network revision 1.57
1#!/bin/sh 2# 3# $NetBSD: network,v 1.57 2008/10/11 17:28:03 christos Exp $ 4# 5 6# PROVIDE: network 7# REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8# BEFORE: NETWORKING 9 10$_rc_subr_loaded . /etc/rc.subr 11 12name="network" 13start_cmd="network_start" 14stop_cmd="network_stop" 15 16nl=' 17' # a newline 18 19network_start() 20{ 21 # set hostname, turn on network 22 # 23 echo "Starting network." 24 25 # If $hostname is set, use it for my Internet name, 26 # otherwise use /etc/myname 27 # 28 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 29 hostname=$(cat /etc/myname) 30 fi 31 if [ -n "$hostname" ]; then 32 echo "Hostname: $hostname" 33 hostname $hostname 34 else 35 # Don't warn about it if we're going to run 36 # DHCP later, as we will probably get the 37 # hostname at that time. 38 # 39 if ! checkyesno dhclient && [ -z "$(hostname)" ]; then 40 warn "\$hostname not set." 41 fi 42 fi 43 44 # Check $domainname first, then /etc/defaultdomain, 45 # for NIS/YP domain name 46 # 47 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 48 domainname=$(cat /etc/defaultdomain) 49 fi 50 if [ -n "$domainname" ]; then 51 echo "NIS domainname: $domainname" 52 domainname $domainname 53 fi 54 55 # Flush all routes just to make sure it is clean 56 if checkyesno flushroutes; then 57 /sbin/route -qn flush 58 fi 59 60 # Set the address for the first loopback interface, so that the 61 # auto-route from a newly configured interface's address to lo0 62 # works correctly. 63 # 64 # NOTE: obscure networking problems will occur if lo0 isn't configured. 65 # 66 /sbin/ifconfig lo0 inet 127.0.0.1 67 68 # According to RFC1122, 127.0.0.0/8 must not leave the node. 69 # 70 /sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 71 72 # IPv6 routing setups, and host/router mode selection. 73 # 74 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 75 # We have IPv6 support in kernel. 76 77 # disallow link-local unicast dest without outgoing scope 78 # identifiers. 79 # 80 /sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 81 82 # disallow the use of the RFC3849 documentation address 83 # 84 /sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject 85 86 # IPv6 site-local scoped address prefix (fec0::/10) 87 # has been deprecated by RFC3879. 88 # 89 if [ -n "$ip6sitelocal" ]; then 90 warn "\$ip6sitelocal is no longer valid" 91 fi 92 93 # disallow "internal" addresses to appear on the wire. 94 # 95 /sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 96 97 # disallow packets to malicious IPv4 compatible prefix 98 # 99 /sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 100 /sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 101 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 102 /sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 103 104 # disallow packets to malicious 6to4 prefix 105 # 106 /sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 107 /sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 108 /sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 109 /sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 110 111 # Completely disallow packets to IPv4 compatible prefix. 112 # This may conflict with RFC1933 under following circumstances: 113 # (1) An IPv6-only KAME node tries to originate packets to IPv4 114 # compatible destination. The KAME node has no IPv4 115 # compatible support. Under RFC1933, it should transmit 116 # native IPv6 packets toward IPv4 compatible destination, 117 # hoping it would reach a router that forwards the packet 118 # toward auto-tunnel interface. 119 # (2) An IPv6-only node originates a packet to IPv4 compatible 120 # destination. A KAME node is acting as an IPv6 router, and 121 # asked to forward it. 122 # Due to rare use of IPv4 compatible address, and security 123 # issues with it, we disable it by default. 124 # 125 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 126 127 /sbin/sysctl -qw net.inet6.ip6.forwarding=0 128 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=0 129 130 case $ip6mode in 131 router) 132 echo 'IPv6 mode: router' 133 /sbin/sysctl -qw net.inet6.ip6.forwarding=1 134 135 # disallow unique-local unicast forwarding without 136 # explicit configuration. 137 if ! checkyesno ip6uniquelocal; then 138 /sbin/route -q add -inet6 fc00:: -prefixlen 7 \ 139 ::1 -reject 140 fi 141 ;; 142 143 autohost) 144 echo 'IPv6 mode: autoconfigured host' 145 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=1 146 ;; 147 148 host) 149 echo 'IPv6 mode: host' 150 ;; 151 152 *) warn "invalid \$ip6mode value "\"$ip6mode\" 153 ;; 154 155 esac 156 fi 157 158 # Configure all of the network interfaces listed in $net_interfaces; 159 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 160 # In the following, "xxN" stands in for interface names, like "le0". 161 # 162 # For any interfaces that has an $ifconfig_xxN variable 163 # associated, we break it into lines using ';' as a separator, 164 # then process it just like the contents of an /etc/ifconfig.xxN 165 # file. 166 # 167 # For each line from the $ifconfig_xxN variable or the 168 # /etc/ifconfig.xxN file, we ignore comments and blank lines, 169 # treat lines beginning with "!" as commands to execute, treat 170 # "dhcp" as a special case to invoke dhcpcd, and for any other 171 # line we run "ifconfig xxN", using each line of the file as the 172 # arguments for a separate "ifconfig" invocation. 173 # 174 # In order to configure an interface reasonably, you at the very least 175 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 176 # and probably a netmask (as in "netmask 0xffffffe0"). You will 177 # frequently need to specify a media type, as in "media UTP", for 178 # interface cards with multiple media connections that do not 179 # autoconfigure. See the ifconfig manual page for details. 180 # 181 # Note that /etc/ifconfig.xxN takes multiple lines. The following 182 # configuration is possible: 183 # inet 10.1.1.1 netmask 0xffffff00 184 # inet 10.1.1.2 netmask 0xffffff00 alias 185 # inet6 2001:db8::1 prefixlen 64 alias 186 # 187 # You can put shell script fragment into /etc/ifconfig.xxN by 188 # starting a line with "!". Refer to ifconfig.if(5) for details. 189 # 190 if [ "$net_interfaces" != NO ]; then 191 if checkyesno auto_ifconfig; then 192 tmp=$(/sbin/ifconfig -l) 193 for cloner in $(/sbin/ifconfig -C 2>/dev/null); do 194 for int in /etc/ifconfig.${cloner}[0-9]*; do 195 [ ! -f $int ] && break 196 tmp="$tmp ${int##*.}" 197 done 198 done 199 else 200 tmp="$net_interfaces" 201 fi 202 echo -n 'Configuring network interfaces:' 203 for int in $tmp; do 204 eval argslist=\$ifconfig_$int 205 206 # Skip interfaces that do not have explicit 207 # configuration information. If auto_ifconfig is 208 # false then also warn about such interfaces. 209 # 210 if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ] 211 then 212 if ! checkyesno auto_ifconfig; then 213 echo 214 warn \ 215 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 216 warn "interface $int not configured." 217 fi 218 continue 219 fi 220 221 echo -n " $int" 222 223 # Create the interface if necessary. 224 # If the interface did not exist before, 225 # then also resync ipf(4). 226 # 227 if /sbin/ifconfig $int create 2>/dev/null && \ 228 checkyesno ipfilter; then 229 /sbin/ipf -y >/dev/null 230 fi 231 232 # If $ifconfig_xxN is empty, then use 233 # /etc/ifconfig.xxN, which we know exists due to 234 # an earlier test. 235 # 236 # If $ifconfig_xxN is non-empty and contains a 237 # newline, then just use it as is. (This allows 238 # semicolons through unmolested.) 239 # 240 # If $ifconfig_xxN is non-empty and does not 241 # contain a newline, then convert all semicolons 242 # to newlines. 243 # 244 case "$argslist" in 245 '') 246 cat /etc/ifconfig.$int 247 ;; 248 *"${nl}"*) 249 echo "$argslist" 250 ;; 251 *) 252 ( 253 set -o noglob 254 IFS=';'; set -- $argslist 255 #echo >&2 "[$#] [$1] [$2] [$3] [$4]" 256 IFS="$nl"; echo "$*" 257 ) 258 ;; 259 esac | 260 while read -r args; do 261 case "$args" in 262 ''|"#"*|create) 263 ;; 264 "!"*) 265 # Run arbitrary command in a subshell. 266 ( eval "${args#*!}" ) 267 ;; 268 dhcp) 269 /sbin/dhcpcd -n ${dhcpcd_flags} $int 270 ;; 271 *) 272 # Pass args to ifconfig. Note 273 # that args may contain embedded 274 # shell metacharacters, such as 275 # "ssid 'foo;*>bar'". We eval 276 # one more time so that things 277 # like ssid "Columbia University" work. 278 ( 279 set -o noglob 280 eval set -- $args 281 #echo >&2 "[$#] [$1] [$2] [$3]" 282 /sbin/ifconfig $int "$@" 283 ) 284 ;; 285 esac 286 done 287 configured_interfaces="$configured_interfaces $int" 288 done 289 echo "." 290 fi 291 292 echo -n "Adding interface aliases:" 293 294 # Check if each configured interface xxN has an $ifaliases_xxN variable 295 # associated, then configure additional IP addresses for that interface. 296 # The variable contains a list of "address netmask" pairs, with 297 # "netmask" set to "-" if the interface default netmask is to be used. 298 # 299 # Note that $ifaliases_xxN works only in certain cases and its 300 # use is not recommended. Use /etc/ifconfig.xxN or multiple 301 # commands in $ifconfig_xxN instead. 302 # 303 for int in lo0 $configured_interfaces; do 304 eval args=\$ifaliases_$int 305 if [ -n "$args" ]; then 306 set -- $args 307 while [ $# -ge 2 ]; do 308 addr=$1 ; net=$2 ; shift 2 309 if [ "$net" = "-" ]; then 310 # for compatibility only, obsolete 311 /sbin/ifconfig $int inet alias $addr 312 else 313 /sbin/ifconfig $int inet alias $addr \ 314 netmask $net 315 fi 316 echo -n " $int:$addr" 317 done 318 fi 319 done 320 321 # /etc/ifaliases, if it exists, contains the names of additional IP 322 # addresses for each interface. It is formatted as a series of lines 323 # that contain 324 # address interface netmask 325 # 326 # Note that /etc/ifaliases works only in certain cases and its 327 # use is not recommended. Use /etc/ifconfig.xxN or multiple 328 # commands in $ifconfig_xxN instead. 329 # 330 if [ -f /etc/ifaliases ]; then 331 while read addr int net; do 332 if [ -z "$net" ]; then 333 # for compatibility only, obsolete 334 /sbin/ifconfig $int inet alias $addr 335 else 336 /sbin/ifconfig $int inet alias $addr netmask $net 337 fi 338 done < /etc/ifaliases 339 fi 340 341 echo "." # for "Adding interface aliases:" 342 343 # Check $defaultroute, then /etc/mygate, for the name or address 344 # of my IPv4 gateway host. If using a name, that name must be in 345 # /etc/hosts. 346 # 347 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 348 defaultroute=$(cat /etc/mygate) 349 fi 350 if [ -n "$defaultroute" ]; then 351 /sbin/route add default $defaultroute 352 fi 353 354 # Check $defaultroute6, then /etc/mygate6, for the name or address 355 # of my IPv6 gateway host. If using a name, that name must be in 356 # /etc/hosts. Note that the gateway host address must be a link-local 357 # address if it is not using an stf* interface. 358 # 359 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 360 defaultroute6=$(cat /etc/mygate6) 361 fi 362 if [ -n "$defaultroute6" ]; then 363 if [ "$ip6mode" = "autohost" ]; then 364 echo 365 warn \ 366 "ip6mode is set to 'autohost' and a v6 default route is also set." 367 fi 368 /sbin/route add -inet6 default $defaultroute6 369 fi 370 371 # IPv6 interface autoconfiguration. 372 # 373 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 374 # wait till DAD is completed. always invoke it in case 375 # if are configured manually by ifconfig 376 # 377 dadcount=$(/sbin/sysctl -n net.inet6.ip6.dad_count 2>/dev/null) 378 sleep $dadcount 379 sleep 1 380 381 if checkyesno rtsol; then 382 if [ "$ip6mode" = "autohost" ]; then 383 echo 'Sending router solicitation...' 384 /sbin/rtsol $rtsol_flags 385 else 386 echo 387 warn \ 388 "ip6mode must be set to 'autohost' to use rtsol." 389 fi 390 391 # wait till DAD is completed, for global addresses 392 # configured by router advert message. 393 # 394 sleep $dadcount 395 sleep 1 396 fi 397 fi 398 399 # XXX this must die 400 if [ -s /etc/netstart.local ]; then 401 sh /etc/netstart.local start 402 fi 403} 404 405network_stop() 406{ 407 echo "Stopping network." 408 409 # XXX this must die 410 if [ -s /etc/netstart.local ]; then 411 sh /etc/netstart.local stop 412 fi 413 414 echo "Deleting aliases." 415 if [ -f /etc/ifaliases ]; then 416 while read addr int net; do 417 /sbin/ifconfig $int inet delete $addr 418 done < /etc/ifaliases 419 fi 420 421 for int in $(/sbin/ifconfig -lu); do 422 eval args=\$ifaliases_$int 423 if [ -n "$args" ]; then 424 set -- $args 425 while [ $# -ge 2 ]; do 426 addr=$1 ; net=$2 ; shift 2 427 /sbin/ifconfig $int inet delete $addr 428 done 429 fi 430 done 431 432 # down interfaces 433 # 434 echo -n 'Downing network interfaces:' 435 if [ "$net_interfaces" != NO ]; then 436 if checkyesno auto_ifconfig; then 437 tmp=$(/sbin/ifconfig -l) 438 else 439 tmp="$net_interfaces" 440 fi 441 for int in $tmp; do 442 eval args=\$ifconfig_$int 443 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 444 echo -n " $int" 445 /sbin/dhcpcd -k $int 2> /dev/null 446 /sbin/ifconfig $int down 447 if /sbin/ifconfig $int destroy 2>/dev/null && \ 448 checkyesno ipfilter; then 449 # resync ipf(4) 450 /sbin/ipf -y >/dev/null 451 fi 452 fi 453 done 454 echo "." 455 fi 456 457 # flush routes 458 # 459 /sbin/route -qn flush 460 461} 462 463load_rc_config $name 464load_rc_config_var dhclient dhclient 465load_rc_config_var ipfilter ipfilter 466run_rc_command "$1" 467