network revision 1.71
1#!/bin/sh 2# 3# $NetBSD: network,v 1.71 2016/03/06 18:50:06 christos Exp $ 4# 5 6# PROVIDE: network 7# REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8# BEFORE: NETWORKING 9 10$_rc_subr_loaded . /etc/rc.subr 11 12name="network" 13start_cmd="network_start" 14stop_cmd="network_stop" 15 16nl=' 17' # a newline 18 19intmissing() 20{ 21 local int="$1" 22 shift 23 for i; do 24 if [ "$int" = "$i" ]; then 25 return 1 26 fi 27 done 28 return 0 29} 30 31have_inet6() 32{ 33 /sbin/ifconfig lo0 inet6 >/dev/null 2>&1 34} 35 36network_start() 37{ 38 # set hostname, turn on network 39 # 40 echo "Starting network." 41 42 network_start_hostname 43 network_start_domainname 44 network_start_loopback 45 have_inet6 && 46 network_start_ipv6_route 47 [ "$net_interfaces" != NO ] && 48 network_start_interfaces 49 network_start_aliases 50 network_start_defaultroute 51 network_start_defaultroute6 52 have_inet6 && 53 network_start_ipv6_autoconf 54 network_wait_dad 55 network_start_local 56} 57 58network_start_hostname() 59{ 60 # If $hostname is set, use it for my Internet name, 61 # otherwise use /etc/myname 62 # 63 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 64 hostname=$(kat /etc/myname) 65 fi 66 if [ -n "$hostname" ]; then 67 echo "Hostname: $hostname" 68 hostname $hostname 69 else 70 # Don't warn about it if we're going to run 71 # DHCP later, as we will probably get the 72 # hostname at that time. 73 # 74 if ! checkyesno dhclient && ! checkyesno dhcpcd && \ 75 [ -z "$(hostname)" ] 76 then 77 warn "\$hostname not set." 78 fi 79 fi 80} 81 82network_start_domainname() 83{ 84 # Check $domainname first, then /etc/defaultdomain, 85 # for NIS/YP domain name 86 # 87 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 88 domainname=$(kat /etc/defaultdomain) 89 fi 90 if [ -n "$domainname" ]; then 91 echo "NIS domainname: $domainname" 92 domainname $domainname 93 fi 94 95 # Flush all routes just to make sure it is clean 96 if checkyesno flushroutes; then 97 /sbin/route -qn flush 98 fi 99} 100 101network_start_loopback() 102{ 103 # Set the address for the first loopback interface, so that the 104 # auto-route from a newly configured interface's address to lo0 105 # works correctly. 106 # 107 # NOTE: obscure networking problems will occur if lo0 isn't configured. 108 # 109 /sbin/ifconfig lo0 inet 127.0.0.1 110 111 # According to RFC1122, 127.0.0.0/8 must not leave the node. 112 # 113 /sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 114} 115 116network_start_ipv6_route() 117{ 118 # IPv6 routing setups, and host/router mode selection. 119 # 120 # We have IPv6 support in kernel. 121 122 # disallow link-local unicast dest without outgoing scope 123 # identifiers. 124 # 125 /sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 126 127 # disallow the use of the RFC3849 documentation address 128 # 129 /sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject 130 131 # IPv6 site-local scoped address prefix (fec0::/10) 132 # has been deprecated by RFC3879. 133 # 134 if [ -n "$ip6sitelocal" ]; then 135 warn "\$ip6sitelocal is no longer valid" 136 fi 137 138 # disallow "internal" addresses to appear on the wire. 139 # 140 /sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 141 142 # disallow packets to malicious IPv4 compatible prefix 143 # 144 /sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 145 /sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 146 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 147 /sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 148 149 # disallow packets to malicious 6to4 prefix 150 # 151 /sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 152 /sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 153 /sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 154 /sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 155 156 # Completely disallow packets to IPv4 compatible prefix. 157 # This may conflict with RFC1933 under following circumstances: 158 # (1) An IPv6-only KAME node tries to originate packets to IPv4 159 # compatible destination. The KAME node has no IPv4 160 # compatible support. Under RFC1933, it should transmit 161 # native IPv6 packets toward IPv4 compatible destination, 162 # hoping it would reach a router that forwards the packet 163 # toward auto-tunnel interface. 164 # (2) An IPv6-only node originates a packet to IPv4 compatible 165 # destination. A KAME node is acting as an IPv6 router, and 166 # asked to forward it. 167 # Due to rare use of IPv4 compatible address, and security 168 # issues with it, we disable it by default. 169 # 170 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 171 172 /sbin/sysctl -qw net.inet6.ip6.forwarding=0 173 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=0 174 175 case $ip6mode in 176 router) 177 echo 'IPv6 mode: router' 178 /sbin/sysctl -qw net.inet6.ip6.forwarding=1 179 180 # disallow unique-local unicast forwarding without 181 # explicit configuration. 182 if ! checkyesno ip6uniquelocal; then 183 /sbin/route -q add -inet6 fc00:: -prefixlen 7 \ 184 ::1 -reject 185 fi 186 ;; 187 188 autohost) 189 echo 'IPv6 mode: autoconfigured host' 190 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=1 191 ;; 192 193 host) 194 echo 'IPv6 mode: host' 195 ;; 196 197 *) warn "invalid \$ip6mode value "\"$ip6mode\" 198 ;; 199 200 esac 201} 202 203network_start_interfaces() 204{ 205 # Configure all of the network interfaces listed in $net_interfaces; 206 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 207 # In the following, "xxN" stands in for interface names, like "le0". 208 # 209 # For any interfaces that has an $ifconfig_xxN variable 210 # associated, we break it into lines using ';' as a separator, 211 # then process it just like the contents of an /etc/ifconfig.xxN 212 # file. 213 # 214 # For each line from the $ifconfig_xxN variable or the 215 # /etc/ifconfig.xxN file, we ignore comments and blank lines, 216 # treat lines beginning with "!" as commands to execute, treat 217 # "dhcp" as a special case to invoke dhcpcd, and for any other 218 # line we run "ifconfig xxN", using each line of the file as the 219 # arguments for a separate "ifconfig" invocation. 220 # 221 # In order to configure an interface reasonably, you at the very least 222 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 223 # and probably a netmask (as in "netmask 0xffffffe0"). You will 224 # frequently need to specify a media type, as in "media UTP", for 225 # interface cards with multiple media connections that do not 226 # autoconfigure. See the ifconfig manual page for details. 227 # 228 # Note that /etc/ifconfig.xxN takes multiple lines. The following 229 # configuration is possible: 230 # inet 10.1.1.1 netmask 0xffffff00 231 # inet 10.1.1.2 netmask 0xffffff00 alias 232 # inet6 2001:db8::1 prefixlen 64 alias 233 # 234 # You can put shell script fragment into /etc/ifconfig.xxN by 235 # starting a line with "!". Refer to ifconfig.if(5) for details. 236 # 237 ifaces="$(/sbin/ifconfig -l)" 238 if checkyesno auto_ifconfig; then 239 tmp="$ifaces" 240 for cloner in $(/sbin/ifconfig -C); do 241 for int in /etc/ifconfig.${cloner}[0-9]*; do 242 [ ! -f $int ] && break 243 tmp="$tmp ${int##*.}" 244 done 245 done 246 else 247 tmp="$net_interfaces" 248 fi 249 echo -n 'Configuring network interfaces:' 250 for int in $tmp; do 251 eval argslist=\$ifconfig_$int 252 253 # Skip interfaces that do not have explicit 254 # configuration information. If auto_ifconfig is 255 # false then also warn about such interfaces. 256 # 257 if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ] 258 then 259 if ! checkyesno auto_ifconfig; then 260 echo 261 warn \ 262 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 263 warn "interface $int not configured." 264 fi 265 continue 266 fi 267 268 echo -n " $int" 269 270 # Create the interface if necessary. 271 # If the interface did not exist before, 272 # then also resync ipf(4). 273 # 274 if intmissing $int $ifaces; then 275 if /sbin/ifconfig $int create && \ 276 checkyesno ipfilter; then 277 /sbin/ipf -y >/dev/null 278 fi 279 fi 280 281 # If $ifconfig_xxN is empty, then use 282 # /etc/ifconfig.xxN, which we know exists due to 283 # an earlier test. 284 # 285 # If $ifconfig_xxN is non-empty and contains a 286 # newline, then just use it as is. (This allows 287 # semicolons through unmolested.) 288 # 289 # If $ifconfig_xxN is non-empty and does not 290 # contain a newline, then convert all semicolons 291 # to newlines. 292 # 293 case "$argslist" in 294 '') 295 cat /etc/ifconfig.$int 296 ;; 297 *"${nl}"*) 298 echo "$argslist" 299 ;; 300 *) 301 ( 302 set -o noglob 303 IFS=';'; set -- $argslist 304 #echo >&2 "[$#] [$1] [$2] [$3] [$4]" 305 IFS="$nl"; echo "$*" 306 ) 307 ;; 308 esac | 309 collapse_backslash_newline | 310 while read -r args; do 311 case "$args" in 312 ''|"#"*|create) 313 ;; 314 "!"*) 315 # Run arbitrary command in a subshell. 316 ( eval "${args#*!}" ) 317 ;; 318 dhcp) 319 if ! checkyesno dhcpcd; then 320 /sbin/dhcpcd -n \ 321 ${dhcpcd_flags} $int 322 fi 323 ;; 324 *) 325 # Pass args to ifconfig. Note 326 # that args may contain embedded 327 # shell metacharacters, such as 328 # "ssid 'foo;*>bar'". We eval 329 # one more time so that things 330 # like ssid "Columbia University" work. 331 ( 332 set -o noglob 333 eval set -- $args 334 #echo >&2 "[$#] [$1] [$2] [$3]" 335 /sbin/ifconfig $int "$@" 336 ) 337 ;; 338 esac 339 done 340 configured_interfaces="$configured_interfaces $int" 341 done 342 echo "." 343} 344 345network_start_aliases() 346{ 347 echo -n "Adding interface aliases:" 348 349 # Check if each configured interface xxN has an $ifaliases_xxN variable 350 # associated, then configure additional IP addresses for that interface. 351 # The variable contains a list of "address netmask" pairs, with 352 # "netmask" set to "-" if the interface default netmask is to be used. 353 # 354 # Note that $ifaliases_xxN works only in certain cases and its 355 # use is not recommended. Use /etc/ifconfig.xxN or multiple 356 # commands in $ifconfig_xxN instead. 357 # 358 for int in lo0 $configured_interfaces; do 359 eval args=\$ifaliases_$int 360 if [ -n "$args" ]; then 361 set -- $args 362 while [ $# -ge 2 ]; do 363 addr=$1 ; net=$2 ; shift 2 364 if [ "$net" = "-" ]; then 365 # for compatibility only, obsolete 366 /sbin/ifconfig $int inet alias $addr 367 else 368 /sbin/ifconfig $int inet alias $addr \ 369 netmask $net 370 fi 371 echo -n " $int:$addr" 372 done 373 fi 374 done 375 376 # /etc/ifaliases, if it exists, contains the names of additional IP 377 # addresses for each interface. It is formatted as a series of lines 378 # that contain 379 # address interface netmask 380 # 381 # Note that /etc/ifaliases works only in certain cases and its 382 # use is not recommended. Use /etc/ifconfig.xxN or multiple 383 # commands in $ifconfig_xxN instead. 384 # 385 if [ -f /etc/ifaliases ]; then 386 while read addr int net; do 387 if [ -z "$net" ]; then 388 # for compatibility only, obsolete 389 /sbin/ifconfig $int inet alias $addr 390 else 391 /sbin/ifconfig $int inet alias $addr netmask $net 392 fi 393 done < /etc/ifaliases 394 fi 395 396 echo "." # for "Adding interface aliases:" 397} 398 399network_start_defaultroute() 400{ 401 # Check $defaultroute, then /etc/mygate, for the name or address 402 # of my IPv4 gateway host. If using a name, that name must be in 403 # /etc/hosts. 404 # 405 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 406 defaultroute=$(kat /etc/mygate) 407 fi 408 if [ -n "$defaultroute" ]; then 409 /sbin/route add default $defaultroute 410 fi 411} 412 413network_start_defaultroute6() 414{ 415 # Check $defaultroute6, then /etc/mygate6, for the name or address 416 # of my IPv6 gateway host. If using a name, that name must be in 417 # /etc/hosts. Note that the gateway host address must be a link-local 418 # address if it is not using an stf* interface. 419 # 420 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 421 defaultroute6=$(kat /etc/mygate6) 422 fi 423 if [ -n "$defaultroute6" ]; then 424 if [ "$ip6mode" = "autohost" ]; then 425 echo 426 warn \ 427 "ip6mode is set to 'autohost' and a v6 default route is also set." 428 fi 429 /sbin/route add -inet6 default $defaultroute6 430 fi 431} 432 433network_start_ipv6_autoconf() 434{ 435 # IPv6 interface autoconfiguration. 436 437 # dhcpcd will ensure DAD completes before forking 438 if checkyesnox rtsol && ! checkyesno dhcpcd; then 439 if [ "$ip6mode" = "autohost" ]; then 440 echo 441 warn "rtsol has been removed, " \ 442 "please configure dhcpcd in its place." 443 fi 444 fi 445} 446 447network_wait_dad() 448{ 449 # Wait for the DAD flags to clear form all addresses. 450 if [ -n "$ifconfig_wait_dad_flags" ]; then 451 echo 'Waiting for DAD to complete for' \ 452 'statically configured addresses...' 453 ifconfig $ifconfig_wait_dad_flags 454 fi 455} 456 457network_start_local() 458{ 459 # XXX this must die 460 if [ -s /etc/netstart.local ]; then 461 sh /etc/netstart.local start 462 fi 463} 464 465network_stop() 466{ 467 echo "Stopping network." 468 469 network_stop_local 470 network_stop_aliases 471 [ "$net_interfaces" != NO ] && 472 network_stop_interfaces 473 network_stop_route 474} 475 476network_stop_local() 477{ 478 # XXX this must die 479 if [ -s /etc/netstart.local ]; then 480 sh /etc/netstart.local stop 481 fi 482} 483 484network_stop_aliases() 485{ 486 echo "Deleting aliases." 487 if [ -f /etc/ifaliases ]; then 488 while read addr int net; do 489 /sbin/ifconfig $int inet delete $addr 490 done < /etc/ifaliases 491 fi 492 493 for int in $(/sbin/ifconfig -lu); do 494 eval args=\$ifaliases_$int 495 if [ -n "$args" ]; then 496 set -- $args 497 while [ $# -ge 2 ]; do 498 addr=$1 ; net=$2 ; shift 2 499 /sbin/ifconfig $int inet delete $addr 500 done 501 fi 502 done 503} 504 505network_stop_interfaces() 506{ 507 # down interfaces 508 # 509 echo -n 'Downing network interfaces:' 510 if checkyesno auto_ifconfig; then 511 tmp=$(/sbin/ifconfig -l) 512 else 513 tmp="$net_interfaces" 514 fi 515 for int in $tmp; do 516 eval args=\$ifconfig_$int 517 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 518 echo -n " $int" 519 if [ -f /var/run/dhcpcd-$int.pid ]; then 520 /sbin/dhcpcd -k $int 2> /dev/null 521 fi 522 /sbin/ifconfig $int down 523 if /sbin/ifconfig $int destroy 2>/dev/null && \ 524 checkyesno ipfilter; then 525 # resync ipf(4) 526 /sbin/ipf -y >/dev/null 527 fi 528 fi 529 done 530 echo "." 531} 532 533network_stop_route() 534{ 535 # flush routes 536 # 537 /sbin/route -qn flush 538 539} 540 541load_rc_config $name 542load_rc_config_var dhclient dhclient 543load_rc_config_var dhcpcd dhcpcd 544load_rc_config_var ipfilter ipfilter 545run_rc_command "$1" 546