netstart revision 1.178
1#!/bin/sh - 2# 3# $OpenBSD: netstart,v 1.178 2017/04/25 19:17:33 rpe Exp $ 4 5# Turn off Strict Bourne shell mode. 6set +o sh 7 8# Echo file $1 to stdout. Skip comment lines and delete everything 9# after the first '#' from other lines. Strip leading and trailing 10# whitespace if IFS is set. 11# Usage: stripcom /path/to/file 12stripcom() { 13 local _file=$1 _line 14 15 [[ -f $_file ]] || return 16 17 while read _line; do 18 [[ -n ${_line%%#*} ]] && print -r -- "$_line" 19 done <$_file 20} 21 22# Parse and "unpack" a hostname.if(5) line given as positional parameters. 23# Fill the _cmds array with the resulting interface configuration commands. 24parse_hn_line() { 25 local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr 26 set -A _c -- "$@" 27 set -o noglob 28 29 case ${_c[_af]} in 30 ''|*([[:blank:]])'#'*) 31 return 32 ;; 33 inet) ((${#_c[*]} > 1)) || return 34 [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4 35 [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}" 36 if [[ -n ${_c[_bc]} ]]; then 37 _c[_bc]="broadcast ${_c[_bc]}" 38 [[ ${_c[_bc]} == *NONE ]] && _c[_bc]= 39 fi 40 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 41 ;; 42 inet6) ((${#_c[*]} > 1)) || return 43 if [[ ${_c[_name]} == autoconf ]]; then 44 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 45 rtsolif="$rtsolif $_if" 46 return 47 fi 48 [[ ${_c[_name]} == alias ]] && _prefix=3 49 [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}" 50 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 51 ;; 52 dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return 53 _prev=$((${#_cmds[*]} - 1)) 54 ((_prev >= 0)) || return 55 set -A _c -- ${_cmds[_prev]} 56 _name=3 57 [[ ${_c[_name]} == alias ]] && _name=4 58 _c[_name]="${_c[_name]} $_daddr" 59 _cmds[$_prev]="${_c[@]}" 60 ;; 61 dhcp) _c[0]= 62 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} down;dhclient $_if" 63 dhcpif="$dhcpif $_if" 64 ;; 65 rtsol) # XXX Support the rtsol keyword for some time to enable a smooth 66 # XXX transition to autoconf. 67 _c[0]= 68 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} up" 69 _cmds[${#_cmds[*]}]="ifconfig $_if inet6 autoconf" 70 rtsolif="$rtsolif $_if" 71 ;; 72 '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g') 73 _cmds[${#_cmds[*]}]="${_cmd#!}" 74 ;; 75 *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 76 ;; 77 esac 78 unset _c 79 set +o noglob 80} 81 82# Start a single interface. 83# Usage: ifstart if1 84ifstart() { 85 local _if=$1 _file=$HN_DIR/hostname.$1 _cmds _i=0 _line _stat 86 set -A _cmds 87 88 # Interface names must be alphanumeric only. We check to avoid 89 # configuring backup or temp files, and to catch the "*" case. 90 [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return 91 92 if [[ ! -f $_file ]]; then 93 echo "netstart: $_file: No such file or directory" 94 return 95 fi 96 97 # Not using stat(1), we can't rely on having /usr yet. 98 set -A _stat -- $(ls -nL $_file) 99 if [ "${_stat[0]#???????} ${_stat[2]} ${_stat[3]}" != "--- 0 0" ]; then 100 echo "WARNING: $_file is insecure, fixing permissions" 101 chmod -LR o-rwx $_file 102 chown -LR root.wheel $_file 103 fi 104 105 # Check for ifconfig'able interface, except if -n option is specified. 106 if ! $PRINT_ONLY; then 107 (ifconfig $_if || ifconfig $_if create) >/dev/null 2>&1 || 108 return 109 fi 110 111 # Parse the hostname.if(5) file and fill _cmds array with interface 112 # configuration commands. 113 set -o noglob 114 while IFS= read -- _line; do 115 parse_hn_line $_line 116 done <$_file 117 118 # Apply the interface configuration commands stored in _cmds array. 119 while ((_i < ${#_cmds[*]})); do 120 if $PRINT_ONLY; then 121 print -r -- "${_cmds[_i]}" 122 else 123 eval "${_cmds[_i]}" 124 fi 125 ((_i++)) 126 done 127 unset _cmds 128 set +o noglob 129} 130 131# Start multiple interfaces by driver name. 132# Usage: ifmstart "em iwm" "trunk vlan" 133# Start "$1" interfaces in order or all interfaces if empty. 134# Don't start "$2" interfaces. "$2" is optional. 135ifmstart() { 136 local _sifs=$1 _xifs=$2 _hn _if _sif _xif 137 138 for _sif in ${_sifs:-ALL}; do 139 for _hn in /etc/hostname.*; do 140 _if=${_hn#/etc/hostname.} 141 [[ $_if == '*' ]] && continue 142 143 # Skip unwanted ifs. 144 for _xif in $_xifs; do 145 [[ $_xif == ${_if%%[0-9]*} ]] && continue 2 146 done 147 148 # Start wanted ifs. 149 [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if 150 done 151 done 152} 153 154# IPv6 autoconf the interfaces in the $rtsolif list. 155# Usage: ifv6autoconf 156ifv6autoconf() { 157 local _if 158 159 # $ip6kernel will not have been set if we were invoked with a 160 # list of interface names 161 ifconfig lo0 inet6 >/dev/null 2>&1 || return 0 162 163 for _if in $rtsolif; do 164 ifconfig $_if inet6 autoconf 165 done 166} 167 168# Parse /etc/mygate and add default routes for IPv4 and IPv6 169# Usage: defaultroute 170defaultroute() { 171 [[ -z $dhcpif ]] && stripcom /etc/mygate | while read gw; do 172 [[ $gw == @(*:*) ]] && continue 173 route -qn delete default >/dev/null 2>&1 174 route -qn add -host default $gw && break 175 done 176 [[ -z $rtsolif ]] && stripcom /etc/mygate | while read gw; do 177 [[ $gw == !(*:*) ]] && continue 178 route -qn delete -inet6 default >/dev/null 2>&1 179 route -qn add -host -inet6 default $gw && break 180 done 181} 182 183# Make sure the invoking user has the right privileges. 184if (($(id -u) != 0)); then 185 echo "${0##*/}: need root privileges" 186 exit 1 187fi 188 189# Get network related vars from rc.conf using the parsing routine from rc.subr. 190FUNCS_ONLY=1 . /etc/rc.d/rc.subr 191_rc_parse_conf 192 193HN_DIR=${HN_DIR:-/etc} 194PRINT_ONLY=false 195USAGE="USAGE: ${0##*/} [-n] [interface ...]" 196while getopts ":n" opt; do 197 case $opt in 198 n) PRINT_ONLY=true;; 199 *) print -u2 "$USAGE"; exit 1;; 200 esac 201done 202shift $((OPTIND-1)) 203 204# Option -n is only supported if interface names are specified as parameters. 205if $PRINT_ONLY && (($# == 0)); then 206 print -u2 "Missing parameters.\n$USAGE" 207 exit 1 208fi 209 210# If we were invoked with a list of interface names, just reconfigure these 211# interfaces (or bridges), add default routes and return. 212if (($# > 0)); then 213 for _if; do ifstart $_if; done 214 ifv6autoconf 215 defaultroute 216 return 217fi 218 219# Otherwise, process with the complete network initialization. 220 221# /etc/myname contains my symbolic name. 222[[ -f /etc/myname ]] && hostname "$(stripcom /etc/myname)" 223 224# Set the address for the loopback interface. Bringing the interface up, 225# automatically invokes the IPv6 address ::1. 226ifconfig lo0 inet 127.0.0.1/8 227 228if ifconfig lo0 inet6 >/dev/null 2>&1; then 229 # IPv6 configurations. 230 ip6kernel=YES 231 232 # Disallow link-local unicast dest without outgoing scope identifiers. 233 route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject >/dev/null 234 235 # Disallow site-local unicast dest without outgoing scope identifiers. 236 # If you configure site-locals without scope id (it is permissible 237 # config for routers that are not on scope boundary), you may want 238 # to comment the line out. 239 route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject >/dev/null 240 241 # Disallow "internal" addresses to appear on the wire. 242 route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null 243 244 # Disallow packets to malicious IPv4 compatible prefix. 245 route -qn add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject >/dev/null 246 route -qn add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 247 route -qn add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 248 route -qn add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 249 250 # Disallow packets to malicious 6to4 prefix. 251 route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null 252 route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null 253 route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject >/dev/null 254 route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject >/dev/null 255 256 # Disallow packets without scope identifier. 257 route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject >/dev/null 258 route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject >/dev/null 259 260 # Completely disallow packets to IPv4 compatible prefix. 261 # 262 # This may conflict with RFC1933 under following circumstances: 263 # (1) An IPv6-only KAME node tries to originate packets to IPv4 264 # compatible destination. The KAME node has no IPv4 compatible 265 # support. Under RFC1933, it should transmit native IPv6 266 # packets toward IPv4 compatible destination, hoping it would 267 # reach a router that forwards the packet toward auto-tunnel 268 # interface. 269 # (2) An IPv6-only node originates a packet to an IPv4 compatible 270 # destination. A KAME node is acting as an IPv6 router, and 271 # asked to forward it. 272 # 273 # Due to rare use of IPv4 compatible addresses, and security issues 274 # with it, we disable it by default. 275 route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null 276 277 rtsolif="" 278else 279 ip6kernel=NO 280fi 281 282 283# Configure all the non-loopback interfaces which we know about, but 284# do not start interfaces which must be delayed. Refer to hostname.if(5) 285ifmstart "" "trunk svlan vlan carp gif gre pfsync pppoe tun bridge switch pflow" 286 287# The trunk interfaces need to come up first in this list. 288# The (s)vlan interfaces need to come up after trunk. 289# Configure all the carp interfaces which we know about before default route. 290ifmstart "trunk svlan vlan carp" 291 292# Now that $rtsolif has been populated, IPv6 autoconf those interfaces 293ifv6autoconf 294 295# Look for default routes in /etc/mygate. 296defaultroute 297 298# Multicast routing. 299if [[ $multicast != YES ]]; then 300 route -qn delete 224.0.0.0/4 >/dev/null 2>&1 301 route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null 302fi 303 304# Configure PPPoE, GIF, GRE, TUN and PFLOW interfaces, delayed because they 305# require routes to be set. TUN might depend on PPPoE, and GIF or GRE may 306# depend on either of them. PFLOW might bind to ip addresses configured 307# on either of them. 308ifmstart "pppoe tun gif gre bridge switch pflow" 309 310# Reject 127/8 other than 127.0.0.1. 311route -qn add -net 127 127.0.0.1 -reject >/dev/null 312 313if [[ $ip6kernel == YES ]]; then 314 # This is to make sure DAD is completed before going further. 315 count=0 316 while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do 317 sleep 1 318 done 319fi 320