $CISCO_DEF_DOMAIN"
 412         fi
 413         echo "$NEW_RESOLVCONF" > /etc/resolv.conf
 414
 415         if [ "$OS" = "Darwin" ]; then
 416                 case "`uname -r`" in
 417                         # Skip for pre-10.4 systems
 418                         4.*|5.*|6.*|7.*)
 419                                 ;;
 420                         # 10.4 and later require use of scutil for DNS to work properly
 421                         *)
 422                                 OVERRIDE_PRIMARY=""
 423                                 if [ -n "$CISCO_SPLIT_INC" ]; then
 424                                         if [ $CISCO_SPLIT_INC -lt 1 ]; then
 425                                                 # Must override for correct default route
 426                                                 # Cannot use multiple DNS matching in this case
 427                                                 OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 428                                         fi
 429                                 fi
 430                                 # Uncomment the following if/fi pair to use multiple
 431                                 # DNS matching when available.  When multiple DNS matching
 432                                 # is present, anything reading the /etc/resolv.conf file
 433                                 # directly will probably not work as intended.
 434                                 #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then
 435                                         # Cannot use multiple DNS matching without a domain
 436                                         OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 437                                 #fi
 438                                 scutil >/dev/null 2>&1 <<-EOF
 439                                         open
 440                                         d.init
 441                                         d.add ServerAddresses * $INTERNAL_IP4_DNS
 442                                         set State:/Network/Service/$TUNDEV/DNS
 443                                         d.init
 444                                         # next line overrides the default gateway and breaks split routing
 445                                         # d.add Router $INTERNAL_IP4_ADDRESS
 446                                         d.add Addresses * $INTERNAL_IP4_ADDRESS
 447                                         d.add SubnetMasks * 255.255.255.255
 448                                         d.add InterfaceName $TUNDEV
 449                                         $OVERRIDE_PRIMARY
 450                                         set State:/Network/Service/$TUNDEV/IPv4
 451                                         close
 452                                 EOF
 453                                 if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then
 454                                         scutil >/dev/null 2>&1 <<-EOF
 455                                                 open
 456                                                 get State:/Network/Service/$TUNDEV/DNS
 457                                                 d.add DomainName $CISCO_DEF_DOMAIN_ORIG
 458                                                 d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG
 459                                                 d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG
 460                                                 set State:/Network/Service/$TUNDEV/DNS
 461                                                 close
 462                                         EOF
 463                                 fi
 464                                 ;;
 465                 esac
 466         fi
 467 }
 468
 469 restore_resolvconf_generic() {
 470         if [ ! -f "$RESOLV_CONF_BACKUP" ]; then
 471                 return
 472         fi
 473         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf
 474         rm -f -- "$RESOLV_CONF_BACKUP"
 475
 476         if [ "$OS" = "Darwin" ]; then
 477                 case "`uname -r`" in
 478                         # Skip for pre-10.4 systems
 479                         4.*|5.*|6.*|7.*)
 480                                 ;;
 481                         # 10.4 and later require use of scutil for DNS to work properly
 482                         *)
 483                                 scutil >/dev/null 2>&1 <<-EOF
 484                                         open
 485                                         remove State:/Network/Service/$TUNDEV/IPv4
 486                                         remove State:/Network/Service/$TUNDEV/DNS
 487                                         close
 488                                 EOF
 489                                 ;;
 490                 esac
 491         fi
 492 }
 493 # === resolv.conf handling via /sbin/netconfig (Suse 11.1) =====================
 494
 495 # Suse provides a script that modifies resolv.conf. Use it because it will
 496 # restart/reload all other services that care about it (e.g. lwresd).  [unclear if this is still true, but probably --mlk]
 497
 498 modify_resolvconf_suse_netconfig()
 499 {
 500         /sbin/netconfig modify -s vpnc -i "$TUNDEV" <<-EOF
 501                 INTERFACE='$TUNDEV'
 502                 DNSSERVERS='$INTERNAL_IP4_DNS'
 503                 DNSDOMAIN='$CISCO_DEF_DOMAIN'
 504                 EOF
 505 }
 506 # Restore resolv.conf to old contents on Suse
 507 restore_resolvconf_suse_netconfig()
 508 {
 509         /sbin/netconfig remove -s vpnc -i "$TUNDEV"
 510 }
 511
 512 # === resolv.conf handling via /sbin/modify_resolvconf (Suse) =====================
 513
 514 # Suse provides a script that modifies resolv.conf. Use it because it will
 515 # restart/reload all other services that care about it (e.g. lwresd).
 516
 517 modify_resolvconf_suse()
 518 {
 519         FULL_SCRIPTNAME=`readlink -f $0`
 520         RESOLV_OPTS=''
 521         test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\""
 522         test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN"
 523         test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\"
 524 }
 525
 526 # Restore resolv.conf to old contents on Suse
 527 restore_resolvconf_suse()
 528 {
 529         FULL_SCRIPTNAME=`readlink -f $0`
 530         /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV
 531 }
 532
 533 # === resolv.conf handling via UCI (OpenWRT) =========
 534
 535 modify_resolvconf_openwrt() {
 536         add_dns $OPENWRT_INTERFACE $INTERNAL_IP4_DNS
 537 }
 538
 539 restore_resolvconf_openwrt() {
 540         remove_dns $OPENWRT_INTERFACE
 541 }
 542 # === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) =========
 543
 544 modify_resolvconf_manager() {
 545         NEW_RESOLVCONF=""
 546         for i in $INTERNAL_IP4_DNS; do
 547                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 548 nameserver $i"
 549         done
 550         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 551                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 552 domain $CISCO_DEF_DOMAIN"
 553         fi
 554         echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV
 555 }
 556
 557 restore_resolvconf_manager() {
 558         /sbin/resolvconf -d $TUNDEV
 559 }
 560
 561 # ========= Toplevel state handling  =======================================
 562
 563 kernel_is_2_6_or_above() {
 564         case `uname -r` in
 565                 1.*|2.[012345]*)
 566                         return 1
 567                         ;;
 568                 *)
 569                         return 0
 570                         ;;
 571         esac
 572 }
 573
 574 do_pre_init() {
 575         if [ "$OS" = "Linux" ]; then
 576                 if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then
 577                         :
 578                 else # can't open /dev/net/tun
 579                         test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null
 580                         # fix for broken devfs in kernel 2.6.x
 581                         if [ "`readlink /dev/net/tun`" = misc/net/tun \
 582                                 -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then
 583                                 ln -sf /dev/misc/net/tun /dev/net/tun
 584                         fi
 585                         # make sure tun device exists
 586                         if [ ! -e /dev/net/tun ]; then
 587                                 mkdir -p /dev/net
 588                                 mknod -m 0640 /dev/net/tun c 10 200
 589                                 [ -x /sbin/restorecon ] && /sbin/restorecon /dev/net/tun
 590                         fi
 591                         # workaround for a possible latency caused by udev, sleep max. 10s
 592                         if kernel_is_2_6_or_above ; then
 593                                 for x in `seq 100` ; do
 594                                         (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break;
 595                                         sleep 0.1
 596                                 done
 597                         fi
 598                 fi
 599         elif [ "$OS" = "FreeBSD" ]; then
 600                 if ! kldstat -q -m if_tun > /dev/null; then
 601                         kldload if_tun
 602                 fi
 603
 604                 if ! ifconfig $TUNDEV > /dev/null; then
 605                         ifconfig $TUNDEV create
 606                 fi
 607         elif [ "$OS" = "GNU/kFreeBSD" ]; then
 608                 if [ ! -e /dev/tun ]; then
 609                         kldload if_tun
 610                 fi
 611         elif [ "$OS" = "NetBSD" ]; then
 612                 :
 613         elif [ "$OS" = "OpenBSD" ]; then
 614                 if ! ifconfig $TUNDEV > /dev/null; then
 615                         ifconfig $TUNDEV create
 616                 fi
 617                 :
 618         elif [ "$OS" = "SunOS" ]; then
 619                 :
 620         elif [ "$OS" = "Darwin" ]; then
 621                 :
 622         fi
 623 }
 624
 625 do_connect() {
 626         if [ -n "$CISCO_BANNER" ]; then
 627                 echo "Connect Banner:"
 628                 echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done
 629                 echo
 630         fi
 631
 632         set_vpngateway_route
 633         do_ifconfig
 634         if [ -n "$CISCO_SPLIT_INC" ]; then
 635                 i=0
 636                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 637                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 638                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 639                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 640                         if [ $NETWORK != "0.0.0.0" ]; then
 641                                 set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 642                         else
 643                                 set_default_route
 644                         fi
 645                         i=`expr $i + 1`
 646                 done
 647                 for i in $INTERNAL_IP4_DNS ; do
 648                         echo "$i" | grep : >/dev/null || \
 649                                 set_network_route "$i" "255.255.255.255" "32"
 650                 done
 651         elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 652                 set_default_route
 653         fi
 654         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 655                 i=0
 656                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 657                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 658                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 659                         if [ $NETMASKLEN -lt 128 ]; then
 660                                 set_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 661                         else
 662                                 set_ipv6_default_route
 663                         fi
 664                         i=`expr $i + 1`
 665                 done
 666                 for i in $INTERNAL_IP4_DNS ; do
 667                         if echo "$i" | grep : >/dev/null; then
 668                                 set_ipv6_network_route "$i" "128"
 669                         fi
 670                 done
 671         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 672                 set_ipv6_default_route
 673         fi
 674
 675         if [ -n "$INTERNAL_IP4_DNS" ]; then
 676                 $MODIFYRESOLVCONF
 677         fi
 678 }
 679
 680 do_disconnect() {
 681         if [ -n "$CISCO_SPLIT_INC" ]; then
 682                 i=0
 683                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 684                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 685                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 686                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 687                         if [ $NETWORK != "0.0.0.0" ]; then
 688                                 # FIXME: This doesn't restore previously overwritten
 689                                 #        routes.
 690                                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 691                         else
 692                                 reset_default_route
 693                         fi
 694                         i=`expr $i + 1`
 695                 done
 696                 for i in $INTERNAL_IP4_DNS ; do
 697                         del_network_route "$i" "255.255.255.255" "32"
 698                 done
 699         else
 700                 reset_default_route
 701         fi
 702         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 703                 i=0
 704                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 705                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 706                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 707                         if [ $NETMASKLEN -eq 0 ]; then
 708                                 reset_ipv6_default_route
 709                         else
 710                                 del_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 711                         fi
 712                         i=`expr $i + 1`
 713                 done
 714                 for i in $INTERNAL_IP6_DNS ; do
 715                         del_ipv6_network_route "$i" "128"
 716                 done
 717         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 718                 reset_ipv6_default_route
 719         fi
 720
 721         del_vpngateway_route
 722
 723         if [ -n "$INTERNAL_IP4_DNS" ]; then
 724                 $RESTORERESOLVCONF
 725         fi
 726         destroy_tun_device
 727 }
 728
 729 #### Main
 730
 731 if [ -z "$reason" ]; then
 732         echo "this script must be called from vpnc" 1>&2
 733         exit 1
 734 fi
 735
 736 case "$reason" in
 737         pre-init)
 738                 run_hooks pre-init
 739                 do_pre_init
 740                 ;;
 741         connect)
 742                 run_hooks connect
 743                 do_connect
 744                 run_hooks post-connect
 745                 ;;
 746         disconnect)
 747                 run_hooks disconnect
 748                 do_disconnect
 749                 run_hooks post-disconnect
 750                 ;;
 751         reconnect)
 752                 run_hooks reconnect
 753                 ;;
 754         *)
 755                 echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
 756                 exit 1
 757                 ;;
 758 esac
 759
 760 exit 0