network revision 1.61.12.1
1#!/bin/sh 2# 3# $NetBSD: network,v 1.61.12.1 2012/11/20 02:57:56 tls Exp $ 4# 5 6# PROVIDE: network 7# REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8# BEFORE: NETWORKING 9 10$_rc_subr_loaded . /etc/rc.subr 11 12name="network" 13start_cmd="network_start" 14stop_cmd="network_stop" 15 16nl=' 17' # a newline 18 19network_start() 20{ 21 # set hostname, turn on network 22 # 23 echo "Starting network." 24 25 # If $hostname is set, use it for my Internet name, 26 # otherwise use /etc/myname 27 # 28 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 29 hostname=$(cat /etc/myname) 30 fi 31 if [ -n "$hostname" ]; then 32 echo "Hostname: $hostname" 33 hostname $hostname 34 else 35 # Don't warn about it if we're going to run 36 # DHCP later, as we will probably get the 37 # hostname at that time. 38 # 39 if ! checkyesno dhclient && ! checkyesno dhcpcd && \ 40 [ -z "$(hostname)" ] 41 then 42 warn "\$hostname not set." 43 fi 44 fi 45 46 # Check $domainname first, then /etc/defaultdomain, 47 # for NIS/YP domain name 48 # 49 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 50 domainname=$(cat /etc/defaultdomain) 51 fi 52 if [ -n "$domainname" ]; then 53 echo "NIS domainname: $domainname" 54 domainname $domainname 55 fi 56 57 # Flush all routes just to make sure it is clean 58 if checkyesno flushroutes; then 59 /sbin/route -qn flush 60 fi 61 62 # Set the address for the first loopback interface, so that the 63 # auto-route from a newly configured interface's address to lo0 64 # works correctly. 65 # 66 # NOTE: obscure networking problems will occur if lo0 isn't configured. 67 # 68 /sbin/ifconfig lo0 inet 127.0.0.1 69 70 # According to RFC1122, 127.0.0.0/8 must not leave the node. 71 # 72 /sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 73 74 # IPv6 routing setups, and host/router mode selection. 75 # 76 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 77 # We have IPv6 support in kernel. 78 79 # disallow link-local unicast dest without outgoing scope 80 # identifiers. 81 # 82 /sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 83 84 # disallow the use of the RFC3849 documentation address 85 # 86 /sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject 87 88 # IPv6 site-local scoped address prefix (fec0::/10) 89 # has been deprecated by RFC3879. 90 # 91 if [ -n "$ip6sitelocal" ]; then 92 warn "\$ip6sitelocal is no longer valid" 93 fi 94 95 # disallow "internal" addresses to appear on the wire. 96 # 97 /sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 98 99 # disallow packets to malicious IPv4 compatible prefix 100 # 101 /sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 102 /sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 103 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 104 /sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 105 106 # disallow packets to malicious 6to4 prefix 107 # 108 /sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 109 /sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 110 /sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 111 /sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 112 113 # Completely disallow packets to IPv4 compatible prefix. 114 # This may conflict with RFC1933 under following circumstances: 115 # (1) An IPv6-only KAME node tries to originate packets to IPv4 116 # compatible destination. The KAME node has no IPv4 117 # compatible support. Under RFC1933, it should transmit 118 # native IPv6 packets toward IPv4 compatible destination, 119 # hoping it would reach a router that forwards the packet 120 # toward auto-tunnel interface. 121 # (2) An IPv6-only node originates a packet to IPv4 compatible 122 # destination. A KAME node is acting as an IPv6 router, and 123 # asked to forward it. 124 # Due to rare use of IPv4 compatible address, and security 125 # issues with it, we disable it by default. 126 # 127 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 128 129 /sbin/sysctl -qw net.inet6.ip6.forwarding=0 130 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=0 131 132 case $ip6mode in 133 router) 134 echo 'IPv6 mode: router' 135 /sbin/sysctl -qw net.inet6.ip6.forwarding=1 136 137 # disallow unique-local unicast forwarding without 138 # explicit configuration. 139 if ! checkyesno ip6uniquelocal; then 140 /sbin/route -q add -inet6 fc00:: -prefixlen 7 \ 141 ::1 -reject 142 fi 143 ;; 144 145 autohost) 146 echo 'IPv6 mode: autoconfigured host' 147 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=1 148 ;; 149 150 host) 151 echo 'IPv6 mode: host' 152 ;; 153 154 *) warn "invalid \$ip6mode value "\"$ip6mode\" 155 ;; 156 157 esac 158 fi 159 160 # Configure all of the network interfaces listed in $net_interfaces; 161 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 162 # In the following, "xxN" stands in for interface names, like "le0". 163 # 164 # For any interfaces that has an $ifconfig_xxN variable 165 # associated, we break it into lines using ';' as a separator, 166 # then process it just like the contents of an /etc/ifconfig.xxN 167 # file. 168 # 169 # For each line from the $ifconfig_xxN variable or the 170 # /etc/ifconfig.xxN file, we ignore comments and blank lines, 171 # treat lines beginning with "!" as commands to execute, treat 172 # "dhcp" as a special case to invoke dhcpcd, and for any other 173 # line we run "ifconfig xxN", using each line of the file as the 174 # arguments for a separate "ifconfig" invocation. 175 # 176 # In order to configure an interface reasonably, you at the very least 177 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 178 # and probably a netmask (as in "netmask 0xffffffe0"). You will 179 # frequently need to specify a media type, as in "media UTP", for 180 # interface cards with multiple media connections that do not 181 # autoconfigure. See the ifconfig manual page for details. 182 # 183 # Note that /etc/ifconfig.xxN takes multiple lines. The following 184 # configuration is possible: 185 # inet 10.1.1.1 netmask 0xffffff00 186 # inet 10.1.1.2 netmask 0xffffff00 alias 187 # inet6 2001:db8::1 prefixlen 64 alias 188 # 189 # You can put shell script fragment into /etc/ifconfig.xxN by 190 # starting a line with "!". Refer to ifconfig.if(5) for details. 191 # 192 if [ "$net_interfaces" != NO ]; then 193 if checkyesno auto_ifconfig; then 194 tmp=$(/sbin/ifconfig -l) 195 for cloner in $(/sbin/ifconfig -C 2>/dev/null); do 196 for int in /etc/ifconfig.${cloner}[0-9]*; do 197 [ ! -f $int ] && break 198 tmp="$tmp ${int##*.}" 199 done 200 done 201 else 202 tmp="$net_interfaces" 203 fi 204 echo -n 'Configuring network interfaces:' 205 for int in $tmp; do 206 eval argslist=\$ifconfig_$int 207 208 # Skip interfaces that do not have explicit 209 # configuration information. If auto_ifconfig is 210 # false then also warn about such interfaces. 211 # 212 if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ] 213 then 214 if ! checkyesno auto_ifconfig; then 215 echo 216 warn \ 217 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 218 warn "interface $int not configured." 219 fi 220 continue 221 fi 222 223 echo -n " $int" 224 225 # Create the interface if necessary. 226 # If the interface did not exist before, 227 # then also resync ipf(4). 228 # 229 if /sbin/ifconfig $int create 2>/dev/null && \ 230 checkyesno ipfilter; then 231 /sbin/ipf -y >/dev/null 232 fi 233 234 # If $ifconfig_xxN is empty, then use 235 # /etc/ifconfig.xxN, which we know exists due to 236 # an earlier test. 237 # 238 # If $ifconfig_xxN is non-empty and contains a 239 # newline, then just use it as is. (This allows 240 # semicolons through unmolested.) 241 # 242 # If $ifconfig_xxN is non-empty and does not 243 # contain a newline, then convert all semicolons 244 # to newlines. 245 # 246 case "$argslist" in 247 '') 248 cat /etc/ifconfig.$int 249 ;; 250 *"${nl}"*) 251 echo "$argslist" 252 ;; 253 *) 254 ( 255 set -o noglob 256 IFS=';'; set -- $argslist 257 #echo >&2 "[$#] [$1] [$2] [$3] [$4]" 258 IFS="$nl"; echo "$*" 259 ) 260 ;; 261 esac | 262 collapse_backslash_newline | 263 while read -r args; do 264 case "$args" in 265 ''|"#"*|create) 266 ;; 267 "!"*) 268 # Run arbitrary command in a subshell. 269 ( eval "${args#*!}" ) 270 ;; 271 dhcp) 272 if ! checkyesno dhcpcd; then 273 /sbin/dhcpcd -n \ 274 ${dhcpcd_flags} $int 275 fi 276 ;; 277 *) 278 # Pass args to ifconfig. Note 279 # that args may contain embedded 280 # shell metacharacters, such as 281 # "ssid 'foo;*>bar'". We eval 282 # one more time so that things 283 # like ssid "Columbia University" work. 284 ( 285 set -o noglob 286 eval set -- $args 287 #echo >&2 "[$#] [$1] [$2] [$3]" 288 /sbin/ifconfig $int "$@" 289 ) 290 ;; 291 esac 292 done 293 configured_interfaces="$configured_interfaces $int" 294 done 295 echo "." 296 fi 297 298 echo -n "Adding interface aliases:" 299 300 # Check if each configured interface xxN has an $ifaliases_xxN variable 301 # associated, then configure additional IP addresses for that interface. 302 # The variable contains a list of "address netmask" pairs, with 303 # "netmask" set to "-" if the interface default netmask is to be used. 304 # 305 # Note that $ifaliases_xxN works only in certain cases and its 306 # use is not recommended. Use /etc/ifconfig.xxN or multiple 307 # commands in $ifconfig_xxN instead. 308 # 309 for int in lo0 $configured_interfaces; do 310 eval args=\$ifaliases_$int 311 if [ -n "$args" ]; then 312 set -- $args 313 while [ $# -ge 2 ]; do 314 addr=$1 ; net=$2 ; shift 2 315 if [ "$net" = "-" ]; then 316 # for compatibility only, obsolete 317 /sbin/ifconfig $int inet alias $addr 318 else 319 /sbin/ifconfig $int inet alias $addr \ 320 netmask $net 321 fi 322 echo -n " $int:$addr" 323 done 324 fi 325 done 326 327 # /etc/ifaliases, if it exists, contains the names of additional IP 328 # addresses for each interface. It is formatted as a series of lines 329 # that contain 330 # address interface netmask 331 # 332 # Note that /etc/ifaliases works only in certain cases and its 333 # use is not recommended. Use /etc/ifconfig.xxN or multiple 334 # commands in $ifconfig_xxN instead. 335 # 336 if [ -f /etc/ifaliases ]; then 337 while read addr int net; do 338 if [ -z "$net" ]; then 339 # for compatibility only, obsolete 340 /sbin/ifconfig $int inet alias $addr 341 else 342 /sbin/ifconfig $int inet alias $addr netmask $net 343 fi 344 done < /etc/ifaliases 345 fi 346 347 echo "." # for "Adding interface aliases:" 348 349 # Check $defaultroute, then /etc/mygate, for the name or address 350 # of my IPv4 gateway host. If using a name, that name must be in 351 # /etc/hosts. 352 # 353 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 354 defaultroute=$(cat /etc/mygate) 355 fi 356 if [ -n "$defaultroute" ]; then 357 /sbin/route add default $defaultroute 358 fi 359 360 # Check $defaultroute6, then /etc/mygate6, for the name or address 361 # of my IPv6 gateway host. If using a name, that name must be in 362 # /etc/hosts. Note that the gateway host address must be a link-local 363 # address if it is not using an stf* interface. 364 # 365 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 366 defaultroute6=$(cat /etc/mygate6) 367 fi 368 if [ -n "$defaultroute6" ]; then 369 if [ "$ip6mode" = "autohost" ]; then 370 echo 371 warn \ 372 "ip6mode is set to 'autohost' and a v6 default route is also set." 373 fi 374 /sbin/route add -inet6 default $defaultroute6 375 fi 376 377 # IPv6 interface autoconfiguration. 378 # 379 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 380 # wait till DAD is completed. always invoke it in case 381 # if are configured manually by ifconfig 382 # 383 echo 'Waiting for DAD completion for' \ 384 'statically configured addresses...' 385 dadcount=$(/sbin/sysctl -n net.inet6.ip6.dad_count 2>/dev/null) 386 sleep $dadcount 387 sleep 1 388 389 if checkyesno rtsol; then 390 if [ "$ip6mode" = "autohost" ]; then 391 echo 'Sending router solicitation...' 392 /sbin/rtsol $rtsol_flags 393 else 394 echo 395 warn \ 396 "ip6mode must be set to 'autohost' to use rtsol." 397 fi 398 399 # wait till DAD is completed, for global addresses 400 # configured by router advert message. 401 # 402 echo 'Waiting for DAD completion for' \ 403 'addresses configured by router advert message...' 404 sleep $dadcount 405 sleep 1 406 fi 407 fi 408 409 # XXX this must die 410 if [ -s /etc/netstart.local ]; then 411 sh /etc/netstart.local start 412 fi 413} 414 415network_stop() 416{ 417 echo "Stopping network." 418 419 # XXX this must die 420 if [ -s /etc/netstart.local ]; then 421 sh /etc/netstart.local stop 422 fi 423 424 echo "Deleting aliases." 425 if [ -f /etc/ifaliases ]; then 426 while read addr int net; do 427 /sbin/ifconfig $int inet delete $addr 428 done < /etc/ifaliases 429 fi 430 431 for int in $(/sbin/ifconfig -lu); do 432 eval args=\$ifaliases_$int 433 if [ -n "$args" ]; then 434 set -- $args 435 while [ $# -ge 2 ]; do 436 addr=$1 ; net=$2 ; shift 2 437 /sbin/ifconfig $int inet delete $addr 438 done 439 fi 440 done 441 442 # down interfaces 443 # 444 echo -n 'Downing network interfaces:' 445 if [ "$net_interfaces" != NO ]; then 446 if checkyesno auto_ifconfig; then 447 tmp=$(/sbin/ifconfig -l) 448 else 449 tmp="$net_interfaces" 450 fi 451 for int in $tmp; do 452 eval args=\$ifconfig_$int 453 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 454 echo -n " $int" 455 if [ -f /var/run/dhcpcd-$int.pid ]; then 456 /sbin/dhcpcd -k $int 2> /dev/null 457 fi 458 /sbin/ifconfig $int down 459 if /sbin/ifconfig $int destroy 2>/dev/null && \ 460 checkyesno ipfilter; then 461 # resync ipf(4) 462 /sbin/ipf -y >/dev/null 463 fi 464 fi 465 done 466 echo "." 467 fi 468 469 # flush routes 470 # 471 /sbin/route -qn flush 472 473} 474 475load_rc_config $name 476load_rc_config_var dhclient dhclient 477load_rc_config_var dhcpcd dhcpcd 478load_rc_config_var ipfilter ipfilter 479run_rc_command "$1" 480