From c77dd94ad40a9ecefcf46dd1017de0712b89e5e8 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 1 Feb 2023 10:36:39 +0100
Subject: [PATCH] security/openconnect: ignore DNS information #3090

---
 .../src/opnsense/scripts/OPNsense/Openconnect/vpnc.sh     | 8 ++++++++
 .../service/templates/OPNsense/Openconnect/openconnect    | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100755 security/openconnect/src/opnsense/scripts/OPNsense/Openconnect/vpnc.sh

diff --git a/security/openconnect/src/opnsense/scripts/OPNsense/Openconnect/vpnc.sh b/security/openconnect/src/opnsense/scripts/OPNsense/Openconnect/vpnc.sh
new file mode 100755
index 000000000..1257be102
--- /dev/null
+++ b/security/openconnect/src/opnsense/scripts/OPNsense/Openconnect/vpnc.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# do not pass DNS information that clobbers /etc/resolv.conf
+export INTERNAL_IP4_DNS=
+
+. /usr/local/sbin/vpnc-script
+
+# XXX we can register the proper DNS via ifctl(8) if required later
diff --git a/security/openconnect/src/opnsense/service/templates/OPNsense/Openconnect/openconnect b/security/openconnect/src/opnsense/service/templates/OPNsense/Openconnect/openconnect
index 5b8dd9037..25975f7f9 100644
--- a/security/openconnect/src/opnsense/service/templates/OPNsense/Openconnect/openconnect
+++ b/security/openconnect/src/opnsense/service/templates/OPNsense/Openconnect/openconnect
@@ -1,9 +1,10 @@
 {% if helpers.exists('OPNsense.openconnect.general.enabled') and OPNsense.openconnect.general.enabled == '1' %}
 openconnect_enable="YES"
+openconnect_flags="-s /usr/local/opnsense/scripts/OPNsense/Openconnect/vpnc.sh"
 {%   if helpers.exists('OPNsense.openconnect.general.server') and OPNsense.openconnect.general.server != '' %}
 {%     if helpers.exists('OPNsense.openconnect.general.user') and OPNsense.openconnect.general.user != '' %}
 {%       if helpers.exists('OPNsense.openconnect.general.password') and OPNsense.openconnect.general.password != '' %}
-openconnect_flags="--config=/usr/local/etc/openconnect.conf {{ OPNsense.openconnect.general.server }}"
+openconnect_flags="${openconnect_flags} --config=/usr/local/etc/openconnect.conf {{ OPNsense.openconnect.general.server }}"
 {%       endif %}
 {%     endif %}
 {%   endif %}