mirror of
https://github.com/os-mnemo/pan-globalprotect-okta
synced 2026-07-31 15:54:36 +02:00
Aivars Sterns
2c222deccb
* Introduce docker and launch script * warn if unbound not found * output only on connect * show new routes
113 lines
2.4 KiB
Bash
Executable File
113 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
_VPNC_SCRIPT="/usr/local/sbin/vpnc-script"
|
|
|
|
# addr/mask/masklen
|
|
_ROUTES="
|
|
10.0.0.0/255.0.0.0/8
|
|
192.168.0.0/255.255.0.0/16
|
|
"
|
|
# zone [insecure]
|
|
_DOMAINS="
|
|
example.com 0
|
|
"
|
|
|
|
OIFS=$IFS; NLIFS='
|
|
'
|
|
|
|
_split() {
|
|
_line=$1; IFS=$2; shift 2
|
|
read -r -- "$@" <<-EOF
|
|
${_line}
|
|
EOF
|
|
}
|
|
|
|
_get_unbound() {
|
|
command -v /usr/local/sbin/unbound-control >/dev/null 2>&1 \
|
|
&& echo "/usr/local/sbin/unbound-control" && return 0
|
|
command -v unbound-control >/dev/null 2>&1 \
|
|
&& echo "unbound-control" && return 0
|
|
return 1
|
|
}
|
|
|
|
output_routes()
|
|
{
|
|
[ X"${reason}" != X"connect" ] && return
|
|
if [ -n "${CISCO_SPLIT_INC}" ]; then
|
|
_i=0
|
|
while [ ${_i} -lt ${CISCO_SPLIT_INC} ] ; do
|
|
eval _addr="\${CISCO_SPLIT_INC_${_i}_ADDR}"
|
|
eval _mask="\${CISCO_SPLIT_INC_${_i}_MASK}"
|
|
eval _masklen="\${CISCO_SPLIT_INC_${_i}_MASKLEN}"
|
|
echo "orig.route: ${_addr}/${_masklen}"
|
|
_i=$(expr ${_i} + 1)
|
|
done
|
|
fi
|
|
}
|
|
|
|
adjust_routes()
|
|
{
|
|
for _k in $(env | grep ^CISCO_SPLIT_INC | cut -d '=' -f 1); do
|
|
unset ${_k}
|
|
done
|
|
IFS=$NLIFS
|
|
_i=0;
|
|
for _line in ${_ROUTES}; do
|
|
_split "${_line}" ' ' _route _
|
|
_split "${_route}" '/' _addr _mask _masklen _
|
|
export CISCO_SPLIT_INC_${_i}_ADDR="${_addr}"
|
|
export CISCO_SPLIT_INC_${_i}_MASK="${_mask}"
|
|
export CISCO_SPLIT_INC_${_i}_MASKLEN="${_masklen}"
|
|
if [ X"${reason}" = X"connect" ]; then
|
|
echo "new.route: ${_addr}/${_masklen}"
|
|
fi
|
|
_i=$(expr ${_i} + 1)
|
|
done
|
|
export CISCO_SPLIT_INC=${_i}
|
|
IFS=$OIFS
|
|
}
|
|
|
|
output_dns()
|
|
{
|
|
[ X"${reason}" != X"connect" ] && return
|
|
echo "orig.dns: ${INTERNAL_IP4_DNS}"
|
|
echo "orig.domain: ${CISCO_DEF_DOMAIN}"
|
|
}
|
|
|
|
adjust_dns()
|
|
{
|
|
_dns="${INTERNAL_IP4_DNS}"
|
|
[ -z "${_dns}" ] && return
|
|
_unbound=$(_get_unbound) || \
|
|
{ echo "warn: unbound not found" >&2 && return; }
|
|
unset CISCO_DEF_DOMAIN
|
|
unset INTERNAL_IP4_DNS
|
|
IFS=$NLIFS
|
|
for _line in ${_DOMAINS}; do
|
|
_split "${_line}" ' ' _domain _insecure _
|
|
if [ X"${reason}" = X"connect" ]; then
|
|
if [ X"${_insecure}" = X"1" ]; then
|
|
${_unbound} insecure_add "${_domain}"
|
|
fi
|
|
${_unbound} forward_add +i "${_domain}" "${_dns}"
|
|
${_unbound} flush_requestlist
|
|
${_unbound} flush_zone "${_domain}"
|
|
elif [ X"${reason}" = X"disconnect" ]; then
|
|
if [ X"${_insecure}" = X"1" ]; then
|
|
${_unbound} insecure_remove "${_domain}"
|
|
fi
|
|
${_unbound} forward_remove +i "${_domain}"
|
|
${_unbound} flush_zone "${_domain}"
|
|
${_unbound} flush_requestlist
|
|
fi
|
|
done
|
|
IFS=$OIFS
|
|
}
|
|
|
|
output_routes
|
|
adjust_routes
|
|
output_dns
|
|
adjust_dns
|
|
|
|
${_VPNC_SCRIPT} $@
|