network revision 1.63
1#!/bin/sh 2# 3# $NetBSD: network,v 1.63 2013/04/20 18:24:18 christos Exp $ 4# 5 6# PROVIDE: network 7# REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8# BEFORE: NETWORKING 9 10$_rc_subr_loaded . /etc/rc.subr 11 12name="network" 13start_cmd="network_start" 14stop_cmd="network_stop" 15 16nl=' 17' # a newline 18 19intmissing() { 20 local int="$1" 21 shift 22 for i 23 do 24 if [ "$int" = "$i" ]; then 25 return 1 26 fi 27 done 28 return 0 29} 30 31network_start() 32{ 33 # set hostname, turn on network 34 # 35 echo "Starting network." 36 37 # If $hostname is set, use it for my Internet name, 38 # otherwise use /etc/myname 39 # 40 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 41 hostname=$(cat /etc/myname) 42 fi 43 if [ -n "$hostname" ]; then 44 echo "Hostname: $hostname" 45 hostname $hostname 46 else 47 # Don't warn about it if we're going to run 48 # DHCP later, as we will probably get the 49 # hostname at that time. 50 # 51 if ! checkyesno dhclient && ! checkyesno dhcpcd && \ 52 [ -z "$(hostname)" ] 53 then 54 warn "\$hostname not set." 55 fi 56 fi 57 58 # Check $domainname first, then /etc/defaultdomain, 59 # for NIS/YP domain name 60 # 61 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 62 domainname=$(cat /etc/defaultdomain) 63 fi 64 if [ -n "$domainname" ]; then 65 echo "NIS domainname: $domainname" 66 domainname $domainname 67 fi 68 69 # Flush all routes just to make sure it is clean 70 if checkyesno flushroutes; then 71 /sbin/route -qn flush 72 fi 73 74 # Set the address for the first loopback interface, so that the 75 # auto-route from a newly configured interface's address to lo0 76 # works correctly. 77 # 78 # NOTE: obscure networking problems will occur if lo0 isn't configured. 79 # 80 /sbin/ifconfig lo0 inet 127.0.0.1 81 82 # According to RFC1122, 127.0.0.0/8 must not leave the node. 83 # 84 /sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 85 86 # IPv6 routing setups, and host/router mode selection. 87 # 88 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 89 # We have IPv6 support in kernel. 90 91 # disallow link-local unicast dest without outgoing scope 92 # identifiers. 93 # 94 /sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 95 96 # disallow the use of the RFC3849 documentation address 97 # 98 /sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject 99 100 # IPv6 site-local scoped address prefix (fec0::/10) 101 # has been deprecated by RFC3879. 102 # 103 if [ -n "$ip6sitelocal" ]; then 104 warn "\$ip6sitelocal is no longer valid" 105 fi 106 107 # disallow "internal" addresses to appear on the wire. 108 # 109 /sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 110 111 # disallow packets to malicious IPv4 compatible prefix 112 # 113 /sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 114 /sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 115 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 116 /sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 117 118 # disallow packets to malicious 6to4 prefix 119 # 120 /sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 121 /sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 122 /sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 123 /sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 124 125 # Completely disallow packets to IPv4 compatible prefix. 126 # This may conflict with RFC1933 under following circumstances: 127 # (1) An IPv6-only KAME node tries to originate packets to IPv4 128 # compatible destination. The KAME node has no IPv4 129 # compatible support. Under RFC1933, it should transmit 130 # native IPv6 packets toward IPv4 compatible destination, 131 # hoping it would reach a router that forwards the packet 132 # toward auto-tunnel interface. 133 # (2) An IPv6-only node originates a packet to IPv4 compatible 134 # destination. A KAME node is acting as an IPv6 router, and 135 # asked to forward it. 136 # Due to rare use of IPv4 compatible address, and security 137 # issues with it, we disable it by default. 138 # 139 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 140 141 /sbin/sysctl -qw net.inet6.ip6.forwarding=0 142 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=0 143 144 case $ip6mode in 145 router) 146 echo 'IPv6 mode: router' 147 /sbin/sysctl -qw net.inet6.ip6.forwarding=1 148 149 # disallow unique-local unicast forwarding without 150 # explicit configuration. 151 if ! checkyesno ip6uniquelocal; then 152 /sbin/route -q add -inet6 fc00:: -prefixlen 7 \ 153 ::1 -reject 154 fi 155 ;; 156 157 autohost) 158 echo 'IPv6 mode: autoconfigured host' 159 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=1 160 ;; 161 162 host) 163 echo 'IPv6 mode: host' 164 ;; 165 166 *) warn "invalid \$ip6mode value "\"$ip6mode\" 167 ;; 168 169 esac 170 fi 171 172 # Configure all of the network interfaces listed in $net_interfaces; 173 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 174 # In the following, "xxN" stands in for interface names, like "le0". 175 # 176 # For any interfaces that has an $ifconfig_xxN variable 177 # associated, we break it into lines using ';' as a separator, 178 # then process it just like the contents of an /etc/ifconfig.xxN 179 # file. 180 # 181 # For each line from the $ifconfig_xxN variable or the 182 # /etc/ifconfig.xxN file, we ignore comments and blank lines, 183 # treat lines beginning with "!" as commands to execute, treat 184 # "dhcp" as a special case to invoke dhcpcd, and for any other 185 # line we run "ifconfig xxN", using each line of the file as the 186 # arguments for a separate "ifconfig" invocation. 187 # 188 # In order to configure an interface reasonably, you at the very least 189 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 190 # and probably a netmask (as in "netmask 0xffffffe0"). You will 191 # frequently need to specify a media type, as in "media UTP", for 192 # interface cards with multiple media connections that do not 193 # autoconfigure. See the ifconfig manual page for details. 194 # 195 # Note that /etc/ifconfig.xxN takes multiple lines. The following 196 # configuration is possible: 197 # inet 10.1.1.1 netmask 0xffffff00 198 # inet 10.1.1.2 netmask 0xffffff00 alias 199 # inet6 2001:db8::1 prefixlen 64 alias 200 # 201 # You can put shell script fragment into /etc/ifconfig.xxN by 202 # starting a line with "!". Refer to ifconfig.if(5) for details. 203 # 204 if [ "$net_interfaces" != NO ]; then 205 ifaces="$(/sbin/ifconfig -l)" 206 if checkyesno auto_ifconfig; then 207 tmp="$ifaces" 208 for cloner in $(/sbin/ifconfig -C); do 209 for int in /etc/ifconfig.${cloner}[0-9]*; do 210 [ ! -f $int ] && break 211 tmp="$tmp ${int##*.}" 212 done 213 done 214 else 215 tmp="$net_interfaces" 216 fi 217 echo -n 'Configuring network interfaces:' 218 for int in $tmp; do 219 eval argslist=\$ifconfig_$int 220 221 # Skip interfaces that do not have explicit 222 # configuration information. If auto_ifconfig is 223 # false then also warn about such interfaces. 224 # 225 if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ] 226 then 227 if ! checkyesno auto_ifconfig; then 228 echo 229 warn \ 230 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 231 warn "interface $int not configured." 232 fi 233 continue 234 fi 235 236 echo -n " $int" 237 238 # Create the interface if necessary. 239 # If the interface did not exist before, 240 # then also resync ipf(4). 241 # 242 if intmissing $int $ifaces; then 243 if /sbin/ifconfig $int create && \ 244 checkyesno ipfilter; then 245 /sbin/ipf -y >/dev/null 246 fi 247 fi 248 249 # If $ifconfig_xxN is empty, then use 250 # /etc/ifconfig.xxN, which we know exists due to 251 # an earlier test. 252 # 253 # If $ifconfig_xxN is non-empty and contains a 254 # newline, then just use it as is. (This allows 255 # semicolons through unmolested.) 256 # 257 # If $ifconfig_xxN is non-empty and does not 258 # contain a newline, then convert all semicolons 259 # to newlines. 260 # 261 case "$argslist" in 262 '') 263 cat /etc/ifconfig.$int 264 ;; 265 *"${nl}"*) 266 echo "$argslist" 267 ;; 268 *) 269 ( 270 set -o noglob 271 IFS=';'; set -- $argslist 272 #echo >&2 "[$#] [$1] [$2] [$3] [$4]" 273 IFS="$nl"; echo "$*" 274 ) 275 ;; 276 esac | 277 collapse_backslash_newline | 278 while read -r args; do 279 case "$args" in 280 ''|"#"*|create) 281 ;; 282 "!"*) 283 # Run arbitrary command in a subshell. 284 ( eval "${args#*!}" ) 285 ;; 286 dhcp) 287 if ! checkyesno dhcpcd; then 288 /sbin/dhcpcd -n \ 289 ${dhcpcd_flags} $int 290 fi 291 ;; 292 *) 293 # Pass args to ifconfig. Note 294 # that args may contain embedded 295 # shell metacharacters, such as 296 # "ssid 'foo;*>bar'". We eval 297 # one more time so that things 298 # like ssid "Columbia University" work. 299 ( 300 set -o noglob 301 eval set -- $args 302 #echo >&2 "[$#] [$1] [$2] [$3]" 303 /sbin/ifconfig $int "$@" 304 ) 305 ;; 306 esac 307 done 308 configured_interfaces="$configured_interfaces $int" 309 done 310 echo "." 311 fi 312 313 echo -n "Adding interface aliases:" 314 315 # Check if each configured interface xxN has an $ifaliases_xxN variable 316 # associated, then configure additional IP addresses for that interface. 317 # The variable contains a list of "address netmask" pairs, with 318 # "netmask" set to "-" if the interface default netmask is to be used. 319 # 320 # Note that $ifaliases_xxN works only in certain cases and its 321 # use is not recommended. Use /etc/ifconfig.xxN or multiple 322 # commands in $ifconfig_xxN instead. 323 # 324 for int in lo0 $configured_interfaces; do 325 eval args=\$ifaliases_$int 326 if [ -n "$args" ]; then 327 set -- $args 328 while [ $# -ge 2 ]; do 329 addr=$1 ; net=$2 ; shift 2 330 if [ "$net" = "-" ]; then 331 # for compatibility only, obsolete 332 /sbin/ifconfig $int inet alias $addr 333 else 334 /sbin/ifconfig $int inet alias $addr \ 335 netmask $net 336 fi 337 echo -n " $int:$addr" 338 done 339 fi 340 done 341 342 # /etc/ifaliases, if it exists, contains the names of additional IP 343 # addresses for each interface. It is formatted as a series of lines 344 # that contain 345 # address interface netmask 346 # 347 # Note that /etc/ifaliases works only in certain cases and its 348 # use is not recommended. Use /etc/ifconfig.xxN or multiple 349 # commands in $ifconfig_xxN instead. 350 # 351 if [ -f /etc/ifaliases ]; then 352 while read addr int net; do 353 if [ -z "$net" ]; then 354 # for compatibility only, obsolete 355 /sbin/ifconfig $int inet alias $addr 356 else 357 /sbin/ifconfig $int inet alias $addr netmask $net 358 fi 359 done < /etc/ifaliases 360 fi 361 362 echo "." # for "Adding interface aliases:" 363 364 # Check $defaultroute, then /etc/mygate, for the name or address 365 # of my IPv4 gateway host. If using a name, that name must be in 366 # /etc/hosts. 367 # 368 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 369 defaultroute=$(cat /etc/mygate) 370 fi 371 if [ -n "$defaultroute" ]; then 372 /sbin/route add default $defaultroute 373 fi 374 375 # Check $defaultroute6, then /etc/mygate6, for the name or address 376 # of my IPv6 gateway host. If using a name, that name must be in 377 # /etc/hosts. Note that the gateway host address must be a link-local 378 # address if it is not using an stf* interface. 379 # 380 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 381 defaultroute6=$(cat /etc/mygate6) 382 fi 383 if [ -n "$defaultroute6" ]; then 384 if [ "$ip6mode" = "autohost" ]; then 385 echo 386 warn \ 387 "ip6mode is set to 'autohost' and a v6 default route is also set." 388 fi 389 /sbin/route add -inet6 default $defaultroute6 390 fi 391 392 # IPv6 interface autoconfiguration. 393 # 394 if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then 395 # wait till DAD is completed. always invoke it in case 396 # if are configured manually by ifconfig 397 # 398 echo 'Waiting for DAD completion for' \ 399 'statically configured addresses...' 400 dadcount=$(/sbin/sysctl -n net.inet6.ip6.dad_count 2>/dev/null) 401 sleep $dadcount 402 sleep 1 403 404 if checkyesno rtsol; then 405 if [ "$ip6mode" = "autohost" ]; then 406 echo 'Sending router solicitation...' 407 /sbin/rtsol $rtsol_flags 408 else 409 echo 410 warn \ 411 "ip6mode must be set to 'autohost' to use rtsol." 412 fi 413 414 # wait till DAD is completed, for global addresses 415 # configured by router advert message. 416 # 417 echo 'Waiting for DAD completion for' \ 418 'addresses configured by router advert message...' 419 sleep $dadcount 420 sleep 1 421 fi 422 fi 423 424 # XXX this must die 425 if [ -s /etc/netstart.local ]; then 426 sh /etc/netstart.local start 427 fi 428} 429 430network_stop() 431{ 432 echo "Stopping network." 433 434 # XXX this must die 435 if [ -s /etc/netstart.local ]; then 436 sh /etc/netstart.local stop 437 fi 438 439 echo "Deleting aliases." 440 if [ -f /etc/ifaliases ]; then 441 while read addr int net; do 442 /sbin/ifconfig $int inet delete $addr 443 done < /etc/ifaliases 444 fi 445 446 for int in $(/sbin/ifconfig -lu); do 447 eval args=\$ifaliases_$int 448 if [ -n "$args" ]; then 449 set -- $args 450 while [ $# -ge 2 ]; do 451 addr=$1 ; net=$2 ; shift 2 452 /sbin/ifconfig $int inet delete $addr 453 done 454 fi 455 done 456 457 # down interfaces 458 # 459 echo -n 'Downing network interfaces:' 460 if [ "$net_interfaces" != NO ]; then 461 if checkyesno auto_ifconfig; then 462 tmp=$(/sbin/ifconfig -l) 463 else 464 tmp="$net_interfaces" 465 fi 466 for int in $tmp; do 467 eval args=\$ifconfig_$int 468 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 469 echo -n " $int" 470 if [ -f /var/run/dhcpcd-$int.pid ]; then 471 /sbin/dhcpcd -k $int 2> /dev/null 472 fi 473 /sbin/ifconfig $int down 474 if /sbin/ifconfig $int destroy 2>/dev/null && \ 475 checkyesno ipfilter; then 476 # resync ipf(4) 477 /sbin/ipf -y >/dev/null 478 fi 479 fi 480 done 481 echo "." 482 fi 483 484 # flush routes 485 # 486 /sbin/route -qn flush 487 488} 489 490load_rc_config $name 491load_rc_config_var dhclient dhclient 492load_rc_config_var dhcpcd dhcpcd 493load_rc_config_var ipfilter ipfilter 494run_rc_command "$1" 495