#!/bin/sh
#* reason                       -- why this script was called, one of: pre-init connect disconnect
#* VPNGATEWAY                   -- vpn gateway address (always present)
#* TUNDEV                       -- tunnel device (always present)
#* INTERNAL_IP4_ADDRESS         -- address (always present)
#* INTERNAL_IP4_NETMASK         -- netmask (often unset)
#* INTERNAL_IP4_DNS             -- list of dns serverss
#* INTERNAL_IP4_NBNS            -- list of wins servers
#* CISCO_DEF_DOMAIN             -- default domain name
#* CISCO_BANNER                 -- banner from server
#* CISCO_SPLIT_INC              -- number of networks in split-network-list
#* CISCO_SPLIT_INC_%d_ADDR      -- network address
#* CISCO_SPLIT_INC_%d_MASK      -- subnet mask (for example: 255.255.255.0)
#* CISCO_SPLIT_INC_%d_MASKLEN   -- subnet masklen (for example: 24)
#* CISCO_SPLIT_INC_%d_PROTOCOL  -- protocol (often just 0)
#* CISCO_SPLIT_INC_%d_SPORT     -- source port (often just 0)
#* CISCO_SPLIT_INC_%d_DPORT     -- destination port (often just 0)

#set -x

OS="`uname -s`"
MODULES='ip_tables ip_conntrack iptable_filter iptable_nat ipt_MASQUERADE'
DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute
RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup

if ! [ -d "/var/run/vpnc" ]; then
       mkdir -p /var/run/vpnc
fi

ifconfig_syntax_ptp="pointopoint"
route_syntax_gw="gw"
route_syntax_del="del"
route_syntax_netmask="netmask"

####

kernel_is_2_6_or_above() {
	case `uname -r` in
		1.*|2.[012345]*)
			return 1
			;;
		*)
			return 0
			;;
	esac
}

do_pre_init() {
	if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then
		:
	else # can't open /dev/net/tun
		test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null
		# fix for broken devfs in kernel 2.6.x
		if [ "`readlink /dev/net/tun`" = misc/net/tun \
			-a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then
			ln -sf /dev/misc/net/tun /dev/net/tun
		fi
		# make sure tun device exists
		if [ ! -e /dev/net/tun ]; then
			mkdir -p /dev/net
			mknod -m 0640 /dev/net/tun c 10 200
		fi
		# workaround for a possible latency caused by udev, sleep max. 10s
		if kernel_is_2_6_or_above ; then
			for x in `seq 100` ; do
				(exec 6<> /dev/net/tun) > /dev/null 2>&1 && break;
				sleep 0.1
			done
		fi
	fi
}

do_ifconfig() {
	ifconfig "$TUNDEV" "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu 1412 up
}

destroy_tun_device() {
	:
}

if [ -n "$IPROUTE" ]; then
	fix_ip_get_output () {
		sed 's/cache//;s/metric \?[0-9]\+ [0-9]\+//g;s/hoplimit [0-9]\+//g'
	}

	set_vpngateway_route() {
		$IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output`
		$IPROUTE route flush cache
	}
	
	del_vpngateway_route() {
		$IPROUTE route $route_syntax_del "$VPNGATEWAY"
		$IPROUTE route flush cache
	}
	
	set_default_route() {
		$IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
		$IPROUTE route $route_syntax_del default
		$IPROUTE route add default dev "$TUNDEV"
		$IPROUTE route flush cache
	}
	
	set_network_route() {
		NETWORK="$1"
		NETMASK="$2"
		NETMASKLEN="$3"
		$IPROUTE route add "$NETWORK/$NETMASKLEN" dev "$TUNDEV"
		$IPROUTE route flush cache
	}
	
	reset_default_route() {
		$IPROUTE route $route_syntax_del default > /dev/null 2>&1
		$IPROUTE route add `cat "$DEFAULT_ROUTE_FILE"`
		$IPROUTE route flush cache
	}
	
	del_network_route() {
		# linux deletes routes automatically if the device is shut down
		return
		#NETWORK="$1"
		#NETMASK="$2"
		#NETMASKLEN="$3"
		#$IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV" 
		#$IPROUTE route flush cache
	}
else
	orig_route_syntax_gw=$route_syntax_gw
	ORIGDEFGW=$(netstat -r -n | grep '^0.0.0.0' | awk '{print $2}')
	if [ "$ORIGDEFGW" = "0.0.0.0" ] ; then
		ORIGDEFGW=$(netstat -r -n | grep '^0.0.0.0' | awk '{print $8}')
		route_syntax_gw=dev
	fi

	get_default_gw() {
		echo $ORIGDEFGW
	}
	
	set_vpngateway_route() {
		route add -host "$VPNGATEWAY" $route_syntax_gw $ORIGDEFGW

	}

	del_vpngateway_route() {
		route $route_syntax_del -host "$VPNGATEWAY"
	}
	
	set_default_route() {
		echo "$route_syntax_gw $ORIGDEFGW" > "$DEFAULT_ROUTE_FILE"
 		route $route_syntax_del default
		route add default $orig_route_syntax_gw "$INTERNAL_IP4_ADDRESS"
	}
	
	set_network_route() {
		NETWORK="$1"
		NETMASK="$2"
		NETMASKLEN="$3"
		route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $orig_route_syntax_gw "$INTERNAL_IP4_ADDRESS"
	}
	
	reset_default_route() {
		route $route_syntax_del default
		route add default `cat "$DEFAULT_ROUTE_FILE"`
	}
	
	del_network_route() {
		case $OS in
		Linux|NetBSD) # and probably others...
			# routes are deleted automatically on device shutdown
			return
			;;
		esac
		NETWORK="$1"
		NETMASK="$2"
		NETMASKLEN="$3"
		route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS"
	}
fi

write_resolvconf() {
	grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP"
	NEW_RESOLVCONF="#@VPNC_GENERATED@ -- this file is generated by vpnc
# and will be overwritten by vpnc
# as long as the above mark is intact"

	# Don't step on INTERNAL_IP4_DNS value, use a temporary variable
	INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS"
	exec 6< /etc/resolv.conf
	while read LINE <&6 ; do
		case $LINE in
			nameserver*)
				if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then
					read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF
	$INTERNAL_IP4_DNS_TEMP
EOF
					LINE="nameserver $ONE_NAMESERVER"
				else
					LINE=""
				fi
				;;
			domain*|search*)
				if [ -n "$CISCO_DEF_DOMAIN" ]; then
					LINE="$LINE $CISCO_DEF_DOMAIN"
					CISCO_DEF_DOMAIN=""
				fi
				;;
		esac
		NEW_RESOLVCONF="$NEW_RESOLVCONF
$LINE"
	done
	exec 6<&-
	
	for i in $INTERNAL_IP4_DNS_TEMP ; do
		NEW_RESOLVCONF="$NEW_RESOLVCONF
nameserver $i"
	done
	if [ -n "$CISCO_DEF_DOMAIN" ]; then
		NEW_RESOLVCONF="$NEW_RESOLVCONF
search $CISCO_DEF_DOMAIN"
	fi
	echo "$NEW_RESOLVCONF" > /etc/resolv.conf
}

reset_resolvconf() {
	if [ ! -e "$RESOLV_CONF_BACKUP" ]; then
		return
	fi
	grep '^#@VPNC_GENERATED@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf
	rm -f -- "$RESOLV_CONF_BACKUP"
}

do_connect() {
	if [ -n "$CISCO_BANNER" ]; then
		echo "Connect Banner:"
		echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done
		echo
	fi
	
	do_ifconfig
	set_vpngateway_route
	if [ -n "$CISCO_SPLIT_INC" ]; then
		i=0
		while [ $i -lt $CISCO_SPLIT_INC ] ; do
			eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
			eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
			eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
			set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
			i=`expr $i + 1`
		done
		for i in $INTERNAL_IP4_DNS ; do
			set_network_route "$i" "255.255.255.255" "32"
		done
	else
		set_default_route
	fi
	
	if [ -n "$INTERNAL_IP4_DNS" ]; then
		write_resolvconf
	fi
}

do_disconnect() {
	destroy_tun_device
	if [ -n "$CISCO_SPLIT_INC" ]; then
		i=0
		while [ $i -lt $CISCO_SPLIT_INC ] ; do
			eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}"
			eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}"
			eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}"
			del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN"
			i=`expr $i + 1`
		done
		for i in $INTERNAL_IP4_DNS ; do
			del_network_route "$i" "255.255.255.255" "32"
		done
	else
		if [ -s "$DEFAULT_ROUTE_FILE" ]; then
			reset_default_route
			rm -f -- "$DEFAULT_ROUTE_FILE"
		fi
	fi
	
	del_vpngateway_route
	
	if [ -n "$INTERNAL_IP4_DNS" ]; then
		reset_resolvconf
	fi
}

start_vpn_nat() {
	for MODUL in $MODULES; do
		modprobe $MODUL
	done
	iptables -A FORWARD -o $TUNDEV -j ACCEPT
	iptables -A FORWARD -i $TUNDEV -j ACCEPT
	iptables -t nat -A POSTROUTING -o $TUNDEV -j MASQUERADE
}

stop_vpn_nat() {
	iptables -t nat -D POSTROUTING -o $TUNDEV -j MASQUERADE
	iptables -D FORWARD -i $TUNDEV -j ACCEPT
	iptables -D FORWARD -o $TUNDEV -j ACCEPT
	reverse_list=
	for MODUL in $MODULES; do
		reverse_list="$MODUL $reverse_list"
	done
	for MODUL in $reverse_list; do
		rmmod $MODUL
	done
}

####

if [ -z "$reason" ]; then
	echo "this script must be called from vpnc" 1>&2
	exit 1
fi

case $reason in
	pre-init)
		do_pre_init
		;;
	connect)
		do_connect
		#start_vpn_nat
		;;
	disconnect)
		#stop_vpn_nat
		do_disconnect
		if [ "`dirname $0`" = '/var/tmp' ]; then
			rm -f $0
		fi
		;;
	*)
		echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2
		exit 1
		;;
esac

exit 0