blob: 772c4a45a1ba14b6ebae96de6a11ad551a2f8a02 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
|
#!/bin/sh
# List of parameters passed through environment
#* reason -- why this script was called, one of: pre-init connect disconnect
#* VPNGATEWAY -- vpn gateway address (always present)
#* TUNDEV -- tunnel device (always present)
#* INTERNAL_IP4_ADDRESS -- address (always present)
#* INTERNAL_IP4_MTU -- mtu (often unset)
#* INTERNAL_IP4_NETMASK -- netmask (often unset)
#* INTERNAL_IP4_NETMASKLEN -- netmask length (often unset)
#* INTERNAL_IP4_NETADDR -- address of network (only present if netmask is set)
#* INTERNAL_IP4_DNS -- list of dns servers
#* INTERNAL_IP4_NBNS -- list of wins servers
#* INTERNAL_IP6_ADDRESS -- IPv6 address
#* INTERNAL_IP6_NETMASK -- IPv6 netmask
#* INTERNAL_IP6_DNS -- IPv6 list of dns servers
#* CISCO_DEF_DOMAIN -- default domain name
#* CISCO_BANNER -- banner from server
#* CISCO_SPLIT_INC -- number of networks in split-network-list
#* CISCO_SPLIT_INC_%d_ADDR -- network address
#* CISCO_SPLIT_INC_%d_MASK -- subnet mask (for example: 255.255.255.0)
#* CISCO_SPLIT_INC_%d_MASKLEN -- subnet masklen (for example: 24)
#* CISCO_SPLIT_INC_%d_PROTOCOL -- protocol (often just 0)
#* CISCO_SPLIT_INC_%d_SPORT -- source port (often just 0)
#* CISCO_SPLIT_INC_%d_DPORT -- destination port (often just 0)
#* CISCO_IPV6_SPLIT_INC -- number of networks in IPv6 split-network-list
#* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address
#* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen
HOOKS_DIR=/etc/openconnect
# FIXMEs:
# Section A: route handling
# 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored
# In order to use them, we'll probably need os specific solutions
# * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV
# This would be an *alternative* to changing the routes (and thus 2) and 3)
# shouldn't be relevant at all)
# 2) There are two different functions to set routes: generic routes and the
# default route. Why isn't the defaultroute handled via the generic route case?
# 3) In the split tunnel case, all routes but the default route might get replaced
# without getting restored later. We should explicitely check and save them just
# like the defaultroute
# 4) Replies to a dhcp-server should never be sent into the tunnel
# Section B: Split DNS handling
# 1) We parse CISCO_SPLIT_DNS and use dnsmasq to set it
do_connect() {
if [ -n "$CISCO_BANNER" ]; then
logger -t openconnect "Connect Banner:"
echo "$CISCO_BANNER" | while read LINE ; do logger -t openconnect "|" "$LINE" ; done
fi
proto_init_update "$TUNDEV" 1
if [ -n "$INTERNAL_IP4_MTU" ]; then
MTU=$INTERNAL_IP4_MTU
fi
if [ -z "$MTU" ]; then
MTU=1412
fi
proto_add_ipv4_address "$INTERNAL_IP4_ADDRESS" 32 "" "$INTERNAL_IP4_ADDRESS"
if [ -n "$INTERNAL_IP4_NETMASKLEN" ]; then
proto_add_ipv4_route "$INTERNAL_IP4_NETADDR" "$INTERNAL_IP4_NETMASKLEN"
fi
# If the netmask is provided, it contains the address _and_ netmask
if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then
INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128"
fi
if [ -n "$INTERNAL_IP6_NETMASK" ]; then
addr="${INTERNAL_IP6_NETMASK%%/*}"
mask="${INTERNAL_IP6_NETMASK##*/}"
[[ "$addr" != "$mask" ]] && proto_add_ipv6_address "$addr" "$mask"
fi
DNSMASQ_FILE="/tmp/dnsmasq.d/openconnect.$TUNDEV"
LOCAL_DOMAIN=$(uci get dhcp.@dnsmasq[0].domain)
rm -f $DNSMASQ_FILE
if [ -n "$CISCO_SPLIT_DNS" ] && [ -d "/tmp/dnsmasq.d/" ];then
SDNS=`echo $CISCO_SPLIT_DNS|sed 's/,/\n/g'`
echo "$SDNS" | while read i; do
if [ "$i" = "$LOCAL_DOMAIN" ];then
continue
fi
if [ -n "$INTERNAL_IP4_DNS" ];then
for dns in $INTERNAL_IP4_DNS;do
echo "server=/$i/$dns" >> $DNSMASQ_FILE
done
fi
if [ -n "$INTERNAL_IP6_DNS" ];then
for dns in $INTERNAL_IP6_DNS;do
echo "server=/$i/$dns" >> $DNSMASQ_FILE
done
fi
echo "rebind-domain-ok=$i" >> $DNSMASQ_FILE
done
/etc/init.d/dnsmasq restart
else
if [ -n "$INTERNAL_IP4_DNS" ];then
for dns in $INTERNAL_IP4_DNS;do
proto_add_dns_server "$dns"
done
fi
if [ -n "$INTERNAL_IP6_DNS" ];then
for dns in $INTERNAL_IP6_DNS;do
proto_add_dns_server "$dns"
done
fi
if [ -n "$CISCO_DEF_DOMAIN" ] && [ "$CISCO_DEF_DOMAIN" != "$LOCAL_DOMAIN" ];then
if [ -n "$INTERNAL_IP4_DNS" ];then
for dns in $INTERNAL_IP4_DNS;do
echo "server=/$CISCO_DEF_DOMAIN/$dns" >> $DNSMASQ_FILE
done
fi
if [ -n "$INTERNAL_IP6_DNS" ];then
for dns in $INTERNAL_IP6_DNS;do
echo "server=/$CISCO_DEF_DOMAIN/$dns" >> $DNSMASQ_FILE
done
fi
proto_add_dns_search "$CISCO_DEF_DOMAIN"
fi
fi
if [ -n "$CISCO_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
if [ $NETWORK != "0.0.0.0" ]; then
proto_add_ipv4_route "$NETWORK" "$NETMASKLEN"
else
proto_add_ipv4_route "0.0.0.0" 0
fi
i=$(($i + 1))
done
elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then
proto_add_ipv4_route "0.0.0.0" 0
fi
if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then
i=0
while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do
eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}"
eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}"
if [ $NETMASKLEN -lt 128 ]; then
proto_add_ipv6_route "$NETWORK" "$NETMASKLEN"
else
proto_add_ipv6_route "::0" 0
fi
i=$(($i + 1))
done
elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then
proto_add_ipv6_route "::0" 0
fi
proto_send_update "$INTERFACE"
}
do_disconnect() {
if [ -f "/tmp/dnsmasq.d/openconnect.$TUNDEV" ]; then
rm -f "/tmp/dnsmasq.d/openconnect.$TUNDEV"
/etc/init.d/dnsmasq restart
fi
proto_init_update "$TUNDEV" 0
proto_send_update "$INTERFACE"
}
#### Hooks
run_hooks() {
HOOK="$1"
if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then
for script in ${HOOKS_DIR}/${HOOK}.d/* ; do
[ -f $script ] && . $script
done
fi
}
#### Main
if [ -z "$reason" ]; then
logger -t openconnect "this script must be called from vpnc" 1>&2
exit 1
fi
if [ -z "$INTERFACE" ]; then
logger -t openconnect "this script must be called for an active interface"
exit 1
fi
. /lib/netifd/netifd-proto.sh
case "$reason" in
pre-init)
run_hooks pre-init
;;
connect)
run_hooks connect
do_connect
run_hooks post-connect
;;
disconnect)
run_hooks disconnect
do_disconnect
run_hooks post-disconnect
;;
reconnect)
run_hooks reconnect
;;
attempt-reconnect)
run_hooks attempt-reconnect
;;
*)
logger -t openconnect "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
exit 1
;;
esac
exit 0
|