vpnc-script

   1 #!/bin/sh
   2 #
   3 # Originally part of vpnc source code:
   4 # © 2005-2012 Maurice Massar, Jörg Mayer, Antonio Borneo et al.
   5 # © 2009-2012 David Woodhouse <dwmw2@infradead.org>
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 2 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program; if not, write to the Free Software
  19 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  20 #
  21 ################
  22 #
  23 # List of parameters passed through environment
  24 #* reason                       -- why this script was called, one of: pre-init connect disconnect reconnect
  25 #* VPNGATEWAY                   -- vpn gateway address (always present)
  26 #* TUNDEV                       -- tunnel device (always present)
  27 #* INTERNAL_IP4_ADDRESS         -- address (always present)
  28 #* INTERNAL_IP4_MTU             -- mtu (often unset)
  29 #* INTERNAL_IP4_NETMASK         -- netmask (often unset)
  30 #* INTERNAL_IP4_NETMASKLEN      -- netmask length (often unset)
  31 #* INTERNAL_IP4_NETADDR         -- address of network (only present if netmask is set)
  32 #* INTERNAL_IP4_DNS             -- list of dns servers
  33 #* INTERNAL_IP4_NBNS            -- list of wins servers
  34 #* INTERNAL_IP6_ADDRESS         -- IPv6 address
  35 #* INTERNAL_IP6_NETMASK         -- IPv6 netmask
  36 #* INTERNAL_IP6_DNS             -- IPv6 list of dns servers
  37 #* CISCO_DEF_DOMAIN             -- default domain name
  38 #* CISCO_BANNER                 -- banner from server
  39 #* CISCO_SPLIT_INC              -- number of networks in split-network-list
  40 #* CISCO_SPLIT_INC_%d_ADDR      -- network address
  41 #* CISCO_SPLIT_INC_%d_MASK      -- subnet mask (for example: 255.255.255.0)
  42 #* CISCO_SPLIT_INC_%d_MASKLEN   -- subnet masklen (for example: 24)
  43 #* CISCO_SPLIT_INC_%d_PROTOCOL  -- protocol (often just 0)
  44 #* CISCO_SPLIT_INC_%d_SPORT     -- source port (often just 0)
  45 #* CISCO_SPLIT_INC_%d_DPORT     -- destination port (often just 0)
  46 #* CISCO_IPV6_SPLIT_INC         -- number of networks in IPv6 split-network-list
  47 #* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address
  48 #* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen
  49
  50 # FIXMEs:
  51
  52 # Section A: route handling
  53
  54 # 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored
  55 #   In order to use them, we'll probably need os specific solutions
  56 #   * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV
  57 #       This would be an *alternative* to changing the routes (and thus 2) and 3)
  58 #       shouldn't be relevant at all)
  59 # 2) There are two different functions to set routes: generic routes and the
  60 #   default route. Why isn't the defaultroute handled via the generic route case?
  61 # 3) In the split tunnel case, all routes but the default route might get replaced
  62 #   without getting restored later. We should explicitely check and save them just
  63 #   like the defaultroute
  64 # 4) Replies to a dhcp-server should never be sent into the tunnel
  65
  66 # Section B: Split DNS handling
  67
  68 # 1) Maybe dnsmasq can do something like that
  69 # 2) Parse dns packets going out via tunnel and redirect them to original dns-server
  70
  71 #env | sort
  72 #set -x
  73
  74 # =========== script (variable) setup ====================================
  75
  76 PATH=/sbin:/usr/sbin:$PATH
  77
  78 OS="`uname -s`"
  79
  80 HOOKS_DIR=/etc/vpnc
  81 DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute
  82 RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup
  83 SCRIPTNAME=`basename $0`
  84
  85 # some systems, eg. Darwin & FreeBSD, prune /var/run on boot
  86 if [ ! -d "/var/run/vpnc" ]; then
  87         mkdir -p /var/run/vpnc
  88         [ -x /sbin/restorecon ] && /sbin/restorecon /var/run/vpnc
  89 fi
  90
  91 # stupid SunOS: no blubber in /usr/local/bin ... (on stdout)
  92 IPROUTE="`which ip 2> /dev/null | grep '^/'`"
  93
  94 if ifconfig --help 2>&1 | grep BusyBox > /dev/null; then
  95         ifconfig_syntax_inet=""
  96 else
  97         ifconfig_syntax_inet="inet"
  98 fi
  99
 100 if [ "$OS" = "Linux" ]; then
 101         ifconfig_syntax_ptp="pointopoint"
 102         route_syntax_gw="gw"
 103         route_syntax_del="del"
 104         route_syntax_netmask="netmask"
 105 else
 106         ifconfig_syntax_ptp=""
 107         route_syntax_gw=""
 108         route_syntax_del="delete"
 109         route_syntax_netmask="-netmask"
 110 fi
 111 if [ "$OS" = "SunOS" ]; then
 112         route_syntax_interface="-interface"
 113         ifconfig_syntax_ptpv6="$INTERNAL_IP6_ADDRESS"
 114 else
 115         route_syntax_interface=""
 116         ifconfig_syntax_ptpv6=""
 117 fi
 118
 119 if [ -r /etc/openwrt_release ] && [ -n "$OPENWRT_INTERFACE" ]; then
 120         . /etc/functions.sh
 121         include /lib/network
 122         MODIFYRESOLVCONF=modify_resolvconf_openwrt
 123         RESTORERESOLVCONF=restore_resolvconf_openwrt
 124 elif [ -x /sbin/resolvconf ] && [ "$OS" != "FreeBSD" ]; then # Optional tool on Debian, Ubuntu, Gentoo - but not FreeBSD, it seems to work different
 125         MODIFYRESOLVCONF=modify_resolvconf_manager
 126         RESTORERESOLVCONF=restore_resolvconf_manager
 127 elif [ -x /sbin/netconfig ]; then # tool on Suse after 11.1
 128         MODIFYRESOLVCONF=modify_resolvconf_suse_netconfig
 129         RESTORERESOLVCONF=restore_resolvconf_suse_netconfig
 130 elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1
 131         MODIFYRESOLVCONF=modify_resolvconf_suse
 132         RESTORERESOLVCONF=restore_resolvconf_suse
 133 else # Generic for any OS
 134         MODIFYRESOLVCONF=modify_resolvconf_generic
 135         RESTORERESOLVCONF=restore_resolvconf_generic
 136 fi
 137
 138
 139 # =========== script hooks =================================================
 140
 141 run_hooks() {
 142         HOOK="$1"
 143
 144         if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then
 145             for script in ${HOOKS_DIR}/${HOOK}.d/* ; do
 146                 [ -f $script ] && . $script
 147             done
 148         fi
 149 }
 150
 151 # =========== tunnel interface handling ====================================
 152
 153 do_ifconfig() {
 154         if [ -n "$INTERNAL_IP4_MTU" ]; then
 155                 MTU=$INTERNAL_IP4_MTU
 156         elif [ -n "$IPROUTE" ]; then
 157                 MTUDEV=`$IPROUTE route get "$VPNGATEWAY" | sed -ne 's/^.*dev \([a-z0-9]*\).*$/\1/p'`
 158                 MTU=`$IPROUTE link show "$MTUDEV" | sed -ne 's/^.*mtu \([[:digit:]]\+\).*$/\1/p'`
 159                 if [ -n "$MTU" ]; then
 160                         MTU=`expr $MTU - 88`
 161                 fi
 162         fi
 163
 164         if [ -z "$MTU" ]; then
 165                 MTU=1412
 166         fi
 167
 168         # Point to point interface require a netmask of 255.255.255.255 on some systems
 169         if [ -n "$IPROUTE" ]; then
 170                 $IPROUTE link set dev "$TUNDEV" up mtu "$MTU"
 171                 $IPROUTE addr add "$INTERNAL_IP4_ADDRESS/32" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
 172         else
 173                 ifconfig "$TUNDEV" ${ifconfig_syntax_inet} "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up
 174         fi
 175
 176         if [ -n "$INTERNAL_IP4_NETMASK" ]; then
 177                 set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN
 178         fi
 179
 180         # If the netmask is provided, it contains the address _and_ netmask
 181         if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
 182             INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
 183         fi
 184         if [ -n "$INTERNAL_IP6_NETMASK" ]; then
 185             if [ -n "$IPROUTE" ]; then
 186                 $IPROUTE -6 addr add $INTERNAL_IP6_NETMASK dev $TUNDEV
 187             else
 188                 # Unlike for Legacy IP, we don't specify the dest_address
 189                 # here on *BSD. OpenBSD for one will refuse to accept
 190                 # incoming packets to that address if we do.
 191                 # OpenVPN does the same (gives dest_address for Legacy IP
 192                 # but not for IPv6).
 193                 # Only Solaris needs it; hence $ifconfig_syntax_ptpv6
 194                 ifconfig "$TUNDEV" inet6 $INTERNAL_IP6_NETMASK $ifconfig_syntax_ptpv6 mtu $MTU up
 195             fi
 196         fi
 197 }
 198
 199 destroy_tun_device() {
 200         case "$OS" in
 201         NetBSD|OpenBSD) # and probably others...
 202                 ifconfig "$TUNDEV" destroy
 203                 ;;
 204         FreeBSD)
 205                 ifconfig "$TUNDEV" destroy > /dev/null 2>&1 &
 206                 ;;
 207         esac
 208 }
 209
 210 # =========== route handling ====================================
 211
 212 if [ -n "$IPROUTE" ]; then
 213         fix_ip_get_output () {
 214                 sed -e 's/ /\n/g' | \
 215                     sed -ne '1p;/via/{N;p};/dev/{N;p};/src/{N;p};/mtu/{N;p}'
 216         }
 217
 218         set_vpngateway_route() {
 219                 $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output`
 220                 $IPROUTE route flush cache
 221         }
 222
 223         del_vpngateway_route() {
 224                 $IPROUTE route $route_syntax_del "$VPNGATEWAY"
 225                 $IPROUTE route flush cache
 226         }
 227
 228         set_default_route() {
 229                 $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
 230                 $IPROUTE route replace default dev "$TUNDEV"
 231                 $IPROUTE route flush cache
 232         }
 233
 234         set_network_route() {
 235                 NETWORK="$1"
 236                 NETMASK="$2"
 237                 NETMASKLEN="$3"
 238                 $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 239                 $IPROUTE route flush cache
 240         }
 241
 242         reset_default_route() {
 243                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 244                         $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"`
 245                         $IPROUTE route flush cache
 246                         rm -f -- "$DEFAULT_ROUTE_FILE"
 247                 fi
 248         }
 249
 250         del_network_route() {
 251                 NETWORK="$1"
 252                 NETMASK="$2"
 253                 NETMASKLEN="$3"
 254                 $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 255                 $IPROUTE route flush cache
 256         }
 257
 258         set_ipv6_default_route() {
 259                 # We don't save/restore IPv6 default route; just add a higher-priority one.
 260                 $IPROUTE -6 route add default dev "$TUNDEV" metric 1
 261                 $IPROUTE -6 route flush cache
 262         }
 263
 264         set_ipv6_network_route() {
 265                 NETWORK="$1"
 266                 NETMASKLEN="$2"
 267                 $IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 268                 $IPROUTE route flush cache
 269         }
 270
 271         reset_ipv6_default_route() {
 272                 $IPROUTE -6 route del default dev "$TUNDEV"
 273                 $IPROUTE route flush cache
 274         }
 275
 276         del_ipv6_network_route() {
 277                 NETWORK="$1"
 278                 NETMASKLEN="$2"
 279                 $IPROUTE -6 route del "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
 280                 $IPROUTE -6 route flush cache
 281         }
 282 else # use route command
 283         get_default_gw() {
 284                 # isn't -n supposed to give --numeric output?
 285                 # apperently not...
 286                 # Get rid of lines containing IPv6 addresses (':')
 287                 netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }'
 288         }
 289
 290         set_vpngateway_route() {
 291                 route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`"
 292         }
 293
 294         del_vpngateway_route() {
 295                 route $route_syntax_del -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`"
 296         }
 297
 298         set_default_route() {
 299                 DEFAULTGW="`get_default_gw`"
 300                 echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE"
 301                 route $route_syntax_del default $route_syntax_gw "$DEFAULTGW"
 302                 route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 303         }
 304
 305         set_network_route() {
 306                 NETWORK="$1"
 307                 NETMASK="$2"
 308                 NETMASKLEN="$3"
 309                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 310                 route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface
 311         }
 312
 313         reset_default_route() {
 314                 if [ -s "$DEFAULT_ROUTE_FILE" ]; then
 315                         route $route_syntax_del default $route_syntax_gw "`get_default_gw`" $route_syntax_interface
 316                         route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"`
 317                         rm -f -- "$DEFAULT_ROUTE_FILE"
 318                 fi
 319         }
 320
 321         del_network_route() {
 322                 case "$OS" in
 323                 Linux|NetBSD|OpenBSD|Darwin|SunOS) # and probably others...
 324                         # routes are deleted automatically on device shutdown
 325                         return
 326                         ;;
 327                 esac
 328                 NETWORK="$1"
 329                 NETMASK="$2"
 330                 NETMASKLEN="$3"
 331                 route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS"
 332         }
 333
 334         set_ipv6_default_route() {
 335                 route add -inet6 default "$INTERNAL_IP6_ADDRESS" $route_syntax_interface
 336         }
 337
 338         set_ipv6_network_route() {
 339                 NETWORK="$1"
 340                 NETMASK="$2"
 341                 route add -inet6 -net "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS" $route_syntax_interface
 342                 :
 343         }
 344
 345         reset_ipv6_default_route() {
 346                 route $route_syntax_del -inet6 default "$INTERNAL_IP6_ADDRESS"
 347                 :
 348         }
 349
 350         del_ipv6_network_route() {
 351                 NETWORK="$1"
 352                 NETMASK="$2"
 353                 route $route_syntax_del -inet6 "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS"
 354                 :
 355         }
 356
 357 fi
 358
 359 # =========== resolv.conf handling ====================================
 360
 361 # =========== resolv.conf handling for any OS =========================
 362
 363 modify_resolvconf_generic() {
 364         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP"
 365         NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc
 366 # and will be overwritten by vpnc
 367 # as long as the above mark is intact"
 368
 369         # Remember the original value of CISCO_DEF_DOMAIN we need it later
 370         CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN"
 371         # Don't step on INTERNAL_IP4_DNS value, use a temporary variable
 372         INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS"
 373         exec 6< "$RESOLV_CONF_BACKUP"
 374         while read LINE <&6 ; do
 375                 case "$LINE" in
 376                         nameserver*)
 377                                 if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then
 378                                         read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF
 379         $INTERNAL_IP4_DNS_TEMP
 380 EOF
 381                                         LINE="nameserver $ONE_NAMESERVER"
 382                                 else
 383                                         LINE=""
 384                                 fi
 385                                 ;;
 386                         search*)
 387                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 388                                         LINE="$LINE $CISCO_DEF_DOMAIN"
 389                                         CISCO_DEF_DOMAIN=""
 390                                 fi
 391                                 ;;
 392                         domain*)
 393                                 if [ -n "$CISCO_DEF_DOMAIN" ]; then
 394                                         LINE="domain $CISCO_DEF_DOMAIN"
 395                                         CISCO_DEF_DOMAIN=""
 396                                 fi
 397                                 ;;
 398                 esac
 399                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 400 $LINE"
 401         done
 402         exec 6<&-
 403
 404         for i in $INTERNAL_IP4_DNS_TEMP ; do
 405                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 406 nameserver $i"
 407         done
 408         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 409                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 410 search $CISCO_DEF_DOMAIN"
 411         fi
 412         echo "$NEW_RESOLVCONF" > /etc/resolv.conf
 413
 414         if [ "$OS" = "Darwin" ]; then
 415                 case "`uname -r`" in
 416                         # Skip for pre-10.4 systems
 417                         4.*|5.*|6.*|7.*)
 418                                 ;;
 419                         # 10.4 and later require use of scutil for DNS to work properly
 420                         *)
 421                                 OVERRIDE_PRIMARY=""
 422                                 if [ -n "$CISCO_SPLIT_INC" ]; then
 423                                         if [ $CISCO_SPLIT_INC -lt 1 ]; then
 424                                                 # Must override for correct default route
 425                                                 # Cannot use multiple DNS matching in this case
 426                                                 OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 427                                         fi
 428                                 fi
 429                                 # Uncomment the following if/fi pair to use multiple
 430                                 # DNS matching when available.  When multiple DNS matching
 431                                 # is present, anything reading the /etc/resolv.conf file
 432                                 # directly will probably not work as intended.
 433                                 #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then
 434                                         # Cannot use multiple DNS matching without a domain
 435                                         OVERRIDE_PRIMARY='d.add OverridePrimary # 1'
 436                                 #fi
 437                                 scutil >/dev/null 2>&1 <<-EOF
 438                                         open
 439                                         d.init
 440                                         d.add ServerAddresses * $INTERNAL_IP4_DNS
 441                                         set State:/Network/Service/$TUNDEV/DNS
 442                                         d.init
 443                                         # next line overrides the default gateway and breaks split routing
 444                                         # d.add Router $INTERNAL_IP4_ADDRESS
 445                                         d.add Addresses * $INTERNAL_IP4_ADDRESS
 446                                         d.add SubnetMasks * 255.255.255.255
 447                                         d.add InterfaceName $TUNDEV
 448                                         $OVERRIDE_PRIMARY
 449                                         set State:/Network/Service/$TUNDEV/IPv4
 450                                         close
 451                                 EOF
 452                                 if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then
 453                                         scutil >/dev/null 2>&1 <<-EOF
 454                                                 open
 455                                                 get State:/Network/Service/$TUNDEV/DNS
 456                                                 d.add DomainName $CISCO_DEF_DOMAIN_ORIG
 457                                                 d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG
 458                                                 d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG
 459                                                 set State:/Network/Service/$TUNDEV/DNS
 460                                                 close
 461                                         EOF
 462                                 fi
 463                                 ;;
 464                 esac
 465         fi
 466 }
 467
 468 restore_resolvconf_generic() {
 469         if [ ! -f "$RESOLV_CONF_BACKUP" ]; then
 470                 return
 471         fi
 472         grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf
 473         rm -f -- "$RESOLV_CONF_BACKUP"
 474
 475         if [ "$OS" = "Darwin" ]; then
 476                 case "`uname -r`" in
 477                         # Skip for pre-10.4 systems
 478                         4.*|5.*|6.*|7.*)
 479                                 ;;
 480                         # 10.4 and later require use of scutil for DNS to work properly
 481                         *)
 482                                 scutil >/dev/null 2>&1 <<-EOF
 483                                         open
 484                                         remove State:/Network/Service/$TUNDEV/IPv4
 485                                         remove State:/Network/Service/$TUNDEV/DNS
 486                                         close
 487                                 EOF
 488                                 ;;
 489                 esac
 490         fi
 491 }
 492 # === resolv.conf handling via /sbin/netconfig (Suse 11.1) =====================
 493
 494 # Suse provides a script that modifies resolv.conf. Use it because it will
 495 # restart/reload all other services that care about it (e.g. lwresd).  [unclear if this is still true, but probably --mlk]
 496
 497 modify_resolvconf_suse_netconfig()
 498 {
 499         /sbin/netconfig modify -s vpnc -i "$TUNDEV" <<-EOF
 500                 INTERFACE='$TUNDEV'
 501                 DNSSERVERS='$INTERNAL_IP4_DNS'
 502                 DNSDOMAIN='$CISCO_DEF_DOMAIN'
 503                 EOF
 504 }
 505 # Restore resolv.conf to old contents on Suse
 506 restore_resolvconf_suse_netconfig()
 507 {
 508         /sbin/netconfig remove -s vpnc -i "$TUNDEV"
 509 }
 510
 511 # === resolv.conf handling via /sbin/modify_resolvconf (Suse) =====================
 512
 513 # Suse provides a script that modifies resolv.conf. Use it because it will
 514 # restart/reload all other services that care about it (e.g. lwresd).
 515
 516 modify_resolvconf_suse()
 517 {
 518         FULL_SCRIPTNAME=`readlink -f $0`
 519         RESOLV_OPTS=''
 520         test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\""
 521         test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN"
 522         test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\"
 523 }
 524
 525 # Restore resolv.conf to old contents on Suse
 526 restore_resolvconf_suse()
 527 {
 528         FULL_SCRIPTNAME=`readlink -f $0`
 529         /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV
 530 }
 531
 532 # === resolv.conf handling via UCI (OpenWRT) =========
 533
 534 modify_resolvconf_openwrt() {
 535         add_dns $OPENWRT_INTERFACE $INTERNAL_IP4_DNS
 536 }
 537
 538 restore_resolvconf_openwrt() {
 539         remove_dns $OPENWRT_INTERFACE
 540 }
 541 # === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) =========
 542
 543 modify_resolvconf_manager() {
 544         NEW_RESOLVCONF=""
 545         for i in $INTERNAL_IP4_DNS; do
 546                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 547 nameserver $i"
 548         done
 549         if [ -n "$CISCO_DEF_DOMAIN" ]; then
 550                 NEW_RESOLVCONF="$NEW_RESOLVCONF
 551 domain $CISCO_DEF_DOMAIN"
 552         fi
 553         echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV
 554 }
 555
 556 restore_resolvconf_manager() {
 557         /sbin/resolvconf -d $TUNDEV
 558 }
 559
 560 # ========= Toplevel state handling  =======================================
 561
 562 kernel_is_2_6_or_above() {
 563         case `uname -r` in
 564                 1.*|2.[012345]*)
 565                         return 1
 566                         ;;
 567                 *)
 568                         return 0
 569                         ;;
 570         esac
 571 }
 572
 573 do_pre_init() {
 574         if [ "$OS" = "Linux" ]; then
 575                 if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then
 576                         :
 577                 else # can't open /dev/net/tun
 578                         test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null
 579                         # fix for broken devfs in kernel 2.6.x
 580                         if [ "`readlink /dev/net/tun`" = misc/net/tun \
 581                                 -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then
 582                                 ln -sf /dev/misc/net/tun /dev/net/tun
 583                         fi
 584                         # make sure tun device exists
 585                         if [ ! -e /dev/net/tun ]; then
 586                                 mkdir -p /dev/net
 587                                 mknod -m 0640 /dev/net/tun c 10 200
 588                                 [ -x /sbin/restorecon ] && /sbin/restorecon /dev/net/tun
 589                         fi
 590                         # workaround for a possible latency caused by udev, sleep max. 10s
 591                         if kernel_is_2_6_or_above ; then
 592                                 for x in `seq 100` ; do
 593                                         (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break;
 594                                         sleep 0.1
 595                                 done
 596                         fi
 597                 fi
 598         elif [ "$OS" = "FreeBSD" ]; then
 599                 if ! kldstat -q -m if_tun > /dev/null; then
 600                         kldload if_tun
 601                 fi
 602
 603                 if ! ifconfig $TUNDEV > /dev/null; then
 604                         ifconfig $TUNDEV create
 605                 fi
 606         elif [ "$OS" = "GNU/kFreeBSD" ]; then
 607                 if [ ! -e /dev/tun ]; then
 608                         kldload if_tun
 609                 fi
 610         elif [ "$OS" = "NetBSD" ]; then
 611                 :
 612         elif [ "$OS" = "OpenBSD" ]; then
 613                 if ! ifconfig $TUNDEV > /dev/null; then
 614                         ifconfig $TUNDEV create
 615                 fi
 616                 :
 617         elif [ "$OS" = "SunOS" ]; then
 618                 :
 619         elif [ "$OS" = "Darwin" ]; then
 620                 :
 621         fi
 622 }
 623
 624 do_connect() {
 625         if [ -n "$CISCO_BANNER" ]; then
 626                 echo "Connect Banner:"
 627                 echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done
 628                 echo
 629         fi
 630
 631         set_vpngateway_route
 632         do_ifconfig
 633         if [ -n "$CISCO_SPLIT_INC" ]; then
 634                 i=0
 635                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 636                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 637                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 638                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 639                         if [ $NETWORK != "0.0.0.0" ]; then
 640                                 set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 641                         else
 642                                 set_default_route
 643                         fi
 644                         i=`expr $i + 1`
 645                 done
 646                 for i in $INTERNAL_IP4_DNS ; do
 647                         echo "$i" | grep : >/dev/null || \
 648                                 set_network_route "$i" "255.255.255.255" "32"
 649                 done
 650         elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 651                 set_default_route
 652         fi
 653         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 654                 i=0
 655                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 656                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 657                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 658                         if [ $NETMASKLEN -lt 128 ]; then
 659                                 set_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 660                         else
 661                                 set_ipv6_default_route
 662                         fi
 663                         i=`expr $i + 1`
 664                 done
 665                 for i in $INTERNAL_IP4_DNS ; do
 666                         if echo "$i" | grep : >/dev/null; then
 667                                 set_ipv6_network_route "$i" "128"
 668                         fi
 669                 done
 670         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 671                 set_ipv6_default_route
 672         fi
 673
 674         if [ -n "$INTERNAL_IP4_DNS" ]; then
 675                 $MODIFYRESOLVCONF
 676         fi
 677 }
 678
 679 do_disconnect() {
 680         if [ -n "$CISCO_SPLIT_INC" ]; then
 681                 i=0
 682                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 683                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 684                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 685                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 686                         if [ $NETWORK != "0.0.0.0" ]; then
 687                                 # FIXME: This doesn't restore previously overwritten
 688                                 #        routes.
 689                                 del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
 690                         else
 691                                 reset_default_route
 692                         fi
 693                         i=`expr $i + 1`
 694                 done
 695                 for i in $INTERNAL_IP4_DNS ; do
 696                         del_network_route "$i" "255.255.255.255" "32"
 697                 done
 698         else
 699                 reset_default_route
 700         fi
 701         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 702                 i=0
 703                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 704                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 705                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 706                         if [ $NETMASKLEN -eq 0 ]; then
 707                                 reset_ipv6_default_route
 708                         else
 709                                 del_ipv6_network_route "$NETWORK" "$NETMASKLEN"
 710                         fi
 711                         i=`expr $i + 1`
 712                 done
 713                 for i in $INTERNAL_IP6_DNS ; do
 714                         del_ipv6_network_route "$i" "128"
 715                 done
 716         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 717                 reset_ipv6_default_route
 718         fi
 719
 720         del_vpngateway_route
 721
 722         if [ -n "$INTERNAL_IP4_DNS" ]; then
 723                 $RESTORERESOLVCONF
 724         fi
 725
 726
 727         if [ -n "$IPROUTE" ]; then
 728                 if [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 729                         $IPROUTE addr del "$INTERNAL_IP4_ADDRESS/255.255.255.255" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
 730                 fi
 731                 # If the netmask is provided, it contains the address _and_ netmask
 732                 if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
 733                         INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
 734                 fi
 735                 if [ -n "$INTERNAL_IP6_NETMASK" ]; then
 736                         $IPROUTE -6 addr del $INTERNAL_IP6_NETMASK dev $TUNDEV
 737                 fi
 738         else
 739                 if [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 740                         ifconfig "$TUNDEV" 0.0.0.0
 741                 fi
 742                 if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
 743                         INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
 744                 fi
 745                 if [ -n "$INTERNAL_IP6_NETMASK" ]; then
 746                         ifconfig "$TUNDEV" inet6 del $INTERNAL_IP6_NETMASK
 747                 fi
 748         fi
 749
 750         destroy_tun_device
 751 }
 752
 753 #### Main
 754
 755 if [ -z "$reason" ]; then
 756         echo "this script must be called from vpnc" 1>&2
 757         exit 1
 758 fi
 759
 760 case "$reason" in
 761         pre-init)
 762                 run_hooks pre-init
 763                 do_pre_init
 764                 ;;
 765         connect)
 766                 run_hooks connect
 767                 do_connect
 768                 run_hooks post-connect
 769                 ;;
 770         disconnect)
 771                 run_hooks disconnect
 772                 do_disconnect
 773                 run_hooks post-disconnect
 774                 ;;
 775         reconnect)
 776                 run_hooks reconnect
 777                 ;;
 778         *)
 779                 echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
 780                 exit 1
 781                 ;;
 782 esac
 783
 784 exit 0