netstart revision 1.187
1#!/bin/sh - 2# 3# $OpenBSD: netstart,v 1.187 2017/11/12 21:58:00 tb Exp $ 4 5# Turn off Strict Bourne shell mode. 6set +o sh 7 8# Echo file $1 to stdout. Skip comment lines and delete everything 9# after the first '#' from other lines. Strip leading and trailing 10# whitespace if IFS is set. 11# Usage: stripcom /path/to/file 12stripcom() { 13 local _file=$1 _line 14 15 [[ -f $_file ]] || return 16 17 while read _line; do 18 [[ -n ${_line%%#*} ]] && print -r -- "$_line" 19 done <$_file 20} 21 22# Parse and "unpack" a hostname.if(5) line given as positional parameters. 23# Fill the _cmds array with the resulting interface configuration commands. 24parse_hn_line() { 25 local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr 26 set -A _c -- "$@" 27 set -o noglob 28 29 case ${_c[_af]} in 30 ''|*([[:blank:]])'#'*) 31 return 32 ;; 33 inet) ((${#_c[*]} > 1)) || return 34 [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4 35 [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}" 36 if [[ -n ${_c[_bc]} ]]; then 37 _c[_bc]="broadcast ${_c[_bc]}" 38 [[ ${_c[_bc]} == *NONE ]] && _c[_bc]= 39 fi 40 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 41 ;; 42 inet6) ((${#_c[*]} > 1)) || return 43 if [[ ${_c[_name]} == autoconf ]]; then 44 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 45 V6_AUTOCONF=true 46 return 47 fi 48 [[ ${_c[_name]} == alias ]] && _prefix=3 49 [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}" 50 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 51 ;; 52 dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return 53 _prev=$((${#_cmds[*]} - 1)) 54 ((_prev >= 0)) || return 55 set -A _c -- ${_cmds[_prev]} 56 _name=3 57 [[ ${_c[_name]} == alias ]] && _name=4 58 _c[_name]="${_c[_name]} $_daddr" 59 _cmds[$_prev]="${_c[@]}" 60 ;; 61 dhcp) _c[0]= 62 _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} down;dhclient $_if" 63 V4_DHCPCONF=true 64 ;; 65 '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g') 66 _cmds[${#_cmds[*]}]="${_cmd#!}" 67 ;; 68 *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}" 69 ;; 70 esac 71 unset _c 72 set +o noglob 73} 74 75# Start a single interface. 76# Usage: ifstart if1 77ifstart() { 78 local _if=$1 _hn=/etc/hostname.$1 _cmds _i=0 _line _stat 79 set -A _cmds 80 81 # Interface names must be alphanumeric only. We check to avoid 82 # configuring backup or temp files, and to catch the "*" case. 83 [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return 84 85 if [[ ! -f $_hn ]]; then 86 echo "${0##*/}: $_hn: No such file or directory" 87 return 88 fi 89 90 # Not using stat(1), we can't rely on having /usr yet. 91 set -A _stat -- $(ls -nL $_hn) 92 if [[ "${_stat[0]}${_stat[2]}${_stat[3]}" != *---00 ]]; then 93 echo "WARNING: $_hn is insecure, fixing permissions" 94 chmod -LR o-rwx $_hn 95 chown -LR root:wheel $_hn 96 fi 97 98 # Check for ifconfig'able interface, except if -n option is specified. 99 if ! $PRINT_ONLY; then 100 (ifconfig $_if || ifconfig $_if create) >/dev/null 2>&1 || 101 return 102 fi 103 104 # Parse the hostname.if(5) file and fill _cmds array with interface 105 # configuration commands. 106 set -o noglob 107 while IFS= read -- _line; do 108 parse_hn_line $_line 109 done <$_hn 110 111 # Apply the interface configuration commands stored in _cmds array. 112 while ((_i < ${#_cmds[*]})); do 113 if $PRINT_ONLY; then 114 print -r -- "${_cmds[_i]}" 115 else 116 eval "${_cmds[_i]}" 117 fi 118 ((_i++)) 119 done 120 unset _cmds 121 set +o noglob 122} 123 124# Start multiple interfaces by driver name. 125# Usage: ifmstart "em iwm" "trunk vlan" 126# Start "$1" interfaces in order or all interfaces if empty. 127# Don't start "$2" interfaces. "$2" is optional. 128ifmstart() { 129 local _sifs=$1 _xifs=$2 _hn _if _sif _xif 130 131 for _sif in ${_sifs:-ALL}; do 132 for _hn in /etc/hostname.*; do 133 _if=${_hn#/etc/hostname.} 134 [[ $_if == '*' ]] && continue 135 136 # Skip unwanted ifs. 137 for _xif in $_xifs; do 138 [[ $_xif == ${_if%%[0-9]*} ]] && continue 2 139 done 140 141 # Start wanted ifs. 142 [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if 143 done 144 done 145} 146 147# Parse /etc/mygate and add default routes for IPv4 and IPv6 148# Usage: defaultroute 149defaultroute() { 150 ! $V4_DHCPCONF && stripcom /etc/mygate | 151 while read gw; do 152 [[ $gw == @(*:*) ]] && continue 153 route -qn add -host default $gw && break 154 done 155 ! $V6_AUTOCONF && stripcom /etc/mygate | 156 while read gw; do 157 [[ $gw == !(*:*) ]] && continue 158 route -qn add -host -inet6 default $gw && break 159 done 160} 161 162# Get network related vars from rc.conf using the parsing routine from rc.subr. 163FUNCS_ONLY=1 . /etc/rc.d/rc.subr 164_rc_parse_conf 165 166PRINT_ONLY=false 167USAGE="USAGE: ${0##*/} [-n] [interface ...]" 168V4_DHCPCONF=false 169V6_AUTOCONF=false 170 171while getopts ":n" opt; do 172 case $opt in 173 n) PRINT_ONLY=true;; 174 *) print -u2 "$USAGE"; exit 1;; 175 esac 176done 177shift $((OPTIND-1)) 178 179# Option -n is only supported if interface names are specified as parameters. 180if $PRINT_ONLY && (($# == 0)); then 181 print -u2 "Missing parameters.\n$USAGE" 182 exit 1 183fi 184 185# If we were invoked with a list of interface names, just reconfigure these 186# interfaces (or bridges), add default routes and return. 187if (($# > 0)); then 188 for _if; do ifstart $_if; done 189 defaultroute 190 return 191fi 192 193# Otherwise, process with the complete network initialization. 194 195# /etc/myname contains my symbolic name. 196[[ -f /etc/myname ]] && hostname "$(stripcom /etc/myname)" 197 198# Set the address for the loopback interface. Bringing the interface up, 199# automatically invokes the IPv6 address ::1. 200ifconfig lo0 inet 127.0.0.1/8 201 202if ifconfig lo0 inet6 >/dev/null 2>&1; then 203 # IPv6 configurations. 204 ip6kernel=YES 205 206 # Disallow link-local unicast dest without outgoing scope identifiers. 207 route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject >/dev/null 208 209 # Disallow site-local unicast dest without outgoing scope identifiers. 210 # If you configure site-locals without scope id (it is permissible 211 # config for routers that are not on scope boundary), you may want 212 # to comment the line out. 213 route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject >/dev/null 214 215 # Disallow "internal" addresses to appear on the wire. 216 route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null 217 218 # Disallow packets to malicious IPv4 compatible prefix. 219 route -qn add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject >/dev/null 220 route -qn add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 221 route -qn add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 222 route -qn add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject >/dev/null 223 224 # Disallow packets to malicious 6to4 prefix. 225 route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null 226 route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null 227 route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject >/dev/null 228 route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject >/dev/null 229 230 # Disallow packets without scope identifier. 231 route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject >/dev/null 232 route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject >/dev/null 233 234 # Completely disallow packets to IPv4 compatible prefix. 235 # 236 # This may conflict with RFC1933 under following circumstances: 237 # (1) An IPv6-only KAME node tries to originate packets to IPv4 238 # compatible destination. The KAME node has no IPv4 compatible 239 # support. Under RFC1933, it should transmit native IPv6 240 # packets toward IPv4 compatible destination, hoping it would 241 # reach a router that forwards the packet toward auto-tunnel 242 # interface. 243 # (2) An IPv6-only node originates a packet to an IPv4 compatible 244 # destination. A KAME node is acting as an IPv6 router, and 245 # asked to forward it. 246 # 247 # Due to rare use of IPv4 compatible addresses, and security issues 248 # with it, we disable it by default. 249 route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null 250else 251 ip6kernel=NO 252fi 253 254 255# Configure all the non-loopback interfaces which we know about, but 256# do not start interfaces which must be delayed. Refer to hostname.if(5) 257ifmstart "" "trunk svlan vlan carp gif gre pfsync pppoe tun bridge switch pflow" 258 259# The trunk interfaces need to come up first in this list. 260# The (s)vlan interfaces need to come up after trunk. 261# Configure all the carp interfaces which we know about before default route. 262ifmstart "trunk svlan vlan carp" 263 264# Look for default routes in /etc/mygate. 265defaultroute 266 267# Multicast routing. 268if [[ $multicast != YES ]]; then 269 route -qn delete 224.0.0.0/4 >/dev/null 2>&1 270 route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null 271fi 272 273# Configure PPPoE, GIF, GRE, TUN and PFLOW interfaces, delayed because they 274# require routes to be set. TUN might depend on PPPoE, and GIF or GRE may 275# depend on either of them. PFLOW might bind to ip addresses configured 276# on either of them. 277ifmstart "pppoe tun gif gre bridge switch pflow" 278 279# Reject 127/8 other than 127.0.0.1. 280route -qn add -net 127 127.0.0.1 -reject >/dev/null 281 282if [[ $ip6kernel == YES ]]; then 283 # This is to make sure DAD is completed before going further. 284 count=0 285 while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do 286 sleep 1 287 done 288fi 289