Professional Documents
Culture Documents
/bin/sh
#
# Originally part of vpnc source code:
# © 2005-2012 Maurice Massar, Jörg Mayer, Antonio Borneo et al.
# © 2009-2022 David Woodhouse <dwmw2@infradead.org>, Daniel Lenski
<dlenski@gmail.com> et al.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
#
################
#
# List of parameters passed through environment
#* reason -- why this script was called, one of: pre-init
connect disconnect reconnect attempt-reconnect
#* VPNGATEWAY -- VPN gateway address (always present)
#* VPNPID -- PID of the process controlling the VPN
(OpenConnect v9.0+)
#* TUNDEV -- tunnel device (always present)
#* IDLE_TIMEOUT -- gateway's idle timeout in seconds (OpenConnect
v8.06+); unused
#* LOG_LEVEL -- log level; ERROR=0, INFO=1, DEBUG=2, TRACE=3
(OpenConnect v9.0+)
#* INTERNAL_IP4_ADDRESS -- address (always present)
#* INTERNAL_IP4_MTU -- MTU (often unset)
#* INTERNAL_IP4_NETMASK -- netmask (often unset)
#* INTERNAL_IP4_NETMASKLEN -- netmask length (often unset)
#* INTERNAL_IP4_NETADDR -- address of network (only present if netmask is
set)
#* INTERNAL_IP4_DNS -- list of DNS servers
#* INTERNAL_IP4_NBNS -- list of WINS servers
#* INTERNAL_IP6_ADDRESS -- IPv6 address
#* INTERNAL_IP6_NETMASK -- IPv6 netmask
#* INTERNAL_IP6_DNS -- IPv6 list of dns servers
#* CISCO_DEF_DOMAIN -- default domain name
#* CISCO_BANNER -- banner from server
#* CISCO_SPLIT_DNS -- DNS search domain list
#* CISCO_SPLIT_INC -- number of networks in split-network-list
#* CISCO_SPLIT_INC_%d_ADDR -- network address
#* CISCO_SPLIT_INC_%d_MASK -- subnet mask (for example: 255.255.255.0)
#* CISCO_SPLIT_INC_%d_MASKLEN -- subnet masklen (for example: 24)
#* CISCO_SPLIT_INC_%d_PROTOCOL -- protocol (often just 0); unused
#* CISCO_SPLIT_INC_%d_SPORT -- source port (often just 0); unused
#* CISCO_SPLIT_INC_%d_DPORT -- destination port (often just 0); unused
#* CISCO_IPV6_SPLIT_INC -- number of networks in IPv6 split-network-list
#* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address
#* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen
#
# The split tunnel variables above have *_EXC* counterparts for network
# addresses to be excluded from the VPN tunnel.
# FIXMEs:
PATH=/sbin:/usr/sbin:$PATH
OS="`uname -s`"
HOOKS_DIR=/etc/vpnc
DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute.${VPNPID}
DEFAULT_ROUTE_FILE_IPV6=/var/run/vpnc/defaultroute_ipv6.${VPNPID}
RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup.${VPNPID}
SCRIPTNAME=`basename $0`
# some systems, eg. Darwin & FreeBSD, prune /var/run on boot
if [ ! -d "/var/run/vpnc" ]; then
mkdir -p /var/run/vpnc
[ -x /sbin/restorecon ] && /sbin/restorecon /var/run/vpnc
fi
RESOLVEDENABLED=0
grep '^hosts' /etc/nsswitch.conf 2>/dev/null|grep resolve >/dev/null 2>&1
if [ $? = 0 ];then
command resolvectl status >/dev/null 2>&1 || command systemd-resolve --status
>/dev/null 2>&1
if [ $? = 0 ];then
RESOLVEDENABLED=1
fi
fi
run_hooks() {
HOOK="$1"
if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then
for script in ${HOOKS_DIR}/${HOOK}.d/* ; do
[ -f $script ] && . $script
done
fi
}
do_ifconfig() {
if [ -n "$INTERNAL_IP4_MTU" ]; then
MTU=$INTERNAL_IP4_MTU
elif [ -n "$IPROUTE" ]; then
MTUDEV=`$IPROUTE route get "$VPNGATEWAY" | sed -ne 's/^.*dev \([a-z0-
9]*\).*$/\1/p'`
MTU=`$IPROUTE link show "$MTUDEV" | sed -ne 's/^.*mtu \([[:digit:]]\
+\).*$/\1/p'`
if [ -n "$MTU" ]; then
MTU=`expr $MTU - 88`
fi
fi
if [ -z "$MTU" ]; then
MTU=1412
fi
if [ -n "$INTERNAL_IP4_NETMASK" ]; then
set_network_route "$INTERNAL_IP4_NETADDR" "$INTERNAL_IP4_NETMASK"
"$INTERNAL_IP4_NETMASKLEN" "$TUNDEV"
fi
set_vpngateway_route() {
# We'll attempt to add a host route to the gateway through every route
that matches
# its address (excluding those through TUNDEV because the goal is to
avoid loopback).
echo "$VPNGATEWAY" | grep -q : && FAMILY=-6 || FAMILY=-4
list_non_loopback_routes "$VPNGATEWAY" |
while read LINE ; do
# We do not want to use 'replace', since a route to the gateway
that already
# exists is mostly likely the correct one (e.g. the case of a
reconnect attempt
# after dead-peer detection, but no change in the underlying
network devices).
$IPROUTE $FAMILY route add `echo "$VPNGATEWAY $LINE" |
fix_ip_get_output` 2>/dev/null
done
$IPROUTE $FAMILY route flush cache 2>/dev/null
}
del_vpngateway_route() {
$IPROUTE route $route_syntax_del "$VPNGATEWAY"
$IPROUTE route flush cache 2>/dev/null
}
set_default_route() {
$IPROUTE route | grep '^default' | fix_ip_get_output >
"$DEFAULT_ROUTE_FILE"
$IPROUTE route replace default dev "$TUNDEV"
$IPROUTE route flush cache 2>/dev/null
}
set_network_route() {
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
NETDEV="$4"
NETGW="$5"
if [ -n "$NETGW" ]; then
$IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$NETDEV" via
"$NETGW"
else
$IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$NETDEV"
fi
$IPROUTE route flush cache 2>/dev/null
}
set_exclude_route() {
# add explicit route to keep current routing for this target
# (keep traffic separate from VPN tunnel)
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
list_non_loopback_routes "$NETWORK/$NETMASKLEN" |
while read LINE ; do
$IPROUTE $FAMILY route add `echo "$NETWORK/$NETMASKLEN $LINE" |
fix_ip_get_output` 2>/dev/null
done
$IPROUTE $FAMILY route flush cache 2>/dev/null
}
del_exclude_route() {
# FIXME: In theory, this could delete existing routes which are
# identical to split-exclude routes specified by VPNGATEWAY
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
$IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN"
$IPROUTE route flush cache 2>/dev/null
}
reset_default_route() {
if [ -s "$DEFAULT_ROUTE_FILE" ]; then
$IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"`
$IPROUTE route flush cache 2>/dev/null
rm -f -- "$DEFAULT_ROUTE_FILE"
fi
}
del_network_route() {
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
NETDEV="$4"
$IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$NETDEV"
$IPROUTE route flush cache 2>/dev/null
}
set_ipv6_default_route() {
# We don't save/restore IPv6 default route; just add a higher-priority
one.
$IPROUTE -6 route add default dev "$TUNDEV" metric 1
$IPROUTE -6 route flush cache 2>/dev/null
}
set_ipv6_network_route() {
NETWORK="$1"
NETMASKLEN="$2"
NETDEV="$3"
NETGW="$4"
if [ -n "$NETGW" ]; then
$IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$NETDEV"
via "$NETGW"
else
$IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$NETDEV"
fi
$IPROUTE -6 route flush cache 2>/dev/null
}
set_ipv6_exclude_route() {
NETWORK="$1"
NETMASKLEN="$2"
set_exclude_route "$NETWORK" nomask "$NETMASKLEN"
}
reset_ipv6_default_route() {
$IPROUTE -6 route del default dev "$TUNDEV"
$IPROUTE -6 route flush cache 2>/dev/null
}
del_ipv6_network_route() {
NETWORK="$1"
NETMASKLEN="$2"
NETDEV="$3"
$IPROUTE -6 route del "$NETWORK/$NETMASKLEN" dev "$NETDEV"
$IPROUTE -6 route flush cache 2>/dev/null
}
del_ipv6_exclude_route() {
# FIXME: In theory, this could delete existing routes which are
# identical to split-exclude routes specified by VPNGATEWAY
NETWORK="$1"
NETMASKLEN="$2"
$IPROUTE -6 route del "$NETWORK/$NETMASKLEN"
$IPROUTE -6 route flush cache 2>/dev/null
}
else # use route command
get_default_gw() {
# Intended behavior, starting with `netstat -r -n` output:
# - keep lines starting with 'default' or '0.0.0.0', but exclude bogus
routes '0.0.0.0/nn' where nn != 0
# - remove lines containing IPv6 addresses (':')
# - remove lines for link-local routes
(https://superuser.com/a/1067742)
# - remove lines containing $TUNDEV (we don't want loopback)
netstat -r -n | awk '/:/ { next; } /link#/ { next; }
/[[:space:]]'"$TUNDEV"'([[:space:]]|$)/ { next; } /^(default|
0\.0\.0\.0([[:space:]]|\/0))/ { print $2; exit; }'
}
set_vpngateway_route() {
# Unlike with iproute2, there is no way to determine which current
# route(s) match the VPN gateway, so we simply find a default
# route and use its gateway.
case "$VPNGATEWAY" in
*:*) route add $route_syntax_inet6_host "$VPNGATEWAY" $route_syntax_gw
"`get_ipv6_default_gw`";;
*) route add -host "$VPNGATEWAY" $route_syntax_gw
"`get_default_gw`";;
esac
}
del_vpngateway_route() {
case "$VPNGATEWAY" in
*:*) route $route_syntax_del $route_syntax_inet6_host "$VPNGATEWAY"
$route_syntax_gw "`get_ipv6_default_gw`";;
*) route $route_syntax_del -host "$VPNGATEWAY" $route_syntax_gw
"`get_default_gw`";;
esac
}
set_default_route() {
DEFAULTGW="`get_default_gw`"
echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE"
route $route_syntax_del default $route_syntax_gw "$DEFAULTGW"
route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS"
$route_syntax_interface
}
set_network_route() {
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
if [ -n "$5" ]; then
NETGW="$5"
else
NETGW="$INTERNAL_IP4_ADDRESS"
fi
route add -net "$NETWORK" $route_syntax_netmask "$NETMASK"
$route_syntax_gw "$NETGW" $route_syntax_interface
}
set_exclude_route() {
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
DEFAULTGW="${DEFAULTGW:-`get_default_gw`}"
if [ -z "$DEFAULTGW" ]; then
echo "cannot find route for exclude route $NETWORK/$NETMASKLEN,
ignoring" >&2
return
fi
# Add explicit route to keep traffic for this target separate
# from tunnel. FIXME: We use default gateway - this is our best
# guess in absence of "ip" command to query effective route.
route add -net "$NETWORK" $route_syntax_netmask "$NETMASK"
$route_syntax_gw "$DEFAULTGW" $route_syntax_interface
}
del_exclude_route() {
# FIXME: This can delete existing routes in case they're
# identical to split-exclude routes specified by VPNGATEWAY
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
route $route_syntax_del -net "$NETWORK" $route_syntax_netmask
"$NETMASK"
}
reset_default_route() {
if [ -s "$DEFAULT_ROUTE_FILE" ]; then
route $route_syntax_del default $route_syntax_gw
"`get_default_gw`" $route_syntax_interface
route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"`
rm -f -- "$DEFAULT_ROUTE_FILE"
fi
}
del_network_route() {
NETWORK="$1"
NETMASK="$2"
NETMASKLEN="$3"
if [ -n "$5" ]; then
NETGW="$5"
else
NETGW="$INTERNAL_IP4_ADDRESS"
fi
route $route_syntax_del -net "$NETWORK" $route_syntax_netmask
"$NETMASK" $route_syntax_gw "$NETGW"
}
get_ipv6_default_gw() {
# Intended behavior, starting with `netstat -r -n` IPv6 output:
# - keep lines starting with 'default' or '::'
# - append %$interface to link-local routes (fe80::/10)
# - remove lines for loopback interface (lo)
# - remove lines containing $TUNDEV (we don't want loopback)
# FIXME: is there a better way to exclude loopback routes than
filtering interface /^lo/?
netstat -r -n $netstat_syntax_ipv6 | awk '/^(default|::\/0)/ { if ($NF!
~/^lo/ && $NF!~/'"$TUNDEV"'([[:space:]]|$)/) { print ($2~/^fe[89ab]/ ? $2"%"$NF :
$2); } }'
}
set_ipv6_default_route() {
DEFAULTGW="`get_ipv6_default_gw`"
echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE_IPV6"
route $route_syntax_del $route_syntax_inet6 default $route_syntax_gw
"$DEFAULTGW"
route add $route_syntax_inet6 default $route_syntax_gw
"$INTERNAL_IP6_ADDRESS" $route_syntax_interface
}
set_ipv6_network_route() {
NETWORK="$1"
NETMASK="$2"
DEVICE="$3"
if [ -n "$4" ]; then
NETGW="$4"
elif [ "$OS" = "Linux" ]; then
route add $route_syntax_inet6_net "$NETWORK/$NETMASK" dev
"$DEVICE"
return
else
NETGW="$INTERNAL_IP6_ADDRESS"
fi
set_ipv6_exclude_route() {
NETWORK="$1"
NETMASK="$2"
IPV6DEFAULTGW="${IPV6DEFAULTGW:-`get_ipv6_default_gw`}"
if [ -z "$IPV6DEFAULTGW" ]; then
echo "cannot find route for exclude route $NETWORK/$NETMASKLEN,
ignoring" >&2
return
fi
# Add explicit route to keep traffic for this target separate
# from tunnel. FIXME: We use default gateway - this is our best
# guess in absence of "ip" command to query effective route.
route add $route_syntax_inet6_net "$NETWORK/$NETMASK" "$IPV6DEFAULTGW"
$route_syntax_interface
:
}
reset_ipv6_default_route() {
if [ -s "$DEFAULT_ROUTE_FILE_IPV6" ]; then
route $route_syntax_del $route_syntax_inet6 default
$route_syntax_gw "`get_ipv6_default_gw`" $route_syntax_interface
route add $route_syntax_inet6 default $route_syntax_gw `cat
"$DEFAULT_ROUTE_FILE_IPV6"`
rm -f -- "$DEFAULT_ROUTE_FILE_IPV6"
fi
:
}
del_ipv6_network_route() {
NETWORK="$1"
NETMASK="$2"
DEVICE="$3"
if [ -n "$4" ]; then
NETGW="$4"
elif [ "$OS" = "Linux" ]; then
route $route_syntax_del $route_syntax_inet6 "$NETWORK/$NETMASK"
dev "$DEVICE"
return
else
NETGW="$INTERNAL_IP6_ADDRESS"
fi
route $route_syntax_del $route_syntax_inet6 "$NETWORK/$NETMASK"
$route_syntax_gw "$NETGW"
:
}
del_ipv6_exclude_route() {
NETWORK="$1"
NETMASK="$2"
route $route_syntax_del $route_syntax_inet6 "$NETWORK/$NETMASK"
:
}
fi
modify_resolvconf_generic() {
grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp --
/etc/resolv.conf "$RESOLV_CONF_BACKUP"
NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc
# and will be overwritten by vpnc
# as long as the above mark is intact"
DOMAINS="$CISCO_DEF_DOMAIN"
for i in $INTERNAL_IP4_DNS ; do
NEW_RESOLVCONF="$NEW_RESOLVCONF
nameserver $i"
done
# note that "search" is mutually exclusive with "domain";
# "search" allows multiple domains to be listed, so use that
if [ -n "$DOMAINS" ]; then
NEW_RESOLVCONF="$NEW_RESOLVCONF
search $DOMAINS"
fi
echo "$NEW_RESOLVCONF" > /etc/resolv.conf
restore_resolvconf_generic() {
if [ ! -f "$RESOLV_CONF_BACKUP" ]; then
return
fi
grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat
"$RESOLV_CONF_BACKUP" > /etc/resolv.conf
rm -f -- "$RESOLV_CONF_BACKUP"
modify_resolvconf_suse_netconfig()
{
/sbin/netconfig modify -s vpnc -i "$TUNDEV" <<-EOF
INTERFACE='$TUNDEV'
DNSSERVERS='$INTERNAL_IP4_DNS'
DNSDOMAIN='$CISCO_DEF_DOMAIN'
EOF
}
# Restore resolv.conf to old contents on Suse
restore_resolvconf_suse_netconfig()
{
/sbin/netconfig remove -s vpnc -i "$TUNDEV"
}
modify_resolvconf_suse()
{
FULL_SCRIPTNAME=`readlink -f $0`
RESOLV_OPTS=''
test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\""
test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d
$CISCO_DEF_DOMAIN"
test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s vpnc -p
$SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created
by $SCRIPTNAME\"
}
modify_resolvconf_openwrt() {
add_dns $OPENWRT_INTERFACE $INTERNAL_IP4_DNS
}
restore_resolvconf_openwrt() {
remove_dns $OPENWRT_INTERFACE
}
# === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) =========
modify_resolvconf_manager() {
NEW_RESOLVCONF=""
for i in $INTERNAL_IP4_DNS; do
NEW_RESOLVCONF="$NEW_RESOLVCONF
nameserver $i"
done
if [ -n "$CISCO_DEF_DOMAIN" ]; then
NEW_RESOLVCONF="$NEW_RESOLVCONF
search $CISCO_DEF_DOMAIN"
fi
echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV
}
restore_resolvconf_manager() {
/sbin/resolvconf -d $TUNDEV
}
AF_INET=2
get_if_index() {
local link
link="$(ip link show dev "$1")" || return $?
echo ${link} | awk -F: '{print $1}'
}
busctl_call() {
local dest node
dest=org.freedesktop.resolve1
node=/org/freedesktop/resolve1
busctl call "$dest" "${node}" "${dest}.Manager" "$@"
}
busctl_set_nameservers() {
local if_index addresses args addr
if_index=$1
shift
addresses="$@"
args="$if_index $#"
for addr in ${addresses}; do
args="$args ${AF_INET} 4 $(echo $addr | sed 's/[.]/ /g')"
done
busctl_call SetLinkDNS 'ia(iay)' ${args}
}
resolvectl_set_nameservers() {
local if_index addresses
if_index=$1
shift
addresses="$@"
/usr/bin/resolvectl dns $if_index $addresses
}
busctl_set_search() {
local if_index domains args domain
if_index=$1
shift
domains="$@"
args="$if_index $#"
for domain in ${domains}; do
args="$args ${domain} false"
done
busctl_call SetLinkDomains 'ia(sb)' ${args}
}
resolvectl_set_search() {
local if_index domains
if_index=$1
shift
domains="$@"
/usr/bin/resolvectl domain $if_index $domains
}
modify_resolved_manager() {
local if_index split_dns_list
if_index=$(get_if_index $TUNDEV)
split_dns_list=$(echo $CISCO_SPLIT_DNS | tr ',' ' ')
resolvectl_set_nameservers $if_index $INTERNAL_IP4_DNS
if [ -n "$CISCO_DEF_DOMAIN" ] || [ -n "$split_dns_list" ]; then
resolvectl_set_search $if_index $CISCO_DEF_DOMAIN $split_dns_list
fi
}
modify_resolved_manager_old() {
local if_index
if_index=$(get_if_index $TUNDEV)
busctl_set_nameservers $if_index $INTERNAL_IP4_DNS
if [ -n "$CISCO_DEF_DOMAIN" ]; then
busctl_set_search $if_index $CISCO_DEF_DOMAIN
fi
}
restore_resolved_manager() {
local if_index
if_index=$(get_if_index $TUNDEV)
/usr/bin/resolvectl revert $if_index
}
restore_resolved_manager_old() {
local if_index
if_index=$(get_if_index $TUNDEV)
busctl_call RevertLink 'i' $if_index
}
modify_resolvconf_unbound() {
if [ -n "$CISCO_DEF_DOMAIN" ]; then
/usr/sbin/unbound-control forward_add +i ${CISCO_DEF_DOMAIN} $
{INTERNAL_IP4_DNS}
/usr/sbin/unbound-control flush_requestlist
/usr/sbin/unbound-control flush_zone ${CISCO_DEF_DOMAIN}
fi
}
restore_resolvconf_unbound() {
if [ -n "$CISCO_DEF_DOMAIN" ]; then
/usr/sbin/unbound-control forward_remove +i ${CISCO_DEF_DOMAIN}
/usr/sbin/unbound-control flush_zone ${CISCO_DEF_DOMAIN}
/usr/sbin/unbound-control flush_requestlist
fi
}
modify_resolvconf_resolvd() {
/sbin/route nameserver $TUNDEV $INTERNAL_IP4_DNS $INTERNAL_IP6_DNS
}
restore_resolvconf_resolvd() {
/sbin/route nameserver $TUNDEV
}
# ========= Toplevel state handling =======================================
do_pre_init() {
if [ "$OS" = "Linux" ]; then
if (exec 6< /dev/net/tun) > /dev/null 2>&1 ; then
:
else # can't open /dev/net/tun
test -e /proc/sys/kernel/modprobe && `cat
/proc/sys/kernel/modprobe` tun 2>/dev/null
# make sure tun device exists
if [ ! -e /dev/net/tun ]; then
mkdir -p /dev/net
mknod -m 0640 /dev/net/tun c 10 200
[ -x /sbin/restorecon ] && /sbin/restorecon /dev/net/tun
fi
# workaround for a possible latency caused by udev, sleep max.
10s
for x in $(seq 100) ; do
(exec 6<> /dev/net/tun) > /dev/null 2>&1 && break;
sleep 0.1
done
fi
elif [ "$OS" = "FreeBSD" -o "$OS" = "DragonFly" ]; then
if ! ifconfig $TUNDEV > /dev/null; then
ifconfig $TUNDEV create
fi
elif [ "$OS" = "GNU/kFreeBSD" ]; then
if [ ! -e /dev/tun ]; then
kldload if_tun
fi
elif [ "$OS" = "NetBSD" ]; then
:
elif [ "$OS" = "OpenBSD" ]; then
if ! ifconfig $TUNDEV > /dev/null; then
ifconfig $TUNDEV create
fi
:
elif [ "$OS" = "SunOS" ]; then
:
elif [ "$OS" = "Darwin" ]; then
:
fi
}
do_connect() {
if [ -n "$CISCO_BANNER" ]; then
echo "Connect Banner:"
echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done
echo
fi
case "$VPNGATEWAY" in
127.*|::1) ;; # localhost (probably proxy)
*) set_vpngateway_route ;;
esac
do_ifconfig
if [ -n "$CISCO_SPLIT_EXC" ]; then
i=0
while [ $i -lt $CISCO_SPLIT_EXC ] ; do
eval NETWORK="\${CISCO_SPLIT_EXC_${i}_ADDR}"
eval NETMASK="\${CISCO_SPLIT_EXC_${i}_MASK}"
eval NETMASKLEN="\${CISCO_SPLIT_EXC_${i}_MASKLEN}"
case "$NETWORK" in
0.*|127.*|169.254.*) echo "ignoring non-forwardable exclude
route $NETWORK/$NETMASKLEN" >&2 ;;
*) set_exclude_route "$NETWORK" "$NETMASK" "$NETMASKLEN" ;;
esac
i=`expr $i + 1`
done
fi
if [ -n "$CISCO_IPV6_SPLIT_EXC" ]; then
# untested
i=0
while [ $i -lt $CISCO_IPV6_SPLIT_EXC ] ; do
eval NETWORK="\${CISCO_IPV6_SPLIT_EXC_${i}_ADDR}"
eval NETMASKLEN="\${CISCO_IPV6_SPLIT_EXC_${i}_MASKLEN}"
set_ipv6_exclude_route "$NETWORK" "$NETMASKLEN"
i=`expr $i + 1`
done
fi
if [ -n "$CISCO_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
if [ "$NETWORK" != "0.0.0.0" ]; then
set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
"$TUNDEV"
else
set_default_route
fi
i=`expr $i + 1`
done
elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
set_default_route
fi
if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
if [ $NETMASKLEN -eq 0 ]; then
set_ipv6_default_route
else
set_ipv6_network_route "$NETWORK" "$NETMASKLEN" "$TUNDEV"
fi
i=`expr $i + 1`
done
elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
set_ipv6_default_route
fi
if [ -n "$INTERNAL_IP4_DNS" ]; then
$MODIFYRESOLVCONF
fi
}
do_disconnect() {
if [ -n "$CISCO_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
if [ "$NETWORK" != "0.0.0.0" ]; then
# FIXME: This doesn't restore previously overwritten
# routes.
del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
"$TUNDEV"
else
reset_default_route
fi
i=`expr $i + 1`
done
else
reset_default_route
fi
if [ -n "$CISCO_SPLIT_EXC" ]; then
i=0
while [ $i -lt $CISCO_SPLIT_EXC ] ; do
eval NETWORK="\${CISCO_SPLIT_EXC_${i}_ADDR}"
eval NETMASK="\${CISCO_SPLIT_EXC_${i}_MASK}"
eval NETMASKLEN="\${CISCO_SPLIT_EXC_${i}_MASKLEN}"
case "$NETWORK" in
0.*|127.*|169.254.*) ;; # ignoring non-forwardable exclude
route
*) del_exclude_route "$NETWORK" "$NETMASK" "$NETMASKLEN" ;;
esac
i=`expr $i + 1`
done
fi
if [ -n "$CISCO_IPV6_SPLIT_EXC" ]; then
# untested
i=0
while [ $i -lt $CISCO_IPV6_SPLIT_EXC ] ; do
eval NETWORK="\${CISCO_IPV6_SPLIT_EXC_${i}_ADDR}"
eval NETMASKLEN="\${CISCO_IPV6_SPLIT_EXC_${i}_MASKLEN}"
del_ipv6_exclude_route "$NETWORK" "$NETMASKLEN"
i=`expr $i + 1`
done
fi
if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
if [ $NETMASKLEN -eq 0 ]; then
reset_ipv6_default_route
else
del_ipv6_network_route "$NETWORK" "$NETMASKLEN" "$TUNDEV"
fi
i=`expr $i + 1`
done
elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
reset_ipv6_default_route
fi
del_vpngateway_route
if [ -n "$INTERNAL_IP4_DNS" ]; then
$RESTORERESOLVCONF
fi
if [ -n "$IPROUTE" ]; then
if [ -n "$INTERNAL_IP4_ADDRESS" ]; then
$IPROUTE addr del "$INTERNAL_IP4_ADDRESS/255.255.255.255" peer
"$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
fi
# If the netmask is provided, it contains the address _and_ netmask
if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ];
then
INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
fi
if [ -n "$INTERNAL_IP6_NETMASK" ]; then
$IPROUTE -6 addr del $INTERNAL_IP6_NETMASK dev $TUNDEV
fi
$IPROUTE link set dev "$TUNDEV" down
else
if [ -n "$INTERNAL_IP4_ADDRESS" ]; then
ifconfig "$TUNDEV" `ifconfig_syntax_del "$INTERNAL_IP4_ADDRESS"`
fi
if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ];
then
INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
fi
if [ -n "$INTERNAL_IP6_NETMASK" ]; then
ifconfig "$TUNDEV" `ifconfig_syntax_del "$INTERNAL_IP6_NETMASK"`
fi
ifconfig "$TUNDEV" down
fi
case "$OS" in
NetBSD|OpenBSD) # and probably others...
ifconfig "$TUNDEV" destroy
;;
FreeBSD|DragonFly)
ifconfig "$TUNDEV" destroy > /dev/null 2>&1 &
;;
esac
}
do_attempt_reconnect() {
set_vpngateway_route
}
#### Main
if [ -z "$reason" ]; then
echo "this script must be called from vpnc" 1>&2
exit 1
fi
case "$reason" in
pre-init)
run_hooks pre-init
do_pre_init
;;
connect)
run_hooks connect
do_connect
run_hooks post-connect
;;
disconnect)
run_hooks disconnect
do_disconnect
run_hooks post-disconnect
;;
attempt-reconnect)
# Invoked before each attempt to re-establish the session.
# If the underlying physical connection changed, we might
# be left with a route to the VPN server through the VPN
# itself, which would need to be fixed.
run_hooks attempt-reconnect
do_attempt_reconnect
run_hooks post-attempt-reconnect
;;
reconnect)
# After successfully re-establishing the session.
run_hooks reconnect
;;
*)
echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
exit 1
;;
esac
exit 0