network revision 1.47
1#!/bin/sh 2# 3# $NetBSD: network,v 1.47 2004/10/12 14:51:03 lukem Exp $ 4# 5 6# PROVIDE: network 7# REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8# BEFORE: NETWORKING 9 10$_rc_subr_loaded . /etc/rc.subr 11 12name="network" 13start_cmd="network_start" 14stop_cmd="network_stop" 15 16network_start() 17{ 18 # set hostname, turn on network 19 # 20 echo "Starting network." 21 22 # If $hostname is set, use it for my Internet name, 23 # otherwise use /etc/myname 24 # 25 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 26 hostname=$(cat /etc/myname) 27 fi 28 if [ -n "$hostname" ]; then 29 echo "Hostname: $hostname" 30 hostname $hostname 31 else 32 # Don't warn about it if we're going to run 33 # DHCP later, as we will probably get the 34 # hostname at that time. 35 # 36 if ! checkyesno dhclient && [ -z "$(hostname)" ]; then 37 warn "\$hostname not set." 38 fi 39 fi 40 41 # Check $domainname first, then /etc/defaultdomain, 42 # for NIS/YP domain name 43 # 44 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 45 domainname=$(cat /etc/defaultdomain) 46 fi 47 if [ -n "$domainname" ]; then 48 echo "NIS domainname: $domainname" 49 domainname $domainname 50 fi 51 52 # Flush all routes just to make sure it is clean 53 if checkyesno flushroutes; then 54 route -qn flush 55 fi 56 57 # Set the address for the first loopback interface, so that the 58 # auto-route from a newly configured interface's address to lo0 59 # works correctly. 60 # 61 # NOTE: obscure networking problems will occur if lo0 isn't configured. 62 # 63 ifconfig lo0 inet 127.0.0.1 64 65 # According to RFC1122, 127.0.0.0/8 must not leave the node. 66 # 67 route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 68 69 # IPv6 routing setups, and host/router mode selection. 70 # 71 if ifconfig lo0 inet6 >/dev/null 2>&1; then 72 # We have IPv6 support in kernel. 73 74 # disallow link-local unicast dest without outgoing scope 75 # identifiers. 76 # 77 route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 78 79 # disallow site-local unicast dest without outgoing scope 80 # identifiers. 81 # If you configure site-locals without scope id (it is 82 # permissible config for routers that are not on scope 83 # boundary), you may want to comment the following one out. 84 # 85 if ! checkyesno ip6sitelocal; then 86 route -q add -inet6 fec0:: -prefixlen 10 ::1 -reject 87 fi 88 89 # disallow "internal" addresses to appear on the wire. 90 # 91 route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 92 93 # disallow packets to malicious IPv4 compatible prefix 94 # 95 route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 96 route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 97 route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 98 route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 99 100 # disallow packets to malicious 6to4 prefix 101 # 102 route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 103 route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 104 route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 105 route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 106 107 # Completely disallow packets to IPv4 compatible prefix. 108 # This may conflict with RFC1933 under following circumstances: 109 # (1) An IPv6-only KAME node tries to originate packets to IPv4 110 # comatible destination. The KAME node has no IPv4 111 # compatible support. Under RFC1933, it should transmit 112 # native IPv6 packets toward IPv4 compatible destination, 113 # hoping it would reach a router that forwards the packet 114 # toward auto-tunnel interface. 115 # (2) An IPv6-only node originates a packet to IPv4 compatible 116 # destination. A KAME node is acting as an IPv6 router, and 117 # asked to forward it. 118 # Due to rare use of IPv4 compatible address, and security 119 # issues with it, we disable it by default. 120 # 121 route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 122 123 sysctl -qw net.inet6.ip6.forwarding=0 124 sysctl -qw net.inet6.ip6.accept_rtadv=0 125 126 case $ip6mode in 127 router) 128 echo 'IPv6 mode: router' 129 sysctl -qw net.inet6.ip6.forwarding=1 130 ;; 131 132 autohost) 133 echo 'IPv6 mode: autoconfigured host' 134 sysctl -qw net.inet6.ip6.accept_rtadv=1 135 ;; 136 137 host) 138 echo 'IPv6 mode: host' 139 ;; 140 141 *) warn "invalid \$ip6mode value "\"$ip6mode\" 142 ;; 143 144 esac 145 fi 146 147 # Configure all of the network interfaces listed in $net_interfaces; 148 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 149 # In the following, "xxN" stands in for interface names, like "le0". 150 # For any interfaces that has an $ifconfig_xxN variable associated, 151 # we do "ifconfig xxN $ifconfig_xxN". 152 # If there is no such variable, we take the contents of the file 153 # /etc/ifconfig.xxN, and run "ifconfig xxN" repeatedly, using each 154 # line of the file as the arguments for a separate "ifconfig" 155 # invocation. 156 # 157 # In order to configure an interface reasonably, you at the very least 158 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 159 # and probably a netmask (as in "netmask 0xffffffe0"). You will 160 # frequently need to specify a media type, as in "media UTP", for 161 # interface cards with multiple media connections that do not 162 # autoconfigure. See the ifconfig manual page for details. 163 # 164 # Note that /etc/ifconfig.xxN takes multiple lines. The following 165 # configuration is possible: 166 # inet 10.1.1.1 netmask 0xffffff00 167 # inet 10.1.1.2 netmask 0xffffff00 alias 168 # inet6 fec0::1 prefixlen 64 alias 169 # 170 # You can put shell script fragment into /etc/ifconfig.xxN by 171 # starting a line with "!". Refer to ifconfig.if(5) for details. 172 # 173 if [ "$net_interfaces" != NO ]; then 174 if checkyesno auto_ifconfig; then 175 tmp=$(ifconfig -l) 176 for cloner in $(ifconfig -C 2>/dev/null); do 177 for int in /etc/ifconfig.${cloner}[0-9]*; do 178 [ ! -f $int ] && break 179 tmp="$tmp ${int##*.}" 180 done 181 done 182 else 183 tmp="$net_interfaces" 184 fi 185 echo -n 'Configuring network interfaces:' 186 for int in $tmp; do 187 eval args=\$ifconfig_$int 188 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 189 if ifconfig $int create 2>/dev/null && \ 190 checkyesno ipfilter; then 191 # resync ipf(4) 192 ipf -y >/dev/null 193 fi 194 fi 195 if [ -n "$args" ]; then 196 echo -n " $int" 197 ifconfig $int $args 198 elif [ -f /etc/ifconfig.$int ]; then 199 echo -n " $int" 200 while read args; do 201 [ -z "$args" ] && continue 202 case "$args" in 203 "#"*|create) 204 ;; 205 "!"*) 206 eval ${args#*!} 207 ;; 208 *) 209 ifconfig $int $args 210 ;; 211 esac 212 done < /etc/ifconfig.$int 213 else 214 if ! checkyesno auto_ifconfig; then 215 echo 216 warn \ 217 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 218 warn "interface $int not configured." 219 fi 220 continue 221 fi 222 configured_interfaces="$configured_interfaces $int" 223 done 224 echo "." 225 fi 226 227 # Check $defaultroute, then /etc/mygate, for the name or address 228 # of my IPv4 gateway host. If using a name, that name must be in 229 # /etc/hosts. 230 # 231 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 232 defaultroute=$(cat /etc/mygate) 233 fi 234 if [ -n "$defaultroute" ]; then 235 route add default $defaultroute 236 fi 237 238 # Check $defaultroute6, then /etc/mygate6, for the name or address 239 # of my IPv6 gateway host. If using a name, that name must be in 240 # /etc/hosts. Note that the gateway host address must be a link-local 241 # address if it is not using an stf* interface. 242 # 243 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 244 defaultroute6=$(cat /etc/mygate6) 245 fi 246 if [ -n "$defaultroute6" ]; then 247 if [ "$ip6mode" = "autohost" ]; then 248 echo 249 warn \ 250 "ip6mode is set to 'autohost' and a v6 default route is also set." 251 fi 252 route add -inet6 default $defaultroute6 253 fi 254 255 # Check if each configured interface xxN has an $ifaliases_xxN variable 256 # associated, then configure additional IP addresses for that interface. 257 # The variable contains a list of "address netmask" pairs, with 258 # "netmask" set to "-" if the interface default netmask is to be used. 259 # 260 # Note that $ifaliases_xxN works only with certain configurations and 261 # considered not recommended. Use /etc/ifconfig.xxN if possible. 262 # 263 # 264 if [ -n "$configured_interfaces" ]; then 265 echo "Adding interface aliases:" 266 done_aliases_message=yes 267 fi 268 for int in $configured_interfaces; do 269 eval args=\$ifaliases_$int 270 if [ -n "$args" ]; then 271 set -- $args 272 while [ $# -ge 2 ]; do 273 addr=$1 ; net=$2 ; shift 2 274 if [ "$net" = "-" ]; then 275 # for compatibility only, obsolete 276 ifconfig $int inet alias $addr 277 else 278 ifconfig $int inet alias $addr \ 279 netmask $net 280 fi 281 done 282 fi 283 done 284 285 # /etc/ifaliases, if it exists, contains the names of additional IP 286 # addresses for each interface. It is formatted as a series of lines 287 # that contain 288 # address interface netmask 289 # 290 # Note that /etc/ifaliases works only with certain cases only and its 291 # use is not recommended. Use /etc/ifconfig.xxN instead. 292 # 293 # 294 if [ -f /etc/ifaliases ]; then 295 if [ "$done_aliases_message" != yes ]; then 296 echo "Adding interface aliases:" 297 fi 298 while read addr int net; do 299 if [ -z "$net" ]; then 300 # for compatibility only, obsolete 301 ifconfig $int inet alias $addr 302 else 303 ifconfig $int inet alias $addr netmask $net 304 fi 305 done < /etc/ifaliases 306 fi 307 308 # IPv6 interface autoconfiguration. 309 # 310 if ifconfig lo0 inet6 >/dev/null 2>&1; then 311 # wait till DAD is completed. always invoke it in case 312 # if are configured manually by ifconfig 313 # 314 dadcount=$(sysctl -n net.inet6.ip6.dad_count 2>/dev/null) 315 sleep $dadcount 316 sleep 1 317 318 if checkyesno rtsol; then 319 if [ "$ip6mode" = "autohost" ]; then 320 echo 'Sending router solicitation...' 321 rtsol $rtsol_flags 322 else 323 echo 324 warn \ 325 "ip6mode must be set to 'autohost' to use rtsol." 326 fi 327 328 # wait till DAD is completed, for global addresses 329 # configured by router advert message. 330 # 331 sleep $dadcount 332 sleep 1 333 fi 334 fi 335 336 # XXX this must die 337 if [ -s /etc/netstart.local ]; then 338 sh /etc/netstart.local start 339 fi 340} 341 342network_stop() 343{ 344 echo "Stopping network." 345 346 # XXX this must die 347 if [ -s /etc/netstart.local ]; then 348 sh /etc/netstart.local stop 349 fi 350 351 echo "Deleting aliases." 352 if [ -f /etc/ifaliases ]; then 353 while read addr int net; do 354 ifconfig $int inet delete $addr 355 done < /etc/ifaliases 356 fi 357 358 for int in $(ifconfig -lu); do 359 eval args=\$ifaliases_$int 360 if [ -n "$args" ]; then 361 set -- $args 362 while [ $# -ge 2 ]; do 363 addr=$1 ; net=$2 ; shift 2 364 ifconfig $int inet delete $addr 365 done 366 fi 367 done 368 369 # down interfaces 370 # 371 echo -n 'Downing network interfaces:' 372 if [ "$net_interfaces" != NO ]; then 373 if checkyesno auto_ifconfig; then 374 tmp=$(ifconfig -l) 375 else 376 tmp="$net_interfaces" 377 fi 378 for int in $tmp; do 379 eval args=\$ifconfig_$int 380 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 381 echo -n " $int" 382 ifconfig $int down 383 if ifconfig $int destroy 2>/dev/null && \ 384 checkyesno ipfilter; then 385 # resync ipf(4) 386 ipf -y >/dev/null 387 fi 388 fi 389 done 390 echo "." 391 fi 392 393 # flush routes 394 # 395 route -qn flush 396 397} 398 399load_rc_config $name 400load_rc_config_var dhclient dhclient 401load_rc_config_var ipfilter ipfilter 402run_rc_command "$1" 403