Hello community, here is the log from the commit of package vpnc for openSUSE:Factory checked in at 2012-02-08 17:21:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/vpnc (Old) and /work/SRC/openSUSE:Factory/.vpnc.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "vpnc", Maintainer is "[email protected]" Changes: -------- --- /work/SRC/openSUSE:Factory/vpnc/vpnc.changes 2012-01-05 13:50:18.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.vpnc.new/vpnc.changes 2012-02-08 17:21:30.000000000 +0100 @@ -1,0 +2,7 @@ +Sat Jan 14 23:35:02 UTC 2012 - [email protected] + +- update to rev 512 of nortel branch + - mostly fixes to vpnc-script and typos / compiler warnings + - obsoletes "bugfix.diff" + +------------------------------------------------------------------- Old: ---- bugfix.diff vpnc-0.5.3r481.tar.bz2 New: ---- vpnc-0.5.3r512.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ vpnc.spec ++++++ --- /var/tmp/diff_new_pack.ljLtvj/_old 2012-02-08 17:21:31.000000000 +0100 +++ /var/tmp/diff_new_pack.ljLtvj/_new 2012-02-08 17:21:31.000000000 +0100 @@ -15,12 +15,13 @@ # Please submit bugfixes or comments via http://bugs.opensuse.org/ # + Name: vpnc BuildRequires: gnutls BuildRequires: libgcrypt-devel BuildRequires: libgnutls-devel BuildRequires: pkg-config -Version: 0.5.3r481 +Version: 0.5.3r512 Release: 0 Summary: A Client for Cisco VPN concentrator License: GPL-2.0+ @@ -30,7 +31,6 @@ Source: %{name}-%{version}.tar.bz2 # only for checkin warnings... Source1: checkout_svn.sh -Patch0: bugfix.diff Patch1: vpnc-no-build-dates.patch Patch2: work-with-netconfig.patch # most ugly hack ever @@ -61,7 +61,6 @@ %prep %setup -n %{name} -%patch0 -p0 %patch1 #Patch is not yet working :-( #patch2 -p0 ++++++ vpnc-0.5.3r481.tar.bz2 -> vpnc-0.5.3r512.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/Makefile new/vpnc/Makefile --- old/vpnc/Makefile 2009-09-12 19:10:32.000000000 +0200 +++ new/vpnc/Makefile 2012-01-14 08:54:24.000000000 +0100 @@ -17,7 +17,7 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# $Id: Makefile 444 2009-09-12 17:10:32Z Antonio Borneo $ +# $Id: Makefile 483 2012-01-14 07:54:24Z Antonio Borneo $ DESTDIR= PREFIX=/usr/local @@ -76,7 +76,7 @@ CFLAGS += -fstrict-aliasing -freorder-blocks -fsched-interblock endif -all : $(BINS) vpnc.8 vpnc-script +all : $(BINS) vpnc.8 vpnc : $(OBJS) vpnc.o $(CC) -o $@ $^ $(LDFLAGS) @@ -84,9 +84,6 @@ vpnc.8 : vpnc.8.template makeman.pl vpnc ./makeman.pl -vpnc-script : vpnc-script.in - sed -e 's,@''PREFIX''@,$(PREFIX),g' $< > $@ && chmod 755 $@ - cisco-decrypt : cisco-decrypt.o decrypt-utils.o $(CC) -o $@ $^ $(LDFLAGS) @@ -126,7 +123,7 @@ -rm -f $(OBJS) $(BINOBJS) $(BINS) tags distclean : clean - -rm -f vpnc-debug.c vpnc-debug.h vpnc.ps vpnc.8 .depend vpnc-script + -rm -f vpnc-debug.c vpnc-debug.h vpnc.ps vpnc.8 .depend install-common: all install -d $(DESTDIR)$(ETCDIR) $(DESTDIR)$(BINDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(MANDIR)/man1 $(DESTDIR)$(MANDIR)/man8 $(DESTDIR)$(DOCDIR) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/config.c new/vpnc/config.c --- old/vpnc/config.c 2011-11-20 07:02:04.000000000 +0100 +++ new/vpnc/config.c 2012-01-14 08:57:51.000000000 +0100 @@ -15,7 +15,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - $Id: config.c 474 2011-11-20 06:02:04Z Antonio Borneo $ + $Id: config.c 511 2012-01-14 07:57:51Z Antonio Borneo $ */ #define _GNU_SOURCE @@ -323,7 +323,7 @@ "Script ", "<command>", "command is executed using system() to configure the interface,\n" - "routing and so on. Device name, IP, etc. are passed using enviroment\n" + "routing and so on. Device name, IP, etc. are passed using environment\n" "variables, see README. This script is executed right after ISAKMP is\n" "done, but before tunneling is enabled. It is called when vpnc\n" "terminates, too\n", @@ -388,6 +388,13 @@ " * tap: virtual ethernet interface\n", config_def_if_mode }, { + CONFIG_IF_MTU, 1, 1, + "--ifmtu", + "Interface MTU ", + "<0-65535>", + "Set MTU for TUN/TAP interface (default 0 == automatic detect)", + NULL + }, { CONFIG_DEBUG, 1, 1, "--debug", "Debug ", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/config.h new/vpnc/config.h --- old/vpnc/config.h 2011-11-20 07:02:04.000000000 +0100 +++ new/vpnc/config.h 2012-01-14 08:57:39.000000000 +0100 @@ -15,7 +15,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - $Id: config.h 474 2011-11-20 06:02:04Z Antonio Borneo $ + $Id: config.h 510 2012-01-14 07:57:39Z Antonio Borneo $ */ #ifndef __CONFIG_H__ @@ -41,6 +41,7 @@ CONFIG_VERSION, CONFIG_IF_NAME, CONFIG_IF_MODE, + CONFIG_IF_MTU, CONFIG_IKE_DH, CONFIG_IPSEC_PFS, CONFIG_IPSEC_GATEWAY, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/enum2debug.pl new/vpnc/enum2debug.pl --- old/vpnc/enum2debug.pl 2011-08-22 16:19:18.000000000 +0200 +++ new/vpnc/enum2debug.pl 2012-01-14 08:57:51.000000000 +0100 @@ -6,8 +6,6 @@ use warnings; my $in_enum = 0; -my $element; -my $arrayname; print STDERR << 'EOF'; /* Automatically generated with enum2debug.pl: Don't edit! */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/isakmp-pkt.c new/vpnc/isakmp-pkt.c --- old/vpnc/isakmp-pkt.c 2011-11-09 03:01:50.000000000 +0100 +++ new/vpnc/isakmp-pkt.c 2012-01-14 08:57:51.000000000 +0100 @@ -16,7 +16,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - $Id: isakmp-pkt.c 470 2011-11-09 02:01:50Z Antonio Borneo $ + $Id: isakmp-pkt.c 511 2012-01-14 07:57:51Z Antonio Borneo $ */ #include <assert.h> @@ -929,7 +929,7 @@ } DEBUG(3, printf("BEGIN_PARSE\n")); - DEBUG(3, printf("Recieved Packet Len: %zu\n", data_len)); + DEBUG(3, printf("Received Packet Len: %zu\n", data_len)); fetchn(r->i_cookie, ISAKMP_COOKIE_LENGTH); hex_dump("i_cookie", r->i_cookie, ISAKMP_COOKIE_LENGTH, NULL); fetchn(r->r_cookie, ISAKMP_COOKIE_LENGTH); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/mk-version new/vpnc/mk-version --- old/vpnc/mk-version 2008-06-11 01:19:11.000000000 +0200 +++ new/vpnc/mk-version 2012-01-14 10:04:23.000000000 +0100 @@ -3,14 +3,69 @@ # print vpnc version from file VERSION, appending the string printed # by svnversion(1) if appropriate +function git_svn_version () +{ + local key value svn_log svn_commit svn_ver + + # exit if not in git repository + if [ "true" != "$(git rev-parse --is-inside-work-tree 2>/dev/null)" ]; then + return + fi + + # search for svn-remote defined in git configuration + while read key value; do + svn_url_pattern+="\\|$value" + done << EOF + $(git config --get-regexp '^svn-remote\..*\.url$' 2>/dev/null) +EOF + + # exit if no svn-remote defined + if [ ${#svn_url_pattern} -eq 0 ]; then + return + fi + + # scan git-log for latest commit from any svn-remote above + svn_log=($(git log --first-parent -1 \ + --grep="^git-svn-id: \(${svn_url_pattern:2}\)@" 2>/dev/null)) + + # check commit hash is 40 hex digits + svn_commit=${svn_log[1]} + if [ ${#svn_commit} -ne 40 -o -n "${svn_commit//[0-9a-f]/}" ]; then + return + fi + + # check svn version is numeric + svn_ver=${svn_log[ ${#svn_log[@]} - 2 ]} + svn_ver=${svn_ver#*@} + if [ -z "${#svn_ver}" -o -n "${svn_ver//[0-9]/}" ]; then + return + fi + + if [ $(git rev-list --count HEAD...${svn_commit}) -eq 0 ]; then + if [ `git status -s | grep -vc '^??'` -eq 0 ]; then + # no git commits and tree clean + echo "${svn_ver}" + return + fi + fi + # there are local git commits after latest svn commit or tree is dirty + echo "${svn_ver}M" +} + + _version="`cat VERSION`" if [ -d .svn ]; then - if command -v svnversion >/dev/null; then - _version="$_version-`svnversion`" - else - _version="$_version-`sed -n '/^dir$/{n;p;q;}' .svn/entries`" - fi + if command -v svnversion >/dev/null; then + _version="$_version-`svnversion`" + else + _version="$_version-`sed -n '/^dir$/{n;p;q;}' .svn/entries`" + fi +elif command -v git >/dev/null; then + git_ext=$(git_svn_version) + if [ -n "${git_ext}" ]; then + _version="$_version-${git_ext}" + fi fi echo "$_version" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/tunip.c new/vpnc/tunip.c --- old/vpnc/tunip.c 2011-11-20 13:38:12.000000000 +0100 +++ new/vpnc/tunip.c 2012-01-14 08:57:51.000000000 +0100 @@ -21,7 +21,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - $Id: tunip.c 479 2011-11-20 12:38:12Z Antonio Borneo $ + $Id: tunip.c 511 2012-01-14 07:57:51Z Antonio Borneo $ */ /* borrowed from pipsecd (-; */ @@ -649,12 +649,10 @@ * Process non-IP packets * Return 1 if packet has been processed, 0 otherwise */ -static int process_non_ip(struct sa_block *s, uint8_t *frame) +static int process_non_ip(uint8_t *frame) { struct ether_header *eth = (struct ether_header *) frame; - s = NULL; /* unused */ - if (ntohs(eth->ether_type) != ETHERTYPE_IP) { /* drop non-ip traffic */ return 1; @@ -684,7 +682,7 @@ if (process_arp(s, start)) { return; } - if (process_non_ip(s, start)) { + if (process_non_ip(start)) { return; } pack -= ETH_HLEN; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/vpnc-script new/vpnc/vpnc-script --- old/vpnc/vpnc-script 1970-01-01 01:00:00.000000000 +0100 +++ new/vpnc/vpnc-script 2012-01-14 08:57:25.000000000 +0100 @@ -0,0 +1,687 @@ +#!/bin/sh +# List of parameters passed through environment +#* reason -- why this script was called, one of: pre-init connect disconnect +#* VPNGATEWAY -- vpn gateway address (always present) +#* TUNDEV -- tunnel device (always present) +#* INTERNAL_IP4_ADDRESS -- address (always present) +#* INTERNAL_IP4_MTU -- mtu (often unset) +#* INTERNAL_IP4_NETMASK -- netmask (often unset) +#* INTERNAL_IP4_NETMASKLEN -- netmask length (often unset) +#* INTERNAL_IP4_NETADDR -- address of network (only present if netmask is set) +#* INTERNAL_IP4_DNS -- list of dns servers +#* INTERNAL_IP4_NBNS -- list of wins servers +#* INTERNAL_IP6_ADDRESS -- IPv6 address +#* INTERNAL_IP6_NETMASK -- IPv6 netmask +#* INTERNAL_IP6_DNS -- IPv6 list of dns servers +#* CISCO_DEF_DOMAIN -- default domain name +#* CISCO_BANNER -- banner from server +#* CISCO_SPLIT_INC -- number of networks in split-network-list +#* CISCO_SPLIT_INC_%d_ADDR -- network address +#* CISCO_SPLIT_INC_%d_MASK -- subnet mask (for example: 255.255.255.0) +#* CISCO_SPLIT_INC_%d_MASKLEN -- subnet masklen (for example: 24) +#* CISCO_SPLIT_INC_%d_PROTOCOL -- protocol (often just 0) +#* CISCO_SPLIT_INC_%d_SPORT -- source port (often just 0) +#* CISCO_SPLIT_INC_%d_DPORT -- destination port (often just 0) +#* CISCO_IPV6_SPLIT_INC -- number of networks in IPv6 split-network-list +#* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address +#* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen + +# FIXMEs: + +# Section A: route handling + +# 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored +# In order to use them, we'll probably need os specific solutions +# * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV +# This would be an *alternative* to changing the routes (and thus 2) and 3) +# shouldn't be relevant at all) +# 2) There are two different functions to set routes: generic routes and the +# default route. Why isn't the defaultroute handled via the generic route case? +# 3) In the split tunnel case, all routes but the default route might get replaced +# without getting restored later. We should explicitely check and save them just +# like the defaultroute +# 4) Replies to a dhcp-server should never be sent into the tunnel + +# Section B: Split DNS handling + +# 1) Maybe dnsmasq can do something like that +# 2) Parse dns packets going out via tunnel and redirect them to original dns-server + +#env | sort +#set -x + +# =========== script (variable) setup ==================================== + +PATH=/sbin:/usr/sbin:$PATH + +OS="`uname -s`" + +DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute +RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup +SCRIPTNAME=`basename $0` + +# some systems, eg. Darwin & FreeBSD, prune /var/run on boot +if [ ! -d "/var/run/vpnc" ]; then + mkdir -p /var/run/vpnc + [ -x /sbin/restorecon ] && /sbin/restorecon /var/run/vpnc +fi + +# stupid SunOS: no blubber in /usr/local/bin ... (on stdout) +IPROUTE="`which ip | grep '^/'`" 2> /dev/null + +if [ "$OS" = "Linux" ]; then + ifconfig_syntax_ptp="pointopoint" + route_syntax_gw="gw" + route_syntax_del="del" + route_syntax_netmask="netmask" +else + ifconfig_syntax_ptp="" + route_syntax_gw="" + route_syntax_del="delete" + route_syntax_netmask="-netmask" +fi +if [ "$OS" = "SunOS" ]; then + route_syntax_interface="-interface" + ifconfig_syntax_ptpv6="$INTERNAL_IP6_ADDRESS" +else + route_syntax_interface="" + ifconfig_syntax_ptpv6="" +fi + +if [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo + MODIFYRESOLVCONF=modify_resolvconf_manager + RESTORERESOLVCONF=restore_resolvconf_manager +elif [ -x /sbin/netconfig ]; then # tool on Suse after 11.1 + MODIFYRESOLVCONF=modify_resolvconf_suse_netconfig + RESTORERESOLVCONF=restore_resolvconf_suse_netconfig +elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1 + MODIFYRESOLVCONF=modify_resolvconf_suse + RESTORERESOLVCONF=restore_resolvconf_suse +else # Generic for any OS + MODIFYRESOLVCONF=modify_resolvconf_generic + RESTORERESOLVCONF=restore_resolvconf_generic +fi + +# =========== tunnel interface handling ==================================== + +do_ifconfig() { + if [ -n "$INTERNAL_IP4_MTU" ]; then + MTU=$INTERNAL_IP4_MTU + elif [ -n "$IPROUTE" ]; then + MTUDEV=$($IPROUTE route get "$VPNGATEWAY" | sed -ne 's/^.*dev \([a-z0-9]*\).*$/\1/p') + MTU=$($IPROUTE link show "$MTUDEV" | sed -ne 's/^.*mtu \([[:digit:]]\+\).*$/\1/p') + if [ -n "$MTU" ]; then + MTU=$(( $MTU - 88 )) + fi + fi + + if [ -z "$MTU" ]; then + MTU=1412 + fi + + # Point to point interface require a netmask of 255.255.255.255 on some systems + if [ -n "$IPROUTE" ]; then + $IPROUTE link set dev "$TUNDEV" up mtu "$MTU" + $IPROUTE addr add "$INTERNAL_IP4_ADDRESS/255.255.255.255" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV" + else + ifconfig "$TUNDEV" inet "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up + fi + + if [ -n "$INTERNAL_IP4_NETMASK" ]; then + set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN + fi + + # If the netmask is provided, it contains the address _and_ netmask + if [ -n "$INTERNAL_IP6_ADDRESS" ] && [ -z "$INTERNAL_IP6_NETMASK" ]; then + INTERNAL_IP6_NETMASK="$INTERNAL_IP6_ADDRESS/128" + fi + if [ -n "$INTERNAL_IP6_NETMASK" ]; then + if [ -n "$IPROUTE" ]; then + $IPROUTE -6 addr add $INTERNAL_IP6_NETMASK dev $TUNDEV + else + # Unlike for Legacy IP, we don't specify the dest_address + # here on *BSD. OpenBSD for one will refuse to accept + # incoming packets to that address if we do. + # OpenVPN does the same (gives dest_address for Legacy IP + # but not for IPv6). + # Only Solaris needs it; hence $ifconfig_syntax_ptpv6 + ifconfig "$TUNDEV" inet6 $INTERNAL_IP6_NETMASK $ifconfig_syntax_ptpv6 mtu $MTU up + fi + fi +} + +destroy_tun_device() { + case "$OS" in + NetBSD|FreeBSD) # and probably others... + ifconfig "$TUNDEV" destroy + ;; + esac +} + +# =========== route handling ==================================== + +if [ -n "$IPROUTE" ]; then + fix_ip_get_output () { + sed -e 's/ /\n/g' | \ + sed -ne '1p;/via/{N;p};/dev/{N;p};/src/{N;p};/mtu/{N;p}' + } + + set_vpngateway_route() { + $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output` + $IPROUTE route flush cache + } + + del_vpngateway_route() { + $IPROUTE route $route_syntax_del "$VPNGATEWAY" + $IPROUTE route flush cache + } + + set_default_route() { + $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE" + $IPROUTE route replace default dev "$TUNDEV" + $IPROUTE route flush cache + } + + set_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE route flush cache + } + + reset_default_route() { + if [ -s "$DEFAULT_ROUTE_FILE" ]; then + $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"` + $IPROUTE route flush cache + rm -f -- "$DEFAULT_ROUTE_FILE" + fi + } + + del_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE route flush cache + } + + set_ipv6_default_route() { + # We don't save/restore IPv6 default route; just add a higher-priority one. + $IPROUTE -6 route add default dev "$TUNDEV" metric 1 + $IPROUTE -6 route flush cache + } + + set_ipv6_network_route() { + NETWORK="$1" + NETMASKLEN="$2" + $IPROUTE -6 route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE route flush cache + } + + reset_ipv6_default_route() { + $IPROUTE -6 route del default dev "$TUNDEV" + $IPROUTE route flush cache + } + + del_ipv6_network_route() { + NETWORK="$1" + NETMASKLEN="$2" + $IPROUTE -6 route del "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE -6 route flush cache + } +else # use route command + get_default_gw() { + # isn't -n supposed to give --numeric output? + # apperently not... + # Get rid of lines containing IPv6 addresses (':') + netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }' + } + + set_vpngateway_route() { + route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`" + } + + del_vpngateway_route() { + route $route_syntax_del -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`" + } + + set_default_route() { + DEFAULTGW="`get_default_gw`" + echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE" + route $route_syntax_del default $route_syntax_gw "$DEFAULTGW" + route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface + } + + set_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" $route_syntax_interface + } + + reset_default_route() { + if [ -s "$DEFAULT_ROUTE_FILE" ]; then + route $route_syntax_del default $route_syntax_gw "`get_default_gw`" $route_syntax_interface + route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"` + rm -f -- "$DEFAULT_ROUTE_FILE" + fi + } + + del_network_route() { + case "$OS" in + Linux|NetBSD|Darwin|SunOS) # and probably others... + # routes are deleted automatically on device shutdown + return + ;; + esac + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" + } + + set_ipv6_default_route() { + route add -inet6 default "$INTERNAL_IP6_ADDRESS" $route_syntax_interface + } + + set_ipv6_network_route() { + NETWORK="$1" + NETMASK="$2" + route add -inet6 -net "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS" $route_syntax_interface + : + } + + reset_ipv6_default_route() { + route $route_syntax_del -inet6 default "$INTERNAL_IP6_ADDRESS" + : + } + + del_ipv6_network_route() { + NETWORK="$1" + NETMASK="$2" + route $route_syntax_del -inet6 "$NETWORK/$NETMASK" "$INTERNAL_IP6_ADDRESS" + : + } + +fi + +# =========== resolv.conf handling ==================================== + +# =========== resolv.conf handling for any OS ========================= + +modify_resolvconf_generic() { + grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP" + NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc +# and will be overwritten by vpnc +# as long as the above mark is intact" + + # Remember the original value of CISCO_DEF_DOMAIN we need it later + CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN" + # Don't step on INTERNAL_IP4_DNS value, use a temporary variable + INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS" + exec 6< "$RESOLV_CONF_BACKUP" + while read LINE <&6 ; do + case "$LINE" in + nameserver*) + if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then + read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF + $INTERNAL_IP4_DNS_TEMP +EOF + LINE="nameserver $ONE_NAMESERVER" + else + LINE="" + fi + ;; + search*) + if [ -n "$CISCO_DEF_DOMAIN" ]; then + LINE="$LINE $CISCO_DEF_DOMAIN" + CISCO_DEF_DOMAIN="" + fi + ;; + domain*) + if [ -n "$CISCO_DEF_DOMAIN" ]; then + LINE="domain $CISCO_DEF_DOMAIN" + CISCO_DEF_DOMAIN="" + fi + ;; + esac + NEW_RESOLVCONF="$NEW_RESOLVCONF +$LINE" + done + exec 6<&- + + for i in $INTERNAL_IP4_DNS_TEMP ; do + NEW_RESOLVCONF="$NEW_RESOLVCONF +nameserver $i" + done + if [ -n "$CISCO_DEF_DOMAIN" ]; then + NEW_RESOLVCONF="$NEW_RESOLVCONF +search $CISCO_DEF_DOMAIN" + fi + echo "$NEW_RESOLVCONF" > /etc/resolv.conf + + if [ "$OS" = "Darwin" ]; then + case "`uname -r`" in + # Skip for pre-10.4 systems + 4.*|5.*|6.*|7.*) + ;; + # 10.4 and later require use of scutil for DNS to work properly + *) + OVERRIDE_PRIMARY="" + if [ -n "$CISCO_SPLIT_INC" ]; then + if [ $CISCO_SPLIT_INC -lt 1 ]; then + # Must override for correct default route + # Cannot use multiple DNS matching in this case + OVERRIDE_PRIMARY='d.add OverridePrimary # 1' + fi + fi + # Uncomment the following if/fi pair to use multiple + # DNS matching when available. When multiple DNS matching + # is present, anything reading the /etc/resolv.conf file + # directly will probably not work as intended. + #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then + # Cannot use multiple DNS matching without a domain + OVERRIDE_PRIMARY='d.add OverridePrimary # 1' + #fi + scutil >/dev/null 2>&1 <<-EOF + open + d.init + d.add ServerAddresses * $INTERNAL_IP4_DNS + set State:/Network/Service/$TUNDEV/DNS + d.init + # next line overrides the default gateway and breaks split routing + # d.add Router $INTERNAL_IP4_ADDRESS + d.add Addresses * $INTERNAL_IP4_ADDRESS + d.add SubnetMasks * 255.255.255.255 + d.add InterfaceName $TUNDEV + $OVERRIDE_PRIMARY + set State:/Network/Service/$TUNDEV/IPv4 + close + EOF + if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then + scutil >/dev/null 2>&1 <<-EOF + open + get State:/Network/Service/$TUNDEV/DNS + d.add DomainName $CISCO_DEF_DOMAIN_ORIG + d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG + d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG + set State:/Network/Service/$TUNDEV/DNS + close + EOF + fi + ;; + esac + fi +} + +restore_resolvconf_generic() { + if [ ! -e "$RESOLV_CONF_BACKUP" ]; then + return + fi + grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf + rm -f -- "$RESOLV_CONF_BACKUP" + + if [ "$OS" = "Darwin" ]; then + case "`uname -r`" in + # Skip for pre-10.4 systems + 4.*|5.*|6.*|7.*) + ;; + # 10.4 and later require use of scutil for DNS to work properly + *) + scutil >/dev/null 2>&1 <<-EOF + open + remove State:/Network/Service/$TUNDEV/IPv4 + remove State:/Network/Service/$TUNDEV/DNS + close + EOF + ;; + esac + fi +} +# === resolv.conf handling via /sbin/netconfig (Suse 11.1) ===================== + +# Suse provides a script that modifies resolv.conf. Use it because it will +# restart/reload all other services that care about it (e.g. lwresd). [unclear if this is still true, but probably --mlk] + +modify_resolvconf_suse_netconfig() +{ + /sbin/netconfig modify -s vpnc -i "$TUNDEV" <<-EOF + INTERFACE='$TUNDEV' + DNSSERVERS='$INTERNAL_IP4_DNS' + DNSDOMAIN='$CISCO_DEF_DOMAIN' + EOF +} +# Restore resolv.conf to old contents on Suse +restore_resolvconf_suse_netconfig() +{ + /sbin/netconfig remove -s vpnc -i "$TUNDEV" +} + +# === resolv.conf handling via /sbin/modify_resolvconf (Suse) ===================== + +# Suse provides a script that modifies resolv.conf. Use it because it will +# restart/reload all other services that care about it (e.g. lwresd). + +modify_resolvconf_suse() +{ + FULL_SCRIPTNAME=`readlink -f $0` + RESOLV_OPTS='' + test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\"" + test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN" + test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\" +} + +# Restore resolv.conf to old contents on Suse +restore_resolvconf_suse() +{ + FULL_SCRIPTNAME=`readlink -f $0` + /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV +} + +# === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) ========= + +modify_resolvconf_manager() { + NEW_RESOLVCONF="" + for i in $INTERNAL_IP4_DNS; do + NEW_RESOLVCONF="$NEW_RESOLVCONF +nameserver $i" + done + if [ -n "$CISCO_DEF_DOMAIN" ]; then + NEW_RESOLVCONF="$NEW_RESOLVCONF +domain $CISCO_DEF_DOMAIN" + fi + echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV +} + +restore_resolvconf_manager() { + /sbin/resolvconf -d $TUNDEV +} + +# ========= Toplevel state handling ======================================= + +kernel_is_2_6_or_above() { + case `uname -r` in + 1.*|2.[012345]*) + return 1 + ;; + *) + return 0 + ;; + esac +} + +do_pre_init() { + if [ "$OS" = "Linux" ]; then + if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then + : + else # can't open /dev/net/tun + test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null + # fix for broken devfs in kernel 2.6.x + if [ "`readlink /dev/net/tun`" = misc/net/tun \ + -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then + ln -sf /dev/misc/net/tun /dev/net/tun + fi + # make sure tun device exists + if [ ! -e /dev/net/tun ]; then + mkdir -p /dev/net + mknod -m 0640 /dev/net/tun c 10 200 + [ -x /sbin/restorecon ] && /sbin/restorecon /dev/net/tun + fi + # workaround for a possible latency caused by udev, sleep max. 10s + if kernel_is_2_6_or_above ; then + for x in `seq 100` ; do + (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break; + sleep 0.1 + done + fi + fi + elif [ "$OS" = "FreeBSD" ]; then + if [ ! -e /dev/tun ]; then + kldload if_tun + fi + elif [ "$OS" = "GNU/kFreeBSD" ]; then + if [ ! -e /dev/tun ]; then + kldload if_tun + fi + elif [ "$OS" = "NetBSD" ]; then + : + elif [ "$OS" = "OpenBSD" ]; then + : + elif [ "$OS" = "SunOS" ]; then + : + elif [ "$OS" = "Darwin" ]; then + : + fi +} + +do_connect() { + if [ -n "$CISCO_BANNER" ]; then + echo "Connect Banner:" + echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done + echo + fi + + set_vpngateway_route + do_ifconfig + if [ -n "$CISCO_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" + eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" + eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" + if [ $NETWORK != "0.0.0.0" ]; then + set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + else + set_default_route + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP4_DNS ; do + if ! echo "$i" | grep : >/dev/null; then + set_network_route "$i" "255.255.255.255" "32" + fi + done + elif [ -n "$INTERNAL_IP4_ADDRESS" ]; then + set_default_route + fi + if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}" + eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}" + if [ $NETMASKLEN -lt 128 ]; then + set_ipv6_network_route "$NETWORK" "$NETMASKLEN" + else + set_ipv6_default_route + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP4_DNS ; do + if echo "$i" | grep : >/dev/null; then + set_ipv6_network_route "$i" "128" + fi + done + elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then + set_ipv6_default_route + fi + + if [ -n "$INTERNAL_IP4_DNS" ]; then + $MODIFYRESOLVCONF + fi +} + +do_disconnect() { + if [ -n "$CISCO_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" + eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" + eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" + if [ $NETWORK != "0.0.0.0" ]; then + # FIXME: This doesn't restore previously overwritten + # routes. + del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + else + reset_default_route + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP4_DNS ; do + del_network_route "$i" "255.255.255.255" "32" + done + else + reset_default_route + fi + if [ -n "$CISCO_IPV6_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_IPV6_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_IPV6_SPLIT_INC_${i}_ADDR}" + eval NETMASKLEN="\${CISCO_IPV6_SPLIT_INC_${i}_MASKLEN}" + if [ $NETMASKLEN -eq 0 ]; then + reset_ipv6_default_route + else + del_ipv6_network_route "$NETWORK" "$NETMASKLEN" + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP6_DNS ; do + del_ipv6_network_route "$i" "128" + done + elif [ -n "$INTERNAL_IP6_NETMASK" -o -n "$INTERNAL_IP6_ADDRESS" ]; then + reset_ipv6_default_route + fi + + del_vpngateway_route + + if [ -n "$INTERNAL_IP4_DNS" ]; then + $RESTORERESOLVCONF + fi + destroy_tun_device +} + +#### Main + +if [ -z "$reason" ]; then + echo "this script must be called from vpnc" 1>&2 + exit 1 +fi + +case "$reason" in + pre-init) + do_pre_init + ;; + connect) + do_connect + ;; + disconnect) + do_disconnect + ;; + *) + echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2 + exit 1 + ;; +esac + +exit 0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/vpnc-script.in new/vpnc/vpnc-script.in --- old/vpnc/vpnc-script.in 2011-11-26 07:43:24.000000000 +0100 +++ new/vpnc/vpnc-script.in 1970-01-01 01:00:00.000000000 +0100 @@ -1,530 +0,0 @@ -#!/bin/sh -#* reason -- why this script was called, one of: pre-init connect disconnect -#* VPNGATEWAY -- vpn gateway address (always present) -#* TUNDEV -- tunnel device (always present) -#* INTERNAL_IP4_ADDRESS -- address (always present) -#* INTERNAL_IP4_NETMASK -- netmask (often unset) -#* INTERNAL_IP4_NETMASKLEN -- netmask length (often unset) -#* INTERNAL_IP4_NETADDR -- address of network (only present if netmask is set) -#* INTERNAL_IP4_DNS -- list of dns serverss -#* INTERNAL_IP4_NBNS -- list of wins servers -#* CISCO_DEF_DOMAIN -- default domain name -#* CISCO_BANNER -- banner from server -#* CISCO_SPLIT_INC -- number of networks in split-network-list -#* CISCO_SPLIT_INC_%d_ADDR -- network address -#* CISCO_SPLIT_INC_%d_MASK -- subnet mask (for example: 255.255.255.0) -#* CISCO_SPLIT_INC_%d_MASKLEN -- subnet masklen (for example: 24) -#* CISCO_SPLIT_INC_%d_PROTOCOL -- protocol (often just 0) -#* CISCO_SPLIT_INC_%d_SPORT -- source port (often just 0) -#* CISCO_SPLIT_INC_%d_DPORT -- destination port (often just 0) - -# FIXMEs: - -# Section A: route handling - -# 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored -# In order to use them, we'll probably need os specific solutions -# * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV -# This would be an *alternative* to changing the routes (and thus 2) and 3) -# shouldn't be relevant at all) -# 2) There are two different functions to set routes: generic routes and the -# default route. Why isn't the defaultroute handled via the generic route case? -# 3) In the split tunnel case, all routes but the default route might get replaced -# without getting restored later. We should explicitely check and save them just -# like the defaultroute -# 4) Replies to a dhcp-server should never be sent into the tunnel - -# Section B: Split DNS handling - -# 1) Maybe dnsmasq can do something like that -# 2) Parse dns packets going out via tunnel and redirect them to original dns-server - -#env | sort -#set -x - -# =========== script (variable) setup ==================================== - -PATH=/sbin:/usr/sbin:$PATH - -OS="`uname -s`" - -DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute -RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup -FULL_SCRIPTNAME=@PREFIX@/sbin/vpnc -SCRIPTNAME=`basename $FULL_SCRIPTNAME` - -# some systems, eg. Darwin & FreeBSD, prune /var/run on boot -if [ ! -d "/var/run/vpnc" ]; then - mkdir -p /var/run/vpnc -fi - -# stupid SunOS: no blubber in /usr/local/bin ... (on stdout) -IPROUTE="`which ip | grep '^/' 2> /dev/null`" - -if [ "$OS" = "Linux" ]; then - ifconfig_syntax_ptp="pointopoint" - route_syntax_gw="gw" - route_syntax_del="del" - route_syntax_netmask="netmask" -else - ifconfig_syntax_ptp="" - route_syntax_gw="" - route_syntax_del="delete" - route_syntax_netmask="-netmask" -fi - -if [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo - MODIFYRESOLVCONF=modify_resolvconf_manager - RESTORERESOLVCONF=restore_resolvconf_manager -elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1 - MODIFYRESOLVCONF=modify_resolvconf_suse - RESTORERESOLVCONF=restore_resolvconf_suse -else # Generic for any OS - MODIFYRESOLVCONF=modify_resolvconf_generic - RESTORERESOLVCONF=restore_resolvconf_generic -fi - -# =========== tunnel interface handling ==================================== - -do_ifconfig() { - if [ -n "$INTERNAL_IP4_MTU" ]; then - MTU=$INTERNAL_IP4_MTU - elif [ -n "$IPROUTE" ]; then - DEV=$($IPROUTE route | grep ^default | sed 's/^.* dev \([[:alnum:]-]\+\).*$/\1/') - MTU=$(($($IPROUTE link show "$DEV" | grep mtu | sed 's/^.* mtu \([[:digit:]]\+\).*$/\1/') - 88)) - else - MTU=1412 - fi - - # Point to point interface require a netmask of 255.255.255.255 on some systems - ifconfig "$TUNDEV" inet "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up - - if [ -n "$INTERNAL_IP4_NETMASK" ]; then - set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN - fi -} - -destroy_tun_device() { - case "$OS" in - NetBSD) # and probably others... - ifconfig "$TUNDEV" destroy - ;; - esac -} - -# =========== route handling ==================================== - -if [ -n "$IPROUTE" ]; then - fix_ip_get_output () { - sed -e 's/ /\n/g' | \ - sed -ne '1p;/via/{N;p};/dev/{N;p};/src/{N;p};/mtu/{N;p}' - } - - set_vpngateway_route() { - $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output` - $IPROUTE route flush cache - } - - del_vpngateway_route() { - $IPROUTE route $route_syntax_del "$VPNGATEWAY" - $IPROUTE route flush cache - } - - set_default_route() { - $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE" - $IPROUTE route replace default dev "$TUNDEV" - $IPROUTE route flush cache - } - - set_network_route() { - NETWORK="$1" - NETMASK="$2" - NETMASKLEN="$3" - $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV" - $IPROUTE route flush cache - } - - reset_default_route() { - if [ -s "$DEFAULT_ROUTE_FILE" ]; then - $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"` - $IPROUTE route flush cache - rm -f -- "$DEFAULT_ROUTE_FILE" - fi - } - - del_network_route() { - NETWORK="$1" - NETMASK="$2" - NETMASKLEN="$3" - $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV" - $IPROUTE route flush cache - } -else # use route command - get_default_gw() { - # isn't -n supposed to give --numeric output? - # apperently not... - # Get rid of lines containing IPv6 addresses (':') - netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }' - } - - set_vpngateway_route() { - route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`" - } - - del_vpngateway_route() { - route $route_syntax_del -host "$VPNGATEWAY" - } - - set_default_route() { - DEFAULTGW="`get_default_gw`" - echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE" - route $route_syntax_del default - route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" - } - - set_network_route() { - NETWORK="$1" - NETMASK="$2" - NETMASKLEN="$3" - del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" - route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" - } - - reset_default_route() { - if [ -s "$DEFAULT_ROUTE_FILE" ]; then - route $route_syntax_del default - route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"` - rm -f -- "$DEFAULT_ROUTE_FILE" - fi - } - - del_network_route() { - case "$OS" in - Linux|NetBSD|Darwin) # and probably others... - # routes are deleted automatically on device shutdown - return - ;; - esac - NETWORK="$1" - NETMASK="$2" - NETMASKLEN="$3" - route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" - } -fi - -# =========== resolv.conf handling ==================================== - -# =========== resolv.conf handling for any OS ========================= - -modify_resolvconf_generic() { - grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP" - NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc -# and will be overwritten by vpnc -# as long as the above mark is intact" - - # Remember the original value of CISCO_DEF_DOMAIN we need it later - CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN" - # Don't step on INTERNAL_IP4_DNS value, use a temporary variable - INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS" - exec 6< "$RESOLV_CONF_BACKUP" - while read LINE <&6 ; do - case "$LINE" in - nameserver*) - if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then - read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF - $INTERNAL_IP4_DNS_TEMP -EOF - LINE="nameserver $ONE_NAMESERVER" - else - LINE="" - fi - ;; - search*) - if [ -n "$CISCO_DEF_DOMAIN" ]; then - LINE="$LINE $CISCO_DEF_DOMAIN" - CISCO_DEF_DOMAIN="" - fi - ;; - domain*) - if [ -n "$CISCO_DEF_DOMAIN" ]; then - LINE="domain $CISCO_DEF_DOMAIN" - CISCO_DEF_DOMAIN="" - fi - ;; - esac - NEW_RESOLVCONF="$NEW_RESOLVCONF -$LINE" - done - exec 6<&- - - for i in $INTERNAL_IP4_DNS_TEMP ; do - NEW_RESOLVCONF="$NEW_RESOLVCONF -nameserver $i" - done - if [ -n "$CISCO_DEF_DOMAIN" ]; then - NEW_RESOLVCONF="$NEW_RESOLVCONF -search $CISCO_DEF_DOMAIN" - fi - echo "$NEW_RESOLVCONF" > /etc/resolv.conf - - if [ "$OS" = "Darwin" ]; then - case "`uname -r`" in - # Skip for pre-10.4 systems - 4.*|5.*|6.*|7.*) - ;; - # 10.4 and later require use of scutil for DNS to work properly - *) - OVERRIDE_PRIMARY="" - if [ -n "$CISCO_SPLIT_INC" ]; then - if [ $CISCO_SPLIT_INC -lt 1 ]; then - # Must override for correct default route - # Cannot use multiple DNS matching in this case - OVERRIDE_PRIMARY='d.add OverridePrimary # 1' - fi - fi - # Uncomment the following if/fi pair to use multiple - # DNS matching when available. When multiple DNS matching - # is present, anything reading the /etc/resolv.conf file - # directly will probably not work as intended. - #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then - # Cannot use multiple DNS matching without a domain - OVERRIDE_PRIMARY='d.add OverridePrimary # 1' - #fi - scutil >/dev/null 2>&1 <<-EOF - open - d.init - d.add ServerAddresses * $INTERNAL_IP4_DNS - set State:/Network/Service/$TUNDEV/DNS - d.init - # next line overrides the default gateway and breaks split routing - # d.add Router $INTERNAL_IP4_ADDRESS - d.add Addresses * $INTERNAL_IP4_ADDRESS - d.add SubnetMasks * 255.255.255.255 - d.add InterfaceName $TUNDEV - $OVERRIDE_PRIMARY - set State:/Network/Service/$TUNDEV/IPv4 - close - EOF - if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then - scutil >/dev/null 2>&1 <<-EOF - open - get State:/Network/Service/$TUNDEV/DNS - d.add DomainName $CISCO_DEF_DOMAIN_ORIG - d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG - d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG - set State:/Network/Service/$TUNDEV/DNS - close - EOF - fi - ;; - esac - fi -} - -restore_resolvconf_generic() { - if [ ! -e "$RESOLV_CONF_BACKUP" ]; then - return - fi - grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf - rm -f -- "$RESOLV_CONF_BACKUP" - - if [ "$OS" = "Darwin" ]; then - case "`uname -r`" in - # Skip for pre-10.4 systems - 4.*|5.*|6.*|7.*) - ;; - # 10.4 and later require use of scutil for DNS to work properly - *) - scutil >/dev/null 2>&1 <<-EOF - open - remove State:/Network/Service/$TUNDEV/IPv4 - remove State:/Network/Service/$TUNDEV/DNS - close - EOF - ;; - esac - fi -} -# === resolv.conf handling via /sbin/modify_resolvconf (Suse) ===================== - -# Suse provides a script that modifies resolv.conf. Use it because it will -# restart/reload all other services that care about it (e.g. lwresd). - -modify_resolvconf_suse() -{ - RESOLV_OPTS='' - test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\"" - test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN" - test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s $SCRIPTNAME -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\" -} - -# Restore resolv.conf to old contents on Suse -restore_resolvconf_suse() -{ - /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV -} - -# === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) ========= - -modify_resolvconf_manager() { - NEW_RESOLVCONF="" - for i in $INTERNAL_IP4_DNS; do - NEW_RESOLVCONF="$NEW_RESOLVCONF -nameserver $i" - done - if [ -n "$CISCO_DEF_DOMAIN" ]; then - NEW_RESOLVCONF="$NEW_RESOLVCONF -domain $CISCO_DEF_DOMAIN" - fi - echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV -} - -restore_resolvconf_manager() { - /sbin/resolvconf -d $TUNDEV -} - -# ========= Toplevel state handling ======================================= - -kernel_is_2_6_or_above() { - case `uname -r` in - 1.*|2.[012345]*) - return 1 - ;; - *) - return 0 - ;; - esac -} - -do_pre_init() { - if [ "$OS" = "Linux" ]; then - if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then - : - else # can't open /dev/net/tun - test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null - # fix for broken devfs in kernel 2.6.x - if [ "`readlink /dev/net/tun`" = misc/net/tun \ - -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then - ln -sf /dev/misc/net/tun /dev/net/tun - fi - # make sure tun device exists - if [ ! -e /dev/net/tun ]; then - mkdir -p /dev/net - mknod -m 0640 /dev/net/tun c 10 200 - fi - # workaround for a possible latency caused by udev, sleep max. 10s - if kernel_is_2_6_or_above ; then - for x in `seq 100` ; do - (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break; - sleep 0.1 - done - fi - fi - elif [ "$OS" = "FreeBSD" ]; then - if [ ! -e /dev/tun ]; then - kldload if_tun - fi - elif [ "$OS" = "GNU/kFreeBSD" ]; then - if [ ! -e /dev/tun ]; then - kldload if_tun - fi - elif [ "$OS" = "NetBSD" ]; then - : - elif [ "$OS" = "OpenBSD" ]; then - : - elif [ "$OS" = "SunOS" ]; then - : - elif [ "$OS" = "Darwin" ]; then - : - fi -} - -do_connect() { - if [ -n "$CISCO_BANNER" ]; then - echo "Connect Banner:" - echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done - echo - fi - - do_ifconfig - set_vpngateway_route - if [ -n "$CISCO_SPLIT_INC" ]; then - i=0 - while [ $i -lt $CISCO_SPLIT_INC ] ; do - eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" - eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" - eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" - if [ $NETWORK != "0.0.0.0" ]; then - set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" - else - set_default_route - fi - i=`expr $i + 1` - done - for i in $INTERNAL_IP4_DNS ; do - set_network_route "$i" "255.255.255.255" "32" - done - else - set_default_route - fi - - if [ -n "$INTERNAL_IP4_DNS" ]; then - $MODIFYRESOLVCONF - fi -} - -do_disconnect() { - if [ -n "$CISCO_SPLIT_INC" ]; then - i=0 - while [ $i -lt $CISCO_SPLIT_INC ] ; do - eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" - eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" - eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" - if [ $NETWORK != "0.0.0.0" ]; then - # FIXME: This doesn't restore previously overwritten - # routes. - del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" - else - reset_default_route - fi - i=`expr $i + 1` - done - for i in $INTERNAL_IP4_DNS ; do - del_network_route "$i" "255.255.255.255" "32" - done - else - reset_default_route - fi - - del_vpngateway_route - - if [ -n "$INTERNAL_IP4_DNS" ]; then - $RESTORERESOLVCONF - fi - destroy_tun_device -} - -#### Main - -if [ -z "$reason" ]; then - echo "this script must be called from vpnc" 1>&2 - exit 1 -fi - -case "$reason" in - pre-init) - do_pre_init - ;; - connect) - do_connect - ;; - disconnect) - do_disconnect - ;; - *) - echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2 - exit 1 - ;; -esac - -exit 0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/vpnc.8.template new/vpnc/vpnc.8.template --- old/vpnc/vpnc.8.template 2011-11-13 01:48:06.000000000 +0100 +++ new/vpnc/vpnc.8.template 2012-01-14 08:57:51.000000000 +0100 @@ -1,5 +1,5 @@ .\" Template to generate the vpnc-manpage -.\" $Id: vpnc.8.template 473 2011-11-13 00:48:06Z Antonio Borneo $ +.\" $Id: vpnc.8.template 511 2012-01-14 07:57:51Z Antonio Borneo $ .\" .TH VPNC "8" "Warning: Just a template!" "vpnc man-template" "Warning: Just a template!" .\" Fake header just to make this file viewable with man. @@ -176,7 +176,7 @@ make sure that files with colliding hashes have different names. The number can be derived from the certificate file itself: .P -openssl x509 -subject_hash -noout -in /etc/vpnc/vpn-example-com.pem +openssl x509 \-subject_hash \-noout \-in /etc/vpnc/vpn\-example\-com.pem See also the .B \-\-print\-config @@ -207,7 +207,7 @@ License can be found in /usr/share/common\-licenses/GPL. .SH "SEE ALSO" .BR pcf2vpnc (1), -.BR cisco-decrypt (1), +.BR cisco\-decrypt (1), .BR ip (8), .BR ifconfig (8), .BR route (1), diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vpnc/vpnc.c new/vpnc/vpnc.c --- old/vpnc/vpnc.c 2011-11-20 13:38:07.000000000 +0100 +++ new/vpnc/vpnc.c 2012-01-14 08:57:39.000000000 +0100 @@ -18,7 +18,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - $Id: vpnc.c 478 2011-11-20 12:38:07Z Antonio Borneo $ + $Id: vpnc.c 510 2012-01-14 07:57:39Z Antonio Borneo $ */ #define _GNU_SOURCE @@ -376,6 +376,23 @@ } hex_dump("interface HW addr", s->tun_hwaddr, ETH_ALEN, NULL); } + + unsetenv("INTERNAL_IP4_MTU"); + if (config[CONFIG_IF_MTU]) { + int mtu; + + mtu = atoi(config[CONFIG_IF_MTU]); + if (mtu < 0 || mtu > 65535) { + DEBUG(1, printf("ignore MTU option. Use automatic detection\n")); + mtu = 0; + } + if (mtu > 0) { + char *strbuf; + asprintf(&strbuf, "%d", mtu); + setenv("INTERNAL_IP4_MTU", strbuf, 1); + free(strbuf); + } + } } static void config_tunnel(struct sa_block *s) @@ -933,10 +950,14 @@ unsetenv("CISCO_BANNER"); unsetenv("CISCO_DEF_DOMAIN"); unsetenv("CISCO_SPLIT_INC"); + unsetenv("CISCO_IPV6_SPLIT_INC"); unsetenv("INTERNAL_IP4_NBNS"); unsetenv("INTERNAL_IP4_DNS"); unsetenv("INTERNAL_IP4_NETMASK"); unsetenv("INTERNAL_IP4_ADDRESS"); + unsetenv("INTERNAL_IP6_DNS"); + unsetenv("INTERNAL_IP6_NETMASK"); + unsetenv("INTERNAL_IP6_ADDRESS"); for (; a && reject == 0; a = a->next) switch (a->type) { -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
