net/openconnect/files/vpnc-script

   1 #!/bin/sh
   2 # List of parameters passed through environment
   3 #* reason                       -- why this script was called, one of: pre-init connect disconnect
   4 #* VPNGATEWAY                   -- vpn gateway address (always present)
   5 #* TUNDEV                       -- tunnel device (always present)
   6 #* INTERNAL_IP4_ADDRESS         -- address (always present)
   7 #* INTERNAL_IP4_MTU             -- mtu (often unset)
   8 #* INTERNAL_IP4_NETMASK         -- netmask (often unset)
   9 #* INTERNAL_IP4_NETMASKLEN      -- netmask length (often unset)
  10 #* INTERNAL_IP4_NETADDR         -- address of network (only present if netmask is set)
  11 #* INTERNAL_IP4_DNS             -- list of dns servers
  12 #* INTERNAL_IP4_NBNS            -- list of wins servers
  13 #* INTERNAL_IP6_ADDRESS         -- IPv6 address
  14 #* INTERNAL_IP6_NETMASK         -- IPv6 netmask
  15 #* INTERNAL_IP6_DNS             -- IPv6 list of dns servers
  16 #* CISCO_DEF_DOMAIN             -- default domain name
  17 #* CISCO_BANNER                 -- banner from server
  18 #* CISCO_SPLIT_INC              -- number of networks in split-network-list
  19 #* CISCO_SPLIT_INC_%d_ADDR      -- network address
  20 #* CISCO_SPLIT_INC_%d_MASK      -- subnet mask (for example: 255.255.255.0)
  21 #* CISCO_SPLIT_INC_%d_MASKLEN   -- subnet masklen (for example: 24)
  22 #* CISCO_SPLIT_INC_%d_PROTOCOL  -- protocol (often just 0)
  23 #* CISCO_SPLIT_INC_%d_SPORT     -- source port (often just 0)
  24 #* CISCO_SPLIT_INC_%d_DPORT     -- destination port (often just 0)
  25 #* CISCO_IPV6_SPLIT_INC         -- number of networks in IPv6 split-network-list
  26 #* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address
  27 #* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen
  28
  29 HOOKS_DIR=/etc/openconnect
  30
  31 # FIXMEs:
  32
  33 # Section A: route handling
  34
  35 # 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored
  36 #   In order to use them, we'll probably need os specific solutions
  37 #   * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV
  38 #       This would be an *alternative* to changing the routes (and thus 2) and 3)
  39 #       shouldn't be relevant at all)
  40 # 2) There are two different functions to set routes: generic routes and the
  41 #   default route. Why isn't the defaultroute handled via the generic route case?
  42 # 3) In the split tunnel case, all routes but the default route might get replaced
  43 #   without getting restored later. We should explicitely check and save them just
  44 #   like the defaultroute
  45 # 4) Replies to a dhcp-server should never be sent into the tunnel
  46
  47 # Section B: Split DNS handling
  48
  49 # 1) We parse CISCO_SPLIT_DNS and use dnsmasq to set it
  50
  51 do_connect() {
  52         if [ -n "$CISCO_BANNER" ]; then
  53                 logger -t openconnect "Connect Banner:"
  54                 echo "$CISCO_BANNER" | while read LINE ; do logger -t openconnect "|" "$LINE" ; done
  55         fi
  56
  57         proto_init_update "$TUNDEV" 1
  58
  59         if [ -n "$INTERNAL_IP4_MTU" ]; then
  60                 MTU=$INTERNAL_IP4_MTU
  61         fi
  62
  63         if [ -z "$MTU" ]; then
  64                 MTU=1412
  65         fi
  66
  67         proto_add_ipv4_address "$INTERNAL_IP4_ADDRESS" 32 "" "$INTERNAL_IP4_ADDRESS"
  68
  69         if [ -n "$INTERNAL_IP4_NETMASKLEN" ]; then
  70                 proto_add_ipv4_route "$INTERNAL_IP4_NETADDR" "$INTERNAL_IP4_NETMASKLEN"
  71         fi
  72
  73         # If the netmask is provided, it contains the address _and_ netmask
  74         if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
  75             INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
  76         fi
  77
  78         if [ -n "$INTERNAL_IP6_NETMASK" ]; then
  79                 addr="${INTERNAL_IP6_NETMASK%%/*}"
  80                 mask="${INTERNAL_IP6_NETMASK##*/}"
  81                 [[ "$addr" != "$mask" ]] && proto_add_ipv6_address "$addr" "$mask"
  82         fi
  83
  84         if [ -n "$CISCO_SPLIT_DNS" ] && [ -d "/tmp/dnsmasq.d/" ];then
  85                 SDNS=`echo $CISCO_SPLIT_DNS|sed 's/,/\n/g'`
  86                 DNSMASQ_FILE="/tmp/dnsmasq.d/openconnect.$TUNDEV"
  87                 rm -f $DNSMASQ_FILE
  88                 echo "$SDNS" | while read i; do
  89                         if [ -n "$INTERNAL_IP4_DNS" ];then
  90                                 echo "server=/$i/$INTERNAL_IP4_DNS" >> $DNSMASQ_FILE
  91                         fi
  92                         if [ -n "$INTERNAL_IP6_DNS" ];then
  93                                 echo "server=/$i/$INTERNAL_IP6_DNS" >> $DNSMASQ_FILE
  94                         fi
  95                         echo "rebind-domain-ok=$i" >> $DNSMASQ_FILE
  96                 done
  97                 /etc/init.d/dnsmasq restart
  98         else
  99                 [ -n "$INTERNAL_IP4_DNS" ] && proto_add_dns_server "$INTERNAL_IP4_DNS"
 100                 [ -n "$CISCO_DEF_DOMAIN" ] && proto_add_dns_search "$CISCO_DEF_DOMAIN"
 101         fi
 102
 103         if [ -n "$CISCO_SPLIT_INC" ]; then
 104                 i=0
 105                 while [ $i -lt $CISCO_SPLIT_INC ] ; do
 106                         eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
 107                         eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
 108                         eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
 109                         if [ $NETWORK != "0.0.0.0" ]; then
 110                                 proto_add_ipv4_route "$NETWORK" "$NETMASKLEN"
 111                         else
 112                                 proto_add_ipv4_route "0.0.0.0" 0
 113                         fi
 114                         i=$(($i + 1))
 115                 done
 116         elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
 117                 proto_add_ipv4_route "0.0.0.0" 0
 118         fi
 119         if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
 120                 i=0
 121                 while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
 122                         eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
 123                         eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
 124                         if [ $NETMASKLEN -lt 128 ]; then
 125                                 proto_add_ipv6_route "$NETWORK" "$NETMASKLEN"
 126                         else
 127                                 proto_add_ipv6_route "::0" 0
 128                         fi
 129                         i=$(($i + 1))
 130                 done
 131         elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
 132                 proto_add_ipv6_route "::0" 0
 133         fi
 134         proto_send_update "$INTERFACE"
 135 }
 136
 137 do_disconnect() {
 138         rm -f "/tmp/dnsmasq.d/openconnect.$TUNDEV"
 139         proto_init_update "$TUNDEV" 0
 140         proto_send_update "$INTERFACE"
 141 }
 142
 143 #### Hooks
 144 run_hooks() {
 145         HOOK="$1"
 146
 147         if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then
 148                 for script in ${HOOKS_DIR}/${HOOK}.d/* ; do
 149                         [ -f $script ] && . $script
 150                 done
 151         fi
 152 }
 153
 154 #### Main
 155
 156 if [ -z "$reason" ]; then
 157         logger -t openconnect "this script must be called from vpnc" 1>&2
 158         exit 1
 159 fi
 160 if [ -z "$INTERFACE" ]; then
 161         logger -t openconnect "this script must be called for an active interface"
 162         exit 1
 163 fi
 164
 165 . /lib/netifd/netifd-proto.sh
 166
 167 case "$reason" in
 168         pre-init)
 169                 run_hooks pre-init
 170                 ;;
 171         connect)
 172                 run_hooks connect
 173                 do_connect
 174                 run_hooks post-connect
 175                 ;;
 176         disconnect)
 177                 run_hooks disconnect
 178                 do_disconnect
 179                 run_hooks post-disconnect
 180                 ;;
 181         reconnect)
 182                 run_hooks reconnect
 183                 ;;
 184         *)
 185                 logger -t openconnect "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
 186                 exit 1
 187                 ;;
 188 esac
 189
 190 exit 0